I saw the same activity on another unit but this time the infection is named bazirud.exe and is being loaded by toulobi. In which case, I believe this is the same virus strain and so I cleaned it up with the same procedures I mentioned here.
Is your unit continuously uploading something like emails to internet when you are not doing anything like that on your own? If so, then you may have been hit by this malware called yv8g67.exe. I have posted this before on my defunct www.junblogs.com and while I forwarded some entries I created there before to here, for whatever reason I forgot to include this one. Anyway, I will make this much simpler now.
What it does (minor things):
- Creates several exe with random filenames inside System32 folder and marks it hidden, Read-Only and System. Sizes varies between 41kb and 44kb.
- Further tracing shows it creates a backup/duplicate exe of all those inside System32 folder in the Local User’s temp folder, names are totally different than that inside System32
- It also creates registry entries to HKLM\Software\Microsoft\Shared Tools\MSConfig\startupreg; to ensure that those virus parts will be auto-loaded next log on.
- With the actions happening in the background with this virus, this results to unnecessary overpopulating of HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache entries in Registry
What it does (major things):







