detected NTDLL code modification and RP3DAA64.dll

Jacquie · Mar 20, 2013

Hello Major geeks,

Last night all of a sudden my network lost connection to internet and kept trying to establish a new "public" internet connection. my cable modem doesn't have a reset button so I unplugged all connection to the modem and shutoff the desktop tower and disconnected the power for over 1 minute than plugged it all back in and it refigured itself and got me a private home connection. But because I've had trouble trying to sign in to word press and Google recently the sign in page just kept refreshing, Malware bites and Spybot both found and removed Trojans a few days ago. than TDSSkiller found one item deleted and cleaned reran scan and reported "clean" this morning and now "catchme" found this: "detected NTDLL code modification" and stated it couldn't find my C drive. I just have a weird "feeling" something is amiss and that's why I wanted to have my logs reviewed by someone with more knowledge than myself to see if I still have "crap" on my hard drive and if so how to remove it and replace any corrupted files also.

I also found a zipped file the other day :confused- opens with "unknown application" type of file: "compressed (zipped) Folder SendTo Target (.ZFSendTo Target)- I don't have any idea where it came from I want to delete it but cut and pasted it to my desktop and have not tried to unzip it I have only look at the "properties" - size is 3 bytes.

I have followed and completed your "Read This First" instructions - downloaded the "tools" you listed to my desktop disabled UAC and rebooted. I then ran each of the scans you requested and saved the logs which I have attached to this post. I have also saved “snip its” of folders that show folders I don’t understand.

I now see a folder in my C: drive titled "Qoobox":confused
The TDSSKiller scan returned results of "0" infected files but I had ran this before I went online and looked up on major geeks about asking for help in your forums and have a TDSSKiller Quarantine folder in my C:drive.

Please help me with what I need to do to clean &/or repair my system.

Thank you Jacquie
P.S. I hope I have uploaded the correct log files, please let me know if I sent the wrong ones.

TimW · Mar 22, 2013

If you have a folder named Qoobox, it is from running ComboFix. When did you do that?

So far I am not seeing any malware, but you didn't attach the logs from running MBAM or from running MGTools--C:\MGLogs.zip.

Jacquie · Mar 23, 2013

Thank you for getting back with me. :heart I discovered what Qoobox was after posting my question. I had done a combofix scan a day or two before I started to do all the steps for asking questions on your forum.:-o The Qoobox folder was empty. Sorry about not uploading the other logs you needed I have uploaded them now as well as a couple other zips of all the logs of everything I have run. I don't know if they will help. or maybe I should start everything on your Run this First list and redo it???:confused All I know is my computer just isn't running the same lately, finding weird folders, now IE keeps hang saying something about long scripts. I keep getting all these short cuts to folder under my user name over a dozen ntuser.dat files keep showing up (please see attachéd ntuser snipit)Please help..thanks jacquie

TimW · Mar 23, 2013

I am not finding any malware in your logs. I suggest you post in the software forum for further assistance.

If you are not having any other malware problems, it is time to do our final steps:

We recommend you keep Malwarebytes Anti-Malware for scanning/removal of malware.

If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)

Press and hold the Windows key and then press the letter R on your keyboard. This opens the Run dialog box.

Copy and paste the below into the Run box and then click OK. Note the quotes are required

"%userprofile%\Desktop\combofix" /uninstall

Notes: The space between the combofix" and the /uninstall, it must be there.

This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

Go back to step 4 oof the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.

Go to add/remove programs and uninstall HijackThis. If you don't see it or it will not uninstall, don't worry about it. Just move on to the next step.

If running Vista or Win 7, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Goto the C:\MGtools folder and find the MGclean.bat file. Double click ( if running Vista, Win7, or Win 8 Right Click and Run As Administrator ) on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.

If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others) and running MGclean.bat did not remove, you can delete these files now.

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If you are running Win 7, Vista, Windows XP or Windows ME, do the below:

Refer to the cleaning procedures pointed to by step 6 of the READ ME
for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.

Then reboot and Enable System Restore to create a new clean Restore Point.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

Malware removal from a National Chain = $149
Malware removal from MajorGeeks = $0

Jacquie · Mar 23, 2013

Thank you very much Tim W. Jedi Malware Expert, I appreciate you taking the time to review my logs and reply to my questions. I have completed the "final" steps and will go to the software forums if I keep having problems. But it is GOOD to know that I've not got any malware. :coolI guess the few items found during all the different scans got rid of whatever the "bug" was. I was wondering about the "RP3DAA.dll" is it ok? :confused And what is this "NTDLL code modification" notice that I saw? You see I'm trying to understand better about this stuff to help know the next time what I should worry about or look at. But than again maybe it is beyond me without much more education about virus, malware and the like. I have Advanced System Care 6 and Avast and will keep the Malwarebytes Anti-Malware as you have suggested and I have and use CCleaner. Is there any other software I should use with these? I'm glad for people like you with the knowledge and desire to help us little people keep our computers running safe and secure. Thank you doesn't seem enough. But Thank you. Sincerely, Jacquie:wave

TimW · Mar 24, 2013

What you have for protection is adequate. Just be aware of your surfing habits. Again, the other questions should be addressed in the software forum. And, you are most welcome.

Log in or Sign up

detected NTDLL code modification and RP3DAA64.dll

Jacquie Private E-2

Attached Files:

RKreport[1]_S_03202013_02d1046.txt

hijackthis.log

TDSSKiller.2.8.16.0_20.03.2013_08.04.43_log.txt

HitmanPro_20130320_1121.log

protection-log1-2013-03-17.txt

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Jacquie Private E-2

Attached Files:

mb Logs.zip

MGlogs.zip

Scan logs.zip

ntuser.jpg

Spybot Logs.zip

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Jacquie Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

detected NTDLL code modification and RP3DAA64.dll

Jacquie Private E-2

Attached Files:

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Jacquie Private E-2

Attached Files:

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Jacquie Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Useful Searches