brkl9.exe - Dangerous

brkl9.exe

Free Download

Manual removal instructions:

Antivirus Report of brkl9.exe:
brkl9.exe Malware
brkl9.exeDangerous
brkl9.exeHigh Risk
brkl9.exe
We suggest you to remove BRKl9.exe from your computer as soon as possible.
BRKl9.exe is Trojan/Backdoor.
Kill the process BRKl9.exe and remove BRKl9.exe from Windows startup.

Malware dropper: 1.exe
Removed: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~4090.ex
-------------------------------------------------------------------------------------
Classification:
Code:
Antivirus Version Last Update Result
F-Secure 8.0.14470.0 2009.10.07 Trojan-Downloader:W32/Perkesh.C
Kaspersky 7.0.0.125 2009.10.07 Trojan-Dropper.Win32.Mudrop.dyq
McAfee 5763 2009.10.06 Downloader-BWK
Microsoft 1.5101 2009.10.07 TrojanDownloader:Win32/Perkesh.F
NOD32 4487 2009.10.07 a variant of Win32/TrojanDownloader.Perkesh.I
Symantec 1.4.4.12 2009.10.07 Trojan.Dropper

Additional information
File size: 28672 bytes
MD5 : 882a20641183903aa9370799992fcf9e
SHA1 : 5e9457f994af2805aef1a8f87592d67b9127e849
-------------------------------------------------------------------------------------
Installation
When the program is executed, it creates the following registry subkeys and values:

----------------------------------
Keys added:6
----------------------------------
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe
HKLM\SOFTWARE\Microsoft\DownloadManager
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_VB
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_VB\0000
HKLM\SYSTEM\CurrentControlSet\Services\vb
HKLM\SYSTEM\CurrentControlSet\Services\vb\Security

----------------------------------
Values added:14
----------------------------------
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe\Debugger: "services.exe"
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_VB\0000\Service: "vb"
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_VB\0000\Legacy: 0x00000001
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_VB\0000\ConfigFlags: 0x00000000
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_VB\0000\Class: "LegacyDriver"
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_VB\0000\ClassGUID: "{8ECC055D-047F-11D1-A537-0000F8753ED1}"
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_VB\0000\DeviceDesc: "vb"
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_VB\NextInstance: 0x00000001
HKLM\SYSTEM\CurrentControlSet\Services\vb\Security\Security: 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 00 01 02 00 00 00 00 00 05 20 00 00 00 20 02 00 00 00 00 14 00 8D 01 02 00 01 01 00 00 00 00 00 05 0B 00 00 00 00 00 18 00 FD 01 02 00 01 02 00 00 00 00 00 05 20 00 00 00 23 02 00 00 01 01 00 00 00 00 00 05 12 00 00 00 01 01 00 00 00 00 00 05 12 00 00 00
HKLM\SYSTEM\CurrentControlSet\Services\vb\Type: 0x00000001
HKLM\SYSTEM\CurrentControlSet\Services\vb\Start: 0x00000003
HKLM\SYSTEM\CurrentControlSet\Services\vb\ErrorControl: 0x00000001
HKLM\SYSTEM\CurrentControlSet\Services\vb\ImagePath: "\??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~4090.ex"
HKLM\SYSTEM\CurrentControlSet\Services\vb\DisplayName: "vb"

----------------------------------
Values modified:0
----------------------------------

----------------------------------
Files added:2
----------------------------------
C:\Documents and Settings\Administrator\Local Settings\Temp\~4090.exe
C:\WINDOWS\system32\BRKl9.exe

----------------------------------
Files [attributes?] modified:0
----------------------------------

----------------------------------
Folders added:0
----------------------------------

----------------------------------
Folders deleted:0
----------------------------------

----------------------------------
Total changes:22
----------------------------------

-------------------------------------------------------------------------------------
Detected by UnHackMe:

- none -

After first reboot detected by UnHackMe:

Item Name: vb
Author:
Related File: \??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~4090.ex
Type: Services detected by Partizan

Removal Results: Success
Number of reboot: 1
-------------------------------------------------------------------------------------

Recommended software:
UnHackMe anti-rootkit and anti-malware
http://www.unhackme.com
RegRun Security Suite (Good choice for removal and protection)

Remove brkl9.exe now!

Dmitry Sokolov:

I created UnHackMe in 2006 to fix the problem that antivioruses did not fix: detecting rootkits.

Since that time I work every day to fix the issues that antiviruses cannot.

If your antivirus have not helped you solve the problem, you should try UnHackMe.

We are a small company and you can ask me directly, if you have any questions.

Testimonials

You can read UnHackMe testimonials here.