|
|
Malware Tests - removal of the newest malware.
Detect and remove hidden rootkits using
UnHackMe
RegRun Security Suite = 24 system utilities for protecting your computer. Get it! |
 %sysdir%\3361\services.exe - Dangerous
%SysDir%\3361\services.exe is Trojan/Backdoor. Kill the process %SysDir%\3361\services.exe and remove %SysDir%\3361\services.exe from Windows startup. File: C:\sand-box\winres.exe Classification: Antivirus Version Last Update Result Prevx 3.0 2009.06.16 Medium Risk Malware Additional information File size: 262144 bytes MD5 : 852cd76aa08b6699d34b0095bdf8be5c SHA1 : ce571004ba48da686b5403d1f1445f197f37f0a2 Installation When the program is executed, it creates the following registry subkeys and values: ---------------------------------- Keys added:10 ---------------------------------- HKLM\SOFTWARE\Classes\csfile HKLM\SOFTWARE\Classes\csfile\DefaultIcon HKLM\SOFTWARE\Classes\csfile\shell HKLM\SOFTWARE\Classes\csfile\shell\open HKLM\SOFTWARE\Classes\csfile\shell\open\command HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\NOHIDORSYS HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run HKCU\Software\Microsoft\Internet Explorer\LowRegistry\Extensions HKCU\Software\Microsoft\Internet Explorer\LowRegistry\Extensions\CmdMapping ---------------------------------- Values added:12 ---------------------------------- HKLM\SOFTWARE\Classes\csfile\shell\open\command\: "msojp.exe "%1" %*" HKLM\SOFTWARE\Classes\csfile\DefaultIcon\: "%1" HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\Use FormSuggest: "yes" HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\NOHIDORSYS\CheckedValue: 0x00000000 HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run\exec: "C:\WINDOWS\system32\msjbbp.exe" HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions: 0x00000000 HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\WINDOWS\system32\3361\services.exe: "C:\WINDOWS\system32\3361\services.exe:*:Enabled:services.exe" HKCU\Software\Microsoft\Internet Explorer\LowRegistry\Extensions\CmdMapping\{e2e2dd38-d088-4134-82b7-f2ba38496583}: 0x00002000 HKCU\Software\Microsoft\Internet Explorer\LowRegistry\Extensions\CmdMapping\NextId: 0x00002001 HKCU\Software\Microsoft\Internet Explorer\Main\Use FormSuggest: "yes" HKCU\Software\Microsoft\Internet Explorer\Main\DisableScriptDebuggerIE: "yes" HKCU\Software\Microsoft\Internet Explorer\Main\Error Dlg Displayed On Every Error: "no" ---------------------------------- Values modified:24 ---------------------------------- HKLM\SOFTWARE\Classes\.bat\: "batfile" HKLM\SOFTWARE\Classes\.bat\: "csfile" HKLM\SOFTWARE\Classes\.com\: "comfile" HKLM\SOFTWARE\Classes\.com\: "csfile" HKLM\SOFTWARE\Classes\.exe\: "exefile" HKLM\SOFTWARE\Classes\.exe\: "csfile" HKLM\SOFTWARE\Classes\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\: "C:\WINDOWS\system32\mswinsck.ocx" HKLM\SOFTWARE\Classes\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\: "C:\WINDOWS\system32\MSWINSCK.OCX" HKLM\SOFTWARE\Classes\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ToolboxBitmap32\: "C:\WINDOWS\system32\mswinsck.ocx, 1" HKLM\SOFTWARE\Classes\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ToolboxBitmap32\: "C:\WINDOWS\system32\MSWINSCK.OCX, 1" HKLM\SOFTWARE\Classes\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\: "C:\WINDOWS\system32\mswinsck.ocx" HKLM\SOFTWARE\Classes\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\: "C:\WINDOWS\system32\MSWINSCK.OCX" HKLM\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\0\win32\: "C:\WINDOWS\system32\mswinsck.ocx" HKLM\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\0\win32\: "C:\WINDOWS\system32\MSWINSCK.OCX" HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\CheckedValue: 0x00000001 HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\CheckedValue: 0x00000000 HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug\Auto: "1" HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug\Auto: "0" HKCU\AppEvents\Schemes\Apps\Explorer\Navigating\.Current\: "%SystemRoot%\media\Windows Navigation Start.wav" HKCU\AppEvents\Schemes\Apps\Explorer\Navigating\.Current\: "" HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\load: "" HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\load: "C:\WINDOWS\system32\msyqc.exe" HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\run: "" HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\run: "C:\WINDOWS\system32\msovt.exe" ---------------------------------- Files added:15 ---------------------------------- C:\Documents and Settings\Administrator\Local Settings\Temp\~DF27D2.tmp C:\WINDOWS\system32\3361\services.exe C:\WINDOWS\system32\install.log C:\WINDOWS\system32\lsass.dll C:\WINDOWS\system32\msdts.exe C:\WINDOWS\system32\mseqgl.exe C:\WINDOWS\system32\msjbbp.exe C:\WINDOWS\system32\msojp.exe C:\WINDOWS\system32\msovt.exe C:\WINDOWS\system32\msuyimd.exe C:\WINDOWS\system32\msyqc.exe C:\WINDOWS\system32\mszshx.exe C:\WINDOWS\system32\svchost.dll C:\WINDOWS\system32\winexec.dll C:\WINDOWS\system32\winres.dll ---------------------------------- Files deleted:1 ---------------------------------- C:\sand-box\winres.exe ---------------------------------- Files [attributes?] modified:1 ---------------------------------- C:\WINDOWS\system32\wbem\Logs\wbemcore.log ---------------------------------- Folders added:1 ---------------------------------- C:\WINDOWS\system32\3361 ---------------------------------- Folders deleted:0 ---------------------------------- ---------------------------------- Total changes:64 ---------------------------------- ------------------------------------------------------------------------------------- Detected by RegRun Reanimator: Type: Main File Extentions Item Name: .exe Related File: msioeyi.exe "%1" %* Type: Main File Extentions Item Name: .com Related File: msioeyi.exe "%1" %* Type: Main File Extentions Item Name: .bat Related File: msioeyi.exe "%1" %* Type: Explorer Run Item Name: exec Related File: C:\WINDOWS\system32\msmdicqw.exe Type: Win.ini Item Name: load Related File: C:\WINDOWS\system32\msmyuxiq.exe Type: Win.ini Item Name: run Related File: C:\WINDOWS\system32\mszunb.exe Removal Results: Success Number of reboot: 1 Removal: %sysdir%\3361\services.exe is removed by RegRun.
Read more... Removal instructions...
UnHackMe - Rootkit/Malware killer
Also recommended software: UnHackMe is a part of RegRun Security Suite Platinum.
What is hidden in MSDN? Why software developers prefer Win32.FreeTechSecrets.com? All Unix Manuals in Alphabetical Order C# controls for .NET in 3 simple steps. Constantly updated. Last update: November 16 2009
Interesting information about Vista programs... Need consultation? Would you like to add your opinion?
|
|
