fooding.exe - Dangerous
fooding.exe
Manual removal instructions:
Antivirus Report of fooding.exe:
fooding.exe
W32.Netsky.I@mm is a mass-mailing worm that uses its own SMTP engine to send itself to the email addresses it finds when scanning hard drives and mapped drives.
Copies itself as %Windir%\fooding.exe.
Deletes some values from the registry key (see avguard.exe - W32.Netsky.G@mm)
Scans the files on drives C through Z for email addresses.
Uses its own SMTP engine to send itself to the email addresses it found above, sending to each address once.
The email has the following characteristics:
From: service@yahoo.com
Subject: (One of the following)
Mail account expired
Mail account closed
Mail account deactivated
Body: (One of the following)
Your mail account expired. Please follow the link to reactivate.
Your mail account has been closed. Click on the link for further details.
Your mail account has been deactivated. To reactivate, follow the link.
Attachment:
http:/ /www.[recipient domain]/[user]/index.scr
For example, a message to joe@hotmail.com would have the attachment name http:/ /www.hotmail.com/joe/index.scr.
Manual removal:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
and delete the value: "Tiny AV"="%Windir%\fooding.exe -antivirus service"
Or use RegRun Startup Optimizer to automatical remove it from the system registry.
| fooding.exe | Malware |
| fooding.exe | Dangerous |
| fooding.exe | High Risk |
Copies itself as %Windir%\fooding.exe.
Deletes some values from the registry key (see avguard.exe - W32.Netsky.G@mm)
Scans the files on drives C through Z for email addresses.
Uses its own SMTP engine to send itself to the email addresses it found above, sending to each address once.
The email has the following characteristics:
From: service@yahoo.com
Subject: (One of the following)
Mail account expired
Mail account closed
Mail account deactivated
Body: (One of the following)
Your mail account expired. Please follow the link to reactivate.
Your mail account has been closed. Click on the link for further details.
Your mail account has been deactivated. To reactivate, follow the link.
Attachment:
http:/ /www.[recipient domain]/[user]/index.scr
For example, a message to joe@hotmail.com would have the attachment name http:/ /www.hotmail.com/joe/index.scr.
Manual removal:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
and delete the value: "Tiny AV"="%Windir%\fooding.exe -antivirus service"
Or use RegRun Startup Optimizer to automatical remove it from the system registry.
Dmitry Sokolov:
I created UnHackMe in 2006 to fix the problem that antivioruses did not fix: detecting rootkits.
Since that time I work every day to fix the issues that antiviruses cannot.
If your antivirus have not helped you solve the problem, you should try UnHackMe.
We are a small company and you can ask me directly, if you have any questions.