Still problems after Smitfiles.txt

Discussion in 'Malware Help (A Specialist Will Reply)' started by lroush999, Aug 24, 2006.

Page 2 of 2
  1. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Please goto Add/Remove programs and uninstall the below two programs
    Notification Utility
    Viewpoint Media Player

    Then attach a new log from ShowNew and a new HJT log.

    Tell me what problems you are still having.
     
    chaslang, Aug 25, 2006
    #51
  2. lroush999

    lroush999 Private E-2

    Ok.. when I uninstalled the Notification Utility it gave me an error and said that it may have already been uninstalled, do I want to remove it from Add/Remove Programs, I said yes (hope that's okay)...

    Viewpoint Media Play uninstalled without incident (as far as I can tell)

    When I run ShowNew I still get the error message I mentioned in an earlier post (ntvdm.exe ).

    The files you requested are attached.

    I haven't recently reconnected to the Internet because at this point I'm frankly afraid of what will happen next. I still haven't addressed this 'Torpig' trojan that supposedly have - dont know if I should by the $50 software matt mentioned or if we can get rid of via other means...

    last time I connected to the internet it spawned hundreds of emails. since then I have deleted all of the 'allowed' areas from my firewall and blocked the rpcc.exe from accessing the internet. I didn't find the file on my computer, but I did stop the process with HJT. All I found was the pf file in preftech.

    Thanks in advance for anything you can do for me...
     

    Attached Files:

    lroush999, Aug 25, 2006
    #52
  3. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Okay that's good!

    I'll be giving you another fix to run in a few minutes! I just finishing it off now.


    No! You don't need it, but you should check everything out with financial institutions to be safe. I will be giving you another file to delete related to this trojan too.
     
    chaslang, Aug 25, 2006
    #53
  4. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Okay you have more left than I thought.

    Click on Start, then Run ... type services.msc into the box that opens up, and press 'OK'. On the page that opens, scroll down to Microsoft ASPI Manager ... then right click the entry, select 'Properties' and press 'Stop Service'. When it shows that it is stopped, next please set the 'Start-up Type' to 'Disabled'. Press 'OK' until you get back to Windows.

    Next, run HJT, but instead of scanning, click on the "None of the above, just start the program" button at the bottom of the choices. At the lower right, click on the 'Config" button, and then the Misc tools' button ... select 'Delete an NT Service" ... copy/paste the following into the box that opens, and press "OK":

    aspi113210

    If you receive any error messages just ignore them and continue.

    Now exit HJT but do not reboot when it tells you it needs to. We will do that further down while running the below fix

    Now please run this WareOut Removal and attach the c:\fixwareout\report.txt when finished with all of the below steps (I will remind you at the end).


    Now run HijackThis again and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
    O1 - Hosts: localhost 127.0.0.1
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [License Manager] "C:\Program Files\License_Manager\license_manager.exe " /silent
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {C4925E65-7A1E-11D2-8BB4-00A0C9CC72C3} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712...amai.com/6712/player/install3.0/installer.exe
    O20 - Winlogon Notify: obbf115 - obbf115.dll (file missing)
    After clicking Fix, exit HJT.:


    Now Copy the bold text below to notepad. Save it as fixme.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.
    Now reboot into safe mode and use Windows Explorer to delete the below:
    C:\Program Files\License_Manager <--- the whole folder
    C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00012.dll

    Now reboot into normal mode and attach new logs from:
    - GetRunKey
    - ShowNew
    - HijackThis
    - c:\fixwareout\report.txt

    You will need to post logs in two messages since only 3 can be attach in one message and there are 4 logs to attach.

    Tell me how everything is working now!
     
    chaslang, Aug 25, 2006
    #54
  5. lroush999

    lroush999 Private E-2

    ok.. I got to the point where I ran fixwareout.exe and the Setup dialog box comes up and just hangs there... nothing happens, no buttons to push?
     
    lroush999, Aug 25, 2006
    #55
  6. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Okay! Just skip the WareOut procedure and continue on to the rest.
     
    chaslang, Aug 25, 2006
    #56
  7. lroush999

    lroush999 Private E-2

    ok.. here ya go... I haven't had the nerve to plug in the cable to access the internet yet, but there weren't any errors on boot-up.. do you want me to go ahead and try the internet now? also, do you want me to try running fixwareout now that I've rebooted?

    also, I did get the error I've mentioned before when running shownew (ntvdm.exe)
     

    Attached Files:

    lroush999, Aug 25, 2006
    #57
  8. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    It looks like you did not fix some of the items I asked you to fix. Did you forget the to fix the below in HijackThis?
    O4 - HKCU\..\Run: [License Manager] "C:\Program Files\License_Manager\license_manager.exe " /silent
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

    Run HijackThis select the below lines and do not click fix until ALL browser windows are closed:

    O4 - HKCU\..\Run: [License Manager] "C:\Program Files\License_Manager\license_manager.exe " /silent
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O17 - HKLM\System\CCS\Services\Tcpip\..\{BB2D36A3-51B8-4249-9875-1CF0B2E4F32A}: NameServer = 85.255.116.102,85.255.112.199
    O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.116.102 85.255.112.199
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.116.102 85.255.112.199

    Now Look for the below fiolder and tell me if it exists!!!! Delete it if it does exist:
    C:\Program Files\License_Manager

    Now connect your cable to the internet and then try to run FixWareOut!

    Also run: Sophos Anti-Rootkit 1.0 and attach a log from it.
     
    chaslang, Aug 26, 2006
    #58
  9. lroush999

    lroush999 Private E-2

    I swear I deleted them. I was pretty meticulous about it. I ran HGJ and deleted them again (along with the other entries you gave me). I reran a scan to make sure they were gone. I have no c:\program files\license_manager folder.

    I connected to the internet and so far no issues. I was able to connect and post to this forum from the 'infected' pc.

    I still can't run FixWareOut - still no buttons to push.

    I ran Sophos (actually ran it twice as you will see from the log). I got an error when I ran it that said something about Microsoft needing to close the helper.exe file. It happened twice in each run. I ran it twice because I thought I missed the log file the first time. I then ran the readme and saw that it was creating a log somewhere, so I searched my computer and found it.

    Ok, I went back in to HJT to check one more time for those files and ONE OF THEM WAS BACK. The O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background was BACK. I fixed it again and rerun - logs are attached. What is up with that?
     

    Attached Files:

    lroush999, Aug 26, 2006
    #59
  10. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Okay let's fix this one a different way.

    Run this to remove it: Disable/Remove Windows Messenger

    I have to take a deeper look at the Sophos Rootkit report. Can you get me a real log from the lower window that reports their recommendations on what to fix and not to fix. It should look more like the below (note this is an example and it is not for your problems. It just shows more of what I'm looking for.)
    Also I would like a second report from the below new tool:

    AVG Anti-Rootkit 1.0.0.13 Beta
     
    chaslang, Aug 26, 2006
    #60
  11. lroush999

    lroush999 Private E-2

    ok.. I used the tool and unintalled Windows Messenger from my machine. I ran a HJT to make sure it was gone (appears to be) and I see my rpcc.exe friend is still sitting there now.. (this was after the reboot I had to do to install AVG). I thought about killing it, but decided to wait for what you had to say after you see my Sophos file...

    Also attached is my Sophos file. I noticed that most of them say they aren't removable.. is this an ominous sign that I'm totally out of luck?

    Also attached is the AVG log - also see that rpcc is found there too. How the heck did I get this darn thing?

    Computer seems to be working ok, although I am still afraid to let it sit online too long.. I disconnect it when not in use for now...

    On a scale of 1 - 10, 1 being real close, 10 being - you better go by a new PC.. how close are we to having this thing licked? Just curious..

    I really do appreciate all of your help.. I obviously would have never been able to do this without you!.
     

    Attached Files:

    lroush999, Aug 27, 2006
    #61
  12. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    It has been there all along. That is why we are running the rootkit tools so we can get more infor on it.

    But you did not attach a log from the AVG Rootkit tool. Please attach it.

    I'm not sure right now. You seem to have a different form of this rpcc.exe file that is using a rootkit to hide things. Previous ones that I have had to remove, were not using a rootkit and were simple to remove. We just stopped it from loading at startup and delete the file and that was it. It was gone at that point.

    I keep seeing the below in your HJT log.
    C:\WINDOWS\system32\cmd.exe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE

    From now on make sure you do not have any command prompt windows (cmd.exe) open and also make sure no browsers are running any time you use HJT.


    Now Copy the bold text below to notepad. Save it as fixme.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.
    Make sure viewing of hidden files is enabled (per the tutorial).

    Please run HijackThis and click on the Open the Misc Tools Section button on the open page. Then select Open process manager on the left-hand side. Look for the following process (or processes) and one at a time kill them by selecting it and then click Kill process. Then click yes.

    C:\WINDOWS\system32\rpcc.exe

    If it comes back right away don't worry about it, just continue.

    After killing all the above processes, click Back.
    Then please click Scan and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
    O4 - HKLM\..\Run: [rpcc] rpcc.exe

    After clicking Fix, exit HJT.


    Now run Pocket Killbox by doubleclicking on killbox.exe
    Choose Tools > Delete Temp Files and click Delete Selected Temp Files.
    Then after it deletes the files click the Exit (Save Settings) button.
    Now back on Killbox's main window, Paste the below filenames into KILL BOX one at a time. Check mark the box that says "Delete on Reboot" and checkmark the box "Unregister DLL" (If available) Click the RED X and it will ask you to confirm the file for deletion…say YES and when the next box opens prompting you to reboot now...click NO...and proceed with the next file. Once you get to the last one click YES and it will reboot. Note some of the files listed below may not exist but we need to check for them anyway.

    C:\WINDOWS\system32\rpcc.exe

    If Killbox does not reboot or if you get a Pending Operations type error message just click OK to continue and then just reboot your PC yourself.

    After reboot double check for the below file and delete it if found:
    C:\WINDOWS\system32\rpcc.exe

    Now attach a new HJT log and tell me how the steps went.

    Also attach a new log from ShowNew and a new log from Sophos Anti Rootkit.

    Make sure you tell me how things are working now!
     
    chaslang, Aug 28, 2006
    #62
  13. lroush999

    lroush999 Private E-2

    sorry about the AVG log, for some reason I had it saved as a csv file - and when I uploaded it majorgeeks didn't like it and I didn't notice it... I've attached it now as a text file... looks like it tells us what we already knew.. next post will contain the files and stuff from your instructions..
     

    Attached Files:

    lroush999, Aug 28, 2006
    #63
  14. lroush999

    lroush999 Private E-2

    ok.. I ran the fixme.reg without incident.

    When I went to HJT, I was able to kill the process, but when I went back to the scan, the registry entry wasn't there for me to 'fix'..

    I went ahead and ran killbox and I 'killed' the entry. I rebooted without any errors. I'm online and it doesn't appear as though anything funky is happening.

    I searched for the rpcc.exe file in c:\windows\system32 and didn't see it there. I did see it, however, in my HJT log (attached). Good news (I think) is that Sophos didn't detect it. I've attached the Sophos log and the more information on the one entry it did find. The Show New file is in the next post.

    Thanks again for everything you're doing!
     

    Attached Files:

    lroush999, Aug 28, 2006
    #64
  15. lroush999

    lroush999 Private E-2

    Here is the ShowNew file. Thanks!
     

    Attached Files:

    lroush999, Aug 28, 2006
    #65
  16. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Windows Search will not show hidden files or system files by default so unless you configure like in the below link, it would be a waste of time.

    Searching for Hidden Files on WinXP

    In addition, if the file is super hidden (like a rootkit can do), even the above will not show it.

    Run HijackThis and fix the below line now:

    O4 - HKLM\..\Run: [rpcc] rpcc.exe

    Exit HJT and reboot into safe mode.

    In safe mode, use Windows Explorer to delete the below files (make sure you have configure to view hidden and system files as in the READ & RUN ME step 2)

    C:\511c8624-6674-45a9-aa63-2b36766a5d30.cab
    C:\WINDOWS\system32\svchk.exe
    C:\WINDOWS\system32\ws386.ini
    C:\WINDOWS\system32\rpcc.exe <--- let's just double check again! ;)


    Now reboot into normal mode and attach new logs from HJT and ShowNew.

    How are things running now?
     
    chaslang, Aug 28, 2006
    #66
  17. lroush999

    lroush999 Private E-2

    OK! I am cautiously optimistic...

    I have had my settings set to show hidden files from the beginning, and I've also had the search options set to show hidden, etc. It must have been 'super hidden' like you said.

    anyway, I ran HJT and killed rpcc.exe (yeah - it felt good)

    I rebooted like you asked and deleted all the files you requested. Still could not locate c:\windows\system32\rpcc.exe

    Just to be safe I did a search on my whole pc for *rpcc* and I DID find an instance of it in c:\!Killbox (along with a few other things I've deleted). Is it okay for that to be there? I didn't do anything with it for now, so it's still there.

    I rebooted into normal mode, and things still seem to be OK. No errors and I ran my HJT and rpcc.exe was GONE! YEAH TEAM!! Let's hope it stays gone!

    I've attached the files you requested... are we close to having this thing killed???

    Is this rpcc.exe the torpig trojan, or something else? Are we sure the torpig thing is gone? I change my pwds for my bank, etc on another machine, but I just want to be sure it's gone before I go back to doing stuff on this machine.

    Thanks a million for your help.. you seem like a very busy person on this board.. I don't know how you do it! Do you have another job besides helping folks out on here?

    ok.. I'll stop taking up your time... what's our next move?

    Thanks!
    Lori
     

    Attached Files:

    lroush999, Aug 28, 2006
    #67
  18. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You can delete that whole backup folder for Killbox now.

    It is something totally different than Torpig. It actually has appeared in about 5 different forms. Only time will tell if it is really gone. Last time either something that you still had on your PC or someplace you surfed put it back on your PC after it was removed.

    You're welcome. Yes I have a real job! I just don't sleep. ;)


    If you are not having any other malware problems, it is time to go back to step 1 of the READ & RUN ME to Disable System Restore which will flush your Restore Points. Then reboot and enable System Restore to create a new clean Restore Point.

    After that, you should work thru the below link:

    How to Protect yourself from malware!
     
    chaslang, Aug 29, 2006
    #68
  19. lroush999

    lroush999 Private E-2

    I can't thank you enough.. I really thought there for a while that we would be reformatting this baby.. I have already gone through the steps to protect us from malware, including making a household ID for my family to use instead of the admin.. (now I'm the only one with POWER) :D

    I've done the System Restore and rebooted and reenabled.. I looked one more time for any critters using AdAware and Spybot and it only found one (Smitfraud?) that it fixed. Hopefully this will be the end of my troubles with malware (or it will be significantly reduced because I'm following your suggestions)

    anything I can do for you? do you take donations on the website? I feel like I should give back somehow...

    thanks again.. hope you get some more sleep.. I just had twin girls and I know what it's like to be in a sleep deprived haze!

    Thanks again,
    Lori
     
    lroush999, Aug 29, 2006
    #69
  20. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You're welcome.

    Privately via Paypal!

    Well congrats Mom! :D How old are they?
     
    chaslang, Aug 29, 2006
    #70
Page 2 of 2

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds