Yesterday, I got infected with a trojan that adds mljklif.dll to \system32, adds itself to WinLogon notifiers.
mljklif.dll tries to log keystrokes(which my anti-keylogger blocks), contact Internet thru explorer.exe with winlogon.exe as parent.
I can’t remove it, it’ll just add itself again. It’s embedded in the winlogon.exe process, so I can’t exit winlogon.exe and then delete mljklif.dll, because if you exit winlogon.exe your system will crash.
I’ve uploaded it on VirusTotal and 18/32 AV-products detected it. I tried with Avira Antivir, it said it would delete after reboot, but it didn’t. I’ve sent it to Avast!, so it’ll probably be added to their future virus database.
Tried GPo [ at ] Utilities, which is supposted to rename/move/delete files before Windows boots, but it doesn’t work.
My last hope would be a DOS program that’ll remove it before Windows is booted, which means I’ll need something you can put on a floppy.
Or should I try all antivirus programs that detects it and see if one of them will succeed to delete it?
Here’s some name that’s used for it:
TR/Vundo.Gen
Adware Generic2.OUK
Trojan.Vundo.DMV
AdWare.Virtumonde.jp (Not a Virus)
Trojan.Vundo-525
Win32/Vundo!generic
It’s free. It has definitions that I think will allow it to spank the bottom of this trojan with force. It doesn’t scan the same way other stuff does; it is a memory-monitor. The malware has to access memory in order to run (whether it’s already on the machine or not). When it does so, BOC starts the spanking process (which includes removal, if you want it to).
It should prompt to get updates during install; please allow it to do so. Then reboot and let the fun begin. Given that the trojan involves winlogon, it’s possible that BOC removing the malware may crash your machine; this should not cause any problem other than another reboot.
LM
PS: Disable TeaTimer completely before installing BOC. Tea Timer has some coding issues that are problematic, and can interfere with BOC doing its job. You don’t want TT running on reboot.
I’ve also downloaded Trojan Remover 6.6.2, it detected the trojan, so going to see if it’s able to deal with the problem, else I’ll try BOClean.
If it Trojan Remover fixes the problem, I’ll install BOClean for future use.
Going to reboot computer now.
Ragwing
EDIT: It seems like Trojan Remover fixed the problem. Thanks for your all your help Little Mac.
***** TROJAN REMOVER HAS RESTARTED THE SYSTEM *****
2007-09-14 19:04:28: Trojan Remover has been restarted
Trojan Remover forced a System Restart by terminating WINLOGON.EXE.
The Cleanup Utility was used to remove locked registry keys.
D:\WINDOWS\system32\mljklif.dll has been renamed to D:\WINDOWS\system32\mljklif.dll.ren
2007-09-14 19:04:28: Trojan Remover closed
All that remained was a blank BHO that I removed manually.