Cleaning a trojan that drops malicious DLLs into system folders

Malicious DLLs dropped by a Trojan can make startup items reappear, alter browser settings, and disable security tools on a Windows PC. Removing one DLL is rarely enough because a scheduled task, service, startup shortcut, or registry entry can restore it. Legitimate Windows components also live in protected directories, so deleting files by name can make the PC unbootable.

Disconnect the PC from Wi-Fi or Ethernet before investigating, especially if it reaches banking, email, or a business network. Note the symptoms, recent downloads, and detection names. This process suits a home or small-business Windows machine in Sydney, Melbourne, Brisbane, or Perth, where Microsoft 365 and outsourced IT support are common. An employer-owned device should go to its authorised administrator.

Isolate the device and preserve useful evidence

Start with the network rather than folder browsing. Turn off Wi-Fi, unplug Ethernet, and avoid removable drives and shared folders. If the laptop is only “playing up” without a clear alert, isolation can still stop the payload from contacting its command server or copying more files. Record warnings and running-process details for an administrator before shutting down.

Use a separate clean device to change exposed passwords, starting with email and banking, through official sites or apps. Australian bank customers should call the fraud number printed on their card or shown in the official app. Never upload private documents or an unknown DLL to a public sample-sharing service; it may contain credentials, customer data, or business records.

Confirm the infection and remove the Trojan

In Windows Security, open Virus & threat protection and run a full scan. Allow Defender to quarantine confirmed detections, then choose Scan options and Microsoft Defender Offline scan, which restarts the PC. Keep the network disconnected unless updated definitions are essential; reconnect only after the restart and another check. If a program returns, record the behaviour instead of restoring the detection.

A second opinion from a current, well-known anti-malware product can help, but install it only from its official site. An unwanted program may have arrived with the Trojan; the site's unwanted program guidance helps separate that nuisance from the payload. Do not restore a quarantined file because its name looks familiar.

Inspect system folders without deleting protected files

Review Protection history and record the detection name, exact path, timestamp, and whether it is identified as a Trojan, loader, or DLL. Payloads may appear in C:\Windows\System32, SysWOW64, Program Files, AppData, Temp, a browser folder, or a download directory. A DLL in a system directory is not automatically malicious; origin, signature, and detection matter.

Use the security tool's quarantine action for confirmed objects. Never empty System32, SysWOW64, WinSxS, or a component store by hand, and do not rename DLLs to test them. Compare locations before deciding what an IT professional should remove:

Location	What it may contain	Careful response
System32 and SysWOW64	Protected Windows libraries or an injected DLL	Let a scanner quarantine the identified object; do not delete files by name
AppData, Temp, and download folders	Stagers and payloads unpacked with user permissions	Scan, remove confirmed detections, and clear temporary files after a clean reboot
Startup folders	Shortcuts that launch a malicious executable or DLL	Inspect the target path, then remove a confirmed malicious shortcut
Scheduled tasks and services	Persistence that recreates or reloads the payload	Record the command and entry, then remove it only after verification

After cleanup, reboot and scan again. A Microsoft signature with an unexpected path or unexplained parent process deserves verification through official Microsoft or vendor information; a signature alone does not clear every suspicious file.

Remove persistence and restore a trusted baseline

Inspect the Startup folder, Task Manager startup items, Task Scheduler, Services, registry Run keys, and browser extensions. Microsoft Sysinternals Autoruns, downloaded from Microsoft, can reveal hidden entries. Record each command, path, publisher, and date, then remove or disable only entries linked to the infection. On a managed Australian computer, keep an export or screenshot and let the authorised IT administrator make changes.

If encrypted files are present, do not assume DLL cleanup will decrypt them; the site's ransomware recovery guidance is a separate response path. Running an unverified decryptor can damage the only recoverable copy. Report significant personal or business incidents to ReportCyber or seek advice from the Australian Cyber Security Centre.

If protected components were altered, a driver was used, or the Trojan returns after clean scans, a Windows reset or clean installation is often safer than incremental deletion. Use known-good installation media, restore documents and photos from a clean backup rather than programs or DLLs, and change important passwords from a clean device.

Recover carefully and reduce the chance of return

After cleanup, reconnect on a trusted network long enough to update Windows, the browser, and security software, then disconnect again and run a final offline scan. Remove extensions or startup entries pointing to temporary folders, check download history, and restore from the earliest clean backup while keeping encrypted originals untouched. Australian households and sole traders should keep an offline or separately stored copy because cloud synchronisation alone does not protect against deletion or account compromise.

The site's practical security tips can help keep the clean state: enable Defender and the firewall, use unique passwords through a password manager, and install software only from official vendor or Australian government sources. If credentials or financial details were exposed, contact the relevant bank and ReportCyber. On a Mac, use built-in XProtect updates and official vendor guidance instead of Windows DLL-folder steps.

A clean result means no detections, no suspicious persistence, and no unexplained DLLs returning after reboot—not merely an empty quarantine folder.