Archive for July, 2009

« Older Entries

Remove Trojan packed TDSS backdoor TidServ

Friday, July 31st, 2009



Trojan.TDSSserv also known as Trojan Backdoor.Tidserv is a trojan horse that may represent security risk for the infected computer. The trojan uses rootkit-specific techniques designed to hide the software presence in the system and also blocks user access to security websites. Once running, this trojan will display a fake security alerts that tells you to install a rogue antispyware application to delete the infection. These alerts are a fake and should be ignored!
Use the following instructions to remove trojan TDSSserv (trojan Backdoor.Tidserv).

Step 1: Disable TDSSserv trojan driver.

Right click the My computer icon. If you are using the non classic Start menu, then right click My computer icon on your Start button menu.
Click Properties.
Click Hardware Tab.
Click Device Manager.
In the top menu, click View and click Show Hidden Drivers.
Scroll down to non Plug and Play drivers.
Click + at left.
In the list of drivers right click TDSSserv.sys.
Click Disable.
Click YES for confirm.
Close all windows and reboot your computer.
Step 2: Delete TDSSserv trojan driver.

Download Avenger from here and unzip to your desktop.
Run Avenger, copy,then paste the following text in Input script Box:
Drivers to delete:
TDSSserv.sys

Then click on ‘Execute’.

You will be asked Are you sure you want to execute the current script?. Click Yes.
You will now be asked First step completed — The Avenger has been successfully set up to run on next boot. Reboot now?. Click Yes.
Your PC will now be rebooted.

Step 3: Remove TDSSserv trojan files and any associated malware.

Download Malwarebytes Anti-Malware (MBAM). The program designed to quickly detect, destroy and prevent malware, spyware, trojans.
Once downloaded, close all programs and Windows on your computer (including this one).
Double-click on the icon named mbam-setup.exe to install the application.
When the installation begins, keep following the prompts in order to continue with the installation process. Do not make any changes to default settings and when the program has finished installing, make sure a checkmark is placed next to Update Malwarebytes’ Anti-Malware and Launch Malwarebytes’ Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select “Perform Quick Scan”, then click Scan.
MBAM will now start scanning your computer for malware. This process may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
MBAM will now delete all of the files and registry keys and add them to the quarantine.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.
The trojan TDSSserv creates the following files:
%Temp%\file.exe
%Temp%\TDSS[RANDOM CHARACTERS].tmp
%System%\drivers\TDSS[RANDOM CHARACTERS].sys
%System%\TDSS[RANDOM CHARACTERS].sys
%System%\TDSS[RANDOM CHARACTERS].dat
%System%\TDSS[RANDOM CHARACTERS].log
%System%\TDSSserv.sys
%System%\TDSSerrors.log
%System%\TDSSservers.dat
%System%\TDSSl.dll
%System%\TDSSlog.
%System%\TDSSmain.dll
%System%\TDSSinit.dll
%System%\TDSSlog.dll
%System%\TDSSadw.dll
%System%\TDSSpopup.dll


Also read This info
How to Disable ‘tdssserv.sys’ Trojan Identified With Update Failure and Redirected Searches
Key Symptoms: (any of the following)
applying software updates does not work
Google searches /Yahoo searches are redirected
AntiVirus / AntiMalware programs are just ’spinning’
often associated with Antivirus XP 2008, Antivirus XP 2009
Predicted Outcome:
Ability to complete the UPDATED 8-step Viruses/Spyware/Malware Preliminary Removal Instructions
Ability to update your protection programs: Antivirus, AntiMalware, Rootkit, etc.
Procedural Steps

1.Start->Run-> Devmgmt.msc ->ok
On the toolbar, Click on View -> “Show hidden devices”
2.Scroll down and locate Non-plug and Play Drivers
Click the + sign to expand
3.Search for “TDSSserv.sys”
More exploits: clbdriver.sys, oUltraf, seneka.sys,
Right click on it, and select “Disable”
4. Restart your computer
5. Confirm ‘TDSSserv.sys’ is disabled. Repeat Step 1-3. Cancel to exit.
6. Begin or resume UPDATED 8-step Viruses/Spyware/Malware Preliminary Removal Instructions
Aknowledgement: Mike, humble PC users everywhere

Technical Details:
Common Names: gogoogle, goyahoo
O20 – AppInit_DLLs: karna.dat is apparent in HJT log
Detected in various scanning programs:
C:\WINDOWS\system32\wini10894.exe
C:\WINDOWS\brastk.exe
C:\WINDOWS\system32\brastk.exe
C:\WINDOWS\karna.dat
C:\WINDOWS\system32\karna.dat
TDSSserv.sys
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run | brastk
all software updates redirected to 127.0.0.1 (your own computer) so they won’t update.
Modification History

2.2 Add more service names
2.1 Modify title
1.1 Source material from Kimsland
1.2 This is pretty much my limit for addressing technical details for rooting out the infection

Tags: , , , ,
Posted in 2:Trojan Removal | 3 Comments »

Remove Trojan Lsas Blaster Keylogger

Friday, July 31st, 2009



Lsas.Blaster.Keyloger is fake Windows Alert which is secretly installed by trojan. It is a part of rogue application. A rogue software application designed to trick users into buying a fake product by using scare tactics. It will bombard you with pop ups in order to try and scam you out of money. This infection can come into after fake video codec installation that usually comes with malware.

Aliases : Lsas.Blaster.Keylogger
Infection Type : Trojan Horse
Risk Level: High Risk
System Affected : Windows Operating Systems

General Symptoms
Displays fake warning messages and “System Security Firewall Alert ” popups alerts.
Flashing icons appear on your system tray (Near of your system clock).
Hijacked homepage to OBSCURE webpage.
Internet Explorer is infected with worm Lsas.Blaster.Keyloger. This worm is trying to send your credit card details using Internet Explorer to connect to remote host.

Manual Removal of Lsas.Blaster.Keyloger

Kill Spyware Processes
692527612.exe, 1313928688.exe, 1806188250.exe

Get rid of Files and Folder
C:\Documents and Settings\All Users\Application Data\1929146152\1313928688.exe
C:\Documents and Settings\All Users\Application Data\1372029626\1806188250.exe
C:\Documents and Settings\All Users\Application Data\870894309\692527612.exe

OR,For auto removal of Lsas.Blaster.Key logger, Download Spyware Doctor

Tags: , , ,
Posted in 2:Trojan Removal | 1 Comment »

Trojan Brisv a !inf brisv alinf removal

Friday, July 31st, 2009



Trojan.Brisv.A!inf is a detection for the multimedia files infected with Trojan.Brisv.A.
remove Trojan.Brisv.A!inf need to disable System Restore

Trojan.Brisv.A!inf Summary
Virus Name:Trojan.Brisv.A!inf
Detected By:BitDefender antivirus program
Virus Trojan.Brisv.A!inf Detected times:232381times
Trojan.Brisv.A!inf Overall Risk:Medium 732382
Type: Trojan Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows Vista, Windows XP
Trojan.Brisv.A!inf file size:3623820 bytes Trojan.Brisv.A!infwas first Detected by BitDefender on Tuesday, August 5th, 2008 , 6:02 am,Trojan.Brisv.A!inf is a new threats of Hacking,Malware,Spam,worm.
OPTION 1: Remove Trojan.Brisv.A!inf instruction:
1.Temporarily Disable System Restore;
2.Reboot computer in SafeMode;
3.delte Trojan.Brisv.A!inf virus files and kill Trojan.Brisv.A!inf file task process(if have);
4.Delete/Modify any values added to the registry by Trojan.Brisv.A!inf ;
5.delete IE temp files,restart the computer and run a whole scan with Antivirus Program.

The most popular description of Trojan.Brisv.A!inf states that this infection embeds itself to the files with the following extensions:
• .asf
• .mp2
• .mp3
• .wma
• .wmv

It also looks for media files with other extantions and modifies their extention to .wma. The accession of Trojan.Brisv.A!inf to the files of the above types results in downloading of malicious websites by Windows Media Player once it plays any of the infected media files. The above is a common description of Trojan.Brisv.A!inf. It is true but incomplete. Trojan.Brisv.A!inf hides itself and may disable removal tools of certain times. It may also disable the downloading feature of Windows so that any program cannot be downloaded before you remove Trojan.Brisv.A!inf. As you can see, Trojan.Brisv.A!inf is a tricky and dangerous program that acts as an advertising agent. The products it promotes are normally adult websites and fake computer security tools. It is strongly recommended to ignore services and products adverted by Trojan.Brisv.A!inf and remove Trojan.Brisv.A!inf at the earliest opportunity.


Trojan.Brisv.A!inf Technical Details
Full name: Trojan.Brisv.A!inf
Version: 2009
Type: Rogue anti-spyware
Origin: USA

Signs of being infected with Trojan.Brisv.A!inf:
Trojan.Brisv.A!inf may affect media files as it attempt to embed itself into them. That, if the process of accession of Trojan.Brisv.A!inf has been completed successfully, should increase the size of infected media files by 1.138 kb. If the file has not accepted the embedding copy of Trojan.Brisv.A!inf, it usually goes out of order and cannot be read any more. Trojan.Brisv.A!inf may by chance destroy files other than media if it identifies them as media files and tries to apply the same procedure of embedding itself. Media files infected with Trojan.Brisv.A!inf may go out of order if played with players of developers other than Microsoft. If you see that Windows Media Player downloads strange websites and files are becoming unreadable, you may need to remove Trojan.Brisv.A!inf.

There are rather technical details of Trojan.Brisv.A!inf presence:
Trojan.Brisv.A!inf creates the following key upon launching: HKEY_CURRENT_USER\Software\Microsoft\PIMSRV

and modifies the follwing keys in the Registry:
HKEY_CURRENT_USER\ Software\ Microsoft\ MediaPlayer\ Preferences\ “URLAndExitCommandsEnabled” = “0?

HKEY_CURRENT_USER\ Software\ Microsoft\ MediaPlayer\ Player\ Extensions\ .mp3\ “Permissions” = “21?

Trojan.Brisv.A!inf creates mutex PIMSRV1 in order to provide its one-time presence in the memory.

Trojan.Brisv.A!inf is detected by many fair removal tools, but most of them cannot remove Trojan.Brisv.A!inf, unfortunately. They disregard its ability to disable programs, unlike the tool we are recommending to remove Trojan.Brisv.A!inf

Manual Removal of Trojan Brisv.A

1. Edit Windows registry and remove these registry subkey:
HKEY_CURRENT_USER\Software\Microsoft\PIMSRV

2. Restore these registry entries to default value.(If required)
HKEY_CURRENT_USER\Software\Microsoft\MediaPlayer\Preferences\
“URLAndExitCommandsEnabled” = “0″

HKEY_CURRENT_USER\Software\Microsoft\MediaPlayer\Player\
Extensions\.mp3\”Permissions” = “21″

Tags: , , ,
Posted in 2:Trojan Removal | No Comments »

Trojan Agent Azsy removal guide

Friday, July 31st, 2009



Remove Trojan.Win32.Agent.Azsy
Trojan.win32.agent.azsy is a malicious application which is primitive in its size and essence but extremely dangerous for the compromised system when it comes to the possible impact it may produce. Trojan.win32.agent.azsy is written in C++ programming language and has as little as 439Kb in size. Trojan.win32.agent.azsy infiltrates the target host computer via firewall flaws and other minor security splits. This intrusion is undetected and usually remains obscure all the way until a professional antivirus utility is used. When inside and active, Trojan.win32.agent.azsy parasite launches the malicious campaign for promoting the affiliated rogue anti-spyware program called Personal Antivirus. For this purpose, Trojan.win32.agent.azsy uses the tactics of triggering exaggerated popup alerts and even bogus system scanners that will try to scare the victim into thinking he/she has multiple security issues and malware threats.
Such technique is a component of Personal Antivirus promotion campaign, so Trojan.win32.agent.azsy may be considered an integral part of Personal Antivirus (click here to learn how to remove personal antivirus) fraud, so its timely detection and removal is of critical importance. It’s worth mentioning that some antivirus software may detect Trojan.win32.agent.azsy as Trojan-Downloader.Win32.Agent.aoth, which is basically the same. No matter in what shape and how Trojan.win32.agent.azsy infiltrated your system, this dangerous infection must be immediately removed from your system. Trojan.win32.agent.azsy installs rogue anti-spyware and makes the compromised computer vulnerable.

Malware Type: Trojan Horses

Malware Author: Innovagest2000 SL

Threat Level: Critical

Trojan.win32.agent.azsy Related Pop-Up Screenshot:



How to remove
Trojan.win32.agent.azsy manually:
Manual removal of Trojan.win32.agent.azsy is a feasible objective if you have sufficient expertise in dealing with program files, processes, .dll files and registry entries.

The associated files to be deleted are listed below:
•%Documents and Settings%\All Users\Desktop\Personal Antivirus.lnk

•%Documents and Settings%\All Users\Start Menu\Programs\Personal Antivirus

•%Documents and Settings%\All Users\Start Menu\Programs\Personal Antivirus\Personal Antivirus Home Page.lnk

•%Documents and Settings%\All Users\Start Menu\Programs\Personal Antivirus\Personal Antivirus.lnk

•%Documents and Settings%\All Users\Start Menu\Programs\Personal Antivirus\Purchase License.lnk

•%UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\Personal Antivirus.lnk

•%UserProfile%\Application Data\Personal Antivirus

•%UserProfile%\Application Data\Personal Antivirus\settings.ini

•%UserProfile%\Application Data\Personal Antivirus\uill.ini

•%UserProfile%\Application Data\Personal Antivirus\unins000.exe

•%UserProfile%\Application Data\Personal Antivirus\Uninstall Personal Antivirus.lnk

•%UserProfile%\Application Data\Personal Antivirus\db

•%UserProfile%\Application Data\Personal Antivirus\db\config.cfg

•%UserProfile%\Application Data\Personal Antivirus\db\Timeout.inf

•%UserProfile%\Application Data\Personal Antivirus\db\Urls.inf

•%UserProfile%\Local Settings\Application Data\Microsoft\Windows\log.txt

•%UserProfile%\Local Settings\Application Data\Microsoft\Windows\pguard.ini

•%UserProfile%\Local Settings\Application Data\Microsoft\Windows\services.exe

•%Program Files%\Personal Antivirus

•%Program Files%\Personal Antivirus\activate.ico

•%Program Files%\Personal Antivirus\Explorer.ico

•%Program Files%\Personal Antivirus\PerAvir.exe

•%Program Files%\Personal Antivirus\unins000.dat

•%Program Files%\Personal Antivirus\uninstall.ico

•%Program Files%\Personal Antivirus\working.log

•%Program Files%\Personal Antivirus\db

•%Program Files%\Personal Antivirus\db\DBInfo.ver

•%Program Files%\Personal Antivirus\db\ia080614.db

•%Program Files%\Personal Antivirus\db\ia080618x.db

•%Program Files%\Personal Antivirus\Languages

•%Program Files%\Personal Antivirus\Languages\IAEs.lng

•%Program Files%\Personal Antivirus\Languages\IAFr.lng

•%Program Files%\Personal Antivirus\Languages\IAGer.lng

•%Program Files%\Personal Antivirus\Languages\IAIt.lng

•%WINDOWS%\system32\log.txt
•%UserProfile%\Application Data\Microsoft\Windows\winlogon.exe

•%UserProfile%\Local Settings\Application Data\Microsoft\Internet Explorer\iGSh.png

•%UserProfile%\Local Settings\Application Data\Microsoft\Internet Explorer\iMSh.png

•%UserProfile%\Local Settings\Application Data\Microsoft\Internet Explorer\iPSh.png

•%UserProfile%\Local Settings\Application Data\Microsoft\Internet Explorer\iv.exe

•%UserProfile%\Local Settings\Application Data\Microsoft\Windows\log.txt

•%UserProfile%\Local Settings\Application Data\Microsoft\Windows\pguard.ini

•%UserProfile%\Local Settings\Application Data\Microsoft\Windows\services.exe

The related registry entries to be removed are as follows:
•HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Personal Antivirus_is1

•HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ITGRDENGINE

•HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ITGrdEngine

•HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer “PrS”

•HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “Personal Antivirus”

Please, be aware that manual removal of Trojan.win32.agent.azsy trojan is a cumbersome process and does not always ensure complete deletion of the malware, due to the fact that some files might be hidden or may get reanimated automatically afterwards. Moreover, manual interference of this kind may cause damage to the system. That’s why we strongly recommend automatic removal of Trojan.win32.agent.azsy, which will save your time and enable avoiding any system malfunctions and guarantee the needed result.
Download Trojan.win32.agent.azsy Trojan Automatic Remover

Tags: , ,
Posted in 2:Trojan Removal | No Comments »

Trojan win32 Taterf psw kavos worm

Friday, July 31st, 2009



Remove Trojan win32 Taterf

Win32/Taterf is a family of worms that spread via mapped drives in order to steal login and account details for popular online games.

Company Name and Detection Name avast: Win32:Kavos
AVG (GriSoft): PSW.OnlineGames.2.U
Avira: TR/PSW.Magania.auza
BitDefender: Trojan.PWS.Onlinegames.KBSZ
Dr.Web: Trojan.PWS.Gamania.10780
EMSI Software: Trojan.Win32.Inhoo!IK
eSafe (Alladin): Suspicious file
Eset: Win32/PSW.OnLineGames.NMY
Kaspersky: Trojan.Win32.Agent.bwaa
microsoft: worm:win32/taterf.b
Sophos: Mal/EncPk-HI
Symantec: Trojan.Packed.NsAnti
vba32: Trojan.Win32.Agent.bwaa
V-Buster: Trojan.Agent.HNHG

Installation
When executed, Taterf copies itself to the system directory as a hidden file using one of the following file names:
amvo.exe
kavo.exe
awda.exe
avpo.exe

The registry is modified to run the copy at each Windows start (for example):
Adds value: “amva”
With data: “\amvo.exe”
To subkey: HKCU\Software\Microsoft\Windows\CurrentVersion\Run

Adds value: “avpa”
With data: “\avpo.exe”
To subkey: HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Note: Filenames and registry modifications differ according to variant.

The functionality to perform Taterf’s password-stealing payload is contained in a dll component which is also dropped to the system directory using one of the following file names:
amvo.dll
avpo.dll
kavo.dll
.dll
Where may be omitted entirely, or be a numeral from 0-9.
Once dropped, the dll is injected into explorer.exe or iexplore.exe. These dlls may be detected as Worm:Win32/Taterf..dll, according to variant.

It should be noted, that in order to evade detection, the authors of this family may pack the worm’s executable. In cases such as these, the worm may be detected with the following names:
VirTool:Win32/Vanti.A
VirTool:Win32/Vanti.B
VirTool:Win32/Obfuscator.T

A driver with a randomly generated file name may also be dropped in the %temp% directory depending on which packer is used. This driver is detected as either VirTool:WinNT/Vanti.A or VirTool:WinNT/Vanti.B. The above mentioned dlls may also be written to the %temp% directory when these packers are used.
Spreads Via…
Mapped Drives
The worm continually enumerates drives from C- Z, copying itself to the root of the drive, and creating an ‘autorun.inf’ file. The autorun.inf is used to execute the worm whenever the drive is viewed with Windows Explorer. This file is detected as Worm:Win32/Taterf!inf.


The name that the worm uses to copy itself to in the root of the drive differs across variants, however, it usually consists of random letters and numbers with a ‘.com’, ‘cmd’ or an ‘.exe’ extension.
For example:
q.com
d.com
d6fagcs8.cmd
gjn2pjlw.exe
h1dwg20.exe
h6o0re.cmd

Payload
Steals Online Game Data

Once injected, the DLL is used to obtain account information for one or more of the following Massively Multiplayer Online Games and affiliated products:
Rainbow Island
Cabal Online
A Chinese Odyssey
Hao Fang Battle Net
Lineage
Gamania
MapleStory
qqgame
Legend of Mir
World Of Warcraft

The captured details are sent to a remote server.
Modifies System Settings
The following registry entries are modified in order to hinder detection and removal, and facilitate spreading:
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\
Explorer\NoDriveTypeAutoRun

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\
Advanced\ShowSuperHidden

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\
Advanced\Hidden

HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\
Advanced\Folder\Hidden\SHOWALL\CheckedValue

Downloads Arbitrary Files
The worm contacts the om7890.com domain in order to download files and update itself.

Modifies System Security Settings
The worm attempts to circumvent security products by:
Attempting to prevent AVP Antivirus from displaying notifications regarding system changes by closing windows used by this product.
Attempting to terminate Ravmon.exe if it is found to be running on the affected system.
TO REMOVE THIS THREAT FROM YOUR PC, DOWNLOAD MICROSOFT MALICIOUS SOFTWARE REMOVAL TOOL

Tags: , , , , ,
Posted in 2:Trojan Removal | No Comments »

Trojan downloader renos bah removal

Friday, July 31st, 2009



Remove win32 Trojan downloader Renos.BAH
TrojanDownloader:Win32/Renos.BAH [Microsoft] is also known as:
Threat Alias Number of Incidents
Generic Downloader.x [McAfee] 41
Downloader [Symantec] 38
Trojan-Downloader.Win32.CodecPack [Ikarus] 33
Trojan-Dropper.Agent [Ikarus] 11
Downloader.MisleadApp [Symantec] 8
Trojan.Zlob [Symantec] 7
Generic Downloader.ac [McAfee] 6
Possible_DLDER [Trend Micro] 6
Trojan-Downloader.Win32.Renos [Ikarus] 6
Puper [McAfee] 5
Trojan-Downloader.Win32.Agent.aopv [Kaspersky Lab] 5
Trojan-Downloader.Win32.CodecPack.aac [Kaspersky Lab] 5
Trojan.Fakeavalert [Symantec] 4
Trojan-Downloader.Win32.Renos.BA [Ikarus] 4
Trojan Horse [Symantec] 3
Trojan.Zlob [Ikarus] 3
Trojan-Dropper.Win32.Agent.agsb [Kaspersky Lab] 3
Downloader.Trojan [Symantec] 2
Generic Downloader.ab [McAfee] 2
Mal/Generic-A [Sophos] 2
Troj/Dloadr-CAB [Sophos] 2
Troj/FakeVir-KL [Sophos] 2
Trojan.Win32.Monder.yrv [Kaspersky Lab] 2
Trojan.Zlob!sd6 [PC Tools] 2
Trojan-Downloader.Win32.Agent.aoyi [Kaspersky Lab] 2
Trojan-Downloader.Win32.Agent.apqe [Kaspersky Lab] 2
Trojan-Downloader.Win32.Agent.atam [Kaspersky Lab] 2
Trojan-Downloader.Win32.Agent.bhzq [Kaspersky Lab] 2
Trojan-Downloader.Win32.CodecPack.aak [Kaspersky Lab] 2


Trojan-Downloader.Win32.CodecPack.aar [Kaspersky Lab] 2
Trojan-Downloader.Win32.CodecPack.ae [Kaspersky Lab] 2
Trojan-Downloader.Win32.CodecPack.aej [Kaspersky Lab] 2
Trojan-Downloader.Win32.CodecPack.agz [Kaspersky Lab] 2
Trojan-Downloader.Win32.CodecPack.ajt [Kaspersky Lab] 2
Trojan-Downloader.Win32.CodecPack.dc [Kaspersky Lab] 2
Trojan-Downloader.Win32.FraudLoad [Ikarus] 2
Trojan-Downloader.Win32.Renos.AY [Ikarus] 2
Trojan-Dropper.Win32.Agent.agtl [Kaspersky Lab] 2
Troj/Agent-HSN [Sophos] 1
Troj/Agent-HXH [Sophos] 1
Troj/Agent-INT [Sophos] 1
Troj/Dload-FH [Sophos] 1
Troj/Dloadr-BVW [Sophos] 1
Troj/Dloadr-BYS [Sophos] 1
Troj/Dloadr-CBH [Sophos] 1
Troj/DwnLdr-HJM [Sophos] 1
Troj/DwnLdr-HKG [Sophos] 1
Trojan.FakeAlert [PC Tools] 1
Trojan.Fakeavalert!sd6 [PC Tools] 1
Trojan.Fakeavalert.B [Symantec] 1
Trojan.Win32.Agent.arpa [Kaspersky Lab] 1
Trojan-Downloader [Ikarus] 1
Trojan-Downloader.Agent!sd6 [PC Tools] 1
Trojan-Downloader.JKYN [Ikarus] 1
Trojan-Downloader.Win32.Agent.ahmc [Kaspersky Lab] 1
Trojan-Downloader.Win32.Agent.ahym [Kaspersky Lab] 1
Trojan-Downloader.Win32.Agent.anar [Kaspersky Lab] 1
Trojan-Downloader.Win32.Agent.anoz [Kaspersky Lab] 1
Trojan-Downloader.Win32.CodecPack.aab [Kaspersky Lab] 1
Trojan-Downloader.Win32.CodecPack.aaf [Kaspersky Lab] 1
Trojan-Downloader.Win32.CodecPack.ax [Kaspersky Lab] 1
Trojan-Downloader.Win32.CodecPack.bb [Kaspersky Lab] 1
Trojan-Downloader.Win32.CodecPack.ca [Kaspersky Lab] 1
Trojan-Downloader.Win32.CodecPack.cf [Kaspersky Lab] 1
Trojan-Downloader.Win32.CodecPack.cr [Kaspersky Lab] 1
Trojan-Downloader.Win32.CodecPack.gj [Kaspersky Lab] 1
Trojan-Downloader.Win32.CodecPack.s [Kaspersky Lab] 1
Trojan-Downloader.Win32.CodecPack.vj [Kaspersky Lab] 1
Trojan-Downloader.Win32.CodecPack.wy [Kaspersky Lab] 1
Trojan-Downloader.Win32.CodecPack.xo [Kaspersky Lab] 1
Trojan-Downloader.Win32.CodecPack.xu [Kaspersky Lab] 1
Trojan-Downloader.Win32.FraudLoad.vcno [Kaspersky Lab] 1
Trojan-Downloader.Win32.FraudLoad.vcoy [Kaspersky Lab] 1
Trojan-Downloader.Win32.FraudLoad.vcpp [Kaspersky Lab] 1
Trojan-Downloader.Win32.Small.aeod [Kaspersky Lab] 1
Trojan-Downloader.Win32.Zlob.zsa [Kaspersky Lab] 1
Trojan-Dropper.Win32.Agent.yql [Kaspersky Lab] 1
Win32.SuspectCrc [Ikarus] 1
Win-Trojan/Codecpack.40448 [AhnLab] 1

TrojanDownloader:WIN32/Renos.BAH is a trojan that can download malicious program on to the computer. TrojanDownloader:WIN32/Renos.BAH can also install rogue security programs without users consent. The said program will scam computer users and attracts themto pay for the registered version.

TrojanDownloader:Win32/Renos.BAH [Microsoft] is known to be created as:
%Temp%\systeminit.exe

Note: %Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).
TO REMOVE THIS THREAT FROM YOUR PC, DOWNLOAD MICROSOFT MALICIOUS SOFTWARE REMOVAL TOOL

Tags: , , ,
Posted in 2:Trojan Removal | No Comments »

Trojan win32 Pakes Cutwail gen removal

Friday, July 31st, 2009



Remove Trojan.Pakes , cutwail

Name: Trojan.Pakes
Threat Level: High
Description: Trojan.Pakes downloads various malware including Internet Optimizer, ISTBar, SideFind and Target Saver, which are all products of Integrated Search Technologies (IST).

Type: TT_Downloader, TT_Trojan
Also known as: Trojan.Win32.Pakes.cij, Trojan.Win32.Pakes.kra, trojan.win32.pakes.ldi, Trojan.Win32.Pakes.bzx, TrojanDropper:Win32/Cutwail.gen!I,


Threat analysis: Search ThreatExpert to view reports

Trojan.Win32.Pakes [Ikarus] is known to be created as:
%FontsDir%\3c7780c0.dll
%ProgramFiles%\internet explorer\ijl105.dll
%ProgramFiles%\internet explorer\ijl15.dll
%System%\a.exe
%System%\com\lsass.exe
%System%\com\smss.exe
%System%\dakwx.exe
%System%\digeste.dll
%System%\drivers\hcsablyr.sys
%System%\drivers\outsevwp.sys
%System%\drivers\sespodzv.sys
%System%\drivers\xaxlzacd.sys
%System%\drivers\xwlhztoo.sys
%System%\explorer32.exe
%System%\foova.exe
%System%\isyst32win.exe
%System%\kdcse.exe
%System%\kdozp.exe
%System%\l33t.exe
%System%\msansspc.dll
%System%\msdoswinsyst32.exe
%System%\msiconf.exe
%System%\msmsgs.exe
%System%\msxml71.dll
%System%\oukdfgr.exe
%System%\reader_s.exe
%System%\scrsys16_061230.scr
%System%\setup_ver1.1550.2.exe
%System%\setup_ver1.1550.21.exe
%System%\setupl.exe
%System%\syst32svchost.exe
%System%\system.exe
%System%\updatevd.exe
%System%\updwin32syst.exe
%System%\winsys16_061230.dll
%Temp%\dhl_id8612.exe
%Temp%\explorer32.exe
%Temp%\ieupdates.exe
%Temp%\loader.exe
%Temp%\ntdll64.dll
%Temp%\pinch.exe
%Temp%\u83724.exe
%Temp%\winlogon.exe
%Temp%\wmvcodec_update.exe
%UserProfile%\reader_s.exe
%Windir%\9129837.exe
%Windir%\aczjaczj.exe
%Windir%\fxstaller.exe
%Windir%\ijl105.dll
%Windir%\jbbjrjjr.exe
%Windir%\ommiglef.exe
%Windir%\regsv32.exe
%Windir%\runsql.exe
%Windir%\services.exe
%Windir%\sv.exe
%Windir%\svchost.exe
%Windir%\winlogon.exe
%Windir%\zjiabxag.exe

Notes:
%FontsDir% is a variable that refers to a virtual folder containing fonts. A typical path is C:\Windows\Fonts.
%ProgramFiles% is a variable that refers to the Program Files folder. A typical path is C:\Program Files.
%System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).
%Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).
%UserProfile% is a variable that specifies the current user’s profile folder. By default, this is C:\Documents and Settings\[UserName] (Windows NT/2000/XP).
%Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.

Manual Removal:

Files To delete
systemroot+\system32\lmqfg.dll
iexplore0.dll

systemroot+\system32\lmqfg.dll
{b53082b8-b49c-4ba6-81ff-7c41da1cd87c}
auf0.exe
cfhxxd.exe
ffcfbbb.exe
iexplore.exe
iexplore0.dll
v1200351p.epe
systemroot+\system32\kaqwyy.exe
systemroot+\system32\lmqfg.dll
iexplore0.dll
iexplore.exe
systemroot+\system32\kaqwyy.exe
ffcfbbb.exe
cfhxxd.exe
auf0.exe

REGISTRY ITEMS:
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\
setup\{b53082b8-b49c-4ba6-81ff-7c41da1cd87c}

Removal: This infection can be removed using Spyware Doctor – Downlload it.

Tags: , , , ,
Posted in 2:Trojan Removal | No Comments »

Trojan Win32 packed Generic 200

Friday, July 31st, 2009



Remove Trojan.Packed.Generic.200
Packed.Generic.200 is a usual detection for malicious files that were packed or encrypted to conceal itself from antivirus and security programs. Once executed, Packed.Generic.200 can further harm the computer by downloading additional threats from a remote server.

Trojan:win32/Alureon.gen!J [Microsoft]
Rootkit.win32.TDSS [Ikarus]
Virus.win32.Fasec [Ikarus]
Packed.win32.Tdss.f [Kaspersky Lab]
Rootkit.win32.TDSS.eyj [Kaspersky Lab]
Trojan.win32.InternetAntivirus [Ikarus]
Packed.win32.Tdss.c [Kaspersky Lab]
DNSChanger.r [McAfee]
Trojan:win32/Alureon.gen [Microsoft]
DNSChanger.f.gen.a [McAfee]
Trojan-Downloader.win32.Renos.AQ [Ikarus]
Mal/TDSS-A [Sophos]
Trojan.TDss. [Ikarus]
Mal/Alureon-C [Sophos]
Mal/FakeVirPk-A [Sophos]
TrojanDownloader:win32/Rugzip.A [Microsoft]
Mal/TDSS-A, Mal/EncPk-CZ [Sophos]
Mal/FakeVirPk-A, Mal/EncPk-CZ [Sophos]
Trojan:win32/FakeSpyguard [Microsoft]
Trojan.win32.Alureon [Ikarus]
DNSChanger.gen [McAfee]
Generic FakeAlert.k [McAfee]
Packed.win32.Tdss.a [Kaspersky Lab]
Mal/Alureon-C, Mal/FakeVirPk-A [Sophos]
Mal/EncPk-CZ [Sophos]
Mal/EncPk-GR, Mal/EncPk-GR [Sophos]
Worm.win32.AutoTDSS [Ikarus]
Trojan:win32/InternetAntivirus [Microsoft]
Generic FakeAlert.h [McAfee]
Generic.dx [McAfee]
FakeAlert-AG.gen.a [McAfee]
Trojan:win32/Sudiet.B [Microsoft]
TrojanDownloader:win32/FakeIA.A [Microsoft]
Trojan:win32/Alureon.BH [Microsoft]
Win-Trojan/Xema.variant [AhnLab]
Mal/Generic-A [Sophos]
Packed.win32.Tdss.e [Kaspersky Lab]
Trojan.win32.FakeSpyguard [Ikarus]
Trojan:win32/Vundo.JC.dll [Microsoft]
Mal/Alureon-C, Mal/Alureon-B, Mal/FakeAV-S [Sophos]
Mal/Alureon-C, Mal/Alureon-B, Mal/FakeAV-S, Mal/FakeVirPk-A [Sophos]
Mal/FakeVirPk-A, Mal/TDSS-A [Sophos]
Mal/TDSSPack-E [Sophos]
Trojan.TDss [Ikarus]
Trojan:win32/Alureon.gen!Q [Microsoft]
TrojanSpy:win32/Chadem.A [Microsoft]
Rootkit.TDSS!sd [PC Tools]
Trojan.Fakeav. [Ikarus]
TrojanDownloader:win32/Renos.gen!BC [Microsoft]
TrojanDropper:win32/Kryptik.B [Microsoft]
Packed.win32.Tdss [Ikarus]
Trojan:win32/Witer.B [Microsoft]
Generic FakeAlert.c [McAfee]
Generic PWS.y [McAfee]
Mal/TDSSPack-J [Sophos]
Program:win32/FakeWG.A [Microsoft]
Generic Downloader.x [McAfee]
Mal/FakeAV-AD [Sophos]
Mal/TDSS-A, Mal/FakeVirPk-A [Sophos]
Mal/UnkPack-Fam [Sophos]
Packed.win32.Krap.d [Kaspersky Lab]
Rootkit.win32.TDSS.cnk [Kaspersky Lab]

Virus.win32.Rootkit [Ikarus]
Backdoor.win32.TDSS [Ikarus]
FakeAlert-SpywareGuard [McAfee]
Packed.win32.Tdss.d [Kaspersky Lab]
Trojan:win32/Alureon.BC [Microsoft]
Trojan:WinNT/Alureon.C [Microsoft]
Virus.win32.Fabot [Ikarus]
Mal/Alureon-B, Mal/FakeAV-S [Sophos]
Mal/Alureon-C, Mal/Alureon-B [Sophos]
Mal/EncPk-GR, Mal/EncPk-GR, Mal/TDSSPack-E [Sophos]
Mal/TDSSPack-A, Mal/EncPk-CZ [Sophos]
Mal/TDSSPack-A, Mal/TDSSPack-E, Troj/Virtum-Gen [Sophos]
Mal/TDSSPack-E, Mal/Alureon-C [Sophos]
Packed.win32.Tdss.h [Kaspersky Lab]
Puper [McAfee]
Trojan.Fakeavalert!sd [PC Tools]
Trojan.win32.Pakes.mjk [Kaspersky Lab]
Trojan:win32/Alureon.BG [Microsoft]
Trojan:win32/Alureon.BJ [Microsoft]
Trojan-Downloader.win32.FakeIA [Ikarus]
Trojan-Downloader.win32.Rugzip [Ikarus]
TrojanDownloader:win32/Renos.gen!AQ [Microsoft]
Backdoor.TDSS!sd [PC Tools]
Backdoor.win32.Inject.mw [Kaspersky Lab]
Backdoor.win32.TDSS.bfr [Kaspersky Lab]
Backdoor.win32.TDSS.bkt [Kaspersky Lab]
Backdoor.win32.TDSS.blc [Ikarus]
Backdoor.win32.TDSS.blc [Kaspersky Lab]
Backdoor.win32.TDSS.fp [Kaspersky Lab]
BraveSentry [McAfee]
DNSChanger.f.gen.b [McAfee]
FakeAlert-AB [McAfee]
FakeAlert-AB.dldr [McAfee]
Gen.Trojan [Ikarus]
Generic Downloader.j [McAfee]
Generic FakeAlert.a [McAfee]
Generic PUP.z [McAfee]
Mal/EncPk-GJ, Mal/EncPk-CZ [Sophos]

Packed.Generic.200 [Symantec] is known to be created as:
%AppData%\microsoft\windows\winlogon.exe
%CommonAppData%\svhost.exe
%ProgramFiles%\malware defender00\malwaredef.exe
%ProgramFiles%\malware defender00\uninstall.exe
%ProgramFiles%\spyware guard00\uninstall.exe
%ProgramFiles%\system guard00\uninstall.exe
%System%\.exe
%System%\blphcdj0erc.scr %System%\dgmoeqh.dll %System%\kdbox.exe
%System%\kddgp.exe
%System%\kdech.exe
%System%\kdeln.exe
%System%\kdenh.exe
%System%\kdfjr.exe
%System%\kdfln.exe
%System%\kdfnh.exe
%System%\kdgfk.exe
%System%\kdgvz.exe
%System%\kdgzy.exe
%System%\kdhsx.exe
%System%\kdidf.exe
%System%\kdiqc.exe
%System%\kdius.exe
%System%\kdjdx.exe
%System%\kdjjk.exe
%System%\kdjlv.exe
%System%\kdjqc.exe
%System%\kdjrf.exe
%System%\kdkxu.exe
%System%\kdlsf.exe
%System%\kdmpu.exe
%System%\kdmsx.exe
%System%\kdozp.exe
%System%\kdpdw.exe
%System%\kdpvv.exe
%System%\kdqrh.exe
%System%\kdrnz.exe
%System%\kdryz.exe
%System%\kdufr.exe
%System%\kduns.exe
%System%\kduzx.exe
%System%\kdvah.exe
%System%\kdwau.exe
%System%\kdwfk.exe
%System%\kdxja.exe
%System%\kdxmc.exe
%System%\kdyim.exe
%System%\kdysv.exe
%System%\kdyvf.exe
%System%\lphcdj0erc.exe
%System%\senekaaelyvfva.dll
%System%\senekabiysufkk.dll
%System%\senekabpqxxnos.dll
%System%\senekadbyuscvn.dll
%System%\senekaelbqfoow.dll
%System%\senekagambcjpe.dll
%System%\senekagvrchxfy.dll
%System%\senekaiylbjlxi.dll
%System%\senekakbkuktqs.dll
%System%\senekakorduymb.dll
%System%\senekalkbevyic.dll
%System%\senekamiqufjpy.dll
%System%\senekapdkswqwe.dll
%System%\senekapkrlnsyt.dll
%System%\senekapxywyksp.dll
%System%\senekasftdcbrq.dll
%System%\senekasvthfger.dll
%System%\senekauetqxtiq.dll
%System%\senekavivximpc.dll
%System%\senekaxeqcxnqv.dll
%System%\senekayxmaeorc.dll
%System%\uacagxvnnqb.dll
%System%\uacpylxbwqj.dll
%System%\wcenter.exe
%System%\winscenter.exe
%Temp%\bootmatrix.exe
%Temp%\file.exe
%Temp%\jah.exe
%Temp%\ma_r.exe
%Temp%\ma_v.exe
%Temp%\setup.exe
c:\resycled\boot.com
c:\resycled\ntldr.com

REMOVAL:
. Download Malwarebytes’ Anti-Malware (mbam-setup.exe) and save it on your Desktop.
. After downloading, double-click on mbam-setup.exe to install the application.
. Follow the prompts and install as “default” only
. Before the installation completes, check on the following prompts:
- Update Malwarebytes’ Anti-Malware
- Launch Malwarebytes’ Anti-Malware

. Click “Finish.” Program will run automatically and you will be prompt to update the program before doing a scan. Please update.
. Scan your computer thoroughly.
. When scanning is finished click on the “Show Results”
. Make sure that all detected threats are marked, click on Remove Selected.
. Restart your computer.

Note: Some malware may prevent mbam-setup.exe from downloading and running. You can download and rename this program from a different computer before running it on infected system

Tags: , , , ,
Posted in 2:Trojan Removal | No Comments »

Remove Trojan Win32 ICR Bot

Friday, July 31st, 2009



Remove w32 Trojan downloader IRC Bot also known as Trojan downloader small, Win32/Hooker, Haxspy, FURootkit and CodBot
Summary
Win32/IRCbot is a large family of backdoor Trojans that targets computers running Microsoft Windows. The Trojan drops other malicious software and opens a backdoor on the infected computer to connect to IRC servers. The Trojan can maintain multiple IRC server connections simultaneously to receive commands from attackers.

Symptoms
There are no readily apparent indications of infection by Win32/IRCbot. The name of the Trojan file copy and corresponding registry settings may differ according to the particular variant of Win32/IRCbot.

Technical Information
Win32/IRCbot takes the following actions:
Creates a copy of itself on the infected computer. The location and name of the dropped file varies. The Trojan also adds a value and data to an autostart registry key such as HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
so that the Trojan runs automatically each time Windows starts. For example, one particular variant of Win32/IRCbot creates a copy of itself at %windir%\mwoffice.exe and adds value “Windows Update Controller” with data “%windir%\mwoffice.exe” to this autostart registry key.
Drops other malicious software, such as variants of:
Win32/Rbot
Win32/Sdbot
TrojanDownloader:Win32/Small
TrojanProxy:Win32/Ranky
TrojanSpy:Win32/Haxspy
Trojan:Win32/Hooker
Worm:Win32/Codbot
WinNT/FURootkit


Opens a backdoor in order to connect to certain IRC servers. The Trojan then joins specified IRC channels to receive attacker commands to perform operations such as the following:
Download and run other malicious software
Release information, such as system information and directory and file listings
Conduct denial of service attacks

Like other Trojans, Win32/IRCbot does not have its own spreading mechanism. It can be distributed in numerous ways, for example, through e-mail attachments, peer-to-peer file-sharing networks, network shares, IRC server channels, or internet file downloads.

Tags: , , ,
Posted in 2:Trojan Removal | No Comments »

Trojan Fiala a worm removal

Friday, July 31st, 2009



W32.Fiala.A is a worm that spreads itself through your removable drives. W32.Fiala.A blocks certain applications from launching, and, as an early birthday gift, W32.Fiala.A may drop Trojans on your PC (think Trojan Horse, Hacktool.Rootkit or Trojan.KillAV).

Thanks, W32.Fiala.A.

Block W32.Fiala.A sites:
wuc8.com
wuc9.com

Get rid of W32.Fiala.A files:
%DriveLetter%\JR.PIF

%DriveLetter%\AUTORUN.INF

%System%\dllcache\linkinfo.dll (a clean file that may already be present)

%System%\mfc1.dll (a legitimate copy of Microsoft’s MSVCR71.dll)

%SystemDrive%\AUTORUN.INF

%SystemDrive%\bps.dll (a copy of Trojan Horse)

%ProgramFiles%\henaji.pif (this file may be detected as Trojan Horse, Hacktool.Rootkit or Trojan.KillAV)

%Windir%\Fonts\bat.sys (this file may be detected as Trojan Horse, Hacktool.Rootkit or Trojan.KillAV)

%Windir%\Fonts\kpsp.sys (this file may be detected as Trojan Horse, Hacktool.Rootkit or Trojan.KillAV)

%Windir%\Fonts\lstis.sys (this file may be detected as Trojan Horse, Hacktool.Rootkit or Trojan.KillAV)

AS21a669aS

Delete W32.Fiala.A registry entries:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RAV.EXE\”debugger” = “%System%\dllcache\spoolsv.exe”

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMon.EXE\”debugger” = “%System%\dllcache\spoolsv.exe”

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMonD.EXE\”debugger” = “%System%\dllcache\spoolsv.exe”

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ravservice.EXE\”debugger” = “%System%\dllcache\spoolsv.exe”

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavStub.EXE\”debugger” = “%System%\dllcache\spoolsv.exe”

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavTask.EXE\”debugger” = “%System%\dllcache\spoolsv.exe”

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IceSword.EXE\”debugger” = “%System%\dllcache\spoolsv.exe”

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Iparmor.EXE\”debugger” = “%System%\dllcache\spoolsv.exe”

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KASARP.EXE\”debugger” = “%System%\dllcache\spoolsv.exe”

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kav32.EXE\”debugger” = “%System%\dllcache\spoolsv.exe”

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVPFW.EXE\”debugger” = “%System%\dllcache\spoolsv.exe”

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kavstart.EXE\”debugger” = “%System%\dllcache\spoolsv.exe”

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\”CheckedValue” = “2?

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360rpt.EXE\”debugger” = “%System%\dllcache\spoolsv.exe”

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360safe.EXE\”debugger” = “%System%\dllcache\spoolsv.exe”

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360safebox.EXE\”debugger” = “%System%\dllcache\spoolsv.exe”

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.EXE\”debugger” = “%System%\dllcache\spoolsv.exe”

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ANTIARP.EXE\”debugger” = “%System%\dllcache\spoolsv.exe”

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ArSwp.EXE\”debugger” = “%System%\dllcache\spoolsv.exe”

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Navapsvc.EXE\”debugger” = “%System%\dllcache\spoolsv.exe”

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32krn.EXE\”debugger” = “%System%\dllcache\spoolsv.exe”

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nod32kui.EXE\”debugger” = “%System%\dllcache\spoolsv.exe”

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PFW.EXE\”debugger” = “%System%\dllcache\spoolsv.exe”

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQDoctor.EXE\”debugger” = “%System%\dllcache\spoolsv.exe”

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kissvc.EXE\”debugger” = “%System%\dllcache\spoolsv.exe”

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kmailmon.EXE\”debugger” = “%System%\dllcache\spoolsv.exe”

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPfwSvc.EXE\”debugger” = “%System%\dllcache\spoolsv.exe”

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KRegEx.EXE\”debugger” = “%System%\dllcache\spoolsv.exe”

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVMonxp.KXP\”debugger” = “%System%\dllcache\spoolsv.exe”

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVSrvXP.EXE\”debugger” = “%System%\dllcache\spoolsv.exe”

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVWSC.EXE\”debugger” = “%System%\dllcache\spoolsv.exe”

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kwatch.EXE\”debugger” = “%System%\dllcache\spoolsv.exe”

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RAVTRAY.EXE\”debugger” = “%System%\dllcache\spoolsv.exe”

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regedit.EXE\”debugger” = “%System%\dllcache\spoolsv.exe”

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwmain.EXE\”debugger” = “%System%\dllcache\spoolsv.exe”

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwProxy.EXE\”debugger” = “%System%\dllcache\spoolsv.exe”

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwsrv.EXE\”debugger” = “%System%\dllcache\spoolsv.exe”

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rfwstub.EXE\”debugger” = “%System%\dllcache\spoolsv.exe”

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ast.EXE\”debugger” = “%System%\dllcache\spoolsv.exe”

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AutoRun.EXE\”debugger” = “%System%\dllcache\spoolsv.exe”

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AutoRunKiller.EXE\”debugger” = “%System%\dllcache\spoolsv.exe”

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AvMonitor.EXE\”debugger” = “%System%\dllcache\spoolsv.exe”

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVP.COM\”debugger” = “%System%\dllcache\spoolsv.exe”

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVP.EXE\”debugger” = “%System%\dllcache\spoolsv.exe”

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CCenter.EXE\”debugger” = “%System%\dllcache\spoolsv.exe”

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Frameworkservice.EXE\”debugger” = “%System%\dllcache\spoolsv.exe”

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GFUpd.EXE\”debugger” = “%System%\dllcache\spoolsv.exe”

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GuardField.EXE\”debugger” = “%System%\dllcache\spoolsv.exe”

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HijackThis.EXE\”debugger” = “%System%\dllcache\spoolsv.exe”

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Mmsk.EXE\”debugger” = “%System%\dllcache\spoolsv.exe”

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RsAgent.EXE\”debugger” = “%System%\dllcache\spoolsv.exe”

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rsaupd.EXE\”debugger” = “%System%\dllcache\spoolsv.exe”

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RsMain.EXE\”debugger” = “%System%\dllcache\spoolsv.exe”

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rsnetsvr.EXE\”debugger” = “%System%\dllcache\spoolsv.exe”

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RSTray.EXE\”debugger” = “%System%\dllcache\spoolsv.exe”

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Runiep.EXE\”debugger” = “%System%\dllcache\spoolsv.exe”

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\safeboxTray.EXE\”debugger” = “%System%\dllcache\spoolsv.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ScanFrm.EXE\”debugger” = “%System%\dllcache\spoolsv.exe”

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SREngLdr.EXE\”debugger” = “%System%\dllcache\spoolsv.exe”

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrojanDetector.EXE\”debugger” = “%System%\dllcache\spoolsv.exe”

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Trojanwall.EXE\”debugger” = “%System%\dllcache\spoolsv.exe”

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrojDie.KXP\”debugger” = “%System%\dllcache\spoolsv.exe”

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VPC32.EXE\”debugger” = “%System%\dllcache\spoolsv.exe”

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VPTRAY.EXE\”debugger” = “%System%\dllcache\spoolsv.exe”

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WOPTILITIES.EXE\”debugger” = “%System%\dllcache\spoolsv.exe”


Tags: , , , ,
Posted in 2:Trojan Removal | No Comments »

« Older Entries