|
Startupapps.com recommends you:
Detect and remove hidden rootkits using
UnHackMe
Free fully functional 30-days trial.
RegRun Security Suite = 24 system utilities for protecting your computer.
Try now!
I would like to say that RegRun has helped me on more than 1 occasion
when it comes to spyware/adware by letting me know automatically that a piece of it
got added to Windows startup. There is so much spyware/addware out
there today it's hard to imagine being without RegRun. I like many
other features too including the daily registry backups and file
protection.
Chris Wagers
|
|
 FirewallSvr.exe - Dangerous
firewallsvr.exe
W32.Netsky.Y@mm is a variant of W32.Netsky.X@mm that scans for the email addresses on all non-CD-ROM drives on an infected computer.
Also Known As: W32/Netsky.y@MM [McAfee], WORM_NETSKY.Y [Trend], Win32.Netsky.Y [Computer Associates], W32/Netsky-X [Sophos]
Copies itself as %Windir%\FirewallSvr.exe.
Adds the value: "FirewallSvr"="%Windir%\FirewallSvr.exe"
to the registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Listens on TCP port 82 for an attacker to send an executable file, and then run it.
If the system date is between April 28, 2004 and April 30, 2004,
the worm will attempt to perform Denial of Service (DoS) attack against the following Web sites: www.nibis.de; www.medinfo.ufl.edu; www.educa.ch
Then, the worm uses its own SMTP engine to send itself to the email addresses that it finds.
The email has the following characteristics:
From: (spoofed)
Subject: Delivery failure notice (ID-)
Message:
--- Mail Part Delivered ---
220 Welcome to
Mail type: multipart/related
--- text/html RFC 2504
MX [Mail Exchanger] mx.mt2.kl.
Exim Status OK.
message is available.
where may be one of:
New
Partial
External
Delivered
Attachment: www...session-.com
Manual removal:
Navigate to the key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
and delete the value: "FirewallSvr"="%Windir%\FirewallSvr.exe"
Removal: FirewallSvr.exe is removed by RegRun.
Read more... Removal instructions...
Recommended software:
UnHackMe - easy removal Rootkits/Adware/Spyware.
http://www.unhackme.com
RegRun Security Suite - removal and protection.
http://www.regrun.com
RegRun Reanimator - free removal tool.
greatis.com/reanimator
RegRun - User's Choice
Vista Programs - full info...
What is hidden in MSDN?
.NET Secrets Revealed
Why software developers prefer Win32.FreeTechSecrets.com?
All Unix Manuals in Alphabetical Order
C# controls for .NET in 3 simple steps.
Constantly updated. Last update:
May 12 2008
Interesting information about Vista programs...
Need consultation?
Would you like to add your opinion?
|
|
- Quick Links
-
What's new?
RSS Feed
Add to AppDatabase
Ask Experts
Join forum
Links
- Articles
-
Virus or not? SPTD####.sys
What is mc21.tmp, mc22.tmp, mc23.tmp?
- Select
-
Necessary
Useless
At your option
Dangerous
|
