|
|
Malware Tests - removal of the newest malware.
Detect and remove hidden rootkits using
UnHackMe
RegRun Security Suite = 24 system utilities for protecting your computer. Get it! |
 10204374.exe - Dangerous
10204374.exe is Trojan/Backdoor. Kill the process 10204374.exe and remove 10204374.exe from Windows startup. File: c:\sand-box\install.exe Classification: Code: Antivirus Version Last Update Result a-squared 4.5.0.18 2009.06.19 Trojan.Win32.Winwebsec!IK AntiVir 7.9.0.191 2009.06.19 TR/Dropper.Gen F-Secure 8.0.14470.0 2009.06.18 - Ikarus T3.1.1.59.0 2009.06.19 Trojan.Win32.Winwebsec Kaspersky 7.0.0.125 2009.06.19 - Microsoft 1.4701 2009.06.19 VirTool:Win32/Obfuscator.FR Symantec 1.4.4.12 2009.06.19 Packed.Generic.234 VirusBuster 4.6.5.0 2009.06.18 Trojan.Fraudload.Gen!Pac.3 Additional information File size: 467248 bytes MD5...: e94e01650256cf41174ac56ea3c3fa57 SHA1..: f350421e5046bb1eeb5af2c139285481cb737678 Installation When the program is executed, it creates the following registry subkeys and values: ---------------------------------- Keys deleted:1 ---------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\ShellNew ---------------------------------- Keys added:2 ---------------------------------- HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SystemSecurity2009 HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Extensions ---------------------------------- Values deleted:2 ---------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\ShellNew\~reserved~: 18 00 00 00 01 00 01 00 D9 07 05 00 04 00 1C 00 09 00 30 00 26 00 B8 03 HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\ShellNew\Language: 0x00000409 ---------------------------------- Values added:9 ---------------------------------- HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\install: "C:\sand-box\install.exe" HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\10204374: "C:\Documents and Settings\All Users\Application Data\10204374\10204374.exe" HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SystemSecurity2009\DisplayName: "SystemSecurity2009" HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SystemSecurity2009\ShortcutPath: "C:\Documents and Settings\Administrator\Start Menu\Programs\System Security\\System Security" HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SystemSecurity2009\UninstallString: "C:\Documents and Settings\Administrator\Start Menu\Programs\System Security\\System Security" HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SystemSecurity2009\DisplayIcon: "C:\Documents and Settings\All Users\Application Data\10204374\10204374.exe,0" HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Extensions\.ini: "notepad.exe ^.ini" HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Extensions\.txt: "notepad.exe ^.txt" HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Extensions\.wtx: "notepad.exe ^.wtx" ---------------------------------- Values modified:0 ---------------------------------- ---------------------------------- Files added:4 ---------------------------------- C:\Documents and Settings\Administrator\Desktop\System Security 2009.lnk C:\Documents and Settings\Administrator\Start Menu\Programs\System Security\System Security C:\Documents and Settings\All Users\Application Data\10204374\10204374.exe C:\Documents and Settings\All Users\Application Data\10204374\10204374.glu ---------------------------------- Files [attributes?] modified:0 ---------------------------------- ---------------------------------- Folders added:2 ---------------------------------- C:\Documents and Settings\Administrator\Start Menu\Programs\System Security C:\Documents and Settings\All Users\Application Data\10204374 ---------------------------------- Folders deleted:0 ---------------------------------- ---------------------------------- Total changes:20 ---------------------------------- ------------------------------------------------------------------------------------- Detected by RegRun Reanimator: Type: Registry Run Is it serious? The program is unknown. Probably it is legitimate. Author: Microsoft Corporation Item Name: install Related File: C:\sand-box\install.exe Type: Registry Run Is it serious? The program is unknown. Probably it is legitimate. Author: Microsoft Corporation Item Name: 10204374 Related File: C:\Documents and Settings\All Users\Application Data\10204374\10204374.exe Removal Results: Success Number of reboot: 1 Recommended software: UnHackMe anti-rootkit and anti-malware http://www.unhackme.com RegRun Security Suite (Good choice for removal and protection) http://www.regrun.com Removal: 10204374.exe is removed by RegRun.
Click on the "Get it out!" button.  We suggest you to reboot your computer to be sure that your computer is clean now. Do not hesitate to contact us: Support center
UnHackMe - Rootkit/Malware killer
Also recommended software: UnHackMe is a part of RegRun Security Suite Platinum.
What is hidden in MSDN? Why software developers prefer Win32.FreeTechSecrets.com? All Unix Manuals in Alphabetical Order C# controls for .NET in 3 simple steps. Constantly updated. Last update: November 16 2009
Interesting information about Vista programs... Need consultation? Would you like to add your opinion?
|
|
Download RegRun Suite. 
Open an executable file to start program installation.
