Solved MBAM cannot remove "culprit" access to 5.45.64.145/5.45.69.131

[Slartybart]

Thanks for the updates dsperber,

I'll take a look at the Farbar and ESET logs when you post them.

There's another good tool to empty all temp locations in case anything is hiding there.
I'll post it after the logs are up and you can run it at your connvenience.

Take a look at all broswers on the system (specifically home page, toolbars, and search engines) remove any add-ons that are not readily recognized. They can always be added back if they're needed.

Bill
.

 

[UsernameIssues]

It's disappointing to hear that Process Explorer did not find the infected DLL. Did you enable the view as shown in my screenshot above?

My guess is that the EXE was not infected, it was just being used to load the infected DLL.

 

[Jacee]

This Trojan is also a 'password stealing' Trojan. I would suggest that you let the client know, and have them change ALL their passwords, using a known "clean" computer.

 

[dsperber]

I'll take a look at the Farbar and ESET logs when you post them.

I'm attaching both of the Farbar logs... FRST and ADDITION.

ESET is just getting started so it will be probably 2 hours before its log is ready.

Also, even though it's 2/3 MBAM has not yet even produced a new log (i.e. the 2/2 log is the last one shown), because there has been ZERO reason. Last entry on the 2/2 log was at around 6PM EST regarding starting protection following the daily database update, with the previous last update about 2 hours prior.

I think we have emerged victorious.

There's another good tool to empty all temp locations in case anything is hiding there.
I'll post it after the logs are up and you can run it at your convenience.

I had done my own manual cleaning out of everything from the various TEMP folders on the machine as part of my early housecleaning and uninstall of any programs I saw in Control Panel that were unwanted, unnecessary, or possibly suspicious.

But I'll be glad to use whatever tool you can point me to that does the same thing automatically or perhaps more rigorously.

Take a look at all browsers on the system (specifically home page, toolbars, and search engines) remove any add-ons that are not readily recognized. They can always be added back if they're needed.

Took care of these over the weekend.

I think we're in pretty good shape now.

 

[dsperber]

This Trojan is also a 'password stealing' Trojan. I would suggest that you let the client know, and have them change ALL their passwords, using a known "clean" computer.

Good idea. Thanks for the suggestion.

I've just left them a phone message advising to do this. She's a "shopper".

 

[dsperber]

It's disappointing to hear that Process Explorer did not find the infected DLL. Did you enable the view as shown in my screenshot above?

Yes. And I showed the same Virus/Total column in read as your screenshot showed. It's just that the Virus count was 0.

My guess is that the EXE was not infected, it was just being used to load the infected DLL.

Agreed.

 

[dsperber]

HitmanPro log2
Malware
C:\Windows\system32\rpcss.dll -> PendingDelete
Size . . . . . . . : 550,912 bytes
Age . . . . . . . : 1555.3 days (2009-10-31 07:46:13)
Entropy . . . . . : 5.6
SHA-256 . . . . . : 0A22F667B7D77EC22D623CE5AE3C4218160386EE84EA90DC64036C60371EC763
Product . . . . . : Microsoft® Windows® Operating System
Publisher . . . . : Microsoft Corporation
Description . . . : Distributed COM Services
Version . . . . . : 6.0.6002.18005
Copyright . . . . : © Microsoft Corporation. All rights reserved.
Service . . . . . : RpcSs
> Bitdefender . . . : Trojan.Patched.Zekos.A
> Kaspersky . . . . : Trojan.Win32.Patched.pj
Fuzzy . . . . . . : 109.0
Startup
HKLM\SYSTEM\CurrentControlSet\Services\DcomLaunch\
HKLM\SYSTEM\CurrentControlSet\Services\RpcSs\

Interestingly, it would appear that a second copy of that DLL was stored on D, in the 15GB Dell Recovery Partition copy of Windows!!! And it was not discovered by any scan, and thus clearly also not deleted. But it's there... same as it was on the primary infected C, in D:\Windows\System32. I have to assume it's the same infected DLL (which is NOT present any longer in C in that original location).

Is it safe for me to just delete it manually myself from D?? And what about the possibility that Registry entries on that D version of Windows might have also been affected?

Actually, I'm all for just nuking that partition anyway using Partition Wizard and just resizing C (currently 85GB free out of 135GB partition) along with allocating a brand new D to be used for "system image" backup using Macrium Reflect. That's the right type of "recovery" that is needed to get CURRENT things back if needed, not through the Dell method to put things back to "factory".

Again, this is an old old but perfectly reliable and usable Vista machine and is in all likelihood NEVER going to need "recovery" using this arcane method, assuming it could even still be used.

I think I'm going to vaporize D, and then re-create it along with a resized C, to serve as an internal "backup" partition. Obviously in all the years they've had this Dell laptop they haven't had a need for this, but given what I see now I think it's a sensible thing to do.

 

[dsperber]

I'll take a look at the Farbar and ESET logs when you post them.

Posted Farbar log earlier.

Here's the ESET log (took 4 hours to complete).

Note that ESET found one "threat", which was I'm guessing somehow a "backup copy" of the RPCSS.DLL? It's got a different size, and it has a date from just a few days ago (Friday)... around the time when I think I may have been getting started on the disinfection process.

I'm not sure exactly what this is. But I did push the "delete quarantined items" button on ESET. However the item is still where it was found, so I don't think it really got deleted.

Concerned, I just ran HitmanPro again, and it found ZERO threats. So that's reassuring. Don't know why/how ESET would have noticed it and HitmanPro didn't.

Advice?? Should I (can I) manually delete it myself? Will Windows let me, or will it just restore it?

 

[Slartybart]

Yeah, I'm going to ask other members to look at the Farbar and ESET logs.

In the Fabar these "One month modified ..." might need to be verified
2014-01-31 18:36 - 2006-11-02 01:32 - 00008798 _____ () C:\Windows\system32\icrav03.rat
2014-01-31 18:36 - 2006-11-02 01:32 - 00001988 _____ () C:\Windows\system32\ticrf.rat
2014-01-29 21:29 - 2014-01-29 21:29 - 00000000 ____S () C:\Windows\system32\ubwvq.dqs
2014-01-28 19:01 - 2014-01-28 19:01 - 00000000 ____S () C:\Windows\system32\ifmhg.xgj
2014-01-26 08:56 - 2014-01-26 08:56 - 00028672 _____ () C:\Windows\system32\fdnzvw.cnw
2014-01-26 08:56 - 2014-01-26 08:45 - 00000100 _____ () C:\Windows\system32\ohwyn.tgy
2014-01-26 08:45 - 2014-01-26 08:45 - 00000064 _____ () C:\Windows\system32\yqqn.sxt

2014-01-04 11:46 - 2014-01-04 11:46 - 00101213 ____S () C:\Windows\system32\cdklx.uaf

2014-01-12 20:26 - 2013-12-20 17:02 - 00000000 ____D () C:\Users\susan\Desktop\T.MK801.S.14

Under "Bamital & volsnap Check "

C:\Windows\system32\rpcss.dll
[2009-10-31 07:46] - [2009-04-11 01:28] - 0550912 ____A (Microsoft Corporation) 150DB93F1299491B4AF6025650035AFD
ATTENTION ======> If the system is having audio adware rpcss.dll is patched. Google the MD5, if the MD5 is unique the file is infected.
​

I googled the MD5 and it is unique - no matched found.

In the Farbar Additional file, there are a number of recent (today) events in the event logs.
Look at the tail end of the file or use event viewer on the system.

I'd feel more comfortable if a member on the security team took a look. Jacee has already stopped in and is a bit familiar with thread.
- this is a Vista machine, correct?

Recap scans: How to easily clean an infected computer (Malware Removal Guide) and Farbar FRST

Bill
.

 

[Slartybart]

Let's see what SFC can tell you about Sytem file integrity.

Follow Option Two and Option Three in: http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html

 

[dsperber]

Yeah, I'm going to ask other members to look at the Farbar and ESET logs.

I know nothing here about these things, so I will listen to any comments and/or advice from those more knowledgeable.

Under "Bamital & volsnap Check "

Where are you seeing this??

C:\Windows\system32\rpcss.dll

[2009-10-31 07:46] - [2009-04-11 01:28] - 0550912 ____A (Microsoft Corporation) 150DB93F1299491B4AF6025650035AFD
ATTENTION ======> If the system is having audio adware rpcss.dll is patched. Google the MD5, if the MD5 is unique the file is infected.
​

I googled the MD5 and it is unique - no matched found.

I don't understand. What are you looking at? What are you looking at that shows that "attention" remark??

That RPCSS.DLL is no longer in C:\Windows\System32, having been deleted by HitmanPro.

In the Farbar Additional file, there are a number of recent (today) events in the event logs.
Look at the tail end of the file or use event viewer on the system.

What "recent events" are you referring to?

I'd feel more comfortable if a member on the security team took a look. Jacee has already stopped in and is a bit familiar with thread.

It was suggested that I invite Noeldp to look at this thread, and I've PM'd him.

- this is a Vista machine, correct?

Correct. A Dell laptop.

 

[dsperber]

Let's see what SFC can tell you about Sytem file integrity.

Well, not surprisingly, it's unhappy with the state of RPCSS.DLL... and if I read the details correctly also says it cannot do the repair because the backup is also damaged.

I've edited the SFCDETAILS.TXT file to contain only the relevant "problematic" sections, eliminating the insignificant lines.

You know... maybe the version that is over on the D Recovery Partition is a GOOD ONE, not a copy of the bad one! The date on the D-version is from 1/19/2008 2:36:17AM 547,328 bytes, whereas the problem one found by HitmanPro was dated 2009 and is 3,000 bytes larger.

So even though the repair of C's RPCSS.DLL cannot be done because the C-backup is also corrupt, it seems possible to recover it from the D-version if we believe it to be a valid one.

Thoughts??

 

[dsperber]

Do I need to run SFC /SCANNOW three times in a row, to eventually find the correct original 2008 backup?

If you look at my earlier screenshot where I was looking for RPCSS.DLL with Everything, you see that it occurs in MULTIPLE folders in C:\Winsxs. And there is one from 1/20/2008 which is the correct 535KB (which is the correct size, if we go by what is shown in the screenshot living on the D Recovery partition), whereas the later backups starting in 2009 are 538KB (which is the problematic size).

I've never used SFC /SCANNOW, but I do know that sometimes you need to run three "repairs" in order to finally get things fixed. I guess each subsequent repair uses a successively older backup??

Note from the following screenshot that it looks like the SFC repair I just did has restored a version of RPCSS.DLL into C:\Windows\System32... and it's the defective one.

I'm going to run the repair three more times, and see if I can recover that 2008 version which should be the right one.

 

[dsperber]

Well, I guess my guess was wrong. Doesn't pick up successively older backups with each running of SFC /SCANNOW. It just leaves the 550,912 byte version.

Obviously the 547,328 byte version from 2008 is now clearly recognized as the right original Windows version to shoot for (which matches the untouched version on the D Recovery partition).

Re-run of HitmanPro again again deletes that version (although it's been rendered "harmless" by the previous cleansing of the Registry of the crucial related entries, so that it will no longer start at boot time even if present). It also deletes the backup version. See attached log file.

Interestingly, there is a "$$DELETEME..." version of the corrupt RPCSS.DLL that I don't know exactly where it came from... either the SFC repair, or the rerun of HitmanPro (which seems unlikely)?? It won't go away, but it is the bad object.

I give up for now. I need further advice on how to manually recover the 547,328 version from 2008... either from the C:\Windows\Winsxs backup where it lives, or from the D Recovery partition.

 

[Slartybart]

Sorry dsperber, I shoveled a lot of snow yesterday and fell asleep early.

Let me catch up answering your posts.

Post 47 -> D:\Recovery.
The rpcss.ddl in D:\Recovery is the base install for a Dell Vista - or should be. A scan didn't pick it up so, it's probably NOT infected. If the MD5 is unique then you'll have to sig a little deeper, but methinks it's ok.

I would make the OEM Recovery discs before nuking D:

Post 48 -> ESET
C:\Windows\winsxs\Backup\x86_microsoft-windows-com-base-qfe-rpcss_31bf3856ad364e35_6.0.6002.18005_none_6bb655083b01c988_rpcss.dll_fd3e269b
>> Win32/Patched.IB trojan error while cleaning
This is in the backup folder for Winsxs - ESET failed to clean it, perhaps because it's in winsxs.
I'm not sure what to do with it.

Post 51 -> Ervery thing you ask about was found in:
http://www.sevenforums.com/attachme...ccess-5-45-64-145-5-45-69-131-farbar_frst.txt
or
http://www.sevenforums.com/attachme...s-5-45-64-145-5-45-69-131-farbar_addition.txt

I'll look at the SFC log next.

 

[Slartybart]

Yep, you read it correctly. Noel might want to see the entire log.

The rpcss.dll in D:\Recovery is probably good, getting it might be difficult. On my HP, the part is hidden and has a destop.ini that puts up a HTML screen when you view the part. Getting around that is the easy part.

The base Windows files needed to begin a Recovery are or should be visible, but everything else is packed away in the install wim files.

Gregrocker is a whiz at this stuff.

Just make sure every one knows this is VISTA, Noel particularly. He might offer you replacement file(s) from Win7 if that is left unclear.

I'll go back thru the thread and collect your logs. I like to make it easier for people coming in cold to a thread. I'll match the log fiels to the malware guide, and try to make chronological order out of it.

Bill
.

 

[Slartybart]

dsperber is working on a friend's machine: Dell / Vista SP2

Post 1 -> Malwarebytes Pro alerted dsperber when it blocked IP addresses.
Mbam did not find or contain the threat.

Post 11 /12 - > AdwCleaner log wrapped in a code box on post.

Post 23: I directed dsperber to this: How to easily clean an infected computer (Malware Removal Guide)

Post 27 -> initial FRST log:

Scan_2014-2-1-14-54.txt

Jacee recommends clearing java cache and flushing DNS, dsperber complies.

Post 30 -> JRT run out os sequenct, no harm no foul - nothing found anyway

Post 36 -> Hitman Pro & Mbam logs

HitmanPro_20140202_1454.log

HitmanPro_20140202_1459.log

MBAM_log.txt

Post 43 -> Jacee alert re: Trojan password stealer, dsperber complies.

post 44 - > Farbar logs

Farbar_FRST.txt

Farbar_Addition.txt

Post 48 - ESET log

ESET.txt

Post 53 -> SFC log

sfcdetails.txt

The malware removal guide has more scanners in it than there are logs posted.
Can you backfill the logs for the scanners in red:
[[FONT=Webdings, serif]a[/FONT]] Kaspersky TDSSKiller
[[FONT=Webdings, serif]a[/FONT]] RKill
[[FONT=Webdings, serif]a[/FONT]] Malwarebytes Anti-Malware Free
[[FONT=Webdings, serif]a[/FONT]] HitmanPro
[[FONT=Webdings, serif]a[/FONT]] RogueKiller
[[FONT=Webdings, serif]a[/FONT]] AdwCleaner
[[FONT=Webdings, serif]a[/FONT]] Junkware Removal Tool
Checking the system after the clean
[[FONT=Webdings, serif]a[/FONT]] ESET Online Scanner.
[[FONT=Webdings, serif]a[/FONT]] Emsisoft Emergency Kit.


Edit: Post 61 -> missing logs posted

Rkill.txt

RKreport[0]_D_02022014_151303.txt

JRT.txt

HitmanPro_20140204_0105.log

Post 64 - > EMSISoft log

EMSISoft.txt

Post 68 -> Kaspersky TDSSKiller log

TDSSKiller.3.0.0.19_02.02.2014_14.18.47_log.txt

Thanks,

Bill

 

[Slartybart]

The System Update Readiness Tool (SURT) might help, I'm not sure.
SURT used to carry a few cabs when it was used to prepare Vista for an ungrade to Win7.
Lately though, SURT on Win7 is related to Windows Update issues only.

Download the correct bit depth Vista version form here: What is the System Update Readiness Tool?

It's big and it's slow - just so you know.

Bill
.

 

[tom982]

This will fix up your SFC corruption

SFCFix Script

Warning: this fix is specific to the user in this thread. No one else should follow these instructions as it may cause more harm than good. If you are after assistance, please start a thread of your own.

1. Download SFCFix.exe (by niemiro) and save this to your Desktop.
2. Download the file below, SFCFix.zip, and save this to your Desktop. Ensure that this file is named SFCFix.zip - do not rename it.
3. Save any open documents and close all open windows.
4. On your Desktop, you should see two files: SFCFix.exe and SFCFix.zip.
5. Drag the file SFCFix.zip onto the file SFCFix.exe and release it.
6. SFCFix will now process the script.
7. Upon completion, a file should be created on your Desktop: SFCFix.txt.
8. Copy (Ctrl+C) and Paste (Ctrl+V) the contents of this file into your next post for me to analyse please - put [CODE][/CODE] tags around the log to break up the text.

https://dl.dropboxusercontent.com/u/16537616/Fixes/SFCFix/Scripts/dsperber/SFCFix.zip

SFC Scan

1. Click on the Start
   
   button and in the search box, type Command Prompt
2. When you see Command Prompt on the list, right-click on it and select Run as administrator
3. When command prompt opens, copy and paste the following commands into it, press enter after each
   
   sfc /scannow
   
   Wait for this to finish before you continue
   
   copy %windir%\logs\cbs\cbs.log %userprofile%\Desktop\cbs.txt
   
   
4. This will create a file, cbs.txt on your Desktop. Please attach this to your next post.

 

[cottonball]

dsperber,

tom982's guidance will fix the rpcss.dll issue, however, since you already downloaded and ran FRST, please do the following:

Please run FRST again and type the following in the input box after Search: rpcss.dll
Click the Search button

When done, a report, Search.txt, is created.

Please post the results of the Search.txt in your reply.

When tom is done, we need to use FRST again, and make sure there are no remnants lurking.

Thanks!