Internet Protection - rundll

[lsjimenez]

This is happening to me on a machine running Windows XP Professional SP3. I am getting one of these phony anti-virus pop-ups everytime we open a browser window. I've run Malwarebytes fully updated and it came up with no results. I'm currently running VipreRescue (current version); it has yet to finish. The anti-virus is called Internet Protection. When i open the task manager the process running is rundll32. I haven't deleted this file due to the fact that it might be the system file.

I've also used Malwarebytes removal tool and removed the contents of the etc folder (C:\WINDOWS\system32\drivers\etc) and replaced them with the contents from the same folder from a working computer. Same result.

Any suggestions???

 

[Crush]

Hi,

First:

Please download and run RKill.

Download mirror 1 - Download mirror 2 - Download mirror 3

• Save it to your Desktop.
• Double click the RKill desktop icon.
• It will quickly run and launch a log. If it does not launch a log, try another download link until it does.
• Please post its log in your next reply.
• After it has run successfully, delete RKill.

Note: This tool only kills the active infection, the actual infection will not be gone. Once you reboot the infection will be active again! Please do not reboot until instructed further to do so.

====
Next, download OTL.exe by OldTimer to your Desktop.

• Close all windows and double click OTL.exe.
• Click Run Scan and let the program run uninterrupted.
• It will produce two logs for you, one will pop up - OTL.txt, the other will be saved on your Desktop - Extras.txt. Post both logs in this thread.
• You may need to use two posts to get it all.

 

[Shootist]

Look here for removal instructions.
Remove Internet Protection (Uninstall Guide)

And here.
(Solved) - HELP!! It's called "Internet Protection" : fake anti-virus pop-up « How-To Geek Forums