Jump to content

rundll32.exe Infection


Recommended Posts

I'm quite sure I'm infected. Malwarebytes Antimalware doesn't clear the problem. Here are the symptions:

  1. From startup on I get "Application Exception" popups - "The instruction at ********* referenced memory at ##########. The memory could not be written. After login, the error occurs every time I start a program. Some programs start, others don't.
  2. Starting IE cause error in item above AND also shows a weird screen that stays on top and cannot be closed. IE does not start
  3. Malwarebytes Antimalware detects viruses. I attempt to clean but they still remain after clean and reboot. The virures prevent regedit, Task Manager and system restore. See log.

Attached are the Malwarebytes and Hijack This logs.

I've also attached a screenshot of the "weird" screen shown when I attempt to start IE.

Please advise. Thanks

mbam_log_2009_12_26__19_40_04_.txt

hijackthis.txt

weirdscreen.bmp

Link to post
Share on other sites

Hello drudolph

Welcome to Malwarebytes. :)

=====================

  • Download OTL to your desktop.
  • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • When the window appears, underneath Output at the top change it to Minimal Output.
  • Under the Standard Registry box change it to All.
  • Under Custom scan's and fixes section paste in the below in bold


    %SYSTEMDRIVE%\*.exe

    /md5start

    eventlog.dll

    scecli.dll

    netlogon.dll

    cngaudit.dll

    sceclt.dll

    ntelogon.dll

    logevent.dll

    iaStor.sys

    nvstor.sys

    atapi.sys

    IdeChnDr.sys

    viasraid.sys

    AGP440.sys

    vaxscsi.sys

    nvatabus.sys

    viamraid.sys

    nvata.sys

    nvgts.sys

    iastorv.sys

    ViPrt.sys

    eNetHook.dll

    ahcix86.sys

    KR10N.sys

    nvstor32.sys

    /md5stop

    CREATERESTOREPOINT


  • Check the boxes beside LOP Check and Purity Check.
  • Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
    • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
    • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.

====================

Download the following GMER Rootkit Scanner from Here

  • Download the randomly named EXE file to your Desktop. Remember what its name is since it is randomly named.
  • Double click on the new random named exe file you downloaded and run it. If prompted about the Security Warning and Unknown Publisher go ahead and click on Run
  • It may take a minute to load and become available.
  • If it gives you a warning about rootkit activity and asks if you want to run a full scan...click on NO, then use the following settings for a more complete scan..
  • In the right panel, you will see several boxes that have been checked. Ensure the following are UNCHECKED


  • Sections

  • IAT/EAT

  • Drives/Partition other than Systemdrive (typically only C:\ should be checked)

  • Show All (don't miss this one)


  • Then click the Scan button & wait for it to finish.
  • Once done click on the [save..] button, and in the File name area, type in "ark.txt" or it will save as a .log file which cannot be uploaded to your post.
  • Save it where you can easily find it, such as your desktop
  • **Caution** Rootkit scans often produce false positives. Do NOT take any action on any "<--- ROOKIT" entries
  • Click OK and quit the GMER program.
  • Note: On Firefox you need to go to Tools/Options/Main then under the Downloads section, click on Always ask me where to save files so that you can choose the name and where to save to, in this case your Desktop.

Link to post
Share on other sites

I am severely hampered by the window created by the virus since it is always on top. For example, when I run OTL, I cannot see if I am being prompted for anything or move the window. Do you have an ideas on how to get around this? I've tried changing the monitor resolution. It worked once but now it automatically reverts back to the previous settings.

Thanks!

Link to post
Share on other sites

Please try this hit the Windows Flag key beside the alt key on your keyboard and the D key at the same time this will force the system to go back to the desktop.

It appears to be some ransom ware.

It is foreign language and I cannot decode what it says for now.

Link to post
Share on other sites

Please try this hit the Windows Flag key beside the alt key on your keyboard and the D key at the same time this will force the system to go back to the desktop.

It appears to be some ransom ware.

It is foreign language and I cannot decode what it says for now.

Thanks. Seem to have gotten rid of it for now. I'll try this if it comes back.

Thanks!

Link to post
Share on other sites

Hello drudolph

Welcome to Malwarebytes. :)

=====================

  • Download OTL to your desktop.
  • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • When the window appears, underneath Output at the top change it to Minimal Output.
  • Under the Standard Registry box change it to All.
  • Under Custom scan's and fixes section paste in the below in bold


    %SYSTEMDRIVE%\*.exe

    /md5start

    eventlog.dll

    scecli.dll

    netlogon.dll

    cngaudit.dll

    sceclt.dll

    ntelogon.dll

    logevent.dll

    iaStor.sys

    nvstor.sys

    atapi.sys

    IdeChnDr.sys

    viasraid.sys

    AGP440.sys

    vaxscsi.sys

    nvatabus.sys

    viamraid.sys

    nvata.sys

    nvgts.sys

    iastorv.sys

    ViPrt.sys

    eNetHook.dll

    ahcix86.sys

    KR10N.sys

    nvstor32.sys

    /md5stop

    CREATERESTOREPOINT


  • Check the boxes beside LOP Check and Purity Check.
  • Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
    • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
    • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.

====================

Download the following GMER Rootkit Scanner from Here

  • Download the randomly named EXE file to your Desktop. Remember what its name is since it is randomly named.
  • Double click on the new random named exe file you downloaded and run it. If prompted about the Security Warning and Unknown Publisher go ahead and click on Run
  • It may take a minute to load and become available.
  • If it gives you a warning about rootkit activity and asks if you want to run a full scan...click on NO, then use the following settings for a more complete scan..
  • In the right panel, you will see several boxes that have been checked. Ensure the following are UNCHECKED


  • Sections

  • IAT/EAT

  • Drives/Partition other than Systemdrive (typically only C:\ should be checked)

  • Show All (don't miss this one)


  • Then click the Scan button & wait for it to finish.
  • Once done click on the [save..] button, and in the File name area, type in "ark.txt" or it will save as a .log file which cannot be uploaded to your post.
  • Save it where you can easily find it, such as your desktop
  • **Caution** Rootkit scans often produce false positives. Do NOT take any action on any "<--- ROOKIT" entries
  • Click OK and quit the GMER program.
  • Note: On Firefox you need to go to Tools/Options/Main then under the Downloads section, click on Always ask me where to save files so that you can choose the name and where to save to, in this case your Desktop.

I replied with text copied and pasted from OTL.txt and Extras.txt but my post seems empty. I'm attaching the files instead. NOTE: Could not run GMER because of this virus.

OTL.Txt

Extras.Txt

Link to post
Share on other sites

We will begin with ComboFix.exe. Please visit this webpage for download links, and instructions for running the tool:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

* Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Please include the C:\ComboFix.txt in your next reply for further review.

Link to post
Share on other sites

We will begin with ComboFix.exe. Please visit this webpage for download links, and instructions for running the tool:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

* Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Please include the C:\ComboFix.txt in your next reply for further review.

I cannot start ComboFix. First, I cannot start IE or Chrome so I have been using another computer for this forum and to download and transfer files to the infected computer. When I tried to copy ComboFix.exe to the infected machine, IT IS IMMEDIATELY DELETED! This bugger is smart! So I renamed it to a random file name. It copied okay. However, I cannot run it. I get the same "rundll32 - Application Exception" popup and then the phantom screen?

I there another way to run ComboFix.exe that could bypass this problem?

Thanks!

Link to post
Share on other sites

Run OTL

  • Under the Custom Scans/Fixes box at the bottom, paste in the following
    :OTL
    O1 - Hosts: 209.44.111.57 alarm-security.microsoft.com
    O1 - Hosts: 209.44.111.57 inetantivirus.com
    O1 - Hosts: 209.44.111.57 www.inetantivirus.com
    O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
    O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
    O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1
    O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
    O20 - AppInit_DLLs: (C:\WINDOWS\system32\ylssee.dll) - C:\WINDOWS\system32\ylssee.dll ()
    O20 - Winlogon\Notify\rqRJbbXn: DllName - rqRJbbXn.dll - File not found
    [2008/04/13 18:12:40 | 00,140,836 | -HS- | C] () -- C:\WINDOWS\System32\zvqd.dll
    [2008/04/13 18:12:40 | 00,140,836 | -HS- | C] () -- C:\WINDOWS\System32\yqoklihms.dll
    [2008/04/13 18:12:40 | 00,140,836 | -HS- | C] () -- C:\WINDOWS\System32\ylssee.dll
    [2008/04/13 18:12:40 | 00,140,836 | -HS- | C] () -- C:\WINDOWS\System32\s.dll
    [2008/04/13 18:12:40 | 00,140,836 | -HS- | C] () -- C:\WINDOWS\System32\kjclxovws.dll
    [2008/04/13 18:12:40 | 00,140,836 | -HS- | C] () -- C:\WINDOWS\System32\jbwwet.dll
    [2008/04/13 18:12:40 | 00,140,836 | -HS- | C] () -- C:\WINDOWS\System32\hpc.dll
    [2008/04/13 18:12:40 | 00,140,836 | -HS- | C] () -- C:\WINDOWS\System32\fvz.dll
    [2009/12/27 10:20:00 | 00,000,434 | ---- | M] () -- C:\WINDOWS\Tasks\At1.job



    :Commands
    [emptytemp]


  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot when it is done
  • It will produce a log for you on reboot, please post that log in your next reply.

=================

After reboot re-download combofix renamed then try to run it once more ad let me know if it goes through this time as well.

Post the log if it works.

Link to post
Share on other sites

Run OTL

  • Under the Custom Scans/Fixes box at the bottom, paste in the following
    :OTL
    O1 - Hosts: 209.44.111.57 alarm-security.microsoft.com
    O1 - Hosts: 209.44.111.57 inetantivirus.com
    O1 - Hosts: 209.44.111.57 www.inetantivirus.com
    O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
    O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
    O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1
    O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
    O20 - AppInit_DLLs: (C:\WINDOWS\system32\ylssee.dll) - C:\WINDOWS\system32\ylssee.dll ()
    O20 - Winlogon\Notify\rqRJbbXn: DllName - rqRJbbXn.dll - File not found
    [2008/04/13 18:12:40 | 00,140,836 | -HS- | C] () -- C:\WINDOWS\System32\zvqd.dll
    [2008/04/13 18:12:40 | 00,140,836 | -HS- | C] () -- C:\WINDOWS\System32\yqoklihms.dll
    [2008/04/13 18:12:40 | 00,140,836 | -HS- | C] () -- C:\WINDOWS\System32\ylssee.dll
    [2008/04/13 18:12:40 | 00,140,836 | -HS- | C] () -- C:\WINDOWS\System32\s.dll
    [2008/04/13 18:12:40 | 00,140,836 | -HS- | C] () -- C:\WINDOWS\System32\kjclxovws.dll
    [2008/04/13 18:12:40 | 00,140,836 | -HS- | C] () -- C:\WINDOWS\System32\jbwwet.dll
    [2008/04/13 18:12:40 | 00,140,836 | -HS- | C] () -- C:\WINDOWS\System32\hpc.dll
    [2008/04/13 18:12:40 | 00,140,836 | -HS- | C] () -- C:\WINDOWS\System32\fvz.dll
    [2009/12/27 10:20:00 | 00,000,434 | ---- | M] () -- C:\WINDOWS\Tasks\At1.job



    :Commands
    [emptytemp]


  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot when it is done
  • It will produce a log for you on reboot, please post that log in your next reply.

=================

After reboot re-download combofix renamed then try to run it once more ad let me know if it goes through this time as well.

Post the log if it works.

Not sure why but now I can't run OTL.exe. rundll32.exe error. I'll keep trying. Any suggestions?

Link to post
Share on other sites

Try to rename it to Random.com "Right click on it and choose rename.

Choose rename.com make sure to uncheck hide file extensions for known file types via My Computer Tools Folder Options.

Rename didn't work. I've tried dbl-clicking it from the desktop and from within Explorer. I tried from the "command" prompt. No dice. What is your thought pattern on this issue?

Link to post
Share on other sites

Thought pattern is to get rid of the malware.

*Reboot your computer into SafeMode. You can do this by restarting your computer and continually tapping the F8 key until a menu appears. Use your up arrow key to highlight SafeMode then hit enter.

Then I will need you to show hidden Files \Folders.

To do this:

  • Click Start.
  • Open My Computer.
  • Select the Tools menu and click Folder Options.
  • Select the View Tab.
  • Under the Hidden files and folders heading select Show hidden files and folders.
  • Uncheck the Hide protected operating system files (recommended) option.
  • Click Yes to confirm.
  • Click OK

After that using Windows Explorer (to get there right-click your Start button and go to "Explore")

Delete these folders/files listed below:

C:\WINDOWS\System32\zvqd.dll

C:\WINDOWS\System32\yqoklihms.dll

C:\WINDOWS\System32\ylssee.dll

C:\WINDOWS\System32\s.dll

C:\WINDOWS\System32\kjclxovws.dll

C:\WINDOWS\System32\jbwwet.dll

C:\WINDOWS\System32\hpc.dll

C:\WINDOWS\System32\fvz.dll

C:\WINDOWS\Tasks\At1.job

Now close Windows Explorer.

Now reset your Hidden files\folders to hidden.

To do this:

To reset:

  • Click Start.
  • Open My Computer.
  • Select the Tools menu and click Folder Options.
  • Select the View Tab.
  • Under the Hidden files and folders heading select Do not Show hidden files and folders.
  • Check the Hide protected operating system files (recommended) option.
  • Click Yes to confirm.
  • Click OK

Reboot back into normal Windows ad post a new OTL log or see if it will run.

Link to post
Share on other sites

Thought pattern is to get rid of the malware.

*Reboot your computer into SafeMode. You can do this by restarting your computer and continually tapping the F8 key until a menu appears. Use your up arrow key to highlight SafeMode then hit enter.

Then I will need you to show hidden Files \Folders.

To do this:

  • Click Start.
  • Open My Computer.
  • Select the Tools menu and click Folder Options.
  • Select the View Tab.
  • Under the Hidden files and folders heading select Show hidden files and folders.
  • Uncheck the Hide protected operating system files (recommended) option.
  • Click Yes to confirm.
  • Click OK

After that using Windows Explorer (to get there right-click your Start button and go to "Explore")

Delete these folders/files listed below:

C:\WINDOWS\System32\zvqd.dll

C:\WINDOWS\System32\yqoklihms.dll

C:\WINDOWS\System32\ylssee.dll

C:\WINDOWS\System32\s.dll

C:\WINDOWS\System32\kjclxovws.dll

C:\WINDOWS\System32\jbwwet.dll

C:\WINDOWS\System32\hpc.dll

C:\WINDOWS\System32\fvz.dll

C:\WINDOWS\Tasks\At1.job

Now close Windows Explorer.

Now reset your Hidden files\folders to hidden.

To do this:

To reset:

  • Click Start.
  • Open My Computer.
  • Select the Tools menu and click Folder Options.
  • Select the View Tab.
  • Under the Hidden files and folders heading select Do not Show hidden files and folders.
  • Check the Hide protected operating system files (recommended) option.
  • Click Yes to confirm.
  • Click OK

Reboot back into normal Windows ad post a new OTL log or see if it will run.

I will do this when back at the sick computer.

Thanks!

Link to post
Share on other sites

ok let me know if you are unable to do this.

I was unable to delete C:\Windows\system32\ylsse.dll per your instructions:

Cannot delete ylssee: Access denied

Make sure the disk is not full........currently in use.

Something is using it.

Should I proceed with OTL.exe without having deleted this file?

Link to post
Share on other sites

Yes see if it will run now please.

It did not run.

Here is what's consistent:

- Try to run a program (like OTL)

- rundll32.exe application exception shows. Click OK.

- Phantom screen apprears

- If I look at the running process (with HijackThis, because Task Manager is disabled), the program I tried to run (OTL for example) is listed as well as rundll32.exe. Of course the phantom process is not listed.

Could rundll32.exe have the virus?

Link to post
Share on other sites

Could be but doubtful.

Let's move on shall we.

Download the attached .zip file and save it to your desktop.

Right click on it and choose extract.

Double click on the Start.bat that is inside of the folder.

Once it restarts post the catchme log on the desktop please.

Also let me know if it made a difference.

Link to post
Share on other sites

Could be but doubtful.

Let's move on shall we.

Download the attached .zip file and save it to your desktop.

Right click on it and choose extract.

Double click on the Start.bat that is inside of the folder.

Once it restarts post the catchme log on the desktop please.

Also let me know if it made a difference.

Should Start.bat cause a restart? It did not. The targeted file was deleted. I ran the shutdown line from Start.bat in the Run... dialog. Restart occurred but don't see a file named "catchme" on the desktop or in system32.

Link to post
Share on other sites

Please do this from another computer if you have access to a cd burner and a blank cd.

Go to this page and follow the instructions to create the Dr Web live cd.

http://www.freedrweb.com/livecd/how_it_works/

Boot the infected computer from a cd and run the scan.

Make sure to have it wired connected to the internet so it can update before running the scan.

You update it by clicking the green orb at the top.

Cure or delete the files it finds.

Once that is done reboot into normal windows and see if it still is infected.

Or let me know the current status of the system.

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.