Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This question already has an answer here:

I did a maleware search and got rid of few trogans but now I kep getting messages like error in C:\documents and settings\lindam\application\ntcdsr.dll miss entry

c:\documents and settings\lindam]application\ntcdsr.dll

c:\documents and settings\lindam]application\ipsuiz.dll missing

How do i fix this..

share|improve this question

marked as duplicate by MadHatter, Dan, longneck, Chris S Feb 19 '13 at 14:11

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

I just deleted the keys in regedit by doing a search.. Ex ipsuiz.dll find command in regedit. Right away i found the .dll keys in question. I deleted and boom it worked. I did more scans and im coming up clean even after reboots. I agree with the restore option but thats a lot of down time on a pay role day.. Im 99.9 sure there is no other problems. – user160605 Feb 19 '13 at 17:30

When your computer is infected you can never trust it to work correctly ever again. You should have reinstalled Windows in the first place, and you should still reinstall Windows now.

PS> Those errors look very much like the virus trying to reinstall itself. You're almost certainly still infected. This is exactly why you need to wipe the computer, restore important files from backup, and never trust a computer that's been infected.

share|improve this answer
kinda hard to do when its a server – user160605 Feb 19 '13 at 14:03
Your Disaster Recovery Plan should include directions for reinstall the server and recovering files from backup (even if they're in broad strokes). Reinstalling Windows should never be "hard to do" for a System Administrator. I'll only write this one sentence wondering what someone was doing with a server that it got infected. Nothing will change the fact that you should have reinstalled, and it's still the correct course of action. – Chris S Feb 19 '13 at 14:09
The owner sent something to an employee and it was a virus.. The owners home comeputer got infected. We have back ups up i`m not sure when the computer got infected. – user160605 Feb 19 '13 at 14:13
ok for people not wanting to do a complete restore. Just search the .ll in question in regedit and delete the items you find. Make sure there not to tied to anything important. – user160605 Feb 19 '13 at 17:28

Not the answer you're looking for? Browse other questions tagged or ask your own question.