Pesky RunDLL Virus Errors at Logon

One of our user’s computers was infected with a virus that, after being removed and cleaned up, left these annoying RunDLL errors for DLL files with randomly generated filenames which occurred every time the user would login:

I didn’t get far trying to google some keywords related to the errors. However, some results did point me in the right direction for resolving the issue.

Basically, you want to check every possible repository of startup items or commands. In the registry, most google results told me to check the following locations.

• HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows/CurrentVersion/Run
• HKEY_CURRENT_USER/SOFTWARE/Microsoft/Windows/CurrentVersion/Run

However, where these virus-caused items actually ended up being was under a specific user profile in HKEY_USERS:

HKEY_USERS/userprofile/SOFTWARE/Microsoft/Windows/CurrentVersion/Run

I should mention that CCleaner did not list them under the startup category and neither did msconfig, so registry might be the only way to find them that I know of.