PCTech Forums

I ran hijack and fixed the mentioned items. I also went to the website you recommended and scanned for the files for the w32/ticton-A virus. I did not find the two files mentioned in the article. The wucrtupd.exe was still present in the hijack log. I ran cwshredder and it found several things and i allowed it to fix them. I ran hijack again after reboot, i did not notice
the wucrtupd.exe present this time. Would this indicate that the virus is not present now. attached is new hijack log

Logfile of HijackThis v1.97.7
Scan saved at 9:14:12 AM, on 27/04/04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAM FILES\GRISOFT\AVG6\AVGSERV9.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\LOADQM.EXE
C:\PROGRAM FILES\GRISOFT\AVG6\AVGCC32.EXE
C:\WINDOWS\RunDLL.exe
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\DOWNLOADS\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.thunderstar.net/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Thunderstar Communications
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\GRISOFT\AVG6\avgcc32.exe /STARTUP
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [Avgserv9.exe] C:\PROGRA~1\GRISOFT\AVG6\Avgserv9.exe
O4 - HKCU\..\Run: [Taskbar Display Controls] RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY
O9 - Extra button: ICQ (HKLM)
O9 - Extra 'Tools' menuitem: ICQ (HKLM)
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shoc ... wflash.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shoc ... tor/sw.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://fdl.msn.com/public/chat/msnchat45.cab
O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} (Yahoo! Audio UI1) - http://chat.yahoo.com/cab/yacsui.cab
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com/i/ ... acscom.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/C ... 7279861111
O16 - DPF: {A031D222-B496-11D2-9CC8-00105A10AAF6} (WONWebLauncher Class) - http://www.flipside.com/cab/WONWebLauncherControl.cab
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://riverbelle.microgaming.com/rive ... lashAX.cab
O16 - DPF: {E13F1132-4CA0-4005-84D3-51406E27D269} (BTDownloadCtrl Control) - http://www.shockwave.com/content/thinkt ... adCtrl.cab

Thankyou for your help , it is truely appreciated

You folks are getting me confused. First, on Rundll please see what
Microsoft says at: http://support.microsoft.com/default.as ... bContent=1

Does not imply spyware necessarily to me.

Second as my computer had the file wucrtupd.exe and it had requested internet access thru my firewall, as well as the rundll file, I updated my Anti-Virus definitions, did a virus scan with no problem concerning virus or trojan horses. Then to back it up and be sure, I spent over 3 hours doing an on line virus and security scan and no problems were detected there either.

So what is up with the concern over these two files?

Joatman

You are confused because the file liljim told you to delete is in fact added to the system as a result of the LOXOSCAM virus that is a backdoor Trojan that allows a hacker to gain access to the computer. The application is written in the Delphi programming language.

The file you were reading about is rundll32.exe which is a legit app:

rundll32 - rundll32.exe - Process Information
Process File: rundll32 or rundll32.exe
Process Name: Rundll32
Description: Microsoft "Run a DLL as an App". RUNDLL32 is the Microsoft Windows program that loads DLLs into memory so that they can be used by specific programs or by Windows.
Company: Microsoft Corp.
System Process: Yes
Security Risk ( Virus/Trojan/Worm/Adware/Spyware ): No
Common Errors: N/A

So I would follow what liljim is telling you.

NOTE: wucrtupd.exe Windows Update Critical Update Notification. This will appear in your Task List if you did a Windows Update at some stage and installed the "Critical Update Notification" component.

Cactus

The confusion grows!!!!! If that file (rundll) is a trojan file, then why didn't the Virus/Trojan scans pick it up?
Also why does Microsoft say:
"Rundll vs. Rundll32
Rundll loads and runs 16-bit DLLs, whereas Rundll32 loads and runs 32-bit DLLs. If you pass the wrong type of DLL to Rundll or Rundll32, it may fail to run without indicating any error messages.
The above copied and pasted from:
http://support.microsoft.com/default.as ... bContent=1

I remain suspicious of the statement that rundll is a trojan. Could be just that the site that states that was the first one that pops up on a search as it was when I searched, whereas the Microsoft site was #3 or 4 that popped up. AND THE VIRUS/TROJAN SCAN BOTH ON LINE AND BY MY SYSTEM DID NOT DETECT IT!!!!

The date it entered my computer is the exact same date that rundll32 did which supports there being loaded by Windows. Or at least they have the same date.

Microsoft also states the following also copied and pasted from the site referenced above:
MIcrosoft Windows NT 4.0, Windows 2000, and Windows XP ship with only Rundll32. There is no support for Rundll (the Win16 utility) on either platform.

The Rundll and Rundll32 utility programs were originally designed only for internal use at Microsoft. But the functionality provided by them is sufficiently generic that they are now available for general use. Note that Windows NT 4.0 ships only with the Rundll32 utility program and supports only Rundll32

I know that wucrtvpd is the windows update routine but fail to understand the revelance to the subject at hand unless some do not believe in the windows update ????

Thanks for you help and input.

Joatman

Thanks, Cactus.

I hate to become a 'royal pain' or any kind of a pain, for that matter,
but are you sure I can delete the rundll file even though I'm running Win98SE?

My old computer is running so smoothly, I just hate to chance introducing any problem.

Joatman

If it's not causing any problems leave it.

I thought I would try to find a better explanation of these files.
Rundll.exe

Rundll32.exe

(Microsoft)
Microsoft’s “Run a DLL as an App”. A DLL is a Dynamic Link Library. In layman and [very] simplistic terms a DLL is a portion of a software program which is only used by the main program as and when specific features of the software are used by the end user (for instance the PRINT function in your wordprocessor). The main advantage is that, using this technique, programmers can develop software which does not end up gobbling up memory through the whole program loading in one go, but which instead only uses enough memory for the core functions of the program, with specific features, implemented in separate DLL files, only loaded as and when the end-user decides to use them (ie. The Print DLL will only be loaded into memory when the end-user clicks on PRINT). Another advantage is that the software developers can also have common features which they have implemented across a range of their programs, implemented just the one time as a shared DLL which is used by all that developer’s programs. RUNDLL and RUNDLL32 are the Microsoft Windows programs that need to be used to load DLLs into memory so that they can be used by specific programs or by Windows.

Recommendation :
First, note that RUNDLL.EXE only exists in Windows 95/98/ME, it does not exist in Windows 2000/XP/2003 – its path is C:\Windows\Rundll.exe . RUNDLL and RUNDLL32 do not normally appear in the Task List in Windows. In my experience they tend to appear only when you are already having problems of some sort with your PC, or a particular DLL is either misbehaving, is buggy, or is having problems, such as a Control Panel applet hanging for example. If you see RUNDLL or RUNDLL32 in your Task List persistently then you should be [slightly] worried (see below the other entry for RUNDLL32) – make sure you have good and up‑to‑date antivirus software, boot into Safe Mode, and run a full virus scan on your PC. If you do not have a virus and see either in your Task List, simply leave it alone. I am not sure as to the other times when the real RUNDLL or RUNDLL32 can sometimes suddenly appear in the Task List, but you should leave them alone in most cases provided, again, that you know you do not have a virus.

--------------------------------------------------------------------------------


Rundll.exe

(???)

If you have Windows 2000/XP/2003 and this is running, then you most definitely have a virus. If you have Windows 95/98/ME and the full path to the program, as shown on the Tasks tab of The Ultimate Troubleshooter, is not C:\WINDOWS\RUNDLL.exe , then you also have a virus such as the PWSteal.Banpaes.D virus.

-------------------------------------------------------------------------------


Rundll32.exe

(???)

You have one of the W32.Miroot.Worm / W32/Legemer.Worm / W32.HLLW.Sanker viruses (or another virus).

I hope this helps explains what these files are and what they do.

Cactus

Thanks for taking the time to post the full explanation. I appreciate it and I imagine others do as well. I've pasted it to another document and saved it for future reference.

Joatman