That backdoor is still there:
O20 - Winlogon Notify: rpcc - C:\WINDOWS\System32\rpcc.dll
If I were you, I would keep Zone Alarm running and make sure rpcc.dll is denied access to the internet, along with any other processes you do not recognise.
020 malware injects itself into legitimate processes, and starts up very early in the windows boot, so it is difficult to remove.
There are a number of things you can try.
Fix the entry with HijackThis!, then reboot into safe mode with command prompt and delete the file:
C:\WINDOWS\System32\rpcc.dll
http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/boot_failsafe.mspx?mfr=true
or
Use Killbox to delete the file on reboot:
http://www.bleepingcomputer.com/files/killbox.php
You need to unzip the file, start Killbox, enter the file location:
C:\WINDOWS\System32\rpcc.dll
Then click on ‘delete on reboot’ or you could try ‘replace on reboot with dummy’ and click the big red x.
Then fix the 020 entry with HijackThis!, reboot and check that it has gone.
or
You could try the free trial of CounterSpy because this malware seems to be in its definitions:
http://research.sunbelt-software.com/download.aspx
I would keep Zone Alarm running- it runs ok on my systen with 256M memory. If it is taking up too much resources, make sure you have Windows Firewall enabled:
http://www.geocities.com/dontsurfinthenude/firetut.htm
The other malware you fixed with HijackThis! has not come back, but HijackThis! does not delete the malware files, only the registry entries. You need to look for the files corresponding to the entries you fixed and delete them.
I’d recommend keeping the anti-malware programs you downloaded, updating them and running further scans- they may well find further traces as new definitions are added- but the backdoor is the only thing that seems to be active at the moment.
Hi :