backdoor.bot in registry called rundll.exe

daftasabrush · 06-27-2009, 06:12 PM

Hi, I am really going nuts over this one :(
In the registry of xp pro sp3, I have an entry in winlogon
which has the name taskman. This seems to activate a program hidden
in the C: recyclers called rundll.exe
Everytime I remove the entry, it returns immediately. I have disabled the
recycle bin and the recyclers have gone. I rebooted but of course the
registry entry is still there and still returns each time I delete it.
malwarbytes finds this one rogue entry, removes it but again it still returns.
Is there any way I can stop this backdoor bot ?

I'm hoping someone can help

**amateur** · 06-27-2009, 06:37 PM

Hello and welcome to TSF.

It would be impossible to help without any logs.

Please follow our pre-posting process outlined here:

NEW INSTRUCTIONS - Read This Before Posting For Malware Removal Help

After running through all the steps, you shall have a proper set of logs. Please post them in a new topic, as this one shall be closed.

If you have trouble with one of the steps, simply move on to the next one, and make note of it in your reply.

06-27-2009, 06:12 PM	#1 (permalink)
daftasabrush Registered User Join Date: Jun 2009 Posts: 36 OS: xp professional	backdoor.bot in registry called rundll.exe Hi, I am really going nuts over this one :( In the registry of xp pro sp3, I have an entry in winlogon which has the name taskman. This seems to activate a program hidden in the C: recyclers called rundll.exe Everytime I remove the entry, it returns immediately. I have disabled the recycle bin and the recyclers have gone. I rebooted but of course the registry entry is still there and still returns each time I delete it. malwarbytes finds this one rogue entry, removes it but again it still returns. Is there any way I can stop this backdoor bot ? I'm hoping someone can help

06-27-2009, 06:37 PM	#2 (permalink)
amateur Moderator, Analyst, Security Team ; Rangemaster, TSF Academy Join Date: Jun 2006 Location: USA Posts: 7,283 OS: XP SP3	Re: backdoor.bot in registry called rundll.exe Hello and welcome to TSF. It would be impossible to help without any logs. Please follow our pre-posting process outlined here: NEW INSTRUCTIONS - Read This Before Posting For Malware Removal Help After running through *all* the steps, you shall have a proper set of logs. Please post them in a new topic, as this one shall be closed. If you have trouble with one of the steps, simply move on to the next one, and make note of it in your reply. __________________ My services are free. However, you can donate to TSF to help keep it running. Member of ASAP since 2005 Member of UNITE since 2006