116 reputation
114
bio website
location
age
visits member for 1 year, 7 months
seen Jul 24 at 13:56

Jul
23
awarded  Popular Question
Jan
30
awarded  Famous Question
Apr
29
awarded  Notable Question
Mar
24
awarded  Popular Question
Jan
6
answered Multiple running instances of rundll32.exe
Jan
2
awarded  Supporter
Dec
28
comment Multiple running instances of rundll32.exe
The first rundll32.exe has a command parameter: "C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll",TrayApp and the second one - C:\Windows\system32\AmbRunE.dll,RunDLLEntry
Dec
28
comment Multiple running instances of rundll32.exe
Using the recommended tool I was able to check these two instances of rundll32.exe, and there wasn't anything suspicious on the "DLL" view. Most of the DLLs are from Microsoft corporation. There are some of them which are not signed, but they reside in the C:\WINDOWS (sub)directories which probably seems fine. In the "Handlers" view there are a lot of entries which I don't have an idea how to interpret.
Dec
28
comment Multiple running instances of rundll32.exe
Both rundll32.exe instances have full paths being: C:\WINDOWS\System32\rundll32.exe which seems OK. But having you said that "a changing symbol for rundll32 is a sign that tells you something is wrong" - indeed, the icon for the rundll32.exe is changed. Can we say that something is wrong?
Dec
28
comment Identify a process that uploads data
Well, I did a factory restore to the system from a special partition, just to be on the safe side and get rid of any potential malwares, but now I am getting a strange error at the Windows 7 startup. Here you may want to check the details: security.stackexchange.com/questions/26115/…
Dec
28
asked Multiple running instances of rundll32.exe
Dec
26
comment Identify a process that uploads data
"wireshark" provides a lot of information - more than I need I guess, and it seems it will be harder for me to extract the valuable one. Think, it will be easier and more reliable solution to re-install my OS to get rid off any potential harmful applications installed on my machine. I will play a bit more with these tools, and if there is any progress I will update the thread.
Dec
26
comment Identify a process that uploads data
I am not able to use "Portmon" under Windows 7 - I followed the instructions to run it on non-network disk with administrator privileges but capture can not be started.
Dec
26
comment Identify a process that uploads data
@AliAhmad: actually that was the initial issue. I was constantly disconnected from my Internet connection and I was troubleshooting each time, but nothing helps. My Internet provider told me that they registered a large amount of upload traffic (around 2GB for a day) which causes some kind of bandwidth throttling and this may be the reason behind the constantly dropping connection.
Dec
25
comment Identify a process that uploads data
@AliAhmad: I've used netstat -oa to list all active connection and the PIDs of the services related but I am still not unable to identify the meaning of sending data to 255.255.255.255. In the result list of the command, there is no any entry for the address 255.255.255.255.
Dec
25
comment Identify a process that uploads data
I have tried with "Spybot" (available as a portable app) and scanned my machine with "Avast" anti-virus. There were no any high level threats - only a few tracing cookies. Can you recommend any valuable software tool scanning for such malicious applications?
Dec
25
awarded  Student
Dec
25
asked Identify a process that uploads data