Lsass.exe

[TriRan]

69 RAT

changing in use dll's isn't that complicated.. ive found 2 useful links for you..

Click This One First: Here

Tool Used To Perform The Action: Here

[cak46]

I don't where to start. I went to my reg and there were only entries in the local machine-run. All the others were blank(default). Soooo, I noticed that the entries(4) were stuff that I have installed recently(3) the other one is gcasServe, which I read up on and it's supposed to be there. My 3 are Avast, my new mouse, and ZoneAlarm. So, for kicks anyhow, I went to Depends and noticed that one Red file that's always red no matter what I look at is the MPR.dll. Sooooooooooooo, I thought that it might be the culprit, maybe, so I found it on that site I told you about and downloaded it and tried to copy and paste into system32 and it will not. "Being used by another program" type stuff(excuse) So, I grew a brain cell or two and went into safe mode and I still couldn't do it . Then I went into sys32 and tried to delete mpr.dll from there and it wouldn't let me  :cry: The old line about " cannnot,,,,,,,make sure disk is not full or write protected" blah blah blah. I scanned my original file and it seems clean but that does not always mean it's not corrupted. Anyhow, I'm suspicious of the mpr.dll cause it always shows in red and has that red sentence across the bottom about can't load or whatever, can't remember right now.Time for beer.Ahhhhhhhhh, that's better. Damn Dude, don't ask me what time it is, I'll tell you how to make a watch  :haha: Even though it's probably wrong. Am I outta whack here, should I change brands again?  Should I not travel too far from home without a map    Did you know that many parts of a pine tree are edible?  :haha: Gotta go for now, really tired, long day. I am wayyyyyyyyyy too sober. Anyhow, yak in the morrow OK? Cheers  :wave: :icon_salut:  

Sounds like a good idea.  I have a couple of ideas which are a bit more invasive to the op sys., but lets wait till you give this a go. 

Pine trees.... hmmmm..... I'm from the Pine Tree State so I guess I'll never go hungry ! :haha:   Wash it down with some of that beer.... ummmm,  beer.....

They're coming to take me away ha ha they're coming to take me away ho ho he he...........  :haha:

The project at work is taking its toll............

TriRyans tool looks good.  Edit:  That just sounds wrong to me..... Lets try this:  The utility he suggests sounds appropriate....  You may want to consider using the one out of the cabs  on your cd-rom first.  If wfp finds out about it (version change, size change, etc.,) there will be hell to pay . (not really) It will just re-write the old one back from the dllcache automatically, possibly without popping up a message.  Big brother MS is always lurking.....  Check file versions and size by right mouse clicking on the file, then select properties.  This file (mpr.dll) is used to allow communication to flow between different network protocols.  For info on wfp, take a peeky here:  http://support.microsoft.com/?kbid=222193.  If the versions and size are the same, most likely wfp won't notice a thing.  Make a backup copy of the old one prior to replacing.   

[rikkkki]

Hey cak46. Boy, I'm not getting anywhere tonight

[cak46]

This should help.  http://support.microsoft.com/default.aspx?scid=kb;en-us;228930

1.)  download and Install the inuse tool

2.)  Get to a command prompt

3.) example of usage:

I want to replace the mpr.dll file located in the c:windowssystem32 directory with the mpr.dll file located in the c: directory

inuse c:mpr.dll c:windowssystem32mpr.dll

You must use the full path to the files which the above example shows.

You may want to consider moving your replacement file to the c:  directory  so you don't have to type a long path to get to the file

Windows File protection disallows replacement of system files by keeping a spare copy in the dllcache (one of the hidden directories you can see now in the Windows directory) and copying that back to the system32 directory (or wherever the system file in question is stored for use) if it detects that the protected file has been changed.  Using the same version migh fool WFP into thinking it doesn't need to change the file but it may do crc checking as well (I'm not fully versed in WFC)  Give it a try anyway.  Most that will happen is wfc will error and say its putting it back or it will just put the orig. back and not tell you.  You should at least check the versions so that if they are different, you'll be able to tell whats happening after you replace it.  I know... I know.... long winded....... riddled with techie crap....... :haha:.  Does this help at all?? 

You can look at it this way.....  You go into a store and pick up an Aerosmith  cd(old copy of mpr.dll), intending on walking out of the store with it without paying.  A Molly hatchet cd falls in place where the aerosmith cd was (your new mpr.dll file)  .Just before you get to the door, the manager snags the cd from your hand and drags you back to the shelf.  He then puts the Aeorsmith cd back right where it had been before, pushing the molly hatchet out of the way.  Further, he blindfolds you before taking you back to the rack, so you really don't know what hes doing or where hes taking you or that he even put the Aerosmith cd back in place.  Welcome to WFP 

[cak46]

Hey cak46. Boy, I'm not getting anywhere tonight    First, the fix from TriRan's link is, I think, past my "dark ages" techie abilities. And what you suggested about cabs on my cd, I can't find. There's that HUGE "tools" file with 938MB's of stuff on it that I think I already installed and then removed yesterday. (maybe not, I installed the SDK kit) None of the highlites on the MS page looked familiar to me. I'm at a standstill. I need a "see spot run" path that I can follow or maybe a HOT bowl of "pine cone" soup?  :haha:

Edit: I am having all kinds of trouble trying to download some crtical updates from MS. The latest "windows update installer 3.1" won't take, so I mailed(started a new case) with MS. Never know, there might be something I need in there. The stupid window pops up and tells me they can't install the updates :roll: and at the bottom of the window it tells me I must restart my puter for the updates to take affect.

Restart the puter, then try the install 3.1 download afgain.  Had that same problem with the, YES, now clean HP machine I've been working on.

Pine Tea is Fine For Me  hehe

[rikkkki]

Dude. I've tried the path a 100 different ways and it won't work. I tried it the way you suggested and the way that MS suggested, and it won't work. I did notice that the versions and dates are exactly the same with the two files. I'll try to do the 3.1 again

I typed the "path" about 10 different ways altogether 

[cak46]

Dude. I've tried the path a 100 different ways and it won't work. I tried it the way you suggested and the way that MS suggested, and it won't work. I did notice that the versions and dates are exactly the same with the two files. I'll try to do the 3.1 again

I typed the "path" about 10 different ways altogether

do a search for mpr.dll on your computer.  The full path to it should show up there.  All three copies will show up.  don't use the one in dllcache or the one you copied to c:  .

The one I gave was an example.  I do not know which directory the mpr.dll file is stored in.  I would assume system32, but do not know.  Put an example of the command you put in and what happened (error messages, etc.) if you could.

Example ONLY, not true paths to mpr.dll (as far as I know):

c:                    is a path          mpr.dll is the filename  full path and filename is c:mpr.dll

c:windows        is another path  mpr.dll is the filename  full path and filename is c:windowsmpr.dll

the path is the part prior to the filename (mpr.dll) and tells the operating system where to find the file you are wanting to use as a replacement and the other path is the part prior to the filename (mpr.dll) that tells the op sys where the file is that you want to replace.

[rikkkki]

Will do.

Boy, I'm a little jealous, if you get my dirft. I haven't done something like that for many a year.

mpr.dll is in system32 and the new one is on the c:page(one on my slave, too). I'll run a search to be sure.

[rikkkki]

do a search for mpr.dll on your computer.

[cak46]

Ya, I got that part pretty good, but the actual intro of the inuse, I think is part of the problem and of course the slashes and what not. When I go to the exe icon of inuse and click on it, the comm prompt window blinks faster than the RoadRunner chasing the Energizer Bunny So I was using the regular comm prompt.

That damn window keeps popping up wanting me to restart so it can finish installing the updates that it won't install Persistent to say the least.

Anyhow, I think the machine so far is not recognizing the inuse info in my comm or something, it only takes one symbol in the wrong place

Not sure what you mean here. 

Go ahead and reboot to get rid of the popup asking to reboot then try again.  Did you reboot after installing the inuse program?. 

[rikkkki]

Ya, I've rebooted at least twice. When I go to inuse(freshly downloaded) and click on the exe icon, it just blinks. It's a comm prompt page. But I can't use it cause it dissappears too fast. Has happened in the past with other stuff. So went to the regular comm prompt page and did it from there. Here's the results of my search,,,,,,,,,,,,,,,,,

[VampireXxX]

i know how to solve the problem

edit : sorry abt the post, my bro typed it while i went to mini mart  :angry5:

[rikkkki]

Well, that's a good start  Reminds me of Nvidia's "Dawn" demo, Oh ya

[cak46]

Ya, I've rebooted at least twice. When I go to inuse(freshly downloaded) and click on the exe icon, it just blinks. It's a comm prompt page. But I can't use it cause it dissappears too fast. Has happened in the past with other stuff. So went to the regular comm prompt page and did it from there. Here's the results of my search,,,,,,,,,,,,,,,,,

go to Start>run> then type in cmd and hit enter key

type in the following:

inuse "c:program filesMPR.dllmprmpr.dll" c:WINDOWSsystem32mpr.dll

the " " quotes are either singl quotes ' ' or double quotes " "  can't remember which.  You'll get an error message if they are wrong.

I've got to go or I'll be useless tomorrow.  Give this a try and I'll be back tomorrow!

[rikkkki]

OK I tried but it didn't work.  I made a mistake or two, but you should get an idea,,,,,,,,,,,,,,,,,

[php]

What folder did you download inuse.exe to?

[TriRan]

ok if you've installed inuse then this should work..

File Attached

just run the Completely Automated.bat for it to automaticly replace MPR.dll or use inuse.bat file and fill out the required info to replace any dll in use

[rikkkki]

What folder did you download inuse.exe to?

Hi guys. I downloaded inuse(zip) to Program files, made a new folder(renamed it), put it there and then extracted it inside the new folder, Oh, I just noticed something, I think the path that cak46 gave me was not quite right. I think it should have read: c:program filesMPR.dllmprmpr.dll.

[cak46]

Hi guys. I downloaded inuse(zip) to Program files, made a new folder(renamed it), put it there and then extracted it inside the new folder, Oh, I just noticed something, I think the path that cak46 gave me was not quite right. I think it should have read: c:program filesMPR.dllmprmpr.dll.  The renamed folder is MPR.dll

EDIT: No, he had it right. I'm going to check out TriRan's link and see what's going on.

No.  The way it should read is "c:program filesMPR.dllmprmpr.dll"  You need to specify the path to the inuse.exe file

eg:  "C:program filesWhateverthefolderyourenamedextracteddirectoryname?inuse.exe" "c:program filesMPR.dllmprmpr.dll" c:WINDOWSsystem32mpr.dll

[rikkkki]

OK. Here's the latest. I rebooted and no change.Keep in mind that these two files are exactly the same/version/date, etc. Anyhow, I ran it again twice. I want you to look at it and tell if it did or did not make a change on the second try. Both are on the same screen. Here goes.

[rikkkki]

On the second try, you'll notice that it does say "updating .dll" but then says that it is protected by WFP and whenever I hit any key to continue, the screen just dissappears. So I don't know if it is doing anything ar not. Again, both these .dll files are exactly the same so I can't tell if the change was made via versions, dates, etc.

[cak46]

The updating .dll is contained within the .bat file you executed.  The protection by wfp, thats generated by inuse.exe  see below that it does not exist within the batch.  I would assume that wfp disallowed the replacement of the file.:

ECHO Updating MPR.dll DLL...  You see this as well on the black command prompt screen

"%cd%inuse.exe" "%cd%mpr.dll" "C:WINDOWSSYSTEM32mpr.dll"  This is the call for replacement of the mpr.dll file

GOTO END

:END

ECHO.

ECHO.

ECHO -----------------------------------

ECHO - Script Compiled By: TriRan      -      Well, this is obvious...

ECHO - http://www.teams-w-a-t.com      -

ECHO -----------------------------------

pause  This gives you the "Press any key to continue..." statement in your screen

[rikkkki]

I would assume that it didn't take either. Now that ditty that I was trying to use last night was supposed to bypass the WFP but I couldn't get the path right, according to the directions, anyhow. Maybe if I bring the file "out in the open" it might work. Make it easier to "find" I don't know at this point.

[cak46]

I would assume that it didn't take either. Now that ditty that I was trying to use last night was supposed to bypass the WFP but I couldn't get the path right, according to the directions, anyhow. Maybe if I bring the file "out in the open" it might work. Make it easier to "find" I don't know at this point.   

Easiest way is to copy te new mpr.dll and the inuse.exe into the c:        directory.  When you go to the command prompt type cd  this will bring you to the "root"  That way, the command would look something like:

c:inuse.exe c:mpr.dll c:windowssystem32mpr.dll

This is assuming you have copied the new mpr.dll and the inuse.exe file to the c:  directory.  DOS-like commands are our friends.... 

I have a feeling the same wfp error willl come up but it can't hurt to try. 

[rikkkki]

I guess that won't work either. :cry: I tried it twice but notice what it says about the "destination path" there is no other place in windows(system32) that it can be. And the first part is right. I put both the inuse.exe file and the mpr.dll file on the c page.No folders at all.