dxoxabtshdw.exe

[hazanko]

It's basically ransonware which spams you with fake Windows security alerts, before booting up IE and directing you to "adult.com". It doesn't allow you to start any executables, it blocks any user-initiated attempts to use a browser (firefox, IE, Opera tested) and it basically holds your entire PC to ransom. I only managed to figure out the filename once I booted into safe mode and ran msconfig. It resides in the following folder on my computer:

local settings\Application Data\kkcjccjfn\dxoxabtshdw.exe

Google turns up nothing relevant, either for the full file extension or the executable.

Avast didn't seem to pick it up. It's also worth noting that disabling it on startup has no effect after restart. Malware software doesn't pick it up either. I'm about to try spyblocker s&d, but I don't honestly expect this will help.

So...what's the procedure?

[Left123]

download mbam http://www.malwarebytes.org/

also check this out http://siri-urz.blogspot.com/  (about trojan ransomware)

[hazanko]

mbam didn't pick anything up, even after a full scan. Additionally, it now appears in the avast virus vault as follows:

last changed: 23:19
Transfer time: 15:15

I don't want to sound stupid or ungrateful (avast is free, after all), but I don't understand why it took so long for avast to do something about this file. Between the time it "last changed" and the "transfer time", I ran a full, comprehensive scan of my PC - avast picked up nothing.

I'd be grateful if somebody could enlighten me, because right now, I don't really feel like I'm out of the woods yet. The PC in question is now in autistic mode (completely shut off from my network, I mean...a term I picked up from GitS), but I'm wary of reconnecting it until I understand exactly what happened.

Thanks for your time in advance, people.

[Left123]

did you update malware bytes?

[hazanko]

I downloaded the latest version of mbam another PC and put it on a USB stick. Then installed mbam on the problematic PC. I'm running mbam for the second time today and it doesn't look like it's going to pick up anything - again.

I can't update malware bytes so long as my PC is offline - and I don't really want to put it back online just for that.

But again, what I really want to know is what this thing is and why avast took so long to pick it up.