Error: Invalid location of rundll32.exe in JPEG library. Cannot call action.

same problem for me
bleh
:\

heh.. this has the same thing as the one in downloads..
hNetapi = LoadLibrary("sbaaNetapi.dll");
if (!hNetapi) {
printf("Can't load sbaaNetapi.dll.\n");
exit(0);

so as of about an hour ago, this became old
(wow, is it just me or did today bring alot of action in this community? lol)

> Error: Invalid location of rundll32.exe in JPEG library. Cannot call action.

Got the same problem here

http://www.governmentsecurity.org/forum/in...?showtopic=8069

there's a link where people got it working

hmm, this might be a virus. after running it. services.exe wants to connect to a few numerous portd then my norton corporate AV shuts down. services.exe was dropped in c:\windows (hidden in fodler but not with 3rd party process viewer)and then this file showed up ktd32.atm. so i hex edit this file ktd32.atm and its the log from a keylogger that would have just started since the commands i typed after running the .exe are the only ones there.

everyone else might want to take a closer look at this file.

my xp reboots upon initiating the exploit

yep this is a lame virus .. dont download it

It is ProRat BackDoor
Imo it uses following files in ur Systemroot (WINDOWS\System32\ for XP)
- winkey.dll < the key logger
- wininv.dll < the backdoor

I also found a reg key here:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
HKEY_CURRENT_USER\SOFTWARE\Microsoft DirectX\Winsettings
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}

Maybe More Later

in what version should be this backdoor?

for me it works perfect and gives shell after shell without an entry @reg it also starts no programs--i checked this with procexplorer + autoruns from www.sysinternals.com

i didnt post this, someone used my nick to own u people.
please some moderator or administrator delete this post.

I removed the files from my pc, but it still doesn't want to boot.

Somebody has any suggestions what to do? (without reinstalling windows)

tnx

It drops:
C:\RECYCLER\S-1-5-21-1343024091-1078145449-1060284298-1003\Dc48.dll Geïnfecteerd Backdoor.Prorat.12 <cd0000.0.e>
C:\WINDOWS\system32\winkey.dll Geïnfecteerd Backdoor.Prorat.12 <cd0000.0.e>

Reg Keys:
HKEY_LOCAL_MACHINE\Software\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y} "StubPath"
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run "DirectX For Microsoft® Windows"
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon "Shell"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

Delete the file ktd32.atm in the Windows folder if it exists. (keylog)

More Info:
http://securityresponse.symantec.com/avcen...oor.prorat.html
http://www.sophos.com/virusinfo/analyses/trojproratd.html
http://www.prorat.net
http://www.pestpatrol.com/pestinfo/p/prorat.asp
http://www.megasecurity.org/trojans/p/prorat/Prorat_all.html

It drops some more files, but they are already anounced in this forum.

but i will have a look in my recycler directory.

tnx

still get a blue error screen with the following msg:

stop: 0x0000007f (0x00000008,0x00000000,0x00000000,0x00000000)
unexpected_kernel_mode_trap

PEOPLE stop downloading this!!!!!!

)oni(, the admins are slow sometimes, would you please edit your post to take out the download??

Downloaded it yesterday already....only can reboor my pc anymore even if i deleted the virus.

somebody any suggestions?

i dunno, this virus is stupid... i opened it and didn't notice a thing (i keep by registry RUN folders empty, works like a charm)

Found it

my computer crashed and restarted all the time because of the virusscanner.

really shit and thats why i prefer to have none.

removed the virus myself.

How ?
I don't have the rights to delete the dll's . Even when i exploided Systemrights on my machine i have the message : Access denied .
Can you give me some hints ? Thank you

first stop the exe,
services.exe
than go after dll

this doesn't work for me :-(

C:\>kill.exe services
process #972 [services.exe] killed
process #196 [services.exe] killed



C:\WINDOWS\system32>del wininv.dll
C:\WINDOWS\system32\wininv.dll
Zugriff verweigert ( in English : Access denied )


Some other Methods ?

What i did:

attrib -s -h c:\winnt\services.exe
attrib -s -h c:\winnt\system\sservices.exe
attrib -s -h c:\winnt\system32\fservices.exe

then open 3 dos command screens.

put in 1 screen: del c:\winnt\system\sservices.exe

but don't hit enter yet!....otherwise it will place the file back again

put in 2nd screen: del c:\winnt\system32\fservices.exe

No enter yet!

in the 3rd screen:

go into the c:\winnt directory and type:

kill services.exe

(if you do this in another directory it doesn't work coz there is another "real" services.exe in the c:\winnt\system32 directory)

Then when the process is killed your computer wants to shut down in 60 seconds.

so type in the 3rd dos screen del services.exe (in the c:\winnt directory)

and hit the enter button in the 1st and 2nd dos screen.

Then restart and remove the registry keys and/or the keylog files.

Good luck

yo thank u :-)
With your manual i removed the f*cking backdoor :-D

i have format me c:\


wy did you post something like that