Solved Yet Another dll Problem on Startup

[Curtis01]

My wife installed the yucky Babylon Adware last night.

I updated and ran Spybot, which I believe removed it. However, I am now getting this error message on every startup:

"There was a problem starting.

C:\\Users\Curtis\AppData\Roaming\BabSolution\Shared\NTRedirect.dll

The Specified module could not be found."

I ran Adware Cleaner and JRT.

Reports attached to this post.

Thank you in advance.

--Curtis

 

[gregrocker]

Spybot isn't recommended by anyone here ever as its been years since it became bloated and buggy, and could have actually made the situation worse. I'd run full scans with SUPERAntiSpyware and Malwarebytes for on-demand scanning, and installed AV Microsoft Security Essentials.

Disable all add-ons and Search services in browsers except Flash and Google and keep them out.

Turn off all startups except AV, any sync, gadgets or stickies in msconfig>Startup and >Services after Hiding all MS Services. Keep those clean too.

 

[Curtis01]

Thank you for the advice.

But what specific solution will make the error message stop appearing on startup?

--Curtis

 

[VistaKing]

On your wife's PC download and run the program below

Farbar Recovery Scan Tool


64-Bit Version OS Farbar Recovery Scan Tool x64 <===== Download Link

Drag the FRST64.exe from the Downloads folder to your Desktop

Right click on FRST64.exe and choose

When the tool opens click Yes on the disclaimer window .

Press Scan button.

FRST will let you know when the scan is complete and has written the FRST.txt to file

   Note

The first time Farbar Recovery Scan Tool is run, it makes also another log Addition.txt

Please upload both logs in your reply.(FRST.txt and Addition.txt)

:note: FRST.txt and Addition.txt will be on the Desktop :note:

Upload a File
Click on the Go Advanced button under the Message box . Scroll down to Additional Options then click on Manage Attachments in the Attach Files sections . Click the Browse button locate the file then click on the Open button . In the Upload File from your Computer section click on the Upload button . Wait until it finishes uploading then close the window . Then click Submit Reply .

 

[VistaKing]

Also run

<==== Download


<==== Download

:ar: Click on one of the links above that goes with your Windows 7 bit versions

:ar: Save to the Desktop.

:ar: Close all windows and browsers

:ar: Right click on

and choose

:ar: Press: SCAN

:ar: provide the RKreport.txt (Mode: Scan) in your reply.

 

[gregrocker]

Thank you for the advice.

But what specific solution will make the error message stop appearing on startup?

--Curtis

All of them.

Spybot likely only half removed it so it's struggling to start with Windows. SAS can likely root it out of registry, but the other scans and steps may be required to be comprehensive.

You can also look at your System Restore points to see if you can get before the infection.

 

[madcratebuilder]

It's probably caused by a entry in the registry. If you feel comfortable working with regedit you can search and delete the entry.

 

[Curtis01]

Thank you all for the advice.

I will work on it later today and let you know the results.

Take care.

--Curtis

 

[Curtis01]

FRST files attached.

Will run other scans as time permits.

Thank you for your assistance.

--Curtis

 

[Curtis01]

RK file attached.

Will run other scans as time permits.

Thank you for your assistance.

--Curtis

 

[Curtis01]

I have not yet deleted any of the items RK directed me to delete.

--Curtis

 

[VistaKing]

Open notepad. Inside notepad paste the highlighted items below


start
HKCU\...\Run: [Networking USB Server] - [x]
HKCU\...\Run: [PlayNC Launcher] - [x]
HKCU\...\Run: [NTRedirect] - C:\Windows\SysWOW64\rundll32.exe [44544 2009-07-13] (Microsoft Corporation) <===== ATTENTION
HKLM-x32\...\Run: [] - [x]
2013-08-02 06:35 - 2009-07-13 22:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
C:\Windows\SysWOW64\rundll32.exe
C:\Users\Curtis\lide20lide30n670un676un1240uvst7031a_xpen.exe
end


Click on File select Save As
Location to save file : Desktop
File Name: Fixlist.txt
Save as type : All Files

Click on the Save button

Open FRST64.exe again and this time click on the [FIX] button once complete . Restart your PC . You will have a log called Fixlog.txt upload the log with your reply .

 

[VistaKing]

Once you're done running the fix. Rerun RogueKiller and click on the Delete button.

 

[Curtis01]

Ah, I used the delete function in RK and rebooted. The error message did not appear on this start. I jumped the gun a bit . . .

I will continue working on this in awhile, I need to do some stuff with the kids.

I will post the results.

Thank you all very much for your assistance.

--Curtis

 

[Curtis01]

Fixlog.txt attached.

--Curtis

 

[Curtis01]

Re-ran RK and report attached. There was nothing to delete (I am guessing I deleted the bad stuff when I jumped the gun earlier).

--Curtis

 

[gregrocker]

What were the results of the steps I gave you earlier? You'll not know for sure the infection is gone until these are all completed. Did you want a comprehensive fix based on what has worked best here since Win7 release or just a one-off scan with a little-recognized scanner?

Rfull scans with SUPERAntiSpyware and Malwarebytes for on-demand scanning, and installed AV Microsoft Security Essentials.

Disable all add-ons and Search services in browsers except Flash and Google and keep them out.

Turn off all startups except AV, any sync, gadgets or stickies in msconfig>Startup and >Services after Hiding all MS Services. Keep those clean too.

 

[Curtis01]

SuperAntiSpyware scan log attached.

--Curtis Taylor

 

[gregrocker]

Those are low level cookies. If Malwarebytes didn't find anything more serious then I'd say you're clean.

I'd still disable all Add-ons in Browsers (from Tools>Manage Add-Ons>Extensions and Search (exept Google) ticking box to Prevent anything from changing Search choice.

And don't forget to uncheck everything except AV, any sync, gadgets/stickies in msconfig>Startup and>Services after Hiding All MS Services. The rest are all freeloaders mostly spying on you to build a profile sold to advertisers.

Finally you can minimize tracking cookies building a profile of you using Opt Out of Network Advertising. This is useful to stop having ads pasted everywhere based on what you just searched for.

 

[VistaKing]

Run

SystemCheck

Click here :ar: SecurityCheck to Download

Place the file onto your desktop

Right-click the SecurityCheck choose

Press any key to continue

Once the scan is done . It will open up a text file copy and paste the text

Press Ctrl and A to select All of the text
Press Ctrl and C to copy the selected text
In your reply click on the message box and press Ctrl and V to Paste