|I definitely have a virus. something keeps writing to HKLM\Software\...Run\ |
as soon as I delete the entry, it's re-written.
I'm running Sysinternals Registry Monitor and it's actually explorer.exe that's writing the entry.
I've uploaded my explorer.exe to VirusTotal and nothing is found.
The exe file that's running at startup shows up as a virus by only Microsoft on VirusTotal. So, I ran MS's free online tool, it supposedly eradicated it, but viola, it's right back.
The reg entry name changes frequently, but currently its something like: wximukogi, and it's running: runndll32.exe "C:\windows\uxucedojod.dll, e"
The virus also creates another entry in CurrentVersion with somewhat random letters and a bunch of strange entries. Looks Russian.
I've also compared my explorer.exe file to another machine, and it has the same MD5 checksum from a machine not infected, so it appears it must be one of the support dll's that explorer.exe is utilizing, but I haven't been able to trace it down.
No virus tools I've found have detected any viruses in the system, except Microsoft's.
Unfortunately there's another sneaky problem:
I currently have AVG8.5 installed and cannot UNINSTALL it (as required to install MS live) because the virus somehow has corrupted my registry (HKLM/Software\microsoft\windows NT\currentVersion\Windows cannot be deleted or written to. I've tried all the security tricks, Bart PE, everything... won't budge).
Another problem: at some point my System Restore points got hosed. So I can't go back!
This thing is really pernicious. I'm surprised none of the antivirus companies have detected it yet!
Currently, here's the symptom of the virus:
1) installs itself in registry to run
2) hijacks links in both IE and Firefox: go to a search engine, type in something, and click on a link and it takes you to some bogus site. Go back in browser, click the same link again and it now goes to the correct site.
3) apparently corrupts the registry so that a specific entry cannot be deleted or written to.
4) apparently removes system restore entry points.