Defense Center problems, open with, rundll32.exe not found

llennnn16 · June 28, 2010

Im trying to fix a work computer with valuable files. It's been infected with the Defense Center trojan. I tried using Malwarebytes, and it took some stuff out but now not much opens.

When i want to open malwarebytes, the computer asks me what do i want to open the program with, i get redirected to other sites while web browsing, some programs won't run because it says that rundll32.exe is missing, task manager is locked and i can't access regedit from run

I can't even run hijack this because it tells me i need to open it with a program

Maniac · June 29, 2010

Hello llennnn16! Welcome to Malwarebytes' Anti-Malware Forums!

My name is Borislav and I will be glad to help you solve your problems with malware. Before we begin, please note the following:

The process of cleaning your system may take some time, so please be patient.
Follow my instructions step by step if there is a problem somewhere, stop and tell me.
Stay with the topic until I tell you that your system is clean. Missing symptoms does not mean that everything is okay.
Instructions that I give are for your system only!
If you don't know or can't understand something please ask.
Do not install or uninstall any software or hardware, while work on.
Keep me informed about any changes.

Please follow these instructions:

http://forums.malwarebytes.org/index.php?showtopic=54634

Let me know how are things.

llennnn16 · June 29, 2010

(Sorry for all those posts, that's just prove there's still something wrong. i clicked like 8 times and the page did not move. I even tried to email this to myself so i could post from my phone but even the yahoo button wouldn't budge. Really would be good if there was an edit button for the posts here)

Well i have been able to get rid of most of the problem, but i had to use another program, because Malwarebytes would not run or let me install a fresh copy, even in safe mode, it kept telling me that rundll32.exe was not found and then when the malware recognized the file, it told me that it needed to open with something.

Problems that seem to still be present are: Malwarebytes blocking anything to do with google.com or google-related sites just not loading, I keep getting redirected to spam sites or spam sites just open on a new tab, and Java is acting up, some players won't load, and some buttons just don't work, i click them and nothing happens.

I have been able to run Hijack This! now, here's the log:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 11:30:29 AM, on 6/29/2010

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.17055)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\RTHDCPL.EXE

C:\WINDOWS\system32\igfxtray.exe

C:\WINDOWS\system32\hkcmd.exe

C:\WINDOWS\system32\igfxpers.exe

C:\Program Files\TouchKit\xTouchMon.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe

C:\WINDOWS\system32\igfxsrvc.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Messenger\msmsgs.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files\Symantec\pcAnywhere\awhost32.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\WINDOWS\system32\EpStsSrv.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local

O1 - Hosts: 89.149.193.137 www.google.com

O1 - Hosts: 89.149.193.137 us.search.yahoo.com

O1 - Hosts: 89.149.193.137 uk.search.yahoo.com

O1 - Hosts: 89.149.193.137 search.yahoo.com

O1 - Hosts: 89.149.193.137 www.google.com.br

O1 - Hosts: 89.149.193.137 www.google.it

O1 - Hosts: 89.149.193.137 www.google.es

O1 - Hosts: 89.149.193.137 www.google.co.jp

O1 - Hosts: 89.149.193.137 www.google.com.mx

O1 - Hosts: 89.149.193.137 www.google.ca

O1 - Hosts: 89.149.193.137 www.google.com.au

O1 - Hosts: 89.149.193.137 www.google.nl

O1 - Hosts: 89.149.193.137 www.google.co.za

O1 - Hosts: 89.149.193.137 www.google.be

O1 - Hosts: 89.149.193.137 www.google.gr

O1 - Hosts: 89.149.193.137 www.google.at

O1 - Hosts: 89.149.193.137 www.google.se

O1 - Hosts: 89.149.193.137 www.google.ch

O1 - Hosts: 89.149.193.137 www.google.pt

O1 - Hosts: 89.149.193.137 www.google.dk

O1 - Hosts: 89.149.193.137 www.google.fi

O1 - Hosts: 89.149.193.137 www.google.ie

O1 - Hosts: 89.149.193.137 www.google.no

O1 - Hosts: 89.149.193.137 www.google.de

O1 - Hosts: 89.149.193.137 www.google.fr

O1 - Hosts: 89.149.193.137 www.google.co.uk

O1 - Hosts: 89.149.193.137 www.bing.com

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O4 - HKLM\..\Run: [igfxTray] C:\WINDOWS\system32\igfxtray.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe

O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe

O4 - HKLM\..\Run: [xTouchMon] C:\Program Files\TouchKit\xTouchMon.exe

O4 - HKLM\..\Run: [ClearTKHandle] C:\Program Files\TouchKit\ClearTKHandle.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [Vnukopa] rundll32.exe "C:\WINDOWS\ujisejadaza.dll",Startup

O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray

O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (rootkit-scan)] "C:\Program Files\Malwarebytes' A

Maniac · June 30, 2010

It's not the entire log file from HiJackThis. What about DDS log? GMER log?

llennnn16 · July 1, 2010

It's not the entire log file from HiJackThis. What about DDS log? GMER log?

Sorry but the button for reply just wouldn't budge. For some reason it loaded like 5 replies with only half the log. If it happens again, it's not me its the computer, i did put the entire Hijack This log.

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 11:01:23 AM, on 7/1/2010