Kernelcheck.exe - What is it?

Discussion in 'Malware Help (A Specialist Will Reply)' started by xyster, Jun 11, 2008.

  1. xyster

    xyster Private E-2

    Hello, It's been quite a while since i posted here.

    I have searched the forums for this and found a very similar thread that had no answers. I didn't want to bump it.

    I don't think i have an issue at the moment, so i haven't posted the HJT log. Kaspersky has told me of a Running Process: C:\kernelcheck.exe

    With the following message

    Action: Process is trying to register its copy as startup autorun object. This behavior is typical of Trojans.

    As i failed to find anything useful in google. I thought it would be best to check first before i do something.

    - xyster
    P.S: i read the rules, wasn't 100% sure if this is allowed, sorry if its not
     

    Attached Files:

    xyster, Jun 11, 2008
    #1
  2. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Welcome to Major Geeks!

    Please uninstall HJT as it will be properly installed when you do the following:

    Please follow the instructions in the below link and attach the requested logs when you finish these instructions.

    READ & RUN ME FIRST. Malware Removal Guide
     
    TimW, Jun 12, 2008
    #2
  3. xyster

    xyster Private E-2

    Hello, ok i have read and done all the readme information.

    here are the logs.
     

    Attached Files:

    xyster, Jun 13, 2008
    #3
  4. xyster

    xyster Private E-2

    The MGlogs.zip file.

    thanks for your help in advance.
     

    Attached Files:

    xyster, Jun 13, 2008
    #4
  5. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Let's do this:

    Please disable all anti-virus and anti-spyware programs while we do the following (re-enable when you are finished):

    Run C:\MGtools\analyse.exe by double clicking on it. This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
    After clicking Fix, exit HJT.

    Now Copy the bold text below to notepad. Save it as fixME.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.
    Now use windows explorer to find and delete:
    C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\sysfnx.exe

    Let me know if you have any problems doing the above....and tell me how things are running.
     
    TimW, Jun 13, 2008
    #5
  6. xyster

    xyster Private E-2

    Hello,

    firstly may i just say, you guys here are amazingly quick... thank you so much for all your help.

    Ok, so, i successfully ran HJT and fixed the problem. Then i updated my registry with the information you gave me.

    However, when i went to delete the sysfnx.exe from the directory, it was not there.

    I figured i should do a quick search for the "sysfnx.exe" with explorer to be safe as a double check. It wasnt located anywhere. I know my explorer clears its temp stuff nightly. It may have gone with that, or,well, thats what i am hoping.

    If you need me to clarify, i will :)

    thanks in advance,
    - xyster
     
    xyster, Jun 14, 2008
    #6
  7. xyster

    xyster Private E-2

    Hello again,

    i have done some looking, i now know more about this issue...

    I have discovered how i got the first "kernelcheck.exe" problem.

    It seemed my USB got infected from another computer with the problem. I got this from "swinburne library computers" (stupid swinburne, stupid friend). My friend also has this problem. It seems to be a real pain in the ***. She didnt know she had it on her laptop. It infects the USB's. The moment i plugged in a usb it infected it. I noticed bcus it was my usb while i was transferring files.

    In short; It is a pain. It's painfully contageous. If anyone else is reading this thread, don't stick your usb into your friends computers or you will infect them to if there virus blocker doesnt stop it (like mine spotted it). It will then infect all USB's they plug in and its a long line of pain in removing it.

    How I cleaned the USB:
    I made sure my firewalls were turned on, i removed the kernelcheck.exe from C:\
    I then plugged in the infected USB: I blocked the kernelcheck.exe it tried to do with my Anti-virus
    I then ran the following commands to delete autorun.inf and autorun.exe from my USB. (if you do it through explorer they just kept re-appearing).
    1. Open Start>>Run and type cmd and press enter. This will open a command prompt window. On this command prompt window type the following steps.

    2. type: $: (swap the $ for your USB's drive, eg. J:)

    3. type: attrib -r -h -s autorun.inf (this will make it visible, do the same for the autorun.exe)

    4. type del autorun.inf (this deletes :), do the same for autorun.exe)

    Note: the above commands were an adaption from: http://www.troublefixers.com/not-able-to-open-drives-on-hard-disk-by-double-click/

    - xyster
    P.S: i dont know if that is relevant for this, but i thought i should tell somoene... bcus when i searched in google for this issue i found pretty much nothing about it.
    P.P.S: is this a permanent fix i have done, it doesnt feel so much like it, but im not hugely experienced in this field).
     
    xyster, Jun 15, 2008
    #7
  8. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    You ran a quick scan with MalwareBytes .....was the thumb drive attached at the time? Did you include it for scanning?

    We are seeing more and more of the usb infections.

    Are you still having problems?

    If not, it is time to do our final steps:

    1. If we used ComboFix then UNINSTALL COMBOFIX (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
    2. Click START then RUN
    * Now type "%userprofile%\Desktop\cf" /u in the runbox and click OK.
    * Note: The space between the cf and the /U, it must be there.
    3. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
    4. You can delete the C:\MGtools folder and the C:\MGtools.exe file. You can also delete the C:\MGlogs.zip
    5. If you are running Windows XP or Windows ME, do the below:
    * Refer to the cleaning steps in the READ ME for your Window version and see the steps to Disable System Restore which will flush your Restore Points.
    * Then reboot and Enable System Restore to create a new clean Restore Point.
    6. After doing the above, you should work thru the below link:
    How to Protect yourself from malware!
     
    TimW, Jun 15, 2008
    #8
  9. xyster

    xyster Private E-2

    I have ran the checks on my USB now, it appears to be clean. Thankyou for your help.

    Stupid USB virus. Thankyou so much for all your help hear. It has been so much appreciated.

    You guys are absolutely awesome.

    - xyster
     
    xyster, Jun 15, 2008
    #9
  10. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    You are quite welcome...safe surfing. :)
     
    TimW, Jun 16, 2008
    #10

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds