Virus.Neshta

Short bio

Virus.Neshta is Malwarebytes’ detection name for the Neshta family of viruses which has been around since at least 2010, targeting Windows systems.

Symptoms

To gain persistence, Virus.Neshta changes the default value for the registry key HKEY_CLASSES_ROOTexefileshellopencommand, to “%SystemRoot%svchost.com “%1″ %*”.

Aftermath

After removal of the infected files the system may be missing vital files for programs to run. Depending on the duration of the infection and the removed files, the system may even be inoperable.

Type and source of infection

Virus.Neshta spreads by adding the virus code to other executable files.

Protection

Malwarebytes blocks Virus.Neshta

Home remediation

Malwarebytes can detect and remove Virus.Neshta without further user interaction.

1. Please download Malwarebytesto your desktop.
2. Double-click MBSetup.exeand follow the prompts to install the program.
3. When your Malwarebytes for Windowsinstallation completes, the program opens to the Welcome to Malwarebytes screen.
4. Click on the Get started button.
5. Click Scan to start a Threat Scan.
6. Click Quarantineto remove the found threats.
7. Reboot the system if prompted to complete the removal process.

Business remediation

How to remove Virus.Neshta with the Malwarebytes Nebula console

You can use the Malwarebytes Anti-Malware Nebula console to scan endpoints.

Nebula endpoint tasks menu

Choose the Scan + Quarantine option. Afterwards you can check the Detections pageto see which threats were found.

On the Quarantine pageyou can see which threats were quarantined and restore them if necessary.