msjbbp.exe - Dangerous

msjbbp.exe

Manual removal instructions:

Antivirus Report of msjbbp.exe:
msjbbp.exe Malware
msjbbp.exeDangerous
msjbbp.exeHigh Risk
msjbbp.exe
We suggest you to remove msjbbp.exe from your computer as soon as possible.
Msjbbp.exe is Trojan/Backdoor.
Kill the process msjbbp.exe and remove msjbbp.exe from Windows startup.

File:
C:\sand-box\winres.exe

Classification:
Antivirus Version Last Update Result
Prevx 3.0 2009.06.16 Medium Risk Malware

Additional information
File size: 262144 bytes
MD5 : 852cd76aa08b6699d34b0095bdf8be5c
SHA1 : ce571004ba48da686b5403d1f1445f197f37f0a2

Installation
When the program is executed, it creates the following registry subkeys and values:

----------------------------------
Keys added:10
----------------------------------
HKLM\SOFTWARE\Classes\csfile
HKLM\SOFTWARE\Classes\csfile\DefaultIcon
HKLM\SOFTWARE\Classes\csfile\shell
HKLM\SOFTWARE\Classes\csfile\shell\open
HKLM\SOFTWARE\Classes\csfile\shell\open\command
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\NOHIDORSYS
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
HKCU\Software\Microsoft\Internet Explorer\LowRegistry\Extensions
HKCU\Software\Microsoft\Internet Explorer\LowRegistry\Extensions\CmdMapping

----------------------------------
Values added:12
----------------------------------
HKLM\SOFTWARE\Classes\csfile\shell\open\command\: "msojp.exe "%1" %*"
HKLM\SOFTWARE\Classes\csfile\DefaultIcon\: "%1"
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\Use FormSuggest: "yes"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\NOHIDORSYS\CheckedValue: 0x00000000
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run\exec: "C:\WINDOWS\system32\msjbbp.exe"
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions: 0x00000000
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\WINDOWS\system32\3361\services.exe: "C:\WINDOWS\system32\3361\services.exe:*:Enabled:services.exe"
HKCU\Software\Microsoft\Internet Explorer\LowRegistry\Extensions\CmdMapping\{e2e2dd38-d088-4134-82b7-f2ba38496583}: 0x00002000
HKCU\Software\Microsoft\Internet Explorer\LowRegistry\Extensions\CmdMapping\NextId: 0x00002001
HKCU\Software\Microsoft\Internet Explorer\Main\Use FormSuggest: "yes"
HKCU\Software\Microsoft\Internet Explorer\Main\DisableScriptDebuggerIE: "yes"
HKCU\Software\Microsoft\Internet Explorer\Main\Error Dlg Displayed On Every Error: "no"

----------------------------------
Values modified:24
----------------------------------
HKLM\SOFTWARE\Classes\.bat\: "batfile"
HKLM\SOFTWARE\Classes\.bat\: "csfile"
HKLM\SOFTWARE\Classes\.com\: "comfile"
HKLM\SOFTWARE\Classes\.com\: "csfile"
HKLM\SOFTWARE\Classes\.exe\: "exefile"
HKLM\SOFTWARE\Classes\.exe\: "csfile"
HKLM\SOFTWARE\Classes\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\: "C:\WINDOWS\system32\mswinsck.ocx"
HKLM\SOFTWARE\Classes\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\: "C:\WINDOWS\system32\MSWINSCK.OCX"
HKLM\SOFTWARE\Classes\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ToolboxBitmap32\: "C:\WINDOWS\system32\mswinsck.ocx, 1"
HKLM\SOFTWARE\Classes\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ToolboxBitmap32\: "C:\WINDOWS\system32\MSWINSCK.OCX, 1"
HKLM\SOFTWARE\Classes\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\: "C:\WINDOWS\system32\mswinsck.ocx"
HKLM\SOFTWARE\Classes\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\: "C:\WINDOWS\system32\MSWINSCK.OCX"
HKLM\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\0\win32\: "C:\WINDOWS\system32\mswinsck.ocx"
HKLM\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\0\win32\: "C:\WINDOWS\system32\MSWINSCK.OCX"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\CheckedValue: 0x00000001
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\CheckedValue: 0x00000000
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug\Auto: "1"
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug\Auto: "0"
HKCU\AppEvents\Schemes\Apps\Explorer\Navigating\.Current\: "%SystemRoot%\media\Windows Navigation Start.wav"
HKCU\AppEvents\Schemes\Apps\Explorer\Navigating\.Current\: ""
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\load: ""
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\load: "C:\WINDOWS\system32\msyqc.exe"
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\run: ""
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\run: "C:\WINDOWS\system32\msovt.exe"

----------------------------------
Files added:15
----------------------------------
C:\Documents and Settings\Administrator\Local Settings\Temp\~DF27D2.tmp
C:\WINDOWS\system32\3361\services.exe
C:\WINDOWS\system32\install.log
C:\WINDOWS\system32\lsass.dll
C:\WINDOWS\system32\msdts.exe
C:\WINDOWS\system32\mseqgl.exe
C:\WINDOWS\system32\msjbbp.exe
C:\WINDOWS\system32\msojp.exe
C:\WINDOWS\system32\msovt.exe
C:\WINDOWS\system32\msuyimd.exe
C:\WINDOWS\system32\msyqc.exe
C:\WINDOWS\system32\mszshx.exe
C:\WINDOWS\system32\svchost.dll
C:\WINDOWS\system32\winexec.dll
C:\WINDOWS\system32\winres.dll

----------------------------------
Files deleted:1
----------------------------------
C:\sand-box\winres.exe

----------------------------------
Files [attributes?] modified:1
----------------------------------
C:\WINDOWS\system32\wbem\Logs\wbemcore.log

----------------------------------
Folders added:1
----------------------------------
C:\WINDOWS\system32\3361

----------------------------------
Folders deleted:0
----------------------------------

----------------------------------
Total changes:64
----------------------------------

-------------------------------------------------------------------------------------
Detected by RegRun Reanimator:

Type: Main File Extentions
Item Name: .exe
Related File: msioeyi.exe "%1" %*

Type: Main File Extentions
Item Name: .com
Related File: msioeyi.exe "%1" %*

Type: Main File Extentions
Item Name: .bat
Related File: msioeyi.exe "%1" %*

Type: Explorer Run
Item Name: exec
Related File: C:\WINDOWS\system32\msmdicqw.exe

Type: Win.ini
Item Name: load
Related File: C:\WINDOWS\system32\msmyuxiq.exe

Type: Win.ini
Item Name: run
Related File: C:\WINDOWS\system32\mszunb.exe

Removal Results: Success
Number of reboot: 1

Remove msjbbp.exe now!

Dmitry Sokolov:

I created UnHackMe in 2006 to fix the problem that antivioruses did not fix: detecting rootkits.

Since that time I work every day to fix the issues that antiviruses cannot.

If your antivirus have not helped you solve the problem, you should try UnHackMe.

We are a small company and you can ask me directly, if you have any questions.

Testimonials

You can read UnHackMe testimonials here.