Unknown App

[BuzzStone]

I have the following application that I found in Task Scheduler: prvlzwkb. It is located in Windows System32 Rundll32.exe - nnnoNffg.dll. I have no idea what it does and cannot find any info on it. Does anyone have any ideas what it could be?

[Tarq57]

Did a Google of the process nnnoNffg.dll, looks like it's a vundo variant.
Does the application prvlzwkb change its name after a reboot?

I'd start off trying to terminate the process and running MBAM, if you haven't already.

Links to the Google results:http://www.exterminate-it.com/malped...o-virtumondo/8 and http://forums.spybot.info/archive/in...p/t-27218.html

[BuzzStone]

Thanks for the reply Tarq57. I did some more googling after my post and found the info you have posted. I have scanned with MBAM, SAS, MSE and all comes up clean.

[Tarq57]

I reckon it's there, but cloaking itself. Such process names bear similarities to those used by rootkits. Or polymorphic malware.
Either way, you'll need to find a way to stop it or uncloak it before it can be recognized and eliminated for good.
Not my province, sorry, not trained/knowledgeable enough to confidently help others, there are folk here that are, and plenty of malware removal forums that can help, too. (MajorGeeks, Bleeping computer, Aumha etc. There's a sticky about that Here.

[subhrobhandari]

Spybot should clean Vundo variants.

[ha14]

Hi

Download Hijackthis and do a scan and save the log file, then post here so someone can help you. Alternatively download superantispyware and malwarebytes antimalware. Instal both of them the reboot in safe mode and then scan first with superantispyware, then reboot normal and clean. Repeat the same with malwarebtres antimalware. Good luck.

[lordpake]

Originally Posted by ha14

Download Hijackthis and do a scan and save the log file, then post here so someone can help you.

I do believe forum policies forbid posting of HjT logs here unless specifically requested by forum staff member or other expert, see this thread http://www.wilderssecurity.com/showthread.php?t=42148

[catcherintherye]

See if AppRanger works

[twl845]

Here's the fix. just run it. http://vundofix.atribune.org/