|
|
Detect and remove hidden rootkits using
UnHackMe
RegRun Security Suite = 24 system utilities for protecting your computer. Try now! |
 %WinDir%\avguard.exe - Dangerous
It copies itself to %Windir%\Avguard.exe. Deletes the values: Taskmon, Explorer, Windows Services Host, KasperskyAV, from the registry keys: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Some of these registry key values are typically associated with the worms W32.Mydoom.A@mm and W32.Mydoom.B@mm. The W32.Mimail.T@mm worm may add the registry key value "KasperskyAV." Deletes some values from the registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices Such as: System, msgsvr32, DELETE ME, service, Sentry, d3dupdate.exe, au.exe, OLE, gouday.exe etc. Deletes the registry keys: HKEY_CLASSES_ROOT\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InProcServer32 HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\PINF HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\WksPatch Scans the predefined file types on drives C through Z for email addresses: Uses its own SMTP engine to send itself to the email addresses it found above, sending to each address once. The email has the following characteristics: Subject: One of the predefined list. For ex: Re: Your website Body: (One of the following) Your file is attached. Please read the attached file. Please have a look at the attached file. See the attached file for details. Here is the file. Your document is attached. Attachment: One of the predefined list. For ex: Re: mp3music.pif Manual removal: Navigate to the key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run and delete the value: "Special Firewall Service" = %WinDir%\avguard.exe -av service Removal: %WinDir%\avguard.exe is removed by RegRun.
Read more... Removal instructions...
Recommended software: RegRun Security Suite - removal and protection. http://www.regrun.com RegRun Reanimator - free removal tool. greatis.com/reanimator
What is hidden in MSDN? Why software developers prefer Win32.FreeTechSecrets.com? All Unix Manuals in Alphabetical Order C# controls for .NET in 3 simple steps. Constantly updated. Last update: June 30 2008
Interesting information about Vista programs... Need consultation? Would you like to add your opinion?
|
|
