msuyimd.exe - Dangerous
msuyimd.exe
Manual removal instructions:
Antivirus Report of msuyimd.exe:
msuyimd.exe
We suggest you to remove msuyimd.exe from your computer as soon as possible.
Msuyimd.exe is Trojan/Backdoor.
Kill the process msuyimd.exe and remove msuyimd.exe from Windows startup.
File:
C:\sand-box\winres.exe
Classification:
Antivirus Version Last Update Result
Prevx 3.0 2009.06.16 Medium Risk Malware
Additional information
File size: 262144 bytes
MD5 : 852cd76aa08b6699d34b0095bdf8be5c
SHA1 : ce571004ba48da686b5403d1f1445f197f37f0a2
Installation
When the program is executed, it creates the following registry subkeys and values:
----------------------------------
Keys added:10
----------------------------------
HKLM\SOFTWARE\Classes\csfile
HKLM\SOFTWARE\Classes\csfile\DefaultIcon
HKLM\SOFTWARE\Classes\csfile\shell
HKLM\SOFTWARE\Classes\csfile\shell\open
HKLM\SOFTWARE\Classes\csfile\shell\open\command
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\NOHIDORSYS
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
HKCU\Software\Microsoft\Internet Explorer\LowRegistry\Extensions
HKCU\Software\Microsoft\Internet Explorer\LowRegistry\Extensions\CmdMapping
----------------------------------
Values added:12
----------------------------------
HKLM\SOFTWARE\Classes\csfile\shell\open\command\: "msojp.exe "%1" %*"
HKLM\SOFTWARE\Classes\csfile\DefaultIcon\: "%1"
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\Use FormSuggest: "yes"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\NOHIDORSYS\CheckedValue: 0x00000000
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run\exec: "C:\WINDOWS\system32\msjbbp.exe"
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions: 0x00000000
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\WINDOWS\system32\3361\services.exe: "C:\WINDOWS\system32\3361\services.exe:*:Enabled:services.exe"
HKCU\Software\Microsoft\Internet Explorer\LowRegistry\Extensions\CmdMapping\{e2e2dd38-d088-4134-82b7-f2ba38496583}: 0x00002000
HKCU\Software\Microsoft\Internet Explorer\LowRegistry\Extensions\CmdMapping\NextId: 0x00002001
HKCU\Software\Microsoft\Internet Explorer\Main\Use FormSuggest: "yes"
HKCU\Software\Microsoft\Internet Explorer\Main\DisableScriptDebuggerIE: "yes"
HKCU\Software\Microsoft\Internet Explorer\Main\Error Dlg Displayed On Every Error: "no"
----------------------------------
Values modified:24
----------------------------------
HKLM\SOFTWARE\Classes\.bat\: "batfile"
HKLM\SOFTWARE\Classes\.bat\: "csfile"
HKLM\SOFTWARE\Classes\.com\: "comfile"
HKLM\SOFTWARE\Classes\.com\: "csfile"
HKLM\SOFTWARE\Classes\.exe\: "exefile"
HKLM\SOFTWARE\Classes\.exe\: "csfile"
HKLM\SOFTWARE\Classes\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\: "C:\WINDOWS\system32\mswinsck.ocx"
HKLM\SOFTWARE\Classes\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\: "C:\WINDOWS\system32\MSWINSCK.OCX"
HKLM\SOFTWARE\Classes\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ToolboxBitmap32\: "C:\WINDOWS\system32\mswinsck.ocx, 1"
HKLM\SOFTWARE\Classes\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ToolboxBitmap32\: "C:\WINDOWS\system32\MSWINSCK.OCX, 1"
HKLM\SOFTWARE\Classes\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\: "C:\WINDOWS\system32\mswinsck.ocx"
HKLM\SOFTWARE\Classes\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\: "C:\WINDOWS\system32\MSWINSCK.OCX"
HKLM\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\0\win32\: "C:\WINDOWS\system32\mswinsck.ocx"
HKLM\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\0\win32\: "C:\WINDOWS\system32\MSWINSCK.OCX"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\CheckedValue: 0x00000001
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\CheckedValue: 0x00000000
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug\Auto: "1"
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug\Auto: "0"
HKCU\AppEvents\Schemes\Apps\Explorer\Navigating\.Current\: "%SystemRoot%\media\Windows Navigation Start.wav"
HKCU\AppEvents\Schemes\Apps\Explorer\Navigating\.Current\: ""
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\load: ""
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\load: "C:\WINDOWS\system32\msyqc.exe"
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\run: ""
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\run: "C:\WINDOWS\system32\msovt.exe"
----------------------------------
Files added:15
----------------------------------
C:\Documents and Settings\Administrator\Local Settings\Temp\~DF27D2.tmp
C:\WINDOWS\system32\3361\services.exe
C:\WINDOWS\system32\install.log
C:\WINDOWS\system32\lsass.dll
C:\WINDOWS\system32\msdts.exe
C:\WINDOWS\system32\mseqgl.exe
C:\WINDOWS\system32\msjbbp.exe
C:\WINDOWS\system32\msojp.exe
C:\WINDOWS\system32\msovt.exe
C:\WINDOWS\system32\msuyimd.exe
C:\WINDOWS\system32\msyqc.exe
C:\WINDOWS\system32\mszshx.exe
C:\WINDOWS\system32\svchost.dll
C:\WINDOWS\system32\winexec.dll
C:\WINDOWS\system32\winres.dll
----------------------------------
Files deleted:1
----------------------------------
C:\sand-box\winres.exe
----------------------------------
Files [attributes?] modified:1
----------------------------------
C:\WINDOWS\system32\wbem\Logs\wbemcore.log
----------------------------------
Folders added:1
----------------------------------
C:\WINDOWS\system32\3361
----------------------------------
Folders deleted:0
----------------------------------
----------------------------------
Total changes:64
----------------------------------
-------------------------------------------------------------------------------------
Detected by RegRun Reanimator:
Type: Main File Extentions
Item Name: .exe
Related File: msioeyi.exe "%1" %*
Type: Main File Extentions
Item Name: .com
Related File: msioeyi.exe "%1" %*
Type: Main File Extentions
Item Name: .bat
Related File: msioeyi.exe "%1" %*
Type: Explorer Run
Item Name: exec
Related File: C:\WINDOWS\system32\msmdicqw.exe
Type: Win.ini
Item Name: load
Related File: C:\WINDOWS\system32\msmyuxiq.exe
Type: Win.ini
Item Name: run
Related File: C:\WINDOWS\system32\mszunb.exe
Removal Results: Success
Number of reboot: 1
| msuyimd.exe | Malware |
| msuyimd.exe | Dangerous |
| msuyimd.exe | High Risk |
Msuyimd.exe is Trojan/Backdoor.
Kill the process msuyimd.exe and remove msuyimd.exe from Windows startup.
File:
C:\sand-box\winres.exe
Classification:
Antivirus Version Last Update Result
Prevx 3.0 2009.06.16 Medium Risk Malware
Additional information
File size: 262144 bytes
MD5 : 852cd76aa08b6699d34b0095bdf8be5c
SHA1 : ce571004ba48da686b5403d1f1445f197f37f0a2
Installation
When the program is executed, it creates the following registry subkeys and values:
----------------------------------
Keys added:10
----------------------------------
HKLM\SOFTWARE\Classes\csfile
HKLM\SOFTWARE\Classes\csfile\DefaultIcon
HKLM\SOFTWARE\Classes\csfile\shell
HKLM\SOFTWARE\Classes\csfile\shell\open
HKLM\SOFTWARE\Classes\csfile\shell\open\command
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\NOHIDORSYS
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
HKCU\Software\Microsoft\Internet Explorer\LowRegistry\Extensions
HKCU\Software\Microsoft\Internet Explorer\LowRegistry\Extensions\CmdMapping
----------------------------------
Values added:12
----------------------------------
HKLM\SOFTWARE\Classes\csfile\shell\open\command\: "msojp.exe "%1" %*"
HKLM\SOFTWARE\Classes\csfile\DefaultIcon\: "%1"
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\Use FormSuggest: "yes"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\NOHIDORSYS\CheckedValue: 0x00000000
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run\exec: "C:\WINDOWS\system32\msjbbp.exe"
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions: 0x00000000
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\WINDOWS\system32\3361\services.exe: "C:\WINDOWS\system32\3361\services.exe:*:Enabled:services.exe"
HKCU\Software\Microsoft\Internet Explorer\LowRegistry\Extensions\CmdMapping\{e2e2dd38-d088-4134-82b7-f2ba38496583}: 0x00002000
HKCU\Software\Microsoft\Internet Explorer\LowRegistry\Extensions\CmdMapping\NextId: 0x00002001
HKCU\Software\Microsoft\Internet Explorer\Main\Use FormSuggest: "yes"
HKCU\Software\Microsoft\Internet Explorer\Main\DisableScriptDebuggerIE: "yes"
HKCU\Software\Microsoft\Internet Explorer\Main\Error Dlg Displayed On Every Error: "no"
----------------------------------
Values modified:24
----------------------------------
HKLM\SOFTWARE\Classes\.bat\: "batfile"
HKLM\SOFTWARE\Classes\.bat\: "csfile"
HKLM\SOFTWARE\Classes\.com\: "comfile"
HKLM\SOFTWARE\Classes\.com\: "csfile"
HKLM\SOFTWARE\Classes\.exe\: "exefile"
HKLM\SOFTWARE\Classes\.exe\: "csfile"
HKLM\SOFTWARE\Classes\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\: "C:\WINDOWS\system32\mswinsck.ocx"
HKLM\SOFTWARE\Classes\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\: "C:\WINDOWS\system32\MSWINSCK.OCX"
HKLM\SOFTWARE\Classes\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ToolboxBitmap32\: "C:\WINDOWS\system32\mswinsck.ocx, 1"
HKLM\SOFTWARE\Classes\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ToolboxBitmap32\: "C:\WINDOWS\system32\MSWINSCK.OCX, 1"
HKLM\SOFTWARE\Classes\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\: "C:\WINDOWS\system32\mswinsck.ocx"
HKLM\SOFTWARE\Classes\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\: "C:\WINDOWS\system32\MSWINSCK.OCX"
HKLM\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\0\win32\: "C:\WINDOWS\system32\mswinsck.ocx"
HKLM\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\0\win32\: "C:\WINDOWS\system32\MSWINSCK.OCX"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\CheckedValue: 0x00000001
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\CheckedValue: 0x00000000
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug\Auto: "1"
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug\Auto: "0"
HKCU\AppEvents\Schemes\Apps\Explorer\Navigating\.Current\: "%SystemRoot%\media\Windows Navigation Start.wav"
HKCU\AppEvents\Schemes\Apps\Explorer\Navigating\.Current\: ""
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\load: ""
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\load: "C:\WINDOWS\system32\msyqc.exe"
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\run: ""
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\run: "C:\WINDOWS\system32\msovt.exe"
----------------------------------
Files added:15
----------------------------------
C:\Documents and Settings\Administrator\Local Settings\Temp\~DF27D2.tmp
C:\WINDOWS\system32\3361\services.exe
C:\WINDOWS\system32\install.log
C:\WINDOWS\system32\lsass.dll
C:\WINDOWS\system32\msdts.exe
C:\WINDOWS\system32\mseqgl.exe
C:\WINDOWS\system32\msjbbp.exe
C:\WINDOWS\system32\msojp.exe
C:\WINDOWS\system32\msovt.exe
C:\WINDOWS\system32\msuyimd.exe
C:\WINDOWS\system32\msyqc.exe
C:\WINDOWS\system32\mszshx.exe
C:\WINDOWS\system32\svchost.dll
C:\WINDOWS\system32\winexec.dll
C:\WINDOWS\system32\winres.dll
----------------------------------
Files deleted:1
----------------------------------
C:\sand-box\winres.exe
----------------------------------
Files [attributes?] modified:1
----------------------------------
C:\WINDOWS\system32\wbem\Logs\wbemcore.log
----------------------------------
Folders added:1
----------------------------------
C:\WINDOWS\system32\3361
----------------------------------
Folders deleted:0
----------------------------------
----------------------------------
Total changes:64
----------------------------------
-------------------------------------------------------------------------------------
Detected by RegRun Reanimator:
Type: Main File Extentions
Item Name: .exe
Related File: msioeyi.exe "%1" %*
Type: Main File Extentions
Item Name: .com
Related File: msioeyi.exe "%1" %*
Type: Main File Extentions
Item Name: .bat
Related File: msioeyi.exe "%1" %*
Type: Explorer Run
Item Name: exec
Related File: C:\WINDOWS\system32\msmdicqw.exe
Type: Win.ini
Item Name: load
Related File: C:\WINDOWS\system32\msmyuxiq.exe
Type: Win.ini
Item Name: run
Related File: C:\WINDOWS\system32\mszunb.exe
Removal Results: Success
Number of reboot: 1
Dmitry Sokolov:
I created UnHackMe in 2006 to fix the problem that antivioruses did not fix: detecting rootkits.
Since that time I work every day to fix the issues that antiviruses cannot.
If your antivirus have not helped you solve the problem, you should try UnHackMe.
We are a small company and you can ask me directly, if you have any questions.