Hello
Got this nasty virus rundll32 that keeps coming back and changes proxy settings in IE so I can't connect to the internet. I deleted the start up entry in msconfig, ran full virus scan and it keeps coming back
please help
thank you
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
Did you run your scans in Safe Mode (F8 at startup)? You may need to do that in order to remove the threat.
If you can download and run HiJackThis please do so. Save the log file and post it here for analysis.
http://www.trendsecure.com
Try this: Launch the MalwareBytes app but don't start the scan yet. Run Process Explorer (the MS/Sysinternals app). Right-click on the the rundll32.exe and winlogon.exe processes and put them into Suspend. Then run the MalwareBytes scan. Stopping rundll32 should allow the program to be cleaned, and stopping winlogon should prevent programs from launching (and thus reinstalling themselves). This also means that you can't click Start > Shutdown after the scan is finished, so you'll have to turn off the computer with the power button.
You also may want to run TCPview (another Sysinternals program) and see what is listening on the port your browsers are set to use as a proxy server. Do a search on the hard drive for that exe file, then boot to to Repair Mode on the CD and that program, maybe the rest of the folder it's in as well.
Business Accounts
Answer for Membership
by: piotrmikula108Posted on 2009-04-10 at 11:37:41ID: 24118012
this is the MalwareBytes log
Malwarebytes' Anti-Malware 1.36
Database version: 1962
Windows 5.1.2600 Service Pack 3
4/10/2009 11:35:31 AM
mbam-log-2009-04-10 (11-35-31).txt
Scan type: Quick Scan
Objects scanned: 95755
Time elapsed: 2 minute(s), 39 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 0
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 0
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWAR
Folders Infected:
(No malicious items detected)
Files Infected:
(No malicious items detected)
will run ComboFix now
I agree, when it takes couple hours to fight with those viruses it's better to reload the OS