[Not curable - Virut] Infected: Mal/Generic-A (& Others)

Computer was infected yesterday with the Mal/Generic-A and 6 other viruses (listed below)

• Mal/FakAV-AD
• Mal/Dorf-D
• Mal/HCKPK-A
• Mal/EncPK-IV
• Troj/Scribhos-A
• Trojan Horse: Trojan-Downlaoder-Popwin

Mal/Generic-A appears to be the most invasive - location (per Webroot scan):

"Mal/Generic-A in file \\?\Globalroot\Systemroot\System32\HJGuruishwvpeoa.dll "

Mal/Generic-A is running in memory. Prevents system reboot in anything but safe mode. No internet access. Running Webroot Antivirus. After a complete system scan, all viruses are identified; however, when I attempt to quarantine, I get the blue screen and 'do loop' back to the start up. Once there, I can only boot up in safe mode. When I go back into Webroot, none of the viruses were quarantined.

Using other home computer to relay information.

DDS Log:

DDS (Ver_09-06-26.01) - NTFSx86 MINIMAL
Run by Big Daddy at 13:03:40.63 on Sat 07/25/2009
Internet Explorer: 8.0.6001.18783
Microsoft® Windows Vistaâ„¢ Home Premium 6.0.6001.1.1252.1.1033.18.2038.1318 [GMT -5:00]

SP: Windows Defender *enabled* (Outdated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Program Files\Webroot\Spy Sweeper\WRConsumerService.exe
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k NetworkService
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\wbem\wmiprvse.exe
E:\dds.pif

============== Pseudo HJT Report ===============

uStart Page = hxxp://join.123cashformula.com/track/NTI4MzEuNy42LjEyLjAuMC4wLjA
mDefault_Page_URL = hxxp://www.sony.com/vaiopeople
uInternet Settings,ProxyOverride = *.local
uURLSearchHooks: N/A: {0579b4b6-0293-4d73-b02d-5ebb0ba0f0a2} - c:\program files\asksbar\srchastt\1.bin\A2SRCHAS.DLL
uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\progra~1\yahoo!\companion\installs\cpn\yt.dll
BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\progra~1\yahoo!\companion\installs\cpn\yt.dll
BHO: Yahoo! IE Services Button: {5bab4b5b-68bc-4b02-94d6-2fc0de4a7897} - c:\program files\yahoo!\common\yiesrvc.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\progra~1\yahoo!\companion\installs\cpn\yt.dll
TB: {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No File
uRun: [ISUSPM Startup] "c:\progra~1\common~1\instal~1\update~1\ISUSPM.exe" -startup
uRun: [MyWebSearch Email Plugin] "c:\progra~1\mywebs~1\bar\1.bin\mwsoemon.exe "
uRun: [RegistryMechanic] "c:\program files\registry mechanic\RMTray.exe" /H
uRunOnce: [RegistryMechanic] "c:\program files\registry mechanic\RegMech.exe" /F
mRun: [Windows Defender] "c:\program files\windows defender\MSASCui.exe" -hide
mRun: [IgfxTray] "c:\windows\system32\igfxtray.exe "
mRun: [HotKeysCmds] "c:\windows\system32\hkcmd.exe "
mRun: [Persistence] "c:\windows\system32\igfxpers.exe "
mRun: [Apoint] "c:\program files\apoint\Apoint.exe "
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe "
mRun: [ISBMgr.exe] "c:\program files\sony\isb utility\ISBMgr.exe "
mRun: [VAIO Center Access Bar] "c:\program files\sony\vaio center access bar\VCAB.exe "
mRun: [VAIOSecurity] "c:\program files\sony\vaio security center\VSC.exe" 1
mRun: [NvSvc] "c:\windows\system32\rundll32.exe" c:\windows\system32\nvsvc.dll,nvsvcStart
mRun: [NvCplDaemon] "c:\windows\system32\rundll32.exe" c:\windows\system32\NvCpl.dll,NvStartup
mRun: [NvMediaCenter] "c:\windows\system32\rundll32.exe" c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start
mRun: [<NO NAME>]
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe "
mRun: [AppleSyncNotifier] "c:\program files\common files\apple\mobile device support\bin\AppleSyncNotifier.exe "
mRun: [Kernel and Hardware Abstraction Layer] "c:\windows\KHALMNPR.EXE "
mRun: [LELA] "c:\program files\linksys\linksys easylink advisor\Linksys EasyLink Advisor.exe" /minimized
mRun: [nmctxth] "c:\program files\common files\pure networks shared\platform\nmctxth.exe "
mRun: [MyWebSearch Plugin] "c:\windows\system32\rundll32.exe" c:\progra~1\mywebs~1\bar\1.bin\M3PLUGIN.DLL,UPF
mRun: [My Web Search Bar Search Scope Monitor] "c:\progra~1\mywebs~1\bar\1.bin\m3SrchMn.exe" /m=2 /w /h
mRun: [MyWebSearch Email Plugin] "c:\progra~1\mywebs~1\bar\1.bin\mwsoemon.exe "
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe "
mRun: [SpySweeper] c:\program files\webroot\spy sweeper\SpySweeperUI.exe /startintray
mRunOnce: [Malwarebytes' Anti-Malware] c:\program files\malwarebytes' anti-malware\mbamgui.exe /install /silent
mRunOnce: [Malwarebytes Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript
dRun: [mswindows restore service] c:\windows\temp\n43cwi9nz.exe
dRun: [pridl] "c:\windows\system32\config\systemprofile\appdata\roaming\pridl\pridl.exe" 61A847B5BBF72811329B385672FF01F0B3E35B6638993F4661AA4EBD86D67C56389B284534F310
StartupFolder: c:\users\bigdad~1\appdata\roaming\micros~1\windows\startm~1\programs\startup\pictur~1.lnk - c:\program files\sony\sony picture utility\volumewatcher\SPUVolumeWatcher.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\canonp~1.lnk - c:\windows\system32\spool\drivers\w32x86\3\CAPM3LAK.EXE
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\f1u201~1.lnk - c:\program files\belkin\f1u201.401\usbshare.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\logite~1.lnk - c:\program files\logitech\setpoint\SetPoint.exe
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: &Search
IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office12\EXCEL.EXE/3000
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~4\office12\ONBttnIE.dll
IE: {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - c:\program files\yahoo!\common\yiesrvc.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~4\office12\REFIEBAR.DLL
DPF: CabBuilder - hxxp://ak.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/8/b/d/8bd77752-5704-4d68-a152-f7252adaa4f2/LegitCheckControl.cab
DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\Yinsthelper.dll
DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} - hxxp://dl.tvunetworks.com/TVUAx.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} -
Handler: pure-go - {4746C79A-2042-4332-8650-48966E44ABA8} - c:\program files\common files\pure networks shared\platform\puresp3.dll
Notify: igfxcui - igfxdev.dll
Notify: VESWinlogon - VESWinlogon.dll

============= SERVICES / DRIVERS ===============

R0 ssfs0bbc;ssfs0bbc;c:\windows\system32\drivers\ssfs0bbc.sys [2009-4-21 29808]
R2 WRConsumerService;Webroot Client Service;c:\program files\webroot\spy sweeper\WRConsumerService.exe [2009-7-6 1205760]
S1 pwipf6;Privacyware Filter Driver;c:\windows\system32\drivers\pwipf6.sys [2008-7-2 101128]
S2 fuwd;fuwd;c:\windows\system32\drivers\dsxo.sys [2009-7-25 61440]
S2 LinksysUpdater;Linksys Updater;c:\program files\linksys\linksys updater\bin\LinksysUpdater.exe [2008-5-8 225280]
S2 MSSQL$VAIO_VEDB;SQL Server (VAIO_VEDB);c:\program files\microsoft sql server\mssql.1\mssql\binn\sqlservr.exe [2008-11-24 29263712]
S2 MyWebSearchService;My Web Search Service;c:\progra~1\mywebs~1\bar\1.bin\mwssvc.exe --> c:\progra~1\mywebs~1\bar\1.bin\mwssvc.exe [?]
S2 RapidPortM3;RapidPortM3;c:\windows\system32\drivers\CAPM3LP.SYS [2007-12-28 22976]
S2 regi;regi;c:\windows\system32\drivers\regi.sys [2007-4-17 11032]
S2 WDFNet;Webroot Desktop Firewall network service;c:\program files\webroot\webroot desktop firewall\wdfsvc.exe --> c:\program files\webroot\webroot desktop firewall\wdfsvc.exe [?]
S3 R5U870FLx86;R5U870 UVC Lower Filter ;c:\windows\system32\drivers\R5U870FLx86.sys [2007-5-1 74240]
S3 R5U870FUx86;R5U870 UVC Upper Filter ;c:\windows\system32\drivers\R5U870FUx86.sys [2007-5-1 43904]
S3 SonyImgF;Sony Image Conversion Filter Driver;c:\windows\system32\drivers\SonyImgF.sys [2007-5-1 31104]
S3 ti21sony;ti21sony;c:\windows\system32\drivers\ti21sony.sys [2007-5-1 807424]

=============== Created Last 30 ================

2009-07-25 12:08 61,440 a------- c:\windows\system32\drivers\dsxo.sys
2009-07-25 11:09 <DIR> --d----- c:\users\bigdad~1\appdata\roaming\Malwarebytes
2009-07-25 11:09 38,160 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-07-25 11:09 <DIR> --d----- c:\programdata\Malwarebytes
2009-07-25 11:09 <DIR> --d----- c:\progra~2\Malwarebytes
2009-07-25 11:09 19,096 a------- c:\windows\system32\drivers\mbam.sys
2009-07-25 11:09 <DIR> --d----- c:\program files\Malwarebytes' Anti-Malware
2009-07-25 08:22 <DIR> --d----- c:\program files\common files\Wise Installation Wizard
2009-07-24 21:22 <DIR> a-d----- c:\programdata\TEMP
2009-07-24 21:21 506,368 a------- c:\windows\system32\msxml.dll
2009-07-24 16:50 <DIR> --dsh--- c:\windows\system32\%APPDATA%
2009-07-16 08:16 <DIR> --d----- c:\users\big daddy\Temp
2009-07-15 02:42 289,792 a------- c:\windows\system32\atmfd.dll
2009-07-15 02:42 156,672 a------- c:\windows\system32\t2embed.dll
2009-07-15 02:42 72,704 a------- c:\windows\system32\fontsub.dll
2009-07-15 02:42 10,240 a------- c:\windows\system32\dciman32.dll
2009-07-12 19:15 62,464 a------- c:\windows\loadernew.exe
2009-07-06 14:19 <DIR> --d----- c:\program files\iPod
2009-07-06 14:19 <DIR> --d----- c:\program files\iTunes
2009-07-06 13:36 <DIR> --d----- c:\program files\MSSOAP
2009-07-06 13:36 <DIR> --d----- c:\program files\common files\MSSoap
2009-07-06 08:42 97,800 a------- c:\windows\system32\infocardapi.dll
2009-07-06 08:42 105,016 a------- c:\windows\system32\PresentationCFFRasterizerNative_v0300.dll
2009-07-06 08:42 37,384 a------- c:\windows\system32\infocardcpl.cpl
2009-07-06 08:41 622,080 a------- c:\windows\system32\icardagt.exe
2009-07-06 08:41 11,264 a------- c:\windows\system32\icardres.dll
2009-07-06 08:41 43,544 a------- c:\windows\system32\PresentationHostProxy.dll
2009-07-06 08:41 781,344 a------- c:\windows\system32\PresentationNative_v0300.dll
2009-07-06 08:41 326,160 a------- c:\windows\system32\PresentationHost.exe
2009-07-06 08:23 96,760 a------- c:\windows\system32\dfshim.dll
2009-07-06 08:23 282,112 a------- c:\windows\system32\mscoree.dll
2009-07-06 08:23 41,984 a------- c:\windows\system32\netfxperf.dll
2009-07-06 08:23 158,720 a------- c:\windows\system32\mscorier.dll
2009-07-06 08:22 83,968 a------- c:\windows\system32\mscories.dll
2009-07-06 08:20 1,638,912 a------- c:\windows\system32\mshtml.tlb
2009-07-06 08:20 71,680 a------- c:\windows\system32\iesetup.dll
2009-07-06 08:20 915,456 a------- c:\windows\system32\wininet.dll
2009-07-06 08:20 1,469,440 a------- c:\windows\system32\inetcpl.cpl

==================== Find3M ====================

2009-07-06 14:10 143,360 a------- c:\windows\inf\infstrng.dat
2009-07-06 14:10 143,360 a------- c:\windows\inf\infstor.dat
2009-07-06 14:10 86,016 a------- c:\windows\inf\infpub.dat
2009-07-06 13:33 101,128 a------- c:\windows\system32\drivers\pwipf6.sys
2009-06-05 11:42 2,060,288 a------- c:\windows\system32\usbaaplrc.dll
2009-06-05 11:42 39,424 a------- c:\windows\system32\drivers\usbaapl.sys
2009-05-13 15:39 1,563,008 a------- c:\windows\WRSetup.dll
2009-05-04 15:03 59,904 a------- c:\windows\system32\zlib1.dll
2009-05-04 14:53 286,720 a------- c:\windows\system32\libcurl.dll
2009-05-04 14:53 1,028,096 a------- c:\windows\system32\libeay32.dll
2009-05-04 14:53 196,608 a------- c:\windows\system32\ssleay32.dll
2009-05-04 14:53 143,360 a------- c:\windows\system32\libexpatw.dll
2009-04-30 07:37 293,376 a------- c:\windows\system32\psisdecd.dll
2009-04-30 07:37 428,544 a------- c:\windows\system32\EncDec.dll
2008-06-21 09:20 174 a--sh--- c:\program files\desktop.ini
2008-06-21 09:08 665,600 a------- c:\windows\inf\drvindex.dat
2007-09-14 23:19 1,132,112 a------- c:\programdata\pswi_preloaded.exe
2007-09-14 23:19 1,132,112 a------- c:\progra~2\pswi_preloaded.exe
2006-11-02 07:42 287,440 a------- c:\windows\inf\perflib\0409\perfi.dat
2006-11-02 07:42 287,440 a------- c:\windows\inf\perflib\0409\perfh.dat
2006-11-02 07:42 30,674 a------- c:\windows\inf\perflib\0409\perfd.dat
2006-11-02 07:42 30,674 a------- c:\windows\inf\perflib\0409\perfc.dat
2006-11-02 04:20 287,440 a------- c:\windows\inf\perflib\0000\perfi.dat
2006-11-02 04:20 287,440 a------- c:\windows\inf\perflib\0000\perfh.dat
2006-11-02 04:20 30,674 a------- c:\windows\inf\perflib\0000\perfd.dat
2006-11-02 04:20 30,674 a------- c:\windows\inf\perflib\0000\perfc.dat

============= FINISH: 13:04:51.10 ===============

 

Thank you for the response.

I run Webroot Antivirus.

I ran the program and saved the log. Not sure what's incomplete. Let me know if there's something else I should do. Again, thank you for your help.

 

I never saw the second part. I downloaded one of the two from the links as indicated and ran the diagnostic.

Prior to coming to this site, the other anti-virus program I tried (yesterday) was Malwarebytes. It identified threats and removed them; however, the most invasive malware is still running in memory and not allowing me to boot up in normal mode. I have that log if you need to see it. I also ran the GMER diagnostic and saved that log as well. All that said, under 'normal conditions' I only have one anti-virus program running and that's Webroot.

I downloaded and ran the SecurityCheck.exe. Results below. Thank you..!

SecurityCheck Log:

Results of screen317's Security Check version 0.98.5
Windows Vista Service Pack 1
Out of date service pack!!
``````````````````````````````
Antivirus/Firewall Check:


WMIC entry does not exist for antivirus; attempting automatic update.
``````````````````````````````
Anti-malware/Other Utilities Check:
Spy Sweeper Core
Malwarebytes' Anti-Malware
Java(TM) 6 Update 11
Java(TM) SE Runtime Environment 6
Java(TM) 6 Update 3
Java(TM) 6 Update 7
Out of date Java installed!
Adobe Flash Player 10
Adobe Reader 9
``````````````````````````````
Process Check:
objlist.exe by Laurent
``````````````````````````````
DNS Vulnerability Check:
GREAT! (Very random)

`````````End of Log```````````

 

I have both Webroot (Spy Sweeper) and the Malwarebytes on my system. Do I need to do something to either/both of them to disable...? If so, I'm not sure how to do that...

 

I get an error when I try to run Combofix... Then an !! ALERT !! window pops up and says it's "NOT SAFE to continue!" Goes on to say that the Combofix package has been compromised and to reload a fresh copy from www.bleepingcomputer.com.. The last sentence says that "You may be infected with a file patching virus 'Virut'.. "

I deleted the file from my flash drive. Scanned the flash drive with OfficeScan (other computer) and reloaded the Combofix. Not showing any virus on the flash drive. Tried to run Combofix again on the infected computer with the same result as listed above.

 

My posts are not showing up because they have to be approved by a moderator..? Not sure what's going on.....

Combofix won't run......from previous post that didn't show up....

I've tried running Combofix three times. Each time I get an error that states "It is not SAFE to continue.. The contents of the Combofix pakcage has been compromised. Please download a fresh copy from: www.bleepingcomputer.com. Note: You may be invected with a file patching virus 'Virut'.. "

 

I'm running in Safe Mode. No internet access from infected computer. Should I copy them to my flash drive and upload from there..?

 

Won't load Safe Mode with Networking...

Here's the svchoste.exe result:

Antivirus Version Last Update Result
a-squared 4.5.0.24 2009.07.26 -
AhnLab-V3 5.0.0.2 2009.07.26 -
AntiVir 7.9.0.228 2009.07.24 -
Antiy-AVL 2.0.3.7 2009.07.24 -
Authentium 5.1.2.4 2009.07.26 -
Avast 4.8.1335.0 2009.07.26 -
AVG 8.5.0.387 2009.07.26 -
BitDefender 7.2 2009.07.26 -
CAT-QuickHeal 10.00 2009.07.25 -
ClamAV 0.94.1 2009.07.26 -
Comodo 1774 2009.07.26 -
DrWeb 5.0.0.12182 2009.07.26 -
eSafe 7.0.17.0 2009.07.26 Suspicious File
eTrust-Vet 31.6.6640 2009.07.25 -
F-Prot 4.4.4.56 2009.07.26 -
F-Secure 8.0.14470.0 2009.07.26 -
Fortinet 3.120.0.0 2009.07.26 -
GData 19 2009.07.26 -
Ikarus T3.1.1.64.0 2009.07.26 -
Jiangmin 11.0.800 2009.07.26 -
K7AntiVirus 7.10.802 2009.07.25 -
Kaspersky 7.0.0.125 2009.07.26 -
McAfee 5689 2009.07.26 -
McAfee+Artemis 5689 2009.07.26 -
McAfee-GW-Edition 6.8.5 2009.07.26 Heuristic.LooksLike.Win32.Suspicious.H
Microsoft 1.4903 2009.07.26 -
NOD32 4279 2009.07.26 -
Norman 6.01.09 2009.07.24 -
nProtect 2009.1.8.0 2009.07.26 -
Panda 10.0.0.14 2009.07.26 -
PCTools 4.4.2.0 2009.07.26 -
Prevx 3.0 2009.07.26 -
Rising 21.39.62.00 2009.07.26 -
Sophos 4.44.0 2009.07.26 Sus/BadSVC-A
Sunbelt 3.2.1858.2 2009.07.26 -
Symantec 1.4.4.12 2009.07.26 -
TheHacker 6.3.4.3.373 2009.07.24 -
TrendMicro 8.950.0.1094 2009.07.25 -
VBA32 3.12.10.9 2009.07.26 -
ViRobot 2009.7.25.1853 2009.07.25 -
VirusBuster 4.6.5.0 2009.07.26 -
Additional information
File size: 24320 bytes
MD5...: 91bd01a5dc8eddf64184a113814926b7
SHA1..: ca479b3b5187a77fadd13d19324794b86aa6c993
SHA256: 66b03dd8e94c12de30ace170e01379fcc22a07b8b7de40b88d9ef1af782ac22b
ssdeep: 384:gzBHgWPkbXKxUVkOsKVG3GI0yej4dT+VI2GEvmW9ZrbWxOHZfPQYyWP:gzBL
O6xUVkOs8G3HGj4OISPtR7P

PEiD..: -
TrID..: File type identification
Generic Win/DOS Executable (49.9%)
DOS Executable Generic (49.8%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.1%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x2083
timedatestamp.....: 0x47918b89 (Sat Jan 19 05:32:57 2008)
machinetype.......: 0x14c (I386)

( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x3a24 0x3c00 6.21 5037917ca875679df4e24d44d02f02b4
.data 0x5000 0x5ec 0x600 0.83 9203e7f188b0ecb11266e90e9a442853
.rsrc 0x6000 0x818 0xa00 3.75 013fd325d2363ecadecd660d847876e8
.reloc 0x7000 0x1000 0xf00 7.75 a2f45ec74803513b6526b03aafb3cd86

( 5 imports )
> KERNEL32.dll: HeapSetInformation, ExpandEnvironmentStringsW, CreateActCtxW, ReleaseActCtx, LCMapStringW, lstrlenW, DelayLoadFailureHook, InterlockedExchange, RegisterWaitForSingleObject, SetUnhandledExceptionFilter, GetModuleHandleA, QueryPerformanceCounter, GetTickCount, GetCurrentThreadId, GetCurrentProcessId, GetSystemTimeAsFileTime, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, GetCommandLineW, ExitProcess, SetProcessAffinityUpdateMode, InitializeCriticalSection, GetProcessHeap, SetErrorMode, HeapAlloc, HeapFree, WideCharToMultiByte, LocalFree, CloseHandle, LocalAlloc, LoadLibraryA, InterlockedCompareExchange, FreeLibrary, Sleep, GetProcAddress, DeactivateActCtx, LoadLibraryExW, GetLastError, ActivateActCtx, LeaveCriticalSection, lstrcmpW, EnterCriticalSection, lstrcmpiW
> msvcrt.dll: __p__commode, _adjust_fdiv, __setusermatherr, _amsg_exit, _initterm, exit, __p__fmode, _exit, memcpy, memset, __set_app_type, _terminate@@YAXXZ, _except_handler4_common, _controlfp, _cexit, __wgetmainargs, _XcptFilter
> ADVAPI32.dll: GetTokenInformation, InitializeSecurityDescriptor, SetSecurityDescriptorOwner, SetSecurityDescriptorGroup, SetEntriesInAclW, SetSecurityDescriptorDacl, StartServiceCtrlDispatcherW, RegDisablePredefinedCacheEx, EventRegister, EventEnabled, EventWrite, RegQueryValueExW, RegOpenKeyExW, RegCloseKey, RegisterServiceCtrlHandlerW, SetServiceStatus, OpenProcessToken
> ntdll.dll: RtlSubAuthoritySid, RtlFreeHeap, RtlCopySid, RtlSubAuthorityCountSid, RtlLengthRequiredSid, RtlAllocateHeap, RtlInitializeSid, RtlImageNtHeader, RtlSetProcessIsCritical, RtlUnhandledExceptionFilter, RtlInitializeCriticalSection
> RPCRT4.dll: RpcServerListen, RpcServerUnregisterIf, RpcMgmtWaitServerListen, RpcMgmtSetServerStackSize, RpcMgmtStopServerListening, RpcServerUnregisterIfEx, RpcServerRegisterIf, RpcServerUseProtseqEpW, I_RpcMapWin32Status

( 0 exports )

PDFiD.: -
RDS...: NSRL Reference Data Set
-


ATTENTION: VirusTotal is a free service offered by Hispasec Sistemas. There are no guarantees about the availability and continuity of this service. Although the detection rate afforded by the use of multiple antivirus engines is far superior to that offered by just one product, these results DO NOT guarantee the harmlessness of a file. Currently, there is not any solution that offers a 100% effectiveness rate for detecting viruses and malware.

 

Here's the userinit.exe:

Antivirus Version Last Update Result
a-squared 4.5.0.24 2009.07.26 -
AhnLab-V3 5.0.0.2 2009.07.26 -
AntiVir 7.9.0.228 2009.07.24 -
Antiy-AVL 2.0.3.7 2009.07.24 -
Authentium 5.1.2.4 2009.07.26 -
Avast 4.8.1335.0 2009.07.26 -
AVG 8.5.0.387 2009.07.26 -
BitDefender 7.2 2009.07.26 -
CAT-QuickHeal 10.00 2009.07.25 -
ClamAV 0.94.1 2009.07.26 -
Comodo 1774 2009.07.26 -
DrWeb 5.0.0.12182 2009.07.26 -
eSafe 7.0.17.0 2009.07.26 Suspicious File
eTrust-Vet 31.6.6640 2009.07.25 -
F-Prot 4.4.4.56 2009.07.26 -
F-Secure 8.0.14470.0 2009.07.26 -
Fortinet 3.120.0.0 2009.07.26 -
GData 19 2009.07.26 -
Ikarus T3.1.1.64.0 2009.07.26 -
Jiangmin 11.0.800 2009.07.26 -
K7AntiVirus 7.10.802 2009.07.25 -
Kaspersky 7.0.0.125 2009.07.26 -
McAfee 5689 2009.07.26 -
McAfee+Artemis 5689 2009.07.26 -
McAfee-GW-Edition 6.8.5 2009.07.26 Heuristic.LooksLike.Win32.Suspicious.H
Microsoft 1.4903 2009.07.26 -
NOD32 4279 2009.07.26 -
Norman 6.01.09 2009.07.24 -
nProtect 2009.1.8.0 2009.07.26 -
Panda 10.0.0.14 2009.07.26 -
PCTools 4.4.2.0 2009.07.26 -
Prevx 3.0 2009.07.26 -
Rising 21.39.62.00 2009.07.26 -
Sophos 4.44.0 2009.07.26 -
Sunbelt 3.2.1858.2 2009.07.26 -
Symantec 1.4.4.12 2009.07.26 -
TheHacker 6.3.4.3.373 2009.07.24 -
TrendMicro 8.950.0.1094 2009.07.25 -
VBA32 3.12.10.9 2009.07.26 -
ViRobot 2009.7.25.1853 2009.07.25 -
VirusBuster 4.6.5.0 2009.07.26 -
Additional information
File size: 27904 bytes
MD5...: 4d8ab2887a0337f02c6aeff4850455f5
SHA1..: 0de5ed37e91282cfc7b0ed3fd308fae5d38d5701
SHA256: d7082807303c135424f84cfa7a45df878a5e3787c1ad25f79519b572d300aa7b
ssdeep: 384gKvuowvkKP3vaAf7MQHZa34SACInaPGvF6xUqYzuSSqm6qFWd3ymWfG87Sk
y2:WwIPPZAJxGt/q6sqw1nB7Sky2

PEiD..: -
TrID..: File type identification
Generic Win/DOS Executable (49.9%)
DOS Executable Generic (49.8%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.1%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x2ae5
timedatestamp.....: 0x47918d87 (Sat Jan 19 05:41:27 2008)
machinetype.......: 0x14c (I386)

( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x4a2d 0x4c00 6.04 a21b68c5650468c1bc36f74b6c0ca26b
.data 0x6000 0x498 0x600 0.71 1c4544d585aae74667954f292fb15884
.rsrc 0x7000 0x780 0x800 4.04 9110c031f7af84bd01ee2d772a5521bd
.reloc 0x8000 0x1000 0xf00 7.61 f1fbe8ee93249c27dce40ac711c609e2

( 9 imports )
> USER32.dll: GetSystemMetrics, SystemParametersInfoW, MessageBoxW, LoadStringW, LoadRemoteFonts, CreateWindowExW, ExitWindowsEx, GetKeyboardLayout, CharNextW, DefWindowProcW, RegisterClassExW, DestroyWindow
> ADVAPI32.dll: RegOpenKeyExA, RegQueryValueExA, RegQueryInfoKeyW, RegDeleteTreeW, OpenProcessToken, RegCreateKeyExW, RegSetValueExW, RegQueryValueExW, RegOpenKeyExW, RegCloseKey
> CRYPT32.dll: CryptProtectData
> ntdll.dll: RtlInitUnicodeString, NtOpenKey, NtClose, DbgPrint
> NETAPI32.dll: NetApiBufferFree, DsGetDcNameW
> WLDAP32.dll: -, -, -, -, -, -
> USERENV.dll: -
> KERNEL32.dll: GetStartupInfoA, SetUnhandledExceptionFilter, GetModuleHandleA, QueryPerformanceCounter, GetTickCount, GetCurrentThreadId, GetCurrentProcessId, GetSystemTimeAsFileTime, TerminateProcess, UnhandledExceptionFilter, InterlockedExchange, DelayLoadFailureHook, ExpandEnvironmentStringsA, LoadLibraryA, InterlockedCompareExchange, HeapSetInformation, GetCurrentThread, SetThreadPriority, CreateThread, SetCurrentDirectoryW, FormatMessageW, GetCurrentProcess, GetFileAttributesExW, GetSystemDirectoryW, SetLastError, ExpandEnvironmentStringsW, CreateProcessW, lstrlenW, GetVersionExW, LocalFree, LocalAlloc, GetEnvironmentVariableW, FreeLibrary, GetProcAddress, LoadLibraryW, CompareFileTime, SearchPathW, SetEnvironmentVariableW, GetLastError, CloseHandle, WaitForSingleObject, Sleep, OpenEventW, SetEvent, GetUserDefaultLangID
> msvcrt.dll: exit, _acmdln, _initterm, memmove, __setusermatherr, _adjust_fdiv, __p__commode, __p__fmode, _ismbblead, _terminate@@YAXXZ, _except_handler4_common, _controlfp, _XcptFilter, _vsnwprintf, _exit, _cexit, __getmainargs, _wcsicmp, __set_app_type, memset, _amsg_exit

( 0 exports )

PDFiD.: -
RDS...: NSRL Reference Data Set
-


ATTENTION: VirusTotal is a free service offered by Hispasec Sistemas. There are no guarantees about the availability and continuity of this service. Although the detection rate afforded by the use of multiple antivirus engines is far superior to that offered by just one product, these results DO NOT guarantee the harmlessness of a file. Currently, there is not any solution that offers a 100% effectiveness rate for detecting viruses and malware.

 

explorer.exe result:

Antivirus Version Last Update Result
a-squared 4.5.0.24 2009.07.26 -
AhnLab-V3 5.0.0.2 2009.07.26 -
AntiVir 7.9.0.228 2009.07.24 W32/Virut.Gen
Antiy-AVL 2.0.3.7 2009.07.24 -
Authentium 5.1.2.4 2009.07.26 W32/Virut.AI!Generic
Avast 4.8.1335.0 2009.07.26 Win32:Vitro
AVG 8.5.0.387 2009.07.26 -
BitDefender 7.2 2009.07.26 Win32.Virtob.Gen.12
CAT-QuickHeal 10.00 2009.07.25 W32.Virut.G
ClamAV 0.94.1 2009.07.26 -
Comodo 1774 2009.07.26 -
DrWeb 5.0.0.12182 2009.07.26 Win32.Virut.56
eSafe 7.0.17.0 2009.07.26 -
eTrust-Vet 31.6.6640 2009.07.25 -
F-Prot 4.4.4.56 2009.07.26 W32/Virut.AI!Generic
F-Secure 8.0.14470.0 2009.07.26 Virus.Win32.Virut.ce
Fortinet 3.120.0.0 2009.07.26 -
GData 19 2009.07.26 Win32.Virtob.Gen.12
Ikarus T3.1.1.64.0 2009.07.26 -
Jiangmin 11.0.800 2009.07.26 -
K7AntiVirus 7.10.802 2009.07.25 -
Kaspersky 7.0.0.125 2009.07.26 Virus.Win32.Virut.ce
McAfee 5689 2009.07.26 W32/Virut.n.gen
McAfee+Artemis 5689 2009.07.26 W32/Virut.n.gen
McAfee-GW-Edition 6.8.5 2009.07.26 Win32.Virut.Gen
Microsoft 1.4903 2009.07.26 Virus:Win32/Virut.BM
NOD32 4279 2009.07.26 Win32/Virut.NBP
Norman 6.01.09 2009.07.24 -
nProtect 2009.1.8.0 2009.07.26 -
Panda 10.0.0.14 2009.07.26 -
PCTools 4.4.2.0 2009.07.26 -
Prevx 3.0 2009.07.26 -
Rising 21.39.62.00 2009.07.26 -
Sophos 4.44.0 2009.07.26 W32/Scribble-B
Sunbelt 3.2.1858.2 2009.07.26 Virus.Win32.Virut.ce (v)
Symantec 1.4.4.12 2009.07.26 W32.Virut.CF
TheHacker 6.3.4.3.373 2009.07.24 -
TrendMicro 8.950.0.1094 2009.07.25 PE_VIRUX.GEN-1
VBA32 3.12.10.9 2009.07.26 -
ViRobot 2009.7.25.1853 2009.07.25 -
VirusBuster 4.6.5.0 2009.07.26 -
Additional information
File size: 2947584 bytes
MD5...: 5f93d2876ccd66167202f28e49dbad25
SHA1..: cc36520aac140921013856dc7d65d12ebaf74906
SHA256: 6c5b899fe5b6d4d7f407b8dc59b02eeb8cbb7622f4682b364843809ba66b864d
ssdeep: 24576:OJxr/smirDRnW+7pGYCW5uXSA7jTeFadRsxKb/g/J/ulZ:O3DsmiZLC8A7
/eFw33l

PEiD..: -
TrID..: File type identification
Generic Win/DOS Executable (49.9%)
DOS Executable Generic (49.8%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.1%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x2ccdea
timedatestamp.....: 0x4907e242 (Wed Oct 29 04:10:42 2008)
machinetype.......: 0x14c (I386)

( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x6bea5 0x6c000 6.42 01efa0ddb451b63dd0bfb396b1d576ab
.data 0x6d000 0x215c 0x2000 0.84 7f3a4ccfbf6b5dd627231a22b6ee6f12
.rsrc 0x70000 0x2566a0 0x256800 7.04 bc9643f9701a6c8da708d2bd5b751ff2
.reloc 0x2c7000 0xac00 0xac00 7.52 d04ff7f2f2b454b3ac7a28baeb8982bd

( 19 imports )
> ADVAPI32.dll: RegCloseKey, RegCreateKeyW, RegGetValueW, RegOpenKeyExW, GetTraceEnableFlags, GetTraceEnableLevel, GetTraceLoggerHandle, RegisterTraceGuidsW, UnregisterTraceGuids, RegCreateKeyExW, RegSetValueExW, RegQueryValueExW, EventWrite, EventEnabled, GetLengthSid, GetTokenInformation, OpenProcessToken, EventUnregister, EventRegister, GetUserNameW, RegDeleteValueW, RegEnumKeyExW, RegQueryInfoKeyW, TraceMessage, RegOpenKeyW, RegEnumKeyW, RegEnumValueW, CloseServiceHandle, OpenServiceW, OpenSCManagerW, QueryServiceStatus, CheckTokenMembership, ConvertStringSecurityDescriptorToSecurityDescriptorW, OpenThreadToken, ConvertSidToStringSidW, StartServiceW, CreateWellKnownSid
> KERNEL32.dll: GetSystemTime, GetFileAttributesW, FindClose, FindNextFileW, FindFirstFileW, GetLocalTime, GetDateFormatW, GetTimeFormatW, GetLocaleInfoW, FlushInstructionCache, RaiseException, GetSystemWindowsDirectoryW, SetLastError, ReadFile, GetFileSize, CreateFileW, InterlockedCompareExchange, LoadLibraryA, SystemTimeToFileTime, ExpandEnvironmentStringsW, GlobalGetAtomNameW, MultiByteToWideChar, GetEnvironmentVariableW, GetCurrentProcessId, GetModuleHandleW, lstrlenW, OpenEventW, SetEvent, GetBinaryTypeW, EnterCriticalSection, LeaveCriticalSection, GetSystemTimeAsFileTime, CompareFileTime, GlobalFree, GetTickCount, MulDiv, GetUserDefaultLangID, GetPrivateProfileIntW, GetCurrentThread, GetThreadPriority, GetCurrentThreadId, SetThreadPriority, CompareStringOrdinal, lstrcmpiW, HeapSetInformation, SetErrorMode, CreateMutexW, ReleaseMutex, GetTimeZoneInformation, SetFilePointer, SetProcessShutdownParameters, GetSystemDirectoryW, CreateEventW, SetTermsrvAppInstallMode, RegisterApplicationRestart, ExitProcess, GetModuleFileNameW, GetPrivateProfileStringW, HeapDestroy, InitializeCriticalSection, DeleteCriticalSection, GetCurrentProcess, GetProcessHeap, HeapAlloc, QueryPerformanceFrequency, GetFileAttributesExW, QueueUserWorkItem, GetLongPathNameW, GetProcessTimes, TerminateThread, GetProcessId, CreateIoCompletionPort, GetQueuedCompletionStatus, GetWindowsDirectoryW, FormatMessageW, QueryFullProcessImageNameW, GlobalAlloc, DuplicateHandle, GetCurrentDirectoryW, WideCharToMultiByte, WriteFile, DeactivateActCtx, ActivateActCtx, ReleaseActCtx, CreateActCtxW, FindResourceExW, LoadResource, LockResource, GetUserDefaultUILanguage, LoadLibraryW, GetProcAddress, FreeLibrary, WaitForSingleObject, CreateProcessW, GetCommandLineW, GetStartupInfoW, CreateThread, AssignProcessToJobObject, ResumeThread, Sleep, QueryInformationJobObject, LocalAlloc, LocalFree, CloseHandle, OpenProcess, SetPriorityClass, GetPriorityClass, CreateJobObjectW, SetInformationJobObject, GetLastError, InterlockedDecrement, InterlockedIncrement, HeapFree, UnhandledExceptionFilter, TerminateProcess, QueryPerformanceCounter, GetModuleHandleA, SetUnhandledExceptionFilter, InterlockedExchange, VirtualAlloc, VirtualFree, DelayLoadFailureHook
> GDI32.dll: GetStockObject, CombineRgn, GetLayout, CreatePatternBrush, OffsetViewportOrgEx, GdiAlphaBlend, GetTextExtentPoint32W, ExtTextOutW, SetWindowOrgEx, GetPixel, PatBlt, CreateRectRgn, GetClipRgn, IntersectClipRect, GetViewportOrgEx, SetViewportOrgEx, SelectClipRgn, GetBkColor, CreateCompatibleBitmap, OffsetWindowOrgEx, SetBkColor, GetTextExtentPointW, GetClipBox, CreateDIBSection, CreateRectRgnIndirect, SetTextColor, SetBkMode, GetTextMetricsW, CreateFontIndirectW, CreateSolidBrush, GetObjectW, DeleteObject, CreateCompatibleDC, SelectObject, BitBlt, DeleteDC, GetDeviceCaps
> USER32.dll: GetDlgItem, LoadCursorW, RegisterClassW, IsChild, SetTimer, MonitorFromRect, SetWindowTextW, SetClassLongW, GetClassInfoW, GetClassLongW, KillTimer, GetClassInfoExW, IsWindowEnabled, GetShellWindow, GetIconInfo, SetScrollInfo, GetLastActivePopup, GetSystemMenu, IsIconic, IsZoomed, EnableMenuItem, IsWindowVisible, IsWindow, MonitorFromWindow, GetMonitorInfoW, GetWindowInfo, BeginDeferWindowPos, DeferWindowPos, EndDeferWindowPos, SetFocus, SetForegroundWindow, LoadMenuW, SetMenuInfo, SetMenuDefaultItem, GetSubMenu, TrackPopupMenuEx, LoadImageW, InsertMenuItemW, DestroyIcon, DeleteMenu, GetMenuItemInfoW, SetMenuItemInfoW, CharUpperBuffW, PostQuitMessage, LoadStringW, ShutdownBlockReasonCreate, GetWindowLongA, SetWindowLongW, UnregisterDeviceNotification, RegisterDeviceNotificationW, RegisterWindowMessageW, SetWindowPos, RegisterClassExW, GetDesktopWindow, UpdateWindow, InvalidateRect, BeginPaint, LoadBitmapW, SetLayeredWindowAttributes, EndPaint, ShowWindow, DefWindowProcW, MoveWindow, DestroyWindow, UnregisterClassW, SetProcessDPIAware, PeekMessageW, CreateWindowExW, DialogBoxParamW, MsgWaitForMultipleObjects, GetKeyboardLayout, ActivateKeyboardLayout, IsProcessDPIAware, PrintWindow, GetDCEx, GetPropW, GetNextDlgGroupItem, GetNextDlgTabItem, GetDlgCtrlID, ChildWindowFromPointEx, GetCapture, GetGUIThreadInfo, SetWindowLongA, CharUpperW, GetWindowDC, RegisterClipboardFormatW, UnhookWinEvent, SetWinEventHook, ReleaseCapture, GetUserObjectInformationW, GetProcessWindowStation, FlashWindowEx, GetForegroundWindow, PostMessageW, CreatePopupMenu, GetWindowThreadProcessId, MsgWaitForMultipleObjectsEx, CharPrevW, CharNextW, DispatchMessageW, TranslateMessage, GetMessageW, EqualRect, UnionRect, MapWindowPoints, GetClientRect, EnumWindows, EndTask, SetThreadDesktop, GetThreadDesktop, GetMenuItemID, IsHungAppWindow, DrawTextW, GetSysColor, TrackPopupMenu, SendMessageCallbackW, DeregisterShellHookWindow, EndDialog, IsDlgButtonChecked, LoadIconW, GetSysColorBrush, CloseDesktop, OpenInputDesktop, SetActiveWindow, IsRectEmpty, GetAsyncKeyState, RegisterShellHookWindow, FillRect, GetCursorPos, SetPropW, CopyRect, LockSetForegroundWindow, MonitorFromPoint, InflateRect, GetClassNameW, SubtractRect, RedrawWindow, EnumDisplayMonitors, OffsetRect, IntersectRect, SetWindowRgn, GetMenuState, GhostWindowFromHungWindow, HungWindowFromGhostWindow, GetWindowPlacement, RemovePropW, SendMessageTimeoutW, UnregisterHotKey, RegisterHotKey, InsertMenuW, ModifyMenuW, ClientToScreen, ScreenToClient, GetMenuItemCount, GetFocus, GetScrollInfo, InternalGetWindowText, GetKeyState, ChangeDisplaySettingsW, GetWindowLongW, EnumChildWindows, SendMessageW, GetWindow, GetWindowRect, PtInRect, SetCursor, ChildWindowFromPoint, SetCursorPos, GetMessagePos, LoadAcceleratorsW, WaitMessage, TranslateAcceleratorW, GetWindowRgnBox, GetActiveWindow, MessageBeep, SetWindowPlacement, SetRect, SendNotifyMessageW, UpdateLayeredWindow, GetLastInputInfo, SendDlgItemMessageW, AllowSetForegroundWindow, RemoveMenu, SetParent, CallWindowProcW, EnableWindow, GetDlgItemInt, SetDlgItemInt, CheckDlgButton, CopyIcon, DrawFocusRect, NotifyWinEvent, ExitWindowsEx, DrawEdge, WindowFromPoint, GetDoubleClickTime, SetCapture, TrackMouseEvent, LockWorkStation, AppendMenuW, GetParent, SetScrollPos, SetRectEmpty, AdjustWindowRectEx, BringWindowToTop, CascadeWindows, GetSystemMetrics, SystemParametersInfoW, FindWindowW, ReleaseDC, GetDC, DestroyMenu, GetMenuDefaultItem, TileWindows, GetAncestor, SwitchToThisWindow, CheckMenuItem, ShowWindowAsync
> msvcrt.dll: memset, _unlock, _ftol2_sse, _except_handler4_common, __set_app_type, memcpy, free, memmove, realloc, __dllonexit, _lock, _onexit, _terminate@@YAXXZ, _controlfp, _vsnwprintf, malloc, __wgetmainargs, _cexit, _exit, __p__fmode, _XcptFilter, exit, _wcmdln, _initterm, _amsg_exit, __setusermatherr, _adjust_fdiv, __p__commode
> ntdll.dll: NtOpenThreadToken, NtOpenProcessToken, RtlGetProductInfo, NtQueryInformationToken, NtClose, NtQueryInformationProcess, NtSetInformationProcess, WinSqmAddToStream, NtSetSystemInformation
> SHLWAPI.dll: PathGetDriveNumberW, -, -, PathRemoveFileSpecW, -, -, SHRegGetUSValueW, -, StrDupW, PathQuoteSpacesW, -, -, -, -, StrChrIW, -, -, -, SHRegOpenUSKeyW, SHRegQueryUSValueW, StrCmpW, AssocQueryStringW, -, -, -, -, -, AssocQueryKeyW, PathParseIconLocationW, PathIsPrefixW, -, PathRemoveExtensionW, SHOpenRegStream2W, PathFileExistsW, -, -, -, -, PathFindExtensionW, SHQueryInfoKeyW, -, -, -, -, -, -, -, -, SHDeleteKeyW, PathAppendW, SHDeleteValueW, -, -, -, PathRemoveArgsW, PathRemoveBlanksW, StrCmpNIW, PathFindFileNameW, -, SHSetValueW, SHGetValueW, SHCreateThreadRef, SHSetThreadRef, -, -, PathCombineW, SHRegGetValueW, StrToIntW, -, -, -, PathGetArgsW, StrChrW, -, -, -, -, SHStrDupW, -, -, -, -, -, StrRetToBufW, -, -, -, -, -, -, StrRetToStrW, -, -, StrStrIW, -, -, PathMatchSpecW, PathIsRootW, PathIsNetworkPathW, SHQueryValueExW, AssocCreate, StrCmpIW, -, -, -, StrCmpNW, -, -, StrPBrkW, -, -, -, PathStripToRootW, -, PathIsDirectoryW, -
> SHELL32.dll: -, -, -, -, -, -, -, -, SHGetDesktopFolder, -, SHBindToFolderIDListParent, -, -, -, -, -, -, SHGetIDListFromObject, -, -, -, -, -, -, SHCreateShellItemArrayFromIDLists, -, -, SHCreateItemFromIDList, SHCreateShellItemArrayFromShellItem, -, -, SHBindToFolderIDListParentEx, SHChangeNotify, SHAddToRecentDocs, DuplicateIcon, -, -, -, ShellExecuteW, -, -, SHGetPathFromIDListA, SHUpdateRecycleBinIcon, SHGetKnownFolderIDList, SHGetFolderPathEx, SHFileOperationW, -, -, -, -, -, -, SHGetPathFromIDListW, -, -, -, -, -, -, -, -, -, ExtractIconExW, -, -, -, -, SHGetSpecialFolderLocation, -, -, SHBindToParent, Shell_NotifyIconW, SHGetFolderPathAndSubDirW, Shell_GetCachedImageIndexW, SHGetFolderPathW, -, SHEvaluateSystemCommandTemplate, -, -, -, -, -, -, -, -, -, -, -, SHBindToObject, -, ShellExecuteExW, -, -, SHGetSpecialFolderPathW, -, SHParseDisplayName, -, SHGetFolderLocation, -, -, -, -, -
> ole32.dll: CoTaskMemFree, CoCreateInstance, CoRegisterClassObject, CoRevokeClassObject, CoGetClassObject, OleInitialize, OleUninitialize, CoGetObject, StringFromGUID2, CoUninitialize, CoInitialize, RevokeDragDrop, RegisterDragDrop, CoRegisterMessageFilter, CoMarshalInterThreadInterfaceInStream, CoGetInterfaceAndReleaseStream, CoTaskMemAlloc, CoCreateFreeThreadedMarshaler, DoDragDrop, CoInitializeEx, CreateBindCtx, CoFreeUnusedLibraries, PropVariantClear
> OLEAUT32.dll: -, -, -, -, -, -
> SHDOCVW.dll: -, -
> UxTheme.dll: IsCompositionActive, IsAppThemed, GetThemeMargins, GetThemeRect, IsThemePartDefined, GetThemeBackgroundRegion, DrawThemeTextEx, GetThemeFont, GetThemeColor, GetThemeBool, GetThemeInt, SetWindowTheme, DrawThemeText, GetThemeTextExtent, DrawThemeBackground, CloseThemeData, OpenThemeData, DrawThemeParentBackground, GetThemePartSize, GetThemeMetric, GetThemeBackgroundContentRect
> POWRPROF.dll: GetPwrCapabilities
> dwmapi.dll: DwmIsCompositionEnabled, -, DwmSetWindowAttribute, DwmEnableBlurBehindWindow, DwmQueryThumbnailSourceSize, DwmGetColorizationColor, DwmUpdateThumbnailProperties, DwmRegisterThumbnail, DwmUnregisterThumbnail
> gdiplus.dll: GdiplusShutdown, GdipCloneImage, GdipDrawImageRectI, GdipSetInterpolationMode, GdiplusStartup, GdipCreateFromHDC, GdipCreateBitmapFromStreamICM, GdipCreateBitmapFromStream, GdipGetImageHeight, GdipGetImageWidth, GdipDisposeImage, GdipLoadImageFromFileICM, GdipLoadImageFromFile, GdipDeleteGraphics, GdipFree, GdipAlloc, GdipSetCompositingMode
> slc.dll: SLGetWindowsInformationDWORD
> RPCRT4.dll: RpcBindingFree, RpcStringFreeW, RpcBindingFromStringBindingW, NdrClientCall2, RpcStringBindingComposeW, I_RpcExceptionFilter, RpcBindingSetAuthInfoExW
> PROPSYS.dll: PSGetPropertyKeyFromName, PSPropertyKeyFromString, PSGetPropertyDescription, PSGetNameFromPropertyKey, VariantToBooleanWithDefault, VariantToInt32WithDefault, VariantToStringWithDefault, PSCreateMemoryPropertyStore, VariantToStringAlloc, PropVariantToStringAlloc
> BROWSEUI.dll: -, -

( 0 exports )

PDFiD.: -
RDS...: NSRL Reference Data Set
-

 

OK, thanks.

 

No worries, mate. I appreciate your help and your expertise. Life on the internet can be tricky with all the people wanting to do harm..

I'm disappointed in Webroot. While it did pick it up and identify the virus, ultimately, it failed to protect me as it couldn't deal with it once in memory.. I would be very interested in your recommendation for a product that would have prevented this attack...