Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Trojan Services Removal: Problems with SDFix


  • Please log in to reply
1 reply to this topic

#1 avcaxp

avcaxp

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:03:52 AM

Posted 08 February 2009 - 07:14 PM

Hi,

I seemed to have picked up the following Trojan Service files while attached to an open Wi-Fi network at an international sales meeting for my company being held at a hotel:

C:\WINDOWS\System32\noytcyr.exe
C:\WINDOWS\System32\wsldoekd.exe
C:\WINDOWS\System32\afisicx.exe
C:\WINDOWS\System32\roytctm.exe
C:\WINDOWS\System32\tdydowkc.exe
C:\WINDOWS\System32\soxpeca.exe

C:\WINDOWS\System32\drivers\beep.sys
%System%\360tay.exe

...and possible others. I have disabled these services on my computer for now, but need to clean my system including the registers that have been contaminated. Is it possible to pick up this type of virus without 'clicking' on any links or visiting any websites. That seems to be the case here. My Symantic antivirus starting picking up the virus a day or so after I got onto this network.

I have attached a files to show the analysis of the beep.sys file.

Virus Definition: Please see attached Word doc for analysis of my beep.sys file showing details of the virus.
Problem: I have followed all instructions to load and run SDFix, but have experienced a problem when I try to run the RunThis.bat file. Please see the attached jpg file for a screen shot showing why the bat file is failing.

The Problem: When I type 'Y' to run the RunThis.bat file it starts and then finishes immediately. The attached screen shot shows the message, "The system cannot find the file specified." four times before it stops trying. The final message is " 'dnif.exe' is not recognized as an internal or external command, operable program, or batch file."

Note: My computer is a company computer and therefore I can only logon by selecting "Safe Mode with Networking".
Question: Is that a problem?

Can someone help me understand how to proceed? Thanks in advance. I have been battling this thing since Feb 4. :thumbsup:

Attached Files



BC AdBot (Login to Remove)

 


#2 garmanma

garmanma

    Computer Masochist


  • Members
  • 27,809 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Cleveland, Ohio
  • Local time:07:52 AM

Posted 08 February 2009 - 09:12 PM

I would think that this would be the company's IT department responsibility, no?
Mark
Posted Image
why won't my laptop work?

Having grandkids is God's way of giving you a 2nd chance because you were too busy working your butt off the 1st time around
Do not send me PMs with problems that should be posted in the forums. Keep it in the forums, so everyone benefits
Become a BleepingComputer fan: Facebook and Twitter




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users