?
Solved

Need to remove atledit.dll spyware

Posted on 2004-10-13
11
Medium Priority
?
195 Views
Last Modified: 2010-04-12
I have a piece of spyware on my computer that seems to be related to this .dll file:

Winnt/System32/atledit.dll

This .dll is hidden, and I am unable to delete it, even in safe mode.

I also found a reference to atledit.dll here:

HKLM\software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notitfy\WOW

IF I delete the WOW folder it just comes right back. This spyware creates IE popups on my desktop. How can i get rid of this?
0
Comment
Question by:dplusp
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 4
  • 2
  • +1
11 Comments
 
LVL 65

Accepted Solution

by:
SheharyaarSaahil earned 1050 total points
ID: 12303124
Hello dplusp =)

Do this, Download Adaware SE from here >> AdAware ==> http://www.spychecker.com/program/adaware.html
Install and Update it, and then get this plugin for it and install it >> http://www.lavasoftusa.com/software/addons/vx2cleaner.shtml

Then boot ur system in safemode, and run the scan with Adaware and delete everything it detects !!
Run Disk Cleanup to delete the temp and junks from ur hard drive !!

Restart back in normal mode and check for the problem now ??
if still the same, then Download this tool >> http://download.broadbandmedic.com/VbStuff/VX2Finder.exe
Run it and press the Find button and then the log button.
Copy everything and paste them here !!
Good Luck :)
0
 

Author Comment

by:dplusp
ID: 12303176
I did run AdAware and also SpySweeper. Both programs found a lot of other junk and deleted it. But neither one can seem to detect this particular one.

I tried the link that you sent and got an error message.

0
 
LVL 65

Expert Comment

by:SheharyaarSaahil
ID: 12303200
But i wanted u to download and install that Vx2 Addon and then scan ur system with Adaware !!
and im sorry for that wrong link, here is the working one >> http://www.downloads.subratam.org/VX2Finder9x.exe
0
When ransomware hits your clients, what do you do?

MSPs: Endpoint security isn’t enough to prevent ransomware.
As the impact and severity of crypto ransomware attacks has grown, Webroot fought back, not just by building a next-gen endpoint solution capable of preventing ransomware attacks but also by being a thought leader.

 

Author Comment

by:dplusp
ID: 12303241
I downloaded and executed the Vx2 Finder and got a message that this Finder is only for 9x based systems. Sorry, I'm using XP.
0
 
LVL 65

Expert Comment

by:SheharyaarSaahil
ID: 12303263
no problem :)
can u run this one >> http://www.downloads.subratam.org/VX2Finder.exe
0
 

Author Comment

by:dplusp
ID: 12309071
I ran the VX2 finder and it didn't detect the .dll i'm referring to.

I found the cause of my popups, but can't seem to get rid of this .dll. If I delete it from the registry it just comes right back, and if I try and remove it from the System32 folder I get an access denied error.

How can I get rid of this, or at least keep it from executing?
0
 

Expert Comment

by:rreister
ID: 12309267
Try running the free online copy of X-Cleaner:  http://www.spywareguide.com/txt_onlinescan.html
0
 

Author Comment

by:dplusp
ID: 12309539
I tried the X-Cleaner. The program ended up crashing.
0
 
LVL 65

Expert Comment

by:SheharyaarSaahil
ID: 12309809
>> I ran the VX2 finder and it didn't detect the .dll i'm referring to.

hmmmmm i asked to post here the log it produces :)
0
 
LVL 4

Expert Comment

by:riotz
ID: 12514604
Just Click Start > Run, type 'regsvr32 /u %WinDir%/System32/atledit.dll', then click Ok.
0
 
LVL 4

Expert Comment

by:riotz
ID: 12538167
so how did you fix it now ?
0

Featured Post

Free Tool: SSL Checker

Scans your site and returns information about your SSL implementation and certificate. Helpful for debugging and validating your SSL configuration.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Transferring data across the virtual world became simpler but protecting it is becoming a real security challenge.  How to approach cyber security  in today's business world!
Read about achieving the basic levels of HRIS security in the workplace.
Michael from AdRem Software outlines event notifications and Automatic Corrective Actions in network monitoring. Automatic Corrective Actions are scripts, which can automatically run upon discovery of a certain undesirable condition in your network.…
Monitoring a network: how to monitor network services and why? Michael Kulchisky, MCSE, MCSA, MCP, VTSP, VSP, CCSP outlines the philosophy behind service monitoring and why a handshake validation is critical in network monitoring. Software utilized …
Suggested Courses

752 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question