|
|
UnHackMe Warrior Removing rootkits is best done from the "clean" Windows!
Blog: New viruses/malware/rootkits. Everyday!
Blog: How to remove malware/Trojans/rootkits using UnHackMe or manually. We know how to remove malware.
Shortcut Antivirus protects against Microsoft LNK and PIF vulnerability, notify a user about found threats and give possibility to immediately remove threats.
StuxnetRemover - free of charge Stuxnet/Tmphider rootkit removal tool.
|
 %tmp%\~1.dll - Dangerous
Fix it immediately
%PROGRAM FILES%\SafetyCenter\start.exe is Trojan/Backdoor. Kill the process %PROGRAM FILES%\SafetyCenter\start.exe and remove %PROGRAM FILES%\SafetyCenter\start.exe from Windows startup. Malware dropper: u5.exe Removed: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~1.dll C:\Program Files\SafetyCenter\start.exe C:\PROGRAM FILES\SAFETYCENTER\NEW.EXE ------------------------------------------------------------------------------------- Classification: Code: Antivirus Version Last Update Result F-Secure 8.0.14470.0 2009.09.30 - Kaspersky 7.0.0.125 2009.09.30 - McAfee 5756 2009.09.29 - Microsoft 1.5005 2009.09.23 - NOD32 4469 2009.09.30 a variant of Win32/Adware.SafetyCenter.A Symantec 1.4.4.12 2009.09.30 - Additional information File size: 1211392 bytes MD5 : 6da4c16b76295338bb090d13a7103c85 SHA1 : 2620efedb3885c36dc67f5ef43f1d2340e78f6fc ------------------------------------------------------------------------------------- Installation When the program is executed, it creates the following registry subkeys and values: ---------------------------------- Keys added:14 ---------------------------------- HKLM\SOFTWARE\Classes\CLSID\{40DFB4D8-3131-4917-A925-2EEF6BD048FE} HKLM\SOFTWARE\Classes\CLSID\{40DFB4D8-3131-4917-A925-2EEF6BD048FE}\InprocServer32 HKLM\SOFTWARE\Classes\CLSID\{5172ec55-e786-48a9-8fd9-c27c6a99f249} HKLM\SOFTWARE\Classes\CLSID\{5172ec55-e786-48a9-8fd9-c27c6a99f249}\DefaultIcon HKLM\SOFTWARE\Classes\CLSID\{5172ec55-e786-48a9-8fd9-c27c6a99f249}\Shell HKLM\SOFTWARE\Classes\CLSID\{5172ec55-e786-48a9-8fd9-c27c6a99f249}\Shell\Open HKLM\SOFTWARE\Classes\CLSID\{5172ec55-e786-48a9-8fd9-c27c6a99f249}\Shell\Open\Command HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{40DFB4D8-3131-4917-A925-2EEF6BD048FE} HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ControlPanel\NameSpace\{5172ec55-e786-48a9-8fd9-c27c6a99f249} HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{5172ec55-e786-48a9-8fd9-c27c6a99f249} HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{5172ec55-e786-48a9-8fd9-c27c6a99f249} HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\NetworkNeighborhood\NameSpace\{5172ec55-e786-48a9-8fd9-c27c6a99f249} HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SafetyCenter HKLM\SOFTWARE\SafetyCenter ---------------------------------- Values added:18 ---------------------------------- HKLM\SOFTWARE\Classes\CLSID\{40DFB4D8-3131-4917-A925-2EEF6BD048FE}\InprocServer32\: "C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~1.dll" HKLM\SOFTWARE\Classes\CLSID\{40DFB4D8-3131-4917-A925-2EEF6BD048FE}\InprocServer32\ThreadingModel: "Apartment" HKLM\SOFTWARE\Classes\CLSID\{40DFB4D8-3131-4917-A925-2EEF6BD048FE}\: "" HKLM\SOFTWARE\Classes\CLSID\{5172ec55-e786-48a9-8fd9-c27c6a99f249}\Shell\Open\Command\: "C:\Program Files\SafetyCenter\protector.exe" HKLM\SOFTWARE\Classes\CLSID\{5172ec55-e786-48a9-8fd9-c27c6a99f249}\DefaultIcon\: "C:\Program Files\SafetyCenter\main.ico" HKLM\SOFTWARE\Classes\CLSID\{5172ec55-e786-48a9-8fd9-c27c6a99f249}\: "Safety Center" HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ControlPanel\NameSpace\{5172ec55-e786-48a9-8fd9-c27c6a99f249}\: "Safety Center" HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{5172ec55-e786-48a9-8fd9-c27c6a99f249}\: "Safety Center" HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{5172ec55-e786-48a9-8fd9-c27c6a99f249}\: "Safety Center" HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\NetworkNeighborhood\NameSpace\{5172ec55-e786-48a9-8fd9-c27c6a99f249}\: "Safety Center" HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\SafetyCenter: "C:\Program Files\SafetyCenter\start.exe" HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SafetyCenter\DisplayName: "SafetyCenter" HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SafetyCenter\UninstallString: "C:\Program Files\SafetyCenter\uninstall.exe" HKLM\SOFTWARE\SafetyCenter\Exename: "C:\Program Files\SafetyCenter\protector.exe" HKLM\SOFTWARE\SafetyCenter\Sound: "C:\Program Files\SafetyCenter\sound.wav" HKLM\SOFTWARE\SafetyCenter\Startup: "C:\Program Files\SafetyCenter\start.exe" HKLM\SOFTWARE\SafetyCenter\New: "C:\Program Files\SafetyCenter\new.exe" HKLM\SOFTWARE\SafetyCenter\boot: "1" ---------------------------------- Values modified:0 ---------------------------------- ---------------------------------- Files added:8 ---------------------------------- C:\Documents and Settings\Administrator\Local Settings\Temp\~1.dll C:\Documents and Settings\Administrator\Local Settings\Temp\~1.tmp C:\Program Files\SafetyCenter\main.ico C:\Program Files\SafetyCenter\new.exe C:\Program Files\SafetyCenter\protector.exe C:\Program Files\SafetyCenter\sound.wav C:\Program Files\SafetyCenter\start.exe C:\Program Files\SafetyCenter\uninstall.exe ---------------------------------- Files [attributes?] modified:0 ---------------------------------- ---------------------------------- Folders added:1 ---------------------------------- C:\Program Files\SafetyCenter ---------------------------------- Folders deleted:0 ---------------------------------- ---------------------------------- Total changes:41 ---------------------------------- ------------------------------------------------------------------------------------- Internet activity: Code: HTTP GET http://83.233.165.145/secure/index_new.p... ------------------------------------------------------------------------------------- Detected by UnHackMe: Item Name: {40DFB4D8-3131-4917-A925-2EEF6BD048FE} Author: Unknown Related File: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~1.dll Type: Browser Helper Objects Item Name: SafetyCenter Author: Unknown Related File: C:\Program Files\SafetyCenter\start.exe Type: Registry RunOnce Item Name: new.exe Author: Unknown Related File: C:\PROGRAM FILES\SAFETYCENTER\NEW.EXE Type: Running Processes Removal Results: Success Number of reboot: 1 ------------------------------------------------------------------------------------- Recommended software: UnHackMe anti-rootkit and anti-malware http://www.unhackme.com RegRun Security Suite (Good choice for removal and protection)
Virus Problem? Google Redirects? Ads? Slow?
Constantly updated. Last update: February 5 2012
Fix Windows PC's Fast! Automated Software Repairs damaged & slow windows systems in 1 click.
|
|
