# hiden process or unknown virus disable reg. edit, network and etc.



## djji (Aug 4, 2008)

new or not known VIRUS
***
today i found something like hidden process or unknown virus in my network... cleaning and detection impossible... coping or moving the users data to new computer not possible/new comp. infecting immediately/... unable to detect the infection when move infected harddisk to new-installed computer/antivirus not found nothing/... 
****
SYMPTOMS: 
it's happens in this order every time on each computer

1. windowsXP start slowly
2. before start XP every time start disk-check and find errors on harddisks /like when turn-off XP without shutdown/
3. all works normal/network, internet, regedit, task-manager/
4. after 1 minute regedit and task-manager disabled
5. in registry appear Policy keys - disable regedit=1 /if delete key it's appear again/
6. VIRUS kill ativirus process, and delete services of antivirus
7. on harddisk appear lot of exe and dll files with random names
8. network and internet stops after 3-5 min work
9. host file crashes, and windows report damaged file
10. if all antivirus programs uninstalled, computer continue work very slowly
11. if on computer have antivirus program, after 5-6 min appear blue screen with random error, and XP restarts

PROGRAMS THAT I TRY TO DETECT IT:
Kaspersky AV and Security 6.0 7.0 and 2007 /full legal copy/
Norton internet security 2007 trial/trial from CD with mainboard/
Avira-antivirus free
AVAST free
AVG free
/all programs NOT find VIRUSES/

Ad-Aware 2008
Ad-Aware 6
Spybot - Search & Destroy 
SpywareBlaster 
ect. /NOTHING find/

HijackThis - not find nothing strange/on fresh installed windows/ONLY THIS Policy key - disable regedit=1 /if delete key it's appear again/

ONLY GMER - Root kit tool - find that services.exe started hidden process /if kill or delete services.exe XP crash/ 

SOME STEPS THAT I TRY:
1. detect and clean with antivirus, rootkits or mallware - nothing detecting.
2. install antivirus program it's killed, and damaged after first start
3. move infected hard disk to new computer with fresh windows and fully work protections - VIRUS infect it
4. if registry guards enabled nothing to happen, but first manual allow of any registry change infects computer 
5. manually deleting strange exe and dll files - not help /soon appear new ones with random names/
6. advanced task managers not show any strange processes

not info on forums, or in anti virus corporations sites... 
sorry for bad English, 20 hours fight this virus and nothing... :embarased


any ideas ??? :normal:


----------



## Angelfire777 (Oct 15, 2006)

Hi, welcome to tsf!

Please start here and follow the instructions.

http://www.techsupportforum.com/sec...pdated-important-read-before-posting-log.html

Please ensure that you complete *all* of the 5 Steps. If you cannot complete any of the Steps, *simply move on to the next one* - remember to let the Analyst know about this when you post your logs.

*Do not post your logs back in this thread - follow the guidance in the above link!*

Please note that the Security Forum is always busy, so I would ask for your patience while waiting for a reply - it may take a few days.


----------



## djji (Aug 4, 2008)

i think you answer me automatically, but will give detailed answer...

1 step - not need to uninstall nothing, because it's new windows, it's happens on fresh installed windows after full formated hard disk

2 step - Panda, kaspersky and ect. online and offline scanners not find any viruses or infections

3 step - Spyware Blaster or/and/ IE-Spyad - not find any infections, but symptoms appears soon

step 4 - after install XP, i fully upgrade and update from Microsoft site

step 5 HijackThis - FIND only one strange registry key 

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System DisableRegistryTools=1

if i delete manually with programs or with command this key or set it to 0, it's appear again after 2-3 seconds


----------



## Angelfire777 (Oct 15, 2006)

Hi,

I do not answer questions "automatically." And those steps are there to help provide info for the analyst that will be helping you.

If you see that steps 1-4 doesn't apply to you, proceed to step 5.

Please read all the instructions carefully.


----------

