New Need Help: msdpjpkn.dll

[JerroldNik]

I'm brand new to Avast. Windows XP. I installed Avast after running a full MalwareBytes removal process.

Avast immediately ripped out msdpjpkn.dll and put it in the chest.

Now many programs won't run as they say that this file is missing.

Amongst those affected: Firefox, Gimp, Acrobat, and then some Windows ones: dwwin.exe and dw.exe.

I am not an advanced user.

Can anyone advise me on this?

Thanks,
Jerrold

[DavidR]

What was the location of this file, e.g. (C:\windows\system32\infected-file-name.xxx) ?
What was the malware name given on the detection ?

The only hit on this file name (which looks randomly generated) is for this topic, which for a dll is somewhat suspicious.

There may well be some hooking by this file to those other affected programs, a registry key remaining.

If you haven't already got this software (freeware), download, install, update and run it and report the findings (it should product a log file).

• 1.  MalwareBytes Anti-Malware (MBAM), On-Demand only in free version http://download.bleepingcomputer.com/malwarebytes/mbam-setup.exe, right click on the link and select Save As or Save File (As depending on your browser), save it to a location where you can find it easily later.
• 2. SUPERantispyware (SAS). On-Demand only in free version.

Don't worry about reported tracking cookies they are a minor issue and not one of security, allow SAS to deal with them though. - See http://en.wikipedia.org/wiki/HTTP_cookie.
Also available a portable version of SAS, http://www.superantispyware.com/portablescanner.html, no installation required.

[JerroldNik]

Hi - thanks!


Here's what info I have:


Original file name: msdpjpkn.dll
Original folder: C:\WINDOWS\SYSTEM32
Size of file: 144932
Last modification: 02/05/2003
Time of transfe...: 07/06/2010
Category: Infected files
Virus description: Win32:Trojan-gen
File ID: 1


This was my work computer so I had to get these things working. I have subsequently:

1) Restored the file
2) Removed Avast prior to rebooting (as when I Restored and then rebooted - it just yanked it again)
3) Re-installed Firefox
4) The other programs are working fine now.


I had use MalwareBytes prior but will use the Superantispyware as well - thanks!
 

I would like to get back with Avast (as I have no virus protection) - but must wait until I can figure out how to prevent this from happening again.

Any help would be... helpful. 

Thanks,
Jerrold

[Pondus]

can you upload the file to www.virustotal.com   or   www.virscan.org  when you have the result, copy the URL in the adressbar and post it here

[DavidR]

Hi - thanks!


Here's what info I have:
Original file name: msdpjpkn.dll
Original folder: C:\WINDOWS\SYSTEM32
<snip>
Virus description: Win32:Trojan-gen

This was my work computer so I had to get these things working. I have subsequently:

1) Restored the file
2) Removed Avast prior to rebooting (as when I Restored and then rebooted - it just yanked it again)
3) Re-installed Firefox
4) The other programs are working fine now.

I had use MalwareBytes prior but will use the Superantispyware as well - thanks!
 
I would like to get back with Avast (as I have no virus protection) - but must wait until I can figure out how to prevent this from happening again.
<snip>

I find it even more suspicious that a file in the system32 folder doesn't get any hits (other than this topic) on a search.

So I do feel that the detection is good, but the problem really does look entries in registry hooked to this file when those others start, so I was kind of hoping that MBAM and SAS might find these redundant registry entries and correct/remove them. Ensure that you have the latest updates for MBAM and SAS before running another scan.

- Also useful as a diagnostic tool - FileHippo Download - HiJackThis and post the contents of the HJT log file here. - HJT Information HiJackThis Tutorial.

Download and run HJT and post the contents of the log file (attach the log file) into this topic.

This may hopefully find the run commands that relate to this file name, etc. and hopefully we can remove that

[essexboy]

Sounds like it may be hooked into either userinit or the shell, this would stop the related programmes running 

[DavidR]

Thanks for the timely intervention, as I'm not to sure HJT may show this hooking if it is more complex and if hidden it may require your tools to root it out

[essexboy]

If it is the userinit then HJT should see it - if it is the shell or IFEO then it won't

I have subscribed to the thread 

[DavidR]

Thanks, now we need an update from JerroldNik.

[JerroldNik]

I am very impressed with the volume and quality of responses. I can also feel the interest by the group in what may be something you haven't seen before.

My thoughts were that it was a random file other than it popping up as missing for all the different programs.

Again, they did start working again once I let the file loose.

I would really appreciate it if you folks would agree on one course of action for me to follow. Step by step if you would as I really cannot afford the downtime without the computer. Today's efforts probably cost me 6 or 7 hours of frustration.

If no-one jumps in on that, I will just carry out your recommendations - then await someone's direction prior to re-installing Avast.

My brother-in-law is the main tech-help guy at a local university. He recommends Avast to all offsite users. Just thought you'd like the plug.

He doesn't have the background that you folks seem to have and gave this forum the nod.

Thanks again, Really,
Jerrold

[DavidR]

Letting the file loose really is the last thing that you want as we have said it is hooking these other files either from the userinit or the shell as essexboy said.

There is no disagreement as such, we still want you to run the applications mentioned MBAM plus SAS and report their findings. Then followed up by posting the contents of the hijackthis log file so we can see what is running on your system, e.g. if the userinit section is what is being used by msdpjpkn.dll to hook the other files.

Then we can give more detailed instructions, but to do that we need the reports, etc.

[JerroldNik]

You're gonna love this.

I had already done the MBAM procedure. Updating that and running it again provided no new results.

I installed SAS, updated and ran that.

Luckily, I did a PrtScn and pasted the image onto a Word Doc. You'll find out why I say "luckily" in a moment.

Results:

Processing: C:\WINDOWS\SYSTEM32\MSDPJPKN.DLL
Processing: C:\WINDOWS\SYSTEM32\MSDPJPKN.DLL
Processing: C:\WINDOWS\N1260CP.EXE
Processing: C:\WINDOWS\N1260SM.EXE
Removing: PID (63438944) C:\WINDOWS\SYSTEM32\MSDPJPKN.DLL
Removing: C:\WINDOWS\SYSTEM32\MSDPJPKN.DLL
Removing: C:\WINDOWS\N1260CP.EXE
Removing: C:\WINDOWS\N1260SM.EXE


Now for the funny stuff.

Once again, those specific programs will not load because of a "missing component" further detailed as "missing MSDPJPKN.DLL". But now add to the list of programs - SUPERAntiSpyware!

That's right - I couldn't even print you the log sheet if I wanted to because the program won't open.

Now I can't even reload the file because the program that ripped it can't open.

This is a big issue because everything I send (estimates, quotes, pricing, order acknowledgments and invoicing is sent as PDF, I am essentially grounded.

My next step (as I must do something while waiting to hear back from you guys) is to turn off SAS (as it doesn't work anyway, and try to run the next thing in the list above - HiJackThis.

Hopefully it will work. 

Later,
Jerrold

[JerroldNik]

In order to do the VirusTotal.com or virscan.org scans - I need the file.

Once SAS has ripped the file - is it gone or is it in a vault somewhere? If you can tell me where to find it, I'll do the scans.



Thanks,
Jerrold

[JerroldNik]

Okay fellows, I've done the HiJackThis sweep and have posted the results below. No further action has been taken.



Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 9:05:07 AM, on 09/06/2010
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\WgaTray.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
C:\WINDOWS\System32\msiexec.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx

O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

O4 - HKUS\S-1-5-18\..\RunOnce: [Printing Migration] rundll32.exe C:\WINDOWS\System32\spool\migrate.dll,ProcessWin9xNetworkPrinters (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\RunOnce: [Printing Migration] rundll32.exe C:\WINDOWS\System32\spool\migrate.dll,ProcessWin9xNetworkPrinters (User 'Default user')

O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe

O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\MESSEN~1\MSMSGS.EXE

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\MESSEN~1\MSMSGS.EXE

O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll

O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL

O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll

O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe

O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe

O23 - Service: THotkey - TOSHIBA Corp. - C:\WINDOWS\SYSTEM32\THOTKEY.EXE

--
End of file - 3761 bytes

[YoKenny]

I see that you need to update your system as Acrobat 5.0 is very down level and vulnerable to infection as V9.3 is the current version.

Windows has not been kept up to date as SP3 has been available for almost 2 years and Microsoft will stop support for old versions shortly.

Internet Explorer (IE) V6 is very vulnerable to infection and IE is now at V8.

You need to remove all of Norton (Symantec)
Download and run the Norton Removal Tool
http://service1.symantec.com/support/tsgeninfo.nsf/docid/2005033108162039