Solved Very high RAM usage Rundll32.exe

[Razor505]

When I looked at task manager, it shows Rundll32.exe at 1,075,576 K of memory, I traced it back into SysWOW64. I ran a scan in cmd, to check for mem errors, nothing is wrong. What is causing this?:huh:

 

[VistaKing]

When you traced it back did it say what file inside Syswow64 ?

 

[Razor505]

When you traced it back did it say what file inside Syswow64 ?

It was just in the syswow64 folder.

 

[VistaKing]

Upload the file to www.virustotal.com and link the results with your reply .

 

[Razor505]

https://www.virustotal.com/en/file/...3d95f8620c48102f1eba4124/analysis/1375141005/
Here it is, no virus' detected.

 

[VistaKing]

Click here DDS

:ar: Click on Download Now button

:ar: When the download is complete . Drag the DDS program from the Downloads folder to your Desktop

:ar: Double click the DDS icon on the Desktop then click the Run button to run the tool.

:ar: Place a check next to attach.txt and click Start . When done, DDS will open two logs

• DDS.txt
• Attach.txt

:ar: Save two logs onto your desktop and upload them with your reply

Do not zip the Attach.txt file .

 

[Razor505]

View attachment Attach.txtView attachment DDS.txt
Here they are.

 

[VistaKing]

I think I found your issue

uRun: [ConduitFloatingPlugin_mmlkabjddkpgkgfhdhpimhcbonapngoh] "C:\Windows\SysWOW64\Rundll32.exe" "C:\Program Files (x86)\Conduit\CT3227981\plugins\TBVerifier.dll",RunConduitFloatingPlugin mmlkabjddkpgkgfhdhpimhcbonapngoh

Run the two tools below

AdwCleaner

Click here AdwCleaner

:ar: Click on Download Now button

:ar: Save to the Desktop

:ar: Right-click on AdwCleaner.exe and choose

:ar: Click on Delete and confirm the prompt.

:ar: Your computer will be rebooted automatically. A text file will open after the restart.

Upload the log : The log file is at C:\AdwCleaner[Sn].txt

Then run JRT

Download Junkware Removal Toolkit

Click here Junkware Removal Tool to download

Drag the JRT.exe from the Downloads folder to your Desktop

Right click JRT.exe and choose

Once done upload the JRT.txt file



To Remove AdwCleaner program from your PC

:ar: Right click on adwcleaner.exe choose Run as administrator to run the tool.

:ar: Click on Uninstall, then confirm with yes to remove this utility from your computer.

 

[Razor505]

View attachment AdwCleaner[S1].txt
Adware Cleaner ^

 

[Razor505]

View attachment JRT.txt

 

[VistaKing]

How's the PC ?

Run ESET Online Scanner

On

Hold down Control and click on ESET Online Scanner to open ESET OnlineScan in a new window
Click the

button
Check YES, I accept the Terms of Use.
Click the Start button.
Accept any security warnings from your browser.
Under scan settings, check "Scan Archives" and "Remove found threats"
Click Advanced settings and select the following:
° Scan potentially unwanted applications
° Scan for potentially unsafe applications
° Enable Anti-Stealth technology
ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
When the scan completes, click List Threats
Click Export, and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
Click the Back button.
Click the Finish button.

On

or

Click on esetsmartinstaller_enu.exe to download the ESET Smart Installer. Save it to your desktop.
Right click on

choose

on your desktop
Check YES, I accept the Terms of Use.
Click the Start button.
Accept any security warnings from your browser.
Under scan settings, check "Scan Archives" and "Remove found threats"
Click Advanced settings and select the following:
° Scan potentially unwanted applications
° Scan for potentially unsafe applications
° Enable Anti-Stealth technology
ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
When the scan completes, click List Threats
Click Export, and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
Click the Back button.
Click the Finish button.

 

[Razor505]

While ESET is scanning can you recommend me a good zip file opener, as the Adsremover removed jZip.

 

[VistaKing]

Windows 7 has a built-in zip file opener or you could also use 7zip

7zip Download link :ar: http://downloads.sourceforge.net/sevenzip/7z920-x64.msi

 

[Razor505]

View attachment ESETScan.txt
It revealed only 4 infected files.

 

[VistaKing]

Run

Malwarebytes

Download Link :ar: MalwareBytes

When the installation is done uncheck Enable free trial of Malwarebytes (see image below )

Update the definitions and do a full scan

:ar: On the Scanner tab:
Make sure the "Perform Full Scan" option is selected.
Then click on the Scan button.
:ar: If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
:ar: The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
:ar: When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
:ar: Click OK to close the message box and continue with the removal process.
:ar: Back at the main Scanner screen, click on the Show Results button to see a list of any malware that was found.
:ar: Make sure that everything is checked, and click Remove Selected.
:ar: When removal is completed, a log report will open in Notepad.
:ar: The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
:ar: Copy and paste the contents of that report in your next reply and exit MBAM.

Log Location : C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\Logs

   Note

ProgramData is a hidden folder

 

[Razor505]

Malwarebytes Anti-Malware 1.75.0.1300
Malwarebytes : Free anti-malware download

Database version: v2013.07.29.07

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 10.0.9200.16635
Razor :: RAZOR-PC [administrator]

29/07/2013 6:56:42 PM
mbam-log-2013-07-29 (18-56-42).txt

Scan type: Full scan (C:\|)
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 353560
Time elapsed: 12 minute(s), 29 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 4
C:\Users\Razor\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MW5LKK47\SoftonicDownloader_for_mcafee-internet-security-suite.exe (PUP.Optional.Softonic) -> Quarantined and deleted successfully.
C:\Users\Razor\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SXFVTCV8\appbario7[1].exe (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully.
C:\Users\Razor\AppData\Local\Temp\ToolbarHelper.exe (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully.
C:\Users\Razor\AppData\Local\Temp\ct3227981\ieLogic.exe (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully.

(end)

 

[VistaKing]

Lets clean some temp files

TFC

Download TFC below

Download link :ar: http://oldtimer.geekstogo.com/TFC.exe

Drag the TFC.exe from your Downloads folder to the Desktop

Right click on TFC.exe and choose

Click on the Start button

When its finished it will ask you to restart your PC if it doesn't restart manually .

   Tip

Make sure all of the windows are closed

   Note

TFC will empty your Recycle Bin

 

[Razor505]

After cleaning the temps using TFC I got BSOD, there was no description or error codes.

 

[VistaKing]

Can you upload the dmp file

 

[Razor505]

Can you upload the dmp file

Where would the dmp file be located?