1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

This is interesting!

Discussion in 'Virus & Other Malware Removal' started by TOWER OF POWER, Sep 8, 2002.

Thread Status:
Not open for further replies.
Advertisement
  1. TOWER OF POWER

    TOWER OF POWER Thread Starter

    Joined:
    Mar 14, 2002
    Messages:
    54
    While opening my Internet Explorer 6.0 Each time I move about from page to page , Zone Alarm pops up and ask a request to send a Rundll 32.exe file. To me this doesn├Ęt seem right, can someone explain what is happening. Is this a trojan.
     
  2. Rollin' Rog

    Rollin' Rog

    Joined:
    Dec 9, 2000
    Messages:
    45,855
    It would be a trojan if the spelling is not exactly: rundll32.exe (verifying that those are Ls and not anything that looks like them.

    ZoneAlarm will tell you what IP the process is trying to connect to and sometimes that can be helpful in determining what is happening.

    Naturally you should run an updated antivirus scan, but we can also have a good look at what is running if you post the results of the StartupList program available here:

    http://www.lurkhere.com/~nicefiles/index.html

    My bet is we will see the process trying to connect to your ISPs Domain Name Servers. I think that is what we've seen before, but I don't recall any answers as to why.
     
  3. TOWER OF POWER

    TOWER OF POWER Thread Starter

    Joined:
    Mar 14, 2002
    Messages:
    54
    Thanks for the help, sorry for the delay, here is the list.

    Running processes:

    C:\WINDOWS\SYSTEM\KERNEL32.DLL
    C:\WINDOWS\SYSTEM\MSGSRV32.EXE
    C:\WINDOWS\SYSTEM\MPREXE.EXE
    C:\WINDOWS\SYSTEM\mmtask.tsk
    C:\PROGRAM FILES\GRISOFT\AVG6\AVGSERV9.EXE
    C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE
    C:\WINDOWS\EXPLORER.EXE
    C:\PROGRAM FILES\GRISOFT\AVG6\AVGCC32.EXE
    C:\PROGRAM FILES\PANICWARE\POP-UP STOPPER\DPPS2.EXE
    C:\WINDOWS\SYSTEM\HOOKSYS.EXE
    C:\PROGRAM FILES\ZONE LABS\ZONEALARM\ZONEALARM.EXE
    C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\DISTILLR\ACROTRAY.EXE
    C:\WINDOWS\SYSTEM\DDHELP.EXE
    C:\WINDOWS\SYSTEM\PSTORES.EXE
    C:\WINDOWS\SYSTEM\SPOOL32.EXE
    C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
    C:\UNZIPPED\STARTUPLIST\STARTUPLIST.EXE

    --------------------------------------------------

    Listing of startup folders:

    Shell folders Startup:
    [C:\WINDOWS\Start Menu\Programs\StartUp]
    PhotoWise QuickLink.lnk = C:\Program Files\PhotoWise\quicklnk.exe
    Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe

    Shell folders Common Startup:
    [C:\WINDOWS\All Users\Start Menu\Programs\StartUp]
    ZoneAlarm.lnk = C:\Program Files\Zone Labs\ZoneAlarm\zonealarm.exe

    --------------------------------------------------

    Autorun entries from Registry:
    HKLM\Software\Microsoft\Windows\CurrentVersion\Run

    AVG_CC = C:\PROGRAM FILES\GRISOFT\AVG6\avgcc32.exe /startup
    Pop-Up Stopper = "C:\PROGRAM FILES\PANICWARE\POP-UP STOPPER\DPPS2.EXE"
    HookSys = HookSys.exe

    --------------------------------------------------

    Autorun entries from Registry:
    HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce

    SpyBotSnD = C:\UNZIPPED\SPYBOTSD10.NIASWISS\SPYBOT - SEARCH & DESTROY 1.0\SPYBOTSD.EXE

    --------------------------------------------------

    Autorun entries from Registry:
    HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

    Avgserv9.exe = C:\PROGRA~1\GRISOFT\AVG6\Avgserv9.exe
    TrueVector = C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE -service

    --------------------------------------------------

    Autorun entries from Registry:
    HKCU\Software\Microsoft\Windows\CurrentVersion\Run

    MSMSGS = "C:\PROGRAM FILES\MESSENGER\MSMSGS.EXE" /background

    --------------------------------------------------

    File association entry for .EXE:
    HKEY_CLASSES_ROOT\exefile\shell\open\command

    (Default) = "%1" %*

    --------------------------------------------------

    File association entry for .COM:
    HKEY_CLASSES_ROOT\comfile\shell\open\command

    (Default) = "%1" %*

    --------------------------------------------------

    File association entry for .BAT:
    HKEY_CLASSES_ROOT\batfile\shell\open\command

    (Default) = "%1" %*

    --------------------------------------------------

    File association entry for .PIF:
    HKEY_CLASSES_ROOT\piffile\shell\open\command

    (Default) = "%1" %*

    --------------------------------------------------

    File association entry for .SCR:
    HKEY_CLASSES_ROOT\scrfile\shell\open\command

    (Default) = "%1" /S

    --------------------------------------------------

    Enumerating Active Setup stub paths:
    HKLM\Software\Microsoft\Active Setup\Installed Components

    [{89820200-ECBD-11cf-8B85-00AA005B4383}]
    StubPath = rundll32.exe advpack.dll,UserInstStubWrapper {89820200-ECBD-11cf-8B85-00AA005B4383}

    [>PerUser_MSN_Clean]
    StubPath = C:\WINDOWS\msnmgsr1.exe

    [PerUser_LinkBar_URLs]
    StubPath = C:\WINDOWS\COMMAND\sulfnbk.exe /L

    [{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
    StubPath = "C:\Program Files\OUTLOO~1\setup50.exe" /APP:OE /CALLER:WIN9X /user /install

    [{7790769C-0471-11d2-AF11-00C04FA35D02}]
    StubPath = "C:\Program Files\OUTLOO~1\setup50.exe" /APP:WAB /CALLER:WIN9X /user /install

    [{9EF0045A-CDD9-438e-95E6-02B9AFEC8E11}]
    StubPath = C:\WINDOWS\SYSTEM\updcrl.exe -e -u C:\WINDOWS\SYSTEM\verisignpub1.crl

    [{44BBA840-CC51-11CF-AAFA-00AA00B6015C}.Restore]
    StubPath = rundll32.exe advpack.dll,UserUnInstStubWrapper {44BBA840-CC51-11CF-AAFA-00AA00B6015C}

    --------------------------------------------------

    Shell key & screensaver key from C:\WINDOWS\SYSTEM.INI:

    Shell=Explorer.exe
    SCRNSAVE.EXE=

    --------------------------------------------------

    C:\WINDOWS\WININIT.BAK listing:

    [rename]
    C:\PROGRA~1\COMMON~1\MSIETS\MSIELINK.DLL=C:\PROGRA~1\COMMON~1\MSIETS\TEMP\MSIELINK.DLL

    --------------------------------------------------

    Checking for EXPLORER.EXE instances:

    C:\WINDOWS\Explorer.exe: PRESENT!

    C:\Explorer.exe: not present
    C:\WINDOWS\Explorer\Explorer.exe: not present
    C:\WINDOWS\System\Explorer.exe: not present
    C:\WINDOWS\Command\Explorer.exe: not present

    --------------------------------------------------

    C:\AUTOEXEC.BAT listing:

    @C:\PROGRA~1\GRISOFT\AVG6\bootup.exe
    SET SOUND=C:\PROGRA~1\CREATIVE\CTSND
    SET MIDI=SYNTH:1 MAP:E MODE:0
    SET BLASTER=A220 I5 D1 H5 P330 E620 T6
    SET PATH=%PATH%;C:\WINDOWS\Twain_32\Scanwiz;C:\WINDOWS\Twain\Scanwiz;C:\PROGRA~1\GRISOFT\AVG6
    mode con codepage prepare=((850) C:\WINDOWS\COMMAND\ega.cpi)
    mode con codepage select=850
    keyb cf,,C:\WINDOWS\COMMAND\keybrd2.sys

    --------------------------------------------------

    C:\WINDOWS\DOSSTART.BAT listing:

    C:\WINDOWS\CTCM
    C:\WINDOWS\COMMAND\MSCDEX /D:MSCD001 /M:8

    --------------------------------------------------

    Checking for superhidden extensions:

    .lnk: HIDDEN!
    .pif: HIDDEN!
    .exe: not hidden
    .com: not hidden
    .bat: not hidden
    .hta: not hidden
    .scr: not hidden
    .shs: HIDDEN!
    .vbs: not hidden
    .vbe: not hidden
    .wsh: not hidden

    --------------------------------------------------
    End of report, 6158 bytes

    StartupList version: 1.23.0
    Started from: C:\UNZIPPED\STARTUPLIST

    Command line options:
    /verbose - to add additional info on each section
    /complete - to include empty sections and unsuspicious data
    /force9x - to include Win9x-only startups even if running on WinNT
    /forcent - to include WinNT-only startups even if running on Win9x
    /forceall - to include all Win9x and WinNT startups, regardless of platform
    /history - to list version history only
     
  4. Rollin' Rog

    Rollin' Rog

    Joined:
    Dec 9, 2000
    Messages:
    45,855
    Do you have something called SurfinGuard Pro installed?

    That's the only association I can find for HookSys = HookSys.exe

    It's a good bet that is what is sending rundll32.exe to ZA. You might try Unchecking in msconfig > Startups to test.
     
As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/94797

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice