djrunner2.exe

[quiffhead]

I've been having a problem the last 2 days with this annoying pop up message generated by files that have appeared at C:\WINDOWS\SYSTEM\BIN\djrunner.exe  No matter what I do,  delete them etc,  the error message pops back up

"Windows cannot find "C:\WINDOWS\SYSTEM\BIN\djrunner.exe." Make sure you typed the name correctly, and then try again. To search for click this file, click on the Start button, and then click Search."

I have found a few other people with the problem on another tech forum but noone has fixed it yet,  I'm not sure if this is a virus or what,  but the file/s are related to cracking software by someone by the name of John the Ripper, a notorious password cracker

If anybody knows anything about this,  or knows a fix/cure,  please let me know,  it will be greatly appreciated.

Regards
Jason

[whocares]

Hi,

IF this happens with ALL EXE-files/programs: the Cleaner from www.avast.com should read -> read instructions FIRST!!

otherwise just search for the respective entry in the registry, and remove it (backup the registry-key first!!)

scan you PC with updated avast and maybe onlinescanners from Trend (below) and www.ravantivirus.com , to be on the safe side

SPYBOT, AD-Aware and maybe cwshedder might also help
Links: Search above


 

[techie101]

quiffhead,

I have not heard of djrunner.exe and had no luck attempting to research this problem.

At this point, the advice of Whocares is the best way to go.

If you delete it from the directory but it reappears, this is symtomatic of a "registry" plant or "hijack"

You may have some luck going to the Wilder's Forum.

www.wilders.org

Techie

[MikeBCda]

You may have some luck going to the Wilder's Forum.

www.wilders.org

Just an addy correction -- the forums are at wilderssecurity.com, which is separate from wilders.com.  The forums (fora?) are at http://www.wilderssecurity.com/index.php

[techie101]

Mike,

A correction to your correction.

You most certainly can access the Wilders Forum from the Home page.
It is really not a separate entity.

I have found them most helpful.....
If you contact Wilders directly, they will answer the support request.

I recommended the Wilders forum in case someone there knew something about djrunner.

Techie

[2AsNoE]

Hello, I work for a major financial institution and djrunner2.exe was brought to our attention.

This is a key logger program that is capturing you browse activity to most financial related sites.  You may want to research further to see if you can find the location in which this file was downloaded from.  Most likely the current site is one hosted by Managed.com in Fremont Ca.  This site is completely ALARMING.  I don't want to disclose the ip of the server due to the fact that the perp did not put security on the compromised server and there are TONS of files there for several major financial institutions.  It captures the url, your id, your password and any other clear text entry associated with the post activity.

You should probably consider any inet banking, eCommerce sites you use to perform financial transactions compromised.

I have no word on the remedial actions associated with identification, removal or remedial actions.  

Just out of curiosity, are any of  you running personal firewalls?

[CharleyO]

Yes, I would say that most of us have firewalls. One is just asking for trouble if you have no firewall.    

And amazingly, there are those who go on the internet without a firewall ... NOR ... anti-virus protection!      

Thanks, too, for the additional info on djrunner!      

[quiffhead]

Hi guys,  thanks for all your help & advice,  I have pretty much already tried the ideas given here,  I have found some other people with the same problem on another tech site,  but that site has been down since yesterday,  so I've not been able to get back to them to see if they have any updates!
Just for the record I run kerio personal firewall,  & use Avast Home Edition virus scanner,  yet this problem still got me!
The virus or whatever it is was created by someone called Jogn the Ripper,  this I found out on the other tech site,  but am finding very little info about it all,  even google searches come up blank!  So at this time I'm at a loss as what to do next!

Regards
Jason

[dkhobday]

I was able (it appears) to disinfect a home system (sitting behind a firewall) from djrunner2 by deleting the /bin directory that it was in and deleting a rtdx11??.dat file, an exe beginning with cdg... and all relevant registry entries.

It was a sneaky one!

-Ken

[techie101]

2ASNoE,

Thank you for the fine information on djrunner.exe

I wonder why it is not widely known as a key logger hack?

If you find out anything more, please put a post under General or Virus related topic.

Thanks
Techie

[whocares]

 I have pretty much already tried the ideas given here,

Hi Jason,
then please list the respective results/reports, or problems you encountered while following the advice

do you even find the file on your PC somewhere ?
set Explorer -> view/Extras -> folder options to show all files/folders, including hidden & system ; also let it show all extensions

then do a complete search of your PC for
DJRUNNER
if found, scan it with KAV below

also search the registy for DJRUNNER and list the found key/entries here



 

[quiffhead]

I copied the advice by dkhobday & so far it seems to be sorted,  thank you very much,  it was a right pest  

Jason