Avast WEBforum
Other => General Topics => Topic started by: Saturnv on May 26, 2010, 12:10:03 PM
-
Does anybody know how to get rid of this type of error At start up it says: RUNDLL (in left hand corner) Error loading C:\WINDOWS\osubasusevihe.dll
The specific module could not be found.
Thanks
-
Seems an infected file... Or that you have been infected...
Can you send the samples to virus@avast.com ?
You can zip and password the files... Inform a link to this thread and the password used.
You can send the files to Chest and, from there, resend to Alwil for analysis.
Thanks.
Maybe you need to disable Hide protected operating system files (http://www.xtra.co.nz/help/0,,4155-1916458,00.html) and enable View hidden files and folders' (http://www.bleepingcomputer.com/tutorials/tutorial62.html#winxp) to manage the file(s).
You can check it at www.virustotal.com also.
-
What ? Sorry don't know what you mean by send samples......I just wanted to know what simple program I could possibly run to get rid of this RUNDLL. Not really to analyze it. Yes my computer was infected pretty bad. Avast took care of it but left this RUNDLL error. And I can't get rid of it. Appreciate the help though. Any other suggestions.
-
do a scan with malwarebytes and post the log here
-
Sorry don't know what you mean by send samples.
I'm talking about C:\WINDOWS\osubasusevihe.dll file.
If a virus is replicant (coming and coming again), you could follow the general cleaning procedure:
1. Clean your temporary files. You can use CleanUp (http://www.stevengould.org/downloads/cleanup/) or CCleaner (http://www.ccleaner.com/) for that.
2. Schedule a boot time scanning with avast. Start avast! > Right click the skin > Schedule a boot-time scanning. Select for scanning archives. Boot. Other option is scanning in SafeMode (http://support.microsoft.com/default.aspx?scid=kb;en-us;315222) (repeatedly press F8 while booting).
If avast does not detect it, you can try DrWeb CureIT! (http://www.freedrweb.com/cureit/) instead.
3. It will be good if you download, install, update and run MBAM (http://malwarebytes.org/mbam.php) (or SUPERantispyware (http://www.superantispyware.com) or even SpywareTerminator (http://www.spywareterminator.com)).
If any infection is detected, better and safer is send the file to Quarantine than to simple delete them.
About legit antispyware applications or the bad ones see here (http://www.spywarewarrior.com/rogue_anti-spyware.htm#sites).
4. If you still detecting any strange behavior or even you're sure you're not clean, maybe it will be good to test your machine with anti-rootkit applications (http://www.antirootkit.com/software/index.htm). I suggest avast! antirootkit (http://files.avast.com/files/beta/aswar.exe) or Trend Micro RootkitBuster (http://www.trendmicro.com/download/rbuster.asp) for XP/Vista. For XP only: Panda (http://research.pandasoftware.com/blogs/research/archive/2007/04/27/New-Panda-Anti_2D00_Rootkit-_2D00_-Version-1.07.aspx).
5. Also, if you still detecting strange behaviors or you want to be sure you're clean, maybe making a HijackThis (http://www.bleepingcomputer.com/files/hijackthis.php) log to post here or this analysis site (http://www.hijackthis.de/#anl). Or even submit the RunScanner (http://www.runscanner.net/) log to to on-line analysis.
6. Browser hijacking and problems with antivirus update could be managed in some scenarios by cleaning the hosts file (at C:\windows\system32\drivers\etc folder). The file does not have an extention, it's simply hosts.
The default file consists of a number of example lines preceded with # The only required line is
127.0.0.1 localhost
You can get a good replacement with HostsMan that keep it clean (avoid infections) and updated: http://www.abelhadigital.com
7. After you're clean, disable System Restore on Windows ME (http://support.microsoft.com/default.aspx?scid=kb;en-us;Q264887), XP (http://support.microsoft.com/default.aspx?scid=kb;%5BLN%5D;310405) or Vista (http://support.microsoft.com/?scid=kb%3Ben-us%3B936212&x=6&y=13). System Restore is not available in Windows 9x and 2k. After disabling you can enable it again.
8. Use the immunization of SpywareBlaster (http://www.javacoolsoftware.com/spywareblaster.html).
9. Finally, when you're clean, check for insecure applications with Secunia Software Inspector (http://secunia.com/software_inspector/) to update insecure applications and avoid reinfection.
-
Hey Tech, Thanks for the help but none of them worked. I'm still getting the error code.
-
Post a screenshot of the windows error, please.
-
Here's the screen shots. Thanks
-
Do that errors appear when you boot/logon?
That .dll files seems to be infected ones and the when cleaned the startup items left behind.
You can delete the startup items with msconfig, winpatrol, startupdelayer and a lot of other programs.
-
Well the files are most likely not there any longer, but there is a corresponding registry entry there trying to load them using rundll, hence the error window.
Hey Tech, Thanks for the help but none of them worked. I'm still getting the error code.
Hijackthis, doesn't do anything other than report what is running or set to run, so it won't cure anything. So I suggest that you run HJT again and save the log file and attach it to your next post.
- When you click the Reply button, there is an Additional Options link, this expands the options to attach a file, that can be an image file or a text file (.log or .txt). Also see How to post an Image (http://forum.avast.com/index.php?topic=8982.0).
-
I can't run Hijack cause of this message.
-
Right click HJT and select run as administrator - I believe you have a Vista/7 system - that should work
-
User is being helped in another malware removal forum. http://forums.iobit.com/showthread.php?t=6957