rundll and firefox.exe trying to connect to external website

[slashragnarok]

My scans come out clean but my PC is apparently trying to connect to a website technolgietazo.com. Please help.

[Malwarebytes]

***This is an automated reply***

Hi,

Thanks for posting in the Malwarebytes 3 Help forum.

 

If you are having technical issues with our Windows product, please do the following: 

Spoiler

If you haven’t already done so, please run the Malwarebytes Support Tool and then attach the logs in your next reply:

NOTE: The tools and the information obtained is safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system.

1. Download Malwarebytes Support Tool
2. Once the file is downloaded, open your Downloads folder/location of the downloaded file
3. Double-click mb-support-X.X.X.XXXX.exe to run the program
   • You may be prompted by User Account Control (UAC) to allow changes to be made to your computer. Click Yes to consent.
4. Place a checkmark next to Accept License Agreement and click Next
5. You will be presented with a page stating, "Get Started!"
6. Click the Advanced tab
   
    
7. Click the Gather Logs button
   
    
8. A progress bar will appear and the program will proceed with getting logs from your computer
   
    
9. Upon completion, click a file named mbst-grab-results.zip will be saved to your Desktop. Click OK
   
    
10. Please attach the file in your next reply. Before submitting your reply, be sure to enable "Notify me of replies" like so:
       

Click "Reveal Hidden Contents" below for details on how to attach a file:
 

Spoiler

To save attachments, please click the link as shown below. You can click and drag the files to this bar or you can click the choose files, then browse to where your files are located, select them and click the Open button.

 

One of our experts will be able to assist you shortly.

 

If you are having licensing issues, please do the following: 

Spoiler

For any of these issues:

• Renewals
• Refunds (including double billing)
• Cancellations
• Update Billing Info
• Multiple Transactions
• Consumer Purchases
• Transaction Receipt

Please contact our support team at https://support.malwarebytes.com/community/consumer/pages/contact-us to get help

If you need help looking up your license details, please head here: https://support.malwarebytes.com/docs/DOC-1264 

 

Thanks in advance for your patience.

-The Malwarebytes Forum Team

[slashragnarok]

Here are the logs.

mbst-grab-results.zip

[exile360]

Greetings,

It sounds as though your system could be infected.  Please read and follow the instructions in this topic and then create a new thread in the malware removal area including the requested logs and information by clicking here and one of our malware removal specialists will help you to check and clean the system of any threats as soon as one becomes available.

Good luck, and I hope that the issue is cleared up promptly for you.

Please let us know if there is anything else we can assist you with.

Thanks

[AdvancedSetup]

Hello @slashragnarok and

 

Please run the following steps and post back the logs as an attachment when ready.

STEP 01

• If you're already running Malwarebytes 3 then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button.
• If you don't have Malwarebytes 3 installed yet please download it from here and install it.
• Once installed then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button.
• Once the scan is completed click on the Export Summary button and save the file as a Text file to your desktop or other location you can find, and attach that log on your next reply.
• If Malwarebytes won't run then please skip to the next step and let me know on your next reply.

STEP 02

Please download AdwCleaner by Malwarebytes and save the file to your Desktop.

• Right-click on the program and select Run as Administrator to start the tool.
• Accept the Terms of use.
• Wait until the database is updated.
• Click Scan Now.
• When finished, please click Clean & Repair.
• Your PC should reboot now if any items were found.
• After reboot, a log file will be opened. Copy its content into your next reply.

 

RESTART THE COMPUTER Before running Step 3

STEP 03
Please download the Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit

• Double-click to run it. When the tool opens, click Yes to disclaimer.
• Press the Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
• The first time the tool is run, it also makes another log (Addition.txt). If you've, run the tool before you need to place a check mark here.
• Please attach the Additions.txt log to your reply as well.

 

Thanks

Ron

 

[slashragnarok]

Hi Ron,

Here are my logs

Adwcleaner

# -------------------------------
# Malwarebytes AdwCleaner 7.2.4.0
# -------------------------------
# Build:    09-25-2018
# Database: 2018-11-19.1 (Cloud)
# Support:  https://www.malwarebytes.com/support
#
# -------------------------------
# Mode: Clean
# -------------------------------
# Start:    11-20-2018
# Duration: 00:00:03
# OS:       Windows 10 Pro
# Cleaned:  0
# Failed:   0

***** [ Services ] *****

No malicious services cleaned.

***** [ Folders ] *****

No malicious folders cleaned.

***** [ Files ] *****

No malicious files cleaned.

***** [ DLL ] *****

No malicious DLLs cleaned.

***** [ WMI ] *****

No malicious WMI cleaned.

***** [ Shortcuts ] *****

No malicious shortcuts cleaned.

***** [ Tasks ] *****

No malicious tasks cleaned.

***** [ Registry ] *****

No malicious registry entries cleaned.

***** [ Chromium (and derivatives) ] *****

No malicious Chromium entries cleaned.

***** [ Chromium URLs ] *****

No malicious Chromium URLs cleaned.

***** [ Firefox (and derivatives) ] *****

No malicious Firefox entries cleaned.

***** [ Firefox URLs ] *****

No malicious Firefox URLs cleaned.

*************************

[+] Delete Tracing Keys
[+] Reset Winsock

*************************

AdwCleaner[S00].txt - [2342 octets] - [18/11/2018 22:12:46]
AdwCleaner[C00].txt - [2252 octets] - [18/11/2018 22:13:55]
AdwCleaner[S01].txt - [1371 octets] - [19/11/2018 08:41:02]
AdwCleaner[S02].txt - [1432 octets] - [19/11/2018 22:09:15]
AdwCleaner[S03].txt - [1493 octets] - [20/11/2018 21:05:05]

########## EOF - C:\AdwCleaner\Logs\AdwCleaner[C03].txt ##########

 

 

Addition.txt

FRST.txt

mbam log.txt

[AdvancedSetup]

Why do you have TESTSIGNING set on boot? That's not very safe

What is this batch file doing?
System32\Tasks\Net fix => C:\Users\Sandarpan.PC2\Desktop\network.bat

Why do you have a forced shutdown scheduled to even ignore saving open documents?
System32\Tasks\Shutdown => shutdown [Argument = /s /f /t 60]

What is this  file?
C:\WINDOWS\erzotjzszr.erz

Use of keygens is typically illegal and potentially dangerous to your system
C:\Users\SANDAR~1.PC2\AppData\Local\Temp\keygen.exe

 

[AdvancedSetup]

Please download the attached fixlist.txt file and save it to the Desktop.
NOTE. It's important that both files, FRST or FRST64 and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system.

Run FRST or FRST64 and press the Fix button just once and wait.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Desktop (Fixlog.txt). Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.

fixlist.txt

 

Thanks, Ron

 

[slashragnarok]

On 11/26/2018 at 8:29 AM, AdvancedSetup said:

Why do you have TESTSIGNING set on boot? That's not very safe

What is this batch file doing?
System32\Tasks\Net fix => C:\Users\Sandarpan.PC2\Desktop\network.bat

Why do you have a forced shutdown scheduled to even ignore saving open documents?
System32\Tasks\Shutdown => shutdown [Argument = /s /f /t 60]

What is this  file?
C:\WINDOWS\erzotjzszr.erz

Use of keygens is typically illegal and potentially dangerous to your system
C:\Users\SANDAR~1.PC2\AppData\Local\Temp\keygen.exe

 

Thanks for your reply. The network batch file was for resetting my LAN adapter which was starting up disabled when I staretd Windows. That issue has been resolved since and it is not used anymore

Shutdown => shutdown [Argument = /s /f /t 60] was just a batch file I was practicing on

What is this  file?
C:\WINDOWS\erzotjzszr.erz

No idea

Use of keygens is typically illegal and potentially dangerous to your system
C:\Users\SANDAR~1.PC2\AppData\Local\Temp\keygen.exe

This is probably something I had used years ago and I don't know how it is in the Temp folder

 

Thanks for your fix. I'll try it and report back

 

[slashragnarok]

Here's the fixlog. Interestingly rundll32 kept attempting to access the website I mentioned multiple times as the fix was being applied.

Thanks

Fixlog.txt

[AdvancedSetup]

Great, thanks for the update. Let me have you reboot the computer one more time. Then run all 3 steps again from post 5. This time the scans should come back clean and hopefully nothing more in the FRST logs either.

Thanks

Ron

 

[slashragnarok]

I have run the scans again. MBAM and Adwcleaner scans come out clean as before. I have attached the FRST logs here.

Thanks again.

Addition.txt

FRST.txt

[AdvancedSetup]

Why is the system set to not enforce signed drivers? This helps to prevent infection by having it force drivers to be signed

testsigning: ==> 'testsigning' is set. Check for possible unsigned driver <==== ATTENTION

 

You have an old compromised version of Java installed. Please uninstall Java.  Java 8 Update 144

 

 

Please download the attached fixlist.txt file and save it to the Desktop.
NOTE. It's important that both files, FRST or FRST64 and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system.

Run FRST or FRST64 and press the Fix button just once and wait.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Desktop (Fixlog.txt). Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.

fixlist.txt

Thanks

Ron

 

[slashragnarok]

Thanks Ron

 

Here's the fixlog

Interestingly the same fixes did not remove the file at C:\WINDOWS\erzotjzszr.erz before.

I did update Java

Thanks again

Fixlog.txt

[AdvancedSetup]

How is the computer running now?

Are there still any signs of an infection?

 

[slashragnarok]

It's okay I guess. The problem is that I've run out of time on the MBAM Premium trial and that was the thing catching the culprit. So can't say if it's gone.

[AdvancedSetup]

Well, it showed in scans so if it's still there then the scan should show.

Let's go ahead and run some other scans. We'll even use another scanner from Kaspersky

 

Please download and run the following Kaspersky antivirus scanner to remove any found threats. Temporarily disable your current antivirus while running this scanner.

Kaspersky Virus Removal Tool

Let me know if it finds anything or not

[slashragnarok]

Thanks for your help. Well it never showed up in scans before.  MBAM Premium used to catch it as it tried to access the website in real time. I'll give this a try and report back.

[slashragnarok]

Kaspersky scans are clean.

[AdvancedSetup]

You can look yourself and the file C:\WINDOWS\erzotjzszr.erz  should no longer be there

 

[slashragnarok]

Thanks for your time and help. I think the topic can be closed now and marked resolved.

[AdvancedSetup]

Okay, will do. If you do run into any further issues later on, please let us know.

Take care

Ron

 

[AdvancedSetup]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Thanks