Brief Description

The following registry elements have been created:

• HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\

• HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\

• HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{BF50AC63-19DA-487E-AD4A-0B452D823B59}\

• HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\CLSID\{BF50AC63-19DA-487E-AD4A-0B452D823B59}\

• HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\CLSID\{BF50AC63-19DA-487E-AD4A-0B452D823B59}\INPROCSERVER32\

• HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{BF50AC63-19DA-487E-AD4A-0B452D823B59}\

download unhide.exe and TDssKiller
Run  TDSSKiller and it will locate your infection. It will ask you to remoev the infection ans simply say yes.  IF all goes well and your PC is clean, it will ask to reboot your windows 7. Please do so.

It will most likely find: TrojanDownloader.OpenStream.NBF trojan

If this does not work for you, download the latest malwarebytes and update and scan.

go to start menu, then run, now type in MSCONFIG, go to startup tab and look for a long string of command that has random letters and sometimes numbers, disable that line and save.

Download Malwarebytes, update malwarebytes then do a full system scan. if any virus is found, it will delete it.

Now download spybot, do an update and a full scan, delete any melware or spyware it finds.

You surly must have a virus protection software, if not, download Microsoft Security Essentials, its free, update the app then a full scan.

These steps above should fix and delete the Trojan.win32.Generic.pak!cobra.Engine virus

Here are other virus trojans that are smiler to the one above and can be cleaned the same way.

Trojan.Win32.Generic!BT: Trojan
Trojan-Spy.Win32.Zbot.gen: Trojan
Exploit.PDF-JS.Gen (v): Exploit
Trojan.Win32.Generic!SB.0: Trojan
INF.Autorun (v): Trojan
Trojan.Win32.Hiloti.gen.d (v): Trojan
Trojan.Win32.Generic.pak!cobra: Trojan
Trojan.Win32.Adware: Adware (General)
MyWebSearch Toolbar: Potentially Unwanted Program
Trojan.Win32.Malware: Trojan

Attempts to connect to a high risk domain that may pose a security risk.  It also creates one or more shortcuts .LNK files to provide user accessible links to start a program usually form the desktop or start menu.

• HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\USE FORMSUGGEST = Yes

• HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\CERTIFICATEREVOCATION = 0

• HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WARNONBADCERTRECVING = 0

• HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WARNONZONECROSSING = 0

• HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONES\3\1601 = 0

• HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\WINTRUST\TRUST PROVIDERS\SOFTWARE PUBLISHING\STATE = 146944

• 188.229.88.***:80

• 46.161.11.***:80

• hxxp://searcham.org/*****

To remove this virus,

1.Disable System Restore Windows ME XP only.

2.Update to current engine and DAT files for detection and removal.

3.Run a complete system scan.

Modifications made to the system Registry and  INI files for the purposes of hooking system startup, will be removed if cleaning with the recommended engine and DAT combination or higher.

avast Win32:Caxnet [Trj]
AVG (GriSoft) Rootkit-Pakes.BG (Trojan horse)
avira TR/Koutodoor.psa
Kaspersky HEUR:Trojan.Win32.Generic
BitDefender Gen:Variant.Koutodoor.18
clamav Trojan.Dropper-27717
Dr.Web Trojan.MulDrop.origin
F-Prot W32/Koutodoor.N.gen!Eldorado
FortiNet W32/Koutodoor.KWD!tr.bdr
Microsoft Trojan:Win32/Koutodoor.E
Symantec Trojan.Koutodoor
Eset Win32/Koutodoor.HM trojan (variant)
norman W32/Suspicious_Gen2.LZIQS (trojan)
panda Trj/Genetic.gen
rising Trojan.Win32.Generic.1282E422
Sophos Troj/Kouto-D
Trend Micro TROJ_DLOADR.SMOM
vba32 Trojan.Downloader.gen.h (suspected)

The following files have been added to the system:
%WINDIR%\SYSTEM32\szccw.dll
%TEMP%\nsd12.tmp
%PROGRAMFILES%\Microsoft\ie13\Internat Explorer\target.lnk
%ALLUSERSPROFILE%\Desktop\Internat Explorer.jgp
%WINDIR%\SYSTEM32\drivers\fmsde.sys
%PROGRAMFILES%\Microsoft\ie13\Internat Explorer\Desktop.ini
The following files were temporarily written to disk then later removed:
%TEMP%\hmufctw.bat
%TEMP%\nsq13.tmp
%TEMP%\ygnpyvce.bat
%TEMP%\nsi11.tmp
%WINDIR%\SYSTEM32\mhzscp.bat
%TEMP%\faxjdr.exe
%TEMP%\tmp.bat
%TEMP%\yxcdiz.exe
%TEMP%\nsq13.tmp\System.dll
%TEMP%\wcyolgo.bat
%TEMP%\ftrnkqxw.bat

This is a Trojan detection Unlike viruses Trojans do not self replicate they are spread manually under the premise that they are beneficial. The most common installation methods involve system security exploitation unsuspecting users manually executing unknown programs. Distribution channels include email malicious or hacked Web pages, Internet Relay Chat (IRC), peer-to-peer networks and what have you.

Some path values have been replaced with environment variables as the exact location may vary with different configurations.
e.g.
%WINDIR% = \WINDOWS (Windows 9x/ME/XP/Vista/7), \WINNT (Windows NT/2000)
%PROGRAMFILES% = \Program Files

The following registry elements have been created:

• HKEY_CURRENT_USER\SOFTWARE\ENIGMA PROTECTOR\

• HKEY_CURRENT_USER\SOFTWARE\ENIGMA PROTECTOR\29AEB4A0365755F6-B862CAE984EA4D0E\

• HKEY_CURRENT_USER\SOFTWARE\ENIGMA PROTECTOR\29AEB4A0365755F6-B862CAE984EA4D0E\02F01F553A112DCE-00C9DB38C18D5FD1\

• HKEY_CURRENT_USER\SOFTWARE\ENIGMADEVELOPERS\

The following files have been added to the system:

* %WINDIR%\SYSTEM32\svhest.dll

* %WINDIR%\SYSTEM32\svhest.exe

To remove Generic Trojan BackDoor!cyh!E437DACF​F88B Virus

Download Malwarebytes’ Anti-Malware if you do now have this free software, from  here and save it to your computer.

• Double click mbam-setup.exe and install
• At the end of the installation be sure a checkmark
  • Update Malwarebytes’ Anti-Malware
  • and Launch Malwarebytes’ Anti-Malware
  • do a full scan and allow your computer to fix your virus.
    

Open RootRepeal, click the Drivers tab and select Scan. Right click and select Wipe File on:

H8SRTmeyqxwbpxd.sys

Click the Files tab and select Scan. Right click and select Wipe File on any file that begins with the following:

H8SRT

Do the same for the Hidden Services tab.

Reboot your machine

Then let’s run RootRepeal again:

• Double click ROOTREPEAL to start the program
• Click on the Report tab at the bottom of the program window
• Click the SCAN button
• In the Select Scan dialog, check:

  • Drivers
  • Files
  • Processes
  • SSDT
  • Stealth Objects
  • Hidden Services
  • Shadow SSDT

• Click the OK button
• In the next dialog, select all drives showing
• Click OK to start the scan
  

  Note: The scan can take some time. DO NOT run any other programs while the scan is running

• When the scan is complete, click the SAVE REPORT button and save the report to your Desktop as RootRepeal.txt
• Go to File, then Exit to close the program

1.Disable System Restore windows XP only, Win 7 will not work.

2.Update to current engine and DAT files for detection and removal.

3.Run a complete system scan using AGG or Microsoft security or Kaspersky

Modifications made to the system Registry  files for the purposes of hooking system startup will be removed if cleaning with the recommended engine and DAT combination.

Update the definition and scan your computer, it will find any traces of Trojan.Zlob.P now delete and you should be good to go.

The following files were analyzed:

urdvxc.exe
The following files have been added to the system:

* %COMMONPROGRAMFILES%\microsoft shared\stationery\bzqlkhrh.exe

* %COMMONPROGRAMFILES%\microsoft shared\stationery\vkjljzrn.exe

* %COMMONPROGRAMFILES%\microsoft shared\web server extensions\40\bin\1033\ebsjlbhn.exe

* %COMMONPROGRAMFILES%\microsoft shared\stationery\bhrhnkht.exe

* %PROGRAMFILES%\Adobe\Reader 9.0\rrtkrbtl.exe

* %COMMONPROGRAMFILES%\microsoft shared\stationery\elwtjnbj.exe

* %TEMP%\0A5A6FE619B07BBAFB1F9C1B5F798F7DF96745D9

* %COMMONPROGRAMFILES%\microsoft shared\stationery\bnbtzwxt.exe

* %COMMONPROGRAMFILES%\microsoft shared\stationery\bcwvzwbh.exe

* %COMMONPROGRAMFILES%\microsoft shared\stationery\ehbebsrn.exe

* %PROGRAMFILES%\msn\msncorefiles\tlbhnrlv.exe

* %PROGRAMFILES%\Microsoft Office\OFFICE11\rsrrhtck.exe

* %COMMONPROGRAMFILES%\microsoft shared\stationery\nsqjttkv.exe

* %PROGRAMFILES%\netmeeting\rsewzjqn.exe

* %COMMONPROGRAMFILES%\microsoft shared\stationery\qjllsjhl.exe

* %COMMONPROGRAMFILES%\system\ado\tsektjkj.exe

* %COMMONPROGRAMFILES%\microsoft shared\web server extensions\40\bin\brbvhsvx.exe

* %COMMONPROGRAMFILES%\microsoft shared\stationery\brvrjrke.exe

* %COMMONPROGRAMFILES%\microsoft shared\stationery\njbsvtll.exe

* %COMMONPROGRAMFILES%\microsoft shared\stationery\tlcwjrwt.exe

* %COMMONPROGRAMFILES%\microsoft shared\stationery\czjevcet.exe

* %COMMONPROGRAMFILES%\microsoft shared\stationery\xrljqjzn.exe

* %COMMONPROGRAMFILES%\microsoft shared\web server extensions\40\bin\tjnwrhns.exe

How to remove this virus.

1.Disable System Restore (Windows ME/XP only).

2.Update to current engine and DAT files for detection and removal.

3.Run a complete system scan.

1.Disable System Restore (Windows ME/XP only).

2.Update to current engine and DAT files for detection and removal.

3.Run a complete system scan.

Modifications made to the system Registry and/or INI files for the purposes of hooking system startup, will be successfully removed if cleaning with the recommended engine and DAT combination (or higher).

some of the path values that have been replaced with environment variables as the location may vary with different configurations for example.

%WINDIR% = \WINDOWS (Windows 9x/ME/XP/Vista/7), \WINNT (Windows NT/2000)
%PROGRAMFILES% = \Program Files

The following files were scanned:

urdvxc.exe

REMOVAL

Although this is a low threat virus, the removal of W32/RAHack Worm/Allaple.A Virus  can be a pest but i have found that COMBFIX will remove this threat from your PC. Simply download CombFix by clicking here, save it to your desktop, double click and and press next a few times and let the program scan your PC and clean it. Very simple really, might take some time and make sure you close all browsers and applications before you run CombFix.

Or you may just use MelwareBytes to remove the W32/RAHack virus. I would scan with both apps just to make sure. Good luck

The applications attempted the following network connections.

77.55.21.***:80
95.211.21.***:82
95.211.21.***:80
72.233.89.***:80
hxxp://95.211.21.184:89/*****
194.71.107.**:80
95.211.21.***:89
209.190.24.**:80
95.211.21.***:85

Indication of Infection

This symptoms of this detection are the files, registry, and network communication referenced in the characteristics section.

Some path values have been replaced with environment variables as the exact location may vary with different configurations.
e.g.
%WINDIR% = \WINDOWS (Windows 9x/ME/XP/Vista/7), \WINNT (Windows NT/2000)
%PROGRAMFILES% = \Program Files

This spy software can be downloaded from certain remote sites.

Check if the following applications are installed on the affected system to steal login credentials:

* Ftpcommander
* SmartFTP
* Steam (an online gaming platform)

It also oversees the relevant users’ browsing habits to steal sensitive information.

Save the information gathered in a text file using the file name () Name of the team. Txt and upload to a specific Web site.

Stopzilla says to use their app to remove this threat, but you can simply use http://www.malwarebytes.org to remove this threat. Make sure you first download this app, update it, disconnect your PC from the internet, then run malwarebytes.

SONAR.ProcessHijack.2 is a heuristic detection that is designed to detect new malware based on how it launches new processes. Malware will commonly launch and hijack trusted Windows processes like svchost.exe in order to perform malicious actions.

Antivirus Protection Dates

• Initial Rapid Release version pending
• Latest Rapid Release version pending
• Initial Daily Certified version pending
• Latest Daily Certified version May 4, 2010 revision 048
• Initial Weekly Certified release date pending

Threat Assessment

Wild

• Wild Level: Low
• Number of Infections: 0 – 49
• Number of Sites: 0 – 2
• Geographical Distribution: Low
• Threat Containment: Easy
• Removal: Easy

Damage

• Damage Level: Low

Distribution

• Distribution Level: Low