Results 1 to 6 of 6
  1. #1
    Member
    Join Date
    May 2004
    Posts
    26
    Points
    3

    Default What is this Missing dll ?

    I am working on my sister-in-laws PC.. Her husband, the dirt ball, finally left and left the PC for her to use. I already have removed tons of stuff that she or her daughter did not to need see.

    After windows XP opens I get the following message:

    C:\WINDOWS\System32rueuxh.dll. The specific module could not be found.

    I have tried a Goggle search, "useyourbrain.com", a couple of missing dll sites as well as M$ site on dll hell.

    It is a E machine AMD 1660+ Win XP home, 60 gig, 256 mb. The only thing is I am not using her monitor and I have to start it by using the F8, then selecting start in the VGA mode. I don't get this error starting in the safe mode though.

    I have not run any anti virus programs, Adaware/Spyboot as of yet. Did do a HJT log and deleted I think 103 problem files. Almost of them were host files and a few wild tangent ones.

    Just can't figure out why I can't find any info on these dll

    I know I have to run an Anti virus, spybot and Adaware, etc. Just wanted to know if any body has a clue as to this dll. Going to takes ages to do all this on dial up, and probably not going to able to do it until this weekend.

    Just wanted to know if anybody has any idea what this dll is all about.

    MM

  2. #2
    Member steamwiz's Avatar
    Join Date
    Sep 2003
    Location
    Yorkshire U.K.
    Posts
    14,022
    Points
    2335

    Default

    Hi Matty

    It's a random filename ... you've got the only one

    Once you post a hijackthis file for us, we can tell you how to fix it....

    But first do everything here :-

    http://www.help2go.com/postt8026.html

    cheers

    steam
    Look here for Ways to keep your computer safe
    M'SOFT MVP -Windows Security 2004/8 .member ASAP -

  3. #3
    Member
    Join Date
    May 2004
    Posts
    26
    Points
    3

    Default

    Finally got most of the necessary things done, but had problems:

    CWS -OK

    Spybot-It found a few things, tired to fix them, but Spybot hung at the screen that said "setting a restore point". Removed Spybot and reinstalled it. The next time I ran it came up with its own problem a WDENGINE.dll error

    Ran Adaware - Adaware said I had 4 trojans: Afcore. BK, Dyfica.W, Dyfica.F, and Brok.B. Adaware said to run AVG (using the free on) which I did.

    AVG scan - OK/Clean

    Pandasoft and Housecall - OK

    Looked/googled for info on the 4 trojans, found really nothing other than references to being probably in the system restore. Did turn off the system restore :cry: re-ran AVG, Adaware and Pandasoft and they did not detect any of the 4 trojans. Yes, I did remember to turn Restore back on.

    So I guess I am down to posting a HJT log:

    Logfile of HijackThis v1.98.0
    Scan saved at 9:39:07 PM, on 8/11/2004
    Platform: Windows XP (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 (6.00.2600.0000)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
    C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
    C:\WINDOWS\Explorer.EXE
    C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\Juno\exec.exe
    C:\WINDOWS\System32\wuauclt.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Documents and Settings\KATHY \My Documents\HijackThis1980.exe 11Aug04.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.emachines.com
    R3 - Default URLSearchHook is missing
    F0 - system.ini: Shell=
    F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O3 - Toolbar: JunoBar - {F5735C15-1FB2-41FE-BA12-242757E69DDE} - C:\Program Files\Juno\toolbar.dll
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
    O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe /STARTUP
    O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [uoltray] C:\Program Files\Juno\exec.exe regrun
    O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
    O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - (no file)
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2...ll/xscan53.cab
    O16 - DPF: {8EDAD21C-3584-4E66-A8AB-EB0E5584767D} - http://toolbar.google.com/data/GoogleActivate.cab
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
    O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - http://us.dl1.yimg.com/download.comp...bio5_1_6_0.cab

    Thanks

    MM

    P.S. Don't know why XP/IE is not showing SP1 Installed. To my knowledge they are, just did them last night ?

  4. #4
    Member steamwiz's Avatar
    Join Date
    Sep 2003
    Location
    Yorkshire U.K.
    Posts
    14,022
    Points
    2335

    Default

    Hi

    1. Could we just confirm your situation at the moment...

    After purgeing system restore, Adaware no longer finds the trojans ... yes or no ?

    2. Are you still getting this at startup "C:\WINDOWS\System32rueuxh.dll. The specific module could not be found." ?

    This appears to be the "Aflooder trojan" ... but if you were infected, there should be evidence in your log.

    3. Your log is clean ... this can be fixed to "tidy up"

    R3 - Default URLSearchHook is missing

    4. Do you get this error every time you run spybot ?

    WDENGINE.dll error

    5. quote....
    P.S. Don't know why XP/IE is not showing SP1 Installed. To my knowledge they are, just did them last night ?

    I don't know either... unless they didn't install properly ... you could install Belarc Advisor and see what it says..

    steam
    Look here for Ways to keep your computer safe
    M'SOFT MVP -Windows Security 2004/8 .member ASAP -

  5. #5
    Member
    Join Date
    May 2004
    Posts
    26
    Points
    3

    Default

    Steamwiz:

    Answering your questions in the order they were asked:

    1. No Trojans found by adaware, Spybot or Pandasoft.

    2. No missing dll on start up.

    3. Fixed the URL searchhook missing.

    4. On spybot, not getting the WDENGINE.dll missing when running it in the Standard Mode. I think I got this error when I ran it in the Advanced mode (disable the portion pertaining to XP/ME restore). Just ran it again the standard mode and I am getting the screen that states that spybot is setting a Restore point, but that screen never closes.

    5. Belarc shows that SP1 for XP was installed sometine ago like in 2002/03. Think I Will go back to M$ and have it scanned for updates again.

    Many Thanks Steam

    MM

  6. #6
    Member steamwiz's Avatar
    Join Date
    Sep 2003
    Location
    Yorkshire U.K.
    Posts
    14,022
    Points
    2335

    Default

    hi

    This is just a personal preference....

    Don't fix the usage tracks

    Go to settings\file sets ... scroll to the bottom and untick "usage tracks" (mine is unticked)

    When you "disable the portion pertaining to XP/ME restore" and then fix the usage tracks, spybot may be trying to create a new restore point with the new settings, but can't because you've unticked it ... maybe that's why the window doesn't close... I'm just guessing here.

    Anyway you are very welcome for any help I can give...

    happy surfing

    steam
    Look here for Ways to keep your computer safe
    M'SOFT MVP -Windows Security 2004/8 .member ASAP -