Multiple rundll32 process running

[freaky_seb]

Hello

 

Not sure if anyone can help with this, I'm quite stumped by this and googling around hasn't yielded a solution!

 

We got struck by conficker, managed to get most of it cleaned up, servers are all patched and protected and the majority of the desktops are clean.

 

Since then, quite a few pcs have been running up to 50+ instances of the rundll32 process slowing the machines down.

 

Rebooting machines seems to wipe the slate clean, the pc boots up without all the processes in task manager, but they slowly reappear bogging the machine down again.

 

I've ran the sophos virus scanner and symatecs standalone conficker scanner, both returned clean, windows defender, spybot, adaware, clean!

 

We have found whats causing them to run, 1000+ scheduled tasks, starting with 'At', then a number after the 'At'.

 

Anyone ever seen anything like this? Any help would be appreciated with glowing praise and cookies! You will also save me from tearing my hair out and smashing my fist through every pc in the school!

 

Thanks!

 

Seb

[BJG]

Sounds like you might not have eradicated Conficker. You might try the Microsoft removal instructions on one of the affected PCs as an experiment (seems to involve killing scheduled tasks.)

 

Virus alert about the Win32/Conficker.B worm

[sandeep2504]

that is definately conficker and the rundll32 processes will be the AT scheduled tasks runnning.

 

I would suggest you do the following:

 

Download the sysinternal suite and in there you will find a tool called process explorer which you should use to check the processes (advanced version of task manager which can identify the source of the process).

 

Disable task schedule service

 

Download the microsoft malicous software removal tool and the norman malware cleaner

 

Make sure your copy of windows is up to date with security patches

 

Make sure your anitvirus is up to date

 

Boot into safe mode and run the norman malware cleaner then the microsoft malicous software removal tool then run a complete anti virus scan.

[sandeep2504]

Also i would create script to delete the scheduled tasks that conficker uses (AT1 etc) and run it on all your machines.