atmon.exe - Dangerous
%sysdir%\atmon.exe
Jeff's Story:
My PC had gotten a bad rootkit that my ISP antivirus software (powered by McAfee) could not detect, nor could fix.
I sought a solution on the Internet and discovered your product and tried out the trial.
You quickly found the rootkit and SAVED my PC!
I haven't had any problems since, and I'm extremely grateful.
Manual removal instructions:
Atmon.exe is a Browser Helper Object.
Atmon.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Windir%\Downloaded Program Files\load.exe
%Windir%\Downloaded Program Files\monpop.exe
%Windir%\Downloaded Program Files\pop225.dll
%Windir%\Downloaded Program Files\pophook4.dll
%Windir%\Downloaded Program Files\PopSrv225.exe
%Temp%\auto_update_loader.exe
%Temp%\install_ct.exe
%Temp%\CXtPls.exe
%Temp%\ProxyStub.dll
%Temp%\WinGenerics.dll
%Temp%\ace.dll
%Temp%\atla.dll
%Temp%\atlw.dll
%Temp%\data.bin
%Temp%\libexpat.dll
%Temp%\ph.exe
%Temp%\pm.exe
%Temp%\setup.inf
%Temp%\uninstaller.exe
%Temp%\atl.dll
%System%\atmon.exe
%System%\intfaxui.exe
Adds the value:
"POP" = "C:\WINDOWS\Downloaded Program Files\PopSrv225.exe"
"AutoLoaderEnvoloAutoUpdater" = "auto_update_loader.exe"
"[random name]" = "intfaxui.exe"
"[random name]" = "atmon.exe"
to the Windows startup registry keys.
Removal:
Kill atmon.exe process and remove atmon.exe from Windows startup.