Missing dll

[Twitcher]

I get this pop up on every reboot, just needs the 'ok' button clicking to remove it, but, what is it? Cannot find info on the dll involved.
PC works fine as far as I can see:
>
Error loading C:\Users\Dell Desktop\AppData\Local\merecf.dll
The specified module could not be found
>


I am using a:
Dell
Windows Vista Home Basic
AVG version 9

[BOAC]

Weird - I would suggest an MBAM scan at least in case something is masquerading as that dll.

[bnt]

There's a user account named "Dell Desktop"? If I saw anything like that on a PC of mine, I would terminate the account with extreme prejudice.

[Twitcher]

I ran MBAM, it found a few bits but nothing with the same name or location as the offending dll. Still looking into it.
I named the pc Dell Desktop as opposed to, Fred / my name /etc. I am the only user of it.

[BOAC]

Weird! As you said at the beginning - that file name does not appear to exist! I assume you have double-checked the speeling.

If you are feeling brave you should start poking into 'hijackthis' to see where/if it appears, MSConfig for startup items and the registry if you are REALLY brave!

[Twitcher]

[Parapunter]

I'm not an expert on Dell or anything, but that path is a user account. Dell have an account on that laptop, presumably for remote access, community access or fault fixing. Either way, it is just a user account. If you deleted it, this error message will go away.

Bit of a sledgehammer to crack a nut perhaps, but if it were mine I would right click "My Computer", choose "Manage", doubleclick "Local Users and Groups", choose Users. At the right pane, choose the Dell account, rightclick and choose "delete".

[Mike-Bracknell]

I'm not an expert on Dell or anything, but that path is a user account. Dell have an account on that laptop, presumably for remote access, community access or fault fixing. Either way, it is just a user account. If you deleted it, this error message will go away.

Bit of a sledgehammer to crack a nut perhaps, but if it were mine I would right click "My Computer", choose "Manage", doubleclick "Local Users and Groups", choose Users. At the right pane, choose the Dell account, rightclick and choose "delete".

Please don't follow this suggestion blindly...

The likelihood is that you are currently logged into the computer via the account called Dell Desktop rather than it being a separate account, so deleting it would have you either come up against an error (because you can't pull the rug out from under your own account), or you would end up either logging in as administrator and blatting your own usual login, or (just as bad) manually hacking away at deleting things via file explorer if you couldn't easily delete the account in a single action.

Also, if the dll is found in that account and you are actually using a different account, it won't remove the message as the program that calls the dll won't exist solely in the same account as the dll - you'll always get an error unless you remove the way the dll is called (the easiest way would be by editing the registry, but if you're a novice Windows user I wouldn't recommend a cavalier approach to the registry).

[Parapunter]

If you're logged in on that account it simply won't let you delete it. The obvious thing is to look in user accounts or even the start menu to see exactly who's in.

[Mike-Bracknell]

If you're logged in on that account it simply won't let you delete it. The obvious thing is to look in user accounts or even the start menu to see exactly who's in.

Obvious for you maybe, not necessarily obvious for the OP.

Also, the Start Menu shows the user name, which is not necessarily the same as the login ID (which is how the Cusers folders are named).

[Twitcher]

It has gone!
MBAM must have sorted it out, after a reboot today there is no sign.
I attach the report for future reference if the problem occurs for someone else.
Here is the report:
>
>
Memory Processes Infected: 0
Memory Modules Infected: 1
Registry Keys Infected: 35
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
C:\Program Files\Windows Live\Messenger\msimg32.dll (Adware.MyWebSearch) -> Delete on reboot.

Registry Keys Infected:
HKEY_CLASSES_ROOT\CLSID\{147a976f-eee1-4377-8ea7-4716e4cdd239} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{1d4db7d1-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{1d4db7d3-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{2e9937fc-cf2f-4f56-af54-5a6a3dd375cc} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{741de825-a6f0-4497-9aa6-8023cf9b0fff} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{cf54be1c-9359-4395-8533-1657cf209cfe} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{1d4db7d0-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{d518921a-4a03-425e-9873-b9a71756821e} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\funwebproductsinstaller.start (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\funwebproductsinstaller.start.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\ Ext\Settings\{00a6faf1-072e-44cf-8957-5838f569a31d} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\ Ext\Settings\{07b18ea1-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\ Ext\Settings\{07b18ea9-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\ Ext\Settings\{07b18eab-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\ Ext\Settings\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\ Ext\Settings\{3dc201fb-e9c9-499c-a11f-23c360d7c3f8} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\ Ext\Settings\{9ff05104-b030-46fc-94b8-81276e4e27df} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\ Ext\Stats\{00a6faf1-072e-44cf-8957-5838f569a31d} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\ Ext\Stats\{07b18ea1-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\ Ext\Stats\{07b18ea9-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\ Ext\Stats\{07b18eab-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\ Ext\Stats\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\ Ext\Stats\{3dc201fb-e9c9-499c-a11f-23c360d7c3f8} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\ Ext\Stats\{9ff05104-b030-46fc-94b8-81276e4e27df} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Smart-Shopper (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{59c7fc09-1c83-4648-b3e6-003d2bbc7481} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68af847f-6e91-45dd-9b68-d6a12c30e5d7} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9170b96c-28d4-4626-8358-27e6caeef907} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{d1a71fa0-ff48-48dd-9b6d-7a13a3e42127} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{ddb1968e-ead6-40fd-8dae-ff14757f60c7} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{f138d901-86f0-4383-99b6-9cdd406036da} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Sc hemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\ Run\hjacefeq (Trojan.Agent.U) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Program Files\Windows Live\Messenger\msimg32.dll (Adware.MyWebSearch) -> Delete on reboot.

[BOAC]

it found a few bits

- hmm! It certainly did. My money is on Trojan.Agent.U which I think generated the '****.dll', but anything is possible. To completely sure, I have switched to 'Avast' (free) which allows you to set a boot time scan which normally catches the little ****ers before they get a chance to settle in to Windows.

[Bushfiva]

Just out of interest, did Twitcher ever install a browser toolbar that, among other things, allowed extra emoticons, etc.? The log looks like MyWebSearch (Smiley Central and other naff offerings).

[Twitcher]

I have never willingly installed that toolbar, or indeed any of those annoying toolbars. MyWebSearch must have been bundled in with another program at some stage on the past but I uninstalled it. I am not sure if the trojan is tied in with that or not though.