Which software removes some dll files from WindowsSystem32..

[fred]

Hello,
On each Windows reboot I have the same, two dll files removed from
my Windows\System32 folder.
Which program is responsible for that?
Please advise,
Fred

[jose]

On Jul 22, 3:42

[pegasus [mvp]]

"fred" <fred@nospamme.com> wrote in message
news:%23JsJPSwCKHA.4792@TK2MSFTNGP05.phx.gbl...
> Hello,
> On each Windows reboot I have the same, two dll files removed
> from my Windows\System32 folder.
> Which program is responsible for that?
> Please advise,
> Fred

Which files?

[fred]

The names will not tell you anything: msgpd.dll and msgphd.dll
They belong to the program I trust and use every day.
However, after each Windows reboot I have to reinstall that program to be
able to use it again.
Thanks,
Fred

"Pegasus [MVP]" <news@microsoft.com> wrote in message
news:uK1FCVwCKHA.4608@TK2MSFTNGP02.phx.gbl...
>
> "fred" <fred@nospamme.com> wrote in message
> news:%23JsJPSwCKHA.4792@TK2MSFTNGP05.phx.gbl...
>> Hello,
>> On each Windows reboot I have the same, two dll files removed
>> from my Windows\System32 folder.
>> Which program is responsible for that?
>> Please advise,
>> Fred
>
> Which files?
>

[pa bear [ms mvp]]

>>> On each Windows reboot I have the same, two dll files removed
>>> from my Windows\System32 folder.

How have you determined that the files have been removed? Are you seeing
"file missing" errors when you reboot?

> They belong to the program I trust and use every day.

Phone Dialer Pro (VOIP software), perchance?

There is a very good chance that you are seeing the effects of a hijackware
infection (e.g., Backdoor.Win32.Ripper)!

NB: If you had no anti-virus application installed or the subscription had
expired *when the machine first got infected* and/or your subscription has
since expired and/or the machine's not been kept fully-patched at Windows
Update, don't waste your time with any of the below: Format & reinstall
Windows. A Repair Install will NOT help!

1. See if you can download/run the MSRT manually:
http://www.microsoft.com/security/malwa ... fault.mspx

NB: Run the FULL scan, not the QUICK scan! You may need to download the
MSRT on a non-infected machine, then transfer MRT.EXE to the infected
machine and rename it to SCAN.EXE before running it.

2. [WinXP ONLY!! =>] Run the Windows Live Safety Center's 'Protection' scan
(only!) in Safe Mode with Networking, if need be:
http://onecare.live.com/site/en-us/center/howsafe.htm

3. Run a /thorough/ check for hijackware, including posting the requested
logs in an appropriate forum, not here.

Checking for/Help with Hijackware
http://aumha.net/viewtopic.php?f=30&t=4075
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/data/prevention.htm
http://inetexplorer.mvps.org/tshoot.html
http://www.mvps.org/sramesh2k/Malware_Defence.htm
http://www.elephantboycomputers.com/pag ... ng_Malware

**Chances are you will need to seek expert assistance in
http://spywarehammer.com/simplemachines ... board=10.0,
http://www.spywarewarrior.com/viewforum.php?f=5,
http://www.dslreports.com/forum/cleanup,
http://www.bluetack.co.uk/forums/index.php,
http://aumha.net/viewforum.php?f=30 or other appropriate forums as well.**

If these procedures look too complex - and there is no shame in admitting
this isn't your cup of tea - take the machine to a local, reputable and
independent (i.e., not BigBoxStoreUSA) computer repair shop.
--
~Robear Dyer (PA Bear)
MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002


fred wrote:
> The names will not tell you anything: msgpd.dll and msgphd.dll
> They belong to the program I trust and use every day.
> However, after each Windows reboot I have to reinstall that program to be
> able to use it again.
>
>> Which files?
>>
>>> On each Windows reboot I have the same, two dll files removed
>>> from my Windows\System32 folder.
>>> Which program is responsible for that?

[tom willett]

No, not all virus scanners will warn and alert you *unless* you have
instructed them to do so. Normally, the default is to quarantine or delete.

"ANONYMOUS" <xfsgpr@googlemail.com> wrote in message
news:01fac1a5-cc9d-469c-9725-41eb58517d49@c29g2000yqd.googlegroups.com...
On Jul 22, 9:34 pm, "Pegasus [MVP]" <n...@microsoft.com> wrote:
> They are probably being removed by your virus scanner, e.g. because of a
> false positive alert. Have you checked its quarantine location?
>

No it can't be. All virus scanners will warn you and/or alert you
before taking any drastic action like deleting a file! Please don't
misinform people or give them false sense of security on these
reputable Microsoft newsgroups.

[pegasus [mvp]]

They are probably being removed by your virus scanner, e.g. because of a
false positive alert. Have you checked its quarantine location?

You can confirm my suspicion like so:
1. Physically disconnect your machine from the Internet.
2. Run msconfig.exe.
3. Disable all scanner-related tasks under the startup tab.
4. Disable all scanner-related services under the services tab.
5. Reboot your machine.
6. If the files are missing, re-install them.
7. Reboot the machine.
If files are no longer missing then it's your virus scanner that does the
damage.
8. Re-enable all scanner-related tasks and services.

"fred" <fred@nospamme.com> wrote in message
news:%2374fYgwCKHA.4004@TK2MSFTNGP05.phx.gbl...
> The names will not tell you anything: msgpd.dll and msgphd.dll
> They belong to the program I trust and use every day.
> However, after each Windows reboot I have to reinstall that program to be
> able to use it again.
> Thanks,
> Fred
>
> "Pegasus [MVP]" <news@microsoft.com> wrote in message
> news:uK1FCVwCKHA.4608@TK2MSFTNGP02.phx.gbl...
>>
>> "fred" <fred@nospamme.com> wrote in message
>> news:%23JsJPSwCKHA.4792@TK2MSFTNGP05.phx.gbl...
>>> Hello,
>>> On each Windows reboot I have the same, two dll files removed
>>> from my Windows\System32 folder.
>>> Which program is responsible for that?
>>> Please advise,
>>> Fred
>>
>> Which files?
>>
>
>

[pegasus [mvp]]

"ANONYMOUS" <xfsgpr@googlemail.com> wrote in message
news:01fac1a5-cc9d-469c-9725-41eb58517d49@c29g2000yqd.googlegroups.com...
On Jul 22, 9:34 pm, "Pegasus [MVP]" <n...@microsoft.com> wrote:
> They are probably being removed by your virus scanner, e.g. because of a
> false positive alert. Have you checked its quarantine location?
>

No it can't be. All virus scanners will warn you and/or alert you
before taking any drastic action like deleting a file! Please don't
misinform people or give them false sense of security on these
reputable Microsoft newsgroups.

=================

It's a bold claim to say that "all virus scanners" will warn you. They
should but unless you have personally checked each and every one of them
your claim is pure guesswork. It's the same as saying "All adult Americans
know who Barack Obama is" but you can't be sure until you've asked every one
of them.

Furthermore it is easily possible that the OP overlooked or misinterpreted
the warning if there was one. This is what I tried to alert him to.

Lastly, I don't have the faintest idea what you mean with "give them a false
sense of security". Please explain.

[fred]

Thank you all.
I have traced the problem to SuperAntiSpyware.
Fred

"fred" <fred@nospamme.com> wrote in message
news:%23JsJPSwCKHA.4792@TK2MSFTNGP05.phx.gbl...
> Hello,
> On each Windows reboot I have the same, two dll files removed
> from my Windows\System32 folder.
> Which program is responsible for that?
> Please advise,
> Fred
>

[fred]

Bingo!
Both dll belong to Phone Dialer Pro software.
I am surprised you know that, PABear.
Are you using that software yourself?
I have found out that is the best phone dialer available anywhere.
I've traced the problem to SuperAntiSpyware.
Thanks,
Fred

"PA Bear [MS MVP]" <PABearMVP@gmail.com> wrote in message
news:uejv6qwCKHA.1248@TK2MSFTNGP04.phx.gbl...
>>>> On each Windows reboot I have the same, two dll files removed
>>>> from my Windows\System32 folder.
>
> How have you determined that the files have been removed? Are you seeing
> "file missing" errors when you reboot?
>
>> They belong to the program I trust and use every day.
>
> Phone Dialer Pro (VOIP software), perchance?
>
> There is a very good chance that you are seeing the effects of a
> hijackware infection (e.g., Backdoor.Win32.Ripper)!
>
> NB: If you had no anti-virus application installed or the subscription had
> expired *when the machine first got infected* and/or your subscription has
> since expired and/or the machine's not been kept fully-patched at Windows
> Update, don't waste your time with any of the below: Format & reinstall
> Windows. A Repair Install will NOT help!
>
> 1. See if you can download/run the MSRT manually:
> http://www.microsoft.com/security/malwa ... fault.mspx
>
> NB: Run the FULL scan, not the QUICK scan! You may need to download the
> MSRT on a non-infected machine, then transfer MRT.EXE to the infected
> machine and rename it to SCAN.EXE before running it.
>
> 2. [WinXP ONLY!! =>] Run the Windows Live Safety Center's 'Protection'
> scan (only!) in Safe Mode with Networking, if need be:
> http://onecare.live.com/site/en-us/center/howsafe.htm
>
> 3. Run a /thorough/ check for hijackware, including posting the requested
> logs in an appropriate forum, not here.
>
> Checking for/Help with Hijackware
> http://aumha.net/viewtopic.php?f=30&t=4075
> http://mvps.org/winhelp2002/unwanted.htm
> http://inetexplorer.mvps.org/data/prevention.htm
> http://inetexplorer.mvps.org/tshoot.html
> http://www.mvps.org/sramesh2k/Malware_Defence.htm
> http://www.elephantboycomputers.com/pag ... ng_Malware
>
> **Chances are you will need to seek expert assistance in
> http://spywarehammer.com/simplemachines ... board=10.0,
> http://www.spywarewarrior.com/viewforum.php?f=5,
> http://www.dslreports.com/forum/cleanup,
> http://www.bluetack.co.uk/forums/index.php,
> http://aumha.net/viewforum.php?f=30 or other appropriate forums as well.**
>
> If these procedures look too complex - and there is no shame in admitting
> this isn't your cup of tea - take the machine to a local, reputable and
> independent (i.e., not BigBoxStoreUSA) computer repair shop.
> --
> ~Robear Dyer (PA Bear)
> MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002
>
>
> fred wrote:
>> The names will not tell you anything: msgpd.dll and msgphd.dll
>> They belong to the program I trust and use every day.
>> However, after each Windows reboot I have to reinstall that program to be
>> able to use it again.
>>
>>> Which files?
>>>
>>>> On each Windows reboot I have the same, two dll files removed
>>>> from my Windows\System32 folder.
>>>> Which program is responsible for that?
>

[pa bear [ms mvp]]

Actually, S*PERAntiSpyware might be acting properly & protecting you!
Depending on where you obtained/downloaded Phone Dialer Pro, some Bad Guys
(e.g., Backdoor.Win32.Ripper) might have "come along for the ride."

fred wrote:
> Bingo!
> Both dll belong to Phone Dialer Pro software.
> I am surprised you know that, PABear.
> Are you using that software yourself?
> I have found out that is the best phone dialer available anywhere.
> I've traced the problem to SuperAntiSpyware.
>
> "PA Bear [MS MVP]" wrote:
>>>>> On each Windows reboot I have the same, two dll files removed
>>>>> from my Windows\System32 folder.
>>
>> How have you determined that the files have been removed? Are you seeing
>> "file missing" errors when you reboot?
>>
>>> They belong to the program I trust and use every day.
>>
>> Phone Dialer Pro (VOIP software), perchance?
>>
>> There is a very good chance that you are seeing the effects of a
>> hijackware infection (e.g., Backdoor.Win32.Ripper)!
>>
>> NB: If you had no anti-virus application installed or the subscription
>> had
>> expired *when the machine first got infected* and/or your subscription
>> has
>> since expired and/or the machine's not been kept fully-patched at Windows
>> Update, don't waste your time with any of the below: Format & reinstall
>> Windows. A Repair Install will NOT help!
>>
>> 1. See if you can download/run the MSRT manually:
>> http://www.microsoft.com/security/malwa ... fault.mspx
>>
>> NB: Run the FULL scan, not the QUICK scan! You may need to download the
>> MSRT on a non-infected machine, then transfer MRT.EXE to the infected
>> machine and rename it to SCAN.EXE before running it.
>>
>> 2. [WinXP ONLY!! =>] Run the Windows Live Safety Center's 'Protection'
>> scan (only!) in Safe Mode with Networking, if need be:
>> http://onecare.live.com/site/en-us/center/howsafe.htm
>>
>> 3. Run a /thorough/ check for hijackware, including posting the requested
>> logs in an appropriate forum, not here.
>>
>> Checking for/Help with Hijackware
>> http://aumha.net/viewtopic.php?f=30&t=4075
>> http://mvps.org/winhelp2002/unwanted.htm
>> http://inetexplorer.mvps.org/data/prevention.htm
>> http://inetexplorer.mvps.org/tshoot.html
>> http://www.mvps.org/sramesh2k/Malware_Defence.htm
>> http://www.elephantboycomputers.com/pag ... ng_Malware
>>
>> **Chances are you will need to seek expert assistance in
>> http://spywarehammer.com/simplemachines ... board=10.0,
>> http://www.spywarewarrior.com/viewforum.php?f=5,
>> http://www.dslreports.com/forum/cleanup,
>> http://www.bluetack.co.uk/forums/index.php,
>> http://aumha.net/viewforum.php?f=30 or other appropriate forums as
>> well.**
>>
>> If these procedures look too complex - and there is no shame in admitting
>> this isn't your cup of tea - take the machine to a local, reputable and
>> independent (i.e., not BigBoxStoreUSA) computer repair shop.
>> --
>> ~Robear Dyer (PA Bear)
>> MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002
>>
>>
>> fred wrote:
>>> The names will not tell you anything: msgpd.dll and msgphd.dll
>>> They belong to the program I trust and use every day.
>>> However, after each Windows reboot I have to reinstall that program to
>>> be
>>> able to use it again.
>>>
>>>> Which files?
>>>>
>>>>> On each Windows reboot I have the same, two dll files removed
>>>>> from my Windows\System32 folder.
>>>>> Which program is responsible for that?

[pegasus [mvp]]

"ANONYMOUS" <xfsgpr@googlemail.com> wrote in message
news:01fac1a5-cc9d-469c-9725-41eb58517d49@c29g2000yqd.googlegroups.com...
On Jul 22, 9:34 pm, "Pegasus [MVP]" <n...@microsoft.com> wrote:
> They are probably being removed by your virus scanner, e.g. because of a
> false positive alert. Have you checked its quarantine location?
>

No it can't be. All virus scanners will warn you and/or alert you
before taking any drastic action like deleting a file! Please don't
misinform people or give them false sense of security on these
reputable Microsoft newsgroups.

=======

I trust you will read the OP's conclusion. It was an anti-spyware issue
after all that caused his problem.