I have been battling the skynet virus for about 2 weeks now. I have searched and searched for answers. What started out as being redirected to different websites when I did a google search quickly escalated. Through varioius searches I have downloaded, installed, and run Malwarebytes, SuperAnti Spyware, Spyware Doctor, and HijackThis. Each seemed to get me closer to solving my problem, but none could get rid of it. Now each time I start a new program I get an error message. It seems (and from what I have read) that this virus is attaching itself to every .exe file that attempts to start. Now I get the message:
"The application or DLL globalroot\systemroot\system32\SKYNETpevxtfpo.dll is not a valid windows image. Please check this process against your installation diskette"
when I click "OK" it goes away. From what I can guess, it looks like spyware doctor has it quarantined, but can't get rid of it. For some reason I can't even get Spyware Doctor to open; it will run in the background, but I can't start the program; but the program runs anyway.
In my searches, I found this web site and it seems that "poorronny" had almost the exact issue and was communicating with "Quads". I read and followed along, up to and including downloading ROOTREPEAL. I did that much, ran it and I can see it has identified my issue. It gives me the option of clicking on the hidden / stealth / etc. files and deleting them..but I was a bit nervous being as though "poorronny" was given scripts of some sort to get rid of the problem, so I want to await instruction....below is the report I got from ROOT REPEAL:
ROOTREPEAL (c) AD, 2007-2009
==================================================
Scan Time: 2009/07/06 19:39
Program Version: Version 1.3.0.0
Windows Version: Windows XP SP3
==================================================
Drivers
-------------------
Name: dump_atapi.sys
Image Path: C:\WINDOWS\System32\Drivers\dump_atapi.sys
Address: 0xF331D000 Size: 98304 File Visible: No Signed: -
Status: -
Name: dump_WMILIB.SYS
Image Path: C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS
Address: 0xF7D55000 Size: 8192 File Visible: No Signed: -
Status: -
Name: mchInjDrv.sys
Image Path: C:\WINDOWS\system32\Drivers\mchInjDrv.sys
Address: 0xF7F03000 Size: 2560 File Visible: No Signed: -
Status: -
Name: PROCEXP113.SYS
Image Path: C:\WINDOWS\system32\Drivers\PROCEXP113.SYS
Address: 0xF7D8B000 Size: 7872 File Visible: No Signed: -
Status: -
Name: rootrepeal.sys
Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys
Address: 0xEF257000 Size: 49152 File Visible: No Signed: -
Status: -
Name: SKYNETvcbndoyr.sys
Image Path: C:\WINDOWS\system32\drivers\SKYNETvcbndoyr.sys
Address: 0xF3AB4000 Size: 163840 File Visible: - Signed: -
Status: Hidden from Windows API!
Stealth Objects
-------------------
Object: Hidden Module [Name: SKYNETpevxtfpo.dll]
Process: winlogon.exe (PID: 808) Address: 0x10000000 Size: 32768
Object: Hidden Module [Name: SKYNETpevxtfpo.dll]
Process: services.exe (PID: 856) Address: 0x10000000 Size: 32768
Object: Hidden Module [Name: SKYNETpevxtfpo.dll]
Process: lsass.exe (PID: 876) Address: 0x10000000 Size: 32768
Object: Hidden Module [Name: SKYNETeomtiduy.dll]
Process: svchost.exe (PID: 1064) Address: 0x008f0000 Size: 57344
Object: Hidden Module [Name: SKYNETpevxtfpo.dll]
Process: svchost.exe (PID: 1064) Address: 0x10000000 Size: 32768
Object: Hidden Module [Name: SKYNETpevxtfpo.dll]
Process: svchost.exe (PID: 1132) Address: 0x10000000 Size: 32768
Object: Hidden Module [Name: SKYNETpevxtfpo.dll]
Process: MsMpEng.exe (PID: 1256) Address: 0x10000000 Size: 32768
Object: Hidden Module [Name: SKYNETpevxtfpo.dll]
Process: svchost.exe (PID: 1320) Address: 0x10000000 Size: 32768
Object: Hidden Module [Name: SKYNETpevxtfpo.dll]
Process: svchost.exe (PID: 1412) Address: 0x10000000 Size: 32768
Object: Hidden Module [Name: SKYNETpevxtfpo.dll]
Process: svchost.exe (PID: 1576) Address: 0x10000000 Size: 32768
Object: Hidden Module [Name: SKYNETpevxtfpo.dll]
Process: spoolsv.exe (PID: 1684) Address: 0x10000000 Size: 32768
Object: Hidden Module [Name: SKYNETpevxtfpo.dll]
Process: svchost.exe (PID: 356) Address: 0x10000000 Size: 32768
Object: Hidden Module [Name: SKYNETpevxtfpo.dll]
Process: AppleMobileDeviceService.exe (PID: 420) Address: 0x10000000 Size: 32768
Object: Hidden Module [Name: SKYNETpevxtfpo.dll]
Process: ALUSchedulerSvc.exe (PID: 428) Address: 0x10000000 Size: 32768
Object: Hidden Module [Name: SKYNETpevxtfpo.dll]
Process: mDNSResponder.exe (PID: 588) Address: 0x10000000 Size: 32768
Object: Hidden Module [Name: SKYNETpevxtfpo.dll]
Process: ccSetMgr.exe (PID: 728) Address: 0x10000000 Size: 32768
Object: Hidden Module [Name: SKYNETpevxtfpo.dll]
Process: dvpapi.exe (PID: 1008) Address: 0x10000000 Size: 32768
Object: Hidden Module [Name: SKYNETpevxtfpo.dll]
Process: PIFSvc.exe (PID: 1484) Address: 0x10000000 Size: 32768
Object: Hidden Module [Name: SKYNETpevxtfpo.dll]
Process: Explorer.EXE (PID: 1636) Address: 0x10000000 Size: 32768
Object: Hidden Module [Name: SKYNETpevxtfpo.dll]
Process: McciCMService.exe (PID: 1888) Address: 0x10000000 Size: 32768
Object: Hidden Module [Name: SKYNETpevxtfpo.dll]
Process: MDM.EXE (PID: 1932) Address: 0x10000000 Size: 32768
Object: Hidden Module [Name: SKYNETpevxtfpo.dll]
Process: navapsvc.exe (PID: 1960) Address: 0x10000000 Size: 32768
Object: Hidden Module [Name: SKYNETpevxtfpo.dll]
Process: NPFMntor.exe (PID: 1996) Address: 0x10000000 Size: 32768
Object: Hidden Module [Name: SKYNETpevxtfpo.dll]
Process: NPROTECT.EXE (PID: 2036) Address: 0x003f0000 Size: 32768
Object: Hidden Module [Name: SKYNETpevxtfpo.dll]
Process: nvsvc32.exe (PID: 208) Address: 0x10000000 Size: 32768
Object: Hidden Module [Name: SKYNETpevxtfpo.dll]
Process: RichVideo.exe (PID: 260) Address: 0x10000000 Size: 32768
Object: Hidden Module [Name: SKYNETpevxtfpo.dll]
Process: pctsSvc.exe (PID: 600) Address: 0x00f40000 Size: 32768
Object: Hidden Module [Name: SKYNETpevxtfpo.dll]
Process: SNDSrvc.exe (PID: 1460) Address: 0x10000000 Size: 32768
Object: Hidden Module [Name: SKYNETpevxtfpo.dll]
Process: pctsTray.exe (PID: 1572) Address: 0x01d40000 Size: 32768
Object: Hidden Module [Name: SKYNETpevxtfpo.dll]
Process: SPBBCSvc.exe (PID: 1592) Address: 0x10000000 Size: 32768
Object: Hidden Module [Name: SKYNETpevxtfpo.dll]
Process: NOPDB.EXE (PID: 1876) Address: 0x00380000 Size: 32768
Object: Hidden Module [Name: SKYNETpevxtfpo.dll]
Process: ssoftsrv.exe (PID: 1924) Address: 0x10000000 Size: 32768
Object: Hidden Module [Name: SKYNETpevxtfpo.dll]
Process: svchost.exe (PID: 2080) Address: 0x10000000 Size: 32768
Object: Hidden Module [Name: SKYNETpevxtfpo.dll]
Process: symlcsvc.exe (PID: 2096) Address: 0x10000000 Size: 32768
Object: Hidden Module [Name: SKYNETpevxtfpo.dll]
Process: ccEvtMgr.exe (PID: 2164) Address: 0x10000000 Size: 32768
Object: Hidden Module [Name: SKYNETpevxtfpo.dll]
Process: mm_tray.exe (PID: 2960) Address: 0x10000000 Size: 32768
Object: Hidden Module [Name: SKYNETpevxtfpo.dll]
Process: DirectCD.exe (PID: 3040) Address: 0x00b90000 Size: 32768
Object: Hidden Module [Name: SKYNETpevxtfpo.dll]
Process: WkUFind.exe (PID: 3068) Address: 0x10000000 Size: 32768
Object: Hidden Module [Name: SKYNETpevxtfpo.dll]
Process: LVCOMSX.EXE (PID: 3084) Address: 0x10000000 Size: 32768
Object: Hidden Module [Name: SKYNETpevxtfpo.dll]
Process: LogiTray.exe (PID: 3100) Address: 0x00a80000 Size: 32768
Object: Hidden Module [Name: SKYNETpevxtfpo.dll]
Process: jusched.exe (PID: 3112) Address: 0x10000000 Size: 32768
Object: Hidden Module [Name: SKYNETpevxtfpo.dll]
Process: BCMSMMSG.exe (PID: 3172) Address: 0x10000000 Size: 32768
Object: Hidden Module [Name: SKYNETpevxtfpo.dll]
Process: ccApp.exe (PID: 3232) Address: 0x10000000 Size: 32768
Object: Hidden Module [Name: SKYNETpevxtfpo.dll]
Process: McciTrayApp.exe (PID: 3280) Address: 0x10000000 Size: 32768
Object: Hidden Module [Name: SKYNETpevxtfpo.dll]
Process: rundll32.exe (PID: 3336) Address: 0x10000000 Size: 32768
Object: Hidden Module [Name: SKYNETpevxtfpo.dll]
Process: VerizonServicepoint.exe (PID: 3332) Address: 0x10000000 Size: 32768
Object: Hidden Module [Name: SKYNETpevxtfpo.dll]
Process: apdproxy.exe (PID: 3392) Address: 0x003d0000 Size: 32768
Object: Hidden Module [Name: SKYNETpevxtfpo.dll]
Process: FxSvr2.exe (PID: 3412) Address: 0x10000000 Size: 32768
Object: Hidden Module [Name: SKYNETpevxtfpo.dll]
Process: Acrotray.exe (PID: 3428) Address: 0x10000000 Size: 32768
Object: Hidden Module [Name: SKYNETpevxtfpo.dll]
Process: kkw_run.exe (PID: 3468) Address: 0x10000000 Size: 32768
Object: Hidden Module [Name: SKYNETpevxtfpo.dll]
Process: kmw_run.exe (PID: 3708) Address: 0x10000000 Size: 32768
Object: Hidden Module [Name: SKYNETpevxtfpo.dll]
Process: MSASCui.exe (PID: 3844) Address: 0x10000000 Size: 32768
Object: Hidden Module [Name: SKYNETpevxtfpo.dll]
Process: iTunesHelper.exe (PID: 3948) Address: 0x10000000 Size: 32768
Object: Hidden Module [Name: SKYNETpevxtfpo.dll]
Process: KMW_SHOW.EXE (PID: 272) Address: 0x10000000 Size: 32768
Object: Hidden Module [Name: SKYNETpevxtfpo.dll]
Process: msmsgs.exe (PID: 1128) Address: 0x10000000 Size: 32768
Object: Hidden Module [Name: SKYNETpevxtfpo.dll]
Process: LogitechDesktopMessenger.exe (PID: 1720) Address: 0x10000000 Size: 32768
Object: Hidden Module [Name: SKYNETpevxtfpo.dll]
Process: GoogleToolbarNotifier.exe (PID: 1860) Address: 0x10000000 Size: 32768
Object: Hidden Module [Name: SKYNETpevxtfpo.dll]
Process: wcescomm.exe (PID: 2696) Address: 0x10000000 Size: 32768
Object: Hidden Module [Name: SKYNETpevxtfpo.dll]
Process: ctfmon.exe (PID: 2860) Address: 0x10000000 Size: 32768
Object: Hidden Module [Name: SKYNETpevxtfpo.dll]
Process: rapimgr.exe (PID: 2932) Address: 0x10000000 Size: 32768
Object: Hidden Module [Name: SKYNETpevxtfpo.dll]
Process: SUPERAntiSpyware.exe (PID: 3508) Address: 0x04c70000 Size: 32768
Object: Hidden Module [Name: SKYNETpevxtfpo.dll]
Process: Dropbox.exe (PID: 2628) Address: 0x10000000 Size: 32768
Object: Hidden Module [Name: SKYNETpevxtfpo.dll]
Process: TFService.exe (PID: 3152) Address: 0x003f0000 Size: 32768
Hidden Services
-------------------
Service Name: SKYNETsjvyqapw
Image Path: C:\WINDOWS\system32\drivers\SKYNETvcbndoyr.sys
==EOF==
Any help would be greatly appreciated, as I really cannot afford to reformat my hard drive.