Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Looking to speed up my boot-up time, I turned to msconfig.exe to remove some programs. I found a file named mituo.dll was on this list. I disabled it and restarted to see if it was neccessary, it simply put the entry back in msconfig and started again. I finally renamed it to testmituo.dll and restarted again. I got this error upon startup:

RunDLL Error:
There was a problem starting C:\Users\Me\AppData\Roaming\mituo.dll
The specified module could not be found

I tried to search for mituo.dll but there were no hits. It doesn't even exist in the DLL Information Site. My question is two-fold:

A) What is mituo.dll and if it is not beneficial, how can I stop it from putting itself back on msconfig?
B) What DLL files in general should exist in a clean Windows 7 installation, and how would you get rid of ones not on that list?
C) How do programs get back onto the msconfig list after being disabled? And how can you prevent this?

share|improve this question
    
Sounds like it may be an infection to me. Have you run virus scans, etc? Which DLLs are present after a "clean install" will depend on things like your device drivers, which will depend on your hardware configuration. The best way to only have the default Windows DLL's is to format and install fresh, and then never install anything else. :) –  Ƭᴇcʜιᴇ007 Sep 14 '12 at 1:25
    
Yeah, I did have an infection I cleaned earlier today and it looked like one. I already ran malwarebytes, but this persists. Also, to make the question broader for Superuser, I was also curious on what those default dlls are. Guess I'll try combofix for my issue! –  Duall Sep 14 '12 at 1:35
1  
You can try uploading the dll to virustotal and getting it scanned. –  Darth Android Sep 14 '12 at 1:39
    
Did not know that existed, waiting on it to be scanned now. –  Duall Sep 14 '12 at 1:41
    
If you would like to keep the part B) alive, perhaps edit your question down to only be about that, and not be about your infection. Otherwise the question is half about "how to clean this virus", which is a dupe of the question I linked and will probably be closed as such. –  Ƭᴇcʜιᴇ007 Sep 14 '12 at 1:41

1 Answer 1

up vote 3 down vote accepted

I disabled it and restarted to see if it was neccessary, it simply put the entry back in msconfig and started again. I finally renamed it to testmituo.dll and restarted again. I got this error upon startup.

Of course you did. You re-enabled the file, so Windows tried to load it but could not find it because you have renamed it. That’s completely normal and to be expected.

What is mituo.dll and if it is not beneficial, how can I stop it from putting itself back on msconfig?

Like you said, there are absolutely no hits for that filename other than this page.

You should navigate to the location (C:\Users\Me\AppData\Roaming) in Windows Explorer and examine the Details tab of its Properties dialog to see what information can be gleaned from the Company, Copyright, FileDescription, etc. fields.

You can also use a strings tool to examine text inside the file for more hints on what is does and where it came from.

Also try searching for it (Ctrl+F) in Process Explorer since that may help you determine where and how it is being loaded and run.

What DLL files in general should exist in a clean Windows 7 installation, and how would you get rid of ones not on that list?

The location of the file is indeed concerning. Windows absolutely does not store any DLLs there (in fact, no program should store files in the root directory of user profiles; that’s poor design and/or a bug).

That a DLL is being loaded from there is not good and is possibly/likely a virus or other malware. You should scan it immediately.

How do programs get back onto the msconfig list after being disabled? And how can you prevent this?

When you disable it, all you are doing is disabling it, you are not removing it. So of course the next time you run msconfig, the item will be in the list, but its check-box will be cleared because it is disabled. If you want to permanently remove it rather than just turning it off, then you need to use a different tool like Autoruns.

If I disabled it (uncheck it) in msconfig, it will simply make another checked entry. The unchecked/disabled entry is still there, it just makes a duplicate each time I restart. After renaming the file it can't find it, but the enry in msconfig always replicates.

If the autorun item actually creates a new entry every time you disable it, then it is either a very poorly designed legitimate program, or much more likely, malware. Malware often uses randomly generated filenames which could explain why you cannot find anything about that file. The DLL file itself may not be infected, but it cannot run by itself, so another program must be loading it. Have you run a malware scan?

You should copy the item to your question including which tab of MSConfig it appears on and the contents of each column related to it. Also try Autoruns since it makes it easier to copy a line, open the related registry entry, and disable/delete it.

share|improve this answer
    
Virustotal did give 3 alerts, but what is alarming to me is the fact it comes back after being disabled. I don't know if this helps, but "windowblinds" was on the list without my knowledge as well. Details says nothing besides file type, size, and modified. How can files come back into msconfig after being disabled? (Will edit question to include this). –  Duall Sep 14 '12 at 2:03
    
If it only had three out of 42, then they may be false-positives, but then again, they may have failed to scan it if it is packed or encrypted. What do you mean by it "came back"? You said you re-enabled it, so of course it tries to run on the next boot (but fails since you renamed the file). –  Synetech Sep 14 '12 at 4:20
    
If I disabled it (uncheck it) in msconfig, it will simply make another checked entry. The unchecked/disabled entry is still there, it just makes a duplicate each time I restart. After renaming the file it can't find it, but the enry in msconfig always replicates. –  Duall Sep 14 '12 at 13:00
    
Ah, that's a different story then; and not a good sign (at all). It is looking more and more like it (or something related to it) is a virus. I've updated my answer to reflect that. –  Synetech Sep 15 '12 at 13:44

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.