dr.exe - Dangerous
%windir%\dr.exe
Jeff's Story:
My PC had gotten a bad rootkit that my ISP antivirus software (powered by McAfee) could not detect, nor could fix.
I sought a solution on the Internet and discovered your product and tried out the trial.
You quickly found the rootkit and SAVED my PC!
I haven't had any problems since, and I'm extremely grateful.
Manual removal instructions:
Dr.exe spreads via open network shares.
Related files:
C:\Note.exe
%System%\Hid.exe
%System%\Explorer.dll
%System%\Iexplore.dll
%Windir%\Aim.dll
%Windir%\Boot.exe
%Windir%\C.dll
%Windir%\Crazy.exe
%Windir%\Dr.exe
%Windir%\Empavms.exe
%Windir%\Ipservers.dll
%Windir%\Java.dll
%Windir%\LibParse.exe
%Windir%\Lsass.exe
%Windir%\Miconfig.exe
%Windir%\Moo.dll
%Windir%\Msccl.dll
%Windir%\Msconig.exe
%Windir%\Nhtml.dll
%Windir%\Ratsou.exe
%Windir%\Regedit.dll
%Windir%\Restart.exe
%Windir%\Screen.dll
%Windir%\Sysboot.dll
%Windir%\Syste32.dll
%Windir%\Users.dll
%Windir%\Wind.dll
Adds the value:
"HID.EXE"="%System%\HID.EXE"
"lsass"="%Windir%\Debug\UserMode\lsass.exe"
to the Windows startup registry keys.
Removal:
Kill Dr.exe process and remove Dr.exe from Windows startup.