PDA

View Full Version : What's yrndlcit.exe?



itsleo
2008-01-10, 23:34
I searched for yrndlcit and yrndlcit.exe and found zero references... kinda surprising.

Anyway, this "yrndlcit.exe" was popping up several times a minute - I'd put it on the blacklist - but either I accidentally put it on the white list too or it managed to add itself - I was getting multiple boxes on the screen announcing that yrndlcit.exe was running because it was white listed followed by boxes announcing that it was terminated because it was blacklisted... somehow I got into the lists - don't recall what I did - and deleted the white list entry, so at least I don't see the *(&#$@ boxes anymore. But something's up - still... my desktop icons are all highlighted all the time, and the computer is slow, and it keeps kicking off IE (I use FF) and complaining about being offline (I have no intention of putting it online on my little home LAN until something is resolved - only one other computer is Windows, but...).

I saw the stickies about the procedure - S&D is running right now on the infected computer, so when it's done I'll d/l the other progs, CD them and copy onto El Sicko and run, if there's any point to it...

itsleo
2008-01-11, 16:49
I searched for yrndlcit and yrndlcit.exe and found zero references... kinda surprising.


Hmmm - no one seems to know anything about this?

Meanwhile - what happened when I S&D'ed it yesterday evening was that S&D found - I think - three copies of uhhhh virtumonde (or similar name), and claimed to fix them (registry entries). This morning when I fired it up (offline), it comes up to a blank desktop wallpaper screen - no icons, no taskbar... of course, that's only after about ten minutes of booting - actually probably more - I was doing some other stuff and it had alreaedy times out and gone back to the login.

tashi
2008-01-11, 17:35
Hello.


Hmmm - no one seems to know anything about this?


Well you started the topic yesterday and without providing logs, comments just add to a topic making it appear the user has been responded to, as mentioned in our sticky:
"BEFORE you POST"(READ this Procedure BEFORE Requesting Assistance) (http://forums.spybot.info/showthread.php?t=288)

Please start a new topic, then I will close this one as helpers look for zero response. ;)

itsleo
2008-01-11, 17:59
Hello.



Well you started the topic yesterday and without providing logs, comments just add to a topic making it appear the user has been responded to, as mentioned in our sticky:
"BEFORE you POST"(READ this Procedure BEFORE Requesting Assistance) (http://forums.spybot.info/showthread.php?t=288)

Please start a new topic, then I will close this one as helpers look for zero response. ;)

Okay - but, you might wish to note that I specifically mentioned what I was doing, why I wan't providing logs, and that I had in fact read the stickies, so it seems a little short-sighted of you to quote the "RTFM" stuff back at me.

As a matter of interest, can you tell me what's the deal with this "yrndlcit.exe"? I'm not sure I've ever run into something similar, i.e. with zero reference in the search engines... It occurred to me that either it's brand new (or really, really old) or it's one of those things that generates randomly-named executables... do you have any idea?


http://forums.spybot.info/showthread.php?t=22591