How to Remove DLL Files

What is a DLL file?


DLL (Dynamically Link Library) is an executable file that permits programs to share code to perform one or more predefined functions. A DLL file can be used by several programs at the same time. The benefit of having DLL files is that they don’t get loaded into random access memory (RAM) along with the main program, which saves up space in RAM. So instead of all the coding being built into the program, it uses a particular DLL file that, with a simple call, can execute the operation for it.

Why is it important to remove malicious DLLs?


Most DLL files are essential for the running of your programs but there are other malicious programs, such as browser hijackers and browser plugins, that are usually made up of DLL files that can alter your system settings to allow attackers gain access on your computer.

If you’re really serious about removing unwanted DLL files, make sure you use Windows Add/Remove programs first (how to use Add/Remove programs). Most applications come with an uninstall program that will remove the unwanted DLL files. But be aware the uninstall utility will assume that certain files are shared and it will have no way of knowing which other programs use them or whether these programs are present on your machine. This results in DLLs being left behind that can recreate the malicious program on reboot.

To remove a specific DLL, you should use Regsvr32 (Regsvr32.exe) to register and unregister DLL files which is already built in your Windows operation system’s package.
DOWNLOAD NOW

» Learn more about SpyHunter's Spyware Detection Tool
and steps to uninstall SpyHunter.

There are plenty of other programs available that can help you identify and remove unwanted DLLs, but Regsvr32 is the most common.

Learn how to remove spyware DLL files from your computer.

Unregister Spyware DLL Files Manually


Warning: Unregistering spyware DLL files is difficult and risky. If you unregister the wrong DLL file, your computer may crash and important data may be lost. As a precautionary measure, please back up important files and set a System Restore point (click Start > All Programs > Accessories > System Tools > System Restore, and follow the on-screen instructions) or run a spyware check with a trusted anti-spyware program to automatically detect spyware.

To start unregistering DLL files, you will need to follow these steps:
  1. Open the Command Prompt window
    Press the “Start” button on your taskbar and click on “Run” to start the “Run” tool. In the field, type “cmd” and press the “OK” button.

    Run Cmd
  2. Locate the DLL file
    After opening the Command Prompt window, locate the exact DLL path as shown on the screenshot below. Type “cd” in order to change the current directory, press the “space” button, enter the full path to the DLL file and press the “enter” button on your keyboard. If you want to display the contents of the directory, use the “dir” command.

    Find the folder with the DLL
  3. Unregister the unwanted DLL
    In the directory where you want to remove the DLL, type “regsvr32 /u [DLL_NAME]” and press the “Enter” button.

    Unregister the DLL
  4. Unregistering succeeded
    If the DLL was unregistered successfully, a confirmation message will be displayed.

If you want to undo the removal, you can perform it by typing “regsvr32” without the /u key, just type “regsvr32 [DLL_NAME]” to undo the changes.
Posted: June 6, 2006 | By
Share:
Rate this article:
1 Star2 Stars3 Stars4 Stars5 Stars (12 votes, average: 4.08 out of 5)
Loading ... Loading ...
Home Tutorials How to Remove DLL Files

205 Comments

  • Rishi says:

    i got a message saying “DllUnregisterServer in dntpkwomwx.dll failed. Return code was: 0x8002801c. What do u suggest i should try….
    thanks in advance.

  • Yuri says:

    Sorry, guys, I have to dissapoint you all. As an IT specialist with 12 years of experience, and several years in field of trojan horse removal:

    Regsvr32 won’t work on majority of trojan DLL’s for the simple reason: some of these dll don’t require registration in the first place so you can unregister all of them until you blue in the face, with no effect.

    When you have trojan DLL that cannot be removed by deletion in Standard or Safe mode, there are three basic ways to get rid of them:

    1. Connect your hard drive to another PC as secondary drive and remove it from there. This way, you don’t load your infested Windows and all its dll’s are sleeping.

    2. Use third party utility software like ERD Commander that boots off CD and let’s you explore and remove files from your hard drive.

    3. Use Windows Recovery Console from Microsoft and erase files from recovery console command prompt. You need your installation Windows disk for it.

    thanks

  • ghostrider01 says:

    raprap,

    You shouldn’t follow the main instructions allways, because in some cases they don’t fit. Scan your computer with our free SpyHunter scanner. Our scanner will find the infected files and show their locations. Afterwards boot your computer in Safe Mode and remove the infected files manually. Otherwise, get a reliable anti-spyware program, which will help you to remove the infection.

  • raprap says:

    Hi i kinda need some help!

    I did all the steps in removing Files Secure manually until i reached thsi step.

    I found the directory for the file but this is what all it had… secure .exe and uninstall .exe
    i cant find the .dll

    Similar problems with trying to remove unknown trojan..but this time, I cant find the location of the file

    pls help!

    PLEASE!!!!!!!

  • raprap says:

    Ok…im trying to manually delete Files Secure..I did all the steps smootly until this step.

    When i typed in “DIR”…i never got the .dll

    what should i do? >

  • bob says:

    I ran into a similar virtumonde variant:

    apparently the resident portion re-writes registry entries after you delete them; apparently changes the entry if you rename the dll to match.

    I chased this dragon with spybot s&d, but that did no good on its own…

    this virus puts it’s hooks into IE as a BHO and explorer as an extention – hence the dll is always open for one or the other – even in safe mode, and even in command mode.

    I finally got rid of this by using Windows Recovery Console – booted that, and with it’s command line deleted the offending dll’s. WRC is so light, it doesn’t bring up the actual windows image, hence the dll’s are never opened.

    after deleting these I rebooted XP and ran spybot to get rid of the residual registry entries.

    I highly recommend trying this; you may need an XP installation disk to install this on your computer – damn shame it doesn’t come as a bootable CD.

  • ghostrider01 says:

    ASHISH TANK,

    These instructions should work. But if you are having any problems, you can try to remove the .dll file manually. Just boot your computer in Safe Mode and delete the .dll file. You can also use our free scanner to make sure, that you don’t have any other infected files on your computer.

  • ASHISH TANK says:

    i have performed the action instructed by you but it doesn’t work. why don’t u suggest any other way to delete such dll file?

  • ghostrider01 says:

    Wil,

    Zlob files are changing very often. Are you sure, that you want to unregister the exact file, that you have to unregister? If you are not sure, first of all I suggest you to use our free scanner which will show you the names of files you have to unregister. If you are sure, that you want to unregister the exact file and you can’t do this, try to boot your computer in Safe Mode and remove it manually.

  • Wil says:

    I’ve had the same problem as Brandon, NSri and Jim. I type in my dll file and it says that the entry point was not found and the file cannot be registered. I have made sure I have typed the instructions perfectly several times. This is soo annoying, I really want to know how I can delete this zlob sh!t!!!

  • MattJ says:

    Virus removed!

    Here’s a bit of info, but it didn’t do me much good:
    The virus manifests itself as an Internet Explorer add-on.
    Open Internet Explorer then goto Tools, Manage AddOns, Enable or Disable add-ons.
    You will most likely see the virus file there, maybe on top. If you disable it, it comes right back upon reboot.

    I have Symantec Anti-Virus on my PC and had tried multiple times to have it remove the virus. I updated the virus file online everyday. Last night 01-05-08, Symantec sent me an update so I immediatly ran full scan.
    I could hardly believe it when it located jkhfd.dll in my windows/system32 folder.
    It completed a full scan in about 2 hours. It needed a reboot (said so) to ditch this file.
    I rebooted as directed and it was gone!

    I checked it again today and all is clean!
    Thanks Symantec for the update. I did not get a chance to try a bootable CD prior to the virus being removed.
    Good luck everyone and get those UPDATES installed asap and re-run every day.

    No other technique listed above worked for me and I tried them all.

  • ghostrider01 says:

    Todd,

    Try to boot your computer in Safe Mode and delete foxvncvs.dll manually. There may be some other infected files instead of this one on your computer. So I advise you to scan your computer with our free scanner, which will show you the locations and names of all the infected files. And then you can delete them manually.

  • Birdman7 says:

    Ok so I just got done trying your method from above. I got an error message saying LoadLibrary(“jkhhg.dll”)failed-Access Denied. I’ve tried going in through safe mode to delete it, but after like 5-10 sec it goes back to the yes go to safemode no go to restore screen. So I can’t even get to where the file is to delete it. I’ve traced it to lsass.exe program which runs through the system rather than user. Any idea of I can try. I’m trying autorun right now with now success.

  • MattJ says:

    I’ve been through the same thing as JohnnyRichter and I am a programmer but not a Windows expert. My duaghter’s friend visited and gave us the virus for a nice Holiday present on Dec. 30th. Some of my virus programs are called jkhfd.dll & exe.
    The exe I can remove, the dll I can’t.
    Johnny, if you would have checked your registry after removing a bad entry, you will find like others, they come right back instantly!

    I wrote my own .exe and called it jkhfd.exe and placed it in the system32 folder. My virus registry says to load this program on boot up. So, my fake-virus program has code to delete the jkhfd.dll.

    I was so proud of myself for being so clever and I rebooted. Guess what? The virus laughed at me. It replaced my dummy exe with the original and the dll was not erased.

    Since I’ve tried all anti-virus/spyware stuff with no luck, I’m hoping to get a bootable disk and try to delete it that way. I’ll post back if I can figure this nasty virus out. Good luck to all.

  • Todd says:

    I tried to maually unregister the toj/virtum-gen it says it loaded the foxvncvs.dll but could not unregister the path.

  • ghostrider01 says:

    I agree with JohnnyRichter, it’s better to use a reliable anti-spyware program, than try to solve your problem by yourself, if you are not a computer expert. But formatting should be something you do when your computer is beyond repair. The support of your anti-spyware program should help you to remove the infection from your computer if the program can’t do this.

  • JohnnyRichter says:

    Nevermind, don’t need the help anymore. Windows decided, after importing the complete registry from my laptop, that it didn’t want to boot anymore.

    Turn computer on, reaches windows logo/load screen, instantly reboots, puts me at safe mode selection screen. Any option I pick…instantly reboots and I end up at safe mode selection screen again. I can safely say there is no way to fix this issue…other than to format the hard drive and start from scratch. On the bright side, I haven’t formatted since winxp pro became public…so this might do some good. Luckily my most important files were always kept on my secondary HD…my main HD only held stuff I installed which can be replaced, and a few files that were irreplaceable but not terribly important.

    After these past few days I’ve come to the conclusion that there are some spyware dll’s and exe’s that rely on a system process other than explorer, that runs in normal AND safe mode. None of the above actions, nor any of the top 20 most-used actions…will work on these files. They were created for these purposes…multiply, annoy you, and permanently attach itself within your registry(try to delete the keys, and watch them pop right back up and bring their other dll/exe friends along).

    Long story short…if you have the same problems…just format, and be a little safer with what you download/open/run next time around. Invest in some good anti-spyware programs, anti-virus, firewall, and definitely a process/registry blacklister(i prefer teatimer, comes with spybot s&d). Better safe than sorry, no one likes to lose everything on their hard drive over something as simple/stupid as a naughty file you opened.

  • JohnnyRichter says:

    After my reboot…windows logged in all slow and choppy, then when explorer finally loaded…it didn’t load my start bar. I can not sign online, sound car does not work. All I can do is view folders, and load certain windows programs.

    All I did before reboot was delete ALL regedit keys that had “awtst” or “xxyxwwu” in them. I don’t know if this new problem is because of those keys being deleted…or because of the virus doing something.

    Either way…this is a huge problem, my pc is now a paperweight. I’m currently on my laptop, none of those keys show up in regedit.

    Laptop has Win XP media center edition…PC has Win XP Pro…can I export my whole registry from my laptop to a burnable disc, then import from disc onto pc? Or is the XP M.C.E. not compatible with XP PRO? My pc has years and years worth of files that I can not lose…and it won’t let me burn cd’s or sign online…so if someone could help me fix this issue, it’d be much appreciated.

  • JohnnyRichter says:

    So far I have come across;

    tuvojjfd.exe, awtst.dll, awtst.exe, xxyxwwu.dll, and 2 or 3 other .dll’s. I’ve researched the different bad files, tried some more programs, contacted the companies of my two most-used anti spyware programs…still with no luck.

    I just went into regedit, and did a ctrl+f search for all those file names…and deleted any key associated with them. There were many keys that were directly connected to xxyxwwu.dll and awtst.dll. Hopefully this has worked…need to reboot, then try to delete those .dlls.

    Also, the I.E. popup “work offline/online” keeps showing, when nothing is running. This leads me to believe one of those files listed above is trying to access the internet.

    I can not figure out what windows process these files rely on to run, but it’s not explorer.exe. I went into safe mode, and ended explorer.exe…which put me at the BARE minimum of processes needed for computer to idle in safe mode. I then clicked “run” on the task manager, and entered cmd prompt, changed to system32 folder and proceeded to try and delete those bad files…still no luck…says they’re being used.

    Does anyone know of any sure-fire ways to rid myself of these files? Does anyone know of any anti-spyware programs that have the ability to rid of them for me? So far “delete dll after reboot” programs fail to actually delete these files, because of a certain main system file they ‘leech’ off of that is running constantly.

  • ghostrider01 says:

    Johnny Richter,

    Most likely you are having VirtuMonde or Trojan.Vundo on your computer. These parasites are widely known and it’s very difficult to remove them. Your system may be infected not only with the files you have mentioned, but there can be some other infected files too. On the Internet try to search for programs which are specific for Vundo/Virtumonde removal and there are several of them. Otherwise, you can contact the support team of your anti-spyware program.

  • JohnnyRichter says:

    I have at least two dll’s in \system32\, both of which popped in there today after I was dumb and ran an exe.

    I tried the regedit idea, was told they can’t be removed.

    I tried the cmd/shutting off explorer.exe…was still told the files can’t be removed.

    I tried going to the files and deleting them, was told they can’t be removed.

    I searched my task manager/process list, found nothing out of the ordinary.

    I rebooted with a boot disk and tried deleting them using cmd prompt, was told they can’t be deleted.

    I tried using 5 different programs made for the sole purpose of removing these files upon reboot…they never got removed.

    I tried regsvr /u, was told “c:\windows\system32\filename.dll was loaded, but the DllUnregisterServer entry point was not found….This file can not be registered.”

    I tried using several legit spyware/adware programs, neither of which found the files…or they found the files and claimed to fix them but didn’t really do so.

    I tried searching add/remove programs…no out-of-the-ordinary programs running in there.

    I did everything correctly, all file names and file paths were typed correctly. I must have tried all these steps at least 20 times each…just to be 100% sure, and nothing will get rid of these dll’s.

    I’m currently trying to track down any other exe’s and dll’s are now on my system…to compile a list of all the files that need to be removed.

    So far there’s xxyxwwu.dll, awtst.exe, awtst.dll.

    If anyone has any advice at all, it would be greatly appreciated. This is the best PC I’ve ever built…and I hate knowing there’s spyware/adware running rampant on it.

  • ghostrider01 says:

    NSri,

    As I mentioned above to Brandon, please, make sure that you have typed the correct command line. It has to be without quotation marks. For example, if you want to unregister jkkjh.dll, you have to type: regsvr32 /u jkkjh.dll and press Enter. If you get any errors post them on our comments and we will try to solve your problem.

  • NSri says:

    This idea does not work.

  • ghostrider01 says:

    sai,

    It’s not so easy to remove this trojan. I suggest you to try to boot your computer in Safe Mode and delete the file. If this won’t help you, you have to contact the support of the program you are using to remove downloader.gen.a trojan.

  • Christina says:

    My laptop got infected by Trojan Vundo and I couldn’t rid it completely with the Symantec removal tools at first. It reported no Vundo found but I have the notify popup kept coming. I tried to edit the registry listed in the Symantec page but couldn’t find the infected entries. Now I seem to have finally got rid of it. I am not sure which of the actions was needed but just share with you all.

    I ran the removal tools again in Safe Mode (F8 when booting up). Then I go to the registry (Windows Start > Run > regedit) and Search for the trojan program names (click My Computer, menu Edit > Find / Ctrl-F, then repeat with Find Next / F3). I got the winlogon/notify, CLSID/control sets, etc infected. I removed or edited the entries. At first after I removed the entries, they were added back automatically. I also tried renaming so of the infected values. I re-ran the removal programs several time till the trojan program in system32 folder was deleted and all registry entries are cleaned.

    Hope this help someone on the same boat.

  • sai says:

    can some one help me in removing downloader.gen.a trojan. it is infected in c:\windows\system32\ldcore.dll file.
    i ran mcafee fullscan, paretologic xspywarexe, regcure, vundofix. they are detecting this trojan, but cannot remove it. PLEASE HELP

  • ghostrider01 says:

    mark,

    Did you try to boot your computer in Safe Mode? Your anti-virus program should remove these parasites if it finds them. If this won’t help you, you can try to remove these files manually.

  • mark says:

    I am trying to remove the dll’s jkhhg.dll and cbxxutt.dll because I found they were trojan viruses with sophos anti-virus. Sophos clasifies it as Troj/Virtum-Gen.

    Unfortunately I’ve tried 3 times to delete the virus with Sophos, and it keeps reapearing after Sophos tries to delete it, which requires a full system scan and a restart of the system.

    With both of them I entered command prompt and tried to delete them, but both return the message :

    xxxxx.dll was loaded but the DllUnregister Server entry point was not found.

    This file can not be registered.

    Does anyone have a course of action for me to take??

    Has anyone that had the jkhhg.dll problem found a solution yet??

    Any help is appreciated, Mark.

  • ghostrider01 says:

    Anthony,

    Most likely your antivirus program deleted those infected files. If the program finds viruses, usually it can delete them. My advice for you is to update your antivirus program frequently, because the virus makers create viruses everyday and they renew very often.

  • Anthony says:

    Okay, I was just trying desperately to get rid of ldcore.dll and opnkllm.dll, both of which were reported by Norton Antivirus to be viruses. I attempted unregistering the files, but it said “Access is Denied” when I tried in normal mode, and “Unable to register” or something when it was in safe mode. However, when I rebooted in normal mode, I tried to find the files in the C:\WINDOWS\system32 folder where they were, and I could not find them. I am hopeful that somehow my attempts at destroying them worked, or more likely, they were deleted with a bunch of viruses that Norton Antivirus did delete upon the last reboot. What do you think?

  • jen says:

    taz,

    I read somewhere in my quest to remove an annoying DLL file (like most of us here) that “WINANTIVIRUS PRO” is actually a virus or a spyware. (Is there, actually a difference?) And yes, I think you are in deep trouble.

    I had pop ups showing the ads of several anti- spyware software including “_____doctor” or something which Mcafee also claims as a virus/ spyware but since pop- ups annoy me like a fly to a wound, I close the window before it downloads completely.

    I suggest that you do more research as I still am.

    Good luck!

    Jen

  • ghostrider01 says:

    TAZ,

    Please be more specific, it’s impossible that there could be any files in My Computer. The location of the infected files should be different.

  • TAZ says:

    hey i got the winantiviruspro 2007 virus. now many .dll files werent found and the vtr441.dll is entered as data in a registry key which also contains other files of this virus and other important files.

    the prob is that this file is not on any drive but is in My Computer, and i am not being able to unregister it.

    Please HELP !

    my comps in for a disaster !!!

    i got a windows XP.

  • Steve says:

    ldcore.dll is gone! All the posts above with the random dll names and the google search interference trace back to affiliate.exe which loads ldcore.dll and a host of random gernerated .dll names.

    1. Update your virus scan and anti-spyware programs of choice.
    2. Download Regrun Reanimater ( http://www.greatis.com/reanimator.zip).
    3. Take your computer off the Internet. This is important as it’s integral to ldcore.dll regenerating itself.
    4. Run virus and spyware scans. Obviously delete everything.
    5. Now for Reanimater. Yeah, it’s a really hokey program. No, I don’t work for them. It’s in broken English, but it works. Here’s why: When it finds something, it uses the pre-OS enviornment after a reboot (think checkdsk /f) to actually do the deleting so there’s no access denial. I did like however, that it continues to rerun itself on boot until all infections are gone. You’ll have to let this run 2 or 3 times rebooting in between (it guides you through it).
    6. Re-run spyware scan to remove anything potentially still left from the ad programs ldcore.dll loads.

    That did it for me. ldcore.dll, oppnt.dll, and rsp????.dll are all finally gone. Enjoy!

    -Steve 😉

    PS – I promptly deleted Reanimater when I was done. I dunno. I’ve never heard of them before and the interface was pretty child-like… but it worked for this.

  • behck says:

    If can’t remove it in safe mode. Get UBCD4win, boot it up and manually delete it.

  • Jim says:

    I’ve got that fricken ldcore.dll tearing up my computer, and even after deleting it, it keeps coming back. When I tried the regsvr32 thing, it says that ldcore.dll is not an executable and won’t do anything else about it.

    The weirdest thing is that I can still surf the internet, but if I try to go to any google webpage, it won’t let me. Any helps?

  • n00dl3 says:

    Try renaming the file. Rebooting. Then deleting it.

  • ghostrider01 says:

    neEDHelp,

    Try to use Safe Mode for “ugbtna.dll” removal. This should solve your problem.

  • ghostrider01 says:

    andy Parker,

    This may be spysecure or virtumonde. What are the exact names of dll files? And yes – the best thing to do is to run safe mode with cmd.

  • neEDHelp says:

    got a “ugbtna.dll” in my system32, tried to unreg it thru cmd prompt, delete it thru cmd prompt, and locate it manually thru directory search and delete it, but still can’t. IT’S STILL THERE, keep saying that I can’t delete it — ‘access is denied’. PLEASE HELP!!!!

  • andy Parker says:

    Looks like all you guys may be trying to resolve the nasty blighter that I have contract as well! Is this relating to sypsecure or virtumonde? I have 3 dlls which are being picked up both by Bitdefender and Sophos but neither can disinfect or remove so this is the route I am heading down.

    Presumably the best thing to do is to run safe mode with cmd?

  • ghostrider01 says:

    Brandon,

    Please, make sure that you have typed the correct command line. It has to be without quotation marks. For example, if you want to unregister jkkjh.dll, you have to type: regsvr32 /u jkkjh.dll and press Enter. If you get any errors post them on our comments and we will try to solve your problem.

  • Brandon says:

    I have the same problem. I have tried to unregister with cmd prompt in normal and safe mode but i keep getting the error “jkkjh.dll was loaded, but the DIIUnregisterServer entry point was not found. This file can not be registered.” I have 3 dll files that I am trying to remove – emorakvd.dll , jkkji.dll and khffdaa.dll.
    I have tried deleting them also and receive the error “file in use by other application unable to delete” I have also tried hijack this function – delete a file on restart. and this does not work either.

    ahhhh! I am so frustrated!

  • ghostrider01 says:

    dadun,

    You have a very dangerous parasite on your computer. And it’s not so easy to remove it. You have to use several spyware removal tools and try to remove this file manually with their help. Or if you find this too difficult, you can use anti-spyware or anti-virus programs.

  • ghostrider01 says:

    jan,

    If the antivirus program that you have got don’t help you, try to use other programs. Because one program can miss what the other finds. You can find free tools which can help you fix this problem.

  • dadun says:

    i found jkhih.dll and iifdawv.dll in windows/system32 folder, but i still can’t remove it since it said being use by some process, i check and both being use by winlogon and explorer.exe, anyone know how to remove it?

    already use the spyware scanner, but everytime i restart the pc, my internet security setting back to minimum automatically, even after i changed it, so i guess the spyware/virus that make it to very low security again…anyone can help? much appreciated :)

    thank you

  • jan says:

    XP OS
    Have a nnnmkkj.dll residing in /system32 which I am prohibited from performing any action as the file is always being accessed by another application. NOD32 says will delete on reboot but it can’t as the dll is accessed on bootup.
    I can delete Registry entries but they recreate on bootup.
    Same results in safe mode.
    No 3.5 so can’t boot in DOS

  • ghostrider01 says:

    Dan,

    Probably you are trying to remove the file that not exists. It is possible that you followed the file that was on our instructions but sometimes they not exist.

  • Dan says:

    followed the instruction and received an error message in a popup:

    RegSvr32

    jkkjh.dll was loaded, but the DIIUnregisterServer entry point was not found.
    This file can not be registered.

    Okay

    any help would be appreciated.

  • Ken says:

    I followed the instructions, and the .dll is still on my system. I received an error dialogue box with the code 0x8002801c. My search goes on.

1 2 3 5

Leave a Reply

What is 11 + 9 ?
Please leave these two fields as-is:
IMPORTANT! To be able to proceed, you need to solve the following simple math (so we know that you are a human) :-)