HAY GUYS

Zergrinch · Local time: May 14, 2009, 02:37 AM

I got owned by Malware when I was installing CorelDraw X4, and I need help to kill it. As much as possible, I would like to avoid reformatting.

Basically, the name of the worm that got me was "W32.Spybot.Worm", according to Symantec Antivirus. This appears to be a variant different from the ones on the Symantec database, however.

Relevant HiJackThis log transcript as follows:

Spoiler:

I am aware of the existence of strange files in
C:\Program Files\Common Files\Win SVC 32service.exe
C:\Program Files\Common Files\SERVICES\S-1-5-21-1303342014-1704936951-537590071-0504\services.exe
C:\Program Files\Common Files\SERVICES

I have tried to delete them, and replaced the files with empty txt files set to read-only. I have also deleted the registry entries that pointed to these files. To no avail.

After a specific interval, they're all miraculously restored.

The only odd behavior I notice is a window called "Process1" appearing, followed by Windows Firewall turning itself off.

It seems that "Explorer.exe" has been affected - everytime I force it to exit and restart the program, the "Process1" window appears and the firewall turns itself off. Upon examination with Sysinternals Registry Monitor, I observe Explorer.exe writing registry keys that point "TaskMan" to "Win SVC 32service.exe" located in D:\Recycler\S-1-5-21-1935655697-2049760794-682003330-1003\

I have done a full system scan with Symantec Antivirus and Spybot Search and Destroy - to no avail. They detected the malware, cleaned it, but this still happens.

I am currently runnign a full scan with the latest Microsoft Malicious Software Removal Tool, and VundoFix.

I need help on this, and any recommentations on programs I can try is greatly appreciated!

Jam it back in, in the dark.

**RacinReaver** · Local time: May 13, 2009, 01:31 PM

I'd recommend putting on a registry monitor so you can be notified whenever this thing tries to replicate itself after you delete one portion. A while ago I got hit by Vundo, and while the various fixes for it were helping, none would completely eradicate it on their own, and between restarts my computer would get completely reinfected. I think AVG comes with one that will let you choose which registry modifications to allow as they're happening, though it might have been part of Spybot (I don't remember).

How ya doing, buddy?

RYU · Local time: May 14, 2009, 01:49 PM

try to delete with unlocker very easy to use.

C:\Program Files\Common Files\Win SVC 32service.exe
C:\Program Files\Common Files\SERVICES\S-1-5-21-1303342014-1704936951-537590071-0504\services.exe

This thing is sticky, and I don't like it. I don't appreciate it.

Zergrinch · Local time: May 14, 2009, 06:51 PM

RYU, deleting isn't the issue. The issue is, it keeps coming back

How ya doing, buddy?

RYU · Local time: May 14, 2009, 06:02 PM

first use unlocker to delete Recycler folder "as hidden" in all root drivers then try to use Trojan Remover,i hope remove forever also try to delete any hidden files (exe & dll) in "C:\WINDOWS\system32",if still come back send to me two files.

I was speaking idiomatically.

RYU · Local time: May 15, 2009, 06:59 PM

its fixed or not?

What kind of toxic man-thing is happening now?

Zergrinch · Local time: May 16, 2009, 12:06 AM

Here is what I did.

First, I deleted the files in the paths referenced. Then I created blank files with the same names as these evil files, and set them to system, hidden, and read-only.

Next, I went into Safe Mode, closed down explorer.exe, and extracted a new one from the Windows XP CD.

Finally, still in Safe Mode, I ran Sysinternals Autoruns, and unchecked anything that looked suspicious.

After a reboot, the registry entries I deactivated remained deactivated. However, my video card driver was reset to generic VGA device. I reinstalled the driver, and ran Windows Update to get updated on all fixes.

After another reboot, the video card driver was gone again!

I am no longer having problems with the malware, but I am still observing my system. If the video card driver keeps on disappearing, then I will have no choice but to reapply my system image. I have a system image dated one month ago, back when I was having problems with burning hard disks.

I am crossing my fingers and am hoping that everything is okay now.

FELIPE NO

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
Malware etc threat	Sacred X	Help Desk	6	Jan 12, 2009 03:13 AM
Deep Freeze (and protection for VIRUSES and malware)	Maico	Help Desk	9	Aug 21, 2006 04:37 AM
Free Malware Program?	Tsunade	Help Desk	11	Jul 26, 2006 03:57 AM
Free Malware Removal Software	GrimReaper	Help Desk	1	Jun 3, 2006 08:13 PM