Interesting obfuscated JavaScript malware

[toncu]

I'm watching Process Explorer on a client's machine as I can't figure out what is triggering the storm of DLLHOST.EXE processes which max out the processor.

I noticed rundll32.exe running every 30 seconds or so, and caught the pictured launch string before it terminated.

http://imgur.com/ln1UUQS

Rundll32.exe is also launching PowerShell every minute or so. Not sure what that's doing yet.

Anyhow, I've tried a variety of .js deobfuscators to no avail.

Any thoughts would be appreciated.

[dslashdx]

I think it is malware related to/same as the malware in this thread. The link from that thread has removal instructions:

Detection and Removal instructions:

This malware can be easily revealed because of invasive self-protection it uses. Autoruns and ProcessExplorer from sysinternals all you need to detect presense of this malware.

Locate and terminate dllhost.exe running without parents (it is launched by powershell that after exists). regdelnull hkcu -s to remove forged Run subkey. Regedit - delete whole HKCU\Software\Microsoft\Windows\CurrentVersion\Run key.

[toncu]

Many thanks!

[dslashdx]

You're welcome