Unusual startup item

simon11 · 4 May 2011 at 08:40

I have just found this startup item which will not allow me to remove it. It just comes back.

Value Name: Gpefirawaxo
Value Data: rundll32.exe "C:\WINDOWS\egunuhog.dll",Startup
C:\WINDOWS\egunuhog.dll
274432 bytes
Created: 28/02/2006 13:00
Modified: 14/04/2008 01:12
Company: [no info]

Anybody know what this is?
I have searched the internet but I can't find anything.
I have recently had a few problems and I wonder if it is this.

BigBoy · 4 May 2011 at 08:56

Would Run cccleaner Spybot S&D, MWB and a few other check/cleaning programs looks like mailware to me.

Snograt · 4 May 2011 at 09:10

Nope - the only time egunuhog.dll turns up on a web search is this thread and the identical copy on another-forum-that-shall-not-be-named.

Rule of thumb: dll with random name = virus.

mrk · 4 May 2011 at 10:23

Send the dll to virustotal/jotti for online scanning

http://virusscan.jotti.org/en
http://www.virustotal.com/

simon11 · 4 May 2011 at 12:07

I ran a process scanner which found it. But when I ask it to delete it. It says file not found. It is hiding itself. A system scan does not locate it.
However I have managed to disable it in the startup menu (msconfig) from safe mode.
I hope it stays disabled!

I can't upload the dll to the internet as it is hidden.

Thanks for the replies.

Alasdairhurst · 5 May 2011 at 15:15

doesn't it show in task manager? If it does, you can "go to process location" and make sure you have hidden files visible.

you could also pop the hard drive into another pc as a data drive, and search for the file while your OS, and the program, isn't running.