iun6002.exe malware - is it gone?

Hi there,

The other day I had some networking problems, services such as the Network List Service were failing to start etc. Then after I ran some commands to fix this, Windows Firewall was disabled and couldn't started.

I ran ComboFix (I admit, I have only now just seen the warning to only run it after being given expert advice) and it deleted one file (but also did some stuff in the registry I think, relating to TCPIP). After this, Windows Firewall works again.

That file was iun6002.exe. At the time I didn't think anything of (after all, my network connection was back!) it but I decided to do some further digging today because these two strange events has occurred:

1. Two programs that were ' Click Once Application Manifests' (You know, download a 800Kb file and it'll download the rest later on and store it in AppData) had been un-installed / all that was left was the standard application manifest icon. These were 'Wunderlist 2' and 'rdio'. I have since re-installed them.

2. My installation of Office 2013 Consumer Preview was completely gone. The icons are un-clickable and almost everything in the Office 15 folder was been deleted.

So I read up about iun6002.exe and how malware disguises itself as this .exe especially in the location of C:\Windows and that's where mine was found. I read that it's a pretty nasty spyware tool. Not content with it sitting in ComboFix's quarantine folder with .vir added to the end of it, I ran these scanners:

Windows Defender Spyware Removal (The Windows 7 out-of-the-box one) [CLEAN]
Rogue Killer [No suspicious processes, but some registry suspicions, 2 Wunderlist related, 1 Asus-Xonar audio driver related and two Microsoft looking ones]
Sophos Virus Removal Tool (IN PROGRESS) [Say's it's found 2 threats so far, hmm]

So my question to you after this hopefully understandable explanation is: Am I free from the iun6002.exe spyware? Or is it still on my PC, doing bad things? Any way to check for this? The proccess is definitely not running.

Cheers.

Sheza said:

So my question to you after this hopefully understandable explanation is: Am I free from the iun6002.exe spyware? Or is it still on my PC, doing bad things? Any way to check for this? The proccess is definitely not running.

There's no way to know with 100% certainty if your machine is malware free. No anti-malware product is 100% effective 100% of the time (if there was such a thing we'd all be using it.) But the more scans you run that come back "no malware found" the greater the probability that your computer is malware free. Here are a few more free on demand scanners you could try.

Windows Defender Offline (different than the Windows Defender you ran, and this tool must be created on a known malware free computer.)

Malwarebytes

ESET Online Scanner

SuperAntispyware

Kaspersky TDSSKiller (link is under Step 1: How to disinfect...)

Many people recommend that once a computer becomes infected, the best solution is to do a clean reinstall of the operating system and all other installed programs. If you built your computer yourself (you don't have any system specs listed) you could use this tutorial:

Clean Install Windows 7

If you have a store bought computer that had Windows 7 installed by the computer manufacturer, then one of the Forum experts prepared this tutorial that shows how to do a clean reinstall of a factory OEM computer:

Clean Reinstall - Factory OEM Windows 7

Alas, I think I may do just that. (Did run Malwarebytes at the first sign of trouble, it didn't find anything, hmpf!)

I'm used to re-installing Windows - last time I did it was Christmas Day to celebrate some new hardware going in haha.

The only thing I get worried about is when Windows Install says there's 'no readable partition' or something, which is fixed by removing my secondary hard drive and installing with just 1. It doesn't seem to make any sense to me why it does that though...

Thanks for your help

Sheza said:

The only thing I get worried about is when Windows Install says there's 'no readable partition' or something, which is fixed by removing my secondary hard drive and installing with just 1. It doesn't seem to make any sense to me why it does that though...

Chalk it up to "confusion" (for lack of a more technical explanation.) Choosing between multiple hard drives seems to make all versions of Windows take a couple of steps back and go ... huh? :)

Hey there,

Firstly - thanks for your help! In should note that I know what this program is and can only assume it's because it installs with Setup Factory. The program was installed way before anything started to go wrong.

Code:

SystemLook 30.07.11 by jpshortstuff
Log created at 11:52 on 09/02/2013 by Sheza
Administrator - Elevation successful

========== filefind ==========

Searching for "iun6002.exe"
No files found.

========== regfind ==========

Searching for "iun6002.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WYSIWYG_Web_Builder_8]
"UninstallString"="C:\Windows\iun6002.exe "C:\Program Files (x86)\WYSIWYG Web Builder 8\irunin.ini""

-= EOF =-

Quick question... how can I upload a file if there's no file?

The only iun6002.exe that I have is located in ComboFix's quarantine.