Rundll error

[Tebbs]

Hi, I've recently bought a new computer, but now on start up it keeps bringing up the error message "Error loading C:/windows/system 32/citoriaj.dll, the specified module could not be found". Does anyone have any advice towards finding a solution?!

[digitalocksmith]

This sort of error can be caused by a few things including uninstalling software or running a disk or registry cleaner inadvertantly.
Usually you can replace lost .dll files but i cant seem to find this particular one anywhere and i am not familiar with it.

I guess this leaves you with a couple of choices,
(a) You can perform a system restore if you have it activated in windows or,

(b) You can boot from your install disc and perform a repair install of windows.

Regards

[Tebbs]

I do use a program called reg cleaner, but thats only really to clean up unnecesary programs on startup. I'm sure I can do the system restore, but not too sure about the other option you offered.
I think to break the question down, is it going to do my computer harm? Presumably if you haven't heard of it it isn't going to be a vital windows component, so do I need to worry about it?

[digitalocksmith]

If it causing problems with your system operation then i guess you need to fix it.
If its not bothering you.....well its up to you!

Follow the directions given from the links at the bottom of my post and no harm will come to your system (all data will remain intact)

Be careful with registry cleaners because if you go to hard, you can leave your system inoperable.
For general cleaning of old temp files or reg entries left over from unistalled softs i prefer to use an app called CCleaner (its free).
In all the years of operation it has never caused an issue and works a treat!
http://www.ccleaner.com/

To perform a system restore:

(Vista) http://www.howtogeek.com/howto/windows-vista/using-windows-vista-system-restore/

(XP) http://www.techwarelabs.com/guides/misc_mod/system_restorexp/

http://geekpolice.forumotion.com/pc-tutorials-guides-and-faqs-f13/utilizing-system-restore-in-safe-mode-t541.htm?highlight=system+restore

To perform a repair install:

(Vista) http://www.bleepingcomputer.com/tutorials/tutorial148.html

(XP) http://geekpolice.forumotion.com/search.forum?search_keywords=repair+install

http://pcsupport.about.com/od/operatingsystems/ss/instxprepair1.htm

Good Luck!

[itdupuis]

Just as a word of caution~~Spyware programs usually encode dll's on your cpu. If you have a spyware removal program, try running it and see if points out this file. I would hate for you not to fix it, and it turns out being sypware....Good luck!

[digitalocksmith]

Spyware programs usually encode dll's on your cpu.

mmmm.....lol!

I think you mean the registry!

[Tebbs]

I think I've found out the problem- my computer seems to be infected with virtumonde. I've repeatedly deleted it- I run AVG, Spybot and AdAware normally, and both of them have deleted it several times. plus I have run several programs- Virtumondebegone and Vundofix, but I can't seem to get rid of it for good. Any advice?

[digitalocksmith]

Download a copy of HijackThis and save it to your desktop in a folder.
Do a scan and save the HijackThis logfile. Do not remove anything.
Post your log file here. Link to HijackThis:

http://www.majorgeeks.com/Trend_Micro_HijackThis_d5554.html

[Tebbs]

I downloaded HijackThis and ran a scan. This is the log file, its pretty long!:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:48:58, on 05/05/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Windows\RtHDVCpl.exe
C:\Windows\vVX3000.exe
C:\Program Files\ScanSoft\OmniPageSE4\OpWareSE4.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Common Files\Logitech\KhalShared\KHALMNPR.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\Microsoft Office\Office12\WINWORD.EXE
C:\Windows\system32\rundll32.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Tebbs\Desktop\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.meshcomputers.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=56626&homepage=http://www.google.com/ig
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.meshcomputers.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {8392E6DB-7010-4A8D-8993-978007B2D298} - C:\Windows\system32\xxyxUnmJ.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [VX3000] C:\Windows\vVX3000.exe
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe"
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [BM3da2fc13] Rundll32.exe "C:\Windows\system32\vrwtbyas.dll",s
O4 - HKLM\..\Run: [3e91cf8f] rundll32.exe "C:\Windows\system32\xeyhxudw.dll",b
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [kdx] C:\Program Files\KHost.exe -all
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\npjpi150_10.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\npjpi150_10.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O13 - Gopher Prefix:
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O20 - Winlogon Notify: avgwlntf - C:\Windows\SYSTEM32\avgwlntf.dll
O21 - SSODL: wdpoefan - {925ED904-7A5A-48F2-90D8-014FD8DEC153} - C:\Windows\wdpoefan.dll (file missing)
O21 - SSODL: vadokmxt - {4DB40E39-356E-4561-A644-3D0860491326} - C:\Windows\vadokmxt.dll (file missing)
O21 - SSODL: SrvRunOnce - {22a27181-778a-4db8-b965-470526b98d81} - C:\Windows\Resources\SrvRunOnce.dll (file missing)
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG7 Resident Shield Service (AvgCoreSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: PIXMA Extended Survey Program (IJPLMSVC) - Unknown owner - C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
O23 - Service: KService - Kontiki Inc. - C:\Program Files\Kontiki\KService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe

--
End of file - 8042 bytes

[itdupuis]

Thank you for catching my error Digitalocksmith ;)

[Tebbs]

I am still finding this virus pop up on my computer, despite repeated attempts to get rid of it. Is there any chance anyone could help me fix this? The virus is obviously replicating itself, and all I can do is get rid of the programs it replicates, not the source of the problem. Any help would be greatly appreciated.

[PcPro12]

Try a program called Avira (Anti-Vir), its free http://www.free-av.com/en/download/1/download_avira_antivir_personal__free_antivirus.html

or try using Windows Defender http://www.microsoft.com/downloads/details.aspx?FamilyId=435BFCE7-DA2B-4A6A-AFA4-F7F14E605A0D&displaylang=en&mg_id=10134

I have those 2 and they seem to be working really good...

As to finding the source of the virus, if you cant do it automatically with a program, try manually...but its a bit risky if you dont know what you are doing...

1. Examine the symptoms of the virus and what it does...Like what kind of pop-ups you get and their message...

2. Go to MY COMPUTER, than go to your main hard drive (Local Disk)...

3. Go to the folder called WINDOWS...

4. Make sure you have a column called DATE MODIFIED on that folder, and look through every file that was modified or changed since you got that pop-up or virus...

5. If you didnt find any, go to the SYSTEM32 folder and do the same...if you find any file or text document modified within that time frame, than open it and search for the symptoms of the virus or any code having the message or pop-up information, if you find it, make a system restore point, than delete that file...

This may or may not work, but its a way to delete the source of a virus manually...I did it before and it worked real well...but it takes a while...Good Luck...