Anyone seen msile.exe (possibly related to vundo)?

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by seancb, Mar 9, 2009.

  1. seancb

    seancb Private E-2

    Hello everyone,
    I have been helping someone with a problem where they have a couple of computers which have been showing traces of vundo. The major symptom was a huge number of "msile.exe" processes filling up the task manager. AVG recognizes this (and several random DLL files) as vundo, and is able to remove the threat, but it keeps coming back. I tried vundofix.exe and virtumundobegone.exe and both come up clean.

    For now, I have recommended that they use process explorer to suspend the msile process so that it can't generate copies of itself.

    The problem is that I can't find ANY information online about msile.exe, so I'm wondering if it's very new.

    Another problem is that google thinks I want to search for sm!le.exe. I am purposefully not spelling that word in this topic so that anyone else searching google can search -sm!le and find this result.

    Yet another problem is that vundofix just immediately says "nothing found" - but it doesn't appear to scan any files. I suspect this is because the machines are windows 2000. It does seem to scan and come clean on a neighbouring XP machine, but on the 2000 it doesn't even list the files it's scanning.

    What I'm hoping for is any info anyone might have about this executable. The other thing I was hoping to find out was the functionality of virtumundobegone - I'm wondering if I can manually execute the tasks that it does since it doesn't appear to work properly on win2k - vundo clearly exists on the machine, but vmbegone comes back clean every time.

    Again, AVG can clean this but it keeps coming back so I suspect there is a rogue undetected file somewhere. I have tried AVG, malwarebytes, dr.web. I have tried suspending explorer.exe and winlogon.exe during the scans. I'm at my wits end.

    The computers are not at my place so I can't get logs at the moment. Next time I am over there I am going to go through all of the initial steps (Again) and beg for help here :)

    I just thought I'd get the ball rolling since this msile is on each of these computers, so it's not a random file name, but the fact that there's NO info online really surprises me...

    Thanks!
     
    seancb, Mar 9, 2009
    #1
  2. seancb

    seancb Private E-2

    seancb, Mar 11, 2009
    #2
  3. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Welcome to Major Geeks!

    Don't waste your time with VundoFix. It is no longer effective against Vundo. You need to run the below which on the other hand is quite effective. However msile.exe is not Vundo, but the same procedure still applies.


    Please follow the instructions in the READ & RUN ME FIRST link given futher down and attach the requested logs when you finish these instructions.
    • If you have problems where no tools seem to run, please try following the steps given in the below and then continue on no matter what you find. You only need to try the TDSSserv steps if having problems getting scans in the Read & Run Me First.
    • If something does not run, write down the info to explain to us later but keep on going.
    • Do not assume that because one step does not work that they all will not.
    READ & RUN ME FIRST. Malware Removal Guide
    • After completing the READ & RUN ME and attaching your logs, make sure that you tell us what problems still remain ( if any still do )!
    Helpful Notes:


    1. If you run into problems trying to run the READ & RUN ME or any of the scans in normal boot mode, you can run the steps in safe boot mode but make sure you tell us what you did later when you post logs. See the below if you do not know how to boot in safe mode:
    2. If you have problems downloading on the problem PC, download the tools and the manual updates for SUPERAntiSpyware, Malwarebytes and Spybot ( links are given in the READ & RUN ME) onto another PC and then burn to a CD. Then copy them to the problem PC. You will have to skip getting updates if (and only if) your internet connection does not work. Yes you could use a flash drive too but flash drives are writeable and infections can spread to them.
    3. To avoid additional delay in getting a response, it is strongly advised that after completing the READ & RUN ME you also read this sticky:
    Any additional post is a bump which will add more delay. Once you attach the logs, your thread will be in the work queue and as stated our system works the oldest threads FIRST.
    ​
     
    chaslang, Mar 13, 2009
    #3

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds