Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 5262
  • Last Modified:

runkbot.exe error messages

I have been getting bothersome error messages on my laptop that I thought had been cleaned out when I did a full scan with my Semantec Endpoint Protection.  It helped for a while but it came back.  And this time a scan didn't fix it.
I have the KACE/KBOX program running which checks authenticity if my softwares, and that is what appears to be affected and causing these error messages:

I get a Pop-up window...
runkbot.exe -Common Language Runtime Debugginng Services
With the following error message:
Application has generated an exceptin that could not be handled.
Process id=0x12c (300), thread id=0x120 (288)
click OK to terminate the application
Click CANCEL to debug the application.

...the hex and decimal figures in the "Process id..." line changes with every pop-up message.

Then, when I click CANCEL, to debug, I get an AcroDist.exe -Application Error
The application failed to initialize properly (0x0000005), Click OK to terminate application.



Runkbot.exe -No debugger found.

and it goes on saying the Registered JIT debugger is not available.

OR if I just click OK on the original error message, it goes away, but more of the same errors keep popping up.

Please advise how to rid of this once and for all.
0
mrkent
Asked:
mrkent
  • 5
  • 5
  • 3
  • +1
8 Solutions
 
TrustWiseCommented:
Run ATF Cleaner
http://www.atribune.org/index.php?option=com_content&task=view&id=25&Itemid=25
Then run malwarebytes
http://download.cnet.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.html
Lastly run Combofix
http://www.bleepingcomputer.com/combofix/how-to-use-combofix
Turn off all over your virus protection, firewall, etc.
Post your logs here to make sure your computer is clean
0
 
Thomas Zucker-ScharffSystems AnalystCommented:
Note that Combofix is currently unavailable.
0
 
mrkentAuthor Commented:
Couldn't find the Combofix so that part wasn't done.
Also found some interesting results. First, I don't think the ATF Cleaner worked on my machine.  Because, though I didn't check the cookies and temporary files to see if they were deleted by ATF, when I watched the malwarebytes run I saw that it was scanning files in the temporary internet folder which made it seem that they were not deleted after all.  Malwarebytes did succeed in finding three possible viruses, which I then deleted.  BUT it didn't fix my original porblem.  Still getting these runkbot.exe errrors.
I tried it again but this time I manually cleaned out the elements that ATF Cleaner cleans.  Then malwarebytes did not find anything.  And the problem still exists.
I've enlcosed the logs from the first scan.
Any other thoughts?  BTW, are there diferences in what AV softwares out there look for?  Is this Malewarebyte product doing something different than my current Symantec Endpoint Protection?

I'm pretty new to this subject, and still looking for a solution.   Thanks for your help.
mbam-log-2009-12-16--14-08-28-.txt
0
Automating Your MSP Business

The road to profitability.
Delivering superior services is key to ensuring customer satisfaction and the consequent long-term relationships that enable MSPs to lock in predictable, recurring revenue. What's the best way to deliver superior service? One word: automation.

 
TrustWiseCommented:
Combofix is down temporarily, here is the beta for kittyfix from sUBs
http://download.bleepingcomputer.com/sUBs/Beta/KittyFix.exe
0
 
optomaCommented:
In Malwarebytes, did you use the "remove selected" when the scan was finished?

Could you also scan with Nod online scan http://www.eset.com/onlinescan/
and make note of any detections.

Run autoruns.
In Autoruns:
Hit options and check "verify code signatures" and rescan (F5 key)
Don't make any other changes...

Within Autoruns,select the file tab and select save(Ctrl+S) and save as AutoRuns Data (*.arn) -Output file is a few megs in size
Once saved then right click autoruns.arn and rename to autoruns.txt to upload

Autoruns http://technet.microsoft.com/en-us/sysinternals/bb963902.aspx
0
 
mrkentAuthor Commented:
OK, i've tried it all...  ATF, Malewarebytes (checked the boxes and remove selected), Combofix, Nod on-line scan, and Autoruns.  None of it worked.   In fact nothing worked until I put the runkbot.exe file from the KBOX directory inyo the recycle bin.  But that is not the solution.  The techniques offered all seem to do the same thing -scan, find bad things, kill them.  Is there much parity between the different techniques?

Anything else to help me with this?
0
 
Thomas Zucker-ScharffSystems AnalystCommented:
try a rootkit detector, better yet try three:

sophos: https://secure.sophos.com/products/free-tools/sophos-anti-rootkit/download/
f-secure: http://www.f-secure.com/en_EMEA/security/security-lab/tools-and-services/blacklight/index.html
panda: http://www.softpedia.com/progDownload/Panda-Anti-Rootkit-Download-61553.html

I believe Panda may give you some false positives (it might be Sophos - I can't remember).  At any rate if you do get files listed you don't know whether to let the scanner clean or not - post back here.
0
 
TrustWiseCommented:
Pull the hard drive and install it externally to a different computer. Scan the HDD with Malwarebytes again and as tzucker recommended us panda also. Before you uninstall the HDD right click My Computer go to Properties and turn off the Restore Points.
0
 
mrkentAuthor Commented:
OK, I did the f-secure blacklight rootkit detector and it didn't find any hidden processes.  Didn't do the sophos because I didn't feel like registering.  Next step is to pull the HD and do the Malewarebytes and Panda.  This may take a while as I need to find a different computer to use.
0
 
Thomas Zucker-ScharffSystems AnalystCommented:
Great.  F-secure's app is the least likely to find rootkits, although it is also the least likely to find false positives.  The sophos app is worth registerring for.  It doesn't cost you anything and may solve your problem.
0
 
mrkentAuthor Commented:
Didn't mean to leave you hanging, spent Holidays with family.
Still need to get a different computer to transfer this HD to, and then F-secure app

One last thought, the error messages stopped when I put the runkbot.exe file in the trash ( I didn't erase the trash because I eventually want to resore the file when this thing is fixed.)  Could this mean that the problem is in the runkbot.exe file itself?  This is the executable file of the KBOX application.  Anyone familiar with KBOX?
0
 
TrustWiseCommented:
If you can redownload the .exe file then I would recommend deleting the runkbot.exe file. If you put it in the trash and the problem went away that's a really good indication that this is the problem.
0
 
mrkentAuthor Commented:
Thank you!!
0
 
optomaCommented:
No prob.
0
 
TrustWiseCommented:
your welcome
0

Featured Post

Who's Defending Your Organization from Threats?

Protecting against advanced threats requires an IT dream team – a well-oiled machine of people and solutions working together to defend your organization. Download our resource kit today to learn more about the tools you need to build you IT Dream Team!

  • 5
  • 5
  • 3
  • +1
Tackle projects and never again get stuck behind a technical roadblock.
Join Now