Pacisoft Virus

windows 2000 pro user here:

I visited a music video webpage and the pacisoft virus unloaded on me. it gave me two different spyware problems Apropos & SurfsideKick. I managed to clean everything pretty much, but then I ran into a problem.

I booted in safe mode so I could delete an empty folder at this directory C:\Program Files\Unismith , but that was a no no because after I deleted the empty folder entitled Unismith I was unable to boot up in regular normal mode and I got a KMODE EXCEPTION NOT HANDLED error with the following details.

0xC0000005: STATUS_ACCESS_VIOLATION
A memory access violation occurred.
Parameter 4 of the Stop error
(which is Parameter 1 of the exception)
is the address that the driver attempted
to access.

0x0000001E
0xC0000005 (memory access violation)
0x8133F19D
0x00000001
0x00000008

so I went back into safe mode and recreated the Unismith folder in the C:\Program Files\ directory and guess what ? I was able to boot up in normal mode again.

How can I fix this problem so that I can boot up normal without that specific folder ?

please any help is welcome.

by the way the malicious webpage I went to was HotCodez.com
I would love to report them for having malware on their site. Any suggestions ?

What did you use to clean your system?
There may still be some things left running..
Have a look with HijackThis.

I suggest you give us the the crash dump file. It is located in windows directory
just serach for files named *.dmp. This seems like a rootkit case :rolleyes:

Primarily I used webroot spysweeper which found about 70 or so traces of stuff, then I used ad-aware SE pro 1.06r and then I used Spybot 1.4 , and then i used xoftspy each program has latest definition files. i ran hi-jack this and no suspicious items show up as of now.

I searched for *.dmp in c drive but could not find any files of that nature.

Sounds like a stealthy bastard.... a rootkit is also a possibility

Did you scan in safe mode? You might want to try that too..

well i searched for *.dmp files in c drive but found none of that nature. I am not sure what a rootkit is. although I can tell you that when i did scan with webroot spyweeper it located 2 of the problems in the memory scan.

I did scan in safe mode, but the results were the same as when I scanned in normal mode.

thanks for helping me you guys.

ok I did a rootkit scan using RK Detector and I took a screen shot of the results here http://www.boredinnc.net/ftp/Webpage/1.gif

yes there was a service installed on my system, but I managed to disable it however it still exists in the services list.

hmmm.....
try to clean the registry file

Click on Rar250K
and then follow link to fownload

Registry Corrector
http://getsoft.ru/?author=161&page=2

Did you also check Add/Remove Software? I've removed a lot of adware just by uninstalling it..

yes Sir Dice I sure did. I try not to have too many programs installed so I pay close attention as to what is on my system. How can I delete that 1 service from my services list ? any suggestions ? here is an animated gif of my add/remove programs listed. http://www.boredinnc.net/ftp/Webpage/addremove.gif

here is the registry corrector log file Sir Babis: thanks again:

Program started 9/28/2005 at 9:05:09 AM

Check registry integrity ...
Integrity ok ...

Scan system folder ...
22563 files read ...

Check software locations...
HijackThis.exe ... Delete
0 entries cure, 1 deleted, 0 added, 0 skipped.

Check shared programs...
0 entries cure, 0 deleted, 0 added, 0 skipped.

Check help section...
0 entries cure, 0 deleted, 0 added, 0 skipped.

Check fonts ...
0 entries cure, 0 deleted, 0 added, 0 skipped.

Check device drivers ...
0 entries cure, 0 deleted, 0 added, 0 skipped.

Check extensions assotiations ...
.acl ... Delete
.aprj ... Delete
.aw ... Delete
.col ... Delete
.conf ... Delete
.det ... Delete
.dos ... Delete
.elm ... Delete
.eta ... Delete
.ffa ... Delete
.ffl ... Delete
.fft ... Delete
.ffx ... Delete
.frg ... Delete
.gst ... Delete
.idc ... Delete
.jar ... Delete
.kml ... Delete
.kmz ... Delete
.ldb ... Delete
.lex ... Delete
.nls ... Delete
.opc ... Delete
.pbk ... Delete
.pbr ... Delete
.pcb ... Delete
.pip ... Delete
.sll ... Delete
.stf ... Delete
.tuw ... Delete
.VOC ... Delete
.wll ... Delete
.xmd ... Delete
0 entries cure, 33 deleted, 0 added, 0 skipped.

Check COM entries ...
MSTTSSYN.DLL found : C:\WINDOWS\SYSTEM32\DLLCACHE\MSTTSSYN.DLL
WTTSS22.DLL found : C:\WINDOWS\SYSTEM32\DLLCACHE\WTTSS22.DLL
2 entries cure, 0 deleted, 0 added, 0 skipped.

Check ActiveX entries ...
AcroIEHelper.AcroIEHlprObj ... Delete
AcroIEHelper.AcroIEHlprObj.1 ... Delete
ActMsg.Session ... Delete
ADCS ... Delete
ComPlusMetaData.MsCorHost ... Delete
ComPlusMetaData.MsCorHost.2 ... Delete
Context.test ... Delete
Context.test.1 ... Delete
DXImageTransform.Microsoft.CrRadialWipe ... Delete
DXImageTransform.Microsoft.CrRadialWipe.1 ... Delete
HeaderFooter.HeaderFooter.1 ... Delete
MailFileAtt ... Delete
mapifvbx.object ... Delete
mapifvbx.object.1 ... Delete
Overview.Document ... Delete
SymWriter.pdb ... Delete
TimeStamp ... Delete
WBEMComLocator ... Delete
0 entries cure, 18 deleted, 0 added, 0 skipped.

Check startup list ...
0 entries cure, 0 deleted, 0 added, 0 skipped.

Check unisnstall section ...
HijackThis ... Delete
{2318C2B1-4965-11d4-9B18-009027A5CD4F} ... Delete
{3877C2CD-F137-4144-BDB2-0A811492F920} ... Delete
{5B239A98-4222-4D8C-AF38-1A8EC07F956B} ... Delete
{5D0930A0-1033-433A-8BB9-602665550DD0} ... Delete
0 entries cure, 5 deleted, 0 added, 0 skipped.

Delete temporary registry values ...
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RunMRU\MRUList ... Delete
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RunMRU\a ... Delete
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RunMRU\b ... Delete
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RunMRU\c ... Delete
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RunMRU\d ... Delete
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RunMRU\e ... Delete
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedMRU\MRUList ... Delete
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\MRUList ... Delete
HKCU\SOFTWARE\Microsoft\Internet Explorer\TypedURLs\url1 ... Delete
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Regedit\LastKey ... Delete
0 entries cure, 10 deleted, 0 added, 0 skipped.

Program finished 9/28/2005 at 9:06:03 AM
12 test(s) passed, 16864 entries scanned, 2 entries cure, 67 entries deleted, 0 entries added, 0 skipped.
Created undo file C:\Documents and Settings\greg\Desktop\RC 28-09-05-01.reg.

I would suggest looking for "unismith" in the registry and see if its attached to any keys.

thanks zenger but nothing came up when I searched for that value data.

i'll be back in an hour i wanna take a nap lol

Personally, I'd consider a reformat. But then, I like reformatting my machine fairly regularly anyway ;)

Yeah, Wolfrune, you're a glutton for punishment.

According to what I've found on the net, pacisoft is a startup infection, so there is something in the registry referencing that folder location and looking for a startup or startup config file. Hijackthis may miss it.

If safemode won't get you where you want to go, you might want to look at the Windows version of UltimateBootCD (http://www.ubcd4win.com/) and try to analyze the registry and file system from that. It is possible that the infection is hiding registry keys or other things from you even in Safemode.

Here one prog that can find hiden registry entries


http://www.sysinternals.com/utilitie...trevealer.html

Quote:

---

The term rootkit is used to describe the mechanisms and techniques whereby malware, including viruses, spyware, and trojans, attempt to hide their presence from spyware blockers, antivirus, and system management utilities. There are several rootkit classifications depending on whether the malware survives reboot and whether it executes in user mode or kernel mode.

---

Hope evrything that left......

ok root kit revealer identified some hidden files, and that folder was 1 of them. here look at the gif screen shot i took for u Sir Babis http://www.boredinnc.net/ftp/Webpage/revealer.gif

u see that mpestfat9.sys file in system32 folder ? hmm i cannot seem to locate it even when revealing hidden files. so how do i go about deleting that i wonder? noticed the date time stamp on the reg keys and the sys file and the folder all correspond to 9-27-05. seemingly these r are all culprits, but mysteriously evading my hand of wrath.


i downloaded the ultimate boot cd off that page, but i am not gonna use that just yet until i know what i am doing. thanks.


oh by the way i managed to delete those windows services detected on the Root kit scan by going into the registry and manually deleting them.

thanks all again for help

Could you send that .sys file, i wish to study it.

i would if i could, but it's not visible so the thing is i dunno how to do that. it's deemed ghostware as opposed to spyware. i am waiting on sir babis to try to help me figure out how i can manipulate the file. he helped me locate it thus far so that's half the battle, but if i can manage to manipulate the file somehow yeah i can send it to u.

i tried to type in attrib -a -h -r -s c:\windows\system32\mpestfat9.sys
but it says file not found.

What you are describing sounds a lot like the description from the SANS ISC handler about a week ago:

http://isc.sans.org/diary.php?date=2005-09-22

About the only way you are going to get to the Registry and file system and nail these bad boys is to boot from a CD that allows you to edit the hidden registry keys, and the hidden file system stuff. The boot CD I pointed you to will do that. BTDT, got the t-shirt.

Use the ISO to burn a CD and boot to it. Very straightforward.

I got one ide that may be can work.

Export whole registry to some file and then file try to file that file name in the extracted file.
Then create own registry file that will remove it.


here some examples about how you do export:

1) you can use regedit )) start->run->regedit
2) you can use console )) copy and insert in text file and save it filename.bat then run it may work

::------bat.file-------
reg export HKLM HKLM.reg
find HKLM.reg "Unismith"
if errorlevel == 0 start /w wordpad HKLM.reg

reg export HKCU HKCU.reg
find HKCU.reg "Unismith"
if errorlevel == 0 start /w wordpad HKCU.reg


reg export HKCR HKCR.reg
find HKCR.reg "Unismith"
if errorlevel == 0 start /w wordpad HKCR.reg

reg export HKU HKU.reg
find HKU.reg "Unismith"
if errorlevel == 0 start /w wordpad HKU.reg

reg export HKCC HKCC.reg
find HKCC.reg "Unismith"
if errorlevel == 0 start /w wordpad HKCC.reg

::--------en of bat.file---------
3) how to create regfile that will remove regkey
3.1) remove reg value

[HKEY_CLASSES_ROOT\someK]
InfoTip=-

this will remove value "InfoTip" in key "someK"

3.2) remove key
[-HKEY_CLASSES_ROOT\someK]

this will remove "someK" key

I fixed my problem because;

I jus made a crucuial discovery of an error i made. i was looking in the wrong directory for mpestfat9.sys seemingly i was thinking it was located in C:\WINDOWS\SYSTEM32, but it was in fact located in C:\WINDOWS\SYSTEM32\DRIVERS

by deleting the sys file i was able to also delete unismith folder in safe mode and boot up successfully in normal mode. sorry for all the fuss.

also these 3 hidden registry directorys do not show up anymore when i scan
with rootkit revealer. so problem is fixed 100%
HKLM\SOFTWARE\CqiU2ACteU6m
HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_MSK116X
HKLM\SYSTEM\ControlSet001\Services\MSK116x

thanks all for help especially sir babis for the rootkit revealer program. it proved to be invaluable.

Maybe a little late in the game, but there is another freeware rootkit detector that might give you something worthwhile. Worth keeping on hand, anyway :

http://www.f-secure.com/blacklight/

Good luck.

it's never too late hesperus i got that program cuz u were the one who referred me to it before. thanks a bunch.

by the way i edited my last post regarding the registry entries as the do not show up anymore. i get a no discrepencies clean scan now that the sys file is gone.

100% back to normal. thank god.

ur all so awesome . thanks a million...

Quote:

---

Originally posted here by isle_of_infamy
it's never too late hesperus i got that program cuz u were the one who referred me to it before. thanks a bunch.

---

So, was it of any use ??