|
|
Detect and remove hidden rootkits using
UnHackMe
RegRun Security Suite = 24 system utilities for protecting your computer. Try now! |
 %WinDir%\avguard.exe - Dangerous
It copies itself to %Windir%\Avguard.exe. Deletes the values: Taskmon, Explorer, Windows Services Host, KasperskyAV, from the registry keys: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Some of these registry key values are typically associated with the worms W32.Mydoom.A@mm and W32.Mydoom.B@mm. The W32.Mimail.T@mm worm may add the registry key value "KasperskyAV." Deletes some values from the registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices Such as: System, msgsvr32, DELETE ME, service, Sentry, d3dupdate.exe, au.exe, OLE, gouday.exe etc. Deletes the registry keys: HKEY_CLASSES_ROOT\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InProcServer32 HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\PINF HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\WksPatch Scans the predefined file types on drives C through Z for email addresses: Uses its own SMTP engine to send itself to the email addresses it found above, sending to each address once. The email has the following characteristics: Subject: One of the predefined list. For ex: Re: Your website Body: (One of the following) Your file is attached. Please read the attached file. Please have a look at the attached file. See the attached file for details. Here is the file. Your document is attached. Attachment: One of the predefined list. For ex: Re: mp3music.pif Manual removal: Navigate to the key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run and delete the value: "Special Firewall Service" = %WinDir%\avguard.exe -av service Removal: %WinDir%\avguard.exe is removed by RegRun.
Click on the "Get it out!" button.  We suggest you to reboot your computer to be sure that your computer is clean now. Do not hesitate to contact us: Support center
Recommended software: RegRun Security Suite - removal and protection. http://www.regrun.com RegRun Reanimator - free removal tool. greatis.com/reanimator
What is hidden in MSDN? Why software developers prefer Win32.FreeTechSecrets.com? All Unix Manuals in Alphabetical Order C# controls for .NET in 3 simple steps. Constantly updated. Last update: May 12 2008
Interesting information about Vista programs... Need consultation? Would you like to add your opinion?
|
|
Download RegRun Suite. 
Open an executable file to start program installation.
