msnss.exe - Dangerous
msnss.exe
Manual removal instructions:
Antivirus Report of msnss.exe:
msnss.exe
W32.Gaobot.AUS
It is a repacked variant of W32.Gaobot.SN.
The worm spreads through open network shares and through backdoors that the Mydoom family of worms open.
Steals CD keys from a number of computer games.
Gives the creator backdoor access to the computer via IRC channel:
- Download and execute files
- Scan the network
- List, stop, and start processes
- Control the file system (Delete, create, and list files)
- Launch Denial of Service (DoS) attacks
- Perform port redirection
- Steal system information and email it to the attacker
Attempts to copy itself to computers with weak passwords.
Scans for computers that have been infected by Mydoom variants.
If it finds any, it uses the backdoor installed by Mydoom to copy itself onto the computer as Msgfix.exe.
Manual removal:
Navigate to the keys:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
and delete the values, if present:
"Configuration Loader"="msnss.exe"
"Configuration Loader"="msgfix.exe"
| msnss.exe | Malware |
| msnss.exe | Dangerous |
| msnss.exe | High Risk |
It is a repacked variant of W32.Gaobot.SN.
The worm spreads through open network shares and through backdoors that the Mydoom family of worms open.
Steals CD keys from a number of computer games.
Gives the creator backdoor access to the computer via IRC channel:
- Download and execute files
- Scan the network
- List, stop, and start processes
- Control the file system (Delete, create, and list files)
- Launch Denial of Service (DoS) attacks
- Perform port redirection
- Steal system information and email it to the attacker
Attempts to copy itself to computers with weak passwords.
Scans for computers that have been infected by Mydoom variants.
If it finds any, it uses the backdoor installed by Mydoom to copy itself onto the computer as Msgfix.exe.
Manual removal:
Navigate to the keys:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
and delete the values, if present:
"Configuration Loader"="msnss.exe"
"Configuration Loader"="msgfix.exe"
Dmitry Sokolov:
I created UnHackMe in 2006 to fix the problem that antivioruses did not fix: detecting rootkits.
Since that time I work every day to fix the issues that antiviruses cannot.
If your antivirus have not helped you solve the problem, you should try UnHackMe.
We are a small company and you can ask me directly, if you have any questions.