How Do I Remove this Error on Startup?

Letting the anti-malware tools do their job was absolutely the right thing to do.

It’s simply that the cleanup performed by your anti-malware tools was just shy of complete. That’s not actually uncommon, though I’m not sure why. I’ll explain what happened, and how to clean that last annoying part up manually.

It’s actually a technique that can be useful in other, non-malware related situations as well.

One way malware works

Malware inserts itself into your system in many different ways. One of the most common is that it runs automatically when you reboot and/or log in to your machine.

Unless you’re running malware scans, you might not notice. For example, malware that acts as a zombie on a botnet doesn’t want to be noticed — it’s not going to do anything destructive to your machine, but it just wants to sit there and quietly send out spam — lots of spam.

Malware most often inserts itself into one of the several “auto-start” portions of the system registry. That way, not only does the malware exist in some file or files on your system, but when you reboot or log in, the malware is once again automatically started.

Once your malware removal tools detect and remove the malware — whatever kind it might be — you might think you’re done. Unfortunately, for reasons that aren’t clear to me, sometimes malware removal tools leave the auto-start instructions in place.

And that’s what you’re seeing.

The malware has been removed, but the instructions to start it when you log in have not been removed. When you log in, you get the error message as the system attempts to start a program that no longer exists.

Before we begin…

Back up.

We’re about to make changes to your system — in the registry, actually — and it’s always a good idea to back up fully before you do that.

I prefer a true full-system (or image) backup. In a case like this, where we’re only making changes to the registry, setting a system restore point (which backs up the registry) is typically sufficient.

Removing the auto-start entry

Fortunately, getting rid of the entry is pretty simple, which is why I’m somewhat surprised it would be left at all.

We’ll use the free downloadable tool Autoruns, from Microsoft.

Download and run Autoruns, and you should see a window very similar to this:

Be sure and click on the File menu and select Run as Administrator to ensure you have access to all entries.

There’s a lot of really geeky stuff in that display. It’s showing you everything that might be involved in starting up your computer. It’s a long and often complex list.

The good news is, you don’t need to understand any of it. You already have enough information to go right to the problem.

Click on the Entry menu at the very top, and select Find…

Type in the base name of the module from your error message. In your case, the error message referenced “C:/Users/<removed>/AppData/Local/Temp/cmstpcln.dll”, so you’d enter cmstpcln and press Find Next. Autoruns will highlight the first entry in which it finds the string.

Don’t do anything with what you find just yet.

Instead, repeat the search (just press F3) to see if it appears in more than once place in the registry.

If it appears in only one place (and particularly if that one place is in a folder called “temp”, as yours is), it should be safe to simply remove the reference. Double check that the column labeled “Image Path” matches what’s in the error message.

Right-click on the entry and click on Delete to remove it.

Now, when you reboot, you should no longer have that annoying error message.

Multiple entries, partial matches, and more

In your case, I believe there’ll be only one entry, it’ll match your error message completely, and deleting it will resolve your issue. But what if you find more than one entry in Autoruns?

Malware also attempts to disguise itself by using names of other more common components. In this case, you need to do a little more careful examination of the results before deleting anything. There are no blanket rules here, just a few tips and guidelines.

I’ll make up an example. Let’s say that your error message referenced “C:/Users/leon/AppData/Local/Temp/acrotray.exe”. In searching for it, before deleting anything, we might find more than one instance of something called “acrotray”.

One of them is valid:

The things to note here include:

• The full path does not match the error message, even though the base name is the same.
• This executable does not reside in a suspicious location. “Program Files” is where much software gets installed. “Temp” is not.
• Other information about the executable listed appears valid.
• It’s for software I know I actually installed on the machine: Adobe Acrobat.

Bottom line: this isn’t one to be deleted; it’s legit.

As I said, these aren’t rules as much as guidelines (malware could certainly install itself in “Program Files”, for example), but when used as clues, and particularly when matching against a specific error message such as in your original example, they can be used to make some fairly educated decision about what is and what is not likely to be malware.

And if we guess wrong — well, that’s why we started with a backup.

Podcast audio

Download (right-click, Save-As) (Duration: 7:21 — 3.4MB)

Subscribe: RSS

Video Narration