csystime.exe - Dangerous
csystime.exe
Manual removal instructions:
Antivirus Report of csystime.exe:
csystime.exe
Added as a result of the following virus:
W32.Randex.S is a network-aware worm that attempts to connect to a predetermined IRC server to receive instructions from its author.
It does the following:
Copies itself as the file, %System%\CSysTime.exe.
Calculates a random IP address for a computer that it will try to infect.
Attempts to authenticate itself to the aforementioned, randomly generated IP addresses.
Copies itself to shares that have weak passwords.
Adds the value:
"System time updator"="CSysTime.exe"
to the registry keys:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
Connects to a specific IRC channel on a specific IRC server to receive remote instructions, such as:
ntscan: Performs the scan of a specific computer with weak administrator passwords and copies itself to these machines.
cdkey: Collects CD keys of many popular games and sends them to the IRC channel.
sysinfo: Retrieves the infected machine's information, such as CPU speed, memory, and so on.
Use RegRun Startup Optimizer to remove it from startup.
| csystime.exe | Malware |
| csystime.exe | Dangerous |
| csystime.exe | High Risk |
W32.Randex.S is a network-aware worm that attempts to connect to a predetermined IRC server to receive instructions from its author.
It does the following:
Copies itself as the file, %System%\CSysTime.exe.
Calculates a random IP address for a computer that it will try to infect.
Attempts to authenticate itself to the aforementioned, randomly generated IP addresses.
Copies itself to shares that have weak passwords.
Adds the value:
"System time updator"="CSysTime.exe"
to the registry keys:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
Connects to a specific IRC channel on a specific IRC server to receive remote instructions, such as:
ntscan: Performs the scan of a specific computer with weak administrator passwords and copies itself to these machines.
cdkey: Collects CD keys of many popular games and sends them to the IRC channel.
sysinfo: Retrieves the infected machine's information, such as CPU speed, memory, and so on.
Use RegRun Startup Optimizer to remove it from startup.
Dmitry Sokolov:
I created UnHackMe in 2006 to fix the problem that antivioruses did not fix: detecting rootkits.
Since that time I work every day to fix the issues that antiviruses cannot.
If your antivirus have not helped you solve the problem, you should try UnHackMe.
We are a small company and you can ask me directly, if you have any questions.