[HELP] when turn on my notebook, one module is missing

[andresse89]

hi guys, i'm new here.. but i want to ask something.. my notebook just installed windows 7 professional a week ago, there's no problem beginning..

but yesterday, when i turn on my notebook, just after booting, it said that folder windows\system32\schnas21.dll module can't be found.

could you guys tell me, what module is it?? and how to get that module??
thank's

 

[Desslok]

Looks like that is a virus or malware. Do you have anti-virus installed? Which one?

 

[Kari]

Only reference I can find is a German website (Firefox öffnet sich und schließt wieder - schnas21.dll - PCFreunde.de). According to that site, it is a trojan (TR\Fakealert.qyw.B).

Run Malwarebytes and see if it helps.

Kari

 

[Bill2]

Also, in MSCONFIG, disable any entry that resembles that schnas. If you're unsure, disable everything other than the antivirus app, then re-enable one by one.
Run CCleaner, it'll remove any orphan entries which may be responsible for that message.

 

[andresse89]

Looks like that is a virus or malware. Do you have anti-virus installed? Which one?

yes, i use the last avast free antivirus, i know there are 2 viruses(nzyqea.exe and nzyqeb.exe), and i already delete it, but now still nothing changes.. still like that when i turn on my notebook

Only reference I can find is a German website (Firefox öffnet sich und schließt wieder - schnas21.dll - PCFreunde.de). According to that site, it is a trojan (TR\Fakealert.qyw.B).

Run Malwarebytes and see if it helps.

Kari

i don't know why, it said this module can't be found.. i'll try that malwarebytes..

Also, in MSCONFIG, disable any entry that resembles that schnas. If you're unsure, disable everything other than the antivirus app, then re-enable one by one.
Run CCleaner, it'll remove any orphan entries which may be responsible for that message.

i'll try CCleaner too guys, thanks..

any other suggestion??

 

[Desslok]

It seems to me that your AV partially took care of the issue. Seems like maybe it quarantined the DLL but the trojan is still launching and looking for a DLL it needs. Did you see anything in MSconfig as mentioned?

 

[Kari]

Check if you can find the Fakealert.qyw.B, it should be in your temp folder.

 

[andresse89]

It seems to me that your AV partially took care of the issue. Seems like maybe it quarantined the DLL but the trojan is still launching and looking for a DLL it needs. Did you see anything in MSconfig as mentioned?

sory, i'm beginner with this notebook and windows 7, where could i see the MSconfig??

Check if you can find the Fakealert.qyw.B, it should be in your temp folder.

where could i see the temp folder??

 

[andresse89]

oh guys i already found the msconfig using run, i could see 1 start item using that module is canaveral and the manufacturer is unknown, so what could i do??

 

[Bill2]

andresse89,
Canaveral is not a routine startup item. Uncheck this item in MSCONFIG. It'll give you a message about wanting to restart, do so.
Before restarting, under the column "Command" in Startup tab of MSCONFIG, note down its path. Delete this file from that directory by rebooting the PC in Safe Mode.

 

[andresse89]

andresse89,
Canaveral is not a routine startup item. Uncheck this item in MSCONFIG. It'll give you a message about wanting to restart, do so.
Before restarting, under the column "Command" in Startup tab of MSCONFIG, note down its path. Delete this file from that directory by rebooting the PC in Safe Mode.

yes, i'm already uncheck this item in MSCONFIG n this problem not come's back..

but how could i delete this virus??

at MSCONFIG command, this startup item in rundll32.exe n located at HKCU\software\microsoft\windows\currentversion\run

but i could not find that HKCU.. and i already search the rundll32.exe, but this rundll32.exe are located at my windows.old folder..

before i use vista, n install the win7 at the same partition disc.. my question, if i delete the windows.old(that contain my vista) folder, is it okay?? i mean, is it no problem with my windows 7 now??

 

[Bill2]

"HKCU\software\microsoft\windows\currentversion\run" is a registry base key under which there are located various registry startup items.
To navigate to this key, click on Start button, then in "Run" box, type Regedit. In the left narrow pane look for HKEY_CURRENT_USER. Drill down that key till you locate the desired key. Then under the entry "Run", look in the right pane and try locate the value related to your problem startup. Before deleting, make a backup of your existing "Run" by right clicking on "Run", then click on Export and when prompted, save as "reg" file on your hdd.
IDK how comfortable you are getting into the registry, so suggest installing an app like CCleaner and doing a Registry Cleanup from there.
You can delete the windows.old folder, you dont need it for win7.

 

[andresse89]

"HKCU\software\microsoft\windows\currentversion\run" is a registry base key under which there are located various registry startup items.
To navigate to this key, click on Start button, then in "Run" box, type Regedit. In the left narrow pane look for HKEY_CURRENT_USER. Drill down that key till you locate the desired key. Then under the entry "Run", look in the right pane and try locate the value related to your problem startup. Before deleting, make a backup of your existing "Run" by right clicking on "Run", then click on Export and when prompted, save as "reg" file on your hdd.
IDK how comfortable you are getting into the registry, so suggest installing an app like CCleaner and doing a Registry Cleanup from there.
You can delete the windows.old folder, you dont need it for win7.

i already use that regedit, and i can't found it, maybe i already using CCleaner.. but at the MSCONFIG that startup item still there, i just uncheck it.. so how to delete it??

 

[Bill2]

Open CCleaner. In the left pane, click on "Tools", that will open up 3 new buttons. Click on the middle button called "Startup". Then highlight the entry you want to delete and click on the "Delete" button at the bottom.

 

[andresse89]

Open CCleaner. In the left pane, click on "Tools", that will open up 3 new buttons. Click on the middle button called "Startup". Then highlight the entry you want to delete and click on the "Delete" button at the bottom.

thank's guys.. i already delete it.. hope nothing happen again with my notebook..

and i hope the moderator or admin could closed this thread..
thank's all for suggestion..