Unknown dll

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

Posted: Wed Oct 29, 2008 2:48 am

I have winpatrol installed on my laptop(XP SP2). I rebooted it earlier today, and since that time winpatrol keeps complaining about a new IE add-on.
the add-on is listed as :
C:\windows\system32\opnlJaWP.dll

I keep saying no to adding it, and it keeps popping up. I've tried a google search , with no results returned.

I haven't installed anything on the laptop today, just surfed the web.

Anyone have any ideas what this .dll is for? Is it safe to go in and remove?

Posted: Wed Oct 29, 2008 2:51 am

No documentation on Google means it's not safe. Run a scan and try to see what happens, if you got lots of time. http://security.symantec.com/sscv6/default.asp?langid=ie&venid=sym

Posted: Wed Oct 29, 2008 4:33 am

Firefox FTW.

Posted: Wed Oct 29, 2008 8:13 am

@Ex I only use Firefox and have for some time Smile

. IE can kiss my...

Anyone have any suggestions as to how I can get rid of the damn dll??
I've tried going in through safe mode, couldn't rename or delete.
I used a couple of freeware utilities: Unlocker, & Fileutilities' "moveonboot".
Ran IE (ughhhh) and disabled the add-on in add-on manager.

In each case, it's still there after reboot. It's integrated with the winlogon service, so I'm not sure how to proceed...

Posted: Wed Oct 29, 2008 8:19 am

ah ok I apologize, I thought you were one of ...... you know ..... the Others. In any case, have you tried AVG?

Posted: Wed Oct 29, 2008 8:26 am

Never mind folks. I DL'd hijackthis and it seems to have taken care of the problem. Smile

Edit: no it didn't Sad

. Back to the drawing board...

Posted: Wed Oct 29, 2008 8:35 am

The file name "opnlJaWP.dll" may indicate that it's a randomly generated name, so most probably it is produced (and contains) malware.

If you can trace the actual file back, store it in a password protected zip and send it to Symantec (or whatever AV you like better) for analysis.

Posted: Wed Oct 29, 2008 9:07 am

Seems to gone after this last reboot. I missed a few entries in the registry. Then had to stop winlogon, and delete the file before allowing the system to reboot.
(Just in case someone else needs to get rid of this &$q*$*# file...) Smile

Trophy Videos · Posted: Wed Oct 29, 2008 10:21 am

Hmm. I was going to suggest turning off system restore before trying to remove it. Most malware will copy itself into system restore files, and re-infect the system when it's rebooted. If it comes back, try that.

Posted: Wed Oct 29, 2008 9:15 pm

Random name = shitware, pretty much guaranteed. Hijack This will remove the hook into IE but not necessarily the file itself.

Be wary, shitware like this tends to dig itself right in deeply, and can come back - it's like a cheating spouse, once the trust is gone, it's gone. Flatten and Rebuild if you possibly can (it has other benefits too, you'll be surprised how much faster your PC will be for a rebuild!)