Malwarebyte bock outbound from rundll32.exe

[XxAce79xX]

Hi,

 

My malwarebyte keep notify a block from rundll32 from window/syswow64.

I've tried full scan with malwarebyte. no malware detected. Tried Malwarebytes Anti-Rootkit doesn't help either as it didn't detect anything. 

Below is the log from FRST and Malwarebytes Anti-Rootkit .

please help!

Addition.txt

FRST.txt

mbar-log-2017-08-14 (20-25-19).txt

system-log.txt

[AdvancedSetup]

Hello @XxAce79xX and

Please post the protection log from Malwarebytes so that we can see the actual block entry.

Thank you

Ron

 

[XxAce79xX]

Hi AdvancedSetup,

 

Thanks for the reply.

The protection log is as below.

outbound connection.txt

[AdvancedSetup]

Let me have you run the following please. Make sure you temporarily disable your antivirus.

 

Please download Malwarebytes Anti-Rootkit from here
If needed there is a self help tutorial here: MBAR tutorial

• Unzip the contents to a folder in a convenient location.
• Open the folder where the contents were unzipped and run mbar.exe
• Follow the instructions in the wizard to update and allow the program to scan your computer for threats.
• Click on the Cleanup button to remove any threats and reboot if prompted to do so.
• Wait while the system shuts down and the cleanup process is performed.
• Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process.
• When done, please post the two logs produced they will be in the MBAR folder... mbar-log.txt and system-log.txt

 

[XxAce79xX]

All done! no Malware was found. while the issue still persist.

mbar-log-2017-08-16 (20-10-34).txt

system-log.txt

[AdvancedSetup]

When do you get or see this block? When running Chrome?

If you close Chrome and use another browser, do you still get this block?

 

[XxAce79xX]

I do have chrome installed but I seldom use them.

my primary browser is Firefox. I'm not sure if the block pop up is triggered by any web browser. 

Ill try not using any web browser and see if there is any black pop up. 

[AdvancedSetup]

Please start an elevated Admin level Command Prompt and type the following exactly and press the Enter key after each line.

SCHTASKS /Query /FO LIST /V >"%USERPROFILE%\Desktop\MyScheduledTasks.txt"

reg export "HKEY_CURRENT_USER\Console" "%USERPROFILE%\Desktop\MyConsoleSettings.txt" /y

Then locate on your desktop the file MyScheduledTasks.txt and MyConsoleSettings.txt  then attach them back on your next reply and I'll take a look and see what's going on.

Thank you

Ron

 

[XxAce79xX]

Done. the block continues even if i didn't use any web browser.

MyConsoleSettings.txt

MyScheduledTasks.txt

[AdvancedSetup]

I'm sorry. I thought I had replied to this already, but don't see my reply so obviously not. Please send me a PM in the future if I've not replied within 24 hours or so.

So, the logs do not show any unexpected tasks kicking off that would account for it.

The only obvious item using rundll32 is this entry.

HKLM\...\Run: [ShadowPlay] => "C:\Windows\system32\rundll32.exe" C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart

But this appears to be a legit entry from Nvidia and we don't know for sure at this point if in fact that is the one doing the call or not.

https://forums.geforce.com/default/topic/754662/nvidia-shadowplay-launch-on-startup-/?offset=24

You do have multiple P2P applications such as BitTorrent etc. It's quite possible one of them are launching a rundll32 process that is captured due to many P2P networks using less than clean networks to share data.

 

[XxAce79xX]

the only P2p i have is bit-torrent.  the Rundll32 is not from system32 but from windows\syswow64.

i tired disabling the real time protection and scanning again the Malwarebyte detected 2 files name nsa.exe at my c drive as suspicious and quarantine it. I've already deleted the files.

somehow its doesn't feel like its safe to left this issue unattended..

[AdvancedSetup]

Not saying to leave it. Just saying our initial scans so far are not finding the issue. We can do some other scans though.

 

Please run the following steps and post back the logs as an attachment when ready.

STEP 01

• If you're already running Malwarebytes 3 then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button.
• If you don't have Malwarebytes 3 installed yet please download it from here and install it.
• Once installed then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button.
• Once the scan is completed click on the Export Summary button and save the file as a Text file to your desktop or other location you can find, and attach that log on your next reply.
• If Malwarebytes won't run then please skip to the next step and let me know on your next reply.

STEP 02

Please download AdwCleaner by Malwarebytes and save the file to your Desktop.

• Right-click on the program and select Run as Administrator to start the tool.
• Accept the Terms of use.
• Wait until the database is updated.
• Click Scan.
• When finished, please click Clean.
• Your PC should reboot now if any items were found.
• After reboot, a log file will be opened. Copy its content into your next reply.

STEP 03
Please download the Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit

• Double-click to run it. When the tool opens, click Yes to disclaimer.
• Press the Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
• The first time the tool is run, it also makes another log (Addition.txt). If you've, run the tool before you need to place a check mark here.
• Please attach the FRST.txt and Additions.txt logs to your reply as well.

 

Thanks

Ron

 

Edited August 22, 2017 by AdvancedSetup

[XxAce79xX]

All the files attached below. still getting the outbound message.

Addition.txt

FRST.txt

AdwCleaner[C0].txt

[AdvancedSetup]

Please download the attached fixlist.txt file and save it to the Desktop.
NOTE. It's important that both files, FRST or FRST64 and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system.

Run FRST or FRST64 and press the Fix button just once and wait.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Desktop (Fixlog.txt). Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.

fixlist.txt

Thanks

Ron

 

[XxAce79xX]

done. no outbond message anymore. i think its fixed?

Can i know what was the root cause to the problem so that i can avoid it in the future?

Anyway thanks for the help provided. I just subscribe to 1 year of malwarebytes premium not just because i find malwarebytes consume less resources compare to other brands I've tried before but also of the help i received from here. keep up the good work!

Fixlog.txt

[AdvancedSetup]

You had a policy running as well as some proxy settings that we reset with the fix.

Unless there is something else, I'll go ahead and close your topic then.

Take care

Ron

 

 

 

[XxAce79xX]

i see. sure please go ahead.

[AdvancedSetup]

Glad we could help. :)If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.Other members who need assistance please start your own topic in a new thread. Thanks!