Pesky RunDLL Virus Errors at Logon

One of our user’s computers was infected with a virus that, after being removed and cleaned up, left these annoying RunDLL errors for DLL files with randomly generated filenames which occurred every time the user would login:

logon errors

I didn’t get far trying to google some keywords related to the errors. However, some results did point me in the right direction for resolving the issue.

Basically, you want to check every possible repository of startup items or commands. In the registry, most google results told me to check the following locations.

  • HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows/CurrentVersion/Run
  • HKEY_CURRENT_USER/SOFTWARE/Microsoft/Windows/CurrentVersion/Run

However, where these virus-caused items actually ended up being was under a specific user profile in HKEY_USERS:

HKEY_USERS/userprofile/SOFTWARE/Microsoft/Windows/CurrentVersion/Run

I should mention that CCleaner did not list them under the startup category and neither did msconfig, so registry might be the only way to find them that I know of.

Advertisements

One thought on “Pesky RunDLL Virus Errors at Logon

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

w

Connecting to %s