Windows Vista Forums

Unknown dll in syswow64

  1. #1



    Newbie
    Join Date : Mar 2009
    Posts : 3
    Vista Ultimate x64
    Local Time: 07:45 PM

    Unknown dll in syswow64

    The following .dll is shown as starting up the process(?) "dzdqmgkyetrqrf":

    quflsiblczsu.dll. According to startup.exe, this dll is located in the syswow64 folder, but a search (including hiddens) comes up empty.

    I have recently been the victim of a keylogger trojan and have run 2 separate programs to remove same : Spybot & Spyware Doctor.

    Is this a legitimate .dll?? If not, how do edit the registry to prevent it from working??

      My System SpecsSystem Spec

  2.   


  3. #2
    delphin's Avatar

    Eager to learn

    Join Date : Nov 2008
    Chennai
    Posts : 636
    Windows 7
    Local Time: 05:15 AM
    india

     

    Re: Unknown dll in syswow64

    Quote Originally Posted by Fredji View Post
    The following .dll is shown as starting up the process(?) "dzdqmgkyetrqrf":

    quflsiblczsu.dll. According to startup.exe, this dll is located in the syswow64 folder, but a search (including hiddens) comes up empty.

    I have recently been the victim of a keylogger trojan and have run 2 separate programs to remove same : Spybot & Spyware Doctor.

    Is this a legitimate .dll?? If not, how do edit the registry to prevent it from working??
    Hi,

    this dll looks like a random one. so its better to stop executing it.

    Open regedit.exe and drill down to h key local machine\software\Microsoft\windowsnt\current verson\svchost in the right pane find netsvcs, and double click that if u find these strings there just delete that sting click ok.

    Unknown dll in syswow64-untitled.jpg

    Unknown dll in syswow64-untitled1.jpg


    then drill down to h key local machine\system\CurrentControlSet\Services, there u will find a service with that random string name. expand the service select parameters, in the right pane click on image path, Rename that .dll file into .bad. restart ur system.

    Unknown dll in syswow64-untitled2.jpg

    Unknown dll in syswow64-untitled3.jpg



    Good luck u wiped the dll out

      My System SpecsSystem Spec

  4. #3



    Newbie
    Join Date : Mar 2009
    Posts : 3
    Vista Ultimate x64
    Local Time: 07:45 PM


      Thread Starter

    Re: Unknown dll in syswow64

    Thanks for the quick response. I followed your directions, but unfortunately the .dll is still executing.

    Here's a picture of what is displayed in startup.exe:

    [IMG]file:///C:/Users/Fredji/AppData/Local/Temp/moz-screenshot.jpg[/IMG][IMG]file:///C:/Users/Fredji/AppData/Local/Temp/moz-screenshot-1.jpg[/IMG]

      My System SpecsSystem Spec

  5. #4
    dk70's Avatar

    Member
    Join Date : Apr 2008
    Posts : 213
    Vista Ultimate x64 SP1
    Local Time: 01:45 AM
    denmark

     

    Re: Unknown dll in syswow64

    Try run Malwarebytes and/or SuperAntiSpyware ASAP. After a quickscan and perhaps reboot there is reason to believe computer is cleaned up. Especially since you say current programs detected something - then those 2 should as well and then some. May be clean up better. Not that uncommon X tool cant remove infection 100%. How special tools make money

    I assume it wont help to unregister dll-file, will keep coming back, over and over. Only showing you are still infected and Spy Doctor/Spybot need help Notice the change of names, you cant remove it so easy. If you know details of infection then you dont need programs, can do it all manually after research and pin pointing but who like that?

    Startup by Mike Lin is the latest and greatest in startup detection? Dont think so. Try Autoruns from Sysinternals Autoruns for Windows There is no better and it shows a lot more and is updated. You can save output and post it here if not those 2 programs mentioned do the job. Or post Hijackthis/RSIT log. "Logon" is similar to what you posted. Unless you want confirmation computer "appear" clean there should not be reason to if removal is done properly.

      My System SpecsSystem Spec

  6. #5



    Newbie
    Join Date : Mar 2009
    Posts : 3
    Vista Ultimate x64
    Local Time: 07:45 PM


      Thread Starter

    Re: Unknown dll in syswow64

    Thanks for the help; I finally managed to track down the instruction area (run) in the registry and removed the offending line, restarted, and it's gone

    As for the file changing names, I will run what you suggested and see what happens.

    Thanks again.

      My System SpecsSystem Spec


Unknown dll in syswow64
Similar Threads
Thread Forum
tmp files in SysWOW64 Vista performance & maintenance
x64 vista running processes from syswow64 directory Vista General
Virus sysWOW64 Vista security
SysWOW64?? Vista General
SysWOW64 is 92 gb!!! General Discussion