224-clean.exe - Dangerous

224-clean.exe

Manual removal instructions:

Antivirus Report of 224-clean.exe:
224-clean.exe Malware
224-clean.exeDangerous
224-clean.exeHigh Risk
224-clean.exe
We suggest you to remove UACqqpxthwerx.sys from your computer as soon as possible.
UACqqpxthwerx.sys is Trojan/Backdoor.
Kill the file UACqqpxthwerx.sys and remove UACqqpxthwerx.sys from Windows startup.

Malware dropper: 224-clean.exe
Removed: C:\WINDOWS\system32\drivers\UACqqpxthwerx.sys
-------------------------------------------------------------------------------------
Classification:
Code:
Antivirus Version Last Update Result
F-Secure 8.0.14470.0 2009.10.12 -
Kaspersky 7.0.0.125 2009.10.12 Packed.Win32.TDSS.aa
McAfee 5769 2009.10.12 -
Microsoft 1.5101 2009.10.12 VirTool:Win32/Obfuscator.EW
NOD32 4501 2009.10.12 -
Symantec 1.4.4.12 2009.10.12 -

Additional information
File size: 149504 bytes
MD5 : d88fcacdc357d9b58e748cfe5cd1f43a
SHA1 : 2e5502248a26e9f18c5808121fbfd8da91659f7d
-------------------------------------------------------------------------------------
Installation
When the program is executed, it creates the following registry subkeys and values:

----------------------------------
Keys added:4
----------------------------------
HKLM\SOFTWARE\UAC
HKLM\SOFTWARE\UAC\injector
HKLM\SOFTWARE\UAC\versions
HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys

----------------------------------
Values added:7
----------------------------------
HKLM\SOFTWARE\UAC\injector\*: "uacbbr"
HKLM\SOFTWARE\UAC\affid: "224"
HKLM\SOFTWARE\UAC\type: "av"
HKLM\SOFTWARE\UAC\build: "bbr"
HKLM\SOFTWARE\UAC\subid: "clean"
HKLM\SOFTWARE\UAC\4d4512c1-1c75-4a76-9f64-9e8e6433f0df: ""
HKLM\SOFTWARE\UAC\val: 60 D6 38 9D 21 4C CA 01

----------------------------------
Values modified:4
----------------------------------
HKLM\SYSTEM\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings\ProxyEnable: 0x00000001
HKLM\SYSTEM\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings\ProxyEnable: 0x00000000
HKLM\SYSTEM\CurrentControlSet\Services\wscsvc\Start: 0x00000002
HKLM\SYSTEM\CurrentControlSet\Services\wscsvc\Start: 0x00000004

----------------------------------
Files added:7
----------------------------------
C:\Documents and Settings\Administrator\Local Settings\Temp\UAC8935.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\UAC8944.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\UAC8ea3.tmp
C:\WINDOWS\system32\drivers\UACqqpxthwerx.sys
C:\WINDOWS\system32\UACcrigivaswk.dat
C:\WINDOWS\system32\UACldcbnripmb.dll
C:\WINDOWS\system32\UACtbjgerapuy.dll

----------------------------------
Files deleted:1
----------------------------------
C:\sand-box\224-clean.exe

----------------------------------
Files [attributes?] modified:0
----------------------------------

----------------------------------
Folders added:0
----------------------------------

----------------------------------
Folders deleted:0
----------------------------------

----------------------------------
Total changes:23
----------------------------------

-------------------------------------------------------------------------------------
Internet activity:
Code:
HTTP POST http://updateadvanced.org/banner/proxy.p...
-------------------------------------------------------------------------------------
Detected by UnHackMe:

- none -

After first reboot detected by UnHackMe:

Item Name: UACd.sys
Author:
Related File: \systemroot\system32\drivers\UACqqpxthwerx.sys
Type: Services detected by Partizan

Removal Results: Success
Number of reboot: 1
-------------------------------------------------------------------------------------

Recommended software:
UnHackMe anti-rootkit and anti-malware
http://www.unhackme.com
RegRun Security Suite (Good choice for removal and protection)

Remove 224-clean.exe now!

Dmitry Sokolov:

I created UnHackMe in 2006 to fix the problem that antivioruses did not fix: detecting rootkits.

Since that time I work every day to fix the issues that antiviruses cannot.

If your antivirus have not helped you solve the problem, you should try UnHackMe.

We are a small company and you can ask me directly, if you have any questions.

Testimonials

You can read UnHackMe testimonials here.