Search This Blog
Showing posts with label malware. Show all posts

Manual Removal of W32/Casino.W Trojan

Manual Removal of W32/Casino.W Trojan
W32/Casino.W is a trojan. The trojan will infect Windows systems.
This trojan Copies its files to root of Windows installed drive\Casino\32 Vegas Casino\ Folder as hidden files or active non-hidden files.
This trojan information updated on June 8, 2009.
Other names of W32/Casino.W Trojan:
This trojan is also known as Trojan.Win32.Malware.4,Ad-Spyware.Casino.W.30, Adware.Casino.Q.

Damage Level : Low
Distribution Level: Low/Medium
W32/Casino.W Trojan Manual Removal Instructions
Recommend Removal from Safe Mode:
How to Start in Safe mode:
Restart your Computer, Press F8 Repeatedly, when your Screen turns on, Select Safe mode, press enter.
The Infected Files Can be Seen in these folders and names also Running in Tasks
End the Following Active Process Before Removal
  • [ Kill the Process, Use Killbox if your Access Denied ]
Download W32/Casino.W Trojan Known File Removal Tool
[In Windows Vista Run As Administrator, After Execution System Will Restart]
  • %root of Windows installed drive\Casino\32 Vegas Casino\casino.hlp
    [ No Exact Information about Files, search above related files in Program files Folder ]
    If you have any of these files in running process from task manger, end the process before removal.
    Note: if task manager is disabled, Download the following file, Click to Download - Enable Registry.reg     [ Right Click - Save Target As/Linked Content As ]
    Open it with Regedit.exe [%system32\regedit.exe], then it Confirms Add to registry Yes or No, Confirm Yes, then click Ok.
W32/Casino.W Trojan Entries Manual Removal From Registry
Click Start, Run,Type regedit,Click OK.
Note: If the registry editor fails to open the threat may have modified the registry to prevent access to the registry editor.
  • Download this UnHookExec.inf, [ Right Click - Save Target As/Linked Content As ]
     and then continue with the removal. Save it to your Windows desktop. Do not run it at this time, download it only.
  • After booting into the Safe Mode or VGA Mode
  • Right-click the UnHookExec.inf file and click Install. [This is a small file. It does not display any notice or boxes when you run it.]
W32/Casino.W Trojan modifies registry at the following locations to ensure its automatic execution at every system startup:
Delete The Entries
HKEY_USERS\S-1-5-21-XXXXXXXXXX-XXXXXXXXXX-XXXXXXXXX-XXXX\Software\Microsoft\Windows\ShellNoRoam\MUICache
Delete file entries from right side
Search Registry For W32/Casino.W Trojan File Names listed above to remove completely,
Edit Menu - Find, enter Keyword and remove all value that find in search.

Exit the Registry Editor,
Restart your Computer.

Recommended Removal Tools:
Killbox (Freeware)
By at No comments

Manual Removal of W32/MarketScore.F Trojan

Manual Removal of W32/MarketScore.F Trojan
W32/MarketScore.F is a trojan. The trojan will infect Windows systems.
This trojan Copies its files to Windows, Windows\System Folder as hidden files.
This trojan information updated on May 4, 2009.
Other names of W32/MarketScore.F Trojan:
This trojan is also known as Spyware.Marketscore, Trojan.Win32.Malware.1, Trojan.MulDrop.4313.
Damage Level : Medium/High
Distribution Level: Medium
W32/MarketScore.F Trojan Manual Removal Instructions
Recommend Removal from Safe Mode:
How to Start in Safe mode:
Restart your Computer, Press F8 Repeatedly, when your Screen turns on, Select Safe mode, press enter.
The Infected Files Can be Seen in these folders and names also Running in Tasks
End the Following Active Process Before Removal
  • [ Kill the Process, Use Killbox if your Access Denied ]
Download W32/MarketScore.F Trojan Known File Removal Tool
[In Windows Vista Run As Administrator, After Execution System Will Restart]
  • %Windows\invite1.exe
  • %Windows\runos.exe
  • %Windows\uninstall.exe
  • %Windows\System\dp.exe [ More info on Prevx.com ]
  • %Windows\System\j3ewro.exe
    [ No Exact Information about Files, search above related files in Program files Folder ]
    If you have any of these files in running process from task manger, end the process before removal.
    Note: if task manager is disabled, Download the following file, Click to Download - Enable Registry.reg     [ Right Click - Save Target As/Linked Content As ]
    Open it with Regedit.exe [%system32\regedit.exe], then it Confirms Add to registry Yes or No, Confirm Yes, then click Ok.
W32/MarketScore.F Trojan Entries Manual Removal From Registry
Click Start, Run,Type regedit,Click OK.
Note: If the registry editor fails to open the threat may have modified the registry to prevent access to the registry editor.
  • Download this UnHookExec.inf, [ Right Click - Save Target As/Linked Content As ]
     and then continue with the removal. Save it to your Windows desktop. Do not run it at this time, download it only.
  • After booting into the Safe Mode or VGA Mode
  • Right-click the UnHookExec.inf file and click Install. [This is a small file. It does not display any notice or boxes when you run it.]
W32/MarketScore.F Trojan modifies registry at the following locations to ensure its automatic execution at every system startup:
Delete The Entries
 HKEY_USERS\S-1-5-21-XXXXXXXXXX-XXXXXXXXXX-XXXXXXXXX-XXXX\SOFTWARE\Microsoft\Windows\ShellNoRoam
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Delete : jvsoft C:\WINDOWS\system32\j3ewro.exe
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
Delete : Hidden value:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
Delete : ShowSuperHidden value:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
Delete : NoDriveTypeAutoRun [REG_DWORD, value: 00000091]

Delete file entries from right side
Search Registry For W32/MarketScore.F Trojan File Names listed above to remove completely,
Edit Menu - Find, enter Keyword and remove all value that find in search.

Exit the Registry Editor,
Restart your Computer.

Recommended Removal Tools:
Killbox (Freeware)
By at No comments

Manual Removal of W32/Conficker Worm

Manual Removal of W32/Conficker Worm
W32/Conficker is a worm. The worm will infect Windows systems.
This worm first appeared on March 26, 2009.
Other names of W32/Conficker Worm:
This Worm is also known as Win32/Downadup, W32/Kido, W32/Conflicker and W32/Pakes
W32/Conficker worm has exploited most of the malware entry points available in the Operating System and exploited to its benefit. Once the computer infected by the worm enters, it alters all the pre-requisite registry location to spread through Network, removable drives (USB sticks). The Worm can enter user's system in multiple ways, it may be through network with Admin$ share (brute force dictionary attack), systems with unsecured shares, systems not patched with vulnerability or USB drive etc. Due to this even though user follows the safe computing practice, system may get infected.


The worm attempts to create a HTTP Server and open a random port between 1024 and 10000 in the victim computer. On successful creation of the HTTP Server, the worm downloads the copy of itself to the victim computer. The worm also resets the Restore point. Most of the Variants of the Conficker worm will trigger the payload on April 1. Though Security industries are conducting lot of research on the payload, the exact payload and the damage it can create on April 1st is still a mystery.

Infection symptoms: 
  • Access to Admin shares are denied
  • Scheduled tasks are created
  • Acess to security related websites is denied
  • Access to Windows Updates site is denied
  • Network response will become considerably slow
  • Domain controllers respond slowly to client request
Damage Level : Medium/High
Distribution Level: Medium
W32/Conficker Worm Manual Removal Instructions
Recommend Removal from Safe Mode:
How to Start in Safe mode:
Restart your Computer, Press F8 Repeatedly, when your Screen turns on, Select Safe mode, press enter.
The Infected Files Can be Seen in these folders and names also Running in Tasks
End the Following Active Process Before Removal
  • [ Kill the Process, Use Killbox if your Access Denied ]
Download W32/Conficker Worm Known File Removal Tool
[In Windows Vista Run As Administrator, After Execution System Will Restart]
  • %Windows\System\ [Random Name.dll ], [Random Name.tmp ]
  • %Programs Files\Internet Explorer\ [Random Name.dll ]
  • %Programs Files\Movie Maker\ [Random Name.dll ]
  • %All Users\Application Data\ [Random Name.dll ]
  • %Windows\Temp\ [Random Name.tmp ]
  • %Program Files\wizard.exe
    [ No Exact Information about Files, search above files in Program files Folder ]
    If you have any of these files in running process from task manger, end the process before removal.
    Note: if task manager is disabled, Download the following file, Click to Download - Enable Registry.reg     [ Right Click - Save Target As/Linked Content As ]
    Open it with Regedit.exe [%system32\regedit.exe], then it Confirms Add to registry Yes or No, Confirm Yes, then click Ok.
W32/Conficker Worm Disabled Windows Services
  • Windows Automatic Update Service (wuauserv)
  • Background Intelligent Transfer Service (BITS)
  • Windows Security Center
  • Windows Defender
  • Windows Error Reporting
W32/Conficker Worm also drops following files in the removable and mapped drives:

Folder - \RECYCLER\
root folder -\autorun.inf

The W32/Conficker Worm attaches itself to the following Windows processes:
  • svchost.exe
  • explorer.exe
  • services.exe
W32/Conficker Worm Entries Manual Removal From Registry
Click Start, Run,Type regedit,Click OK.
Note: If the registry editor fails to open the threat may have modified the registry to prevent access to the registry editor.
  • Download this UnHookExec.inf, [ Right Click - Save Target As/Linked Content As ]
     and then continue with the removal. Save it to your Windows desktop. Do not run it at this time, download it only.
  • After booting into the Safe Mode or VGA Mode
  • Right-click the UnHookExec.inf file and click Install. [This is a small file. It does not display any notice or boxes when you run it.]
The W32/Conficker Worm modifies registry at the following locations to ensure its automatic execution at every system startup:

Delete The Entries
 HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
Delete file entry from right side
Search Registry For W32/Conficker Worm File Names listed above to remove completely,
Edit Menu - Find, enter Keyword and remove all value that find in search.

Exit the Registry Editor,
Restart your Computer.

Recommended Removal Tools:
Killbox (Freeware)
By at 2 comments

Vista Tips - Assigning a Password and Renaming the Guest Account

One of the default accounts set up in Windows Vista is the Guest account. This account can be useful if your computer is in a public place such as a library and a low rights account is needed.

However, for most of us, this account is just another possible security hole because it cannot be deleted. It is disabled by default but it could be enabled again by a virus or malware if your computer ever gets infected. The best way to neutralize this account is to give it a random password and rename it to eliminate the chances that some script will be able to use it.
Follow these steps to protect this account:
  • Click the Start menu, right-click Computer, and then select Manage.
  • After Computer Manager loads, expand Local Users and Groups and select the Users folder. All the local computer accounts will be listed.
  • Right-click the Guest account on the list and select Set Password.
  • A warning screen will appear, telling you about what may happen if you proceed. Disregard this message and click Proceed.
  • When the Set Password window appears, type in a completely random password that is a complex password and is also at least 20 characters long in both boxes and click OK. The new password will now be set.
  • Rename the account to confuse any malicious scripts that might be looking for it. Right-click the Guest account again and select Rename.
  • Type a new name for this account that has some random letters and numbers in it. You just want to make it different from Guest.
  • When you are done renaming it, click Enter and you are finished.
Your Guest account is now more secure than ever.
Ultimate Links PC Tips™
By at 1 comment

Manual Removal of W32/MacroVirus.C Trojan

Manual Removal of W32/MacroVirus.C Trojan.
W32/MacroVirus.C is a trojan. The trojan will infect Windows systems.
This trojan first appeared on February 09, 2009.
Other names of W32/MacroVirus.C Trojan:
This trojan is also known as Fake_AntiSpyware.ABE, Trojan.Win32.Malware.3
Damage Level : High/Medium
Distribution Level: Unknown
Auto Removal Tool for W32/MacroVirus.C Trojan
W32/MacroVirus.C Trojan Manual Removal Instructions
Recommend Removal from Safe Mode:
How to Start in Safe mode:
Restart your Computer, Press F8 Repeatedly, when your Screen turns on, Select Safe mode, press enter.
The Infected Files Can be Seen in these folders and names also Running in Tasks
End the Following Active Process Before Removal
Download W32/MacroVirus.C Trojan Known Files Removal Tool
[Run As Administrator [MS Vista], After Execution System Will Restart]
  • %Windows\Installer\38486.msi
  • %Windows\Installer\Icon.exe
  • %Program Files\MacroVirus
  • %Program Files\MacroVirus\MacroVirus.exe
  • %Program Files\MacroVirus\Launcher.exe
  • %Program Files\MacroVirus\python24.dll
  • %Program Files\MacroVirus\sqlite3.dll
    If you have any of these files in running process from task manger, end the process before removal.
    Note: if task manager is disabled
    Download the following file [ Right click and select "Save Target as" ]
    Click to Download - Enable Registry.reg
    Open it with Regedit.exe [%system32\regedit.exe], then it Confirms Add to registry Yes or No, Confirm Yes, then click Ok.
W32/MacroVirus.C Trojan Entries Manual Removal From Registry
Click Start, Run,Type regedit,Click OK.
Note: If the registry editor fails to open the threat may have modified the registry to prevent access to the registry editor.
Download UnHookExec.inf, [ Right click and select "Save Target as" ] and then continue with the removal.
Save it to your Windows desktop. Do not run it at this time, download it only.
After booting into the Safe Mode or VGA Mode
 Right-click the UnHookExec.inf file and click Install. [This is a small file. It does not display any notice or boxes when you run it.]

Delete the registry Key "MacroVirus.exe" at "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"

Delete the registry key "MacroVirus" at "HKEY_CURRENT_USER\Software\"
Delete the registry key "MacroVirus" at "HKEY_LOCAL_MACHINE\Software\"

Delete the registry value "<$PROGRAMS>\MacroVirus\" at "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\"
Delete the registry value "<$PROGRAMFILES>\MacroVirus\" at "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\"
Delete the registry value "<$PROGRAMFILES>\MacroVirus\FilterDrv\" at "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\"
Delete the registry value "<$PROGRAMFILES>\MacroVirus\AddOns\" at "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\"
Delete the registry value "<$PROGRAMFILES>\MacroVirus\Databases\" at "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\"
Delete the registry value "<$PROGRAMFILES>\MacroVirus\Microsoft.VC80.ATL\" at "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\"
Delete the registry value "<$PROGRAMFILES>\MacroVirus\Microsoft.VC80.CRT\" at "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\"
Delete the registry value "<$PROGRAMS>\MacroVirusApp\" at "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\"
Delete the registry value "<$PROGRAMFILES>\MacroVirusApp\" at "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\"
Delete the registry value "<$PROGRAMFILES>\MacroVirusApp\FilterDrv\" at "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\"
Delete the registry value "<$PROGRAMFILES>\MacroVirusApp\AddOns\" at "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\"
Delete the registry value "<$PROGRAMFILES>\MacroVirusApp\Databases\" at "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\"
Delete the registry value "<$PROGRAMFILES>\MacroVirusApp\Microsoft.VC80.ATL\" at "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\"
Delete the registry value "<$PROGRAMFILES>\MacroVirusApp\Microsoft.VC80.CRT\" at "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\"
Delete Entry with any Listed file name Above

Search Registry For W32/MacroVirus.C Trojan File Names listed above to remove completely,
Edit Menu - Find, enter Keyword and remove all value that find in search.

Exit the Registry Editor,
Restart your Computer.

Recommended Removal Tools:
Killbox (Freeware)
By at No comments

Manual Removal of W32/Downadup.AL Worm

Manual Removal of W32/Downadup.AL Worm.
W32/Downadup.AL is a Worm. The W32/Downadup.AL worm will infect Windows systems.
This worm first appeared on January 19, 2009.
Other names of W32/Downadup.AL Worm:
This Worm is also known as Win32/Conficker, W32/Conficker.worm.gen, Mal/Conficker.
Read F-Secure Downadup.AL Details
Read Symantec Downadup.AL Details
Damage Level : Medium/High
Distribution Level: Medium
Symantec Removal Tool for W32/Downadup.AL Worm
F-Secure Removal Tool for W32/Downadup.AL Worm
W32/Downadup.AL Worm Manual Removal Instructions
Recommend Removal from Safe Mode:
How to Start in Safe mode:
Restart your Computer, Press F8 Repeatedly, when your Screen turns on, Select Safe mode, press enter.
The Infected Files Can be Seen in these folders and names also Running in Tasks
End the Following Active Process Before Removal
  • [ Kill the Process, Use Killbox if your Access Denied ]
  • The W32/Downadup.AL Worm copies itself with the random name with *.dll extension in the following locations
  • %Windows System
  • %Programs Files\Internet Explorer
  • %Programs Files\Movie Maker
  • %All Users Application Data
  • %Windows Temp
    ---------------------------------------------
  • %System%\[Random].dll
  • %Program Files%\Internet Explorer\[Random].dll
  • %Program Files%\Movie Maker\[Random].dll
  • %All Users Application Data%\[Random].dll
  • %Temp%\[Random].dll
  • %System%\[Random].tmp
  • %Temp%\[Random].tmp
  • %DriveLetter\RECYCLER\[Folder]\[1fe.a3d][3 random characters]
  • %DriveLetter%\autorun.inf
  • The W32/Downadup.AL Worm copies itself with the random name with .tmp extension in the following locations
  • Windows System
  • Windows Temp
  • The W32/Downadup.AL Worm disables the following services:
  • Windows Automatic Update Service (wuauserv)
  • Background Intelligent Transfer Service (BITS)
  • Windows Security Center Service (wscsvc)
  • Windows Defender Service (WinDefend)
  • Windows Error Reporting Service (ERSvc)
  • Windows Error Reporting Service (WerSvc)
  • The W32/Downadup.AL Worm attempts to block the access to the following security sites which contain the following strings
  • virus, spyware, malware, rootkit, defender, microsoft, symantec, norton, mcafee, trendmicro, sophos, panda, etrust, networkassociates, computerassociates, f-secure, kaspersky, jotti, f-prot, nod32, eset, grisoft, drweb, centralcommand, ahnlab, esafe, avast, avira, quickheal, comodo, clamav, ewido, fortinet, gdata, hacksoft, hauri, ikarus, k7computing, norman, pctools, prevx, rising, securecomputing, sunbelt, emsisoft, arcabit, cpsecure, spamhaus, castlecops, threatexpert, wilderssecurity, windowsupdate, nai, ca, avp, avg, vet, bit9, sans, cert
    If you have any of these files in running process from task manger, end the process before removal.
    Note: if task manager is disabled, Download the following file, Click to Download - Enable Registry.reg     [ Right Click - Save Target As/Linked Content As ]
    Open it with Regedit.exe [%system32\regedit.exe], then it Confirms Add to registry Yes or No, Confirm Yes, then click Ok.
W32/Downadup.AL Worm Entries Manual Removal From Registry
Click Start, Run,Type regedit,Click OK.
Note: If the registry editor fails to open the threat may have modified the registry to prevent access to the registry editor.
  • Download this UnHookExec.inf, [ Right Click - Save Target As/Linked Content As ]
     and then continue with the removal.Save it to your Windows desktop. Do not run it at this time, download it only.
  • After booting into the Safe Mode or VGA Mode
  • Right-click the UnHookExec.inf file and click Install. [This is a small file. It does not display any notice or boxes when you run it.]
The W32/Downadup.AL Worm modifies registry at the following locations to ensure its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
    "TcpNumConnections" = dword:0x00FFFFFE
  • The worm deletes a number of keys from the registry, in order to deactivate the Security Center Notifications and prevent Windows Defender from starting. It also bypasses the Windows Firewall by creating the following registry entry, so that the system can download a copy of the worm:
  • HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List, [PortNumber]:TCP = "[PortNumber]:TCP:*Enabled:[random]"
  • To hide its presence in the system, the worm deletes any System Restore points created by the user, then modifies the following registry keys:
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\Advanced\Folder\Hidden\SHO WALLCheckedValue = dword:00000000
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost, netsvcs = %Previous data% and %Random%
  • During infection, the worm may create a temporary (TMP) file in the the System or Temp folders. The TMP file created is registered as a service kernel driver using the following registry entry:
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\[random]
    Type = dword:00000001
    Start = dword:00000003
    ErrorControl = dword:00000000
    ImagePath = "\...\%Path%\[random].tmp"
    DisplayName = [Random]
  • Once the key is created, the file %MalwarePath%\[random].tmp is deleted.An interesting change the worm makes to the registry involves the following registry entries:
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\
    DisplayName = %ServiceName%
    Type = dword:00000020
    Start = dword:00000002
    ErrorControl = dword:00000000
    ImagePath = "%SystemRoot%\system32\svchost.exe -k netsvcs"
    ObjectName = "LocalSystem"
    Description = %description%
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\[random]\Parameters
    ServiceDll = %Path%
Search Registry For Virus File Names listed above to remove completely,
Edit Menu - Find, enter Keyword and remove all value that find in search.

Exit the Registry Editor,
Restart your Computer.

Recommended Removal Tools:
Killbox (Freeware)
By at No comments

Manual Removal of Win32/Renos.FU Trojan

Manual Removal of Win32/Renos.FU Trojan.
Currently there is no description available for this program.
Win32/Renos.FU is a Trojan. The trojan will infect Windows systems.
The trojan may be dropped by other malware or may be downloaded from remote website by other malware.
This trojan first appeared on January 13, 2009.
Other names of Win32/Renos.FU Trojan:
This trojan is also known as Trojan-Downloader.Win32.CodecPack.amx
Damage Level : Medium
Distribution Level: Medium
Trojan Worm Manual Removal Instructions
Recommend Removal from Safe Mode:
How to Start in Safe mode:
Restart your Computer, Press F8 Repeatedly, when your Screen turns on, Select Safe mode, press enter.
The Infected Files Can be Seen in these folders and names also Running in Tasks
End the Following Active Process Before Removal
  • %Windows\System\sysmgr.exe [ Kill the Process, Use Killbox if your Access Denied ]
  • The following Names Known to be Created
  • %System%\syskernel.exe
  • %System%\winhlpp32.exe
  • %Temp%\0003a44f_rar\syswin.exe
  • %Temp%\0003b140_rar\sys32krnl.exe
  • %Temp%\virus\syskernel.exe
  • %Windir%\sysmgr.exe
  • c:\sys32krnl.exe
  • c:\sysmgr.exe
  • c:\syswin.exe
    • If you have any of these files in running process from task manger, end the process before removal.
    • Note: if task manager is disabled, Download the following file, Click to Download - Enable Registry.reg
    • Open it with Regedit.exe [%system32\regedit.exe], then it Confirms Add to registry Yes or No, Confirm Yes, then click Ok.
Trojan Manual Removal From Registry
Click Start, Run,Type regedit,Click OK.
  • Note: If the registry editor fails to open the threat may have modified the registry to prevent access to the registry editor.
    • Download and run this UnHookExec.inf, and then continue with the removal.
    • Save it to your Windows desktop. Do not run it at this time, download it only.
    • After booting into the Safe Mode or VGA Mode
    • Right-click the UnHookExec.inf file and click Install. [This is a small file. It does not display any notice or boxes when you run it.]
The Trojan modifies registry at the following locations to ensure its automatic execution at every system startup:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run


Search Registry For Virus File Names listed above to remove completely,
Edit Menu - Find, enter Keyword and remove all value that find in search.

Exit the Registry Editor,
Restart your Computer.

Recommended Removal Tools:
Killbox (Freeware)
By at No comments

Manual Removal of W32/CodecPack.AMX Trojan

Manual Removal of W32/CodecPack.AMX Trojan.
W32/CodecPack.AMX is a Trojan. The trojan will infect Windows systems.
The trojan may be dropped by other malware or may be downloaded from remote website by other malware.
This trojan first appeared on January 13, 2009.
Other names of W32/CodecPack.AMX Trojan:
This trojan is also known as Trojan-Downloader.Win32.CodecPack.amx, TrojanDownloader:Win32/Renos.FU
Damage Level : Medium
Distribution Level: Medium
No Removal Tool for W32/CodecPack.AMX Trojan
Trojan Worm Manual Removal Instructions
Recommend Removal from Safe Mode:
How to Start in Safe mode:
Restart your Computer, Press F8 Repeatedly, when your Screen turns on, Select Safe mode, press enter.
The Infected Files Can be Seen in these folders and names also Running in Tasks
End the Following Active Process Before Removal
  • %Windows\System\sysmgr.exe [ Kill the Process, Use Killbox if your Access Denied ]
  • The following Names Known to be Created
  • %System%\syskernel.exe
  • %System%\winhlpp32.exe
  • %Temp%\0003a44f_rar\syswin.exe
  • %Temp%\0003b140_rar\sys32krnl.exe
  • %Temp%\virus\syskernel.exe
  • %Windir%\sysmgr.exe
  • c:\sys32krnl.exe
  • c:\sysmgr.exe
  • c:\syswin.exe
    • If you have any of these files in running process from task manger, end the process before removal.
    • Note: if task manager is disabled, Download the following file, Click to Download - Enable Registry.reg
    • Open it with Regedit.exe [%system32\regedit.exe], then it Confirms Add to registry Yes or No, Confirm Yes, then click Ok.
Trojan Manual Removal From Registry
Click Start, Run,Type regedit,Click OK.
  • Note: If the registry editor fails to open the threat may have modified the registry to prevent access to the registry editor.
    • Download and run this UnHookExec.inf, and then continue with the removal.
    • Save it to your Windows desktop. Do not run it at this time, download it only.
    • After booting into the Safe Mode or VGA Mode
    • Right-click the UnHookExec.inf file and click Install. [This is a small file. It does not display any notice or boxes when you run it.]
The Trojan modifies registry at the following locations to ensure its automatic execution at every system startup:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run


Search Registry For Virus File Names listed above to remove completely,
Edit Menu - Find, enter Keyword and remove all value that find in search.

Exit the Registry Editor,
Restart your Computer.

Recommended Removal Tools:
Killbox (Freeware)
By at No comments

Manual Removal of W32/QQPass.DCG.PSW Trojan

Manual Removal of W32/QQPass.DCG.PSW Trojan.
W32/QQPass.DCG.PSW is a Trojan. The Trojan will infect Windows systems.
The Trojan may be dropped by other malware or may be downloaded from remote website by other malware.
It may also be downloaded unknowingly by a user while visiting malicious Website.
This Trojan first appeared on October 24, 2008.
Other names of W32/QQPass.DCG.PSW Trojan:
This Trojan is also known as Mal/Heuri-E, TROJ_DROPPER.BZM, Trojan-PSW.Win32.QQPass.dcg.
Damage Level : Medium/High
Distribution Level: Unknown
No Removal Tool for W32/QQPass.DCG.PSW Trojan
Trojan Manual Removal Instructions
Recommend Removal from Safe Mode:
How to Start in Safe mode:
Restart your Computer, Press F8 Repeatedly, when your Screen turns on, Select Safe mode, press enter.
The Infected Files Can be Seen in these folders and names also Running in Tasks
End the Following Active Process Before Removal
  • %Windows\hjbh.exe
  • %Windows\bxfq.exe
  • %Windows\dfll.exe
  • %Windows\goti.exe
  • %Windows\gzei.exe
  • %Windows\jdzd.exe
  • %Windows\jvcn.exe
  • %Windows\ouyf.exe
  • %Windows\tlqi.exe
  • %Windows\wgon.exe
  • %Windows\wkxi.exe
  • %Windows\wwny.exe
  • %Windows\ybea.exe
    • If you have any of these files in running process from task manger, end the process before removal.
    • Note: if task manager is disabled, Download the following file, Click to Download - Enable Registry.reg
    • Open it with Regedit.exe [%system32\regedit.exe], then it Confirms Add to registry Yes or No, Confirm Yes, then click Ok.
Trojan Entries Manual Removal From Registry
Click Start, Run,Type regedit,Click OK.
Note: If the registry editor fails to open the threat may have modified the registry to prevent access to the registry editor.
  • Download this UnHookExec.inf, and then continue with the removal.Save it to your Windows desktop. Do not run it at this time, download it only.
  • After booting into the Safe Mode or VGA Mode
  • Right-click the UnHookExec.inf file and click Install. [This is a small file. It does not display any notice or boxes when you run it.]

The Trojan modifies registry at the following locations to ensure its automatic execution at every system startup:

UNKNOWN

Search Registry For Virus File Names listed above to remove completely,
Edit Menu - Find, enter Keyword and remove all value that find in search.

Exit the Registry Editor,
Restart your Computer.

Recommended Removal Tools:
Killbox (Freeware)
By at No comments

Manual Removal of W32/Sohanad.AS Worm

Manual Removal of W32/Sohanad.AS Worm.
W32/Sohanad.AS is a worm. The worm will infect Windows systems.
The worm arrives either as a file downloaded from remote sites by other malware or downloaded unknowingly by a user when visiting malicious Web sites.
The worm also modifies the Windows Registry to disable Registry Editor and Task Manager.
It attempts to connect to certain Web sites to download the possible malicious files.
The worm creates a scheduled task to execute its dropped copies.
It then uses Windows Task Scheduler to schedule task that automatically executes at 9 o'clock everyday.
This worm first appeared on August 22, 2007.
Other names of W32/Sohanad.AS Worm:
This Worm is also known as IM-Worm.Win32.Sohanad.as, W32/YahLover.worm, W32.Imaut.A , DR/Sohanad.AS.1, W32/SillyFDC-AE.
Damage Level : High/Medium
Distribution Level: Unknown
Auto Removal Tools for W32/Sohanad.AS Worm
Download Kaspersky Removal Tool
Worm Manual Removal Instructions
Recommend Removal from Safe Mode:
How to Start in Safe mode:
Restart your Computer, Press F8 Repeatedly, when your Screen turns on, Select Safe mode, press enter.
The Infected Files Can be Seen in these folders and names also Running in Tasks
End the Following Active Process Before Removal
  • %Windows\SCVVHSOT.exe
  • %Windows\System\BLASTCLNNN.EXE
  • %Windows\System\SCVVHSOT.exe
  • %System%\autorun.ini
     It also copies autorun.ini in the Windows System folder, which contains the following lines:
    Open=SCVVHSOT.exe
    Shellexe cute=SCVVHSOT.exe
    Shell\Open\command = SCVVHSOT.exe
    Shell=Open
     To Delete, Open the file using Notepad, then delete whole content inside the file, then File Save, Close notepad, Right click on the File, Select properties, Check readonly, Apply, Ok, Close, then delete.

    • If you have any of these files in running process from task manger, end the process before removal.
    • Note: if task manager is disabled
      Download the following file[ Right click and select "Save Target as" ]
      Click to Download - Enable Registry.reg
    • Open it with Regedit.exe [%system32\regedit.exe], then it Confirms Add to registry Yes or No, Confirm Yes, then click Ok.
Worm Manual Removal From Registry
Click Start, Run,Type regedit,Click OK.
  • Note: If the registry editor fails to open the threat may have modified the registry to prevent access to the registry editor.
    Download and run this UnHookExec.inf, and then continue with the removal.
    Save it to your Windows desktop. Do not run it at this time, download it only.
    After booting into the Safe Mode or VGA Mode
    Right-click the UnHookExec.inf file and click Install. [This is a small file. It does not display any notice or boxes when you run it.]
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Yahoo Messengger
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell
The worm adds the following registry key, so that the malicious file is accesible to all users within the network:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\WorkgroupCrawler\Shares

Search Registry For Virus File Names listed above to remove completely,
Edit Menu - Find, enter Keyword and remove all value that find in search.

Exit the Registry Editor,
Restart your Computer.

Recommended Removal Tools:
Killbox (Freeware)
By at No comments

Manual Removal of W32/SystemAntivirus.A Trojan

Manual Removal of W32/SystemAntivirus.A Trojan.
W32/SystemAntivirus.A is a trojan. The trojan will infect Windows systems.
The Trojan may be dropped by other malware or may be downloaded from remote website by other malware.
It may also be downloaded unknowingly by a user while visiting malicious Website.
This Trojan first appeared on October 11, 2008.
Other names of W32/SystemAntivirus.A Trojan:
This Trojan is also known as Win32/FakeSecSen, Mal/FakeAV-E, TROJ_FAKEAV.NN.
Damage Level : Unknown
Distribution Level: Unknown
Trojan Worm Manual Removal Instructions
Recommend Removal from Safe Mode:
How to Start in Safe mode:
Restart your Computer, Press F8 Repeatedly, when your Screen turns on, Select Safe mode, press enter.
The Infected Files Can be Seen in these folders and names also Running in Tasks
End the Following Active Process Before Removal
  • %Windows\System\lsasrv.dll
  • %Program Files\SAV 
  • %Program Files\SAV\sav.cpl [ Control Panel Entry ]
  • %Program Files\SAV\sav.exe  [ End Process ]
  • %Program Files\SAV\sav0.dat
  • %Program Files\SAV\sav1.dat 
  • %WINDOWS\system32\sav.cpl [ Control Panel Entry ]
  • %Documents and Settings\User Name\Desktop\System Antivirus 2008.lnk
    • If you have any of these files in running process from task manger, end the process before removal.
    • Note: if task manager is disabled, Download the following file, Click to Download - Enable Registry.reg
    • Open it with Regedit.exe [%system32\regedit.exe], then it Confirms Add to registry Yes or No, Confirm Yes, then click Ok.
Unregister DLL Files Using Windows Command Prompt
  • To open the Windows Command Prompt, go to Start > Run > type cmd and then click the "OK" button.
  • Type "cd" in order to change the current directory,
  • Press the "space" button, enter the full path to where you believe the System Antivirus 2008 DLL file is located press the "Enter" button on your keyboard.
  • If you don't know where System Antivirus 2008 DLL file is located, use the "dir" command to display the directory's contents.
  • To unregister "System Antivirus 2008" DLL file,
  • Type in the exact directory path + "regsvr32 /u" + [DLL_NAME]
  • (C:\Windows\System\ regsvr32 /u lsasrv.dll) and press the "Enter" button.
  • A message will pop up that says you successfully unregistered the file.
Trojan Manual Removal From Registry
Click Start, Run,Type regedit,Click OK.
  • Note: If the registry editor fails to open the threat may have modified the registry to prevent access to the registry editor.
    • Download and run this UnHookExec.inf, and then continue with the removal.
    • Save it to your Windows desktop. Do not run it at this time, download it only.
    • After booting into the Safe Mode or VGA Mode
    • Right-click the UnHookExec.inf file and click Install. [This is a small file. It does not display any notice or boxes when you run it.]
The Trojan modifies registry at the following locations to ensure its automatic execution at every system startup:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
[ Do Not Delete the Services Folder instead remove the System Antivirus Service Entry ]
HKEY_CLASSES_ROOT\.key
HKEY_CURRENT_USER\Software\AntiVirus
HKEY_CURRENT_USER\Software\SAV
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
"Antivirus"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
"Antivirus"
Search Registry For Virus File Names listed above to remove completely,
Edit Menu - Find, enter Keyword and remove all value that find in search.

Exit the Registry Editor,
Restart your Computer.

Recommended Removal Tools:
Killbox (Freeware)
By at No comments

More Posts that you may be interested...