Okay, I did an AVG antivirus scan, and it tagged user32.dll. Now, under the status/infection column, it was marked "change". I'm almost certain that this file itself is not a virus. A friend has suggested that I reinstall Windows XP and/or format my hard drive.

Now, I was wondering, what's the best course of action to take? Because I think this DLL file might be related to the occasional bluescreen I've been getting at startups. I don't want to reformat my HD unless absolutely necessary, since it's a hassle to backup everything.

Any suggestions from the computer-savvy?

Thanks.

Hmmm... i seriously doubt that you should delete the file or anything. Because that file, is a system32 file. Which is critical to the OS. Any system32 file is critical to the OS. And this file also contains important data related to the administrative user of the OS.

It's not necessary that the file could be related to the blue-screen fatal errors. Maybe some other thing is causing that. Have you installed some software recently?? Or some drivers?? System drivers?? That includes BIOS upgrades too...
How is your comp behaving??

Also, i personally have had an experience with AVG and i can tell that it's not really very reliable. If possible, i think you should get a NAV or a McAfee or something and re-scan.

And what does AVG mean by "Change"?? Change what?? It's apparel? XD No, seriously.. change what?

Whatever you do, do not take any drastic action on this file just like that.

An OS re-installation would probably solve all of your problems. Known and/or unknown. But it won't guarantee that this problem would not show up again. In your new and re-installed fresh OS. So, i think that before anything, you must first get to know why AVG caught this file.

Warmest regards,
The Firestorm

Be careful with the User32.dll it is rather important to the running of Windows.

Whatever you do, I would highly recommend you backup anything of value, even if your computer is working perfectly.

FirestormII

Also, i personally have had an experience with AVG and i can tell that it's not really very reliable. If possible, i think you should get a NAV or a McAfee or something and re-scan.

I would not recommend Norton or McAfee (especially Norton), both can cause problems and slow your computer down a lot.

Aight, exactly. I do in fact want to know why AVG tagged this file as "change". It's also why I'm asking here. AVG doesn't say 'change what'...it just says 'change'. I was hoping if you knew what could possibly happen to user32.dll that might cause something like this...i.e. could another virus have "corrupted" this dll somehow?

Edited for clearer explanation =D
[view screenshot]

Also, since I'm using a laptop, I haven't made any hardware changes, and no driver changes. The only thing that comes to mind is I downloaded an update file for my router via the 192.168...blah blah router config screen (Netgear). However, I downloaded this a good deal before the sporadic bluescreens started showing up.

So you're saying that it's usually not likely for the user32.dll to cause bluescreens? If so, should user32.dll have an error (and I really don't have the money to buy another virus scanner currently...), what should I do with it?

Again, I greatly appreciate your help.

DD

I would not recommend Norton or McAfee (especially Norton), both can cause problems and slow your computer down a lot.

Norton is by far one of the best anti-virus softwares out there. It slow systems down because it is highly active almost at all times. Right from the point you start your comp till the point you turn it off. It scans nearly all things going on. Before you start a program, it'll scan the running files first, after closing it will scan, on bootup it'll scan, while sending e-mails scan, while on the net, it'll scan. While running a program, it'll scan. It just keeps on scanning scanning scanning and more scanning. Exactly like what a proper anti-virus should do.

In the 6 yrs (or more) i've been with Norton, i have never experienced any troubles with it. Not a single one. Unless and until the user manually interferes with it's work, the anti-virus doesn't cause any troubles at all. Norton is highly efficient in it's work and can really do what it's made to do. AVG on the other hand, cannot always.

AVG came out as a freeware and so it became popular quickly. And dealers also had no troubles supplying it as it was free to them to. But the software in itself is no comparison with NAV or something like that.

Trust me, i've seen AVG overlook viruses a lot of times. And it doesn't slow your system down a lot is because it really doesn't do much work behind your back. (Not that it does a lot in front too! XD)

Warmest regards,
The Firestorm

Bwah?? In the scrnshot, i am seeing that it's saying: "No threats found" Doesn't that mean there aren't any problems?? Or is AVG acting it's normal self?! XD

In any case, if at all that file would have been corrupted or hit by a virus you could see a major impact/difference in the way your OS works.
That is why i asked, how is your comp behaving?? Normal? Abnormal at times? What?? Are those fatal errors still showing up?? When??

I am not saying that the file cannot cause those errors. But i mean that it's not normal for it do cause such a thing. And if at all that file would be completely corrupt, you would most probably have a hell of a trouble even using your comp.

Why don't you try to restore your system settings and all to before you were getting those fatal errors?? With that windows system restore thingy??

But of course, you'd have to take care of what things you have had installed since then. As those files may be lost.

Warmest regards,
The Firestorm

FirestormII

Norton is by far one of the best anti-virus softwares out there. It slow systems down because it is highly active almost at all times. Right from the point you start your comp till the point you turn it off. It scans nearly all things going on. Before you start a program, it'll scan the running files first, after closing it will scan, on bootup it'll scan, while sending e-mails scan, while on the net, it'll scan. While running a program, it'll scan. It just keeps on scanning scanning scanning and more scanning. Exactly like what a proper anti-virus should do.

In the 6 yrs (or more) i've been with Norton, i have never experienced any troubles with it. Not a single one. Unless and until the user manually interferes with it's work, the anti-virus doesn't cause any troubles at all. Norton is highly efficient in it's work and can really do what it's made to do. AVG on the other hand, cannot always.

AVG came out as a freeware and so it became popular quickly. And dealers also had no troubles supplying it as it was free to them to. But the software in itself is no comparison with NAV or something like that.

Trust me, i've seen AVG overlook viruses a lot of times. And it doesn't slow your system down a lot is because it really doesn't do much work behind your back. (Not that it does a lot in front too! XD)

Warmest regards,
The Firestorm

I'm not saying AVG is the best, far from it. Just that Norton and McAfee (to a lesser extend) are very far from the best.

Personally I wouldn't call scanning everything efficient. I didn't buy a decent computer just to have it slowed down with Norton (I ran Norton on a few machines from 1997 - 2006), best thing I did was switch them to Sophos. I've found Norton to be bloated and slow, and cause system instability on several of my systems. I especially don't miss the random slowdowns when I'm working, as Norton decides to scan files or run some other piece of housekeeping.

Not that I use a virus scanner on any of my current computers at the moment.


EDIT: AVG is just saying that the file has changed since that last time it scanned. It is not saying it's infected.

Alright, I'll try a system restore.
By the way, what is user32.dll supposed to do? My computer itself isn't acting funny at all, though. The only thing abnormal is the occasional startup problem I described earlier. Often, restarting will fix the issue right away (until some time in the future, when it pops up again). I'll probably backup my data...just don't want my computer to suddenly crash beyond repair :(

I've also updated the screenshot in my previous post :)

Although I added it to my previous post.

The screen-shot you posted of AVG, is just showing that the user32.dll file had changed since that last time it was scanned. It is not saying it's infected.

Okay. You edited after I had hit "submit" on my post, so I didn't see it the first time.

The user32.dll is a DLL that implements the Windows User API Client Library. It is a core file for several versions of the Microsoft Windows operating system. If this file is damaged or deleted, the operating system will not work. The library accesses and links many of the core components related to the OS and its users (Windows handling, basic user interface functions, etc...).

As Deep mentioned before, the change status on your virus scan simply implies that the file has changed since last time. This could have been from installation of a new program, changing your wallpaper, changing the order of your start menu, etc...

The following are known threats (e.g. viruses) that target the user32.dll file:

Backdoor.Hebolani
Ceydem.6750.Worm
Trojan.Anicmoo
Trojan.Anicmoo.B
Trojan.Anicmoo.C
Trojan.Anicmoo.D

As long as you don't find any of these bad boys on your system, your file should be relatively nominal. As for your blue screen of death concerns, the next time you get the blue screen, write down the numbers that you see.

These numbers will point to a specific cause - usually its a MS hotfix! The reference numbers will tell you - when you go to MS knowledge data base - which hotfix is causing the problems or what the problem is in general.

After you find that problem, you can work to find ways to patch it up.

Edit:

BSOD reference numbers look something like this:

0x0000001E, KMODE_EXCEPTION_NOT_HANDLED

I use AVG as well, and I've been wondering what that user32.dll meant. So it just means that it has been changed? Thanks for all the info, Candia. I think I'm more relieved now.

www.clamwin.com

It's free, better than AVG (some people would argue that it's better than most commercial AV software), and doesn't take a lot of power. Just thought I'd throw that out there.

Personally, I don't even use any AV/Anti-Spyware software...

I suggest you to use kaspersky, norman or bitdefender to detect and to delete trojan. If you use norton or mcafee, even with the newest update, you can't detect new version of trojan and some kind of virus such as id.exe, rm, $lddata$ etc.

Well ... I personally use AVG Antivirus, combined with Avira Antivir Personal Classic Edition. Both of them work well for me so far.
About the "User32.dll" tagged "Change" by AVG, IMHO it's possibly caused by one or more application changed the user32.dll. Another possible cause is Windows did a change to the file.