Necessary At your option Useless Dangerous Windows Programs - Useful, Useless or Malicious
Startupapps.com recommends you:

UnHackMe Warrior Removing rootkits is best done from the "clean" Windows!

UnHackMe Warrior

Blog: New viruses/malware/rootkits. Everyday!

Blog: How to remove malware/Trojans/rootkits using UnHackMe or manually. We know how to remove malware.

Shortcut Antivirus protects against Microsoft LNK and PIF vulnerability, notify a user about found threats and give possibility to immediately remove threats.

StuxnetRemover - free of charge Stuxnet/Tmphider rootkit removal tool.

Blog: System Software Research. What is under the hood? Who is faster? Antiviral and system software under microscope...

Dangerous %sysdir%\3361\services.exe - Dangerous

Fix it immediately


%sysdir%\3361\services.exe
We suggest you to remove %SysDir%\3361\services.exe from your computer as soon as possible.
%SysDir%\3361\services.exe is Trojan/Backdoor.
Kill the process %SysDir%\3361\services.exe and remove %SysDir%\3361\services.exe from Windows startup.

File:
C:\sand-box\winres.exe

Classification:
Antivirus Version Last Update Result
Prevx 3.0 2009.06.16 Medium Risk Malware

Additional information
File size: 262144 bytes
MD5 : 852cd76aa08b6699d34b0095bdf8be5c
SHA1 : ce571004ba48da686b5403d1f1445f197f37f0a2

Installation
When the program is executed, it creates the following registry subkeys and values:

----------------------------------
Keys added:10
----------------------------------
HKLM\SOFTWARE\Classes\csfile
HKLM\SOFTWARE\Classes\csfile\DefaultIcon
HKLM\SOFTWARE\Classes\csfile\shell
HKLM\SOFTWARE\Classes\csfile\shell\open
HKLM\SOFTWARE\Classes\csfile\shell\open\command
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\NOHIDORSYS
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
HKCU\Software\Microsoft\Internet Explorer\LowRegistry\Extensions
HKCU\Software\Microsoft\Internet Explorer\LowRegistry\Extensions\CmdMapping

----------------------------------
Values added:12
----------------------------------
HKLM\SOFTWARE\Classes\csfile\shell\open\command\: "msojp.exe "%1" %*"
HKLM\SOFTWARE\Classes\csfile\DefaultIcon\: "%1"
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\Use FormSuggest: "yes"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\NOHIDORSYS\CheckedValue: 0x00000000
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run\exec: "C:\WINDOWS\system32\msjbbp.exe"
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions: 0x00000000
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\WINDOWS\system32\3361\services.exe: "C:\WINDOWS\system32\3361\services.exe:*:Enabled:services.exe"
HKCU\Software\Microsoft\Internet Explorer\LowRegistry\Extensions\CmdMapping\{e2e2dd38-d088-4134-82b7-f2ba38496583}: 0x00002000
HKCU\Software\Microsoft\Internet Explorer\LowRegistry\Extensions\CmdMapping\NextId: 0x00002001
HKCU\Software\Microsoft\Internet Explorer\Main\Use FormSuggest: "yes"
HKCU\Software\Microsoft\Internet Explorer\Main\DisableScriptDebuggerIE: "yes"
HKCU\Software\Microsoft\Internet Explorer\Main\Error Dlg Displayed On Every Error: "no"

----------------------------------
Values modified:24
----------------------------------
HKLM\SOFTWARE\Classes\.bat\: "batfile"
HKLM\SOFTWARE\Classes\.bat\: "csfile"
HKLM\SOFTWARE\Classes\.com\: "comfile"
HKLM\SOFTWARE\Classes\.com\: "csfile"
HKLM\SOFTWARE\Classes\.exe\: "exefile"
HKLM\SOFTWARE\Classes\.exe\: "csfile"
HKLM\SOFTWARE\Classes\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\: "C:\WINDOWS\system32\mswinsck.ocx"
HKLM\SOFTWARE\Classes\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\: "C:\WINDOWS\system32\MSWINSCK.OCX"
HKLM\SOFTWARE\Classes\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ToolboxBitmap32\: "C:\WINDOWS\system32\mswinsck.ocx, 1"
HKLM\SOFTWARE\Classes\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ToolboxBitmap32\: "C:\WINDOWS\system32\MSWINSCK.OCX, 1"
HKLM\SOFTWARE\Classes\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\: "C:\WINDOWS\system32\mswinsck.ocx"
HKLM\SOFTWARE\Classes\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\: "C:\WINDOWS\system32\MSWINSCK.OCX"
HKLM\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\0\win32\: "C:\WINDOWS\system32\mswinsck.ocx"
HKLM\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\0\win32\: "C:\WINDOWS\system32\MSWINSCK.OCX"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\CheckedValue: 0x00000001
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\CheckedValue: 0x00000000
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug\Auto: "1"
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug\Auto: "0"
HKCU\AppEvents\Schemes\Apps\Explorer\Navigating\.Current\: "%SystemRoot%\media\Windows Navigation Start.wav"
HKCU\AppEvents\Schemes\Apps\Explorer\Navigating\.Current\: ""
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\load: ""
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\load: "C:\WINDOWS\system32\msyqc.exe"
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\run: ""
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\run: "C:\WINDOWS\system32\msovt.exe"

----------------------------------
Files added:15
----------------------------------
C:\Documents and Settings\Administrator\Local Settings\Temp\~DF27D2.tmp
C:\WINDOWS\system32\3361\services.exe
C:\WINDOWS\system32\install.log
C:\WINDOWS\system32\lsass.dll
C:\WINDOWS\system32\msdts.exe
C:\WINDOWS\system32\mseqgl.exe
C:\WINDOWS\system32\msjbbp.exe
C:\WINDOWS\system32\msojp.exe
C:\WINDOWS\system32\msovt.exe
C:\WINDOWS\system32\msuyimd.exe
C:\WINDOWS\system32\msyqc.exe
C:\WINDOWS\system32\mszshx.exe
C:\WINDOWS\system32\svchost.dll
C:\WINDOWS\system32\winexec.dll
C:\WINDOWS\system32\winres.dll

----------------------------------
Files deleted:1
----------------------------------
C:\sand-box\winres.exe

----------------------------------
Files [attributes?] modified:1
----------------------------------
C:\WINDOWS\system32\wbem\Logs\wbemcore.log

----------------------------------
Folders added:1
----------------------------------
C:\WINDOWS\system32\3361

----------------------------------
Folders deleted:0
----------------------------------

----------------------------------
Total changes:64
----------------------------------

-------------------------------------------------------------------------------------
Detected by RegRun Reanimator:

Type: Main File Extentions
Item Name: .exe
Related File: msioeyi.exe "%1" %*

Type: Main File Extentions
Item Name: .com
Related File: msioeyi.exe "%1" %*

Type: Main File Extentions
Item Name: .bat
Related File: msioeyi.exe "%1" %*

Type: Explorer Run
Item Name: exec
Related File: C:\WINDOWS\system32\msmdicqw.exe

Type: Win.ini
Item Name: load
Related File: C:\WINDOWS\system32\msmyuxiq.exe

Type: Win.ini
Item Name: run
Related File: C:\WINDOWS\system32\mszunb.exe

Removal Results: Success
Number of reboot: 1

Remove 3361_SERVICES.EXE.HTM now!

Install UnHackMe Install RegRun

Virus Problem? Google Redirects? Ads? Slow?

  1. First download the latest version UnHackMe: Download UnHackMe.
  2. Open the archive and start the unhackme_setup.exe.
  3. When the installation is over you will see the main UnHackMe screen.
  4. Click on the Advanced button and choose “Send report to the support center” in the popup menu. Follow the instructions. The report file (regrunlog.txt) will be saved on your Desktop.
  5. Go to the Support Center. Attach it to your ticket and click on the Browse button and then to the regrunlog.txt file. Don’t insert the report text directly into the message text! We won’t be able to analyse such a report. Describe your problem in detail. Add the screenshot, your antivirus log or suspicious files.


Constantly updated. Last update: February 5 2012


Fix Windows PC's Fast! Automated Software Repairs damaged & slow windows systems in 1 click.



Quick Links
What's new?
RSS Feed
Add to AppDatabase
Ask Experts
Join forum
Links

Articles
Virus or not? SPTD####.sys
What is mc21.tmp, mc22.tmp, mc23.tmp?

Select
Necessary
Useless
At your option
Dangerous

Copyright © 1998-2012 Greatis Software