Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

The file 'windows\system32\mspsueom.dll' was recommended for removal by my antivirus software; it was flagged as a trojan virus.

I removed the file, rebooted, and now windows complains that the file is needed when I log in and when I run most programs.

I checked other XP systems, and microsoft support website and cannot seem to locate such a file.

Does anyone know where I can find a replacement for mspsueom.dll?

share|improve this question

migrated from serverfault.com Aug 21 '09 at 13:43

This question came from our site for professional system and network administrators.

3 Answers 3

up vote 2 down vote accepted

I'm not able to find it in Google anywhere. I'd start doing a couple things to dig a little bit as to what's going on...

A) sysinternals..run regmon and filemon (or procmon) to find out what exactly is getting the error when you try doing things. If you can't run anything, then this won't help much... B) you can try the registry editor to see if this filename is stuck in somewhere to run before running other executables or particular components.

The alternative...probably best...is to wipe and reinstall, restoring your known-good data files. A rule of security is that if the system was compromised, you can never be sure that it doesn't have something else hidden in the filesystem or some other goodies that you won't be able to easily find, like a rootkit in an alternate data stream for NTFS.

If it were a Windows file or common file from, say, a security program, you'd be able to find it online. The fact that it's not coming up from google is fishy, and if you don't have the file anymore to examine for strings or evidence then it's not going to be easy to figure out. I'd speculate that something stuck that in there as a hidden component of another part of a dropkit or rootkit, but like I said...without evidence it's pure speculation.

share|improve this answer
    
Thanks Bart, I'll try your suggestions and see where I get. –  Jeff Hall Aug 21 '09 at 13:24
    
Getting rid of the error message will be fairly easy. But you should take Barts advice about wiping the machine once its been compromised. –  JS. Aug 21 '09 at 13:28

Most antivirus programs keep removed files in Quarantine. you may be able to restore the file from there. I would then submit the file to virustotal.com to see if you got a false-positive.

share|improve this answer

mspsueom.dll doesn't yield any results with most common search engines, i suppose it is not a system or program component and it was rightly removed by your anti virus software.

however, if you can provide more input regarding which programs won't run without its presence, this would be very helpful indeed.

as a workaround, grab Autoruns and clear any reference to mspsueom.dll, this should take care of the error message when you log in.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.