I am hoping that someone can provide some guidance on the steps I can possibly take to cleaning/remove a new suspected trojan/malware from a friends computer. I am using Starup Control Panel 2.8 by Mike Lin, which shows the file loading in HKLM/Run and a path of C:\Program Files\(some chinese/japanese characters when the special characters are copied into the path window of an explorer window)\Ku6SpeedUpper.exe (Oh one thing she has the IME fully installed so the characters may not show correctly when pasted into the window if you do not have the IME installed, seems to be Unicode). So the directory seems to be hidden since if cannot be discovered when Unhidding protected operating system files, and selecting to show hidden files and folders. When deleting though Startup Control Panel the program immediately replaces itself, even when using HijackThis though you need to rescan with HijackThis to see that it has replaced itself. It also sends CPU usage to 100% and sets exceptions in the windows XP SP3 firewall and CA Personal Firewall setting itself as trusted which I have since denied. The denial do seem to stick and not get changed to trust allow again, at least at this point.
Using Glary Utilities, Ulocker, Spybot Search & Destroy, Spyware Blaster, CA Antivirus: all of no help since they cannot see the file they cannot help to delete or uninstall.
Using Windows XP SP3 search function with hidden and system checked does not find any result again it is very good at hiding, probably made copies of itself and infected a dll or two.
Ran Norman Malware Cleaner and still no go will try Combofix to see if it is detected.
The best and only useful information I have found on this file is at http://spywarefiles.prevx.com/RRFFED449662...DUPPER.EXE.html
Just do a search on google on the file name and you will see.
It seems to trick people into thinking it will speed up/cache the video feed from a site similar to YouTube but in China.
Will post screen shots of the file name as it is shown in Unicode and in the giberish, Done.
Any help would be appreciated.
Edited by TekKnight, 24 September 2009 - 03:33 PM.
Moved from XP to a more appropriate forum. Tw