Stubborn Smitfraud.c - several procedures already tried

demanddeepbass · Dec 15, 2006

Hi guys, I've been using the archived posts on this site as a resource for a while to clean up various machines, thanks very much for all the help, however this one has me stumped! It's a smitfraud infection which arrived alongside torpig a little while back. I got rid of torpig fairly easily but spybot S&D is still flagging up the file rpcc.dll as being infected with smitfraud (no other scan programs seem to spot it though). I've run your suggested scan programs and I've been through heeps of other smitfraud removal posts on the net and tried several removal tools (smitrem, smitfraudfix, antipuper, spsehjfix etc) but no joy. It's disabling the windows firewall and anitvirus software. It also prevents access to the firewall settings page in control panel.
HJT log attached.

Any thoughts? I'm all out!

Cheers guys,

Olly

chaslang · Dec 15, 2006

Welcome to Majorgeeks!

demanddeepbass said:

I've run your suggested scan programs and
Click to expand...

Not sure what you are referring to, but you have not started with the procedure you need to follow.

Please follow our standard cleaning procedures which are necessary for us to provide you support. Also there are steps included for installing, RENAMING, running, and posting HijackThis logs as attachments.

Run ALL the steps in this Sticky thread READ & RUN ME FIRST Before Asking for Support

Make sure you check version numbers and get all updates.

Very Important: Make sure you tell us the results from running the tutorial...was anything found? Were you unable to complete any of the scans?...Were you unable to download any of the tools?...Did you do the on-line scans as suggested? etc.

After doing ALL of the above you still have a problem make sure you have booted to normal mode and run the steps in the below link to properly use HijackThis and attach a log:

Downloading, Installing, and Running HijackThis

Make sure you also rename HijackThis.exe as suggested in the procedures. Use analyse.exe for the new name. This is very important due to some new infections going around.

When you return to make your next post, make sure you attach the following logs and that you have run these scans in the following order too:

CounterSpy

AVG Antispyware log - ONLY IF NEEDED you were not able to run CounterSpy

Bitdefender - from step 6

Panda Scan - from step 6

runkeys.txt - the log from GetRunKey.bat

newfiles.txt - the log from ShowNew.bat

HijackThis

NOTE: You can only attach 3 files in a single message so it will require that you use two messages to attach all of these logs!

demanddeepbass · Dec 24, 2006

Hi Chas, thanks for responding, I had an Idea after my last post which seems to have worked so I thought I'd post back to say thanks and tell anyone else with the same problem what I did.
Spybot was the only scan program finding the problem; it listed two registry keys and the file rpcc.dll as infected. It was able to fix the registry but could not remove rpcc.dll. I tried loads of ways of deleting it but even killbox in safemode would not shift it and the registry keys were re-created every restart. I ended up booting from the windows install disk and using the recovery console thing to erase the file. Rescaning with all the programs suggested on this forum now shows nothing malicious.
I was still unable to enter the firewall settings page and the firewall its self was disabled but the procedure suggested here: file:///C:/Documents%20and%20Settings/Administrator/Desktop/sharedaccess.htm
has fixed that and all now seems to be back to normal.

Can you think of any other things I should check up on Chas?

cheers,

Olly

chaslang · Dec 25, 2006

You really should run the full procedure I gave to you. If you had that problem with rpcc.dll, there is a stong possiblity you may have other problems. Running the procedure and attach the logs will helps us to determine whether you are truly clean or not. However, I already know you have other infections based solely on your HijackThis log. The decision is yours.

Log in or Sign up

Stubborn Smitfraud.c - several procedures already tried

demanddeepbass Private E-2

Attached Files:

hijackthis(demanddeepbass).txt

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

demanddeepbass Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

Log in or Sign up

Stubborn Smitfraud.c - several procedures already tried

demanddeepbass Private E-2

Attached Files:

hijackthis(demanddeepbass).txt

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

demanddeepbass Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

Useful Searches