How to stop .dll file so that it gets deleted

[Kuprin]

Hi All !
I am getting a online virus check pop up whenever i connect to internet nearly around a week a go.It is showing msconfd.dll is infected. i tried deleting it but was not able to delete it. i think it might be working as i cant delete it Even in the safe mode.

I just wanted to know how to stop running .dll files so i can delete it.

Can anyone help me???

[Eric B]

What is a DLL file?

DLL (Dynamically Link Library) is an executable file that permits programs to share code to perform one or more predefined functions. A DLL file can be used by several programs at the same time. The benefit of having DLL files is that they don’t get loaded into random access memory (RAM) along with the main program, which saves up space in RAM. So instead of all the coding being built into the program, it uses a particular DLL file that, with a simple call, can execute the operation for it.

Why is it important to remove malicious DLLs?

Most DLL files are essential for the running of your programs but there are other malicious programs, such as browser hijackers and browser plugins, that are usually made up of DLL files that can alter your system settings to allow attackers gain access on your computer.

If you’re really serious about removing unwanted DLL files, make sure you use Windows Add/Remove programs first (how to use Add/Remove programs). Most applications come with an uninstall program that will remove the unwanted DLL files. But be aware the uninstall utility will assume that certain files are shared and it will have no way of knowing which other programs use them or whether these programs are present on your machine. This results in DLLs being left behind that can recreate the malicious program on reboot.

To remove a specific DLL, you should use Regsvr32 (Regsvr32.exe) to register and unregister DLL files which is already built in your Windows operation system’s package. There are plenty of other programs available that can help you identify and remove unwanted DLLs, but Regsvr32 is the most common.

Learn how to remove spyware DLL files from your computer.

Unregister Spyware DLL Files Manually

Warning: Unregistering spyware DLL files is difficult and risky. If you unregister the wrong DLL file, your computer may crash and important data may be lost. As a precautionary measure, please back up important files and set a System Restore point (click Start > All Programs > Accessories > System Tools > System Restore, and follow the on-screen instructions) or run a spyware check with a trusted anti-spyware program to automatically detect spyware.

To start unregistering DLL files, you will need to follow these steps:

1. Open the Command Prompt window
   Press the “Start” button on your taskbar and click on “Run” to start the “Run” tool. In the field, type “cmd” and press the “OK” button.
   
   
2. Locate the DLL file
   After opening the Command Prompt window, locate the exact DLL path as shown on the screenshot below. Type “cd” in order to change the current directory, press the “space” button, enter the full path to the DLL file and press the “enter” button on your keyboard. If you want to display the contents of the directory, use the “dir” command.
   
   
3. Unregister the unwanted DLL
   In the directory where you want to remove the DLL, type “regsvr32 /u [DLL_NAME]” and press the “Enter” button
   
   
4. Unregistering succeeded
   If the DLL was unregistered successfully, a confirmation message will be displayed.
   

If you want to undo the removal, you can perform it by typing “regsvr32″ without the /u key, just type “regsvr32 [DLL_NAME]” to undo the changes.

[JonathanD]

SPYBOT - Spybot Search & Destroy 1.6 is a very good, FREE Anti-Spyware Program.
Download, install, update, and immunize your System with it.
Then SCAN with it.
Update it, and scan your System once a fortnight.


Malwarebytes is as the name says, a Malware Remover!

NOTE : Download, install, and update these 2 programs in Normal mode.
Reboot into Safe mode, and scan your System with them.
Scan with your AV while you are there.

[Sam.D]

I have dealt with this malware before. It is a beast to get rid of.

It is a winlogon malware piece; it installs an entry into HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify while it is running. If you delete one of those that points to the random-named dll’s, it will create another one.

If you don’t have access to those tools there is another way to do it with just command line tools
1) Find the dll’s with funky random names in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify

2) Open a command line and run:
2a) cacls C:\path-to-randomsdf902.dll /D Everyone
2b) attrib -R -A -S -H C:\path-to-randomsdf902.dll
* These programs will deny all access for this dll to run or do anything

3) Reboot and make sure that no more entries were put in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify

All spyware stuff should be removed in Safe Mode (keep pressing F8 on reboot - choose safe mode with no networking); this helps out a lot especially if the machine is really bad and bogged down