1. Welcome Guest! In order to create a new topic or reply to an existing one, you must register first. It is easy and free. Click here to sign up now!.
    Dismiss Notice

[Solved] Run DLL error

Discussion in 'Malware Removal Help' started by patszy, Feb 7, 2014.

Page 1 of 2
  1. patszy

    patszy Registered Members

    Joined:
    Aug 1, 2010
    Messages:
    181
    Location:
    USA
    Operating System:
    Windows 8
    I recently had a problem with getting Conduit and a lot of other stuffon my then new computer when I added Classic Shell. Got rid of all malware and other stuff but I still get the following when I turn the computer on in the morning:
    54d6d189987d38a430840184b6faea37.jpg
    Is there a simple way to get rid of this? A search does not turn up anything.
    Thanks.
     
    patszy, Feb 7, 2014
    #1
  3. Tony D

    Tony D Administrator Administrator

    Joined:
    Sep 25, 2009
    Messages:
    5,064
    Location:
    SE Pennsylvania, USA
    Operating System:
    Windows XP Professional
    There's a registry entry that's still telling the machine to run the dll. How did you remove Conduit?

    What anti-malware programs are you using?
     
    Tony D, Feb 7, 2014
    #2
  4. allheart55 (Cindy E)

    allheart55 (Cindy E) Administrator Administrator

    Joined:
    Jun 11, 2009
    Messages:
    10,497
    Location:
    Pennsylvania
    Operating System:
    Windows 10
    Computer Brand or Motherboard:
    ASUS M4A77TD AM3 AMD 770 ATX AMD
    CPU:
    AMD Phenom II X6 1090T-Thuban 3.2GHz
    Memory:
    Crucial-DDR3 SDRAM 1333-8GB
    Hard Drive:
    WD Caviar Black SE HDD 640 GB - WD Caviar Black SE HDD 500 GB
    Graphics Card:
    Sapphire Radeon HD-7870 2GB
    Power Supply:
    CORSAIR CMPSU-750W
    That error message on startup is associated with Conduit Ltd. and is difficult to remove. It's
    really important to be sure your computer is completely disinfected. In order to do that you
    may need malware removal assistance. One of our experts will be happy to assist you.

    Please follow the directions here...Preparation for Malware removal help..Windows 8.
    Post the requested logs in a new thread in our Malware Removal. If you have any questions,
    please don't be afraid to ask.
     
    allheart55 (Cindy E), Feb 7, 2014
    #3
  5. Rich M

    Rich M Guest

    Joined:
    Dec 24, 2013
    Messages:
    4,580
    Location:
    NE Pa USA
    Operating System:
    Windows 7
    Computer Brand or Motherboard:
    MSI Z97 PC Mate LGA 1150 Intel Z97
    CPU:
    Intel i7 4790K 4.0Ghz
    Memory:
    Corsair Vengeance 16GB (2x8GB) DDR3 2133
    Hard Drive:
    Crucial 256 Gb SSD+ WD Raptor 300 Gb Sata III
    Graphics Card:
    Radeon R9 280 2GB HDMI
    Power Supply:
    Seasonic 750 watt
    I agree you should run checks in Malware Forum to be certain you got rid of the issues but this particular message can be handled rather simply by entering "Run" in the "Search" and then click on "Run" then in the box that opens type in "Msconfig" and that will take you to "System Config", then click on "Startup" and then "Open Task Manager" to get there. Then find the references to "Conduit" uncheck them then hit "apply", "ok" and then restart and it should disappear.
     
    Rich M, Feb 7, 2014
    #4
  6. starbuck

    starbuck Rest In Peace Pete Administrator

    Joined:
    Sep 26, 2009
    Messages:
    3,830
    Location:
    Midlands, UK
    Operating System:
    Windows 10
    CPU:
    AMD Athlon II x2 250 Processor 3.00GHz
    Memory:
    8gb DDR3
    Hard Drive:
    500gb SATA
    Graphics Card:
    ASUS GeForce GTX 960 2gb
    Power Supply:
    650w PowerCool X-Viper
    The simplest way to remove all references to Conduit is to run the 2 programs below:
    These programs will run on Win8

    Step 1
    Please download Junkware Removal Tool to your desktop.
    • Shut down your protection software now to avoid potential conflicts.
    • Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
    • The tool will open and start scanning your system.
    • Please be patient as this can take a while to complete depending on your system's specifications.
    • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
    • Post the contents of JRT.txt into your next message.



    Please download AdwCleaner by Xplode onto your desktop.
    • Close all open programs and internet browsers.
    • Double click on adwcleaner.exe to run the tool.
      Vista/Windows 7/8 users right-click and select Run As Administrator.
    • Click on the Scan button.
    • AdwCleaner will begin to scan your computer.
    • After the scan has finished...
    • Click on the Clean button.
    • Press OK when asked to close all programs and follow the onscreen prompts.
    • Press OK again to allow AdwCleaner to restart the computer and complete the removal process.
    • After rebooting, a logfile report (AdwCleaner[S0].txt) will open automatically.
    • Copy and paste the contents of that logfile in your next reply.
    • A copy of that logfile will also be saved in the C:\AdwCleaner folder.
    The advantage of running JRT first is that JRT will back up your registry before it does anything.
    So you always have this to fall back on.
     
    starbuck, Feb 8, 2014
    #5
  7. patszy

    patszy Registered Members

    Joined:
    Aug 1, 2010
    Messages:
    181
    Location:
    USA
    Operating System:
    Windows 8
    Thank you all for your replies. Sorry I was unable to get back here yesterday. You all are so prompt and that is certainly appreciated.

    First of all I had not put Malwarebytes on this computer soon enough. After I noticed that things were not right someone helped me clean things up. I got Malwarebytes and Hit Man Pro installed and that took care of most things, others were deleted by the other person who knew more than I did.

    I will check on all the things you have mentioned and will get back to you. Sounds a bit complicated and first I must see if I can disable Hit Man Pro, Marwarebytes, and Windows Defender!!
     
    patszy, Feb 8, 2014
    #6
  8. patszy

    patszy Registered Members

    Joined:
    Aug 1, 2010
    Messages:
    181
    Location:
    USA
    Operating System:
    Windows 8
    First of all, it seemed simplest, so I tried the "Run" "Msconfig" and it did not show me anything. This is what I got: 68e67f5a56950b5038a13f991783776e.jpg
     
    patszy, Feb 8, 2014
    #7
  9. patszy

    patszy Registered Members

    Joined:
    Aug 1, 2010
    Messages:
    181
    Location:
    USA
    Operating System:
    Windows 8
    I can't find ANY way to disable Windows Defender, Malwarebytes, or Hit Man Pro.
    Used to be able to disable those kinds of programs!!
    So, I guess I should not try to run Junkware Removal?????
     
    patszy, Feb 8, 2014
    #8
  10. allheart55 (Cindy E)

    allheart55 (Cindy E) Administrator Administrator

    Joined:
    Jun 11, 2009
    Messages:
    10,497
    Location:
    Pennsylvania
    Operating System:
    Windows 10
    Computer Brand or Motherboard:
    ASUS M4A77TD AM3 AMD 770 ATX AMD
    CPU:
    AMD Phenom II X6 1090T-Thuban 3.2GHz
    Memory:
    Crucial-DDR3 SDRAM 1333-8GB
    Hard Drive:
    WD Caviar Black SE HDD 640 GB - WD Caviar Black SE HDD 500 GB
    Graphics Card:
    Sapphire Radeon HD-7870 2GB
    Power Supply:
    CORSAIR CMPSU-750W
    Hi Patszy,

    I'm going to move your thread to our Malware Removal area in order to best assist you.
    Starbuck, one of our experts will be along to assist you as soon as he is able. I sent him a
    pm letting him know. Please be patient as he works on several other computer help boards.


    Thanks, Cindy
     
    allheart55 (Cindy E), Feb 8, 2014
    #9
  11. starbuck

    starbuck Rest In Peace Pete Administrator

    Joined:
    Sep 26, 2009
    Messages:
    3,830
    Location:
    Midlands, UK
    Operating System:
    Windows 10
    CPU:
    AMD Athlon II x2 250 Processor 3.00GHz
    Memory:
    8gb DDR3
    Hard Drive:
    500gb SATA
    Graphics Card:
    ASUS GeForce GTX 960 2gb
    Power Supply:
    650w PowerCool X-Viper
    Hi Patszy

    WINDOWS DEFENDER

    • Click Start > Programs > Windows Defender or launch from the system tray icon.
    • Click on Tools & Settings > Options.
    • Under Real-time protection options, uncheck the "Real-time protection" check box.
    • Click Save.
    • Go to Start > Control Panel > Security > Windows Defender, at the bottom of the Window Defenders page uncheck under Administrator Options "use Windows Defender" and then Save.
      (When you are done, you can re-enable Defender using the same steps but this time place a check next to "Turn on real-time protection" check box.)


    MalwareBytes Anti Malware

    There are several ways to disable MBAM's real-time protection (registered version only).
    • Right-click on the MBAM icon in the systray and uncheck Enable Protection.
    • When asked, "Are you sure you want to disable the MBAM Protection Module?", click Yes.
    • Right-click on the MBAM icon again and then uncheck Start with Windows.
    • The Protection Module is now disabled and will not restart.
    Alternatively, you can right-click on the MBAM icon in the systray, chose Exit and then click Yes at the prompt asking "Are you sure you want to disable the MBAM Protection Module?"


    Hit Man Pro
    Have never used this program, but stopping it shouldn't be too difficult.
    Normally if you right click the icon on the taskbar it will give you an option to disable it.

    If not:

    How to start Task Manager
    To start Task Manager, take any of the following actions:
    • Press CTRL+ALT+DELETE, keys on your keyboard ( at the same time) and then click Task Manager.
    • Press CTRL+SHIFT+ESC. keys on your keyboard ( at the same time)
    • Right-click an empty area of the taskbar, and then click Task Manager.
    How to exit, a program
    Click the Applications tab.

    To exit a program, click the program that you want to exit, and then click End Task.
     
    starbuck, Feb 8, 2014
    #10
  12. patszy

    patszy Registered Members

    Joined:
    Aug 1, 2010
    Messages:
    181
    Location:
    USA
    Operating System:
    Windows 8
    Thank you....I had tried and have tried again to rt click Malwarebytes and I do not get that option.
    I do not get it when I rt cl Hit Man Pro either. Nothing seems to give me the option to disable!
    I did get Windows Defender disabled though but have enabled it until I figure out how to disable the other two.
    I did go to Task Manager and did not get any Applications tab. Got an Apps tab but that did not contain these programs.

    2fc944fdee4c9625075275e7631f5388.jpg
    I fear this is not working for me since I just can't get these programs stopped. I have always been able to disable these things in the past. Maybe it is this WINDOWS 8,1!!!!! Don't know why they had to mess up everything that was so easy to understand before.
     
    patszy, Feb 8, 2014
    #11
  13. starbuck

    starbuck Rest In Peace Pete Administrator

    Joined:
    Sep 26, 2009
    Messages:
    3,830
    Location:
    Midlands, UK
    Operating System:
    Windows 10
    CPU:
    AMD Athlon II x2 250 Processor 3.00GHz
    Memory:
    8gb DDR3
    Hard Drive:
    500gb SATA
    Graphics Card:
    ASUS GeForce GTX 960 2gb
    Power Supply:
    650w PowerCool X-Viper
    Hi patszy,

    Ok we can do this another way.

    Forget the Junkware Removal Tool for now.
    AdwCleaner should run ok, so run that and then post the report that comes up at the end.
    Basically the 2 programs will search and remove the same things.
    We normally run both just incase one program has been updated more than the other    .

    Edit:
    Have just downloaded and ran HitMan Pro on my Win8.1 system.
    If you are running the free version then don't worry about the program.
    After the scan it didn't stay loaded, so it should be fine to forget about HitMan Pro and run the Junkware Removal Tool.
    You can be doubly sure by clicking the HitMan Pro app to start the program.
    From the main screen click on the Settings button at the bottom.
    Select the Scan tab and then untick Run a scheduled scan on my computer, then click OK.

    a19bbeb4e9ad7331fbd96dd90153f162.png
     
    Last edited: Feb 8, 2014
    starbuck, Feb 8, 2014
    #12
  14. patszy

    patszy Registered Members

    Joined:
    Aug 1, 2010
    Messages:
    181
    Location:
    USA
    Operating System:
    Windows 8
    Hi,
    Thanks for all your trouble.
    I have the Hit Man Pro!! Anyway, I just did what you suggested and did unclick run....

    So, I will go head and do the Adware Cleaner and see if it finds it. First, I have to disable WDef. Will just leave Malwarebtes as it is and hope all will be ok. I can always do a System Restore, I hope, if anything goes wrong?????

    It ran and found a whole lot of Chrome Extensions and there is ONE FILE WITH CONDUIT on it. So I guess I should just go ahead and click "Clean" then get the report. Hope this is right!,

    Have to close this now to finish......
     
    patszy, Feb 8, 2014
    #13
  15. patszy

    patszy Registered Members

    Joined:
    Aug 1, 2010
    Messages:
    181
    Location:
    USA
    Operating System:
    Windows 8
    Here is what it reported and when it rebooted I STILL had that nasty RunDLL.....

    Of course, I don't understand any of this, but there was one things with Conduit on it and I do see it half way down on this report.
    Should all of these things have been deleted? I surely hope so.



    # AdwCleaner v3.018 - Report created 08/02/2014 at 19:24:10
    # Updated 28/01/2014 by Xplode
    # Operating System : Windows 8.1 (64 bits)
    # Username : Patszy - HP
    # Running from : C:\Users\Patszy\Pictures\AdwCleaner.exe
    # Option : Clean

    ***** [ Services ] *****


    ***** [ Files / Folders ] *****

    Folder Deleted : C:\Program Files (x86)\MyPC Backup
    Folder Deleted : C:\Users\Patszy\AppData\LocalLow\PriceGong
    Folder Deleted : C:\Users\Patszy\AppData\Local\Google\Chrome\User Data\Default\Extensions\lipgolpfajiadodbcbljdpmbmbdmfcil
    [!] Folder Deleted : C:\Users\Patszy\AppData\Local\Google\Chrome\User Data\Default\Extensions\lipgolpfajiadodbcbljdpmbmbdmfcil
    [!] Folder Deleted : C:\Users\Patszy\AppData\Local\Google\Chrome\User Data\Default\Extensions\lipgolpfajiadodbcbljdpmbmbdmfcil
    [!] Folder Deleted : C:\Users\Patszy\AppData\Local\Google\Chrome\User Data\Default\Extensions\lipgolpfajiadodbcbljdpmbmbdmfcil
    [!] Folder Deleted : C:\Users\Patszy\AppData\Local\Google\Chrome\User Data\Default\Extensions\lipgolpfajiadodbcbljdpmbmbdmfcil
    [!] Folder Deleted : C:\Users\Patszy\AppData\Local\Google\Chrome\User Data\Default\Extensions\lipgolpfajiadodbcbljdpmbmbdmfcil
    [!] Folder Deleted : C:\Users\Patszy\AppData\Local\Google\Chrome\User Data\Default\Extensions\lipgolpfajiadodbcbljdpmbmbdmfcil
    [!] Folder Deleted : C:\Users\Patszy\AppData\Local\Google\Chrome\User Data\Default\Extensions\lipgolpfajiadodbcbljdpmbmbdmfcil
    [!] Folder Deleted : C:\Users\Patszy\AppData\Local\Google\Chrome\User Data\Default\Extensions\lipgolpfajiadodbcbljdpmbmbdmfcil
    [!] Folder Deleted : C:\Users\Patszy\AppData\Local\Google\Chrome\User Data\Default\Extensions\lipgolpfajiadodbcbljdpmbmbdmfcil
    [!] Folder Deleted : C:\Users\Patszy\AppData\Local\Google\Chrome\User Data\Default\Extensions\lipgolpfajiadodbcbljdpmbmbdmfcil
    [!] Folder Deleted : C:\Users\Patszy\AppData\Local\Google\Chrome\User Data\Default\Extensions\lipgolpfajiadodbcbljdpmbmbdmfcil
    [!] Folder Deleted : C:\Users\Patszy\AppData\Local\Google\Chrome\User Data\Default\Extensions\lipgolpfajiadodbcbljdpmbmbdmfcil
    [!] Folder Deleted : C:\Users\Patszy\AppData\Local\Google\Chrome\User Data\Default\Extensions\lipgolpfajiadodbcbljdpmbmbdmfcil
    [!] Folder Deleted : C:\Users\Patszy\AppData\Local\Google\Chrome\User Data\Default\Extensions\lipgolpfajiadodbcbljdpmbmbdmfcil
    [!] Folder Deleted : C:\Users\Patszy\AppData\Local\Google\Chrome\User Data\Default\Extensions\lipgolpfajiadodbcbljdpmbmbdmfcil
    [!] Folder Deleted : C:\Users\Patszy\AppData\Local\Google\Chrome\User Data\Default\Extensions\lipgolpfajiadodbcbljdpmbmbdmfcil
    [!] Folder Deleted : C:\Users\Patszy\AppData\Local\Google\Chrome\User Data\Default\Extensions\lipgolpfajiadodbcbljdpmbmbdmfcil
    File Deleted : C:\END
    File Deleted : C:\Users\Patszy\AppData\Roaming\Mozilla\Firefox\Profiles\0i4tzmm4.default\searchplugins\Conduit.xml

    ***** [ Shortcuts ] *****


    ***** [ Registry ] *****

    Key Deleted : HKCU\Software\Google\Chrome\Extensions\lipgolpfajiadodbcbljdpmbmbdmfcil
    Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\lipgolpfajiadodbcbljdpmbmbdmfcil
    Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT3279418
    Key Deleted : HKCU\Software\AppDataLow\Toolbar

    ***** [ Browsers ] *****

    -\\ Internet Explorer v11.0.9600.16384


    -\\ Mozilla Firefox v26.0 (en-US)

    [ File : C:\Users\Patszy\AppData\Roaming\Mozilla\Firefox\Profiles\0i4tzmm4.default\prefs.js ]

    Line Deleted : user_pref("CT3279418.UserID", "UN96073884322418239");
    Line Deleted : user_pref("CT3279418.fullUserID", "UN96073884322418239.IN.20131210184400");
    Line Deleted : user_pref("CT3279418.installerVersion", "1.8.1.4");
    Line Deleted : user_pref("CT3279418.toolbarInstallDate", "10-12-2013 18:44:02");
    Line Deleted : user_pref("CT3279418.versionFromInstaller", "10.23.0.722");
    Line Deleted : user_pref("CT3279418.xpeMode", "0");
    Line Deleted : user_pref("smartbar.machineId", "RW2N2CAHEYROD9DD0W/JG+F+SHSJXKHRJHICHKSKZTJKOGZGK/6HXLTPGI8F1NJZRZVBONXCQDFNAYU162R8VA");

    -\\ Google Chrome v32.0.1700.107

    [ File : C:\Users\Patszy\AppData\Local\Google\Chrome\User Data\Default\preferences ]


    *************************

    AdwCleaner[R0].txt - [7084 octets] - [08/02/2014 19:17:52]
    AdwCleaner[S0].txt - [4204 octets] - [08/02/2014 19:24:10]

    ########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [4264 octets] ##########
     
    patszy, Feb 8, 2014
    #14
  16. starbuck

    starbuck Rest In Peace Pete Administrator

    Joined:
    Sep 26, 2009
    Messages:
    3,830
    Location:
    Midlands, UK
    Operating System:
    Windows 10
    CPU:
    AMD Athlon II x2 250 Processor 3.00GHz
    Memory:
    8gb DDR3
    Hard Drive:
    500gb SATA
    Graphics Card:
    ASUS GeForce GTX 960 2gb
    Power Supply:
    650w PowerCool X-Viper
    Hi patszy,

    There is obviously still a run entry in the startup folder that is trying to start.

    By all means try Junkware Removal Tool.
    If that doesn't remove it, there is another way.

    For x64 bit systems download Farbar Recovery Scan Tool x64 and save it to your Desktop.

    • Double-click the downloaded icon to run the tool.

      a1e30894cbd1e51d77798ccaebcd6fa0.png
    • When the tool opens click Yes to disclaimer.

      6c81f32e4cfa276b33b2c5b126a03416.png
    • Press Scan button.

      014f1b4e3a5ba0cd21d8d5fcb5855e81.png
    • It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
    • The first time the tool is run, it also makes another log (Addition.txt). Please copy and paste it to your reply also.
     
    starbuck, Feb 9, 2014
    #15
  17. patszy

    patszy Registered Members

    Joined:
    Aug 1, 2010
    Messages:
    181
    Location:
    USA
    Operating System:
    Windows 8
    Hi,
    I ran the Junkware Removal Tool when I got home from church. I rebooted and still had the RunDLL file!

    Here are the results of the scan:
    0ec26d7e8f8daa5d39195001cebcd502.jpg

    542db88693c249d38d64ad1717a1e1ca.jpg
     
    patszy, Feb 9, 2014
    #16
  18. patszy

    patszy Registered Members

    Joined:
    Aug 1, 2010
    Messages:
    181
    Location:
    USA
    Operating System:
    Windows 8
    Windows will not let me open that last one {Farbar} because it will put my machine at risk.
     
    patszy, Feb 9, 2014
    #17
  19. starbuck

    starbuck Rest In Peace Pete Administrator

    Joined:
    Sep 26, 2009
    Messages:
    3,830
    Location:
    Midlands, UK
    Operating System:
    Windows 10
    CPU:
    AMD Athlon II x2 250 Processor 3.00GHz
    Memory:
    8gb DDR3
    Hard Drive:
    500gb SATA
    Graphics Card:
    ASUS GeForce GTX 960 2gb
    Power Supply:
    650w PowerCool X-Viper
    Could you please explain this a bit more.... as FRST will in no way put your machine at risk.
    It doesn't remove anything, it only produces a report of what is actually on the machine.
    Did FRST download ok?
    Is it just the opening of the program that gives that warning?
    What program is giving the warning?
    Once i have your answers i can always ask the developer as per the reasons for this.

    Thanks
     
    starbuck, Feb 9, 2014
    #18
  20. patszy

    patszy Registered Members

    Joined:
    Aug 1, 2010
    Messages:
    181
    Location:
    USA
    Operating System:
    Windows 8
    I downloaded it and that was ok. When I tried to open it I got a message that went across the whole screen. It said Windows will not open....it will put my computer at risk. So, I did not try again. I would not know what to do it it damaged my computer!! Don't know how or why, but that is what it said.
    After all the trouble I had when I downloaded and installed Classic Shell, I am more careful what I download. Classic Shell is how I got all that malware.
     
    patszy, Feb 10, 2014
    #19
  21. starbuck

    starbuck Rest In Peace Pete Administrator

    Joined:
    Sep 26, 2009
    Messages:
    3,830
    Location:
    Midlands, UK
    Operating System:
    Windows 10
    CPU:
    AMD Athlon II x2 250 Processor 3.00GHz
    Memory:
    8gb DDR3
    Hard Drive:
    500gb SATA
    Graphics Card:
    ASUS GeForce GTX 960 2gb
    Power Supply:
    650w PowerCool X-Viper
    Hi patszy,

    I have run FRST a number of times before, but never on my Win8.1 system.
    So i just downloaded it and gave it a try.
    Yes i see what you mean now.
    It's just Windows being over protective.
    FRST is safe to run ( Windows just doesn't recognise it)
    Easy way around it.
    When the message comes, click on More Info.

    25661e16d4998b13082ea89485756ae8.png

    Now on the next screen click on Run Anyway.

    ebdc4374dab5a2286e35a8968de4af59.png

    • When the tool opens click Yes to disclaimer.

      6c81f32e4cfa276b33b2c5b126a03416.png
    • Press Scan button.

      014f1b4e3a5ba0cd21d8d5fcb5855e81.png
    • It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
    • The first time the tool is run, it also makes another log (Addition.txt). Please copy and paste it to your reply also.

    Isn't Win8.1 full of fun. :crazy:
     
    starbuck, Feb 10, 2014
    #20
Page 1 of 2

Share This Page