1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Inactive KYS.exe virus? icons cannot open now

Discussion in 'Malware and Virus Removal Archive' started by bootan, 2011/05/22.

Thread Status:
Not open for further replies.
  1. 2011/05/22
    bootan

    bootan Inactive Thread Starter

    Joined:
    2010/05/27
    Messages:
    5
    Likes Received:
    0
    [Inactive] KYS.exe virus? icons cannot open now

    i got some spyware on my pc, so i did a malware scan, and it found the problem. the files have been quarantined, they were kys.exe mozilla.exe and iexplorer.exe. when i restarted i could not click on any of my program icons (anthing that is .exe will not open now) very frustrating.

    here is my mbam log:

    Malwarebytes' Anti-Malware 1.50.1.1100
    www.malwarebytes.org

    Database version: 6567

    Windows 5.1.2600 Service Pack 3 (Safe Mode)
    Internet Explorer 6.0.2900.5512

    5/22/2011 10:28:19 AM
    mbam-log-2011-05-22 (10-28-19).txt

    Scan type: Quick scan
    Objects scanned: 166975
    Time elapsed: 10 minute(s), 38 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 0
    Registry Values Infected: 0
    Registry Data Items Infected: 6
    Folders Infected: 0
    Files Infected: 1

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    (No malicious items detected)

    Registry Values Infected:
    (No malicious items detected)

    Registry Data Items Infected:
    HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command\(default) (Hijack.StartMenuInternet) -> Bad: ( "C:\Documents and Settings\s\Local Settings\Application Data\kys.exe" -a "C:\Program Files\Mozilla Firefox\firefox.exe ") Good: (firefox.exe) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\safemode\command\(default) (Hijack.StartMenuInternet) -> Bad: ( "C:\Documents and Settings\s\Local Settings\Application Data\kys.exe" -a "C:\Program Files\Mozilla Firefox\firefox.exe" -safe-mode) Good: (firefox.exe -safe-mode) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command\(default) (Hijack.StartMenuInternet) -> Bad: ( "C:\Documents and Settings\s\Local Settings\Application Data\kys.exe" -a "C:\Program Files\Internet Explorer\IEXPLORE.EXE ") Good: (iexplore.exe) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    c:\documents and settings\s\local settings\application data\kys.exe (Trojan.ExeShell.Gen) -> Quarantined and deleted successfully.


    any help will be great, oh by the way i can open these icons in safe mode, im using another pc right now

    please let me know what else to do thanks in advance
     
  2. 2011/05/22
    Admin.

    Admin. Administrator Administrator Staff

    Joined:
    2001/12/30
    Messages:
    6,687
    Likes Received:
    107
    Hi,

    Read this post as indicated at the top of this forum & follow the instructions.
     

  3. to hide this advert.

  4. 2011/05/22
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
Thread Status:
Not open for further replies.

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.