|
|
UnHackMe Warrior Removing rootkits is best done from the "clean" Windows!
Blog: New viruses/malware/rootkits. Everyday!
Blog: How to remove malware/Trojans/rootkits using UnHackMe or manually. We know how to remove malware.
Shortcut Antivirus protects against Microsoft LNK and PIF vulnerability, notify a user about found threats and give possibility to immediately remove threats.
StuxnetRemover - free of charge Stuxnet/Tmphider rootkit removal tool.
|
 %sysdir%\3361\services.exe - Dangerous
Fix it immediately
%SysDir%\3361\services.exe is Trojan/Backdoor. Kill the process %SysDir%\3361\services.exe and remove %SysDir%\3361\services.exe from Windows startup. File: C:\sand-box\winres.exe Classification: Antivirus Version Last Update Result Prevx 3.0 2009.06.16 Medium Risk Malware Additional information File size: 262144 bytes MD5 : 852cd76aa08b6699d34b0095bdf8be5c SHA1 : ce571004ba48da686b5403d1f1445f197f37f0a2 Installation When the program is executed, it creates the following registry subkeys and values: ---------------------------------- Keys added:10 ---------------------------------- HKLM\SOFTWARE\Classes\csfile HKLM\SOFTWARE\Classes\csfile\DefaultIcon HKLM\SOFTWARE\Classes\csfile\shell HKLM\SOFTWARE\Classes\csfile\shell\open HKLM\SOFTWARE\Classes\csfile\shell\open\command HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\NOHIDORSYS HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run HKCU\Software\Microsoft\Internet Explorer\LowRegistry\Extensions HKCU\Software\Microsoft\Internet Explorer\LowRegistry\Extensions\CmdMapping ---------------------------------- Values added:12 ---------------------------------- HKLM\SOFTWARE\Classes\csfile\shell\open\command\: "msojp.exe "%1" %*" HKLM\SOFTWARE\Classes\csfile\DefaultIcon\: "%1" HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\Use FormSuggest: "yes" HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\NOHIDORSYS\CheckedValue: 0x00000000 HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run\exec: "C:\WINDOWS\system32\msjbbp.exe" HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions: 0x00000000 HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\WINDOWS\system32\3361\services.exe: "C:\WINDOWS\system32\3361\services.exe:*:Enabled:services.exe" HKCU\Software\Microsoft\Internet Explorer\LowRegistry\Extensions\CmdMapping\{e2e2dd38-d088-4134-82b7-f2ba38496583}: 0x00002000 HKCU\Software\Microsoft\Internet Explorer\LowRegistry\Extensions\CmdMapping\NextId: 0x00002001 HKCU\Software\Microsoft\Internet Explorer\Main\Use FormSuggest: "yes" HKCU\Software\Microsoft\Internet Explorer\Main\DisableScriptDebuggerIE: "yes" HKCU\Software\Microsoft\Internet Explorer\Main\Error Dlg Displayed On Every Error: "no" ---------------------------------- Values modified:24 ---------------------------------- HKLM\SOFTWARE\Classes\.bat\: "batfile" HKLM\SOFTWARE\Classes\.bat\: "csfile" HKLM\SOFTWARE\Classes\.com\: "comfile" HKLM\SOFTWARE\Classes\.com\: "csfile" HKLM\SOFTWARE\Classes\.exe\: "exefile" HKLM\SOFTWARE\Classes\.exe\: "csfile" HKLM\SOFTWARE\Classes\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\: "C:\WINDOWS\system32\mswinsck.ocx" HKLM\SOFTWARE\Classes\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\: "C:\WINDOWS\system32\MSWINSCK.OCX" HKLM\SOFTWARE\Classes\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ToolboxBitmap32\: "C:\WINDOWS\system32\mswinsck.ocx, 1" HKLM\SOFTWARE\Classes\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ToolboxBitmap32\: "C:\WINDOWS\system32\MSWINSCK.OCX, 1" HKLM\SOFTWARE\Classes\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\: "C:\WINDOWS\system32\mswinsck.ocx" HKLM\SOFTWARE\Classes\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\: "C:\WINDOWS\system32\MSWINSCK.OCX" HKLM\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\0\win32\: "C:\WINDOWS\system32\mswinsck.ocx" HKLM\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\0\win32\: "C:\WINDOWS\system32\MSWINSCK.OCX" HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\CheckedValue: 0x00000001 HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\CheckedValue: 0x00000000 HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug\Auto: "1" HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug\Auto: "0" HKCU\AppEvents\Schemes\Apps\Explorer\Navigating\.Current\: "%SystemRoot%\media\Windows Navigation Start.wav" HKCU\AppEvents\Schemes\Apps\Explorer\Navigating\.Current\: "" HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\load: "" HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\load: "C:\WINDOWS\system32\msyqc.exe" HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\run: "" HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\run: "C:\WINDOWS\system32\msovt.exe" ---------------------------------- Files added:15 ---------------------------------- C:\Documents and Settings\Administrator\Local Settings\Temp\~DF27D2.tmp C:\WINDOWS\system32\3361\services.exe C:\WINDOWS\system32\install.log C:\WINDOWS\system32\lsass.dll C:\WINDOWS\system32\msdts.exe C:\WINDOWS\system32\mseqgl.exe C:\WINDOWS\system32\msjbbp.exe C:\WINDOWS\system32\msojp.exe C:\WINDOWS\system32\msovt.exe C:\WINDOWS\system32\msuyimd.exe C:\WINDOWS\system32\msyqc.exe C:\WINDOWS\system32\mszshx.exe C:\WINDOWS\system32\svchost.dll C:\WINDOWS\system32\winexec.dll C:\WINDOWS\system32\winres.dll ---------------------------------- Files deleted:1 ---------------------------------- C:\sand-box\winres.exe ---------------------------------- Files [attributes?] modified:1 ---------------------------------- C:\WINDOWS\system32\wbem\Logs\wbemcore.log ---------------------------------- Folders added:1 ---------------------------------- C:\WINDOWS\system32\3361 ---------------------------------- Folders deleted:0 ---------------------------------- ---------------------------------- Total changes:64 ---------------------------------- ------------------------------------------------------------------------------------- Detected by RegRun Reanimator: Type: Main File Extentions Item Name: .exe Related File: msioeyi.exe "%1" %* Type: Main File Extentions Item Name: .com Related File: msioeyi.exe "%1" %* Type: Main File Extentions Item Name: .bat Related File: msioeyi.exe "%1" %* Type: Explorer Run Item Name: exec Related File: C:\WINDOWS\system32\msmdicqw.exe Type: Win.ini Item Name: load Related File: C:\WINDOWS\system32\msmyuxiq.exe Type: Win.ini Item Name: run Related File: C:\WINDOWS\system32\mszunb.exe Removal Results: Success Number of reboot: 1
Remove 3361_SERVICES.EXE.HTM now!
Virus Problem? Google Redirects? Ads? Slow?
Constantly updated. Last update: February 5 2012
Fix Windows PC's Fast! Automated Software Repairs damaged & slow windows systems in 1 click.
|
|
