|
|
Malware Tests - removal of the newest malware.
Detect and remove hidden rootkits using
UnHackMe
RegRun Security Suite = 24 system utilities for protecting your computer. Get it! |
 rbadmm.dll - Dangerous
Rbadmm.dll is Trojan/Backdoor. Kill the file rbadmm.dll and remove rbadmm.dll from Windows startup. File: load.php.exe Classification: Antivirus Version Last Update Result Avast 4.8.1335.0 2009.06.25 - AVG 8.5.0.339 2009.06.25 SHeur2.AMZH Comodo 1419 2009.06.25 - DrWeb 5.0.0.12182 2009.06.25 - F-Secure 8.0.14470.0 2009.06.25 - Kaspersky 7.0.0.125 2009.06.25 - Microsoft 1.4803 2009.06.25 - NOD32 4189 2009.06.25 - Symantec 1.4.4.12 2009.06.25 - Additional information File size: 52224 bytes MD5 : 17fc78114bb7d62806f8adcb61652a62 SHA1 : e4d8938b4c8fffc0d5773cf4748ab20174e79fb0 Installation When the program is executed, it creates the following registry subkeys and values: ---------------------------------- Keys deleted:3 ---------------------------------- HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{e2e2dd38-d088-4134-82b7-f2ba38496583} HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} ---------------------------------- Keys added:7 ---------------------------------- HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\rbadmm HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\rbadma.sys HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\rbadma.sys HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_RBADMA HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_RBADMA\0000 HKLM\SYSTEM\CurrentControlSet\Services\rbadma HKLM\SYSTEM\CurrentControlSet\Services\rbadma\Security ---------------------------------- Values deleted:4 ---------------------------------- HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{e2e2dd38-d088-4134-82b7-f2ba38496583}\CLSID: "{1FBA04EE-3024-11d2-8F1F-0000F87ABD16}" HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{e2e2dd38-d088-4134-82b7-f2ba38496583}\MenuText: "@xpsp3res.dll,-20001" HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{e2e2dd38-d088-4134-82b7-f2ba38496583}\Exec: "%windir%\Network Diagnostic\xpnetdiag.exe" HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\NoExplorer: 0x00000001 ---------------------------------- Values added:23 ---------------------------------- HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\rbadmm\DllName: 72 62 61 64 6D 6D 2E 64 6C 6C 00 00 HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\rbadmm\Startup: 72 62 61 64 6D 6D 00 53 74 HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\rbadmm\Impersonate: 0x00000001 HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\rbadmm\Asynchronous: 0x00000001 HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\rbadmm\MaxWait: 0x00000001 HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\rbadmm\nuag: 47 80 F4 83 1E 01 D2 0F 83 47 80 F4 00 00 00 00 00 00 00 00 HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\rbadma.sys\: "Driver" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\rbadma.sys\: "Driver" HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_RBADMA\0000\Service: "rbadma" HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_RBADMA\0000\Legacy: 0x00000001 HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_RBADMA\0000\ConfigFlags: 0x00000000 HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_RBADMA\0000\Class: "LegacyDriver" HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_RBADMA\0000\ClassGUID: "{8ECC055D-047F-11D1-A537-0000F8753ED1}" HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_RBADMA\0000\DeviceDesc: "RAMDAC GPU Controller" HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_RBADMA\NextInstance: 0x00000001 HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\: "C:\WINDOWS\system32\rundll32.exe:*:Enabled:rundll32" HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\WINDOWS\system32\rundll32.exe: "C:\WINDOWS\system32\rundll32.exe:*:Enabled:Run a DLL as an App" HKLM\SYSTEM\CurrentControlSet\Services\rbadma\Security\Security: 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 00 01 02 00 00 00 00 00 05 20 00 00 00 20 02 00 00 00 00 14 00 8D 01 02 00 01 01 00 00 00 00 00 05 0B 00 00 00 00 00 18 00 FD 01 02 00 01 02 00 00 00 00 00 05 20 00 00 00 23 02 00 00 01 01 00 00 00 00 00 05 12 00 00 00 01 01 00 00 00 00 00 05 12 00 00 00 HKLM\SYSTEM\CurrentControlSet\Services\rbadma\Type: 0x00000001 HKLM\SYSTEM\CurrentControlSet\Services\rbadma\Start: 0x00000001 HKLM\SYSTEM\CurrentControlSet\Services\rbadma\ErrorControl: 0x00000000 HKLM\SYSTEM\CurrentControlSet\Services\rbadma\ImagePath: "system32\rbadma.sys" HKLM\SYSTEM\CurrentControlSet\Services\rbadma\DisplayName: "RAMDAC GPU Controller" ---------------------------------- Values modified:2 ---------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Persistent: 0x00000001 HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Persistent: 0x00000000 ---------------------------------- Files added:4 ---------------------------------- C:\WINDOWS\system32\a99k.bin C:\WINDOWS\system32\hrpdcf.bin C:\WINDOWS\system32\rbadma.sys C:\WINDOWS\system32\rbadmm.dll ---------------------------------- Files deleted:1 ---------------------------------- C:\sand-box\load.php.exe ---------------------------------- Files [attributes?] modified:5 ---------------------------------- C:\WINDOWS\Prefetch\CMD.EXE-087B4001.pf C:\WINDOWS\Prefetch\LOGONUI.EXE-0AF22957.pf C:\WINDOWS\Prefetch\NTOSBOOT-B00DFAAD.pf C:\WINDOWS\Prefetch\WUAUCLT.EXE-399A8E72.pf C:\WINDOWS\system32\wbem\Logs\wmiprov.log ---------------------------------- Folders added:2 ---------------------------------- C:\Documents and Settings\Administrator\Local Settings\Temp\i_setup C:\WINDOWS\Temp\i_setup ---------------------------------- Folders deleted:0 ---------------------------------- ---------------------------------- Total changes:51 ---------------------------------- ------------------------------------------------------------------------------------- Detected by RegRun Reanimator: Item Name: rbadmm Author: Related File: rbadmm.dll Type: Winlogon Notification After first reboot detected by RegRun Reanimator: Item Name: rbadma Author: Related File: system32\rbadma.sys Type: Services detected by Partizan Removal Results: Success Number of reboot: 2 ------------------------------------------------------------------------------------- Recommended software: UnHackMe anti-rootkit and anti-malware http://www.unhackme.com RegRun Security Suite (Good choice for removal and protection) http://www.regrun.com Removal: rbadmm.dll is removed by RegRun.
Click on the "Get it out!" button.  We suggest you to reboot your computer to be sure that your computer is clean now. Do not hesitate to contact us: Support center
UnHackMe - Rootkit/Malware killer
Also recommended software: UnHackMe is a part of RegRun Security Suite Platinum.
What is hidden in MSDN? Why software developers prefer Win32.FreeTechSecrets.com? All Unix Manuals in Alphabetical Order C# controls for .NET in 3 simple steps. Constantly updated. Last update: November 16 2009
Interesting information about Vista programs... Need consultation? Would you like to add your opinion?
|
|
Download RegRun Suite. 
Open an executable file to start program installation.
