Tag Archives: Alureon

CLEARNLOADIMAGE.SYS is Rootkit Alureon

Rootkit CLEARNLOADIMAGE.SYS is software that enables continued privileged access to a computer while actively hiding its presence. Detection and removal of CLEARNLOADIMAGE.SYS may be a very difficult process. You should use anti-rootkit software to fix the CLEARNLOADIMAGE.SYS problem. Malware Analysis of CLEARNLOADIMAGE.SYS Full path on a computer: %Temp%\ctfm00.exe Detected by UnHackMe: Item Name: ctfm00.exe Author: […]
More…

EEFDFDCDFSACFSFDSF.EXE is Trojan Alureon

Is the file EEFDFDCDFSACFSFDSF.EXE located on your computer? Then your computer is infected. We do suggest you should remove EEFDFDCDFSACFSFDSF.EXE from your computer as soon as possible. EEFDFDCDFSACFSFDSF.EXE is Trojan/Backdoor. Kill the process EEFDFDCDFSACFSFDSF.EXE and remove EEFDFDCDFSACFSFDSF.EXE from the Windows startup. Malware Analysis of EEFDFDCDFSACFSFDSF.EXE Full path on a computer: %Common Appdata%\eefdfdcdfsacfsfdsf.exe Detected by UnHackMe: […]
More…

Removed: 4DW4R3.SYS, 4DW4R3C.DLL, 4DW4R3NVGMVSROER.SYS, 4DW4R3RIEYBBXFBI.DLL (trojan Cosmu/Alureon)

Malware: C:\sand-box\lsassc.exe Removed: C:\WINDOWS\SYSTEM32\DRIVERS\4DW4R3.SYS C:\WINDOWS\SYSTEM32\4DW4R3C.DLL C:\WINDOWS\SYSTEM32\DRIVERS\4DW4R3NVGMVSROER.SYS C:\WINDOWS\SYSTEM32\4DW4R3RIEYBBXFBI.DLL —————————————————————————————————————————- Detected by RegRun Warrior: 1. Examiner: 1.1 4DW4R3.SYS Default location: C:\WINDOWS\SYSTEM32\DRIVERS\4DW4R3.SYS MD5: EC196B8CB70705090480E76A6D3FABF4 SHA1: 84BBDAD7 7FDB17F8 1E008F70 C820C43A C150933A File Size: 46 592 1.2 4DW4R3C.DLL Default location: C:\WINDOWS\SYSTEM32\4DW4R3C.DLL MD5: 53B2EEBB1A2D91A861CA7A242AED11A1 SHA1: 56121B5B CF30DC03 8490FC03 60CB0953 5D35EB56 File Size: 28 160 1.3 4DW4R3NVGMVSROER.SYS Default location: C:\WINDOWS\SYSTEM32\DRIVERS\4DW4R3NVGMVSROER.SYS MD5: EC196B8CB70705090480E76A6D3FABF4 […]
More…

Restored: WS2IFSL.SYS (trojan TDSS/Alureon/Olmarik)

Malware: C:\sand-box\Ultimate Codes.exe Restored: C:\WINDOWS\SYSTEM32\DRIVERS\WS2IFSL.SYS —————————————————————————————————————————- Detected by RegRun Warrior: Item Name: WS2IFSL.SYS Author: Microsoft Corporation Related File: C:\WINDOWS\SYSTEM32\DRIVERS\WS2IFSL.SYS Type: Detected using Heuristic Algorithm The original WS2IFSL.SYS has been successfully restore using RegRun Warrior from the Windows installation CD. Removal Results: Success Number of reboot: 1 —————————————————————————————————————————- Classification: Antivirus Version Last Update Result F-Secure 9.0.15370.0 […]
More…

Restored: INTELIDE.SYS (trojan TDSS/Alureon/Olmarik)

Malware: C:\sand-box\1.exe Restored: C:\WINDOWS\SYSTEM32\DRIVERS\INTELIDE.SYS —————————————————————————————————————————- Detected by UnHackMe: Item Name: INTELIDE.SYS Related File: C:\WINDOWS\SYSTEM32\DRIVERS\INTELIDE.SYS Type: Detected using Heuristic Algorithm The original INTELIDE.SYS has been successfully restore using RegRun Warrior from the Windows installation CD. Removal Results: Success Number of reboot: 1 —————————————————————————————————————————- Classification: Antivirus Version Last Update Result F-Secure 9.0.15370.0 2010.05.20 Trojan.TDss.ADZ Kaspersky 7.0.0.125 2010.05.20 […]
More…

Restored: C:\WINDOWS\SYSTEM32\DRIVERS\ATAPI.SYS (trojan TDSS/Alureon)

Malware: C:\sand-box\setup.exe Restored: C:\WINDOWS\SYSTEM32\DRIVERS\ATAPI.SYS —————————————————————————————————————————- Detected by UnHackMe: Item Name: ATAPI.SYS Author: Microsoft Corporation Related File: C:\WINDOWS\SYSTEM32\DRIVERS\ATAPI.SYS Type: Detected using Heuristic Algorithm The original ATAPI.SYS has been successfully restore using RegRun Warrior from the Windows installation CD. Removal Results: Success Number of reboot: 1 —————————————————————————————————————————- Classification: Antivirus Version Last Update Result F-Secure 9.0.15370.0 2010.05.13 – […]
More…

Restored: DISK.SYS (infected by Alureon/TDSS/Olmarik)

Malware: C:\sand-box\in.exe Restored: C:\WINDOWS\SYSTEM32\DRIVERS\DISK.SYS —————————————————————————————————————————- Detected by RegRun Warrior: Item Name: DISK.SYS Author: Microsoft Corporation Related File: C:\WINDOWS\SYSTEM32\DRIVERS\DISK.SYS Type: Detected using Heuristic Algorithm The original DISK.SYS has been successfully restore using RegRun Warrior from the Windows installation CD. Removal Results: Success Number of reboot: 1 —————————————————————————————————————————- Classification: Antivirus Version Last Update Result F-Secure 9.0.15370.0 2010.05.12 […]
More…

Removed: PRAGMAd.sys (variant of TDSS trojan – Alureon/Olmarik)

Malware: C:\sand-box\install01.exe Removed: C:\WINDOWS\PRAGMAqipfvcxnqq\PRAGMAd.sys —————————————————————————————————————————- After first reboot detected by UnHackMe: Item Name: PRAGMAqipfvcxnqq Author: Related File: C:\WINDOWS\PRAGMAQIPFVCXNQQ\PRAGMAD.SYS Type: Services detected by Partizan Removal Results: Success Number of reboot: 2 —————————————————————————————————————————- Classification: Antivirus Version Last Update Result F-Secure 9.0.15370.0 2010.05.11 Gen:Variant.TDss.20 Kaspersky 7.0.0.125 2010.05.11 Trojan-Downloader.Win32.FraudLoad.xcxu Microsoft 1.5703 2010.05.11 Trojan:Win32/Alureon.gen!J NOD32 5105 2010.05.11 Win32/Olmarik.YX —————————————————————————————————————————- Additional […]
More…

Restored: RASACD.SYS (infected by Alureon/TDSS)

Malware: C:\sand-box\dog.exe Restored: C:\WINDOWS\SYSTEM32\DRIVERS\RASACD.SYS —————————————————————————————————————————- Detected by RegRun Warrior: Item Name: RASACD.SYS Author: Microsoft Corporation Related File: C:\WINDOWS\SYSTEM32\DRIVERS\RASACD.SYS Type: Detected using Heuristic Algorithm The original RASACD.SYS has been successfully restore using RegRun Warrior from the Windows installation CD. Removal Results: Success Number of reboot: 1 —————————————————————————————————————————- Classification: Antivirus Version Last Update Result F-Secure 9.0.15370.0 2010.04.19 […]
More…

Restored: DMLOAD.SYS (infected by Alureon/TDSS)

Malware: C:\sand-box\Browser_UpDate_For_Free.exe Restored: C:\WINDOWS\SYSTEM32\DRIVERS\DMLOAD.SYS —————————————————————————————————————————- Detected by RegRun Warrior: Item Name: DMLOAD.SYS Author: Microsoft Corporation Related File: C:\WINDOWS\SYSTEM32\DRIVERS\DMLOAD.SYS Type: Detected using Heuristic Algorithm The original DMLOAD.SYS has been successfully restore using RegRun Warrior from the Windows installation CD. Removal Results: Success Number of reboot: 1 —————————————————————————————————————————- Classification: Antivirus Version Last Update Result F-Secure 9.0.15370.0 2010.04.20 […]
More…