Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Possible Duplicate:
Computer is infected by a virus or a malware, what do I do now?

On one of my server (Windows Server 2003 R2 in VMWare VSX VM) I can see very many rundll32.exe instances running: enter image description here

Each of them was started by command line like these:
rundll32.exe umhsuk.kk,znkefa
rundll32.exe umhsuk.kk,yfufqk
rundll32.exe umhsuk.kk,hmhjje
All of them run in session 0.
All of them run under scvhost.exe (i.e. was started by) where the following services are hosted:
enter image description here

What is it?

share|improve this question

marked as duplicate by Nifle, Tom Wijsman, Sathya Dec 10 '11 at 18:14

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

Nifle: The OPs question deals with diagnosis of a particular phenomema. While the explanation is that there is probably a virus, the question did not deal with "how to clean a virus" but was "what is the explanation for these symptoms". That is not duplicate. – music2myear Sep 9 '11 at 19:13
@music2myear Note that Nifle doesn't get the notification unless you prefix @ to this name. – Sathya Sep 11 '11 at 12:26
(this is to ping @Nifle) – Sathya Sep 11 '11 at 12:26
@music - You are technically correct, I think he'll understand what the problem is when I point him to that question. In the end he probably needs to go to… anyway. Even you pointed him in that direction. – Nifle Sep 11 '11 at 14:47
up vote 4 down vote accepted

Those are viral.

The clue is the random letters following the rundll32 line:

rundll32.exe umhsuk.kk,znkefa

rundll32.exe umhsuk.kk,yfufqk

rundll32.exe umhsuk.kk,hmhjje

Also, the very similar memory sizes indicate this as well. They are multiple duplicate processes spawned this way to make it more difficult to clean. This, however, is one of the simpler and less advanced ways of protecting the viral processes, and so possibly indicates a relatively weak virus that should, hopefully, be easy to clean.

I highly recommend you go through some of the virus cleaning processes described in other questions in this site. I'll get links up shortly.

OK, here's the link to the exhaustive exploration of how best to go about cleaning viruses:

What to do if my computer is infected by viruses or malware

share|improve this answer
If you happen to have a pre-infection snapshot of the VM, that might be a simple fix – Dave M Sep 9 '11 at 17:02
Good point Dave M. I had not noted this was a VM or a server necessarily. – music2myear Sep 9 '11 at 19:14

Not the answer you're looking for? Browse other questions tagged or ask your own question.