|
|
Malware Tests - removal of the newest malware.
Detect and remove hidden rootkits using
UnHackMe
RegRun Security Suite = 24 system utilities for protecting your computer. Get it! |
 xyyy.exe - Dangerous
Xyyy.exe is Trojan/Backdoor. Kill the process xyyy.exe and remove xyyy.exe from Windows startup. File: xyyy.exe Classification: Antivirus Version Last Update Result Avast 4.8.1335.0 2009.06.07 Win32:Agent-MJK AVG 8.5.0.339 2009.06.07 Downloader.Agent.RXM BitDefender 7.2 2009.06.08 Trojan.Agent.ABRR Comodo 1283 2009.06.08 TrojWare.Win32.TrojanDownloader.Agent.DDL DrWeb 5.0.0.12182 2009.06.08 Win32.Ntldrbot F-Secure 8.0.14470.0 2009.06.08 Trojan-Downloader.Win32.Agent.ddl NOD32 4136 2009.06.07 Win32/TrojanDownloader.Agent.DDL Symantec 1.4.4.12 2009.06.08 Trojan Horse Additional information File size: 28160 bytes MD5 : c42bf7fe10d42044915549a3e30d996a SHA1 : 804ff3c4f8ec50f5a5123832d303ab43e8afa249 Installation When the program is executed, it creates the following registry subkeys and values: ---------------------------------- Keys added:4 ---------------------------------- HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_F1B566AF.SYS HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_F1B566AF.SYS\0000 HKLM\SYSTEM\CurrentControlSet\Services\f1b566af.sys HKLM\SYSTEM\CurrentControlSet\Services\f1b566af.sys\Security ---------------------------------- Values added:13 ---------------------------------- HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_F1B566AF.SYS\0000\Service: "f1b566af.sys" HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_F1B566AF.SYS\0000\Legacy: 0x00000001 HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_F1B566AF.SYS\0000\ConfigFlags: 0x00000000 HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_F1B566AF.SYS\0000\Class: "LegacyDriver" HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_F1B566AF.SYS\0000\ClassGUID: "{8ECC055D-047F-11D1-A537-0000F8753ED1}" HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_F1B566AF.SYS\0000\DeviceDesc: "f1b566af.sys" HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_F1B566AF.SYS\NextInstance: 0x00000001 HKLM\SYSTEM\CurrentControlSet\Services\f1b566af.sys\Security\Security: 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 00 01 02 00 00 00 00 00 05 20 00 00 00 20 02 00 00 00 00 14 00 8D 01 02 00 01 01 00 00 00 00 00 05 0B 00 00 00 00 00 18 00 FD 01 02 00 01 02 00 00 00 00 00 05 20 00 00 00 23 02 00 00 01 01 00 00 00 00 00 05 12 00 00 00 01 01 00 00 00 00 00 05 12 00 00 00 HKLM\SYSTEM\CurrentControlSet\Services\f1b566af.sys\Type: 0x00000001 HKLM\SYSTEM\CurrentControlSet\Services\f1b566af.sys\Start: 0x00000001 HKLM\SYSTEM\CurrentControlSet\Services\f1b566af.sys\ErrorControl: 0x00000000 HKLM\SYSTEM\CurrentControlSet\Services\f1b566af.sys\ImagePath: "\??\C:\WINDOWS\system32\drivers\f1b566af.sys" HKLM\SYSTEM\CurrentControlSet\Services\f1b566af.sys\DisplayName: "f1b566af.sys" ---------------------------------- Values modified:0 ---------------------------------- ---------------------------------- Files added:1 ---------------------------------- C:\WINDOWS\system32\drivers\f1b566af.sys ---------------------------------- Files [attributes?] modified:0 ---------------------------------- ---------------------------------- Folders added:0 ---------------------------------- ---------------------------------- Folders deleted:0 ---------------------------------- ---------------------------------- Total changes:18 ---------------------------------- ------------------------------------------------------------------------------------- Detected by RegRun Reanimator: Item Name: f1b566af.sys Author: Related File: \??\C:\WINDOWS\system32\drivers\f1b566af.sys Type: Services detected by Partizan Removal Results: Success Number of reboot: 1 Recommended software: UnHackMe anti-rootkit and anti-malware http://www.unhackme.com RegRun Security Suite (Good choice for removal and protection) http://www.regrun.com Removal: xyyy.exe is removed by RegRun.
Read more... Removal instructions...
UnHackMe - Rootkit/Malware killer
Also recommended software: UnHackMe is a part of RegRun Security Suite Platinum.
What is hidden in MSDN? Why software developers prefer Win32.FreeTechSecrets.com? All Unix Manuals in Alphabetical Order C# controls for .NET in 3 simple steps. Constantly updated. Last update: November 16 2009
Interesting information about Vista programs... Need consultation? Would you like to add your opinion?
|
|
