Pakes.KVV

[Dichotomy]

anybody got any experience with this one?  I don't get viruses but I have a friend that's in crises and I may have to help him out.

[gyrene81]

wow, win32.pakes that's an ugly trojan, 100+ variations of it too. other than a full reload of the system you might be albe to remove it the hard way, i.e. by hand. look for the process psc_mon.exe(?) that should be the resident process that starts it up. as old as it is, once you kill the resident process, you might be able to get rid of it with trend micro's free housecall applet...


it can be messy deleting everything affected...

systemroot+\system32\lmqfg.dll
iexplore0.dll

systemroot+\system32\lmqfg.dll
{b53082b8-b49c-4ba6-81ff-7c41da1cd87c}
auf0.exe
cfhxxd.exe
ffcfbbb.exe
iexplore.exe
iexplore0.dll
v1200351p.epe
systemroot+\system32\kaqwyy.exe
systemroot+\system32\lmqfg.dll
iexplore0.dll
iexplore.exe
systemroot+\system32\kaqwyy.exe
ffcfbbb.exe
cfhxxd.exe
auf0.exe

registry key:
hkey_local_machine\software\microsoft\windows\currentversion\
setup\{b53082b8-b49c-4ba6-81ff-7c41da1cd87c}

[Dichotomy]

Doesn't take a rocket scientist to figure out what he was doing when he got that.  *sigh* looks like I'm ripping and rebuilding a computer this weekend. 

Got any ideas on recovery of his data?  He says he can't see his drives. 

[gyrene81]

if he can't read his drives, something got loaded that took ownership and hid the drive(s).

you could try running this from a command prompt... attrib -h -s *.* /S /D

[Bizman]

Once again, what I'd use to make saving files a little safer if not fixing the whole issue:

Download and burn F-secure rescue cd. Boot from the cd, it starts a simple Linux distro. Update the program and run a full scan.

If Windows is bootable after the scan, download (on a memory stick with another machine) ComboFix from BleepingComputer and run it, preferably in Safe Mode with Networking.

If you feel like you could actually get the machine cleaned, follow with Malwarebytes' AntiMalware, followed with known-reliable online virus scanners and Super AntiSpyware, available also as portable. SAS also has some nice clickable tools to reset various settings.

[Dichotomy]

Thanks gents I'll give it a shot then give him a stern lecture on safe internet browsing.   

So long as I can get his data off I'll reformat to be safe and probably put some additional protection on his machine.