RUNDLL window at startup: access denied

Question

Hello everyone and thank you to all who are willing to read (and help?) me!

This is my first time posting on a forum; generally, I try to manage as best as I can with the information I find in existing posts and responses, but now I'm stuck... So if someone could kindly take a look at my issue and lend a hand...

I have had a problem recently on Windows (XP Media Center Edition, Service Pack 2) that I don't know the severity of: every time Windows starts, a "RUNDLL" window opens with the following message:

"Error loading C:\WINDOWS\system32\j1271731.dll
Access denied"

The first time, I clicked OK, but afterward the workstation wouldn't open. So I rebooted, I didn't click OK (on the RUNDLL window), but a "NT Authority System" window opened, informing me that the system had to shut down because there was a problem with C:\WINDOWS\system32\services.exe, and it rebooted on its own. I don't know if it's related, but I'm mentioning it just in case.
Anyway, since then, every time I start up, I click OK on the RUNDLL error message, and then my Windows works normally (at least apparently).
Is this serious? Should I try to delete the file directly, does it really serve any purpose?
I looked in the forums and understood that viruses like to hang around system32, could this be due to a virus?
Last remark (could this be related?): the error message first appeared when I returned to Windows after modifying some settings on my Linux Ubuntu to be able to write on NTFS disks (since then I have reverted it back to how it was before on Linux, but that hasn't fixed the problem).

Configuration: Windows XP Firefox 2.0.0.4

Séb08 · Answer

Hi,

C:\WINDOWS\system32\j1271731.dll

unknown dll ... it might be a malware.

Scan it with this:

http://www.virustotal.com/en/virustotalx.html

click on "browse", search for the file in question and then click on "send".

Copy and paste the generated report for me.

See you+

--
Everything's good in the wild boar!
*****Have a good day*****

Biloukou · Answer

Thank you for responding so quickly!
I tried to scan it as you instructed, but I encountered a problem: I can't find the file when I browse and go to windows\system32!!

However, when I run msconfig, it appears in the startup tab with its box checked... The command corresponding to it is "rundll32 C:\WINDOWS\system32\j1271731.dll sook".
Where does the "sook" come from after the file extension? Is there something I missed?

Thank you in advance

Biloukou · Answer

Hello again!
Just a little clarification, in fact it has changed, now at startup in the window it no longer says "access denied" but "the specified module could not be found," which may explain why I couldn't find it when I wanted to scan it! Is this maybe a good sign?
Do I just need to remove it from startup in msconfig now? (If that's what needs to be done, I don't know how to do it!)
Thank you again

Séb08 · Answer

Yes, uncheck it in msconfig.

Make sure to follow the instructions in bold for both installations.

==================================

Download and install this software:

* AVG AS

AVG anti spyware
avg antispyware
Update it before running the scan.
Tutorial:
http://www.kachouri.com/tuto/tuto-161-avg-anti-spyware-75-pour-votre-securite.html

-> Relaunch AVG AS -> "Scan" -> "Settings"

Under the question "How to respond?":

-> click on "Recommended Actions" and choose "Quarantine"
-> Click on the "Scan" tab again and perform a "Full System Scan"

If a file is infected at the end of the scan

-> Click on "Apply all actions"

-> Click on "Save report" and then on "Save report as".

-> Save this text file on your desktop and then paste the report here

Then:

download HijackThis (French version) here:
hijackthis

Unzip it in a designated folder.

For example C:\hijackthis < Make sure to save it in c: !

Demo (thanks to Balltrap):
installation hijackthis
http://perso.orange.fr/rginformatique/section%20virus/Hijenr.gif

Run it then:
click on "perform a scan and save the log" (see demo)
copy and paste the entire log onto the forum

Demo: (thanks to balltrap34 for this realization)
http://perso.orange.fr/rginformatique/section%20virus/demohijack.htm

see you+

--
All is good in the wild boar!
*****Have a good day*****

Biloukou · Answer

Here is the translation you requested:

So here it is for vundofix:  VundoFix V6.5.0  Checking Java version...  Java version is 1.5.0.6 Old versions of java are exploitable and should be removed.  Scan started at 18:33:41 18/06/2007  Listing files found while scanning....  C:\windows\system32\abadd.ini C:\windows\system32\awtstur.dll C:\windows\system32\bbmfguxi.dll C:\windows\system32\ddaba.dll C:\windows\system32\ddcbcax.dll C:\windows\system32\hggeccc.dll C:\windows\system32\krbwxvea.dll C:\WINDOWS\system32\pxdhtklg.dll C:\WINDOWS\system32\qomjkii.dll C:\windows\system32\ssqnnoo.dll C:\WINDOWS\system32\ssttu.dll C:\windows\system32\uttss.bak1 C:\windows\system32\uttss.bak2 C:\windows\system32\uttss.ini  Beginning removal...   Attempting to delete C:\windows\system32\abadd.ini C:\windows\system32\abadd.ini Has been deleted!   Attempting to delete C:\windows\system32\awtstur.dll C:\windows\system32\awtstur.dll Has been deleted!   Attempting to delete C:\windows\system32\bbmfguxi.dll C:\windows\system32\bbmfguxi.dll Has been deleted!   Attempting to delete C:\windows\system32\ddaba.dll C:\windows\system32\ddaba.dll Has been deleted!   Attempting to delete C:\windows\system32\ddcbcax.dll C:\windows\system32\ddcbcax.dll Has been deleted!   Attempting to delete C:\windows\system32\hggeccc.dll C:\windows\system32\hggeccc.dll Has been deleted!   Attempting to delete C:\windows\system32\krbwxvea.dll C:\windows\system32\krbwxvea.dll Has been deleted!   Attempting to delete C:\WINDOWS\system32\pxdhtklg.dll C:\WINDOWS\system32\pxdhtklg.dll Has been deleted!   Attempting to delete C:\WINDOWS\system32\qomjkii.dll C:\WINDOWS\system32\qomjkii.dll Has been deleted!   Attempting to delete C:\windows\system32\ssqnnoo.dll C:\windows\system32\ssqnnoo.dll Has been deleted!   Attempting to delete C:\WINDOWS\system32\ssttu.dll C:\WINDOWS\system32\ssttu.dll Has been deleted!   Attempting to delete C:\windows\system32\uttss.bak1 C:\windows\system32\uttss.bak1 Has been deleted!   Attempting to delete C:\windows\system32\uttss.bak2 C:\windows\system32\uttss.bak2 Has been deleted!   Attempting to delete C:\windows\system32\uttss.ini C:\windows\system32\uttss.ini Has been deleted!  Performing Repairs to the registry. Done!  And the new hijack log:  Logfile of Trend Micro HijackThis v2.0.0 (BETA) Scan saved at 18:40:29, on 18/06/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) Boot mode: Normal  Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\ehome\ehtray.exe C:\WINDOWS\RTHDCPL.EXE C:\WINDOWS\arservice.exe C:\Program Files\HP DigitalMedia Archive\DMAScheduler.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\WINDOWS\eHome\ehRecvr.exe C:\Program Files\HP\HP Software Update\HPwuSchd2.exe C:\Program Files\QuickTime\qttask.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\WINDOWS\eHome\ehSched.exe C:\WINDOWS\System32\FTRTSVC.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Documents and Settings\All Users\Application Data\jmrotsvu.exe C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe C:\PROGRA~1\Wanadoo\TaskBarIcon.exe C:\Program Files\Controle Parental\bin\optproxy.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\Program Files\Messenger\msmsgs.exe C:\PROGRA~1\Wanadoo\GestionnaireInternet.exe C:\PROGRA~1\Wanadoo\ComComp.exe C:\Program Files\OpenOffice.org 2.0\program\soffice.exe C:\PROGRA~1\Wanadoo\Toaster.exe C:\PROGRA~1\Wanadoo\Inactivity.exe C:\PROGRA~1\Wanadoo\PollingModule.exe C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE C:\Program Files\OpenOffice.org 2.0\program\soffice.BIN C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\system32\dllhost.exe C:\WINDOWS\eHome\ehmsas.exe C:\PROGRA~1\Wanadoo\Watch.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\wuauclt.exe C:\HP\KBD\KBD.EXE C:\WINDOWS\system32\wuauclt.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe c:\windows\system\hpsysdrv.exe C:\Documents and Settings\HP_Administrateur\Bureau\HiJackThis_v2.exe  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr?cobrand=hp-desktop.msn.com&ocid=HPDHP&pc=HPDTDF R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://fr.search.yahoo.com/?fr=cb-hp06 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://fr.search.yahoo.com/?fr=cb-hp06 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://fr.search.yahoo.com/?fr=cb-hp06 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr?cobrand=hp-desktop.msn.com&ocid=HPDHP&pc=HPDTDF R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://fr.search.yahoo.com/?fr=cb-hp06 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = https://fr.search.yahoo.com/?fr=cb-hp06 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://fr.search.yahoo.com/?fr=cb-hp06 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr?cobrand=hp-desktop.msn.com&ocid=HPDHP&pc=HPDTDF R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = https://fr.search.yahoo.com/?fr=cb-hp06 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://sims/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Orange R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {2294D1B7-845F-4C63-B288-77C67D38A7FE} - C:\WINDOWS\system32\ssttu.dll (file missing) O2 - BHO: (no name) - {5ADF3862-9E2E-4ad3-86F7-4510E6550CD0} - C:\WINDOWS\system32\dnqwrtpg.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O2 - BHO: (no name) - {D936B8F1-6B6E-4AB3-80E1-6EFF09FD096f} - C:\WINDOWS\system32\krbwxvea.dll (file missing) O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe O4 - HKLM\..\Run: [ftutil2] rundll32.exe ftutil2.dll,SetWriteCacheMode O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [AlwaysReady Power Message APP] ARPWRMSG.EXE O4 - HKLM\..\Run: [DMAScheduler] "c:\Program Files\HP DigitalMedia Archive\DMAScheduler.exe" O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPwuSchd2.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [jmrotsvu.exe] C:\Documents and Settings\All Users\Application Data\jmrotsvu.exe O4 - HKLM\..\Run: [SC2] C:\WINDOWS\system32\scchk32.exe O4 - HKLM\..\Run: [GPLv3] rundll32.exe "C:\WINDOWS\system32\qrgrkxdk.dll",realset O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKCU\..\Run: [WOOKIT] C:\Program Files\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_5 O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU') O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user') O4 - .DEFAULT User Startup: PinMcLnk.lnk = C:\hp\bin\cloaker.exe (User 'Default user') O4 - Startup: OpenOffice.org 2.0.lnk = C:\Program Files\OpenOffice.org 2.0\program\quickstart.exe O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: Help with connection - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm O9 - Extra 'Tools' menuitem: Help with connection - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU) O20 - Winlogon Notify: winjvd32 - winjvd32.dll (file missing) O22 - SharedTaskScheduler: Pre-loader Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll O22 - SharedTaskScheduler: Component category cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: Logical Disk Manager Administration Service (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe O23 - Service: Media Center Scheduler Service (ehSched) - Unknown owner - C:\WINDOWS\eHome\ehSched.exe O23 - Service: Event Log (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe O23 - Service: Fax - Unknown owner - C:\WINDOWS\system32\fxssvc.exe O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: Imapi Helper - Alex Feinman - C:\Program Files\Alex Feinman\ISO Recorder\ImapiHelper.exe O23 - Service: IMAPI CD-Burning COM Service (ImapiService) - Unknown owner - C:\WINDOWS\system32\imapi.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe O23 - Service: NetMeeting Remote Desktop Sharing (mnmsrvc) - Unknown owner - C:\WINDOWS\system32\mnmsrvc.exe O23 - Service: Parental Control (OPTENET_FILTER) - Parental Control - C:\Program Files\Controle Parental\bin\optproxy.exe O23 - Service: Plug and Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe O23 - Service: Remote Desktop Help Session Manager (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe O23 - Service: Smart Card (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe O23 - Service: Performance Logs and Alerts (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe O23 - Service: Volume Shadow Copy (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe O23 - Service: WMI Performance Adapter (WmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\wmiapsrv.exe  -- End of file - 11387 bytes  thank you @ see you soon (but how the hell did you know it was Vundo? At the same time, I didn't have the patience to read the log entirely, it might have been written in plain letters in it?)

Séb08 · Answer

ok well you can throw Vundofix.

Restart Hijack, choose "do a scan only" or "scanner seulement" check these lines:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/...
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/...
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/...
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/...
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/...
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/...
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/...
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/...
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/...
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.redirect.hp.com/...

O2 - BHO: (no name) - {2294D1B7-845F-4C63-B288-77C67D38A7FE} - C:\WINDOWS\system32\ssttu.dll (file missing)
O2 - BHO: (no name) - {5ADF3862-9E2E-4ad3-86F7-4510E6550CD0} - C:\WINDOWS\system32\dnqwrtpg.dll
O2 - BHO: (no name) - {D936B8F1-6B6E-4AB3-80E1-6EFF09FD096f} - C:\WINDOWS\system32\krbwxvea.dll (file missing)

O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [ftutil2] rundll32.exe ftutil2.dll,SetWriteCacheMode
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [AlwaysReady Power Message APP] ARPWRMSG.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [jmrotsvu.exe] C:\Documents and Settings\All Users\Application Data\jmrotsvu.exe
O4 - HKLM\..\Run: [GPLv3] rundll32.exe "C:\WINDOWS\system32\qrgrkxdk.dll",realset
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

O20 - Winlogon Notify: winjvd32 - winjvd32.dll (file missing)

O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe

Close all active windows other than HijackThis!, including the browser, then click "Fix checked" or "fix object". Close HijackThis!

==================
Stop this service

France Telecom Routing Table Service

to do this, follow these steps:

Start -> run type services.msc double click on the mentioned service -> and in "startup type" set it to "disabled" and in service status, set it to "stopped".

==================

Show all files and folders…

Click on start -> control panel (in classic view) -> folder options -> "view" tab

* [Check] "show hidden files and folders"

* [Uncheck] "Hide protected operating system files (recommended)"

* [Uncheck] "hide extensions for known file types"

Then [apply] to apply the changes.

And [Ok]

==============

search and delete these bold files (if present):

C:\WINDOWS\System32\FTRTSVC.exe
C:\WINDOWS\system32\qrgrkxdk.dll
C:\Documents and Settings\All Users\Application Data\jmrotsvu.exe
C:\WINDOWS\system32\dnqwrtpg.dll

Empty your recycle bin, restart your PC.

==============

Can you scan this file:

C:\WINDOWS\system32\scchk32.exe

With this:

http://www.virustotal.com/en/virustotalx.html

click on "browse" to locate the file in question and then click on "send".

Copy and paste the generated report to me.

See you+

--
Everything is good in the wild boar!
*****Have a good day*****

Biloukou · Answer

Hello boss

Here is the report from virustotal:

Antivirus Version Update Result
AhnLab-V3 2007.6.16.0 06.19.2007 no virus found
AntiVir 7.4.0.32 06.18.2007 TR/Crypt.XPACK.Gen
Authentium 4.93.8 06.18.2007 no virus found
Avast 4.7.997.0 06.18.2007 no virus found
AVG 7.5.0.467 06.18.2007 no virus found
BitDefender 7.2 06.19.2007 no virus found
CAT-QuickHeal 9.00 06.18.2007 (Suspicious) - DNAScan
ClamAV devel-20070416 06.19.2007 Trojan.Dropper-638
DrWeb 4.33 06.19.2007 no virus found
eSafe 7.0.15.0 06.19.2007 Suspicious Trojan/Worm
eTrust-Vet 30.7.3727 06.19.2007 no virus found
Ewido 4.0 06.18.2007 no virus found
FileAdvisor 1 06.19.2007 no virus found
Fortinet 2.91.0.0 06.19.2007 no virus found
F-Prot 4.3.2.48 06.18.2007 no virus found
F-Secure 6.70.13030.0 06.19.2007 no virus found
Ikarus T3.1.1.8 06.19.2007 Trojan.Win32.Obfuscated.ev
Kaspersky 4.0.2.24 06.19.2007 no virus found
McAfee 5055 06.18.2007 no virus found
Microsoft 1.2607 06.19.2007 no virus found
NOD32v2 2337 06.18.2007 no virus found
Norman 5.80.02 06.18.2007 no virus found
Panda 9.0.0.4 06.19.2007 no virus found
Prevx1 V2 06.19.2007 no virus found
Sophos 4.18.0 06.12.2007 no virus found
Sunbelt 2.2.907.0 06.16.2007 VIPRE.Suspicious
Symantec 10 06.19.2007 no virus found
TheHacker 6.1.6.134 06.18.2007 no virus found
VBA32 3.12.0.2 06.19.2007 no virus found
VirusBuster 4.3.23:9 06.18.2007 no virus found
Webwasher-Gateway 6.0.1 06.19.2007 Trojan.Crypt.XPACK.Gen

Additional Information
File size: 286720 bytes
MD5: a8112ce86fd09dba8e13fd32cef5c421
SHA1: a006a628de97b94d6a6654f1a381f26f69d341bd
Sunbelt info: VIPRE.Suspicious is a generic detection for potential threats that are deemed suspicious through heuristics.

I couldn't delete C:\WINDOWS\system32\qrgrkxdk.dll, it told me access denied, check that the disk is not full or write-protected.

I looked into what vundo was, and indeed the annoying pop-ups from doctorPC and others were really bothering me, but I didn't know it was a virus! However, what I don't understand is that as soon as I had internet access, I downloaded Mozilla, and I removed Internet Explorer! Yet there were still Internet Explorer windows opening with an IP number and a 404 error.

Thanks, see you soon.

Séb08 · Answer

ok

Download: Pocket Killbox here
http://www.downloads.subratam.org/KillBox.exe

Usage demo (thanks to Balltrap34 for this achievement) ::
http://perso.orange.fr/rginformatique/section%20virus/killbox.htm

1-Double-click on KillBox.exe
2- Select "Delete on Reboot"
3 - In "Full Path of File to Delete"

copy and paste:

C:\WINDOWS\system32\qrgrkxdk.dll

do the same with this file

C:\WINDOWS\system32\scchk32.exe

4- click on the red circle
5- a window will pop up for confirmation click on YES
6- a second window asks if you want to restart click on YES

the PC will restart

If you get a message: "pending file rename operations registry data has been removed by external process.", ignore it, and restart your PC manually

And run a hijack log.

see you +

--
Everything is good in the wild boar!
*****Have a good day*****

Biloukou · Answer

Hi
The specified module message is missing again (C:\WINDOWS\system32\j1271731.dll). It hadn't appeared since I unchecked it at startup. Should I "fix" it with hijack, and will that be the end of it?
Anyway, here is the log after performing the actions mentioned in your previous post and restarting:

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 22:39:55, on 21/06/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\HP DigitalMedia Archive\DMAScheduler.exe
C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe
C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\arservice.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\OpenOffice.org 2.0\program\soffice.exe
C:\Program Files\OpenOffice.org 2.0\program\soffice.BIN
C:\PROGRA~1\Wanadoo\GestionnaireInternet.exe
C:\PROGRA~1\Wanadoo\ComComp.exe
C:\PROGRA~1\Wanadoo\Toaster.exe
C:\PROGRA~1\Wanadoo\Inactivity.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\dllhost.exe
C:\PROGRA~1\Wanadoo\Watch.exe
C:\Documents and Settings\HP_Administrateur\Bureau\HiJackThis_v2.exe
C:\WINDOWS\system32\wuauclt.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://sims/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Orange
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [DMAScheduler] "c:\Program Files\HP DigitalMedia Archive\DMAScheduler.exe"
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [j1271731] rundll32 C:\WINDOWS\system32\j1271731.dll sook
O4 - HKCU\..\Run: [WOOKIT] C:\Program Files\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')
O4 - .DEFAULT User Startup: PinMcLnk.lnk = C:\hp\bin\cloaker.exe (User 'Default user')
O4 - Startup: OpenOffice.org 2.0.lnk = C:\Program Files\OpenOffice.org 2.0\program\quickstart.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O22 - SharedTaskScheduler: Pré-chargeur Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Démon de cache des catégories de composant - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: Service de planification Media Center (ehSched) - Unknown owner - C:\WINDOWS\eHome\ehSched.exe
O23 - Service: Journal des événements (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Fax - Unknown owner - C:\WINDOWS\system32\fxssvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Imapi Helper - Alex Feinman - C:\Program Files\Alex Feinman\ISO Recorder\ImapiHelper.exe
O23 - Service: Service COM de gravage de CD IMAPI (ImapiService) - Unknown owner - C:\WINDOWS\system32\imapi.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: Partage de Bureau à distance NetMeeting (mnmsrvc) - Unknown owner - C:\WINDOWS\system32\mnmsrvc.exe
O23 - Service: Plug-and-Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Gestionnaire de session d'aide sur le Bureau à distance (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe
O23 - Service: Carte à puce (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: Journaux et alertes de performance (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe
O23 - Service: Cliché instantané de volume (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe
O23 - Service: Carte de performance WMI (WmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\wmiapsrv.exe

--
End of file - 7877 bytes

@see you soon

cokotte · Answer

Hello, I always get the following message when I start my computer: Rundll loading error c:/windows/system32/gzmrt.dll and it says access denied.   I would like to fix this problem, thank you.

Criouss · Answer

Hello!

I also have this problem with "Rundll Access denied" BUT! the only issue is that it says
"Problem starting NVCPL.DLL
Access denied."

I've been searching online and I keep coming across this same type of topic "Error loading C:\WINDOWS\system32\j1271731.dll
Access denied."

So I'm a bit lost :/

It started when I updated my graphics card to play Battlefield 1

My graphics card is an NVIDIA GeForce GTX 780

Also, I'm on Windows 10 so could that be it?

Hoping to find a solution :)
Thank you and have a great rest of the day!
Criouss

RUNDLL window at startup: access denied

11 réponses

Texture issues in enshrouded

Canon mb5350 - cartridge replacement impossible

Command prompt disabled by admin...

Zoom blocked canon digital ixus 750

Vd-tech (sub-brand of which brand???)

Issue with my kodak easyshare device!

Échec du disque flexible (40)

Football manager (club management game)

Select next line csh foreach

Win32 kamso then rootkit detection