msfsr.sys - Dangerous
%sysdir%\msfsr.sys
Jeff's Story:
My PC had gotten a bad rootkit that my ISP antivirus software (powered by McAfee) could not detect, nor could fix.
I sought a solution on the Internet and discovered your product and tried out the trial.
You quickly found the rootkit and SAVED my PC!
I haven't had any problems since, and I'm extremely grateful.
Manual removal instructions:
msfsr.sys is used to hide files, processes and registry.
msfsr.sy sis a kernel mode rootkit.
msfsr.sys spreads by e-mail and via open network shares.
msfsr.sys tries to terminate antiviral programs installed on a user computer.
Related files:
%WinDir\lsass.exe
%Program Files%\Internet Explorer\iexplore.exe
%SysDir%\dllcache\svchost.exe
%WinDir%\svchost.exe
%System%\drivers\
%System%\msfsr.sys
\zyxwvuts.log
msfsr.sys is created new system drivers:
service name: " msfsr"
display name: " msfsr"
Added to registry:
HKLM\SYSTEM\CurrentControlSet\Services\msfsr
Adds the value:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Shell
explorer.exe %WindDir%\lsass.exe
HKLM\SYSTEM\CurrentControlSet\Services\wuauserv
Start
3
to the Windows startup registry keys.
Added to registry:
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\
Parameters\FirewallPolicy
StandardProfile\AuthorizedApplications\List