Spyware, Viruses, & Security forum

General discussion

Mysterious and annoying virus

by mixonns / October 14, 2009 10:39 PM PDT

I have an infected computer, and googled intensively the symptoms, but found no meaningful trace of it at all on the web, what it might be and how it can be removed?

These are the symptoms which I noticed so far:

1. When a usb flash is plugged in it starts a setup program for PDF Unlocker
2. it creates on the usb drive autorun.inf file and config folder (which links to system recycler)
3. it creates pdfunlocker.tmp file in C:\Documents and Settings\Me\Local Settings\Temp
4. in C:\Documents and Settings\Me\Local Settings\Temp it creates a folder named IS- folowed by a random set of characters. In that folder it creates isx.dll
5. in the registry it creates this key: HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENT VERSION\WINLOGON\TASKMAN\C:\RECYCLER\S-1-5-21-0728249037-2743871067-325377221-5747\schl.exe
6. It creates pdfunlocker.exe in C:\Documents and Settings\M\Application Data

I scanned it through Avast home edition, Panda antivirus ActiveScan, HijackThis, Spybot, Mcafee stinger, Mcafee Rootkit Detective and nothing was found.

I tried to delete the files manually, and to correct the registry key, but all of it, of course reappears after deletion.

My system: WIN XP SP3 professional
antivirus > Avast home edition

I would appreciate any hint on what is this and how to nail the annoying pest!

Discussion is locked
You are posting a reply to: Mysterious and annoying virus
The posting of advertisements, profanity, or personal attacks is prohibited. Please refer to our CNET Forums policies for details. All submitted content is subject to our Terms of Use.
Track this discussion and email me when there are updates

If you're asking for technical help, please be sure to include all your system info, including operating system, model number, and any other specifics related to the problem. Also please exercise your best judgment when posting in the forums--revealing personal information such as your e-mail address, telephone number, and address is not recommended.

You are reporting the following post: Mysterious and annoying virus
This post has been flagged and will be reviewed by our staff. Thank you for helping us maintain CNET's great community.
Sorry, there was a problem flagging this post. Please try again now or at a later time.
If you believe this post is offensive or violates the CNET Forums' Usage policies, you can report it below (this will not automatically remove the post). Once reported, our moderators will be notified and the post will be reviewed.
Collapse -
Flash drive issue
by Phil Crase / October 14, 2009 11:47 PM PDT

This occurs only with flash drive input? Any flash drive, or just one? If it is ONLY the one drive, assumption would be that the drive itself is corrupted, need a bit more info.

Collapse -
mysterious virus
by mixonns / October 15, 2009 1:09 AM PDT
In reply to: Flash drive issue

this occurs for any flash drive, i tried 5 different usb drives.
Also, when I restart the computer, regardless of the flash drives, the PDF Unlocker installation jumps out, but not a trace of it can be found in the startup section (i checked it in SpyBot). Can somebody recommend a program which could detect the process that is behind the file creation and the registry modfication?

Collapse -
Try using these tools
by Donna Buenaventura / October 15, 2009 3:46 AM PDT
In reply to: mysterious virus
SUPERAntispyware (SAS) http://download.cnet.com/SuperAntiSpyware-Free-Edition/3000-8022_4-10523889.html
Malwarebytes Antimalware (MBAM) http://download.cnet.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.html
A2 Free (A2) http://download.cnet.com/A-squared-Free/3000-2239_4-10262215.html

If you do not want to install the scanner of A2 and SUPERAntispyware, try their online scanner:
a-squared Web Malware Scanner http://www.emsisoft.com/en/software/ax/
SUPERAntiSpyware Online Safe Scan http://www.superantispyware.com/onlinescan.html

Also, to investigate the process... try:

WinPatrol - http://www.winpatrol.com or http://download.cnet.com/WinPatrol/3000-8022_4-10129149.html
Process Hacker - http://processhacker.sourceforge.net/
Process Explorer - http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx
Collapse -
Problem solved! thanks!
by mixonns / October 15, 2009 5:36 AM PDT
In reply to: Try using these tools

Thanks!

Proces Explorer and RegRunner helped me a lot!

i found and killed the SCHL.EXE file which was hidden in c:recycler/

Changed the registry keys>

HKEY_USERS\S-6-1-21-780-1647-811-100\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\explorer.exe

and HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENT VERSION\WINLOGON\TASKMAN\ C:\WINDOWS\system32\taskmgr.exe

and the problem seems solved.

Still, I would be much happier if a virus removal tool recognized this threat and removed it automatically. Maybe I missed some things. I'm wondering what these security softwares do at all, if such an obvious and easily detectable error is missed (like the location for task manager pointing to the recycle bin in the registry?!)

Collapse -
Good work!
by Donna Buenaventura / October 15, 2009 6:00 AM PDT

We're not sure if other malware scanners will detect and remove that. We'll only know if we will try all of the removal tools which is a lot (more than 30 removal tools).

Glad you able to get rid of it Happy and you're welcome!

Collapse -
same problem
by carlo626 / November 7, 2009 10:04 PM PST

would you mind give more details on how you solved the problem ?

I'm having the same problem and can't delete schl.exe - everything also seems gone

thanks

Collapse -
kill schl.exe
by mixonns / November 20, 2009 7:18 AM PST
In reply to: same problem

first of all, you have to kill the process with task manager if it's active in the memory (end process). I didn't have problems with that. I had trouble finding the schl.exe. I knew it was hidden in the recycle bin, but it just wouldn't show up. I only found it eventually by searching the recycle bin for schl.exe (you have to turn on in search options - more advanced options - search system folders, search hidden files and folders, search subfolders) and after that deleted it with no problems.
It is also important to edit the two registry keys I mentioned above (those are the normal values. Take care with registry editing, do it only if you know exactly what you are doing).
Also, check the registry if schl.exe pops up somewhere else, and see if it might cause some problem. I'm not sure that this solves the problem completely, but for me it worked.

Collapse -
thanks
by carlo626 / November 21, 2009 2:58 AM PST
In reply to: kill schl.exe

thanks mixonns but the problem was that I couldn't find schl.exe in the task manager and everytime I deleted it it just came back-up again

I found that deleting the two registry key - I was a bit hesitant with the explorer key - (by the way they are in a slightly different position than yours) seems to have solved the problem

thanks again as probably without your first finding would never have been able to clear my system - as you said all the antivirus (norton corporate) fail to detect-it

Popular Forums
icon
Computer Newbies 10,686 discussions
icon
Computer Help 54,365 discussions
icon
Laptops 21,181 discussions
icon
Networking & Wireless 16,313 discussions
icon
Phones 17,137 discussions
icon
Security 31,287 discussions
icon
TVs & Home Theaters 22,101 discussions
icon
Windows 7 8,164 discussions
icon
Windows 10 2,657 discussions

The Samsung RF23M8090SG

One of the best French door fridges we've tested

A good-looking fridge with useful features like an auto-filling water pitcher and a temperature-adjustable "FlexZone" drawer. It was a near-flawless performer in our cooling tests.