\avpu32.sys" HKLM\SYSTEM\CurrentControlSet\Services\avpu32 DisplayName "TCPIP Kernel32" HKLM\SYSTEM\CurrentControlSet\Services\avpu32\Security Security HKLM\SYSTEM\CurrentControlSet\Services\avpu64 Type dword:00000001 HKLM\SYSTEM\CurrentControlSet\Services\avpu64 Start dword:00000001 HKLM\SYSTEM\CurrentControlSet\Services\avpu64 ErrorControl dword:00000000 HKLM\SYSTEM\CurrentControlSet\Services\avpu64 ImagePath "\avpu64.sys" HKLM\SYSTEM\CurrentControlSet\Services\avpu64 DisplayName "TCPIP Kernel" ">

avpu64.sys - Dangerous

%sysdir%\avpu64.sys

Jeff's Story:

My PC had gotten a bad rootkit that my ISP antivirus software (powered by McAfee) could not detect, nor could fix.

I sought a solution on the Internet and discovered your product and tried out the trial.

You quickly found the rootkit and SAVED my PC!

I haven't had any problems since, and I'm extremely grateful.

Free Download

Manual removal instructions:

%sysdir%\avpu64.sys
avpu64.sys is rootkit Trojan.Haxdoor-ED.
avpu64.sys is used to hide files, processes and registry.
avpu64.sys is a kernel mode rootkit.
Rootkit creates new system drivers.
Rootkit contacts remote hacker server using HTTP session.
avpu64.sys tries to terminate antiviral programs installed on a user computer.
avpu64.sys monitors user Internet activity and private information.
It sends stolen data to a hacker site.

Related files:
%SysDir%\avpu32.dll
%SysDir%\avpu32.sys
%SysDir%\avpu64.sys
%SysDir%\klogini.dll
%SysDir%\p3.ini
%SysDir%\qy.sys
%SysDir%\qz.dll
%SysDir%\qz.sys
Added to registry:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\avpu32
secureUID

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\avpu32
secureTIME

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\avpu32
DllName
avpu32.dll

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\avpu32
Startup
"MmAllocMap"

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\avpu32
Impersonate
dword:00000001

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\avpu32
Asynchronous
dword:00000001

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\avpu32
MaxWait
dword:00000001

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\avpu32.sys
(default)
"Driver"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\avpu64.sys
(default)
"Driver"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\avpu32.sys
(default)
"Driver"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\avpu64.sys
(default)
"Driver"

HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management
EnforceWriteProtection
dword:00000000

HKLM\SYSTEM\CurrentControlSet\Services\avpu32
Type
dword:00000001

HKLM\SYSTEM\CurrentControlSet\Services\avpu32
Start
dword:00000002

HKLM\SYSTEM\CurrentControlSet\Services\avpu32
ErrorControl
dword:00000000

HKLM\SYSTEM\CurrentControlSet\Services\avpu32
ImagePath
"\avpu32.sys"

HKLM\SYSTEM\CurrentControlSet\Services\avpu32
DisplayName
"TCPIP Kernel32"

HKLM\SYSTEM\CurrentControlSet\Services\avpu32\Security
Security

HKLM\SYSTEM\CurrentControlSet\Services\avpu64
Type
dword:00000001

HKLM\SYSTEM\CurrentControlSet\Services\avpu64
Start
dword:00000001

HKLM\SYSTEM\CurrentControlSet\Services\avpu64
ErrorControl
dword:00000000

HKLM\SYSTEM\CurrentControlSet\Services\avpu64
ImagePath
"\avpu64.sys"

HKLM\SYSTEM\CurrentControlSet\Services\avpu64
DisplayName
"TCPIP Kernel"

Remove avpu64.sys now!