Malicious Website Blocked IP 195.62.25.111 rundll32.exe

[Berliner]

I am receiving this notification several times a minute, rundll32.exe is using a lot of CPU and memory.

 

Here is the FRST.txt log (Addition.txt attached).

 

Thanks !

Duane

 

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:13-06-2015
Ran by Duane (administrator) on DUANE-PC on 14-06-2015 17:58:58
Running from C:\Users\Duane\Desktop
Loaded Profiles: Duane (Available Profiles: Duane & Administrator)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: English (United States)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.amyuni.com)C:\Windows\SysWOW64\cdintf250.dll
2015-06-06 16:36 - 2011-06-26 02:45 - 00256000 _____ C:\Windows\PEV.exe
2015-06-06 16:36 - 2010-11-07 13:20 - 00208896 _____ C:\Windows\MBR.exe
2015-06-06 16:36 - 2009-04-20 00:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2015-06-06 16:36 - 2000-08-30 20:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2015-06-06 16:36 - 2000-08-30 20:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2015-06-06 16:36 - 2000-08-30 20:00 - 00098816 _____ C:\Windows\sed.exe
2015-06-06 16:36 - 2000-08-30 20:00 - 00080412 _____ C:\Windows\grep.exe
2015-06-06 16:36 - 2000-08-30 20:00 - 00068096 _____ C:\Windows\zip.exe
2015-06-06 16:34 - 2015-06-06 16:59 - 00000000 ____D C:\Windows\erdnt
2015-06-06 15:27 - 2015-06-06 16:25 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2015-06-06 13:52 - 2015-06-14 13:55 - 00136408 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-06-06 13:52 - 2015-06-09 18:57 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
2015-06-06 13:52 - 2015-06-06 13:52 - 00000000 ____D C:\ProgramData\Malwarebytes
2015-06-06 13:52 - 2015-04-14 09:37 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-06-06 13:52 - 2015-04-14 09:37 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-06-06 13:52 - 2015-04-14 09:37 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-06-02 20:54 - 2015-06-06 16:32 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-06-14 17:44 - 2011-06-10 04:02 - 00000000 ____D C:\ProgramData\Temp
2015-06-14 17:43 - 2014-07-06 12:29 - 01116578 _____ C:\Windows\WindowsUpdate.log
2015-06-14 17:37 - 2011-06-28 07:20 - 00000000 ____D C:\Users\Duane\AppData\Roaming\Free Download Manager
2015-06-14 12:56 - 2014-07-10 21:23 - 00001555 _____ C:\Users\Duane\AppData\Roaming\SAS7_000.DAT
2015-06-14 12:54 - 2011-07-29 23:23 - 00000000 ____D C:\Users\Duane\AppData\Roaming\WinFF
2015-06-14 12:51 - 2012-05-30 20:15 - 00000000 ____D C:\Users\Duane\AppData\Local\CrashDumps
2015-06-14 01:18 - 2009-07-14 00:45 - 00009920 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-06-14 01:18 - 2009-07-14 00:45 - 00009920 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-06-14 01:16 - 2009-07-14 01:13 - 00888182 _____ C:\Windows\system32\PerfStringBackup.INI
2015-06-14 01:11 - 2012-07-20 19:54 - 00000000 ____D C:\Users\Duane\AppData\Roaming\Dropbox
2015-06-14 01:10 - 2014-07-05 17:38 - 00000296 _____ C:\Windows\Tasks\Gfwkct.job
2015-06-14 01:10 - 2009-07-14 01:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-06-14 01:09 - 2011-06-28 07:20 - 00000000 ____D C:\Program Files (x86)\Free Download Manager
2015-06-14 01:07 - 2011-08-09 20:57 - 00000000 ____D C:\Users\Duane\AppData\Roaming\Media Player Classic
2015-06-13 13:23 - 2011-10-23 19:03 - 00000000 ____D C:\Users\Duane\AppData\Roaming\Mp3tag
2015-06-13 13:14 - 2013-01-15 21:44 - 00000000 ____D C:\Users\Duane\AppData\Roaming\foobar2000
2015-06-13 10:56 - 2011-07-02 23:33 - 00000000 ____D C:\ProgramData\DVD Shrink
2015-06-13 09:40 - 2013-05-05 19:56 - 00000000 ____D C:\Program Files\Recuva
2015-06-13 09:03 - 2011-06-28 22:05 - 00000000 ____D C:\Users\Duane\AppData\Roaming\vlc
2015-06-13 08:23 - 2013-06-12 06:18 - 00001047 _____ C:\Users\Duane\AppData\Roaming\DVDSubEdit.ini
2015-06-13 08:20 - 2011-07-04 13:38 - 00000000 ____D C:\Users\Duane\AppData\Roaming\dvdcss
2015-06-11 20:52 - 2014-07-09 06:47 - 00002787 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Dragon NaturallySpeaking 12.5.lnk
2015-06-10 20:48 - 2011-07-04 16:12 - 00000000 ____D C:\Users\Duane\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Tools
2015-06-09 20:33 - 2011-06-28 07:20 - 00000000 ____D C:\ProgramData\FreeDownloadManager.ORG
2015-06-09 20:30 - 2011-06-27 08:57 - 00000000 ____D C:\Users\Duane
2015-06-09 20:29 - 2014-07-09 06:37 - 00000000 ____D C:\Program Files (x86)\MSXML 4.0
2015-06-07 12:57 - 2011-06-28 21:53 - 00000000 ____D C:\Program Files (x86)\AviSynth 2.5
2015-06-07 08:29 - 2014-10-27 18:21 - 00000000 ____D C:\Users\Duane\AppData\Local\Adobe
2015-06-06 21:33 - 2012-08-31 11:11 - 00000000 ____D C:\ProgramData\Microsoft Help
2015-06-06 17:13 - 2011-06-28 09:33 - 00000148 _____ C:\Windows\QUICKEN.INI
2015-06-06 17:13 - 2011-06-28 09:33 - 00000000 ____D C:\Program Files (x86)\Quicken
2015-06-06 17:02 - 2009-07-13 23:20 - 00000000 __RHD C:\Users\Default
2015-06-06 16:50 - 2009-07-13 22:34 - 00000215 _____ C:\Windows\system.ini
2015-06-06 16:32 - 2012-05-04 06:10 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2015-06-06 16:18 - 2003-03-18 22:20 - 01060864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MFC71.dll
2015-06-06 16:18 - 2003-03-18 22:20 - 01060864 _____ (Microsoft Corporation) C:\Windows\system32\MFC71.dll
2015-06-06 16:18 - 2003-03-18 21:14 - 00499712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcp71.dll
2015-06-06 16:18 - 2003-03-18 21:14 - 00499712 _____ (Microsoft Corporation) C:\Windows\system32\msvcp71.dll
2015-06-06 16:18 - 2003-02-21 05:42 - 00348160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcr71.dll
2015-06-06 16:18 - 2003-02-21 05:42 - 00348160 _____ (Microsoft Corporation) C:\Windows\system32\msvcr71.dll
2015-06-06 13:37 - 2009-07-13 23:20 - 00000000 ____D C:\Windows\SysWOW64\Setup
2015-06-06 13:37 - 2009-07-13 23:20 - 00000000 ____D C:\Windows\SysWOW64\oobe
2015-06-06 13:37 - 2009-07-13 23:20 - 00000000 ____D C:\Windows\SysWOW64\MUI
2015-06-06 13:37 - 2009-07-13 23:20 - 00000000 ____D C:\Windows\SysWOW64\com
2015-05-20 21:55 - 2011-12-04 16:05 - 00000000 ____D C:\Users\Duane\AppData\Roaming\Audacity

==================== Files in the root of some directories =======

2014-07-18 21:15 - 2014-07-18 21:15 - 0000038 _____ () C:\Users\Duane\AppData\Roaming\Camdata.ini
2014-07-18 21:15 - 2014-07-18 21:15 - 0000408 _____ () C:\Users\Duane\AppData\Roaming\CamLayout.ini
2014-07-18 21:15 - 2014-07-18 21:15 - 0000408 _____ () C:\Users\Duane\AppData\Roaming\CamShapes.ini
2014-07-18 21:15 - 2014-07-18 21:15 - 0004546 _____ () C:\Users\Duane\AppData\Roaming\CamStudio.cfg
2013-06-12 06:18 - 2015-06-13 08:23 - 0001047 _____ () C:\Users\Duane\AppData\Roaming\DVDSubEdit.ini
2015-06-13 08:22 - 2015-06-13 08:22 - 0021663 _____ () C:\Users\Duane\AppData\Roaming\DVDSubEditLastFile0.txt
2014-07-10 21:23 - 2015-06-14 12:56 - 0001555 _____ () C:\Users\Duane\AppData\Roaming\SAS7_000.DAT
2014-07-18 21:11 - 2014-07-18 21:11 - 0000096 _____ () C:\Users\Duane\AppData\Roaming\version2.xml
2014-01-09 07:09 - 2014-12-18 16:56 - 0005632 _____ () C:\Users\Duane\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-09-04 19:58 - 2015-04-25 12:00 - 0000040 ___SH () C:\ProgramData\.zreglib
2015-03-15 19:06 - 2015-03-22 19:28 - 0000469 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.400.32.bc

Some files in TEMP:
====================
C:\Users\Duane\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpqbtc5c.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


ATTENTION: ==> Could not access BCD. Check to make sure user is administrator or see Addition.txt for additional information.


LastRegBack: 2015-04-20 16:29

==================== End of log ============================

Addition.txt

FRST.txt

[TwinHeadedEagle]

Hello,
    
 
They call me TwinHeadedEagle around here, and I'll try to help your with your issue.
 
     
    
Before we start please read and note the following:

• We're primarily oriented on malware removal here, so you must know that some issues just cannot be solved and you must be prepared for this. Some tools we use here will remove your browser search history, so backup your important links and all the files whose loss is unacceptable.
• Limit your internet access to posting here, some infections just wait to steal typed-in passwords.
• Please be patient. I know it is frustrating when your PC isn't working properly, but malware removal takes time. Keep in mind that private life gets in the way too. Note that we may live in totally different time zones, what may cause some delays between answers.
• Don't run any scripts or tools on your own, unsupervised usage may cause more harm than good.
• Do not paste the logs in your posts, attachments make my work easier. There is a More reply options button, that gives you Upload Files option below which you can use to attach your reports. Always attach reports from all tools.
• Always execute my instructions in given order. If for some reason you cannot completely follow one instruction, inform me about that.
• I volunteer to help you, so please, do not ask for help for your company/business PC. Companies are making revenue via computers, so it is good thing to pay someone to repair it.
• If I don't hear from you within 3 days from this initial or any subsequent post, then this thread will be closed.

I can't foresee everything, so if anything not covered in my instructions happens, please stop and inform me!
There are no silly questions. Never be afraid to ask if in doubt!
 
 
 
  Rules and policies
 
We won't support any piracy.
That being told, if any evidence of illegal OS, software, cracks/keygens or any other will be revealed, any further assistance will be suspended. If you are aware that there is this kind of stuff on your machine, remove it before proceeding!
The same applies to any use of P2P software: uTorrent, BitTorrent, Vuze, Kazaa, Ares... We don't provide any help for P2P, except for their removal. All P2P software has to be uninstalled or at least fully disabled before proceeding!
 
Failure to follow these guidelines will result with closing your topic and withdrawning any assistance.
 
 

---

 

Please re-run Malwarebytes' Anti-Malware.

• Click the History tab.
• Click Application Logs and double-click the newest Protection Log.
• At the bottom click Export and choose Text file.

Save the file to your desktop and include its content in your next reply.

[Berliner]

Hello TwinHeadedEagle, thank you.

 

Please find the requested log file, attached.

 

Thanks !

Daily Protection Log.txt

[TwinHeadedEagle]

Okay, cure for you
 
 
Fix with Farbar Recovery Scan Tool
 

This fix was created for this user for use on that particular machine.
Running it on another one may cause damage and render the system unstable.

 
Download attached fixlist.txt file and save it to the Desktop:
 
Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

• Right-click on icon and select Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• Press the Fix button just once and wait.
• If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
• When finished FRST will generate a log on the Desktop, called Fixlog.txt.

Please attach it to your reply.

fixlist.txt

[Berliner]

Hello TwinHeadedEagle, please find the fixlog.txt file, attached.

 

Thanks !

[Berliner]

here is the attachment :-)

Fixlog.txt

[TwinHeadedEagle]

Good. How is your PC behaving now?

[Berliner]

There have been no more issues. The notification is gone. :-)

 

I will donate to you, but would like to understand how this infection happens.

 

I have good virus protection and don't visit any "dangerous" websites.

 

Could you please help me understand what this infection was and how I got it?

 

Thanks, TwinHeadedEagle !

[TwinHeadedEagle]

I don't know how you got infected, I can only guess, what I don't want to do. Based on some information (which I again can't be sure they are true, because malware can manipulate with information), it seems that infection happened on 7. may 2015. It was modified on 14. june, and then MalwareBytes started catching it.

 

It was probably some new piece of malware and it is not a rare thing that antivirus just cannot detect malware that is old few hours or days.

[Berliner]

OK, donation complete.

 

The date helped, I will review my internet history.

 

Thanks !

[AdvancedSetup]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!