Rundll32.exe

Hello this is the first time i am posting something here so please correct me if i have made any mistakes

Bitdefender is showing me a "Potentially malicious process detected" in the active virus control section.

In the event details its shows the path like "....\SysWOW64\rundll32.exe

Blocked.

I don't get any option to delete, quarantine or repair nothing except "Allow and monitor".

This thing has been getting detected a number of times! And since the time it has started being detected my Computer start up has slowed down and my Firefox hangs for 5 minutes at least once since i start the computer. Also my windows file explorer hangs a lot and takes ages to get back to normal use!

Can someone please help?

Would really appreciate some help

Thank you.

Find more posts tagged with

Comments

rootkit

Hello

In order to be able to further investigate the reported situation we need a bit more information from your computer as follows:

. A BDSYS log;

[how to GENERATE A BDSYS LOG]

. Save and extract the BDSYS tool to a location of your choice:

http://www.bitdefender.com/files/Knowledge.../BDSysLog_i.exe

. Make sure you close all active applications and then run "BDSysLog_i.exe"; If you receive a firewall

alert,select to Allow the application to connect;

. Click the "Create log" button to start generating the

log; A progress bar is indicating that the tool is creating the report;

. When the small window appears with the message "Log

saved" then the report is complete and a new file named "bdsyslog.zip" has appeared on your Desktop;

. Upload that file on

http://www.sendspace.com

http://www.mediafire.com

and send me a PM with the download link.

If you were already asked to generate the log file, disregard the message above and just post the ticket ID.

IMPORTANT:

.During this process the Real Time Protection in Bitdefender must be temporarily disabled;

.If you receive a Bitdefender Firewall alert to inform you that BDSysLog_i.exe tries to connect to the internet,then you need to select Allow;

[how to DISABLE THE ANTIVIRUS PROTECTION in Bitdefender 2012]

In order to disable the antivirus protection, please open Bitdefender and click the "Settings" button in the upper side part of the interface"; In the new window go to "Antivirus" > "Shield" tab and click on "ON" under On-access scanning. Select the time interval that suites your troubleshooting needs and click "OK". The On-access scanning should be enabled back after finishing the troubleshooting procedure.

[how to DISABLE THE ANTIVIRUS PROTECTION in Bitdefender 2013]

We will get back to you as soon as the analysis is complete.

Have a nice day.

rootkit

Thank you for reporting this.

I've sent your request to our lab. I'll keep you up to date.

Have a nice day.

Mr. Muffins

Ok thank you

Thanks a lot for helping so promptly

rootkit

Hello

Please use the following tool to remove the infection:

http://forum.bitdefender.com/index.php?showtopic=26540

Thank you!

Mr. Muffins

Hello again

I tried using that tool but whenever i open it it says "Status: Initialization Error".

I have read how to use the tool and am going by the guidelines... i disabled the real time protection, ran it as administrator and yes it is on the same HDD.

Hoping am not bothering you too much or am not doing something wrong >.<

rootkit

Hello

Have you tried to use it in Safe Mode?

http://www.bitdefender.com/support/How-do-...-Mode-1022.html

Thank you!

Mr. Muffins

Still the same.

Tried it in safemode, safemode with networking but still it says "Initialization Error"

Thank you

rootkit

Hello

Please run a scan with Bitdefender and let me know if something is discovered.

Thank you!

Mr. Muffins

Ran a full system scan and nothing was found but still i keep getting rundll.exe in avtive virsu control panel. Still cant run that tool tried in all the safemodes and all.

Thank you

rootkit

Hello

Recreate a BDSYS log and send it via PM.

http://forum.bitdefender.com/index.php?sho...st&p=166130

Merry Christmas!

Mr. Muffins

Done

Happy Christmas to you too and a happy new year in advance

rootkit

Hello

I have sent the logs to our labs and I will get back to you with the results.

Take care.

Mr. Muffins

Ok. Thanks a lot!

rootkit

Hello

We discovered malware in your PC.

You will have to fix the MBR using this method:

http://windows7themes.net/how-to-fix-mbr-in-windows-7.html

After this, please boot in Safe Mode and delete the following file:

C:\Users\Ajinkya\AppData\Local\Temp\Rpcqt.dll

. Restart the computer in Safe Mode With Networking;

[How to restart in SAFE MODE]

- Restart the computer;

- Press the "F8" key several times before Microsoft Windows begins to load; you need to press "F8" until you will be displayed a text menu;

- Select "SAFE MODE"

If the situation persists or you require further assistance please do not hesitate to contact us.

Have a great day!

Mr. Muffins

Since i think the last two days or something i have been getting this error at startup.

"There was a problem starting

C:\Users\Ajinkya\AppData\Local\Temp\Rpcqt.dll

The specified module cannot be found."

It so happens that you gave me the same file to delete and I was about to post this error over here but in that time you reverted and asked me to fix the mbr and all.

Anywho i still did the mbr fix the way it was asked and all. But when i went into safemode to delete the file

1. I couldn't find the folder "AppData" from the above path. No worries i opened it through run and went to the folder to find that file.

2. There is no file with that name - "Rpcqt.dll" in the Temp folder so naturally couldn't delete it.

I restarted my computer and all and am still getting the above error of not finding that module.

Also Bitdefender has not stopped but does not report the Run32.dll virus in the active virus control tab as frequently as it used to.

Hope all this helps to remove this annoying malware, cause i don't know maybe its because of that or something else but my startup is very slow, my computer suddenly freezes for a few seconds and whenever i open firefox browser or start menu at startup it just freezes and everything is extremely slow! i can't even shut down properly when this happens.

Hope this helps

Thanks for helping

rootkit

Hello

Download and install this software and then run it to clean your computer's registry and temporary files:

http://download.piriform.com/ccsetup326.exe

http://www.piriform.com/docs/ccleaner/usin...gistry-cleaning

Once the cleaning is complete it's recommended to restart your computer.

If you have a registry cleaner already installed, you can use that one.

This should make disable that warning from Startup.

As for those warnings, we are still investigating.

Take care.

Mr. Muffins

Hello

Well before i could do what you had suggested my computer refused to start up getting stuck at starting windows. After trying in safe mode, repair computer, boot up with last know good configuration and trying to do a system restore it seemed that my computer was heading towards the gallows. Thankfully i tried starting it again and miraculously it started! But when it started it was so slow so slow that just opening My Computer took about 43 minutes (Yes i used a stopwatch). Well anywho through a trouble some night in which i had to just transfer 15GB of files to the other drive where windows wasn't installed which btw took like about say 3 hours i was finally able to install windows again.

Now i don't know why all the above said took place...maybe it was the malware which was detected or maybe my laptop is now just trash.

So anyways i have just installed bitdefender again and will run a full system scan soon. If i find anything i will let you know

Thank you

rootkit

Hello

Is everything working properly now? The initial situation is still reproducing?

Should you need any further assistance, please do not hesitate to contact us.

Have a great day!