Member Avatar for Gilgabob

I had read all the threads regarding this nasty and I have made some progress but now I am stuck.
I have a HP Pavilion 775y desktop, 2 megs ram
I am running windows XP

Earlier today I used system restore by using command.com which allowed me to access the internet and my icons reappeared but I still cannot run anything. Upon booting I get an error that Rundll32.exe was not found. Nothing loads into my tray either.

I don't know what to try at this point.

  • 3 Contributors
  • 10 Replies
  • 198 Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by PhilliePhan

Dani AI

Generated

The symptoms reported by — desktop icons returning after System Restore but executables failing to run and an error about rundll32.exe — are typical of the “police”/rogue-AV families that both hijack EXE handling and sometimes install kernel-level components. That combination makes in-place cleaning unpredictable: some helpers and tools will run, others will be blocked or rendered ineffective. The first objective is preservation of personal data; the second is to remove the infection from a clean environment.

A pragmatic, low-risk workflow that avoids re-executing the infected OS is: try Safe Mode to see whether basic scanners will run; if executables are still blocked, use a clean bootable environment (Linux live USB or an AV vendor rescue disk) to copy documents, mail stores and browser profiles to external media — do not copy .exe, .dll or installer files. Scan those saved files on a known-clean machine before reuse. Offline rescue media run before Windows and are often able to find and remove rootkit components that an in‑OS scanner cannot.

Regarding the suggestions in the thread: ’s renaming trick is a legitimate, commonly used workaround for broken EXE associations and can allow some scanners to execute; is correct to point out that rootkit components make removal harder and that powerful tools (ComboFix and the like) should be used only with experienced guidance. Diagnostic text logs from low-level tools are very helpful for targeted advice, since they let analysts see what’s actually hooking the system rather than guessing.

If reliable removal cannot be confirmed, a full reformat and reinstall is the surest cure. Before destructive steps, image the drive or at least back up personal data. Avoid restoring system files from the infected system, keep product keys and installers on separate media, and, where uncertainty remains, consider professional imaging/forensic assistance to preserve data while removing the threat.

Recommended Answers

All 10 Replies

Member Avatar for Bleachy32

Get the malwarebytes anti malware program, then rename it with a .com ext instead of exe. Then it will run, do a scan and it will get rid of all the messed up registry stuff thats causing redirects.

If that does not work, do the same ext rename with Hijackthis program. Good luck, this one really pissed me off.

Member Avatar for Gilgabob

In the Malwarebyte folder there is an application named mbam. If I R-click that ap then select properties, under the program tab there is a MSDOS logo with a box next to it that currently has mbam.exe in it. Below that, after Cmd line is another box with the command line which ends in mbam.exe. Is this what needs to be changed?

Member Avatar for Bleachy32

In the Malwarebyte folder there is an application named mbam. If I R-click that ap then select properties, under the program tab there is a MSDOS logo with a box next to it that currently has mbam.exe in it. Below that, after Cmd line is another box with the command line which ends in mbam.exe. Is this what needs to be changed?

. Ijust r clicked and changed it on desktop with rename

Member Avatar for Gilgabob

Renaming it in that way had no effect for me. Same problem - I get the Open With box. Anyone else have ideas? I'm desperate.

Member Avatar for Gilgabob

I'm off to work, will check back tomorrow.

Member Avatar for PhilliePhan

Renaming it in that way had no effect for me. Same problem - I get the Open With box. Anyone else have ideas? I'm desperate.

First, Rename mbam.exe to zappa.com
See if it will run.
If so, please have it remove all that it finds and post the log for us.


If it does not run, you can try the following, but it is strictly a "Run At Your Own Risk!" proposition:

* Download and EXTRACT the KILLBAD folder to your C:\ Drive
* Use START > RUN >Command.com to get a command prompt

* TYPE C:\KILLBAD\KILLBAD.bat ENTER

* If the tool is able to run, a log should eventually pop up in notepad.
Please post that for us.

Then, try running MBA-M again.

Best Luck :)
PP

Member Avatar for PhilliePhan

New linky for KILLBAD.zip

You might be able to run it by navigating to C:\KILLBAD\KILLBAD.bat and DoubleClicking the .bat file - that ought to work.

PP :)

Member Avatar for PhilliePhan

Here's hoping you can get this to run....

As it turns out, this infection is major nasty! My simple little batch ain't gonna do it, lol!
Looks like there are some serious rootkit components to this and our best bet would be to get combofix to run. Generally, when I see baddies such as this, I advise a reformat because of the nature of the rootkit beast.
However, if you'd like to give cleaning this a shot, we can try to get combofix to run.
To do that, we'll need to take a different tack.

If you'd like to continue, please do the following:

Please Download Win32kDiag and save it to your Desktop.

• http://ad13.geekstogo.com/Win32kDiag.exe
• http://download.bleepingcomputer.com/rootrepeal/Win32kDiag.exe

-- DoubleClick on Win32kDiag.exe to run it. Let it run for as long as it needs to.
-- When it says Finished – Press any key to exit, do that to exit the program.
-- You should now have a Win32kDiag.txt on your Desktop. Please post the entire log for me and we’ll go from there.

I will check back as soon as time permits.

Cheers :)
PP

Member Avatar for Gilgabob

I tried everything up to your last suggestion to no avail.
I downloaded win32diag but because it's an .exe I cannot run it.

Member Avatar for PhilliePhan

I tried everything up to your last suggestion to no avail.
I downloaded win32diag but because it's an .exe I cannot run it.

Can your rename it to and try that?

PP :)

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.