rundll32.exe going nuts

Welcome to Major Geeks!

Your problems may not be malware. The below will tell us. However also answer this, did you problems begin before or after installing SP3?


Please follow the instructions in the below link and attach the requested logs when you finish these instructions.

READ & RUN ME FIRST. Malware Removal Guide

 

The only issues I see are non-malware. And several are things that the READ & RUN ME already stated.

From Step 1 of the READ & RUN ME:

1. You are using MSconfig to control startups. See what we recommended in step 1 of the READ & RUN ME.
2. Uninstall the below software:
   • Java(TM) 6 Update 3
   • Messenger Plus! Live <-- We strongly recommend not trusting/using this application.

Now also do the below to remova a leftover from Windows Live Messenger.

Run C:\MGtools\analyse.exe by double clicking on it. This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

After clicking Fix, exit HJT.

Now let's cleanup from running the READ ME.

If you are not having any other malware problems, it is time to do our final steps:

1. You can uninstall SUPERAntiSpyware now.~
2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop & renamed it like we requested.)
   • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
   • "%userprofile%\Desktop\cf" /u
     • Notes: The space between the cf" and the /u, it must be there.
     • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
   • Delete the C:\cf folder from combofix.
3. If we used SmitFraudFix, you can delete all files and folders related to it now including the c:\rapport.txt log.
4. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
5. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
6. Go to add/remove programs and uninstall HijackThis.
7. You can delete the C:\MGtools folder and the C:\MGtools.exe file. You can also delete the C:\MGlogs.zip
8. If you are running Vista, Windows XP or Windows ME, do the below:
   • Refer to the cleaning steps in the READ ME for your Window version and see the steps to Disable System Restore which will flush your Restore Points.
   • Then reboot and Enable System Restore to create a new clean Restore Point.
9. After doing the above, you should work thru the below link:
   • How to Protect yourself from malware!

 

You can keep it it you wish. But I would change the options so that it does not run at startup. It is a useful scanner as is Malwarebytes.

 

Please do not attach HijackThis logs that you run. It needs to be installed properly and renamed (like it was with MGtools) to be effective.

Where did you find w32/Dloader.GBVM and what program found it? Was it Norman?? Could be a false positive so I need to know exactly where it believes the problem is located.

 

Then it is a know false positive issue with Norman that they need to address. They are detecting MBAM as a problem when it is not.

Another false positive. All that registry fix does is to set hidden files and folders back to normal defaults. Seems like Norman has some issues they need to resolve.

 

Are they referring to one of their own files??? Or did you mean the below file which is part of Windows:
C:\WINDOWS\system32\drivers\etc\hosts

While we did not look at the contents of your host file, the size appears to be what would be expected for a Windows default.

 

I still don't know what you (or they) mean by "the service host". Also what is an SD brick?