|
|
Malware Tests - removal of the newest malware.
Detect and remove hidden rootkits using
UnHackMe
RegRun Security Suite = 24 system utilities for protecting your computer. Get it! |
 aa29.exe - Dangerous
Aa29.exe is Trojan/Backdoor. Kill the process aa29.exe and remove aa29.exe from Windows startup. Classification: Antivirus Version Last Update Result Avast 4.8.1335.0 2009.06.11 Win32:Agent-ACMH AVG 8.5.0.339 2009.06.11 PSW.OnlineGames3.FWC BitDefender 7.2 2009.06.12 Generic.Onlinegames.14. 8CB1D663 DrWeb 5.0.0.12182 2009.06.12 Trojan.PWS.Wsgame.12056 F-Secure 8.0.14470.0 2009.06.12 Trojan-GameThief.Win32.Magania.bfrp NOD32 4149 2009.06.11 probably a variant of Win32/PSW.OnLineGames.NRD Symantec 1.4.4.12 2009.06.12 Infostealer.Gampass Additional information File size: 24192 bytes MD5 : ed2f3e779672d8e96e032a412b49e298 SHA1 : d71d8f54c39ebc2bb8081e49c1ed992308795bb8 Installation When the program is executed, it creates the following registry subkeys and values: ---------------------------------- Keys added:2 ---------------------------------- HKLM\SOFTWARE\Classes\CLSID\{4679E74B-E5EE-458F-B613-2324AA1C817E} HKLM\SOFTWARE\Classes\CLSID\{4679E74B-E5EE-458F-B613-2324AA1C817E}\InprocServer32 ---------------------------------- Values added:3 ---------------------------------- HKLM\SOFTWARE\Classes\CLSID\{4679E74B-E5EE-458F-B613-2324AA1C817E}\InprocServer32\: "C:\WINDOWS\system32\mR7Sg4vSx5TR.dll" HKLM\SOFTWARE\Classes\CLSID\{4679E74B-E5EE-458F-B613-2324AA1C817E}\InprocServer32\ThreadingModel: "Apartment" HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{4679E74B-E5EE-458F-B613-2324AA1C817E}: "" ---------------------------------- Values modified:0 ---------------------------------- ---------------------------------- Files deleted:2 ---------------------------------- C:\sand-box\aa29.exe C:\WINDOWS\system32\verclsid.exe ---------------------------------- Files [attributes?] modified:0 ---------------------------------- ---------------------------------- Folders added:0 ---------------------------------- ---------------------------------- Folders deleted:0 ---------------------------------- ---------------------------------- Total changes:7 ---------------------------------- ------------------------------------------------------------------------------------- Detected by RegRun Reanimator: Type: Shell Execute Hooks Item Name: 4679E74B-E5EE-458F-B613-2324AA1C817E Related File: C:\WINDOWS\system32\mR7Sg4vSx5TR.dll Removal Results: Success Number of reboot: 1 Removal: aa29.exe is removed by RegRun.
Read more... Removal instructions...
UnHackMe - Rootkit/Malware killer
Also recommended software: UnHackMe is a part of RegRun Security Suite Platinum.
What is hidden in MSDN? Why software developers prefer Win32.FreeTechSecrets.com? All Unix Manuals in Alphabetical Order C# controls for .NET in 3 simple steps. Constantly updated. Last update: November 16 2009
Interesting information about Vista programs... Need consultation? Would you like to add your opinion?
|
|
