Removed: mspdb11.dll
Malware: mix.exe
Removed: C:\Documents and Settings\All Users\Application Data\Microsoft\Windows\mspdb11.dll
—————————————————————————————————————————-
Classification:
| Antivirus | Version | Last Update | Result |
|---|---|---|---|
| F-Secure | 9.0.15370.0 | 2010.02.17 | - |
| Kaspersky | 7.0.0.125 | 2010.02.17 | Trojan.Win32.Inject.amlv |
| McAfee | 5894 | 2010.02.16 | - |
| NOD32 | 4873 | 2010.02.17 | Win32/Spy.Agent.NQT |
| Norman | 6.04.08 | 2010.02.16 | - |
| Symantec | 20091.2.0.41 | 2010.02.17 | Trojan Horse |
—————————————————————————————————————————-
Additional information
File size: 77312 bytes
MD5 : 1a014f0013df71d9c680aff014c200ad
SHA1 : 889b3fcbeb677f56703552d40de3dae76eab0ca8
SHA256: 37ddd418f449f109e492b71a0b2beee37050063608354b1e3427ecf875187848
—————————————————————————————————————————-
Installation
When the program is executed, it creates the following registry subkeys and values:
———————————-
Values added:3
———————————-
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\LoadAppInit_DLLs: 0×00000001
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\RequireSignedAppInit_DLLs: 0×00000000
HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\PendingFileRenameOperations: 5C 3F 3F 5C 43 3A 5C 73 61 6E 64 2D 62 6F 78 5C 6D 69 78 2E 65 78 65 00 00 00
———————————-
Values modified:2
———————————-
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs: “”
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs: “C:\DOCUME~1\ALLUSE~1\APPLIC~1\MICROS~1\Windows\mspdb11.dll”
———————————-
Files added:1
———————————-
C:\Documents and Settings\All Users\Application Data\Microsoft\Windows\mspdb11.dll
———————————-
Folders added:1
———————————-
C:\Documents and Settings\All Users\Application Data\Microsoft\Windows
———————————-
Total changes:7
———————————-
—————————————————————————————————————————-
Detected by UnHackMe:
Item Name: AppInit_DLLs
Author: Unknown
Related File: C:\DOCUME~1\ALLUSE~1\APPLIC~1\MICROS~1\Windows\mspdb11.dll
Type: List of Injected DLLs
Removal Results: Success
Number of reboot: 1
—————————————————————————————————————————-
Recommended software:
UnHackMe anti-rootkit and anti-malware
http://www.unhackme.com
RegRun Security Suite (Good choice for removal and protection)
http://www.regrun.com
Recommended: UnHackMe anti-rootkit and anti-malware
Premium software: RegRun Security Suite (Good choice for removal and protection)
