Error message caused by newly removed file

[Slaps]

Malwarebytes recently removed an infected file from my laptop.

Since then I have had an error message appear on start up saying that the system is unable to start a file called soap0_pack.exe

I think this is probably the file that was removed but how do I stop the message coming up and what is trying to open it?

Any help appreciated.

[Maurice Naggar]

Hello Slaps and welcome to MalwareBytes forums.

Re-run MBAM & do a Quick scan. Afterwards, logoff and restart. Tell us if same issue re-occurs.

[Slaps]

No change.

Error is a RunDLL error saying that there was an error starting soap0_pack.exe

The specified module could not be found.

[Firefox]

Hello and welcome to Malwarebytes

Being that you had an infection, and most likely still have some left overs, its best to get the experts help you clean up the rest.

If you think you are infected, here are the steps needed to get your computer cleaned....

Please read the following so that you can begin the cleaning process:

IMPORTANT: Don't use any temporary file cleaners unless requested - this can cause data loss and make recovery difficult

You have 3 Options that you can choose from as listed below:

• Option 1 —— Free Expert advice in the Malware Removal Forum
  
• Option 2 —— Paying customer -- Contact Support via email
  
• Option 3 —— Premium, Fee-Based Support

OPTION 1

As we don't deal with malware removal in the General Malwarebytes' Anti-Malware Forum, you need to start a topic in the

Malware Removal forum so a qualified helper can help you fix any malware related problems/infections you may have.

• Please read and follow the directions >>Right HERE<<, skipping any steps you are unable to complete.
  
• After posting your new post, make sure under options, you select Track this topic and choose Immediate Email Notification,
  so that you're alerted when someone has replied to your post.

NOTE: Please do not post back to (bump) your topic within the first 48 hours.

Replying to your own posts changes the post count and helpers are looking for topics with zero replies.

If you reply to your own post helpers may think that you're already being helped and thus overlook your post.

• If there is no reply from any experts after 48 hours, you can reply to the topic, asking for help again.
  Or
  
• You may send a Private Message to a Moderator asking for assistance.
  

OPTION 2

Alternatively, as a paying customer, you can contact the help desk by filling out the form located >>Right HERE<<

OPTION 3

If you would like to use our Malwarebytes Premium Services, Comprehensive solutions to all your computer support needs—from installation and set-up to troubleshooting and tune-ups go to our Malwarebytes Premium Services support site >>Right HERE<<

Please be patient, someone will assist you as soon as possible.

PS: Please use the "Reply to this Topic" or "More Reply Options" buttons (instead of the “Quote” and “MultiQuote” buttons) when replying here & at the other forums. That will make your topic easier to follow.

[rodimus]

I have just cleaned off a laptop for a customer and I am getting the same message. A dialogue box appears on boot that simply says

"rundll" in the top left corner and says "There was an error starting c:\users\<username>\AppData\Temp\soap0_pack.exe".

I know I have already removed the virus, but I am having trouble finding the location in the windows system where this file was being called from. I am pretty sure it is no longer a threat thanks to malware bytes, but I wanted to post here so you have an idea of how many people might be getting the same error.

If I discover any more information, I would be happy to pass it on.

Thanks for the great program.

[screen317]

Hi,

Both of you, please download SystemLook from one of the links below and save it to your Desktop.

Download Mirror #1

Download Mirror #2

• Double-click SystemLook.exe to run it.
  
• Copy the content of the following codebox into the main textfield:
  

  :regfind
  soap0_pack.exe
  

  
  

• Click the Look button to start the scan.
  
• When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
  

Note: The log can also be found on your Desktop entitled SystemLook.txt

[rodimus]

Just a follow up the the post I made earlier. Spybot Search and Destroy has a feature under 'Tools', where you can look at startup items, and it showed me what was triggering the rundll32 file.

The virus had left a folder on the desktop called startup with a file in it, that was the cause of the problem. When I deleted the folder, poof, error message dissapeared.

I hope this information proves to be helpful.

@screen317, thanks for the information, I am always grateful for help with tools and such.

[screen317]

If whoever is reading this still has a copy of any related files or folders, please PM me so I can give them to our research team...