A PC I have been charged with sorting out has one remaining problem.

At one time there was iMesh on it. It had been removed, but an error as follows still remains upon boot.

RUNDLL

Error loading C:\Progra~1\Uninsta~1.dll

The specified module could not be found.

Now, the plot thickened. I have used Ccleaner and Hijack this to see the processes that startup and have removed the entry in HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce.

Reboot, fine...no recurrence.

Reboot again, ITS BACK. Same place as I removed it from before.

I have used Spysweeper, Panda ActiveScan, Spyhunter, Spybot, Adaware and a few other things but nothing comes up with owt that does anything but remove this key.

I have now run out of ideas as I have removed every registry entry, file on the PC and uninstalled it as well as cleaned the registry but nothing stops this from coming back.

If anyone knows of this error I would be most grateful as to how to get rid of it.

Cheers
Tongy

A couple more ideas I have had since the BHO idea from eairlier...

check that the machine is using explorer.exe at:

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell\

Also check that the version and date modified of the explorer.exe on the machine is the same as one on an uninfected machine.

Also check the [boot] section of system.ini for anything untoward, on XP there shouldnt be anything in there (afaik).

Finally check each of these (before rebooting):
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce\

HKLU\Software\Microsoft\Windows\CurrentVersion\Run\
HKLU\Software\Microsoft\Windows\CurrentVersion\RunOnce\

If after clearing that lot out you still have the problem then I would have to suggest that a normally benign application has been infected and turned into a host.

My daughter installed it on her puter a while back it was a bitch to remove, I forgot how but it involved registery monitoring to find out what it did.

Been there, torn hair out.

So thats why you are bald?

Right, I have spent hours on this and thank the big fella Nimrod as well as others for help but I found it was a key lurking under the pretence of being a similar name to a SpySweeper file.... It turned out to be:

SsiEfr.e (the legit name is Ssiefr.exe).

I personally hope that whomever was involved in the development of this garbage software rots.

Cheers and good-fsking night!
Tongy

autoruns from sysinternals is handy in these cases.