Endpoint Protection

One of the workstations, on a client's network was hit with a trojan(?) which was captured by Symantec and removed (over 2000 ties before it was successful).

Now when the machine reboots, RUNDLL complains that AJILULEFARI.DLL cannot be found.

Google search and a search of the Symantec site does not find any references to this DLL.  Searching the registry I cannot find any clue about where it is or how to stop it from trying to load. I cannot find any new programs that were installed that would be using this DLL.

Anyone have any ideas how I can finish the removal of this nuisance?

Thanks in advance to all.

Stuart

Remove entries of AJILULEFARI.DLL from registry

HKCU\Software\Microsoft\Windows\CurrentVersion\Run

HKLM\Software\Microsoft\Windows\CurrentVersion\Run

You might also want to check in MSCONFIG in the "Startup" Tab to make sure it's not being called from there.