Deeply ingrained virus/malware/nasty

[PrivateCranky]

Hello all,

Please be gentle, it's my first question post here!

I've recently had the opportunity to attempt to remove a new nasty. This one is rather compilcated, and it took me several attempts to get rid of it.

I've read the special sticky notes on this part of the forums. The computer in question was not used for financial transactions of any kind, so it was safe to not reformat it.

I'm not sure how the nasty got onto the computer, but it sure was difficult to get rid of.

I think the crux problem was a .dll called "wyyo.dll", but I'm a bit frightened by chasing this one!

I hope the experts can help here!

Many thanks,

Pvt. Cranky.

 

[touch]

Hello PrivateCranky

It sounds like you have - wyyo.dll - on your computer ?
http://virscan.org/report/8e3845481b3eca8c4a0c39513eb158ba.html

If you have, I´ll suggest you proceed as follows ->

Please run the steps in this guide:

8-step Viruses/Spyware/Malware Preliminary Removal Instructions

Post attached log´s from:

Malwarebyte
Superantispyware
Hijackthis

In your next reply

 

[PrivateCranky]

Hi Touch,

Thanks for replying. I believe I have fully removed this nasty from my friend's computer, but I wanted to check here, because I've not seen this one in the wild before and I believe it is a new one (I suppose it could be a variant of another one but I can't be sure, and would only like to examine it in a secure environment). However, seeing as I believe it is removed, I do not have a sample of it to give to you - maybe someone else will have one?

I searched on this board before my first question post, and wanted to know if the experts here have had any experience or knowledge with this nasty.

Thanks!

 

[touch]

Ok. Hope you can use this info about wyyo.dll:
http://www.prevx.com/filenames/X1532889751981303385-X1/WYYO.DLL.html

 

[PrivateCranky]

Brilliant, thanks Touch, that was all the information I was after.

I'm sill wondering where "patient zero" was so to speak.

PrivateCranky.