syschk.exe - Dangerous
syschk.exe
Manual removal instructions:
Antivirus Report of syschk.exe:
syschk.exe
W32.Galil.F@mm is a mass-mailing worm that uses its own SMTP engine or Microsoft Outlook to spread.
It harvests email addresses from the files in the current user's Temporary Internet Files folder, Yahoo Messenger, Microsoft Outlook address book, as well as the files whose extensions are .asf, .avi, .doc, .jpg, .mdb, .mpe, .mpeg, .mpg, .pps, .ram, .rar, or .xls.
The worm may spoof the "From" field. The email message has a randomly selected subject line, which may also be the attachment name. The attachment has a .bhx, .exe, .hqx, .mim, .uu , .uue, or .xxe extension. The message body is also different.
When it runs, it does the following:
Displays a fake message.
May create a folder, %Windir%\Sys32s, and copy itself as %Windir%\Sys32s\ZaCker.exe with attributes set to Read-only, Hidden, and System.
Copies itself as %System%\MizZabbat32.exe.
May create the following files:
%System%\Syschk.exe: (With attributes may set to Read-only, Hidden, and System. This is the worm's propagation component.) 29,183 bytes
%System%\Smtp.Ocx: (An SMTP library. This file is not viral by itself.) 25,736 bytes
%System%\Runhelp.cab: (Which contains a file runhelp.inf. This file is not viral by itself.) 6,323 bytes
%Windir%\Sys32s\Runhelp.cab: (With attributes set to Read-only, Hidden, and System.) 6,323 bytes
%Windir%\Web\Folder.htt: (With attributes is set to Hidden and Archive.) 15,483 bytes
Manual removal.
Navigate to the key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
and delete the value:
"SystemChecker"="%System%\Syschk.exe"
Navigate to the key:
HKEY_CURRENT_USER
and delete the value
"Cya"
Use RegRun Startup Optimizer to automatically clean your system.
| syschk.exe | Malware |
| syschk.exe | Dangerous |
| syschk.exe | High Risk |
It harvests email addresses from the files in the current user's Temporary Internet Files folder, Yahoo Messenger, Microsoft Outlook address book, as well as the files whose extensions are .asf, .avi, .doc, .jpg, .mdb, .mpe, .mpeg, .mpg, .pps, .ram, .rar, or .xls.
The worm may spoof the "From" field. The email message has a randomly selected subject line, which may also be the attachment name. The attachment has a .bhx, .exe, .hqx, .mim, .uu , .uue, or .xxe extension. The message body is also different.
When it runs, it does the following:
Displays a fake message.
May create a folder, %Windir%\Sys32s, and copy itself as %Windir%\Sys32s\ZaCker.exe with attributes set to Read-only, Hidden, and System.
Copies itself as %System%\MizZabbat32.exe.
May create the following files:
%System%\Syschk.exe: (With attributes may set to Read-only, Hidden, and System. This is the worm's propagation component.) 29,183 bytes
%System%\Smtp.Ocx: (An SMTP library. This file is not viral by itself.) 25,736 bytes
%System%\Runhelp.cab: (Which contains a file runhelp.inf. This file is not viral by itself.) 6,323 bytes
%Windir%\Sys32s\Runhelp.cab: (With attributes set to Read-only, Hidden, and System.) 6,323 bytes
%Windir%\Web\Folder.htt: (With attributes is set to Hidden and Archive.) 15,483 bytes
Manual removal.
Navigate to the key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
and delete the value:
"SystemChecker"="%System%\Syschk.exe"
Navigate to the key:
HKEY_CURRENT_USER
and delete the value
"Cya"
Use RegRun Startup Optimizer to automatically clean your system.
Dmitry Sokolov:
I created UnHackMe in 2006 to fix the problem that antivioruses did not fix: detecting rootkits.
Since that time I work every day to fix the issues that antiviruses cannot.
If your antivirus have not helped you solve the problem, you should try UnHackMe.
We are a small company and you can ask me directly, if you have any questions.