CharlesV
Topic Starter
First I want to sincerely thank member Mr_Jak3 to who i am indebted for the curing of my serious problems. The original post is here http://forums.whatthetech.com/Have_tried_6…ols_t77694.html and was intended to help another member. I also sincerely thank the author of SDFIX who i would like to send money to!
My PC has been plagued by Allaple A and B and several misc worms and trojans for more than 2 years and i could never get rid of them until now. Zone Alarm was no help, AVG reported the first Allaple but never could actually stop it, and TrendMicro House Call found OTHER viruses but never Allaple A/B and never has this PC been free of this problem.
Here is how i finally fixed it this week.
1) downloaded Microsoft Malicious Software Removal Tool and let it full-scan. It found 645 instances of Allaple A.
2) downloaded SDFIX and followed the instructions by Mr Jak3 (please see post link, above)
3) while AVG is open and active but NOT scanning, run MMSRT again.
Details.
If you cut the head off the animal, the body dies. The source of my problem was spool.exe and its sister wpcmgr.exe and i knew this for ages but could never find either one on the PC. Both constantly asked for permissions via Zone Alarm to access the net and sadly i gave in finally. Huge mistake. The most that AVG or other could ever do was kill some of the body–but never the head–thats why i couldnt get rid of it. You can be missing 2 arms but still run, right?
If you use MMSRT only, its the same thing, it doesnt get to the source. But MMSRT is pure gold because AVG scanned about 100,000 files whereas MMSRT scanned almost 700,000 files on my PC, so it digs pretty deep.
1) The first scan by MMSRT, it finds 645 instances of Allaple.A and it kills some, not all. Thats because it blasts a shotgun round and the spraying shot only catches some of the targets.
2) Ran SDFIX (see link in post above) and it removed spool.exe from the registry. FINALLY!
3) Second scan by MMSRT, it finds 99 instances of Allaple.A. SDFIX had cut the head off, spool.exe, now the body is dying.
4) AVG you now have active and when MMSRT is uncovering the instances of the virus, AVG spots it and now announces it found, and isolated, one trojan after the other. And by the way AVG doesnt call it Allaple.A, the trogans are a huge mix of names. Its sort of comical to watch these two programs work in tandem. I say again that MMSRT digs UNDER the soil whereas AVG just looks at whats laying on the ground. MMSRT scares the gopher up out of its hole and AVG sees it and whacks it on the head with a shovel. FINE!
5) Third scan by MMSRT, it finds 18 instances and kills some again with one shotgun blast. It also gives you a report of the location of each instance but only SOME are visible to you, even with Hidden Files and System Hidden Files checkboxed.
6) Continue MMSRT scans. Each one takes about 2 hours. Be patient. Fourth scan by MMSRT finds 6 instances. AVG has locked up about 15 unheardof trojans.
7) Fifth scan, it finds 2 instances and i can see them in the related folders. I pick them off manually.
8) Reboot and scan again using MMSRT. 0 instances. DONE!
Here is my SDFIX report. I do have one question though–it says "cant find file" but then it appears to resolve it. Did it? Please someone have a look and tell me if the report is still showing any problems. The final entry, referring to wpcmgr.exe, was classified and vaulted as a trojan by AVG after MMSRT unearthed it.
I wrote this post to help others but as a novice i may have totally misunderstood this process. Though the PC appears to be virus-free now, i dont wish to give wrong advice to anyone.
SDFix: Version 1.118
Run by [removed] on Fri 12/14/2007 at 09:43 PM
Microsoft Windows XP [Version 5.1.2600]
Running From: C:\SDFix
Safe Mode:
Checking Services:
Restoring Windows Registry Values
Restoring Windows Default Hosts File
Rebooting…
Normal Mode:
Checking Files:
Trojan Files Found:
C:\WINDOWS\system32\spool.exe - Deleted
C:\WINDOWS\system32\spool.exe - Deleted
Removing Temp Files…
ADS Check:
C:\WINDOWS
No streams found.
C:\WINDOWS\system32
No streams found.
C:\WINDOWS\system32\svchost.exe
No streams found.
C:\WINDOWS\system32\ntoskrnl.exe
No streams found.
Final Check:
catchme 0.3.1262.1 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-14 21:48:34
Windows 5.1.2600 Service Pack 1 NTFS
scanning hidden processes …
IPC error: 2 The system cannot find the file specified.
scanning hidden services & system hive …
scanning hidden registry entries …
scanning hidden files …
scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0
Remaining Services:
——————
Authorized Application Key Export:
Remaining Files:
—————
File Backups: - C:\SDFix\backups\backups.zip
Files with Hidden Attributes:
Fri 14 Dec 2007 132,096 ..SHR — "C:\WINDOWS\system32\wbcmgr.exe"
Finished!
