DLL error pop ups when booting up

By pikabox
Aug 22, 2012
Topic Status:
Not open for further replies.
  1. I recent got infected by the sirefef virus but it has now been cleaned. But now everytime I boot up my computer I'll get RunDLL pop up messages stating:
    1. There was a problem starting C:\Users\Barbara\AppData\Roaming\ndhuig.dll
    and
    2. C:\Users\Barbara\AppData\Roaming\psfcer.dll

    what does this mean and how can this be fixed?
  2. WinXPert

    WinXPert TechSpot Booster Posts: 527

    Try CCleaner

    clean your temps and scan for issues
  3. pikabox

    pikabox Newcomer, in training Topic Starter Posts: 17

    I've cleaned the temps using ccleaner already, but the pop up still occurs. How do you scan for issues?
  4. WinXPert

    WinXPert TechSpot Booster Posts: 527

  5. Bobbye

    Bobbye Helper on the Fringe Posts: 16,392   +35

    You still -or again- have malware entries. You don't run a cleaning program just to remove mystery entries!

    Entries on previous Combofix log:

    =====================================
    Please go to VirSCAN.org FREE on-line scan service:
    If busy, you can use one of the following: ( you only need one)
    VirusTotal
    Jotti
    • Copy and paste the following file path into the Suspicious files to scan box on the top of the page.
    Code:
    C:\Users\Barbara\AppData\Roaming\ndhuig.dll
    C:\Users\Barbara\AppData\Roaming\psfcer.dll 
    • At the upload site, click once inside the window next to Browse.
    • Press Ctrl+V on the keyboard (both at the same time) to paste the file path into the window.
    • Click on the Upload button.
      This will perform a scan across multiple different virus scanning engines.
      Your file will possibly be entered into a queue which normally takes less than a minute to clear.
      Important: Wait for all of the scanning engines to complete.
    • Once the Scan is completed scroll down and click on the Copy to Clipboard button. This will copy the link of the report into the Clipboard.
    • Paste the contents of the Clipboard in your next reply.
    ======================================
    What are the following?
    1) ¡¥p¹º¥ô°È¡¦ ¤å¥ó§¨ ¸Ìªº¤º®e

    2) §¹¦¨®É¶¡: 2012-08-17 11:19:34 - ¹q¸£¤w«·s±Ò°Ê
    ComboFix-quarantined-files.txt 2012-08-17 01:19
    ------------------------------------
    It's possible that if some processes are in another language, the scanner may not pick it up.
    ===================================
    I'd like you to run the Eset scan again please. NOTE my direction to UNCHECK 'remove found threats.' I will handle them if any are found:

    To run the Eset Online Virus Scan:
    If you use Internet Explorer:
    1. Open the ESETOnlineScan
    2. Skip to #4 to "Continue with the directions"

      If you are using a browser other than Internet Explorer
    3. Open Eset Smart Installer
      [o] Click on the esetsmartinstaller_enu.exelink and save to the desktop.
      [o] Double click on the desktop icon to run.
      [o] After successful installation of the ESET Smart Installer, the ESET Online Scanner will be launched in a new Window
    4. Continue with the directions.
    5. Check 'Yes I accept terms of use.'
    6. Click Start button
    7. Accept any security warnings from your browser.
      [​IMG]
    8. Uncheck 'Remove found threats'
    9. Check 'Scan archives/
    10. Leave remaining settings as is.
    11. Press the Start button.
    12. ESET will then download updates for itself, install itself, and begin scanning your computer. Please wait for the scan to finish.
    13. When the scan completes, press List of found threats
    14. Push Export of text file and save the file to your desktop using a unique name, such as ESETScan. Paste this log in your next reply.
    15. Push the Back button, then Finish
    NOTE: If no malware is found then no log will be produced. Let me know if this is the case.
    =================================
    Do you still have Combofix on the system. If not, I will give directions for it. Please don't run by yourself.
  6. pikabox

    pikabox Newcomer, in training Topic Starter Posts: 17

    Oh, I wasn't aware before and I've run CCleaner but I forgot to post back. I rebooted and only the psfcer.dll shows up on boot up now. But when I try to insert the file, C:\Users\Barbara\AppData\Roaming\psfcer.dll, into the suspicious file box, the browse option says the file cannot be found and thus cannot be uploaded.
  7. Jay Pfoutz

    Jay Pfoutz Malware Helper Posts: 4,286   +49

    This is not a malware issue. It is more based on operating system errors. Therefore, it has been moved back. Thanks!
  8. Bobbye

    Bobbye Helper on the Fringe Posts: 16,392   +35

    StrToUintA> identified as Trojan

    Jay, if you feel this is a system problem, please identify these processes:
    ndhuig.dll
    psfcer.dll

    Please don't confuse the member when I have identified a file as malware.
  9. pikabox

    pikabox Newcomer, in training Topic Starter Posts: 17

    I'm still not sure on how I am to proceed?
  10. mailpup

    mailpup TS Special Forces Posts: 8,385   +205

    Bobbye, if this problem is malware, then this thread should be in Virus and Malware, not here.
  11. Jay Pfoutz

    Jay Pfoutz Malware Helper Posts: 4,286   +49

    ndhuig.dll was deleted already.
    The second file was probably missed.

    We can fix that...

    Go to Start > type in CMD and hit enter.

    Type the following in Command Prompt, and press Enter:

    del /f "C:\Users\Barbara\AppData\Roaming\ndhuig.dll" && del /f "C:\Users\Barbara\AppData\Roaming\psfcer.dll"

    It will confirm each deletion or they will be an error if they don't delete.

    Please open Notepad and enter in the following:
    Then, click File > Save as...
    Save as killDLL.reg to your Desktop.
    Choose Save as type... All Files.
    Click Save.

    Then, exit Notepad.

    Double-click on killDLL.reg, it will ask to Merge/Confirm. Do so, and reboot your computer. Tell us the status on this.
     
  12. pikabox

    pikabox Newcomer, in training Topic Starter Posts: 17

    When I tried to type the entry into CMD, it returns with "could not find file ..... ". Should I just proceedwith the regedit step?
  13. Jay Pfoutz

    Jay Pfoutz Malware Helper Posts: 4,286   +49

    Try this in Command Prompt:

    del /f "C:\Users\Barbara\AppData\Roaming\psfcer.dll"

    then do the REGEDIT step.
  14. pikabox

    pikabox Newcomer, in training Topic Starter Posts: 17

    It returns with "the system cannot find the path specified". Shall I proceed with regedit?
  15. Jay Pfoutz

    Jay Pfoutz Malware Helper Posts: 4,286   +49

    Yes, go ahead!
  16. pikabox

    pikabox Newcomer, in training Topic Starter Posts: 17

    Ahh, there is no pop up now! yay, thanks for your help once again! :D
  17. Jay Pfoutz

    Jay Pfoutz Malware Helper Posts: 4,286   +49

    Great! Problem solved. Good job. :)
Topic Status:
Not open for further replies.


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.