Virus Gone... Now what?

From: "Needy" <Needy RemoveThis @discussions.microsoft.com>

| I recently ridded myself of a massive virus, but still have some lingering
| issues:
|
| 1). I recieve the following error messages at start-up
|
| a). "Error loading C:\WINDOWS\system32\ijlfsdqr.dll"
| b). "Error loading C:\WINDOWS\system32\mqwqbftp.dll"
|
| I don't know if I need these, but I'd like to use them or delete ( I don't
| know how to do either option).
|
| 2). When viewing my startup application through msconfig, I've found some
| suspect exe. I've searched but have been unable to locate how a clean (like
| new) startup should appear. After my nightmare, I could care less about
| automatically openning anything.
|
| As usual, thanks in advance for any and all assitance...



Download and execute HiJack This! (HJT)
http://www.trendsecure.com/portal/en-US/threat_analytics/HJTInstall.exe

Create a HJT log file and post it in one of the below locations...

{ Please - Do NOT post the HJT Log here ! }

Forums where you can get expert advice for HiJack This! (HJT) logs.

NOTE: Registration is REQUIRED in any of the below before posting a log

Suggested primary:
http://www.thespykiller.co.uk/index.php?board=3.0

Suggested secondary:
http://www.bleepingcomputer.com/forums/forum22.html
http://castlecops.com/forum67.html

Suggested tertiary:
http://www.dslreports.com/forum/cleanup
http://www.cybertechhelp.com/forums/forumdisplay.php?f=25
http://www.atribune.org/forums/index.php?showforum=9
http://www.geekstogo.com/forum/Malware_Removal_HiJackThis_Logs_Go_Here-f37.html
http://gladiator-antivirus.com/forum/index.php?showforum=170
http://forum.networktechs.com/forumdisplay.php?f=130
http://forums.maddoktor2.com/index.php?showforum=17
http://www.spywarewarrior.com/viewforum.php?f=5
http://forums.spywareinfo.com/index.php?showforum=18
http://forums.techguy.org/f54-s.html
http://forums.tomcoyote.org/index.php?showforum=27
http://forums.subratam.org/index.php?showforum=7
http://www.5starsupport.com/ipboard/index.php?showforum=18
http://www.malwarebytes.org/forums/index.php?showforum=7
http://makephpbb.com/phpbb/viewforum.php?f=2
http://forums.techguy.org/54-security/
http://forums.security-central.us/forumdisplay.php?f=13


--
Dave
http://www.claymania.com/removal-trojan-adware.html
Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp

"Needy" <Needy.TakeThisOut@discussions.microsoft.com> wrote in message
news:CB33D1FF-50B6-43DC-81D0-6D9AC7606757@microsoft.com...
>I recently ridded myself of a massive virus, but still have some lingering
> issues:
>
> 1). I recieve the following error messages at start-up
>
> a). "Error loading C:\WINDOWS\system32\ijlfsdqr.dll"
> b). "Error loading C:\WINDOWS\system32\mqwqbftp.dll"
>
> I don't know if I need these, but I'd like to use them or delete ( I don't
> know how to do either option).
>
> 2). When viewing my startup application through msconfig, I've found some
> suspect exe. I've searched but have been unable to locate how a clean (like
> new) startup should appear. After my nightmare, I could care less about
> automatically openning anything.
>
> As usual, thanks in advance for any and all assitance...


1.) This is usually what happens when your antivirus program deletes the file
but doesn't clean up the mechanism that launches it at startup. Here's a program
from Microsoft that will help you stop the error messages.

AutoRuns for Windows v9.13
http://technet.microsoft.com/en-us/sysinternals/bb963902.aspx

Once you've downloaded and extracted the files, run autoruns.exe. Look on the
Everything tab for an entry that lists ijlfsdqr.dll in the Image path column.
Right click on that entry and select Search Online from the menu. Odds are that
you'll come up with an empty search. This pretty much confirms that it was some
type of malware that your scan deleted. Uncheck the item. Do the same for
mqwqbftp.dll. Restart your computer. If you no longer see the error message, you
can go back and delete the entries in Autoruns.

2.) You can click on the Logon tab to get essentially the same information you
get through msconfig. Once again, you can right click on each item and do an
online search to see what's available on the net with regard to that entry. That
said, it's an unfortunate reality that if you're looking for a clean startup,
the only real way to achieve that is to flatten and rebuild.

Good luck

Nepatsfan