dvk01 Posted April 5, 2008 ID:15676 Share Posted April 5, 2008 looks like a big mistake herehttp://forums.techguy.org/malware-removal-...tml#post5758049it appears from the log that MBAM deleted rundll32.exe did it Link to post Share on other sites More sharing options...
Staff nosirrah Posted April 5, 2008 Staff ID:15685 Share Posted April 5, 2008 Can someone please attach a copy of Vista rundll32.exe please .I only have XP set up here and need to confirm that this is the actual problem .The lack of a path in the detection from that log makes it seem like it could also be an application glitch .rundll32.exe (Trojan.Agent) -> Delete on reboot. Link to post Share on other sites More sharing options...
Staff nosirrah Posted April 5, 2008 Staff ID:15686 Share Posted April 5, 2008 O4 - HKCU\..\Run: [bM0d0bece4] Rundll32.exe "C:\Users\user\AppData\Local\Temp\netcowfe.dll",sThis should have been detected by current defs but was not , bet there is a glitch when dealing with rundll32.exe .I am removing this family of defs for now . Link to post Share on other sites More sharing options...
dvk01 Posted April 5, 2008 Author ID:15709 Share Posted April 5, 2008 vista version from my computer attachedrundll32.ziprundll32.zip Link to post Share on other sites More sharing options...
Staff nosirrah Posted April 5, 2008 Staff ID:15711 Share Posted April 5, 2008 Thanks for he sample , confirmed that this is not a defs side fp .Marcin is working on this . Link to post Share on other sites More sharing options...
suuzzee Posted May 20, 2008 ID:18492 Share Posted May 20, 2008 Could someone please share a copy of rundll32.exe for XP Home Edition? Have read all the posts on the rundll32.exe topic and am certain that malwarebytes removed it. I'm currently completely locked out of all Control Panel functions. TIA! Link to post Share on other sites More sharing options...
Root Admin RubbeR DuckY Posted May 20, 2008 Root Admin ID:18493 Share Posted May 20, 2008 Can you please click on the Quarantine tab. Select rundll32.exe and click Restore.Once you get it restored, please run a quick scan and post the results so we can see what it gets detected as. Link to post Share on other sites More sharing options...
Staff nosirrah Posted May 20, 2008 Staff ID:18497 Share Posted May 20, 2008 C:\WINDOWS\system32\dllcacheShould be a copy in here as well . Link to post Share on other sites More sharing options...
myrtille Posted May 29, 2008 ID:19050 Share Posted May 29, 2008 Once you get it restored, please run a quick scan and post the results so we can see what it gets detected as.Hi,I had a case, where the rundll32.exe was deleted on a vista machine a couple of days ago with the following MBAM version:Malwarebytes' Anti-Malware 1.12Datenbank Version: 790it still seems to get detected as trojan.agent:rundll32.exe (Trojan.Agent) -> Delete on reboot.C:\Users\Alex\AppData\Local\Temp\qdyldqtt.dll (Trojan.Vundo) -> Delete on reboot.rundll32.exe deletedgreets myrtille Link to post Share on other sites More sharing options...
Staff nosirrah Posted May 29, 2008 Staff ID:19051 Share Posted May 29, 2008 We are working on the fix for this .I am hoping that todays app update will handle this . Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now