So, after spending several days fighting this thing, I finally got rid of it. I'm pretty sure I got the right one, but along the way I found some suspicious items that could have contributed. Here's the steps it took to clean it up.
First thing I did was to check all of the autostart locations on windows. I followed this article here. Most of the locations where clean except for:
- This key had a second path on it pointing to
C:\Documents and Settings\NetworkService\Application Data\09A52917-B4FC-4f02-AE3B-BF55D9351F4A\msvcs.exe
- This node had a
REG_SZ key named
2C508BD5-F9C6-4955-B93A-09B835EC3C64 which was pointing to the msvcs.exe file in the
- This node had two other nodes that looked suspicious to me. They were named
torlfsvses. Both nodes had keys that pointed to a
toldvw32.dll file and were set with a
WlStartupEvent event. Looking these up on Google didn't produce any meaningful results at the time, so I went ahead an removed them. There doesn't seem to be problems with having done that yet.
The real issue is that
msvcs.exe file. If one manages to survive it will replicate it self across all user profiles on the machine. Since it was hooked up into the
NetworkService profile it would always make sure it existed in the other profiles.
There's three locations where
msvcs.exe exists. They are:
- Not 100% sure on this one, but I did find two suspicious files:
MSVCS.EXE-301B4EC0.pf. I went ahead and removed them without issues (so far at-least).
I hope this helps someone in the future. It worked for me. If you have a computer that had/has this and it's hooked up to a domain make sure to check the user's profile folder on the server as well, there's a copy there too. Needless to say, don't login into that profile directly on the server because you're just going to have a very fun time after that...
Also, you can't clean it through Safe Mode if the profile you're logging into has been infected. I used UBCD4Win to clean up what I saw, then I did the rest through Safe Mode.
Now, I know the general consensus is to nuke the computer and start from scratch, but that is not always possible in a business environment. After I had it cleaned up and confirmed clean by several antivirus tools I ran
chkdsk /f /r on the drive, defragmented it with MyDefrag (4.3.1) and the computer works perfectly as if it never happened. So, nuking the computer is not always the best course of action as @Synetech pointed out him/her self.
Lastly, Kaspersky was installed on the computer, but somehow was turned off and that's how the virus (malware?) got through and did what it did. I'm not a fan of antivirus software at all, in fact I don't have any on my 6 or so machines that I have, but in an environment where you have technically challenged personel, it is a good idea to have it and its also a very good idea to make sure it's actually turned on and updated.
That is all fellow awesome people. I hope someone else can benefit from this answer in the future.