1 reply to this topic

[Ridcully]

comments/responses inline
Hi,

Go to this part of the forum: http://www.malwareby...hp?showforum=55
Start a new thread there, because I need a file from your computer which you have to attach there.

-> done, here we are

Browse to the following file:

C:\WINDOWS\tiyshc.vot

Rightclick and select to zip it. This should create a tiyshc.zip folder.
Upload/attach that folder in the thread you started in that other forumpart.

-> done

Once you've uploaded that file, * Open hijackthis, click 'config' (bottom right)
Choose the tab 'misc Tools' on top.
Choose 'delete a file on reboot'
In the field, copy and paste next:

C:\WINDOWS\tiyshc.vot

Click open.
Hijackthis will tell you that this file will be deleted on next reboot and if you want to reboot now. Click Yes/ok
Your system should reboot now.

Then, Open notepad and copy and paste next present in the quotebox below in it:
(don't forget to copy and paste REGEDIT4)

QUOTE
REGEDIT4

[KEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"aux"="wdmaud.drv"

Save this as fix.reg Choose to save as *all files and place it on your desktop.
It should look like this:
Doubleclick on it and when it asks you if you want to merge the contents to the registry, click yes/ok.

-> done

Above steps should resolve your problems, so let me know in your next reply. You'll also be able to update malwarebytes then smile.gif

-> update processed successfully!!

Thanks a million! Off to scan. Any idea how/where I got this thing? Or why norton/webroot didn't see it?

also, I assume that I should delete the zipped file?
--------------------
Mieke Verburgh
Malwarebytes Researcher

Attached Files

•  tiyshc.zip   9.98KB   4 downloads

[miekiemoes]

Thank you for the file. This one was already detected by Malwarebytes - detection for this one was added last week, but since you couldn't update malwarebytes, it also explains why it wasn't detected in your case;