extext123734t.exe - Dangerous
extext123734t.exe
Manual removal instructions:
Antivirus Report of extext123734t.exe:
extext123734t.exe
We suggest you to remove extext123734t.exe from your computer as soon as possible.
Extext123734t.exe is Trojan/Backdoor.
Kill the process extext123734t.exe and remove extext123734t.exe from Windows startup.
File: avp1.exe (C:\sand-box\avp1.exe)
Classification:
Antivirus Version Last Update Result
Avast 4.8.1335.0 2009.07.24 Win32:Rootkit-gen
AVG 8.5.0.387 2009.07.25 Suspicion: unknown virus
BitDefender 7.2 2009.07.25 Gen:Trojan.Heur.PT.1030110101
Comodo 1742 2009.07.25 TrojWare.Win32.Magania.~CC
DrWeb 5.0.0.12182 2009.07.25 -
F-Secure 8.0.14470.0 2009.07.24 Suspicious:W32/Malware!Gemini
Kaspersky 7.0.0.125 2009.07.25 Trojan-Downloader.Win32.Geral.axi
Microsoft 1.4903 2009.07.25 TrojanDropper:Win32/Dogrobot.E
NOD32 4277 2009.07.25 Win32/AutoRun.Agent.QQ
Symantec 1.4.4.12 2009.07.25 Trojan.KillAV
Additional information
File size: 30642 bytes
MD5 : 685de881f54eddd77911f4da916ff398
SHA1 : 26bb7236d7d2ea4bee21bb8d7b6e3a27916b7a3b
Installation
When the program is executed, it creates the following registry subkeys and values:
----------------------------------
Keys deleted:1
----------------------------------
HKLM\SYSTEM\CurrentControlSet\Services\PCIDump
----------------------------------
Keys added:77
----------------------------------
HKLM\SOFTWARE\Microsoft\ESENT\Process\extext123734t
HKLM\SOFTWARE\Microsoft\ESENT\Process\extext123734t\DEBUG
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360delays.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safebox.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe
...
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsserv.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vstskmgr.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xcommsvr.exe
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ASYNCMAC
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ASYNCMAC\0000
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PCIDUMP
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PCIDUMP\0000
HKLM\SYSTEM\CurrentControlSet\Services\pcidump
HKLM\SYSTEM\CurrentControlSet\Services\pcidump\Security
----------------------------------
Values deleted:5
----------------------------------
HKLM\SYSTEM\CurrentControlSet\Services\PCIDump\ErrorControl: 0x00000000
HKLM\SYSTEM\CurrentControlSet\Services\PCIDump\Group: "PCI Configuration"
HKLM\SYSTEM\CurrentControlSet\Services\PCIDump\Start: 0x00000001
HKLM\SYSTEM\CurrentControlSet\Services\PCIDump\Tag: 0x00000001
HKLM\SYSTEM\CurrentControlSet\Services\PCIDump\Type: 0x00000001
----------------------------------
Values added:119
----------------------------------
HKLM\SOFTWARE\Microsoft\ESENT\Process\extext123734t\DEBUG\Trace Level: ""
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RsTray: "C:\WINDOWS\system32\scvhost.exe"
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360delays.exe\360delays.exe: "svchost.exe"
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safebox.exe\360Safebox.exe: "svchost.exe"
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe\360tray.exe: "svchost.exe"
...
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsserv.exe\vsserv.exe: "svchost.exe"
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vstskmgr.exe\vstskmgr.exe: "svchost.exe"
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xcommsvr.exe\xcommsvr.exe: "svchost.exe"
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ASYNCMAC\0000\Service: "AsyncMac"
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ASYNCMAC\0000\Legacy: 0x00000001
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ASYNCMAC\0000\ConfigFlags: 0x00000000
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ASYNCMAC\0000\Class: "LegacyDriver"
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ASYNCMAC\0000\ClassGUID: "{8ECC055D-047F-11D1-A537-0000F8753ED1}"
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ASYNCMAC\0000\DeviceDesc: "RAS Asynchronous Media Driver"
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ASYNCMAC\NextInstance: 0x00000001
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PCIDUMP\0000\Service: "pcidump"
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PCIDUMP\0000\Legacy: 0x00000001
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PCIDUMP\0000\ConfigFlags: 0x00000000
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PCIDUMP\0000\Class: "LegacyDriver"
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PCIDUMP\0000\ClassGUID: "{8ECC055D-047F-11D1-A537-0000F8753ED1}"
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PCIDUMP\0000\DeviceDesc: "pcidump"
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PCIDUMP\NextInstance: 0x00000001
HKLM\SYSTEM\CurrentControlSet\Services\pcidump\Security\Security: 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 00 01 02 00 00 00 00 00 05 20 00 00 00 20 02 00 00 00 00 14 00 8D 01 02 00 01 01 00 00 00 00 00 05 0B 00 00 00 00 00 18 00 FD 01 02 00 01 02 00 00 00 00 00 05 20 00 00 00 23 02 00 00 01 01 00 00 00 00 00 05 12 00 00 00 01 01 00 00 00 00 00 05 12 00 00 00
HKLM\SYSTEM\CurrentControlSet\Services\pcidump\Type: 0x00000001
HKLM\SYSTEM\CurrentControlSet\Services\pcidump\Start: 0x00000004
HKLM\SYSTEM\CurrentControlSet\Services\pcidump\ErrorControl: 0x00000000
HKLM\SYSTEM\CurrentControlSet\Services\pcidump\ImagePath: "\??\C:\WINDOWS\system32\drivers\pcidump.sys"
HKLM\SYSTEM\CurrentControlSet\Services\pcidump\DisplayName: "pcidump"
HKLM\SYSTEM\CurrentControlSet\Services\pcidump\DeleteFlag: 0x00000001
HKCU\Software\Microsoft\Notepad\lfEscapement: 0x00000000
HKCU\Software\Microsoft\Notepad\lfOrientation: 0x00000000
HKCU\Software\Microsoft\Notepad\lfWeight: 0x00000190
HKCU\Software\Microsoft\Notepad\lfItalic: 0x00000000
HKCU\Software\Microsoft\Notepad\lfUnderline: 0x00000000
HKCU\Software\Microsoft\Notepad\lfStrikeOut: 0x00000000
HKCU\Software\Microsoft\Notepad\lfCharSet: 0x00000000
HKCU\Software\Microsoft\Notepad\lfOutPrecision: 0x00000001
HKCU\Software\Microsoft\Notepad\lfClipPrecision: 0x00000002
HKCU\Software\Microsoft\Notepad\lfQuality: 0x00000002
HKCU\Software\Microsoft\Notepad\lfPitchAndFamily: 0x00000031
HKCU\Software\Microsoft\Notepad\iPointSize: 0x00000064
HKCU\Software\Microsoft\Notepad\fWrap: 0x00000000
HKCU\Software\Microsoft\Notepad\StatusBar: 0x00000000
HKCU\Software\Microsoft\Notepad\fSaveWindowPositions: 0x00000000
HKCU\Software\Microsoft\Notepad\lfFaceName: "Lucida Console"
HKCU\Software\Microsoft\Notepad\szHeader: "&f"
HKCU\Software\Microsoft\Notepad\szTrailer: "Page &p"
HKCU\Software\Microsoft\Notepad\iMarginTop: 0x000003E8
HKCU\Software\Microsoft\Notepad\iMarginBottom: 0x000003E8
HKCU\Software\Microsoft\Notepad\iMarginLeft: 0x000002EE
HKCU\Software\Microsoft\Notepad\iMarginRight: 0x000002EE
HKCU\Software\Microsoft\Notepad\fMLE_is_broken: 0x00000000
HKCU\Software\Microsoft\Notepad\iWindowPosX: 0x0000006E
HKCU\Software\Microsoft\Notepad\iWindowPosY: 0x0000006E
HKCU\Software\Microsoft\Notepad\iWindowPosDX: 0x00000258
HKCU\Software\Microsoft\Notepad\iWindowPosDY: 0x0000019B
----------------------------------
Values modified:2
----------------------------------
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Start: 0x00000002
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Start: 0x00000004
----------------------------------
Files added:5
----------------------------------
C:\WINDOWS\system32\drivers\AsyncMac.sys
C:\WINDOWS\system32\scvhost.exe
C:\WINDOWS\extext123734t.exe
C:\AUTORUN.INF
C:\recycle.{645FF040-5081-101B-9F08-00AA002F954E}\kav32.exe
----------------------------------
Files deleted:2
----------------------------------
C:\sand-box\avp1.exe
C:\WINDOWS\system32\drivers\asyncmac.sys
----------------------------------
Files [attributes?] modified:1
----------------------------------
C:\WINDOWS\system32\wbem\Logs\wbemcore.log
----------------------------------
Folders added:2
----------------------------------
C:\recycle.{645FF040-5081-101B-9F08-00AA002F954E}
C:\recycle.{645FF040-5081-101B-9F08-00AA002F954E}\safe.
----------------------------------
Folders deleted:0
----------------------------------
----------------------------------
Total changes:212
----------------------------------
-------------------------------------------------------------------------------------
Detected by RegRun Reanimator:
Item Name: RsTray
Author: Unknown
Related File: C:\WINDOWS\system32\scvhost.exe
Type: Registry Run
Item Name: C:\autorun.inf
Author: Unknown
Related File: C:\autorun.inf
Type: Autorun.inf
Removal Results: Success
Number of reboot: 1
-------------------------------------------------------------------------------------
Recommended software:
UnHackMe anti-rootkit and anti-malware
http://www.unhackme.com
RegRun Security Suite (Good choice for removal and protection)
| extext123734t.exe | Malware |
| extext123734t.exe | Dangerous |
| extext123734t.exe | High Risk |
Extext123734t.exe is Trojan/Backdoor.
Kill the process extext123734t.exe and remove extext123734t.exe from Windows startup.
File: avp1.exe (C:\sand-box\avp1.exe)
Classification:
Antivirus Version Last Update Result
Avast 4.8.1335.0 2009.07.24 Win32:Rootkit-gen
AVG 8.5.0.387 2009.07.25 Suspicion: unknown virus
BitDefender 7.2 2009.07.25 Gen:Trojan.Heur.PT.1030110101
Comodo 1742 2009.07.25 TrojWare.Win32.Magania.~CC
DrWeb 5.0.0.12182 2009.07.25 -
F-Secure 8.0.14470.0 2009.07.24 Suspicious:W32/Malware!Gemini
Kaspersky 7.0.0.125 2009.07.25 Trojan-Downloader.Win32.Geral.axi
Microsoft 1.4903 2009.07.25 TrojanDropper:Win32/Dogrobot.E
NOD32 4277 2009.07.25 Win32/AutoRun.Agent.QQ
Symantec 1.4.4.12 2009.07.25 Trojan.KillAV
Additional information
File size: 30642 bytes
MD5 : 685de881f54eddd77911f4da916ff398
SHA1 : 26bb7236d7d2ea4bee21bb8d7b6e3a27916b7a3b
Installation
When the program is executed, it creates the following registry subkeys and values:
----------------------------------
Keys deleted:1
----------------------------------
HKLM\SYSTEM\CurrentControlSet\Services\PCIDump
----------------------------------
Keys added:77
----------------------------------
HKLM\SOFTWARE\Microsoft\ESENT\Process\extext123734t
HKLM\SOFTWARE\Microsoft\ESENT\Process\extext123734t\DEBUG
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360delays.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safebox.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe
...
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsserv.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vstskmgr.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xcommsvr.exe
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ASYNCMAC
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ASYNCMAC\0000
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PCIDUMP
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PCIDUMP\0000
HKLM\SYSTEM\CurrentControlSet\Services\pcidump
HKLM\SYSTEM\CurrentControlSet\Services\pcidump\Security
----------------------------------
Values deleted:5
----------------------------------
HKLM\SYSTEM\CurrentControlSet\Services\PCIDump\ErrorControl: 0x00000000
HKLM\SYSTEM\CurrentControlSet\Services\PCIDump\Group: "PCI Configuration"
HKLM\SYSTEM\CurrentControlSet\Services\PCIDump\Start: 0x00000001
HKLM\SYSTEM\CurrentControlSet\Services\PCIDump\Tag: 0x00000001
HKLM\SYSTEM\CurrentControlSet\Services\PCIDump\Type: 0x00000001
----------------------------------
Values added:119
----------------------------------
HKLM\SOFTWARE\Microsoft\ESENT\Process\extext123734t\DEBUG\Trace Level: ""
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RsTray: "C:\WINDOWS\system32\scvhost.exe"
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360delays.exe\360delays.exe: "svchost.exe"
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safebox.exe\360Safebox.exe: "svchost.exe"
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe\360tray.exe: "svchost.exe"
...
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsserv.exe\vsserv.exe: "svchost.exe"
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vstskmgr.exe\vstskmgr.exe: "svchost.exe"
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xcommsvr.exe\xcommsvr.exe: "svchost.exe"
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ASYNCMAC\0000\Service: "AsyncMac"
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ASYNCMAC\0000\Legacy: 0x00000001
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ASYNCMAC\0000\ConfigFlags: 0x00000000
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ASYNCMAC\0000\Class: "LegacyDriver"
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ASYNCMAC\0000\ClassGUID: "{8ECC055D-047F-11D1-A537-0000F8753ED1}"
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ASYNCMAC\0000\DeviceDesc: "RAS Asynchronous Media Driver"
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ASYNCMAC\NextInstance: 0x00000001
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PCIDUMP\0000\Service: "pcidump"
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PCIDUMP\0000\Legacy: 0x00000001
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PCIDUMP\0000\ConfigFlags: 0x00000000
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PCIDUMP\0000\Class: "LegacyDriver"
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PCIDUMP\0000\ClassGUID: "{8ECC055D-047F-11D1-A537-0000F8753ED1}"
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PCIDUMP\0000\DeviceDesc: "pcidump"
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PCIDUMP\NextInstance: 0x00000001
HKLM\SYSTEM\CurrentControlSet\Services\pcidump\Security\Security: 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 00 01 02 00 00 00 00 00 05 20 00 00 00 20 02 00 00 00 00 14 00 8D 01 02 00 01 01 00 00 00 00 00 05 0B 00 00 00 00 00 18 00 FD 01 02 00 01 02 00 00 00 00 00 05 20 00 00 00 23 02 00 00 01 01 00 00 00 00 00 05 12 00 00 00 01 01 00 00 00 00 00 05 12 00 00 00
HKLM\SYSTEM\CurrentControlSet\Services\pcidump\Type: 0x00000001
HKLM\SYSTEM\CurrentControlSet\Services\pcidump\Start: 0x00000004
HKLM\SYSTEM\CurrentControlSet\Services\pcidump\ErrorControl: 0x00000000
HKLM\SYSTEM\CurrentControlSet\Services\pcidump\ImagePath: "\??\C:\WINDOWS\system32\drivers\pcidump.sys"
HKLM\SYSTEM\CurrentControlSet\Services\pcidump\DisplayName: "pcidump"
HKLM\SYSTEM\CurrentControlSet\Services\pcidump\DeleteFlag: 0x00000001
HKCU\Software\Microsoft\Notepad\lfEscapement: 0x00000000
HKCU\Software\Microsoft\Notepad\lfOrientation: 0x00000000
HKCU\Software\Microsoft\Notepad\lfWeight: 0x00000190
HKCU\Software\Microsoft\Notepad\lfItalic: 0x00000000
HKCU\Software\Microsoft\Notepad\lfUnderline: 0x00000000
HKCU\Software\Microsoft\Notepad\lfStrikeOut: 0x00000000
HKCU\Software\Microsoft\Notepad\lfCharSet: 0x00000000
HKCU\Software\Microsoft\Notepad\lfOutPrecision: 0x00000001
HKCU\Software\Microsoft\Notepad\lfClipPrecision: 0x00000002
HKCU\Software\Microsoft\Notepad\lfQuality: 0x00000002
HKCU\Software\Microsoft\Notepad\lfPitchAndFamily: 0x00000031
HKCU\Software\Microsoft\Notepad\iPointSize: 0x00000064
HKCU\Software\Microsoft\Notepad\fWrap: 0x00000000
HKCU\Software\Microsoft\Notepad\StatusBar: 0x00000000
HKCU\Software\Microsoft\Notepad\fSaveWindowPositions: 0x00000000
HKCU\Software\Microsoft\Notepad\lfFaceName: "Lucida Console"
HKCU\Software\Microsoft\Notepad\szHeader: "&f"
HKCU\Software\Microsoft\Notepad\szTrailer: "Page &p"
HKCU\Software\Microsoft\Notepad\iMarginTop: 0x000003E8
HKCU\Software\Microsoft\Notepad\iMarginBottom: 0x000003E8
HKCU\Software\Microsoft\Notepad\iMarginLeft: 0x000002EE
HKCU\Software\Microsoft\Notepad\iMarginRight: 0x000002EE
HKCU\Software\Microsoft\Notepad\fMLE_is_broken: 0x00000000
HKCU\Software\Microsoft\Notepad\iWindowPosX: 0x0000006E
HKCU\Software\Microsoft\Notepad\iWindowPosY: 0x0000006E
HKCU\Software\Microsoft\Notepad\iWindowPosDX: 0x00000258
HKCU\Software\Microsoft\Notepad\iWindowPosDY: 0x0000019B
----------------------------------
Values modified:2
----------------------------------
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Start: 0x00000002
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Start: 0x00000004
----------------------------------
Files added:5
----------------------------------
C:\WINDOWS\system32\drivers\AsyncMac.sys
C:\WINDOWS\system32\scvhost.exe
C:\WINDOWS\extext123734t.exe
C:\AUTORUN.INF
C:\recycle.{645FF040-5081-101B-9F08-00AA002F954E}\kav32.exe
----------------------------------
Files deleted:2
----------------------------------
C:\sand-box\avp1.exe
C:\WINDOWS\system32\drivers\asyncmac.sys
----------------------------------
Files [attributes?] modified:1
----------------------------------
C:\WINDOWS\system32\wbem\Logs\wbemcore.log
----------------------------------
Folders added:2
----------------------------------
C:\recycle.{645FF040-5081-101B-9F08-00AA002F954E}
C:\recycle.{645FF040-5081-101B-9F08-00AA002F954E}\safe.
----------------------------------
Folders deleted:0
----------------------------------
----------------------------------
Total changes:212
----------------------------------
-------------------------------------------------------------------------------------
Detected by RegRun Reanimator:
Item Name: RsTray
Author: Unknown
Related File: C:\WINDOWS\system32\scvhost.exe
Type: Registry Run
Item Name: C:\autorun.inf
Author: Unknown
Related File: C:\autorun.inf
Type: Autorun.inf
Removal Results: Success
Number of reboot: 1
-------------------------------------------------------------------------------------
Recommended software:
UnHackMe anti-rootkit and anti-malware
http://www.unhackme.com
RegRun Security Suite (Good choice for removal and protection)
Dmitry Sokolov:
I created UnHackMe in 2006 to fix the problem that antivioruses did not fix: detecting rootkits.
Since that time I work every day to fix the issues that antiviruses cannot.
If your antivirus have not helped you solve the problem, you should try UnHackMe.
We are a small company and you can ask me directly, if you have any questions.