deskpan.dll not to be found

[polonus]

Hi forum members,

I opened up autoruns from Sysinternals and did a scan. Configuration screen extension then it says it cannot find deskpan.dll that should be in C\windows\system32
I am on a Win XP SP2. Where did deskpan.dll get removed? Was it an uninstall routine, was it malware or a cleansing routine that went wrong? Can someone explain?

polonus

[DavidR]

I don't think it got removed, just didn't exist, I have done a swarch of my windows and sub folder for this file and zero hits.

I also have autoruns v8.6 and it didn't baulk at the fact I don't have deskpan.dll go figure. I thought the whole purpose of autoruns was it was a stand alone application ?

http://www.processlibrary.com/directory/files/deskpan/

[polonus]

Hi DavidR,

Thanks for that info, I had that hunch too, but now I feel more relaxed that you arrive at the same conclusion. I also have found that deskpan.dll can be removed following a malware infection, so I wanted to be certain. So you eased my mind at this point.

polonus

[DavidR]

Your welcome, though I did misread your post, I though autoruns was having a problem because this file was missing. Not that its scan expected to find it.

Where did you see this "Configuration screen extension then it says it cannot find deskpan.dll that should be in C\windows\system32 " ?

[Lisandro]

Polonus, can you post a screenshot of Autoruns with the deskpan.dll error?

[polonus]

Hi DavidR,

It reads like this
\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
HKLM\Software\Microsoft\Windows\CurrentVersion\ShellExtension\Approved
Autorun Entry                                                                 Image Path
Configuratiescherm-uitbreiding Beeldscherm-panning      File not found: deskpan.dll   
\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
Where there should be the dll image is a white empty image...
If the dll was there it should be in C\windows\system32


The Dutch there = Configurationscreen-extension MonitorScreen-panning
What to do next?
What I see in windows\system32 is a general dll as Desk.cpl modified

polonus

[Lisandro]

What to do next?

Delete the entry from Autoruns. You don't need it, it does not exist. Probably a bad uninstalled program.
From which program does it belong, can you know?

[polonus]

Hi Tech,

It is advanced monitor accessories. configuration screen. 
It seems it is not a critical file.

pol

[polonus]

Here is a silent runners log:
"Silent Runners.vbs", revision R50, http://www.silentrunners.org/
Operating System: Windows XP SP2
Output limited to non-default values, except where indicated by "{++}"


Startup items buried in registry:
---------------------------------

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
"CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS]
"MSMSGS" = ""C:\Program Files\Messenger\msmsgs.exe" /background" [MS]
"Democracy Player" = "C:\Program Files\Participatory Culture Foundation\Democracy Player\Democracy.exe" ["Participatory Culture Foundation"]
"updateMgr" = "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9" ["Adobe Systems Incorporated"]

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
"ntiMUI" = ""C:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe"" [null data]
"(Default)" = "(empty string)" [file not found]
"RemoteControl" = ""C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"" ["Cyberlink Corp."]
"IMJPMIG8.1" = ""C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32" [MS]
"MSPY2002" = ""C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" /SYNC" [null data]
"PHIME2002ASync" = ""C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" /SYNC" [MS]
"PHIME2002A" = ""C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" /IMEName" [MS]
"SiSPower" = ""Rundll32.exe" SiSPower.dll,ModeAgent" [MS]
"SoundMan" = "SOUNDMAN.EXE" ["Realtek Semiconductor Corp."]
"Acer Empowering Technology Monitor" = "C:\WINDOWS\system32\SysMonitor.exe" [null data]
"AspireService" = ""C:\Program Files\Acer\Acer eMode Management\AspireService.exe"" ["Acer Inc."]
"MediaSync" = ""C:\Program Files\Acer\Acer eConsole\MediaSync.exe"" ["Acer Inc."]
"PCMService" = ""C:\Program Files\Acer TV-FM\PCMService.exe"" ["CyberLink Corp."]
"eRecoveryService" = ""C:\Acer\Empowering Technology\eRecovery\eRAgent.exe"" ["Acer Inc."]
"SiteAdvisor" = "C:\Program Files\SiteAdvisor\6066\SiteAdv.exe" ["McAfee, Inc."]
"avast!" = "C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" ["ALWIL Software"]
"SunJavaUpdateSched" = ""C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"" ["Sun Microsystems, Inc."]
"COMODO Firewall Pro" = ""C:\Program Files\Comodo\Firewall\CPF.exe" /background" ["COMODO"]
"BOC-423" = "C:\PROGRA~1\Comodo\CBOClean\BOC423.exe" ["COMODO"]
"NetShareMonitor" = "J:\Damina\NetShareMonitor\NetShareMonitor.exe" [empty string]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{02478D38-C3F9-4EFB-9B51-7695ECA05670}\(Default) = (no title provided)
  -> {HKLM...CLSID} = "Yahoo! Toolbar Helper"
                   \InProcServer32\(Default) = "C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll" ["Yahoo! Inc."]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided)
  -> {HKLM...CLSID} = "Adobe PDF Reader Link Helper"
                   \InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"]
{089FD14D-132B-48FC-8861-0048AE113215}\(Default) = (no title provided)
  -> {HKLM...CLSID} = (no title provided)
                   \InProcServer32\(Default) = "C:\Program Files\SiteAdvisor\6066\SiteAdv.dll" ["McAfee, Inc."]
{2B9F5787-88A5-4945-90E7-C4B18563BC5E}\(Default) = (no title provided)
  -> {HKLM...CLSID} = "CBrowserHelper Object"
                   \InProcServer32\(Default) = "C:\Program Files\KeyScrambler\KeyScramblerIE.dll" ["QFX Software Corporation"]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided)
  -> {HKLM...CLSID} = "SSVHelper Class"
                   \InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll" ["Sun Microsystems, Inc."]

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Configuratiescherm-uitbreiding Beeldscherm-panning"
  -> {HKLM...CLSID} = "Configuratiescherm-uitbreiding Beeldscherm-panning"
                   \InProcServer32\(Default) = "deskpan.dll" [file not found]
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "HyperTerminal-pictogramuitbreiding"
  -> {HKLM...CLSID} = "HyperTerminal Icon Ext"
                   \InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."]
"{7C9D5882-CB4A-4090-96C8-430BFE8B795B}" = "Webroot Spy Sweeper Context Menu Integration"
  -> {HKLM...CLSID} = "Webroot Spy Sweeper Context Menu Integration"
                   \InProcServer32\(Default) = "C:\PROGRA~1\Webroot\SPYSWE~1\SSCtxMnu.dll" [file not found]
"{A155339D-CCCD-4714-85EB-3754B804C9DF}" = "a-squared Free Context Menu Shell Extension"
  -> {HKLM...CLSID} = "a-squared Free Context Menu"
                   \InProcServer32\(Default) = "C:\PROGRA~1\A-SQUA~1\A2FREE~1.DLL" ["Emsi Software GmbH"]
"{472083B0-C522-11CF-8763-00608CC02F24}" = "avast"
  -> {HKLM...CLSID} = "avast"
                   \InProcServer32\(Default) = "C:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"]
"{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}" = "OpenOffice.org Column Handler"
  -> {HKLM...CLSID} = (no title provided)
                   \InProcServer32\(Default) = ""C:\Program Files\OpenOffice.org 2.1\program\shlxthdl.dll"" ["Sun Microsystems, Inc."]
"{087B3AE3-E237-4467-B8DB-5A38AB959AC9}" = "OpenOffice.org Infotip Handler"
  -> {HKLM...CLSID} = (no title provided)
                   \InProcServer32\(Default) = ""C:\Program Files\OpenOffice.org 2.1\program\shlxthdl.dll"" ["Sun Microsystems, Inc."]
"{63542C48-9552-494A-84F7-73AA6A7C99C1}" = "OpenOffice.org Property Sheet Handler"
  -> {HKLM...CLSID} = (no title provided)
                   \InProcServer32\(Default) = ""C:\Program Files\OpenOffice.org 2.1\program\shlxthdl.dll"" ["Sun Microsystems, Inc."]
"{3B092F0C-7696-40E3-A80F-68D74DA84210}" = "OpenOffice.org Thumbnail Viewer"
  -> {HKLM...CLSID} = (no title provided)
                   \InProcServer32\(Default) = ""C:\Program Files\OpenOffice.org 2.1\program\shlxthdl.dll"" ["Sun Microsystems, Inc."]

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows\
"AppInit_DLLs" = (value not set)

HKLM\System\CurrentControlSet\Control\Session Manager\
<<!>> "BootExecute" = "autocheck autochk *"|"lsdelete" [null data]


polonus

[DavidR]

I see it now way down in the Everything Tab and it obviously shows mine is missing to but it isn't something I going to lose any sleep over. I have found some other files reported as missing.

The strange thing is that regseeker (my registry cleaner) I would have thought should be looking for invalid registry entries, it didn't find this one

[polonus]

Hi DavidR,

So much the better, good for the "sloop roll" with the silentrunners. Something learned is something gained. That's how I look at it. Thanks you all for your assistance, and that's it.

polonus