[Fix] StartupCheckLibrary.dll and Winscomrssrv.dll Error at Startup

When you log in to your Windows computer, the following error message windows may pop up:

RunDLL

There was a problem starting StartupCheckLibrary.dll

The specified module could not be found.
RunDLL

There was a problem starting winscomrssrv.dll

The specified module could not be found.

startupchecklibrary.dll malware startup error
Additionally, you may see the following error:

There was a problem starting StartupCheckLibrary.dll

Operation did not complete successfully because the file contains a virus or potentially unwanted software.

startupchecklibrary.dll malware startup error

Cause

The modules StartupCheckLibrary.dll and Winscomrssrv.dll are 100% malicious programs that can steal information from your computer. You do NOT need these files on your computer. The related module winlogui.exe is a coin miner trojan. These kinds of programs come with illegal/cracked computer software and video games.

startupchecklibrary.dll malware startup error
VirusTotal.com results for the StartupCheckLibrary.dll module

This malware can disable the Microsoft Defender anti-virus and perform other configuration changes on the computer. The script (maintenance.vbs) will drop the coin miner trojan named winlogui.exe in the Windows\System32 folder and then do a cleanup of all malicious files (maintenance.vbs, Winscomrssrv.dll, startupchecklibrary.dll, etc.)

In some cases, the Microsoft Defender security options may turn blank and only display the “Security at glance” message after infection. Refer to the article Windows Defender Service Missing; Security at a glance page is Empty.

The malware files run at startup via scheduled tasks instead of the regular startup locations in the registry or Startup folder.

The modules StartupCheckLibrary.dll and Winscomrssrv.dll have the “Microsoft Corporation” name in the DLL properties. But these are fake and unsigned modules that try to pose as legitimate Microsoft files.

Copyright: © Microsoft Corporation. All rights reserved.
Product: Microsoft® Windows® Operating System
Description: Startup Check Library DLL
Original Name: StartupCheckLibrary.dll
File Version 10.0.16299.15

Copyright: Microsoft Corporation. All rights reserved.
Product Name: Microsoft Windows Operating System
Description: winscomrssrv
Original Name: winscomrssrv.dll
FileVersion: 10.0.16299.15

(Malwarebytes anti-virus classifies these types of files as Trojan.FakeMS)

Microsoft Defender may successfully thwart the attack. Trojan:Win32/Tiggre!plock is the name that Microsoft has assigned to the trojan. Here’s an instance where Microsoft Defender antivirus has successfully blocked the modules StartupCheckLibrary.dll and Winscomrssrv.dll.

startupchecklibrary.dll malware startup error - defender block

 

Fix: StartupCheckLibrary.dll and Winscomrssrv.dll Error at Startup

Even if Microsoft Defender has successfully eliminated or quarantined the malware files, it’s advisable to run a thorough scan using a third-party scanner like Malwarebytes Antimalware (free) and perhaps with Malwarebytes Anti Rookit.



A thorough scan with updated definition files should eliminate all traces of the malware from the file system and the registry.

startupchecklibrary.dll malware startup error

Here are some of the important items that would be cleared:

Scheduled Tasks

  • Microsoft\Windows\Wininet\Winlogui => winlogui.exe
  • Microsoft\Windows\WDI\SrvHost => rundll32.exe winscomrssrv.dll,SrvMainHost
  • Microsoft\Windows\Application Experience\StartupCheckLibrary => rundll32.exe StartupCheckLibrary.dll,DllMainRunLibrary
  • Microsoft\Windows\Windows Error Reporting\winrmsrv => winrmsrv.exe

Files

  • winlogui.exe (Coinminer.MALXMR)
  • winrmsrv.exe (Application.CoinMiner)
  • winscomrssrv.dll (Trojan.Generic)
  • StartupCheckLibrary.dll (Trojan.Generic)

Want to Delete the Tasks and Files manually?

In case you want to delete the scheduled tasks manually, you can do so using Task Scheduler.

  1. Open Task Scheduler.
  2. Expand “Task Scheduler Library”
  3. Expand Microsoft → Windows → Wininet. Delete the Winlogui task.
  4. Similarly, delete the other three tasks (SrvHost, StartupCheckLibrary, winrmsrv) from the branches below:
    • Microsoft → Windows → WDI → Delete SrvHost
    • Microsoft → Windows → Application Experience → Delete StartupCheckLibrary
    • Microsoft → Windows → Windows Error Reporting → Delete winrmsrv
  5. Quit Task Scheduler.

Optionally, you can use Microsoft Sysinternals’s Autoruns utility to delete these entries.

startupchecklibrary.dll malware startup error

Once done, restart Windows and re-run a thorough scan for malware.

I hope the startup errors relating to StartupCheckLibrary.dll and Winscomrssrv.dll are now resolved.


One small request: If you liked this post, please share this?

One "tiny" share from you would seriously help a lot with the growth of this blog. Some great suggestions:
  • Pin it!
  • Share it to your favorite blog + Facebook, Reddit
  • Tweet it!
So thank you so much for your support, my reader. It won't take more than 10 seconds of your time. The share buttons are right below. :)

Ramesh Srinivasan is passionate about Microsoft technologies and he has been a consecutive ten-time recipient of the Microsoft Most Valuable Professional award in the Windows Shell/Desktop Experience category, from 2003 to 2012. He loves to troubleshoot and write about Windows. Ramesh founded Winhelponline.com in 2005.

1 thought on “[Fix] StartupCheckLibrary.dll and Winscomrssrv.dll Error at Startup”

Leave a Comment