Problem with a trojan

  infrared1334 12:48 08 Apr 08
Locked

Windows Defender recently informed me that a trojan is in my system and it cannot remove it. So I located the trojan and delete it myself. But, when I start my computer, Windows popped up a message, saying that it can't locate and run the dll file, which is the trojan. How can I prevent this message to pop up again the next time i log on to Windows? I am running Windows Vista Home Basic. Can you help?

  Ditch999 15:13 08 Apr 08

Run your antivirus/antispyware programmes in Safe Mode. The dll file is not the only part of the trojan, there are other files associated with it that will execute at startup and try to find that file, which is what you are experiencing.

  skidzy 16:01 08 Apr 08

Follow ditch's advice of running your anti's in safemode.

You may find out that the dll is corrupt and if a windows dll,sfc should fix that issue.

How to run sfc;

If you can get into windows;

Start and type CMD ,right click CMD and run as Administrator.

Then type or copy and paste the below

sfc /scannow

And enter,let this finish.

If no joy in removing the trojan,post the exact trojan details back here.

  skidzy 16:06 08 Apr 08

You can run SFC in safemode and probably find this is best.

  Mac70 16:49 08 Apr 08

That sounds like the trojan had created a registry key which is still there.
Im no registry master so Ill leave it to someone else to advise you on that.

  infrared1334 11:29 23 May 08

Now there's two. The first one is "ihkbboqs.dll"(if I am not wrong) and the second one is "wmwmv.dll"(if I am not wrong again).

  infrared1334 11:30 23 May 08

I thank all who had posted a respond here! Thanks!

  skidzy 15:26 23 May 08

Its been a long time waiting for your response and things may just get worse if you do not deal with this.

I have an idea for you that may work.

Firstly i can find no relevance to your dll's you have posted,therefore i can only assume they are not needed and do not belong to windows.

We may find it easier to diagnose the problem with a log from Hijackthis (do not post this here) though you can if you wish send me a copy of the scan log via the yellow envelope.

Ok,something to try;

Click your windows orb (bottom left of the screen) and in the search box type

system32

And enter.

This will take you into the system32 folder where i think these dll's are stored.

Find the problem dll's and right click each one
ihkbboqs.dll
wmwmv.dll

And rename as follows;

ihkbboqs.old
wmwmv.old

Reboot the system,if your have any problems,just boot into safe mode and rename them back to the original tag.

If all runs ok after they have been renamed (2-3 reboots) you can safely delete the dll's in question by the same way i have pointed out above.

Though there is a chance there are one or more registry entries that have been created and may reappear/reproduce new dll's upon rebooting the machine.
If this is the case,you are going to need expert help from a specialist forum (this we will address later).

Also please confirm you are running an upto date antivirus and antispyware.

Also list any antispyware/antivirus programs you have installed.

  infrared1334 06:03 25 May 08

The antivirus software I am running is the McAfee SecurityCentre.

  Sun Of The East 07:08 15 Jun 08

I am here to tell you that I have changed my username from Infrared1334 to this.

  Sun Of The East 07:12 15 Jun 08

I have deleted some registry entries containing the word ihkbboqs.dll. I am now rebooting to see if Windows will tell me that "the specified module could not be found." (Hope it does not...)

This thread is now locked and can not be replied to.

AMD Ryzen release date, specifications and features: Three CPUs from the Ryzen 7 range now…

1995-2015: How technology has changed the world in 20 years

Glassworks Barcelona shows how it captured the artistic imagination of Conor in A Monster Calls

Best iPhone games 2017 | Best iPad games 2017: 162 fantastic iOS games that you need to play right…