Removed: C:\WINDOWS\system32\msapps\comsrvr.exe (trojan Heur)
Malware: bro.jpg
Removed: C:\WINDOWS\system32\msapps\comsrvr.exe
—————————————————————————————————————————-
Detected by UnHackMe:
Item Name: COMServer
Author: dncmc
Related File: “C:\WINDOWS\system32\msapps\comsrvr.exe” s
Type: Auto Services
Item Name: comsrvr.exe
Author:
Related File: C:\WINDOWS\SYSTEM32\MSAPPS\COMSRVR.EXE
Type: Running Processes
Removal Results: Success
Number of reboot: 1
—————————————————————————————————————————-
How to quickly detect malware presence?
Registry: HKLM\System\CurrentControlSet\Services\COMServer\ImagePath
Value: “”C:\WINDOWS\system32\msapps\comsrvr.exe” s”
Folders: C:\WINDOWS\system32\msapps\
Files: C:\WINDOWS\system32\msapps\comsrvr.exe
—————————————————————————————————————————-
| Antivirus | Version | Last Update | Result |
|---|---|---|---|
| F-Secure | 9.0.15370.0 | 2010.09.02 | Gen:Trojan.Heur.RP.cuW@aCMG7dei |
| Kaspersky | 7.0.0.125 | 2010.09.02 | Trojan-Dropper.Win32.Agent.cwsh |
| Microsoft | 1.6103 | 2010.09.02 | - |
| NOD32 | 5419 | 2010.09.02 | - |
—————————————————————————————————————————-
Additional information
MD5 : 40851dc7e311d481efbe84dc6db3c6e4
SHA1 : 0942619127173ba5ebc960afe94e7d5f6e3ddcd8
SHA256: 40dfd9a454a90efb56542ce4d45c2d036c1c9d7be67810d5bcb446fdedf2d7d3
—————————————————————————————————————————-
Installation
When the program is executed, it creates the following registry subkeys and values:
———————————-
Keys added:4
———————————-
HKLM\System\CurrentControlSet\Enum\Root\LEGACY_COMSERVER
HKLM\System\CurrentControlSet\Enum\Root\LEGACY_COMSERVER\0000
HKLM\System\CurrentControlSet\Services\COMServer
HKLM\System\CurrentControlSet\Services\COMServer\Security
———————————-
Values added:14
———————————-
HKLM\System\CurrentControlSet\Enum\Root\LEGACY_COMSERVER\0000\Service: “COMServer”
HKLM\System\CurrentControlSet\Enum\Root\LEGACY_COMSERVER\0000\Legacy: 0×00000001
HKLM\System\CurrentControlSet\Enum\Root\LEGACY_COMSERVER\0000\ConfigFlags: 0×00000000
HKLM\System\CurrentControlSet\Enum\Root\LEGACY_COMSERVER\0000\Class: “LegacyDriver”
HKLM\System\CurrentControlSet\Enum\Root\LEGACY_COMSERVER\0000\ClassGUID: “{8ECC055D-047F-11D1-A537-0000F8753ED1}”
HKLM\System\CurrentControlSet\Enum\Root\LEGACY_COMSERVER\0000\DeviceDesc: “COMServer”
HKLM\System\CurrentControlSet\Enum\Root\LEGACY_COMSERVER\NextInstance: 0×00000001
HKLM\System\CurrentControlSet\Services\COMServer\Security\Security: 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 00 01 02 00 00 00 00 00 05 20 00 00 00 20 02 00 00 00 00 14 00 8D 01 02 00 01 01 00 00 00 00 00 05 0B 00 00 00 00 00 18 00 FD 01 02 00 01 02 00 00 00 00 00 05 20 00 00 00 23 02 00 00 01 01 00 00 00 00 00 05 12 00 00 00 01 01 00 00 00 00 00 05 12 00 00 00
HKLM\System\CurrentControlSet\Services\COMServer\Type: 0×00000010
HKLM\System\CurrentControlSet\Services\COMServer\Start: 0×00000002
HKLM\System\CurrentControlSet\Services\COMServer\ErrorControl: 0×00000000
HKLM\System\CurrentControlSet\Services\COMServer\ImagePath: “”C:\WINDOWS\system32\msapps\comsrvr.exe” s”
HKLM\System\CurrentControlSet\Services\COMServer\DisplayName: “COMServer”
HKLM\System\CurrentControlSet\Services\COMServer\ObjectName: “LocalSystem”
———————————-
Files added:1
———————————-
C:\WINDOWS\system32\msapps\comsrvr.exe
———————————-
Folders added:1
———————————-
C:\WINDOWS\system32\msapps
———————————-
Total changes:20
———————————-
—————————————————————————————————————————-
Recommended software:
UnHackMe anti-rootkit and anti-malware
http://www.unhackme.com
RegRun Security Suite (Good choice for removal and protection)
http://www.regrun.com
Comments
Tell me what you're thinking...
and oh, if you want a pic to show with your comment, go get a gravatar!
- Remember: the best way to remove rootkits is from the outside!
