setup3.exe - Dangerous

setup3.exe

Free Download

Manual removal instructions:

Antivirus Report of setup3.exe:
setup3.exe Malware
setup3.exeDangerous
setup3.exeHigh Risk
setup3.exe
We suggest you to remove setup3.exe from your computer as soon as possible.
Setup3.exe is Trojan/Backdoor.
Kill the process setup3.exe and remove setup3.exe from Windows startup.

File: setup3.exe
-------------------------------------------------------------------------------------
Classification:
Code:
Antivirus Version Last Update Result
Avast 4.8.1335.0 2009.08.11 Win32:Spyware-gen
AVG 8.5.0.406 2009.08.12 -
BitDefender 7.2 2009.08.12 Trojan.Generic.1568657
Comodo 1949 2009.08.12 -
DrWeb 5.0.0.12182 2009.08.12 Trojan.Hosts.82
F-Secure 8.0.14470.0 2009.08.11 -
Kaspersky 7.0.0.125 2009.08.12 -
Microsoft 1.4903 2009.08.11 -
NOD32 4327 2009.08.11 probably a variant of Win32/Spy.Agent
Symantec 1.4.4.12 2009.08.12 Infostealer

Additional information
File size: 48640 bytes
MD5 : e0db9bd62514f3b0c626a305bb4e4213
SHA1 : 9e07bdf15bc079786266fddc9f81ed29768254fd

-------------------------------------------------------------------------------------
Installation
When the program is executed, it creates the following registry subkeys and values:

----------------------------------
Keys added:1
----------------------------------
HKCU\Software\Microsoft\Internet Explorer\International\CpMRU

----------------------------------
Values added:7
----------------------------------
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lin: "C:\WINDOWS\system32\setup3.exe"
HKCU\Software\Microsoft\Internet Explorer\International\W2KLpk: 0x00000001
HKCU\Software\Microsoft\Internet Explorer\International\CpMRU\Enable: 0x00000001
HKCU\Software\Microsoft\Internet Explorer\International\CpMRU\Size: 0x0000000A
HKCU\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits: 0x00000064
HKCU\Software\Microsoft\Internet Explorer\International\CpMRU\Factor: 0x00000014
HKCU\Software\Microsoft\Internet Explorer\Main\Default_Page_URL: "http://www.535420.com"

----------------------------------
Values modified:10
----------------------------------
HKCU\Software\Microsoft\Internet Explorer\Main\Start Page: "http://www.google.com/"
HKCU\Software\Microsoft\Internet Explorer\Main\Start Page: "http://www.535420.com"
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\iexplore\Count: 0x00000002
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\iexplore\Count: 0x00000003
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\iexplore\Time: D9 07 08 00 02 00 0B 00 0E 00 3A 00 24 00 B1 01
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\iexplore\Time: D9 07 08 00 04 00 0D 00 0C 00 30 00 2C 00 00 00
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E2E2DD38-D088-4134-82B7-F2BA38496583}\iexplore\Count: 0x00000002
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E2E2DD38-D088-4134-82B7-F2BA38496583}\iexplore\Count: 0x00000003
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E2E2DD38-D088-4134-82B7-F2BA38496583}\iexplore\Time: D9 07 08 00 02 00 0B 00 0E 00 3A 00 24 00 1E 02
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E2E2DD38-D088-4134-82B7-F2BA38496583}\iexplore\Time: D9 07 08 00 04 00 0D 00 0C 00 30 00 2C 00 B5 01

----------------------------------
Files added:2
----------------------------------
C:\Documents and Settings\Administrator\Local Settings\Temp\~1.tmp
C:\WINDOWS\system32\setup3.exe

----------------------------------
Files [attributes?] modified:2
----------------------------------
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat

----------------------------------
Folders added:0
----------------------------------

----------------------------------
Folders deleted:0
----------------------------------

----------------------------------
Total changes:22
----------------------------------
-------------------------------------------------------------------------------------
Internet activity:

Code:
HTTP GET http://www.535420.com/?sy
-------------------------------------------------------------------------------------
Detected by RegRun Reanimator:

Item Name: setup3.exe
Author: Unknown
Related File: C:\WINDOWS\system32\setup3.exe
Type: Detected using Heuristic Algorithm

Item Name: lin
Author: Unknown
Related File: C:\WINDOWS\system32\setup3.exe
Type: Registry Run

Removal Results: Success
Number of reboot: 1
-------------------------------------------------------------------------------------

Recommended software:
UnHackMe anti-rootkit and anti-malware
http://www.unhackme.com
RegRun Security Suite (Good choice for removal and protection)

Remove setup3.exe now!

Dmitry Sokolov:

I created UnHackMe in 2006 to fix the problem that antivioruses did not fix: detecting rootkits.

Since that time I work every day to fix the issues that antiviruses cannot.

If your antivirus have not helped you solve the problem, you should try UnHackMe.

We are a small company and you can ask me directly, if you have any questions.

Testimonials

You can read UnHackMe testimonials here.