0ssruqj8.dll - Dangerous
0ssruqj8.dll
Manual removal instructions:
Antivirus Report of 0ssruqj8.dll:
0ssruqj8.dll
We suggest you to remove 0sSrUqJ8.dll from your computer as soon as possible.
0sSrUqJ8.dll is Trojan/Backdoor.
Kill the file 0sSrUqJ8.dll and remove 0sSrUqJ8.dll from Windows startup.
File:
c:\sand-box\2.exe
Classification:
Antivirus Version Last Update Result
Avast 4.8.1335.0 2009.06.18 Win32:Cdur
AVG 8.5.0.339 2009.06.18 BackDoor.Generic10.ALBY
BitDefender 7.2 2009.06.19 Trojan.Generic.1273471
Comodo 1368 2009.06.19 TrojWare.Win32.Trojan.Agent.
Gen
DrWeb 5.0.0.12182 2009.06.18 DLOADER.Trojan
F-Secure 8.0.14470.0 2009.06.18 Trojan.Win32.CDur.crh
K7AntiVirus 7.10.766 2009.06.17 Trojan.Win32.Malware.1
Microsoft 1.4701 2009.06.19 Backdoor:Win32/Poison.Y
NOD32 4169 2009.06.19 Win32/Prosti.NBO
Symantec 1.4.4.12 2009.06.19 Trojan.Dropper
Additional information
File size: 180494 bytes
MD5 : 125359b9ea3b296f4f61cf7ced134d04
SHA1 : 9916f31f97f38101882bdfbb17f39c9f45c3817d
Installation
When the program is executed, it creates the following registry subkeys and values:
----------------------------------
Keys added:5
----------------------------------
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_TELNETS
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_TELNETS\0000
HKLM\SYSTEM\CurrentControlSet\Services\telnets
HKLM\SYSTEM\CurrentControlSet\Services\telnets\Parameters
HKLM\SYSTEM\CurrentControlSet\Services\telnets\Security
----------------------------------
Values added:16
----------------------------------
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_TELNETS\0000\Service: "telnets"
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_TELNETS\0000\Legacy: 0x00000001
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_TELNETS\0000\ConfigFlags: 0x00000000
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_TELNETS\0000\Class: "LegacyDriver"
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_TELNETS\0000\ClassGUID: "{8ECC055D-047F-11D1-A537-0000F8753ED1}"
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_TELNETS\0000\DeviceDesc: "telnets"
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_TELNETS\NextInstance: 0x00000001
HKLM\SYSTEM\CurrentControlSet\Services\telnets\Security\Security: 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 00 01 02 00 00 00 00 00 05 20 00 00 00 20 02 00 00 00 00 14 00 8D 01 02 00 01 01 00 00 00 00 00 05 0B 00 00 00 00 00 18 00 FD 01 02 00 01 02 00 00 00 00 00 05 20 00 00 00 23 02 00 00 01 01 00 00 00 00 00 05 12 00 00 00 01 01 00 00 00 00 00 05 12 00 00 00
HKLM\SYSTEM\CurrentControlSet\Services\telnets\Parameters\ServiceDLL: "%SystemRoot%\0sSrUqJ8.dll"
HKLM\SYSTEM\CurrentControlSet\Services\telnets\Type: 0x00000110
HKLM\SYSTEM\CurrentControlSet\Services\telnets\Start: 0x00000002
HKLM\SYSTEM\CurrentControlSet\Services\telnets\ErrorControl: 0x00000000
HKLM\SYSTEM\CurrentControlSet\Services\telnets\ImagePath: "%SystemRoot%\System32\svchost.exe -k netsvcs"
HKLM\SYSTEM\CurrentControlSet\Services\telnets\DisplayName: "telnets"
HKLM\SYSTEM\CurrentControlSet\Services\telnets\ObjectName: "LocalSystem"
HKLM\SYSTEM\CurrentControlSet\Services\telnets\Description: "telnets"
----------------------------------
Values modified:2
----------------------------------
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\netsvcs: '6to4 AppMgmt AudioSrv Browser CryptSvc DMServer DHCP ERSvc EventSystem FastUserSwitchingCompatibility HidServ Ias Iprip Irmon LanmanServer LanmanWorkstation Messenger Netman Nla Ntmssvc NWCWorkstation Nwsapagent Rasauto Rasman Remoteaccess Schedule Seclogon SENS Sharedaccess SRService Tapisrv Themes TrkWks W32Time WZCSVC Wmi WmdmPmSp winmgmt wscsvc xmlprov napagent hkmsvc BITS wuauserv ShellHWDetection helpsvc WmdmPmSN'
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\netsvcs: '6to4 AppMgmt AudioSrv Browser CryptSvc DMServer DHCP ERSvc EventSystem FastUserSwitchingCompatibility HidServ Ias Iprip Irmon LanmanServer LanmanWorkstation Messenger Netman Nla Ntmssvc NWCWorkstation Nwsapagent Rasauto Rasman Remoteaccess Schedule Seclogon SENS Sharedaccess SRService Tapisrv Themes TrkWks W32Time WZCSVC Wmi WmdmPmSp winmgmt wscsvc xmlprov napagent hkmsvc BITS wuauserv ShellHWDetection helpsvc WmdmPmSN telnets'
----------------------------------
Files added:3
----------------------------------
C:\WINDOWS\system32\0sSrUqJ8.dll
C:\WINDOWS\system32\3s6Ef0eSOU.del
C:\WINDOWS\system32\3s6Ef0eSOU.ini
----------------------------------
Files [attributes?] modified:0
----------------------------------
----------------------------------
Folders added:0
----------------------------------
----------------------------------
Folders deleted:0
----------------------------------
----------------------------------
Total changes:26
----------------------------------
-------------------------------------------------------------------------------------
Detected by RegRun Reanimator:
Type: Svchost DLLs
Item Name: telnets
Related File: %SystemRoot%\0sSrUqJ8.dll
Removal Results: Success
Number of reboot: 1
| 0ssruqj8.dll | Malware |
| 0ssruqj8.dll | Dangerous |
| 0ssruqj8.dll | High Risk |
0sSrUqJ8.dll is Trojan/Backdoor.
Kill the file 0sSrUqJ8.dll and remove 0sSrUqJ8.dll from Windows startup.
File:
c:\sand-box\2.exe
Classification:
Antivirus Version Last Update Result
Avast 4.8.1335.0 2009.06.18 Win32:Cdur
AVG 8.5.0.339 2009.06.18 BackDoor.Generic10.ALBY
BitDefender 7.2 2009.06.19 Trojan.Generic.1273471
Comodo 1368 2009.06.19 TrojWare.Win32.Trojan.Agent.
Gen
DrWeb 5.0.0.12182 2009.06.18 DLOADER.Trojan
F-Secure 8.0.14470.0 2009.06.18 Trojan.Win32.CDur.crh
K7AntiVirus 7.10.766 2009.06.17 Trojan.Win32.Malware.1
Microsoft 1.4701 2009.06.19 Backdoor:Win32/Poison.Y
NOD32 4169 2009.06.19 Win32/Prosti.NBO
Symantec 1.4.4.12 2009.06.19 Trojan.Dropper
Additional information
File size: 180494 bytes
MD5 : 125359b9ea3b296f4f61cf7ced134d04
SHA1 : 9916f31f97f38101882bdfbb17f39c9f45c3817d
Installation
When the program is executed, it creates the following registry subkeys and values:
----------------------------------
Keys added:5
----------------------------------
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_TELNETS
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_TELNETS\0000
HKLM\SYSTEM\CurrentControlSet\Services\telnets
HKLM\SYSTEM\CurrentControlSet\Services\telnets\Parameters
HKLM\SYSTEM\CurrentControlSet\Services\telnets\Security
----------------------------------
Values added:16
----------------------------------
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_TELNETS\0000\Service: "telnets"
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_TELNETS\0000\Legacy: 0x00000001
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_TELNETS\0000\ConfigFlags: 0x00000000
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_TELNETS\0000\Class: "LegacyDriver"
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_TELNETS\0000\ClassGUID: "{8ECC055D-047F-11D1-A537-0000F8753ED1}"
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_TELNETS\0000\DeviceDesc: "telnets"
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_TELNETS\NextInstance: 0x00000001
HKLM\SYSTEM\CurrentControlSet\Services\telnets\Security\Security: 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 00 01 02 00 00 00 00 00 05 20 00 00 00 20 02 00 00 00 00 14 00 8D 01 02 00 01 01 00 00 00 00 00 05 0B 00 00 00 00 00 18 00 FD 01 02 00 01 02 00 00 00 00 00 05 20 00 00 00 23 02 00 00 01 01 00 00 00 00 00 05 12 00 00 00 01 01 00 00 00 00 00 05 12 00 00 00
HKLM\SYSTEM\CurrentControlSet\Services\telnets\Parameters\ServiceDLL: "%SystemRoot%\0sSrUqJ8.dll"
HKLM\SYSTEM\CurrentControlSet\Services\telnets\Type: 0x00000110
HKLM\SYSTEM\CurrentControlSet\Services\telnets\Start: 0x00000002
HKLM\SYSTEM\CurrentControlSet\Services\telnets\ErrorControl: 0x00000000
HKLM\SYSTEM\CurrentControlSet\Services\telnets\ImagePath: "%SystemRoot%\System32\svchost.exe -k netsvcs"
HKLM\SYSTEM\CurrentControlSet\Services\telnets\DisplayName: "telnets"
HKLM\SYSTEM\CurrentControlSet\Services\telnets\ObjectName: "LocalSystem"
HKLM\SYSTEM\CurrentControlSet\Services\telnets\Description: "telnets"
----------------------------------
Values modified:2
----------------------------------
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\netsvcs: '6to4 AppMgmt AudioSrv Browser CryptSvc DMServer DHCP ERSvc EventSystem FastUserSwitchingCompatibility HidServ Ias Iprip Irmon LanmanServer LanmanWorkstation Messenger Netman Nla Ntmssvc NWCWorkstation Nwsapagent Rasauto Rasman Remoteaccess Schedule Seclogon SENS Sharedaccess SRService Tapisrv Themes TrkWks W32Time WZCSVC Wmi WmdmPmSp winmgmt wscsvc xmlprov napagent hkmsvc BITS wuauserv ShellHWDetection helpsvc WmdmPmSN'
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\netsvcs: '6to4 AppMgmt AudioSrv Browser CryptSvc DMServer DHCP ERSvc EventSystem FastUserSwitchingCompatibility HidServ Ias Iprip Irmon LanmanServer LanmanWorkstation Messenger Netman Nla Ntmssvc NWCWorkstation Nwsapagent Rasauto Rasman Remoteaccess Schedule Seclogon SENS Sharedaccess SRService Tapisrv Themes TrkWks W32Time WZCSVC Wmi WmdmPmSp winmgmt wscsvc xmlprov napagent hkmsvc BITS wuauserv ShellHWDetection helpsvc WmdmPmSN telnets'
----------------------------------
Files added:3
----------------------------------
C:\WINDOWS\system32\0sSrUqJ8.dll
C:\WINDOWS\system32\3s6Ef0eSOU.del
C:\WINDOWS\system32\3s6Ef0eSOU.ini
----------------------------------
Files [attributes?] modified:0
----------------------------------
----------------------------------
Folders added:0
----------------------------------
----------------------------------
Folders deleted:0
----------------------------------
----------------------------------
Total changes:26
----------------------------------
-------------------------------------------------------------------------------------
Detected by RegRun Reanimator:
Type: Svchost DLLs
Item Name: telnets
Related File: %SystemRoot%\0sSrUqJ8.dll
Removal Results: Success
Number of reboot: 1
Dmitry Sokolov:
I created UnHackMe in 2006 to fix the problem that antivioruses did not fix: detecting rootkits.
Since that time I work every day to fix the issues that antiviruses cannot.
If your antivirus have not helped you solve the problem, you should try UnHackMe.
We are a small company and you can ask me directly, if you have any questions.