Removed: asectool.exe, scan.dll (FakeAV – Advanced Security Tool 2010)

Malware: a32.exe

Removed: C:\Documents and Settings\Administrator\Application Data\asectool.exe
C:\Documents and Settings\Administrator\Application Data\scan.dll

—————————————————————————————————————————-
Detected by UnHackMe:

Item Name: {80c10400-59cb-4c79-97ce-cc693103afca}
Author: Microsoft Corporation
Related File: C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\APPLICATION DATA\SCAN.DLL
Type: Browser Helper Objects

Item Name: shell
Author: Unknown
Related File: “C:\Documents and Settings\Administrator\Application Data\asectool.exe” /sn
Type: User Shell

Item Name: AdvSecTool
Author: Unknown
Related File: C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\APPLICATION DATA\ASECTOOL.EXE
Type: Registry Run

Item Name: asectool.exe
Author: Unknown
Related File: C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\APPLICATION DATA\ASECTOOL.EXE
Type: Running Processes

After first reboot detected by UnHackMe:

Removal Results: Success
Number of reboot: 1

—————————————————————————————————————————-
How to quickly detect malware presence?

Registry: HKLM\Software\Classes\CLSID\{80c10400-59cb-4c79-97ce-cc693103afca}\InprocServer32\
Value: “C:\Documents and Settings\Administrator\Application Data\scan.dll”

Registry: HKLM\Software\Classes\TypeLib\{58B4E0F5-F122-4C02-B038-C482D998486A}\1.0\0\win32\
Value: “C:\Documents and Settings\Administrator\Application Data\scan.dll”

Registry: HKCU\Software\Microsoft\Windows\CurrentVersion\Run\AdvSecTool
Value: “”C:\Documents and Settings\Administrator\Application Data\asectool.exe”"

Registry: HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell
Value: “”C:\Documents and Settings\Administrator\Application Data\asectool.exe” /sn”

Files:
C:\Documents and Settings\Administrator\Application Data\1tmp.bat
C:\Documents and Settings\Administrator\Application Data\asectool.exe
C:\Documents and Settings\Administrator\Application Data\scan.dll
C:\Documents and Settings\Administrator\Application Data\secmof.tmp
C:\Documents and Settings\Administrator\Desktop\Advanced Security Tool 2010.LNK
C:\Documents and Settings\Administrator\Start Menu\Advanced Security Tool 2010.LNK

—————————————————————————————————————————-

Antivirus	Version	Last Update	Result
F-Secure	9.0.15370.0	2010.08.29	Trojan.Generic.KD.29071
Kaspersky	7.0.0.125	2010.08.29	Trojan.Win32.FakeAV.dum
NOD32	5407	2010.08.29	a variant of Win32/Kryptik.GJY

—————————————————————————————————————————-
Additional information
MD5 : f1af0c9e3c6be3bc77d1e9de3bcd5914
SHA1 : ef66384faa535809c515117855440f129bfd1882
SHA256: 76e7d2139b02cd30da3757437ebca74fdebdf8883b93f892f642a7e8b2192f3b
—————————————————————————————————————————-
Installation
When the program is executed, it creates the following registry subkeys and values:

———————————-
Keys added:28
———————————-
HKLM\Software\Classes\CLSID\{80c10400-59cb-4c79-97ce-cc693103afca}
HKLM\Software\Classes\CLSID\{80c10400-59cb-4c79-97ce-cc693103afca}\InprocServer32
HKLM\Software\Classes\CLSID\{80c10400-59cb-4c79-97ce-cc693103afca}\ProgID
HKLM\Software\Classes\CLSID\{80c10400-59cb-4c79-97ce-cc693103afca}\Programmable
HKLM\Software\Classes\CLSID\{80c10400-59cb-4c79-97ce-cc693103afca}\TypeLib
HKLM\Software\Classes\CLSID\{80c10400-59cb-4c79-97ce-cc693103afca}\VersionIndependentProgID
HKLM\Software\Classes\Interface\{4B66E1DF-4DE3-4CDA-83B5-11673EADAB0B}
HKLM\Software\Classes\Interface\{4B66E1DF-4DE3-4CDA-83B5-11673EADAB0B}\ProxyStubClsid
HKLM\Software\Classes\Interface\{4B66E1DF-4DE3-4CDA-83B5-11673EADAB0B}\ProxyStubClsid32
HKLM\Software\Classes\Interface\{4B66E1DF-4DE3-4CDA-83B5-11673EADAB0B}\TypeLib
HKLM\Software\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}
HKLM\Software\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}\ProxyStubClsid
HKLM\Software\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}\ProxyStubClsid32
HKLM\Software\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}\TypeLib
HKLM\Software\Classes\TypeLib\{58B4E0F5-F122-4C02-B038-C482D998486A}
HKLM\Software\Classes\TypeLib\{58B4E0F5-F122-4C02-B038-C482D998486A}\1.0
HKLM\Software\Classes\TypeLib\{58B4E0F5-F122-4C02-B038-C482D998486A}\1.0\0
HKLM\Software\Classes\TypeLib\{58B4E0F5-F122-4C02-B038-C482D998486A}\1.0\0\win32
HKLM\Software\Classes\TypeLib\{58B4E0F5-F122-4C02-B038-C482D998486A}\1.0\FLAGS
HKLM\Software\Classes\TypeLib\{58B4E0F5-F122-4C02-B038-C482D998486A}\1.0\HELPDIR
HKLM\Software\Classes\BrcWizApp.BrcWiz
HKLM\Software\Classes\BrcWizApp.BrcWiz\CLSID
HKLM\Software\Classes\BrcWizApp.BrcWiz\CurVer
HKLM\Software\Classes\BrcWizApp.BrcWiz.1
HKLM\Software\Classes\BrcWizApp.BrcWiz.1\CLSID
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{80c10400-59cb-4c79-97ce-cc693103afca}
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Associations
HKCU\Software\Advanced Security

———————————-
Values added:34
———————————-
HKLM\Software\Classes\CLSID\{80c10400-59cb-4c79-97ce-cc693103afca}\VersionIndependentProgID\: “BrcWizApp.WinInet”
HKLM\Software\Classes\CLSID\{80c10400-59cb-4c79-97ce-cc693103afca}\TypeLib\: “{58b4e0f5-f122-4c02-b038-c482d998486a}”
HKLM\Software\Classes\CLSID\{80c10400-59cb-4c79-97ce-cc693103afca}\ProgID\: “BrcWizApp.BrcWiz.1″
HKLM\Software\Classes\CLSID\{80c10400-59cb-4c79-97ce-cc693103afca}\InprocServer32\: “C:\Documents and Settings\Administrator\Application Data\scan.dll”
HKLM\Software\Classes\CLSID\{80c10400-59cb-4c79-97ce-cc693103afca}\InprocServer32\ThreadingModel: “Apartment”
HKLM\Software\Classes\CLSID\{80c10400-59cb-4c79-97ce-cc693103afca}\: “BrcWiz Class”
HKLM\Software\Classes\Interface\{4B66E1DF-4DE3-4CDA-83B5-11673EADAB0B}\TypeLib\: “{58B4E0F5-F122-4C02-B038-C482D998486A}”
HKLM\Software\Classes\Interface\{4B66E1DF-4DE3-4CDA-83B5-11673EADAB0B}\TypeLib\Version: “1.0″
HKLM\Software\Classes\Interface\{4B66E1DF-4DE3-4CDA-83B5-11673EADAB0B}\ProxyStubClsid32\: “{00020420-0000-0000-C000-000000000046}”
HKLM\Software\Classes\Interface\{4B66E1DF-4DE3-4CDA-83B5-11673EADAB0B}\ProxyStubClsid\: “{00020420-0000-0000-C000-000000000046}”
HKLM\Software\Classes\Interface\{4B66E1DF-4DE3-4CDA-83B5-11673EADAB0B}\: “_IBhoAppEvents”
HKLM\Software\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}\TypeLib\: “{58B4E0F5-F122-4C02-B038-C482D998486A}”
HKLM\Software\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}\TypeLib\Version: “1.0″
HKLM\Software\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}\ProxyStubClsid32\: “{00020424-0000-0000-C000-000000000046}”
HKLM\Software\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}\ProxyStubClsid\: “{00020424-0000-0000-C000-000000000046}”
HKLM\Software\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}\: “IBhoApp”
HKLM\Software\Classes\TypeLib\{58B4E0F5-F122-4C02-B038-C482D998486A}\1.0\0\win32\: “C:\Documents and Settings\Administrator\Application Data\scan.dll”
HKLM\Software\Classes\TypeLib\{58B4E0F5-F122-4C02-B038-C482D998486A}\1.0\HELPDIR\: “C:\Documents and Settings\Administrator\Application Data\”
HKLM\Software\Classes\TypeLib\{58B4E0F5-F122-4C02-B038-C482D998486A}\1.0\FLAGS\: “0″
HKLM\Software\Classes\TypeLib\{58B4E0F5-F122-4C02-B038-C482D998486A}\1.0\: “WinInet 1.0 Type Library”
HKLM\Software\Classes\BrcWizApp.BrcWiz\CurVer\: “WinInetApp.BrcWiz.1″
HKLM\Software\Classes\BrcWizApp.BrcWiz\CLSID\: “{80c10400-59cb-4c79-97ce-cc693103afca}”
HKLM\Software\Classes\BrcWizApp.BrcWiz\: “BrcWiz Class”
HKLM\Software\Classes\BrcWizApp.BrcWiz.1\CLSID\: “{80c10400-59cb-4c79-97ce-cc693103afca}”
HKLM\Software\Classes\BrcWizApp.BrcWiz.1\: “BrcWiz Class”
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{80c10400-59cb-4c79-97ce-cc693103afca}\NoExplorer: 0×00000001
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Associations\LowRiskFileTypes: “”.exe;”"
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\AdvSecTool: “”C:\Documents and Settings\Administrator\Application Data\asectool.exe”"
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell: “”C:\Documents and Settings\Administrator\Application Data\asectool.exe” /sn”
HKCU\Software\Advanced Security\fstart: “0″
HKCU\Software\Advanced Security\UpdateDate: “20-08-2010″
HKCU\Software\Advanced Security\Minimize: “0″
HKCU\Software\Advanced Security\Autorun: “1″
HKCU\Software\Advanced Security\Scan: “1″

———————————-
Values modified:2
———————————-
(-) HKLM\Software\Microsoft\Security Center\AntiVirusDisableNotify: 0×00000001
(+) HKLM\Software\Microsoft\Security Center\AntiVirusDisableNotify: 0×00000000
(-) HKCU\Software\Microsoft\Windows\CurrentVersion\Controls Folder\Presentation Cache: 10 01 00 /…/ 00 00 00
(+) HKCU\Software\Microsoft\Windows\CurrentVersion\Controls Folder\Presentation Cache: 10 01 00 /…/ 00 00 00

———————————-
Files added:6
———————————-
C:\Documents and Settings\Administrator\Application Data\1tmp.bat
C:\Documents and Settings\Administrator\Application Data\asectool.exe
C:\Documents and Settings\Administrator\Application Data\scan.dll
C:\Documents and Settings\Administrator\Application Data\secmof.tmp
C:\Documents and Settings\Administrator\Desktop\Advanced Security Tool 2010.LNK
C:\Documents and Settings\Administrator\Start Menu\Advanced Security Tool 2010.LNK

———————————-
Files [attributes?] modified:1
———————————-
C:\Documents and Settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

———————————-
Total changes:71
———————————-

—————————————————————————————————————————-
Recommended software:
UnHackMe anti-rootkit and anti-malware
http://www.unhackme.com
RegRun Security Suite (Good choice for removal and protection)
http://www.regrun.com

Comments

• Greatis Software

  • Free Download
  • Send a file

• AverScanner

  AverScaner- EveryDay Malware Scan

• Testimonials

  People say

  Greg

  I spent over 10 hours trying to manually hunt down and remove a rootkit and browser hijacker from my computer. That was a mistake!

  This virus/malware could not be removed by Norton, ZoneLabs, MS Essentials; etc.

  In about 1 hour, I was able to download your software, create the CD-ROM, watch the instruction video and kill 3 ROOKITS from my PC. (Your software hunted down the rootkits and killed them like Spetsnaz going after the enemy!) Get it!

  Joseph

  Your product is the only one on the market that has found and removed rootkits from my system, three rootkits to be precise. I have used other products but they don't measure up to UnHackMe.

  Bob

  The UnHackMe is a real program, no spyware or phish and works great and is easy to use. Enjoy!

  Click Here to Update All your PC's Outdated drivers

• Categories

  • Adware
  • Backdoor
  • Fake Driver-Codec
  • Fake System Tool
  • FakeAV
  • Malware
  • Malware Domain
  • Not-a-Virus
  • Ransomware
  • Rootkit
  • Troyan]>
  • unknown
  • Virus
  • Worm

• Recent Posts

  • OMEGLEVIDSCHECK.EXE is Trojan Agent
  • AFTER.EXE is Trojan Bocinex
  • LIB32WAOQ.EXE is Trojan MSIL.Prash
  • MMIOA5QV0P.EXE is Worm Ainslot
  • MSIZPJ32.DLL is Trojan Downloader6
  • 50DE5TEEYX.EXE is Trojan Cutwail
  • KLLKCH4.EXE is Trojan Agent
  • JL8ZG6FX1U.EXE is Trojan Agent
  • LIB32WAOQ.EXE is Backdoor Advo
  • BIN.EXE is Rootkit SpyEye

• 
• Remember: the best way to remove rootkits is from the outside!

  

• Blogroll

  • RegRun Security Suite. Detects and removes rootkits/malware/adware that your antivirus could not.
  • RegRun Warrior – Removing rootkits is best done from the outside!
  • UnHackMe – rootkit & malware killer

• Popular

  1. 2% X11.EXE is Trojan Buzus
  2. 1% CSDRIVE32.EXE is Worm Kolab
  3. 1% BSI.BUND.EXE is Trojan Ransom
  4. 1%COMPLITLY.DLL
  5. 1% L3YG2H61AY.EXE is Trojan Wigon
  6. 1% IMDCSC.EXE is Trojan CDur
  7. 1% WAJAM.DLL is Trojan xPack
  8. 1% OSJK8S.EXE is Virus Virut
  9. 1%MSDCSC.EXE is Trojan Agent
  10. 1% WINCSA.EXE is Trojan Jorik.IRCbo
  11. 1% SANDRA.DLL is Trojan Sirefef.BV
  12. 1% LSMASS.EXE is Trojan Dapato
  13. 1% NETWORKTOOLHELPER.DLL is Worm Aspxor
  14. 1% ANTIWPA.DLL is Not-a-Virus HackTool.Wpakill
  15. 1% WWMY7SHQ7D.EXE is Trojan Downloader
  16. 1% WINRAR PASSWORD UNLOCKER 2012 1.8V.EXE
  17. 1%MSDCSC.EXE is Trojan Fynloski
  18. 1% MSDUBMNA.SCR is Backdoor Andromeda
  19. 1% FACEBOAX 2.0.3.EXE is Backdoor Poison
  20. 1% PRIAM_BHO.DLL is Adware Wajam

• Tags

  3308c706 Adware Agent Ainslot ATAPI.SYS AutoRun autorun.inf Backdoor Bancos Banker Banload BHO Bifrose Buzus Darkbot Delf Fake AntiVirus FakeAV Farfli Injector IRCBot Jorik KeyLogger Kraddare lsass.exe Malware Domain Oficla OnLineGames Palevo Rebhip Rootkit Scar services.exe SpyEye svchost.exe Taterf TDSS Trojan VB VBKrypt Virus Votwup winlogon.exe Worm ZeroAccess