Re: rundll32 & adware

From: David H. Lipman (DLipman~nospam~_at_Verizon.Net)
Date: 12/04/04


Date: Sat, 04 Dec 2004 20:00:41 GMT

Cute name; I N V U 9 :-)

Here's what "invu9_32.dll" is recognized as...

eTrust-Vet 11.7.0.0 12.03.2004 Win32.Startpage.KF
Kaspersky 4.0.2.24 12.04.2004 not-a-virus:AdWare.Look2Me.r
Sybari 7.5.1314 12.04.2004 Win32.Startpage.KF

Dave

"Jim Watt" <jimwatt@aol.no_way> wrote in message
news:i424r0l0fvf1qb4ta6qd527624acsc1ica@4ax.com...
| On Sat, 04 Dec 2004 15:19:41 GMT, David Postill <david@postill.org.uk>
| wrote:
|
| >In article <soi3r0pdf1bqtl9dvbln9pf9h7rli166mr@4ax.com>, on Sat, 04 Dec 2004 15:39:01
+0100, Jim
| >Watt <jimwatt@aol.no_way> wrote:
| >
| >| On Sat, 04 Dec 2004 10:11:56 GMT, David Postill <david@postill.org.uk>
| >| wrote:
| >|
| >| >Have you run process explorer?
|
| OK by chance I went to the clients office today for something else
| so ran process explorer. It showed that the .dll was
| invu9_32.dll which goes not get a hit on google.
|
| The dll is in c:/windows/system and is flagged as +SR
| so did not show on explorer.
|
| I renamed it in DOS mode and the popups have stopped.
|
| If anyone is interested in looking at it further to determine its
| origin, its zipped up as
|
| http://www.gibnet.com/security/crapware.zip
|
| Uh yes I did mean programs pleading not to be UNinstalled.
|
| I still do not understand quite how this gets run, but its
| currently disabled.
|
| Thanks for the good advice so far in the process.
| --
| Jim Watt
| http://www.gibnet.com



Relevant Pages

  • Re: rundll32 & adware
    ... Watt wrote: ... | OK by chance I went to the clients office today for something else ... | so ran process explorer. ... It showed that the .dll was ...
    (alt.computer.security)
  • Re: Coffee for 20 on bicycle tour?
    ... but nothing like a coffee pot. ... I've got a 1500 watt inverter in my rv that powers a 1000 watt microwave ...
    (alt.coffee)
  • Re: Coffee for 20 on bicycle tour?
    ... pigtail plu on it. ... I've got a 1500 watt inverter in my rv that powers a 1000 watt microwave ... system works yet (but she works just fine on the solar electric system at my ...
    (alt.coffee)
  • Re: rundll32 & adware
    ... Watt wrote: ... |>Have you run process explorer? ... HTH and good luck ... David Postill ...
    (alt.computer.security)
  • Rottendog WDB089 Power Driver Board owners - I need some info
    ... Can someone verify for me the correct resistance/color code for these? ... I'm assuming 1/4 watt since that's what it appears to be on the Rottendog website. ... I'd ask Jim for the info but he's out of town until the 30th. ...
    (rec.games.pinball)