has anyone heard of this dll file ffqtoc.dll before? everytime i do a scan with Spyhunter that file comes up but im unable to get rid of it.
my computer keeps getting some kind of vundo virus and it keeps installing it into my computer.

Dani AI

Generated

ffqtoc.dll is commonly reported as a dropped component of Vundo/adware-type infections and can be hard to remove because it often creates persistence points or is held open by a running process or rootkit. The suggestions from (VundoFix), (Malwarebytes) and (HiJackThis logs) are on the right track. The following is a compact, practical workflow and troubleshooting checklist that complements those recommendations.

Recommended workflow:

  1. Reboot to Safe Mode (F8) and disable System Restore snapshots before deep cleanup if multiple restores keep reinfecting the system.
  2. Run an up-to-date anti-rootkit scanner, then a full anti-malware scan (remove all detections). Repeat until nothing new appears.
  3. Use Autoruns (Sysinternals) to search for references to ffqtoc.dll and remove entries in Run, RunOnce, RunServices, Scheduled Tasks and Browser Helper Objects.
  4. Use Process Explorer to find which process has the DLL loaded; terminate that process and then delete the file. If the file stays locked, delete it offline from bootable rescue media (WinPE/Linux live) so the OS cannot reload it.
  5. Re-scan, repair Winsock/LSP if needed (netsh winsock reset), and confirm DNS and proxy settings are clean.

Additional checks and cautions:

  • Inspect registry paths such as HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run and HKCU equivalents for unusual entries.
  • HiJackThis is diagnostic: logs are useful (as requested) but avoid blindly fixing entries without analysis.
  • Avoid running multiple intensive removal utilities at the same time; tools like ComboFix should be used only under expert guidance. Back up personal data, scan backups before restoring, and if repeated attempts fail a clean reinstall is the safest option. After a confirmed clean, reset all account passwords and apply OS/security updates.

Recommended Answers

All 7 Replies

You should be able to remove it with VundoFix

Hi nosfree,
You need to begin with the steps shown HERE Skipping step 2 as this is no longer used. Go to step 3 and continue on from there.
When you have completed those steps, including the running and removal procedure noted with MBA-M and saving the log for posting here, then download and run a Full System Scan save that log also.
Post back here with the requested logs and we can determine the next steps, if any, will be needed.
Judy

Hi judy, I can't click on the link with the steps for the removal process

Hello,

Pls do the following:

1. - Download Malwarebytes' Anti-Malware (http://www.download.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.html?part=dl-10804572&subj=dl&tag=button) to your desktop.

* Double-click mbam-setup.exe and follow the prompts to install the program.
* At the end, be sure to checkmark the Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform full scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad.
* Post the log back here.

Make sure that you restart the computer.

The log can also be found here:
C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt

2. - Download and post the log.

In your reply, post the logs (in this order):
1. - Malware Bytes Log
2. - Hijackthis Log

Thanks,

Cohen

Hi judy, I can't click on the link with the steps for the removal process

:$ That's because I forgot to put it in there :$
Use the links that Cohen has posted, thankfully he is watching my back!
Judy

Yes, i,ve seend when i was infected by vundo. ok read the article below
Vundo is a trojan that shows irritating pop-up advertisements and secretly downloads harmful files onto your PC. Because Vundo can run lots of advertisements, Vundo can severely decrease your system memory and slow down your computer. Vundo spreads through emails with links to insecure websites that exploit security holes of Internet Explorer. Once you click on a link in a Vundo-laced email, Internet Explorer launches a site that secretly installs the trojan into your computer. Vundo can run every time you startup Windows.
Heres how to get Rid of Vundo Manually

Yes, i,ve seend when i was infected by vundo. ok read the article below
Vundo is a trojan that shows irritating pop-up advertisements and secretly downloads harmful files onto your PC. Because Vundo can run lots of advertisements, Vundo can severely decrease your system memory and slow down your computer. Vundo spreads through emails with links to insecure websites that exploit security holes of Internet Explorer. Once you click on a link in a Vundo-laced email, Internet Explorer launches a site that secretly installs the trojan into your computer. Vundo can run every time you startup Windows.
Heres how to get Rid of Vundo Manually

thanks for that information and members and i are doing what is needed to remove this infection.

Thanks,

Cohen

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.