mr7sg4vsx5tr.dll - Dangerous
mr7sg4vsx5tr.dll
Manual removal instructions:
Antivirus Report of mr7sg4vsx5tr.dll:
mr7sg4vsx5tr.dll
We suggest you to remove mR7Sg4vSx5TR.dll from your computer as soon as possible.
MR7Sg4vSx5TR.dll is Trojan/Backdoor.
Kill the file mR7Sg4vSx5TR.dll and remove mR7Sg4vSx5TR.dll from Windows startup.
Classification:
Antivirus Version Last Update Result
Avast 4.8.1335.0 2009.06.11 Win32:Agent-ACMH
AVG 8.5.0.339 2009.06.11 PSW.OnlineGames3.FWC
BitDefender 7.2 2009.06.12 Generic.Onlinegames.14.
8CB1D663
DrWeb 5.0.0.12182 2009.06.12 Trojan.PWS.Wsgame.12056
F-Secure 8.0.14470.0 2009.06.12 Trojan-GameThief.Win32.Magania.bfrp
NOD32 4149 2009.06.11 probably a variant of Win32/PSW.OnLineGames.NRD
Symantec 1.4.4.12 2009.06.12 Infostealer.Gampass
Additional information
File size: 24192 bytes
MD5 : ed2f3e779672d8e96e032a412b49e298
SHA1 : d71d8f54c39ebc2bb8081e49c1ed992308795bb8
Installation
When the program is executed, it creates the following registry subkeys and values:
----------------------------------
Keys added:2
----------------------------------
HKLM\SOFTWARE\Classes\CLSID\{4679E74B-E5EE-458F-B613-2324AA1C817E}
HKLM\SOFTWARE\Classes\CLSID\{4679E74B-E5EE-458F-B613-2324AA1C817E}\InprocServer32
----------------------------------
Values added:3
----------------------------------
HKLM\SOFTWARE\Classes\CLSID\{4679E74B-E5EE-458F-B613-2324AA1C817E}\InprocServer32\: "C:\WINDOWS\system32\mR7Sg4vSx5TR.dll"
HKLM\SOFTWARE\Classes\CLSID\{4679E74B-E5EE-458F-B613-2324AA1C817E}\InprocServer32\ThreadingModel: "Apartment"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{4679E74B-E5EE-458F-B613-2324AA1C817E}: ""
----------------------------------
Values modified:0
----------------------------------
----------------------------------
Files deleted:2
----------------------------------
C:\sand-box\aa29.exe
C:\WINDOWS\system32\verclsid.exe
----------------------------------
Files [attributes?] modified:0
----------------------------------
----------------------------------
Folders added:0
----------------------------------
----------------------------------
Folders deleted:0
----------------------------------
----------------------------------
Total changes:7
----------------------------------
-------------------------------------------------------------------------------------
Detected by RegRun Reanimator:
Type: Shell Execute Hooks
Item Name: 4679E74B-E5EE-458F-B613-2324AA1C817E
Related File: C:\WINDOWS\system32\mR7Sg4vSx5TR.dll
Removal Results: Success
Number of reboot: 1
| mr7sg4vsx5tr.dll | Malware |
| mr7sg4vsx5tr.dll | Dangerous |
| mr7sg4vsx5tr.dll | High Risk |
MR7Sg4vSx5TR.dll is Trojan/Backdoor.
Kill the file mR7Sg4vSx5TR.dll and remove mR7Sg4vSx5TR.dll from Windows startup.
Classification:
Antivirus Version Last Update Result
Avast 4.8.1335.0 2009.06.11 Win32:Agent-ACMH
AVG 8.5.0.339 2009.06.11 PSW.OnlineGames3.FWC
BitDefender 7.2 2009.06.12 Generic.Onlinegames.14.
8CB1D663
DrWeb 5.0.0.12182 2009.06.12 Trojan.PWS.Wsgame.12056
F-Secure 8.0.14470.0 2009.06.12 Trojan-GameThief.Win32.Magania.bfrp
NOD32 4149 2009.06.11 probably a variant of Win32/PSW.OnLineGames.NRD
Symantec 1.4.4.12 2009.06.12 Infostealer.Gampass
Additional information
File size: 24192 bytes
MD5 : ed2f3e779672d8e96e032a412b49e298
SHA1 : d71d8f54c39ebc2bb8081e49c1ed992308795bb8
Installation
When the program is executed, it creates the following registry subkeys and values:
----------------------------------
Keys added:2
----------------------------------
HKLM\SOFTWARE\Classes\CLSID\{4679E74B-E5EE-458F-B613-2324AA1C817E}
HKLM\SOFTWARE\Classes\CLSID\{4679E74B-E5EE-458F-B613-2324AA1C817E}\InprocServer32
----------------------------------
Values added:3
----------------------------------
HKLM\SOFTWARE\Classes\CLSID\{4679E74B-E5EE-458F-B613-2324AA1C817E}\InprocServer32\: "C:\WINDOWS\system32\mR7Sg4vSx5TR.dll"
HKLM\SOFTWARE\Classes\CLSID\{4679E74B-E5EE-458F-B613-2324AA1C817E}\InprocServer32\ThreadingModel: "Apartment"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{4679E74B-E5EE-458F-B613-2324AA1C817E}: ""
----------------------------------
Values modified:0
----------------------------------
----------------------------------
Files deleted:2
----------------------------------
C:\sand-box\aa29.exe
C:\WINDOWS\system32\verclsid.exe
----------------------------------
Files [attributes?] modified:0
----------------------------------
----------------------------------
Folders added:0
----------------------------------
----------------------------------
Folders deleted:0
----------------------------------
----------------------------------
Total changes:7
----------------------------------
-------------------------------------------------------------------------------------
Detected by RegRun Reanimator:
Type: Shell Execute Hooks
Item Name: 4679E74B-E5EE-458F-B613-2324AA1C817E
Related File: C:\WINDOWS\system32\mR7Sg4vSx5TR.dll
Removal Results: Success
Number of reboot: 1
Dmitry Sokolov:
I created UnHackMe in 2006 to fix the problem that antivioruses did not fix: detecting rootkits.
Since that time I work every day to fix the issues that antiviruses cannot.
If your antivirus have not helped you solve the problem, you should try UnHackMe.
We are a small company and you can ask me directly, if you have any questions.