uacqqpxthwerx.sys - Dangerous
uacqqpxthwerx.sys
Manual removal instructions:
Antivirus Report of uacqqpxthwerx.sys:
uacqqpxthwerx.sys
We suggest you to remove UACqqpxthwerx.sys from your computer as soon as possible.
UACqqpxthwerx.sys is Trojan/Backdoor.
Kill the file UACqqpxthwerx.sys and remove UACqqpxthwerx.sys from Windows startup.
Malware dropper: 224-clean.exe
Removed: C:\WINDOWS\system32\drivers\UACqqpxthwerx.sys
-------------------------------------------------------------------------------------
Classification:
Code:
Antivirus Version Last Update Result
F-Secure 8.0.14470.0 2009.10.12 -
Kaspersky 7.0.0.125 2009.10.12 Packed.Win32.TDSS.aa
McAfee 5769 2009.10.12 -
Microsoft 1.5101 2009.10.12 VirTool:Win32/Obfuscator.EW
NOD32 4501 2009.10.12 -
Symantec 1.4.4.12 2009.10.12 -
Additional information
File size: 149504 bytes
MD5 : d88fcacdc357d9b58e748cfe5cd1f43a
SHA1 : 2e5502248a26e9f18c5808121fbfd8da91659f7d
-------------------------------------------------------------------------------------
Installation
When the program is executed, it creates the following registry subkeys and values:
----------------------------------
Keys added:4
----------------------------------
HKLM\SOFTWARE\UAC
HKLM\SOFTWARE\UAC\injector
HKLM\SOFTWARE\UAC\versions
HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys
----------------------------------
Values added:7
----------------------------------
HKLM\SOFTWARE\UAC\injector\*: "uacbbr"
HKLM\SOFTWARE\UAC\affid: "224"
HKLM\SOFTWARE\UAC\type: "av"
HKLM\SOFTWARE\UAC\build: "bbr"
HKLM\SOFTWARE\UAC\subid: "clean"
HKLM\SOFTWARE\UAC\4d4512c1-1c75-4a76-9f64-9e8e6433f0df: ""
HKLM\SOFTWARE\UAC\val: 60 D6 38 9D 21 4C CA 01
----------------------------------
Values modified:4
----------------------------------
HKLM\SYSTEM\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings\ProxyEnable: 0x00000001
HKLM\SYSTEM\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings\ProxyEnable: 0x00000000
HKLM\SYSTEM\CurrentControlSet\Services\wscsvc\Start: 0x00000002
HKLM\SYSTEM\CurrentControlSet\Services\wscsvc\Start: 0x00000004
----------------------------------
Files added:7
----------------------------------
C:\Documents and Settings\Administrator\Local Settings\Temp\UAC8935.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\UAC8944.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\UAC8ea3.tmp
C:\WINDOWS\system32\drivers\UACqqpxthwerx.sys
C:\WINDOWS\system32\UACcrigivaswk.dat
C:\WINDOWS\system32\UACldcbnripmb.dll
C:\WINDOWS\system32\UACtbjgerapuy.dll
----------------------------------
Files deleted:1
----------------------------------
C:\sand-box\224-clean.exe
----------------------------------
Files [attributes?] modified:0
----------------------------------
----------------------------------
Folders added:0
----------------------------------
----------------------------------
Folders deleted:0
----------------------------------
----------------------------------
Total changes:23
----------------------------------
-------------------------------------------------------------------------------------
Internet activity:
Code:
HTTP POST http://updateadvanced.org/banner/proxy.p...
-------------------------------------------------------------------------------------
Detected by UnHackMe:
- none -
After first reboot detected by UnHackMe:
Item Name: UACd.sys
Author:
Related File: \systemroot\system32\drivers\UACqqpxthwerx.sys
Type: Services detected by Partizan
Removal Results: Success
Number of reboot: 1
-------------------------------------------------------------------------------------
Recommended software:
UnHackMe anti-rootkit and anti-malware
http://www.unhackme.com
RegRun Security Suite (Good choice for removal and protection)
| uacqqpxthwerx.sys | Malware |
| uacqqpxthwerx.sys | Dangerous |
| uacqqpxthwerx.sys | High Risk |
UACqqpxthwerx.sys is Trojan/Backdoor.
Kill the file UACqqpxthwerx.sys and remove UACqqpxthwerx.sys from Windows startup.
Malware dropper: 224-clean.exe
Removed: C:\WINDOWS\system32\drivers\UACqqpxthwerx.sys
-------------------------------------------------------------------------------------
Classification:
Code:
Antivirus Version Last Update Result
F-Secure 8.0.14470.0 2009.10.12 -
Kaspersky 7.0.0.125 2009.10.12 Packed.Win32.TDSS.aa
McAfee 5769 2009.10.12 -
Microsoft 1.5101 2009.10.12 VirTool:Win32/Obfuscator.EW
NOD32 4501 2009.10.12 -
Symantec 1.4.4.12 2009.10.12 -
Additional information
File size: 149504 bytes
MD5 : d88fcacdc357d9b58e748cfe5cd1f43a
SHA1 : 2e5502248a26e9f18c5808121fbfd8da91659f7d
-------------------------------------------------------------------------------------
Installation
When the program is executed, it creates the following registry subkeys and values:
----------------------------------
Keys added:4
----------------------------------
HKLM\SOFTWARE\UAC
HKLM\SOFTWARE\UAC\injector
HKLM\SOFTWARE\UAC\versions
HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys
----------------------------------
Values added:7
----------------------------------
HKLM\SOFTWARE\UAC\injector\*: "uacbbr"
HKLM\SOFTWARE\UAC\affid: "224"
HKLM\SOFTWARE\UAC\type: "av"
HKLM\SOFTWARE\UAC\build: "bbr"
HKLM\SOFTWARE\UAC\subid: "clean"
HKLM\SOFTWARE\UAC\4d4512c1-1c75-4a76-9f64-9e8e6433f0df: ""
HKLM\SOFTWARE\UAC\val: 60 D6 38 9D 21 4C CA 01
----------------------------------
Values modified:4
----------------------------------
HKLM\SYSTEM\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings\ProxyEnable: 0x00000001
HKLM\SYSTEM\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings\ProxyEnable: 0x00000000
HKLM\SYSTEM\CurrentControlSet\Services\wscsvc\Start: 0x00000002
HKLM\SYSTEM\CurrentControlSet\Services\wscsvc\Start: 0x00000004
----------------------------------
Files added:7
----------------------------------
C:\Documents and Settings\Administrator\Local Settings\Temp\UAC8935.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\UAC8944.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\UAC8ea3.tmp
C:\WINDOWS\system32\drivers\UACqqpxthwerx.sys
C:\WINDOWS\system32\UACcrigivaswk.dat
C:\WINDOWS\system32\UACldcbnripmb.dll
C:\WINDOWS\system32\UACtbjgerapuy.dll
----------------------------------
Files deleted:1
----------------------------------
C:\sand-box\224-clean.exe
----------------------------------
Files [attributes?] modified:0
----------------------------------
----------------------------------
Folders added:0
----------------------------------
----------------------------------
Folders deleted:0
----------------------------------
----------------------------------
Total changes:23
----------------------------------
-------------------------------------------------------------------------------------
Internet activity:
Code:
HTTP POST http://updateadvanced.org/banner/proxy.p...
-------------------------------------------------------------------------------------
Detected by UnHackMe:
- none -
After first reboot detected by UnHackMe:
Item Name: UACd.sys
Author:
Related File: \systemroot\system32\drivers\UACqqpxthwerx.sys
Type: Services detected by Partizan
Removal Results: Success
Number of reboot: 1
-------------------------------------------------------------------------------------
Recommended software:
UnHackMe anti-rootkit and anti-malware
http://www.unhackme.com
RegRun Security Suite (Good choice for removal and protection)
Dmitry Sokolov:
I created UnHackMe in 2006 to fix the problem that antivioruses did not fix: detecting rootkits.
Since that time I work every day to fix the issues that antiviruses cannot.
If your antivirus have not helped you solve the problem, you should try UnHackMe.
We are a small company and you can ask me directly, if you have any questions.