Solved MBAM cannot remove "culprit" access to 5.45.64.145/5.45.69.131

cottonball · Feb 5, 2014

Good job!!

tom982 is probably getting some

at this time, but, I'm sure he will be with you as soon as he can.

Please do not run any other programs in the meantime.

Thank you for your patience!

tom982 · Feb 6, 2014

Great work, cottonball! Now that you're clean, we can perform the last bit of the fix:

SFCFix Script

Warning: this fix is specific to the user in this thread. No one else should follow these instructions as it may cause more harm than good. If you are after assistance, please start a thread of your own.

Download SFCFix.exe (by niemiro) and save this to your Desktop.
Download the file below, SFCFix.zip, and save this to your Desktop. Ensure that this file is named SFCFix.zip - do not rename it.
Save any open documents and close all open windows.
On your Desktop, you should see two files: SFCFix.exe and SFCFix.zip.
Drag the file SFCFix.zip onto the file SFCFix.exe and release it.
SFCFix will now process the script.
Upon completion, a file should be created on your Desktop: SFCFix.txt.
Copy (Ctrl+C) and Paste (Ctrl+V) the contents of this file into your next post for me to analyse please - put [CODE][/CODE] tags around the log to break up the text.

https://dl.dropboxusercontent.com/u/16537616/Fixes/SFCFix/Scripts/dsperber/SFCFix.zip

SFC Scan

Click on the Start

button and in the search box, type Command Prompt
When you see Command Prompt on the list, right-click on it and select Run as administrator
When command prompt opens, copy and paste the following commands into it, press enter after each

sfc /scannow

Wait for this to finish before you continue

copy %windir%\logs\cbs\cbs.log %userprofile%\Desktop\cbs.txt
This will create a file, cbs.txt on your Desktop. Please attach this to your next post.

Tom

dsperber · Feb 6, 2014

tom982 said:
SFCFix Script

Warning: this fix is specific to the user in this thread. No one else should follow these instructions as it may cause more harm than good. If you are after assistance, please start a thread of your own.

Download SFCFix.exe (by niemiro) and save this to your Desktop.

Download the file below, SFCFix.zip, and save this to your Desktop. Ensure that this file is named SFCFix.zip - do not rename it.

Save any open documents and close all open windows.

On your Desktop, you should see two files: SFCFix.exe and SFCFix.zip.

Drag the file SFCFix.zip onto the file SFCFix.exe and release it.

SFCFix will now process the script.

Upon completion, a file should be created on your Desktop: SFCFix.txt.

Copy (Ctrl+C) and Paste (Ctrl+V) the contents of this file into your next post for me to analyse please - put [CODE][/CODE] tags around the log to break up the text.

https://dl.dropboxusercontent.com/u/16537616/Fixes/SFCFix/Scripts/dsperber/SFCFix.zip

Step 2 is still running, so I thought I'd post the results of the above Step 1.

Log is attached.

Here is a screenshot of the current state of things regarding RPCSS.DLL following the above SFCFix.

I will post the results of the /SCANNOW along with a second screenshot again showing the whereabouts of RPCSS.DLL in my next reply, when it finishes.

dsperber · Feb 6, 2014

tom982 said:
SFC Scan

Click on the Start

button and in the search box, type Command Prompt

When you see Command Prompt on the list, right-click on it and select Run as administrator

When command prompt opens, copy and paste the following commands into it, press enter after each

sfc /scannow

Wait for this to finish before you continue

copy %windir%\logs\cbs\cbs.log %userprofile%\Desktop\cbs.txt

This will create a file, cbs.txt on your Desktop. Please attach this to your next post.

I believe we have liftoff!

Looks like SFC /SCANNOW has correctly replaced the infected 550,912 byte version of RPCSS.DLL (which just a moment ago was in C:\Windows\System32) with the new 550,400 byte clean one you provided in the ZIP file going into SFCFix.

I'm attaching the log from the /SCANNOW.

Now... the only remaining item is that there are now TWO copies of the infected version of RPCSS.DLL still living in \Winsxs\Temp\PendingDeletes of the form $$DELETEME.... Previously there was only one. So obviously it is the SFC /SCANNOW which is creating these.

However I myself cannot delete them (access denied). So how are they supposed to get deleted??? I don't want them on my system, as they are the infected versions. Even though HitmanPro long ago (several days ago) removed the crucial activating Registry entries so that these two $$DELETEME versions are harmless, I still want to delete them... as their name suggests was intended.

So, how does one go about deleting them??

Anyway, this long and arduous process does appear to be just about at its true completion once these two $$DELETEME files are finally deleted. They are the only existing copies of the infected RPCSS.DLL remaining on the disk.

Can't thank all of you who contributed anything at all enough. Reps will be given all around!

cottonball · Feb 6, 2014

dsperber,

Not to worry...

There are several hours of time difference between tom982 and us, so, we need to wait for his assessment of the replacement by SFC.

tom982 · Feb 7, 2014

Excellent! The repair went through, and SFC has been able to reform the hardlinks:

Code:

RtlRunPrimitiveOperationsFromCallbacksAgainstSil(...)[gle=0xd0000121]
2014-02-06 14:41:47, Info                  CSI    000001bc [SR] Unable to complete Verify and Repair transaction because some of the files that need to be repaired are in use. A reboot is required to complete this operation.
2014-02-06 14:41:47, Info                  CSI    000001bd [SR] Repairing 1 components
2014-02-06 14:41:47, Info                  CSI    000001be [SR] Beginning Verify and Repair transaction
2014-02-06 14:41:47, Info                  CSI    000001bf Hashes for file member \??\C:\Windows\System32\rpcss.dll do not match actual file [l:18{9}]"rpcss.dll" :
  Found: {l:32 b:LoH+3oc4UsIVMAq3bp2C8hqqNYK8qz7aMTs/OXlfwY4=} Expected: {l:32 b:7AKkEtpf3ix1mkosWQRXnhznxJmc6HFFgS81T8j14YM=}
2014-02-06 14:41:47, Info                  CSI    000001c0 [SR] Repairing corrupted file [ml:520{260},l:46{23}]"\??\C:\Windows\System32"\[l:18{9}]"rpcss.dll" from store
2014-02-06 14:41:47, Info                  CSI    000001c1 Repair results created:
POQ 85 starts:
     0: Move File: Source = [l:192{96}]"\SystemRoot\WinSxS\Temp\PendingRenames\7afaf9787323cf01d22300005c133c07._0000000000000000.cdf-ms", Destination = [l:104{52}]"\SystemRoot\WinSxS\FileMaps\_0000000000000000.cdf-ms"
    1: Move File: Source = [l:162{81}]"\SystemRoot\WinSxS\Temp\PendingRenames\9a1e01797323cf01d32300005c133c07.$$.cdf-ms", Destination = [l:74{37}]"\SystemRoot\WinSxS\FileMaps\$$.cdf-ms"
    2: Move File: Source = [l:214{107}]"\SystemRoot\WinSxS\Temp\PendingRenames\7a050d797323cf01d42300005c133c07.$$_system32_21f9a9c4a2f8b514.cdf-ms", Destination = [l:126{63}]"\SystemRoot\WinSxS\FileMaps\$$_system32_21f9a9c4a2f8b514.cdf-ms"
    3: Hard Link File: Source = [l:246{123}]"\SystemRoot\WinSxS\x86_microsoft-windows-com-base-qfe-rpcss_31bf3856ad364e35_6.0.6002.18005_none_6bb655083b01c988\rpcss.dll", Destination = [l:66{33}]"\??\C:\Windows\System32\rpcss.dll"

POQ 85 ends.
2014-02-06 14:41:47, Info                  CSI    000001c2 [SR] Repair complete

So we've fixed rpcss.dll; now for the next issue! I suspect this issue will be fixed if you reboot, so reboot your computer and let me know how it goes. This error is a little worrying though, it's unusual for an issue like this to return a fatal (F) error like this:

Code:

2014-02-06 14:41:47, Error                 CSI    000001bb (F) STATUS_CANNOT_DELETE #4098596# from

If they don't get removed over a reboot then we'll have to do it manually.

Tom

dsperber · Feb 7, 2014

tom982 said:
now for the next issue! I suspect this issue will be fixed if you reboot, so reboot your computer and let me know how it goes.

Well, I re-booted but I don't know what you expect to happen. I had already re-booted previously (following the SFC /SCANNOW) and the results posted reflected that re-boot. And there were still the two $$DELETEME versions of the corrupted RPCSS.DLL still sitting there in \Winsxs\Temp\PendingDeletes, having been created there by SFC but not actually deleted.

So I didn't have any expectations about seeing those two files disappear upon a new re-boot. And in fact they did NOT disappear. They're still there.

So I don't know what else you've described as "the next issue". Is it these two files that don't seem to actually ever get deleted? Or is it some other file?

Also, I ran my own screenshot looking for RPCSS.DLL, posted above. But if you wanted me to run some other scan utility you didn't mention it. So I don't know what you expected me to provide in this reply that would tell you "how it went"?? What log file or other output are you wanting me to generate and post for you to look at, now that I've re-booted?

I'd like to get rid of those two $$DELETEME files, and it sounds like you've seen (in the SFC log) a third file that didn't get deleted either... although I don't know what that file is.

Waiting for your next instructions.

tom982 · Feb 7, 2014

Cottonball, would you mind killing off this folder with FRST please? I'm not sure what permissions are on this folder and it's subfiles, but I'm guessing it will be a little more than a right click > delete and the only tools I know to do a job like this are the malware removal ones, ie tools I'm not allowed to use yet (the fun ones!)

C:\Windows\winsxs\Temp\PendingDeletes

Tom

dsperber · Feb 7, 2014

tom982 said:
Cottonball, would you mind killing off this folder with FRST please?

C:\Windows\winsxs\Temp\PendingDeletes

So is this the last of it, and the two files inside it?

Or was there some other third file that you'd noticed in the SFC log which also must be dealt with? That's what I thought you were pointing out.

cottonball · Feb 7, 2014

@tom982:

Not quite sure we can nuke: PendingDeletes
To my understanding, the files in it are files that Windows has designated for deletion in the future...??

On the CSI issue you pointed out, have no clue on what it is.
My idea of CSI is "Crime Scene Investigation"

@dsperber:

Let's find the path of the files, and will press on from there.

:info: Please run FRST again and type the following in the input box after Search:

Code:

C:\Windows\winsxs\Temp\PendingDeletes\$$DeleteMe.*

Click the Search button

When done, a report, Search.txt, is created.

Please post the results of the Search.txt in your reply.

If the above shows no results, use this input instead:

Code:

C:\Windows\winsxs\Temp\PendingDeletes\$$DeleteMe.rpcss.dll.01cf2373a53dd39a.0000
C:\Windows\winsxs\Temp\PendingDeletes\$$DeleteMe.rpcss.dll.01cf2163f246e720.0000

:info: Also run SystemLook:
http://jpshortstuff.247fixes.com/SystemLook.exe

•Double-click SystemLook.exe to run it.
•Copy the content inside the codebox into the input field:

Code:

:filefind
C:\Windows\winsxs\Temp\PendingDeletes\$$DeleteMe.*
C:\Windows\winsxs\Temp\PendingDeletes\$$DeleteMe.rpcss.dll.01cf2373a53dd39a.0000
C:\Windows\winsxs\Temp\PendingDeletes\$$DeleteMe.rpcss.dll.01cf2163f246e720.0000

•Click the Look button to start the scan.
•When finished, a notepad window opens with the results of the scan.

Also post the SystemLook report in your reply.

Thanks.

.

tom982 · Feb 7, 2014

dsperber said:
tom982 said:

Cottonball, would you mind killing off this folder with FRST please?

C:\Windows\winsxs\Temp\PendingDeletes

Click to expand...

So is this the last of it, and the two files inside it?

Or was there some other third file that you'd noticed in the SFC log which also must be dealt with? That's what I thought you were pointing out.

I'm in a rush so I've got to keep this short. The error didn't actually mention a file, but I suspect it was one of the two you found; in answer to your question, no there isn't a third file

dsperber · Feb 7, 2014

cottonball said:
:info: Please run FRST again
If the above shows no results, use this input instead:

Code:

C:\Windows\winsxs\Temp\PendingDeletes\$$DeleteMe.rpcss.dll.01cf2373a53dd39a.0000 C:\Windows\winsxs\Temp\PendingDeletes\$$DeleteMe.rpcss.dll.01cf2163f246e720.0000

Didn't work with the complete path/file in the search argument.

But with just the file name in the search, it did do what you wanted.

Log attached.

:info: Also run SystemLook:
http://jpshortstuff.247fixes.com/SystemLook.exe

•Double-click SystemLook.exe to run it.
•Copy the content inside the codebox into the input field:

Again, the search only expects the file name, not the complete path.

Log attached.

cottonball · Feb 7, 2014

dsperber,

:info: Once again, please open notepad (Start > All Programs > Accessories > Notepad)

Copy the entire contents of the code box below (Do not copy the word 'code') to Notepad.
Save it to the Desktop, and name it: fixlist.txt

Note: The fixlist.txt and FRST must both be on the Desktop, or this will not work!

Code:

start
C:\Windows\winsxs\Temp\PendingDeletes\$$DeleteMe.rpcss.dll.01cf2163f246e720.0000
C:\Windows\winsxs\Temp\PendingDeletes\$$DeleteMe.rpcss.dll.01cf2373a53dd39a.0000
end

Now, please run FRST, and press the Fix button just once, and wait.

When done, the tool creates a report on the Desktop called: Fixlog.txt

Please post the Fixlog.txt in your reply.

dsperber · Feb 7, 2014

cottonball said:
dsperber,

:info: Once again, please open notepad (Start > All Programs > Accessories > Notepad)

Copy the entire contents of the code box below (Do not copy the word 'code') to Notepad.
Save it to the Desktop, and name it: fixlist.txt

Now, please run FRST, and press the Fix button just once, and wait.

When done, the tool creates a report on the Desktop called: Fixlog.txt

Please post the Fixlog.txt in your reply.

Well, I do believe we're finished here! GONE.

Log attached.

'Twas a long, hard journey, but we have emerged victorious!

Now this thread REALLY is "solved".

Time to spread the "reps". Again, can't thank you all enough for your patience and help over this past week.

UsernameIssues · Feb 7, 2014

Glad that you got it all sorted

cottonball · Feb 7, 2014

Great job, dsperber!!!

Please give me a day or so to go over the entire thread, and then we can wrap up.

dsperber · Feb 7, 2014

UsernameIssues said:
Glad that you got it all sorted

Indeed.

And when it rains it pours...

I finally got reconnected to my cousin's Win7 HP desktop machine in NY, using TeamViewer instead of RealVNC. I'd been prevented from connecting for the past few months ever since I changed the port-forwarding configuration on his Verizon modem/router for additional security (and to try and thwart "port scanners" who were trying to get through port 5900 on every RealVNC-enabled machine I support for friends and family). I think it's a problem with the Verizon router, but whatever the explanation I could never again get to the VNC Server running on his machine.

Having recently learned about TeamViewer (which uses a different connectivity approach than VNC and does not require opening ports on a router and adding Windows Firewall exceptions), I had him install TeamViewer yesterday and now sure enough I was finally able to get onto his PC to help him out with what his real issue... which was DEADLY SLOW COMPUTER BEHAVIOR!

I of course was immediately suspicious of some type of infection/malware, especially as he's an AOL user. And although I had long ago installed Microsoft Security Essentials on his machine I'd not been able to install Anti-Malware since I haven't had connectivity through VNC for several months now... at least not until yesterday when I had him install TeamViewer.

Initial inspection through Task Manager showed constant 100% CPU usage. This was essentially from what appeared to be multiple copies of Internet Explorer running simultaneously, and burning up all the CPU.

Ok. It took a VERY LONG time to get everything run (because I kept fighting with numerous seemingly self-launching copies of what Task Manager claimed were IEXPLORE.EXE and IEXPLORE32.EXE tasks, and when I'd END TASK them, and they'd just re-launch!) because the machine was so deadly slow. But eventually I finally completed running the same "recipe" of scan/DELETE malware-detecting utilities that I just came through myself this past week on my friend's Vista laptop in Florida.

And sure enough, there was PLENTY OF MALWARE PRESENT.

And with the results of each completed utility scan I also pushed the DELETE button to remove everything which had been discovered. This included MBAM Pro (which I installed on his machine) and RogueKiller, both of which detected various threats and objects worthy of deleting through their scans.

And once again, it was HitmanPro which found (a) a Trojan, sorry can't remember its name and I've since deleted the log, along with Registry entries, and (b) even FIREFOX.EXE was "infected" and had to be quarantined (the rest of the items and cookies and dangerous PREFS.JS lines for Firefox could be permanently deleted)!

I also uninstalled several "questionable" and obviously unwanted programs using Control Panel, as well as reverting his home page in IE from what had become (probably unnoticed by him) xol-dot-com instead of aol-dot-com as it should have been. To get Firefox back I also reinstalled a freshly downloaded v27 copy of the installer, since the infected FIREFOX.EXE had been quarantined.

I also discovered that Windows Firewall had been disabled (actually, the Service had been disabled, probably by the malware) and I re-enabled that as well.

And, in the end, the machine is now once again seemingly working perfectly and up-to-speed. Obviously it helps not to have 8 copies of "IE" trying to get started simultaneously, not to mention what plug-ins were previously active, not to mention what was happening when Firefox was launched (unaware that it was infected as well).

You can't imagine how appreciative my cousin was to me (and, by implication, from me to all-of-you for what I learned this past week on this thread) for how his PC has now "come completely back to life", from being essentially "dead".

Hopefully the newly installed presence of MBAM will help guard against possible future infections (again, AOL users seem to be particularly vulnerable of late).

When it rains it pours.

UsernameIssues · Feb 7, 2014

I hope that you did most of that cleanup work while in the safe mode. Fewer bad things should be running while in the safe mode. Teamviewer works in the safe mode

One of the computers that I remote into would not connect via TeamViewer today. This makes two computers this week that has not let me back in using TeamViewer. That is why I like to have a second or third way to get in.

cottonball · Feb 8, 2014

Let's remove the following tools used and their reports, since these tools are updated frequently, and it is best to have a new copy:

AdwCleaner > Run the tool, and press: Uninstall
TDSSKiller
RKill
RogueKiller
Junkware Removal Tool
Farbar Recovery Scan Tool, its C:\FRST folder, and associated reports
SFCFix.zip
SFCFix.exe
cbs logs

The ESET Online Scan is a program you may want to use every so often.

Also, make sure security software is ALL enabled and running!

Thanks for following all the instructions and providing the reports!!

Have a great week, dsperber!!

Slartybart · Feb 9, 2014

I got power back yesterday and Internet back today, sorry for my absence. The storm itself wasn't that bad, but those early 20th century wires couldn't carry the weight of the ice. Transformers were blowing for 30 miles in all directions (mostly east and west). It was fun... like camping in the winter... cold and dark.... makes you appreciate what you have the rest of the time.

First, I want to say that this was a great example of team effort - thanks go out to everyone.

Second, make sure your friend keeps the machine protected with an up-to-date real time A/V program and that they practice safe surfing / messaging. Malware can get part even the best protection, so run a on-demand scanner once a month (ESET is good, but slow... Mbam and AdwCleaner are good quick checks) pick a few and run them periodically (those are the three that I use to see if anything got past Avast! be free)

Third, I'll add to Cottonball's cleanup list - TDSSkiller logs on C:\ can be removed.

Fourth, I learned a few things (as usual here on SF) -
SFCfix will be new and improved!
FRST can kill off winsxs files.. although one of the pending deletes required a restart - has that already been done?

From the FRST fixlog:
Could not move "C:\Windows\winsxs\Temp\PendingDeletes\$$DeleteMe.rpcss.dll.01cf2163f246e720.0000" => Scheduled to move on reboot.
C:\Windows\winsxs\Temp\PendingDeletes\$$DeleteMe.rpcss.dll.01cf2373a53dd39a.0000 => Moved successfully.
=> Result of Scheduled Files to move (Boot Mode: Normal) (Date&Time: 2014-02-07 19:40:56)<=

C:\Windows\winsxs\Temp\PendingDeletes\$$DeleteMe.rpcss.dll.01cf2163f246e720.0000 => Is moved successfully.

So now you're helping your cousin in NY - did I read that corerctly?

Good luck with that project - open a new thread if you think you need help on that.

Bill

Solved MBAM cannot remove "culprit" access to 5.45.64.145/5.45.69.131

Retired ol' hound...

My Computer My Computer

At a glance

&#1641;(&#865;&#3663;&#815;&#865;&#3663;)&#1782;

My Computer My Computer

At a glance

New member

Attachments

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

Retired ol' hound...

My Computer My Computer

At a glance

&#1641;(&#865;&#3663;&#815;&#865;&#3663;)&#1782;

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

&#1641;(&#865;&#3663;&#815;&#865;&#3663;)&#1782;

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

Retired ol' hound...

My Computer My Computer

At a glance

&#1641;(&#865;&#3663;&#815;&#865;&#3663;)&#1782;

My Computer My Computer

At a glance

New member

Attachments

My Computer My Computer

At a glance

Retired ol' hound...

My Computer My Computer

At a glance

New member

Attachments

My Computer My Computer

At a glance

a.k.a. UNI

My Computer My Computer

At a glance

Retired ol' hound...

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

a.k.a. UNI

My Computer My Computer

At a glance

Retired ol' hound...

My Computer My Computer

At a glance

Re Member

My Computer My Computer

At a glance

My Computer

٩(͡๏̯͡๏)۶

My Computer

My Computer

My Computer

My Computer

٩(͡๏̯͡๏)۶

My Computer

My Computer

٩(͡๏̯͡๏)۶

My Computer

My Computer

My Computer

٩(͡๏̯͡๏)۶

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer