RUNDLL Error Messages

During "Startup" I get two messages both of which have "RUNDLL" in the upper
left hand corner and both of which begin with "Error Loading." The 2
messages are as follows:

1. c:\windows\system32\uvcemhnc.dll

2. c:\windows\system32\elfgbxoo.dll

After I close both of the boxes, the computer doesn't seem to be affected
but I know that problems can simmer under the surface and then cause damage
down the road. I have an IBM ThinkCentre Desktop. When I am in the Systems
Configuration Utility I see the two files under the "Start up" tab but I
don't see any way to fix or delete them (if indeed this would be wise).

I have gotten advice from Norton that was useless and Microsoft sent me to
this site. Any advice anyone can give me would be appreciated.

"DJ" <DJ@discussions.microsoft.com> wrote in message
news:0D9D33E8-5F0E-45CC-A601-8E83A6899CCC@microsoft.com...
> During "Startup" I get two messages both of which have "RUNDLL" in the upper
> left hand corner and both of which begin with "Error Loading." The 2
> messages are as follows:
>
> 1. c:\windows\system32\uvcemhnc.dll
>
> 2. c:\windows\system32\elfgbxoo.dll
>
> After I close both of the boxes, the computer doesn't seem to be affected
> but I know that problems can simmer under the surface and then cause damage
> down the road. I have an IBM ThinkCentre Desktop. When I am in the Systems
> Configuration Utility I see the two files under the "Start up" tab but I
> don't see any way to fix or delete them (if indeed this would be wise).
>
> I have gotten advice from Norton that was useless and Microsoft sent me to
> this site. Any advice anyone can give me would be appreciated.


Did you run an antivirus or antispyware scan recently on this computer? The
behavior you describe is usually what happens when an antivirus or
antispyware program identifies a file as malware, deletes the file, but doesn't
clean up the mechanism that launches the malware at startup.

Here's a program from Microsoft that will help you stop the error messages.

AutoRuns for Windows v9.21
http://technet.microsoft.com/en-us/s.../bb963902.aspx

Once you've downloaded and extracted the files, run autoruns.exe.
Look on the Everything tab for an entry that lists uvcemhnc.dll in the Image
path
column.
Right click on that entry and select Search Online from the menu.
Odds are that you'll come up with an empty search. This pretty much confirms
that it was some type of malware that your scan deleted.
Uncheck the item.
Do the same for elfgbxoo.dll.
Restart your computer. If you no longer see the error message, you can go back
and delete the entry in Autoruns.

Just to be on the safe side, you might consider taking steps to make sure the
system is malware free. Here's a site with general instructions on cleaning a
computer.

Courtesy of Malke Routh, MS-MVP
http://www.elephantboycomputers.com/...iruses_Malware

Good luck

Nepatsfan

This might be a problem caused to any infection(Vundo Virus). When u get this
message it seems the vundo is removed from the computer but just the startup
entries are left.

You can manually remove them from registry.
First put the computer to the normal mode from msconfig.
Then look under this two locations.
HKLM\Software\Microsoft\Windows\Current Version\Run
HKCU\Software\Microsoft\Windows\Current Version\Run
If u find the entries you can delete them.

Make sure these files are not present in the System32 folder.
--
Mir Sajjad Mehdi
Microsoft XP Platform Support


"DJ" wrote:

> During "Startup" I get two messages both of which have "RUNDLL" in the upper
> left hand corner and both of which begin with "Error Loading." The 2
> messages are as follows:
>
> 1. c:\windows\system32\uvcemhnc.dll
>
> 2. c:\windows\system32\elfgbxoo.dll
>
> After I close both of the boxes, the computer doesn't seem to be affected
> but I know that problems can simmer under the surface and then cause damage
> down the road. I have an IBM ThinkCentre Desktop. When I am in the Systems
> Configuration Utility I see the two files under the "Start up" tab but I
> don't see any way to fix or delete them (if indeed this would be wise).
>
> I have gotten advice from Norton that was useless and Microsoft sent me to
> this site. Any advice anyone can give me would be appreciated.

"DJ" wrote:

> During "Startup" I get two messages both of which have "RUNDLL" in the upper
> left hand corner and both of which begin with "Error Loading." The 2
> messages are as follows:
>
> 1. c:\windows\system32\uvcemhnc.dll
>
> 2. c:\windows\system32\elfgbxoo.dll
>
> After I close both of the boxes, the computer doesn't seem to be affected
> but I know that problems can simmer under the surface and then cause damage
> down the road. I have an IBM ThinkCentre Desktop. When I am in the Systems
> Configuration Utility I see the two files under the "Start up" tab but I
> don't see any way to fix or delete them (if indeed this would be wise).
>
> I have gotten advice from Norton that was useless and Microsoft sent me to
> this site. Any advice anyone can give me would be appreciated.


Unexplained computer behaviour may be caused by deceptive software
http://support.microsoft.com/kb/827315

Go through these Cleaning steps:
1... First, try to clean up your caches, Internet files and delete cookies
by doing this:
Click Start >> Control Panel >> Double click Network and Internet
Connections >> Double click Internet Options.
On the IE properties windows you will see these Tabs:
General | Security | Privacy | Content | Connections | Programs |
Advanced
Under General Tab clear your History, Internet Files and Cookies.
Then click on Advanced tab and scroll down to under the Browsing Option:
[&] Browsing
[ ] Enable Third-Party browser extensions (Req Rest) uncheck this box.
Then click on Programs Tab and click Manage Add-Ons and Disable all non
Verified Add-Ons (You should Renable them later one-by-one and see the
culprit and update it or remove it.
How to manage Add-Ons:
http://support.microsoft.com/kb/883256
Scan for malware from here:
http://onecare.live.com/site/en-gb/d....htm?s_cid=sah
http://onecare.live.com/standard/en-gb/default.htm
RootkitRevealer v1.71
By Bryce Cogswell and Mark Russinovich
http://www.microsoft.com/technet/sys...tRevealer.mspx


Run a scan from here on-line:
http://security.symantec.com/sscv6/d...d=ie&venid=sym
http://www3.ca.com/securityadvisor/virusinfo/scan.aspx
Download Avast Cleaner (offline scanner) from here:
http://www.avast.com/eng/avast-virus-cleaner.html

You can download this tool "AutoRuns for Windows"
http://technet.microsoft.com/en-us/s.../bb963902.aspx
And remove the entry from here:

Locate this key:
HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Run = look in
the right pane/window and remove the entry for it
" c:\windows\system32\uvcemhnc.dll"
And this Key:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\Run = look in
the right pane/window and remove the entry for it
"c:\windows\system32\elfgbxoo.dll"
Run disk cleanup and defrag in safe mode.

HTH.
nass
---
http://www.nasstec.co.uk

I'll try this. Thank You

"Mir Mehdi" wrote:

> This might be a problem caused to any infection(Vundo Virus). When u get this
> message it seems the vundo is removed from the computer but just the startup
> entries are left.
>
> You can manually remove them from registry.
> First put the computer to the normal mode from msconfig.
> Then look under this two locations.
> HKLM\Software\Microsoft\Windows\Current Version\Run
> HKCU\Software\Microsoft\Windows\Current Version\Run
> If u find the entries you can delete them.
>
> Make sure these files are not present in the System32 folder.
> --
> Mir Sajjad Mehdi
> Microsoft XP Platform Support
>
>
> "DJ" wrote:
>
> > During "Startup" I get two messages both of which have "RUNDLL" in the upper
> > left hand corner and both of which begin with "Error Loading." The 2
> > messages are as follows:
> >
> > 1. c:\windows\system32\uvcemhnc.dll
> >
> > 2. c:\windows\system32\elfgbxoo.dll
> >
> > After I close both of the boxes, the computer doesn't seem to be affected
> > but I know that problems can simmer under the surface and then cause damage
> > down the road. I have an IBM ThinkCentre Desktop. When I am in the Systems
> > Configuration Utility I see the two files under the "Start up" tab but I
> > don't see any way to fix or delete them (if indeed this would be wise).
> >
> > I have gotten advice from Norton that was useless and Microsoft sent me to
> > this site. Any advice anyone can give me would be appreciated.

Yes I did recently run an anti-virus. Maybe that's it. Thanks a lot for
your help.

"Nepatsfan" wrote:

> "DJ" <DJ@discussions.microsoft.com> wrote in message
> news:0D9D33E8-5F0E-45CC-A601-8E83A6899CCC@microsoft.com...
> > During "Startup" I get two messages both of which have "RUNDLL" in the upper
> > left hand corner and both of which begin with "Error Loading." The 2
> > messages are as follows:
> >
> > 1. c:\windows\system32\uvcemhnc.dll
> >
> > 2. c:\windows\system32\elfgbxoo.dll
> >
> > After I close both of the boxes, the computer doesn't seem to be affected
> > but I know that problems can simmer under the surface and then cause damage
> > down the road. I have an IBM ThinkCentre Desktop. When I am in the Systems
> > Configuration Utility I see the two files under the "Start up" tab but I
> > don't see any way to fix or delete them (if indeed this would be wise).
> >
> > I have gotten advice from Norton that was useless and Microsoft sent me to
> > this site. Any advice anyone can give me would be appreciated.
>
>
> Did you run an antivirus or antispyware scan recently on this computer? The
> behavior you describe is usually what happens when an antivirus or
> antispyware program identifies a file as malware, deletes the file, but doesn't
> clean up the mechanism that launches the malware at startup.
>
> Here's a program from Microsoft that will help you stop the error messages.
>
> AutoRuns for Windows v9.21
> http://technet.microsoft.com/en-us/s.../bb963902.aspx
>
> Once you've downloaded and extracted the files, run autoruns.exe.
> Look on the Everything tab for an entry that lists uvcemhnc.dll in the Image
> path
> column.
> Right click on that entry and select Search Online from the menu.
> Odds are that you'll come up with an empty search. This pretty much confirms
> that it was some type of malware that your scan deleted.
> Uncheck the item.
> Do the same for elfgbxoo.dll.
> Restart your computer. If you no longer see the error message, you can go back
> and delete the entry in Autoruns.
>
> Just to be on the safe side, you might consider taking steps to make sure the
> system is malware free. Here's a site with general instructions on cleaning a
> computer.
>
> Courtesy of Malke Routh, MS-MVP
> http://www.elephantboycomputers.com/...iruses_Malware
>
> Good luck
>
> Nepatsfan
>
>
>
>
>

I'll give it a shot. Thanks

"nass" wrote:

>
>
> "DJ" wrote:
>
> > During "Startup" I get two messages both of which have "RUNDLL" in the upper
> > left hand corner and both of which begin with "Error Loading." The 2
> > messages are as follows:
> >
> > 1. c:\windows\system32\uvcemhnc.dll
> >
> > 2. c:\windows\system32\elfgbxoo.dll
> >
> > After I close both of the boxes, the computer doesn't seem to be affected
> > but I know that problems can simmer under the surface and then cause damage
> > down the road. I have an IBM ThinkCentre Desktop. When I am in the Systems
> > Configuration Utility I see the two files under the "Start up" tab but I
> > don't see any way to fix or delete them (if indeed this would be wise).
> >
> > I have gotten advice from Norton that was useless and Microsoft sent me to
> > this site. Any advice anyone can give me would be appreciated.
>
>
> Unexplained computer behaviour may be caused by deceptive software
> http://support.microsoft.com/kb/827315
>
> Go through these Cleaning steps:
> 1... First, try to clean up your caches, Internet files and delete cookies
> by doing this:
> Click Start >> Control Panel >> Double click Network and Internet
> Connections >> Double click Internet Options.
> On the IE properties windows you will see these Tabs:
> General | Security | Privacy | Content | Connections | Programs |
> Advanced
> Under General Tab clear your History, Internet Files and Cookies.
> Then click on Advanced tab and scroll down to under the Browsing Option:
> [&] Browsing
> [ ] Enable Third-Party browser extensions (Req Rest) uncheck this box.
> Then click on Programs Tab and click Manage Add-Ons and Disable all non
> Verified Add-Ons (You should Renable them later one-by-one and see the
> culprit and update it or remove it.
> How to manage Add-Ons:
> http://support.microsoft.com/kb/883256
> Scan for malware from here:
> http://onecare.live.com/site/en-gb/d....htm?s_cid=sah
> http://onecare.live.com/standard/en-gb/default.htm
> RootkitRevealer v1.71
> By Bryce Cogswell and Mark Russinovich
> http://www.microsoft.com/technet/sys...tRevealer.mspx
>
>
> Run a scan from here on-line:
> http://security.symantec.com/sscv6/d...d=ie&venid=sym
> http://www3.ca.com/securityadvisor/virusinfo/scan.aspx
> Download Avast Cleaner (offline scanner) from here:
> http://www.avast.com/eng/avast-virus-cleaner.html
>
> You can download this tool "AutoRuns for Windows"
> http://technet.microsoft.com/en-us/s.../bb963902.aspx
> And remove the entry from here:
>
> Locate this key:
> HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Run = look in
> the right pane/window and remove the entry for it
> " c:\windows\system32\uvcemhnc.dll"
> And this Key:
> HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\Run = look in
> the right pane/window and remove the entry for it
> "c:\windows\system32\elfgbxoo.dll"
> Run disk cleanup and defrag in safe mode.
>
> HTH.
> nass
> ---
> http://www.nasstec.co.uk
>
>