Remove-Malware.com

Archive | Post Malware Cleanup RSS feed for this section

Muliple RunDLL32.exe’s in Task Manager? That Dern Conficker…

I ran up against a little issue in a small 10 person office that sorta stumped me for a few hours. At random times during the day client pc’s would spawn dozens of rundll32.exe processes and effectively render the pc useless (it sucked up all the ram).

The cause?

These boxes were infected with Conficker at one point which created dozens of scheduled tasks. These scheduled tasks spawn all those RunDll32.exe’s. I simply deleted the tasks and have not seen a recurrence of all those RunDll32.exe processes.

Also, sorry I haven’t posted much this week, I had a nasty flu.

No Internet after Virus Removal – Ndis.sys

I remove malware everyday from PC’s and whenever I see a trend I’ll usually write about it. This post is about the infection of the Ndis.sys drive (a Windows file which is a component of the Windows networking software). As many of you know I usually use bootable media to remove malware. Since I’m in a bootable environment I’m able to remove ANY infected file on the hard drive (filesystem). As you may have guessed, this can be really dangerous.

Why?

Infected system files in the Windows folder can be easily deleted thus making the Windows OS unbootable or in the case of this example “un-networkable”. So, if you’ve just removed malware with a bootable removal tool and all your network adapters have ! symbols (explanation marks) then you’re probably missing the ndis.sys file (or it’s corrupted).

To replace your Ndis.sys with a non-infected one you have a few options:

Copy one from a non infected PC (make sure the OS’s match – do a winver).
Copy one (expand) from the OS disc.
Type copy “C:\WINDOWS\ServicePackFiles\i386\ndis.sys” “C:\WINDOWS\system32\drivers\ndis.sys”.
Reboot. After you reboot your networking functionality should be restored.