TechSpot

Experience of Infostealer.Gampass and Infostealer.Perfwo

By samlow
May 6, 2007
Topic Status:
Not open for further replies.
  1. My pc was visited by Infostealer.Gampass and Infostealer.Perfwo and it was my most pain experience in removing it. I lost 97 exe files which were infected. I would like to share here and hope to help those panic victims.

    Folder created by them:
    %program Files%Common Files\Microsoft Shared\Web Folders\

    Files created:
    %windir%\svchost.exe
    %program files%\Common Files\Microsoft Shared\Web Folders\MSOSV.EXE
    %program files%\Common Files\Microsoft Shared\Web Folders\MSOSVEXT.EXE

    Files created after virus activated:
    %program files%\Common Files\Microsoft Shared\Web Folders\TempA.exe
    ...
    %program files%\Common Files\Microsoft Shared\Web Folders\TempM.exe
    %windir%\Sysfy3\svchost.exe
    %windir%\Sysfy3\Ghook.dll

    These 2 trojan horse visited me with 4 more viruses, which are
    - shualai.exe
    - nwizhx2.exe
    - nwizAsktao.exe
    - cmdbcs.exe

    The av (antivirus) is able to deleted the creation of Temp*.exe, svchost.exe and Ghook.dll. However, the other files are able to run at background.

    Removal steps:
    1. Stop the task of shualai.exe

    2. Delete the following files:
    - shualai.exe and shualai.dll
    - nwizhx2.exe and nwizhx2.dll
    - nwizAsktao.exe and nwizAsktao.dll
    - cmdbcs.exe and cmdbcs.dll
    (note that dll files located in %windir%\windows\system32 while exe files located in %windir%\windows\)

    3. Run regedit, search the following registry and remove them.
    - shualai (2 entries)
    - nwizhx2 (1 entry)
    - nwizAsktao (1 enty)
    - cmdbcs (2 entries)

    4. Remove
    %windir%\svchost.exe
    %program files%\Common Files\Microsoft Shared\Web Folders\MSOSV.EXE
    %program files%\Common Files\Microsoft Shared\Web Folders\MSOSVEXT.EXE
    %program files%\Common Files\Microsoft Shared\Web Folders\Temp(x).exe

    5. Reboot

    If the steps does not solve the problem, format ALL the hardisk logical partition at once.

    Hope this helps.
Topic Status:
Not open for further replies.


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.