Report New Spyware Here

* A variant of the wuauserv %fystemroot% hijack

Symptoms :

-Attacks your ISP DNS settings
-IE & Google redirects
-Slow system
-Disables various updates : Antivirus, WMP etc
-Disallows several security programs to run or open

Entries in Hijackthis :

O17 - HKLM\System\CCS\Services\Tcpip\..\{802088D3-E982-48DE-8D14-4633A35B2A64}: NameServer = 85.255.112.204,85.255.112.90
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.112.204,85.255.112.90
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.112.204,85.255.112.90
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.112.204,85.255.112.90

Again, is installed in the system32\drivers folder via a hidden .sys

Solution :

-Use GMER to identify the hidden .sys file (Rootkit)
-run COMBOFIX (make sure you install the Recovery Console as well, as the fix results in an internet loss, you have to restore your normal internet settings)
NOTE : If combofix doesn't run, rename the combofix.exe to whatever you want and try again
-run MBAM, it will then detect and remove some leftover strings

Hope this helps