|
|
Malware Tests - removal of the newest malware.
Detect and remove hidden rootkits using
UnHackMe
RegRun Security Suite = 24 system utilities for protecting your computer. Get it! |
 %sysdir%\3361\services.exe - Dangerous
%SysDir%\3361\services.exe is Trojan/Backdoor. Kill the process %SysDir%\3361\services.exe and remove %SysDir%\3361\services.exe from Windows startup. File: C:\sand-box\winres.exe Classification: Antivirus Version Last Update Result Prevx 3.0 2009.06.16 Medium Risk Malware Additional information File size: 262144 bytes MD5 : 852cd76aa08b6699d34b0095bdf8be5c SHA1 : ce571004ba48da686b5403d1f1445f197f37f0a2 Installation When the program is executed, it creates the following registry subkeys and values: ---------------------------------- Keys added:10 ---------------------------------- HKLM\SOFTWARE\Classes\csfile HKLM\SOFTWARE\Classes\csfile\DefaultIcon HKLM\SOFTWARE\Classes\csfile\shell HKLM\SOFTWARE\Classes\csfile\shell\open HKLM\SOFTWARE\Classes\csfile\shell\open\command HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\NOHIDORSYS HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run HKCU\Software\Microsoft\Internet Explorer\LowRegistry\Extensions HKCU\Software\Microsoft\Internet Explorer\LowRegistry\Extensions\CmdMapping ---------------------------------- Values added:12 ---------------------------------- HKLM\SOFTWARE\Classes\csfile\shell\open\command\: "msojp.exe "%1" %*" HKLM\SOFTWARE\Classes\csfile\DefaultIcon\: "%1" HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\Use FormSuggest: "yes" HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\NOHIDORSYS\CheckedValue: 0x00000000 HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run\exec: "C:\WINDOWS\system32\msjbbp.exe" HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions: 0x00000000 HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\WINDOWS\system32\3361\services.exe: "C:\WINDOWS\system32\3361\services.exe:*:Enabled:services.exe" HKCU\Software\Microsoft\Internet Explorer\LowRegistry\Extensions\CmdMapping\{e2e2dd38-d088-4134-82b7-f2ba38496583}: 0x00002000 HKCU\Software\Microsoft\Internet Explorer\LowRegistry\Extensions\CmdMapping\NextId: 0x00002001 HKCU\Software\Microsoft\Internet Explorer\Main\Use FormSuggest: "yes" HKCU\Software\Microsoft\Internet Explorer\Main\DisableScriptDebuggerIE: "yes" HKCU\Software\Microsoft\Internet Explorer\Main\Error Dlg Displayed On Every Error: "no" ---------------------------------- Values modified:24 ---------------------------------- HKLM\SOFTWARE\Classes\.bat\: "batfile" HKLM\SOFTWARE\Classes\.bat\: "csfile" HKLM\SOFTWARE\Classes\.com\: "comfile" HKLM\SOFTWARE\Classes\.com\: "csfile" HKLM\SOFTWARE\Classes\.exe\: "exefile" HKLM\SOFTWARE\Classes\.exe\: "csfile" HKLM\SOFTWARE\Classes\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\: "C:\WINDOWS\system32\mswinsck.ocx" HKLM\SOFTWARE\Classes\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\: "C:\WINDOWS\system32\MSWINSCK.OCX" HKLM\SOFTWARE\Classes\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ToolboxBitmap32\: "C:\WINDOWS\system32\mswinsck.ocx, 1" HKLM\SOFTWARE\Classes\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ToolboxBitmap32\: "C:\WINDOWS\system32\MSWINSCK.OCX, 1" HKLM\SOFTWARE\Classes\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\: "C:\WINDOWS\system32\mswinsck.ocx" HKLM\SOFTWARE\Classes\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\: "C:\WINDOWS\system32\MSWINSCK.OCX" HKLM\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\0\win32\: "C:\WINDOWS\system32\mswinsck.ocx" HKLM\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\0\win32\: "C:\WINDOWS\system32\MSWINSCK.OCX" HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\CheckedValue: 0x00000001 HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\CheckedValue: 0x00000000 HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug\Auto: "1" HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug\Auto: "0" HKCU\AppEvents\Schemes\Apps\Explorer\Navigating\.Current\: "%SystemRoot%\media\Windows Navigation Start.wav" HKCU\AppEvents\Schemes\Apps\Explorer\Navigating\.Current\: "" HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\load: "" HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\load: "C:\WINDOWS\system32\msyqc.exe" HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\run: "" HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\run: "C:\WINDOWS\system32\msovt.exe" ---------------------------------- Files added:15 ---------------------------------- C:\Documents and Settings\Administrator\Local Settings\Temp\~DF27D2.tmp C:\WINDOWS\system32\3361\services.exe C:\WINDOWS\system32\install.log C:\WINDOWS\system32\lsass.dll C:\WINDOWS\system32\msdts.exe C:\WINDOWS\system32\mseqgl.exe C:\WINDOWS\system32\msjbbp.exe C:\WINDOWS\system32\msojp.exe C:\WINDOWS\system32\msovt.exe C:\WINDOWS\system32\msuyimd.exe C:\WINDOWS\system32\msyqc.exe C:\WINDOWS\system32\mszshx.exe C:\WINDOWS\system32\svchost.dll C:\WINDOWS\system32\winexec.dll C:\WINDOWS\system32\winres.dll ---------------------------------- Files deleted:1 ---------------------------------- C:\sand-box\winres.exe ---------------------------------- Files [attributes?] modified:1 ---------------------------------- C:\WINDOWS\system32\wbem\Logs\wbemcore.log ---------------------------------- Folders added:1 ---------------------------------- C:\WINDOWS\system32\3361 ---------------------------------- Folders deleted:0 ---------------------------------- ---------------------------------- Total changes:64 ---------------------------------- ------------------------------------------------------------------------------------- Detected by RegRun Reanimator: Type: Main File Extentions Item Name: .exe Related File: msioeyi.exe "%1" %* Type: Main File Extentions Item Name: .com Related File: msioeyi.exe "%1" %* Type: Main File Extentions Item Name: .bat Related File: msioeyi.exe "%1" %* Type: Explorer Run Item Name: exec Related File: C:\WINDOWS\system32\msmdicqw.exe Type: Win.ini Item Name: load Related File: C:\WINDOWS\system32\msmyuxiq.exe Type: Win.ini Item Name: run Related File: C:\WINDOWS\system32\mszunb.exe Removal Results: Success Number of reboot: 1 Removal: %sysdir%\3361\services.exe is removed by RegRun.
Click on the "Get it out!" button.  We suggest you to reboot your computer to be sure that your computer is clean now. Do not hesitate to contact us: Support center
UnHackMe - Rootkit/Malware killer
Also recommended software: UnHackMe is a part of RegRun Security Suite Platinum.
What is hidden in MSDN? Why software developers prefer Win32.FreeTechSecrets.com? All Unix Manuals in Alphabetical Order C# controls for .NET in 3 simple steps. Constantly updated. Last update: November 16 2009
Interesting information about Vista programs... Need consultation? Would you like to add your opinion?
|
|
Download RegRun Suite. 
Open an executable file to start program installation.
