SpywareShooter
127.0.0.1
This a nasty piece of malware that you have. I infected myself with it today to do some research and it actually took me over an hour to remove it on my own computer since it was eating up all my CPU. I created a "notes" file in the process of removing this and uploaded it to spywareshooter.com. In the notes.txt file I have listed files that are dropped by this piece of malware and what piece of malware they are part of. You can view my "notes" at www.spywareshooter.com/notes.txt. I am sorry for the poor format of the file, but this was a quick job and I will work on getting it more readable when I have time.
[STEP 1] Fix HijackThis Entries:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html
R1 - HKLM\Software\Microsoft\! Internet Explorer\Main,Default_Page_URL = c:\secure32.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\system32\kernels64.exe
O4 - HKLM\..\Run: [PayTime] C:\WINDOWS\system32\paytime.exe
O4 - HKLM\..\Run: [System] C:\WINDOWS\system32\kernels64.exe
O4 - HKCU\..\Run: [Windows installer] C:\winstall.exe
O4 - HKCU\..\Run: [PayTime] C:\WINDOWS\system32\paytime.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O18 - Filter: text/html - (no CLSID) - (no file)
O20 - Winlogon Notify: browsela - C:\WINDOWS\system32\browsela.dll
[STEP 2] Remove Malicious Files:
c:\secure32.html
C:\WINDOWS\system32\kernels64.exe
C:\WINDOWS\system32\paytime.exe
C:\winstall.exe
C:\WINDOWS\system32\browsela.dll
[STEP 3]Report Back to us:
[STEP 1] Fix HijackThis Entries:
Fix the following entries with HijackThis by placing checkmarks in the boxes next to them and clicking "Fix Checked".
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html
R1 - HKLM\Software\Microsoft\! Internet Explorer\Main,Default_Page_URL = c:\secure32.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\system32\kernels64.exe
O4 - HKLM\..\Run: [PayTime] C:\WINDOWS\system32\paytime.exe
O4 - HKLM\..\Run: [System] C:\WINDOWS\system32\kernels64.exe
O4 - HKCU\..\Run: [Windows installer] C:\winstall.exe
O4 - HKCU\..\Run: [PayTime] C:\WINDOWS\system32\paytime.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O18 - Filter: text/html - (no CLSID) - (no file)
O20 - Winlogon Notify: browsela - C:\WINDOWS\system32\browsela.dll
[STEP 2] Remove Malicious Files:
Locate the following files using Windows Explorer (the My Computer icon or shortcut) and delete them from your computer.
c:\secure32.html
C:\WINDOWS\system32\kernels64.exe
C:\WINDOWS\system32\paytime.exe
C:\winstall.exe
C:\WINDOWS\system32\browsela.dll
[STEP 3]Report Back to us:
Once you have followed all of the steps above please reboot your computer and post a new HijackThis log.
0
