rundll
I am getting the following rundll error: file eqepupiyeciferab.dll not found. also I have a program that is generating trojan horses on my computer. the files themselves are being blocked by Nortan but I can't find where they're coming from. this occures even with the internet disconnected. When I want to shut down, I have to end the rundll program several times before windows will log off1 person needs an answerI do too
October 7th, 2010 10:03pm
You would need to scan with several decent malware tools and AV programs. eg SpyBot, Malwarbytes
Free Windows Admin Tool Kit Click here and download it now
October 8th, 2010 7:35pm
It is easy to get rid of the error message by doing something like disabling the startup item in msconfig (if you can even find it), but I suggest you fix the problem and not just fix the symptom of the problem by just eliminating the startup message.I would also not recommend that you start poking around in the registry unless you have a backup since there is no "undo" or "quit without saving" option in regedit. If you make a mistake, that's it.Those ideas offer "quick" and sometimes risky relief of the symptom, but may not actually fix the problem. I would also be wary of ideas that begin with the words "try". You do not need to try things, you need to fix things.Here are comprehensive instructions that will keep you safe and resolve your issue the "right" way.There are very few .DLL files that should be loaded from the C:\WINDOWS folder and that is not one of them.Describe your current antivirus and anti malware situation: McAfee, Norton, Spybot, AVG, Avira!, MSE, Defender, ZoneAlarm, PC Tools, Comodo, etc.A "Cannot find...", "Cannot start..., "Cannot load...". "Could not run..." Cannot run" "Error loading..." or "specific module could not be found" message at startup is usually related to malware that was set to run at startup but the referenced file(s) has been deleted after a malware scan leaving behind a registry entry or startup item pointing to a file that does not exist. It could be from a malicious software removal or an uninstalled application. The entry may have a curious looking name since it was probably generated at random when the malware was installed. If you search your system for the referenced file, you may not even find it.Windows is trying to load this file but cannot locate it since the file was mostly likely removed during a scan for malicious software. However, an associated orphaned startup parameter or registry entry remains and is telling Windows to load the file when you boot up or login.You need to remove the referenced entry so Windows stops trying to load or run the file. It may or may not be in the registry but you can find it. Autoruns (see below) will find the item no matter where it is. If you just locate and uncheck the item in msconfig, that disables the item but does not remove the reference to the bogus startup item from your computer. The msconfig program is not a startup manager, it is a troubleshooting tool. Disabling things in msconfig to put a stop to the messages and thinking your problem is resolved is short sighted and leaves behind a sloppy XP configuration. Merely disabling the display of a startup error message should not count as a "solution" to the problem.If you are comfortable editing the registry you can search for and remove the reference directly from there or remove it using a popular third party tool called Autoruns. The problem may not always be found in the registry though.Before making any changes to your registry by hand or with third party tools, be sure to make a backup of the registry first. There is no undo or quit without saving option in regedit.Here is a link to a popular registry backup tool:http://www.snapfiles.com/get/erunt.htmlYou can use Autoruns to find the leftover startup item no matter where it is hiding. Autoruns does not install anything on your computer. It will display all of the startup locations where the reference might be so you can disable it or delete it completely. Here is the download link for Autoruns:http://technet.microsoft.com/en-us/sysinternals/bb963902.aspxLaunch Autoruns.exe and wait for it to finish populating the list of entries.When Autoruns is finished scanning your system, it will say "Ready" at the bottom left corner. Autoruns can be a little intimidating at first if you have never see it before since it displays a lot of information. You are really only interested in a couple sections.The problem item is usually in the system startup or user startup entries so click the Logon tab and see if the startup item is there.Scroll through the list and look for a startup entry related to the file(s) in the error message.If you don't find it in the Logon tab, look for it in the Everything tab.Right-click on the offending entry and choose to delete it. If you are not sure what it is, you can just disable it, reboot and if the issue is resolved, and then delete the offending entry. If you don't see it in Autoruns you may have to edit the registry and remove the item from the Startup folder there. Autoruns should display the same information though.Since you had or have an infection, follow up with this:Perform some scans for malicious software, then fix any remaining issues:Download, install, update and do a full scan with these free malware detection programs:Malwarebytes (MBAM): http://malwarebytes.org/SUPERAntiSpyware: (SAS): http://www.superantispyware.com/They can be uninstalled later if desired.Reboot your computer and troubleshoot remaining issues.Don't guess what the problem might be - figure it out and fix it. I need YOUR votes and points for helpful replies and Propose as Answers. I am saving up for a pony!
October 8th, 2010 8:43pm
I was able to find the specified file reference doing as you said using autoruns and deleat it. However most of my problems are still there. autoruns showed me a folder local settings/temp found in c:\documents and settings\new, but I couldent locate that folder. that folder contains a file bnebvj.exe, that is trying to execute and giving me error messages. that path is also the target location for the trojan horses that are being generated and blocked by Nortan. Is the file bnebvj.exe safe to eliminate with autoruns?
Free Windows Admin Tool Kit Click here and download it now
October 11th, 2010 3:21am
Very good.In a perfect world, there should be no executables (.exe files) under Documents and Settings for any user - except maybe downloaded temporary files which would get removed during a regular maintenance operation to remove temporary Internet files. That is not where exectuable files go.Unless you have a user named "new", there should be no "new" folder under Documents and Settings either (unless you made one for some reason).When exploring Documents and Settings, be sure your settings allow you to see hidden files and folders.Googling your suspicious file reveals zero hits, and knowing that malware will sometime generate files with curious names at random to hide from scanning programs that might know about it, bnebvj.exe falls into that category. The malicious software is trying to hide from you and the scanning programs that might find and remove it.If you can see it in Autoruns, you can just disable it, reboot and then see how things go and then delete it when you are satisfied that nothing gets broken if it is missing.Adjust your Explorer settings so you can see more in the Documents and Settings folder:Open explorer to the folder of interest Click Tools Click the Folder Options, View tab Enable: Show hidden files and folders Disable: Hide extensions for known file types Click OK to apply the settingss (you can clcik Restore Defaults later)Then see if you can find your suspicious file and rename it with some other extension like bnebvj.exe --> bnebvj.old or just delete it.You could also do a Windows Search and using the Advanced Search options, enable it to search all folders and hidden files, etc.What usually happens with these kinds of things is your anvivirus software will delete the file (so you may not find it in a search), but leave behind the bogus startup entry.Be sure you run MBAM and AS as indicated. Don't guess what the problem might be - figure it out and fix it. I need YOUR votes and points for helpful replies and Propose as Answers. I am saving up for a pony!
October 11th, 2010 8:17am