Problema ad avvio computer con rundll32.exe

[Enrico88]

Ragazzi, ho biogno d'aiuto...

Il mio pc era infetto! Ho installato NOD32 e mi ha rilevato dei virus che mi ha cancellato! Solo che ora quando avvio il pc mi compare il seguente messaggio di errore:

RUNDLL
Errore durante il caricamento di dll32
Impossibile trovare il modulo specificato

Ho notato che se mentre è presente il messaggio vado nel Task Manager il processo rundll32.exe è presente, mentre quando chiudo il messaggio scompare!

Qualcuno ha idea di come fare per risolvere il problema?

Siccome ho un pc assemblato e non ho il cd di windows xp ne ho preso un altro in prestito, l'ho inserito e ho provato a digitare da esegui: expand D:\i386\rundll32.ex_ c:\windows\system32\rundll32.exe
Si apre una finestra stile DOS ch poi si chiude... Non so se il riprisino sia andato a buon fine... Sta di fatto che quando riavvio il pc l'errore riappare!

Altre notazioni: Ho notato che a volte, sia quando avevo NOD32, sia ora che ho Avira Antivirus, non si carica bene e devo avviarlo manualmente!

Inoltre il pc a volte si riavvia da solo, non so se sia dovuto a questo!

Grazie a tutti coloro che mi aiuteranno!

[Enrico88]

Nessuno sa aiutarmi?

[AMIGASYSTEM]

Non hai ripulito bene il PC,succede che NOD32 scopre i virus,però non può cancellarli,perchè sono in uso,quindi dovresti andare nel percorso indicato da NOD32 e cancellare manualmente,naturalmente usando alcune procedure per poterlo fare,visto che Win non li molla perchè in uso,perchè protetti.
Allora per prima cosa devi scoprire file nascosti e protetti da sistema da Opzione cartella,fatto questo devi installare Unlocker che ti aiuta a cancella o rinaminare i file (così potranno essere cancellati tranquillamente dopo un riavvio),disattivare il ripristino configurazione di sistema,altrimenti ti conservi pure i virus.
Anche lo spostamento del file infetto su desktop è una buona tecnica per cancellare il file,naturalmente dopo un riavvio,questo perchè i file se rinominati o spostati non saranno caricati da windows in avvio perchè non trovati.
Poi ti consiglio di pulire e disinfettare il registro rispettivamente con CCleaner e Malwarebytes,ti consiglio di rimettere NOD32,questi devono essere aggiornati prima dell'uso,altrimenti le ultime infezioni non saranno riconosciute.

[xcdegasp]

disinstalla nod32 e impostando correttamente Avira fai una scansione completa, pubblica il report di tale scansione
nod32 comunque è corrotto e andava reinstallato, visto che hai già installato avira, sfruttiamo prima quest'ultimo visto che l'infezione è nata per una non individuazione di nod32

nod32 lo possiedi con regolare licenza comprata?

[Enrico88]

Ecco la prima scansione fatta da Antivir appena installato:

Avira AntiVir Personal
Report file date: sabato 28 marzo 2009  17:17

Scanning for 1328914 virus strains and unwanted programs.

Licensee        : Avira AntiVir Personal - FREE Antivirus
Serial number   : 0000149996-ADJIE-0000001
Platform        : Windows XP
Windows version : (Service Pack 2)  [5.1.2600]
Boot mode       : Normally booted
Username        : SYSTEM
Computer name   : BOLLATO-9BEFBAD

Version information:
BUILD.DAT       : 9.0.0.387     17962 Bytes  24/03/2009 11:04:00
AVSCAN.EXE      : 9.0.3.3      464641 Bytes  24/02/2009 11:13:26
AVSCAN.DLL      : 9.0.3.0       40705 Bytes  27/02/2009 09:58:24
LUKE.DLL        : 9.0.3.2      209665 Bytes  20/02/2009 10:35:49
LUKERES.DLL     : 9.0.2.0       12033 Bytes  27/02/2009 09:58:52
ANTIVIR0.VDF    : 7.1.0.0    15603712 Bytes  27/10/2008 11:30:36
ANTIVIR1.VDF    : 7.1.2.12    3336192 Bytes  11/02/2009 19:33:26
ANTIVIR2.VDF    : 7.1.2.199   1008640 Bytes  22/03/2009 15:37:04
ANTIVIR3.VDF    : 7.1.2.228    257024 Bytes  27/03/2009 15:37:05
Engineversion   : 8.2.0.129
AEVDF.DLL       : 8.1.1.0      106868 Bytes  27/01/2009 16:36:42
AESCRIPT.DLL    : 8.1.1.70     369019 Bytes  28/03/2009 15:37:08
AESCN.DLL       : 8.1.1.8      127346 Bytes  28/03/2009 15:37:08
AERDL.DLL       : 8.1.1.3      438645 Bytes  29/10/2008 17:24:41
AEPACK.DLL      : 8.1.3.11     397687 Bytes  28/03/2009 15:37:08
AEOFFICE.DLL    : 8.1.0.36     196987 Bytes  26/02/2009 19:01:56
AEHEUR.DLL      : 8.1.0.111   1679736 Bytes  28/03/2009 15:37:07
AEHELP.DLL      : 8.1.2.2      119158 Bytes  26/02/2009 19:01:56
AEGEN.DLL       : 8.1.1.31     340341 Bytes  28/03/2009 15:37:05
AEEMU.DLL       : 8.1.0.9      393588 Bytes  09/10/2008 13:32:40
AECORE.DLL      : 8.1.6.6      176501 Bytes  17/02/2009 13:22:44
AEBB.DLL        : 8.1.0.3       53618 Bytes  09/10/2008 13:32:40
AVWINLL.DLL     : 9.0.0.3       18177 Bytes  12/12/2008 07:47:59
AVPREF.DLL      : 9.0.0.1       43777 Bytes  05/12/2008 09:32:15
AVREP.DLL       : 8.0.0.3      155905 Bytes  20/01/2009 13:34:28
AVREG.DLL       : 9.0.0.0       36609 Bytes  05/12/2008 09:32:09
AVARKT.DLL      : 9.0.0.1      292609 Bytes  09/02/2009 06:52:24
AVEVTLOG.DLL    : 9.0.0.7      167169 Bytes  30/01/2009 09:37:08
SQLITE3.DLL     : 3.6.1.0      326401 Bytes  28/01/2009 14:03:49
SMTPLIB.DLL     : 9.2.0.25      28417 Bytes  02/02/2009 07:21:33
NETNT.DLL       : 9.0.0.0       11521 Bytes  05/12/2008 09:32:10
RCIMAGE.DLL     : 9.0.0.21    2438401 Bytes  09/02/2009 10:45:45
RCTEXT.DLL      : 9.0.35.0      87297 Bytes  11/03/2009 14:55:12

Configuration settings for the scan:
Jobname.............................: Complete system scan
Configuration file..................: c:\programmi\avira\antivir desktop\sysscan.avp
Logging.............................: low
Primary action......................: repair
Secondary action....................: delete
Scan master boot sector.............: on
Scan boot sector....................: on
Boot sectors........................: C:, 
Process scan........................: on
Scan registry.......................: on
Search for rootkits.................: on
Integrity checking of system files..: on
Optimised scan......................: on
Scan all files......................: All files
Scan archives.......................: on
Recursion depth.....................: 20
Smart extensions....................: on
Macro heuristic.....................: on
File heuristic......................: medium
Deviating risk categories...........: +APPL,+GAME,+JOKE,+PCK,+SPR,

Start of the scan: sabato 28 marzo 2009  17:17

Initiating scan of system files:
Signed -> 'C:\WINDOWS\system32\svchost.exe'
Signed -> 'C:\WINDOWS\system32\winlogon.exe'
Signed -> 'C:\WINDOWS\explorer.exe'
Signed -> 'C:\WINDOWS\system32\smss.exe'
Signed -> 'C:\WINDOWS\system32\wininet.DLL'
Signed -> 'C:\WINDOWS\system32\wsock32.DLL'
Signed -> 'C:\WINDOWS\system32\ws2_32.DLL'
Signed -> 'C:\WINDOWS\system32\services.exe'
Signed -> 'C:\WINDOWS\system32\lsass.exe'
Signed -> 'C:\WINDOWS\system32\csrss.exe'
Signed -> 'C:\WINDOWS\system32\drivers\kbdclass.sys'
Signed -> 'C:\WINDOWS\system32\spoolsv.exe'
Signed -> 'C:\WINDOWS\system32\alg.exe'
Signed -> 'C:\WINDOWS\system32\wuauclt.exe'
Signed -> 'C:\WINDOWS\system32\advapi32.DLL'
Signed -> 'C:\WINDOWS\system32\user32.DLL'
Signed -> 'C:\WINDOWS\system32\gdi32.DLL'
Signed -> 'C:\WINDOWS\system32\kernel32.DLL'
Signed -> 'C:\WINDOWS\system32\ntdll.DLL'
Signed -> 'C:\WINDOWS\system32\ntoskrnl.exe'
Signed -> 'C:\WINDOWS\system32\ctfmon.exe'
The system files were scanned ('21' files)

Starting search for hidden objects.
'35998' objects were checked, '0' hidden objects were found.

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'rundll32.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'wuauclt.exe' - '1' Module(s) have been scanned
Scan process 'wlcomm.exe' - '1' Module(s) have been scanned
Scan process 'wmiapsrv.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'HPZipm12.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'slserv.exe' - '1' Module(s) have been scanned
Scan process 'SeaPort.exe' - '1' Module(s) have been scanned
Scan process 'jqs.exe' - '1' Module(s) have been scanned
Scan process 'hpqgalry.exe' - '1' Module(s) have been scanned
Scan process 'rapimgr.exe' - '1' Module(s) have been scanned
Scan process 'hpqtra08.exe' - '1' Module(s) have been scanned
Scan process 'wcescomm.exe' - '1' Module(s) have been scanned
Scan process 'msmsgs.exe' - '1' Module(s) have been scanned
Scan process 'msnmsgr.exe' - '1' Module(s) have been scanned
Scan process 'NielsenOnline.exe' - '1' Module(s) have been scanned
Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'jusched.exe' - '1' Module(s) have been scanned
Scan process 'NielsenOnline.exe' - '1' Module(s) have been scanned
Scan process 'hpcmpmgr.exe' - '1' Module(s) have been scanned
Scan process 'hpwuSchd2.exe' - '1' Module(s) have been scanned
Scan process 'atiptaxx.exe' - '1' Module(s) have been scanned
Scan process 'SOUNDMAN.EXE' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'ati2evxx.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'ati2evxx.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
43 processes with 43 modules were scanned

Starting master boot sector scan:

Start scanning boot sectors:

Starting to scan executable files (registry).
The registry was scanned ( '57' files ).


Starting the file scan:

Begin scan in 'C:\'
C:\pagefile.sys
    [WARNING]   The file could not be opened!
    [NOTE]      This file is a Windows system file.
    [NOTE]      This file cannot be opened for scanning.
C:\Documents and Settings\PC\Impostazioni locali\Dati applicazioni\Microsoft\Windows Live Mail\Hotmail (ca d33\Posta in arrivo\2CD672AE-000000A9.eml
  [0] Archive type: MIME
    [NOTE]      A backup was created as '4a124f68.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
    --> file1.html
      [DETECTION] Contains recognition pattern of the HTML/Spoofing.Gen HTML script virus
C:\Documents and Settings\PC\Impostazioni locali\Temp\jopaxx_1237032480.exe
    [DETECTION] Contains a recognition pattern of the (harmful) BDS/Backdoor.Gen back-door program
    [NOTE]      A backup was created as '4a3e4fb6.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
C:\Documents and Settings\PC\Impostazioni locali\Temp\jopaxx_1237463244.exe
    [DETECTION] Contains a recognition pattern of the (harmful) BDS/Backdoor.Gen back-door program
    [NOTE]      A backup was created as '4e294237.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
C:\Documents and Settings\PC\Impostazioni locali\Temp\Web-MediaPlayer_setup.exe
  [0] Archive type: NSIS
    [DETECTION] Contains recognition pattern of the ADSPY/Agent.lqj adware or spyware
    [NOTE]      A backup was created as '4a304ff1.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
C:\System Volume Information\_restore{FFDEF422-64A1-4B27-8B29-1A10A38F92C6}\RP154\A0063973.dll
    [DETECTION] Is the TR/Trash.Gen Trojan
    [NOTE]      A backup was created as '49fe52c9.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
C:\WINDOWS\system32\887164\887164.dll
    [DETECTION] Is the TR/BHO.Gen Trojan
    [NOTE]      A backup was created as '4a05543f.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!


End of the scan: sabato 28 marzo 2009  17:46
Used time: 28:18 Minute(s)

The scan has been done completely.

   4569 Scanned directories
 176683 Files were scanned
      6 Viruses and/or unwanted programs were found
      0 Files were classified as suspicious
      6 files were deleted
      0 Viruses and unwanted programs were repaired
      6 Files were moved to quarantine
      0 Files were renamed
      1 Files cannot be scanned
 176676 Files not concerned
   2687 Archives were scanned
      1 Warnings
      7 Notes
  35998 Objects were scanned with rootkit scan
      0 Hidden objects were found

Il problema che il pc da è che si riavvia a random quando vuole lui... E succede spesso...
Crasha anche abbastanza spesso Mozzilla, ma non so se sia collegato!
Ho provato ad avvviare RegCure, ma il pc si riavvia quando controlla i file/path reference...

Nod32 era regolare, solo che non so perchè nn faceva + gli aggiornamenti e non me ne ero accorto!

Grazie a tutti!

[Enrico88]

Il pc continua a riavviarsi... Ogni 30 minuti o anche meno!