Is this file malware?

[Richard Ingram]

I have a remote client running Windows XP that is getting a message at startup saying "RunDLL error loading c:\windows\calndbty.dll". Malwareytes and MacAffee have scanned the computer and come up clean. I've done searches for calndbty.dll to no avail.

Anybody got any ideas what this file is associated with?

Thanks

[CLiNT]

I can't identify it either...
What else is inside that file location: "c:\windows\calndbty.dll".
Make sure all files are visible prior to searching.

[Paul T]

Autoruns should allow you to find where that file is hiding.

cheers, Paul

[BATcher]

On the offchance that this is an infected file, I suggest you download, install, update and run Malwarebytes' Anti-Malware (the free version, blue button low down on the left).

[bobprimak]

If you can locate the file and make a copy of it, submit it to the Virus Total web site. The site will run 40 different scanning engines on the file, and if it is malicious, someone will flag it. Just one positive result might not be a worry, but five or more flags there would cause me some concern.

[guillaume]

Use autoruns and eliminate the line that points to the missing file. you can also use C Cleaner to find the line in startup and disable or delete the line

[sirpaul1]

The closest I can get to a search is "calnd", which Google gives a whopping 47 entries, but no dll's.

Just by the spelling of it, I'd have to ask if you have a 3rd party calendar or calculator program installed.

I'd either run 'msconfig' (check the 'Startup' tab) or a 3rd party startup manager program, or rename the file it to "calndbtyold.dll" (if it's there at all), run CCleaner (Registry) and see what comes up.

[JackNoir]

Richard, one of the first things to do is find if the file does in fact exist on your computer (as opposed to corruption or located in wrong folder, etc). If it had an error while some program was trying to load it, then perhaps it's "missing". This might be the case if you recently installed a program and the "setup" program either didn't work right or was not properly written. If that's the case you can look for a more recent version of the install/setup program and running it may resolve the issue.

Also, if "autoruns" does show it, then it may also tell you which program and/or company owns it. Then you can look for applications you may have installed with same associations.

A program called "SIW" by Gabriel Topala can also be helpful when investigating software relationships.

Another way to find associated programs is to do a search on fractions of the name. For example, search the C: drive in Windows Explorer for files with "bty" in the name...or "caln"...etc. See where I'm going with this? This is because calndbty may have elements in common with other file names being used by a given program. Programmers sometimes use similar prefixes or suffixes for more than one of the .dll files used by their program.

Searching through the registry for "calndbty" may also be informative. Note: if you don't know how to use the registry then DON'T access it before you do. A user's misstep while accessing the registry can cause major problems...up to and including non-functionality of the computer.

Another thing that can cause this, is that you uninstalled some earlier program, but it didn't uninstall ALL elements of the program, or entries in start-up lists. So this error message may simply be the result of an uninstall that had a hiccup. Think if this started happening after you uninstalled something. You can also go into the System Event Logs and see if there are any clues there.

Another option is to take your system back to a state BEFORE this problem started up by using a Restore Point from a date prior to your first seeing this error. However, be sure you understand the consequences of going back to an earlier restore point. You can lose data/functionality. There are a number of articles/forum discussions on using restore points. I think even Microsoft warns you what risks/tradeoffs are involved.

[caribconsult]

If you are getting NO beeps on bootup, you have a hardware problem. Practically every pc I've ever worked with in the past 25 years will emit ONE beep indicating a correct bootup. Multiple beeps and long-short beep sequences are indicative of various hardware problems. The specific problem is usually indicated in the BIOS section of the motherboard manual.

[DrWho]

If any program is improperly uninstalled from the PC, the link to it remains in the registry.
Removing Norton AV used to do that a lot, before the "Norton Removal Tool" came out.

You can run 'Regedit' and do a search for that file name and remove any entry that points to it.
That's one way.......

Good Luck,
The Doctor

[bobprimak]

If any program is improperly uninstalled from the PC, the link to it remains in the registry.
Removing Norton AV used to do that a lot, before the "Norton Removal Tool" came out.

You can run 'Regedit' and do a search for that file name and remove any entry that points to it.
That's one way.......

Good Luck,
The Doctor

For the reason you allude to (leftovers which are not removed by the program's uninstaller) I have been recommending doing a deeper uninstall with either Revo Uninstaller or Absolute Uninstaller. Both get at this issue, although not perfectly.