|
|
Malware Tests - removal of the newest malware.
Detect and remove hidden rootkits using
UnHackMe
RegRun Security Suite = 24 system utilities for protecting your computer. Get it! |
 0ssruqj8.dll - Dangerous
0sSrUqJ8.dll is Trojan/Backdoor. Kill the file 0sSrUqJ8.dll and remove 0sSrUqJ8.dll from Windows startup. File: c:\sand-box\2.exe Classification: Antivirus Version Last Update Result Avast 4.8.1335.0 2009.06.18 Win32:Cdur AVG 8.5.0.339 2009.06.18 BackDoor.Generic10.ALBY BitDefender 7.2 2009.06.19 Trojan.Generic.1273471 Comodo 1368 2009.06.19 TrojWare.Win32.Trojan.Agent. Gen DrWeb 5.0.0.12182 2009.06.18 DLOADER.Trojan F-Secure 8.0.14470.0 2009.06.18 Trojan.Win32.CDur.crh K7AntiVirus 7.10.766 2009.06.17 Trojan.Win32.Malware.1 Microsoft 1.4701 2009.06.19 Backdoor:Win32/Poison.Y NOD32 4169 2009.06.19 Win32/Prosti.NBO Symantec 1.4.4.12 2009.06.19 Trojan.Dropper Additional information File size: 180494 bytes MD5 : 125359b9ea3b296f4f61cf7ced134d04 SHA1 : 9916f31f97f38101882bdfbb17f39c9f45c3817d Installation When the program is executed, it creates the following registry subkeys and values: ---------------------------------- Keys added:5 ---------------------------------- HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_TELNETS HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_TELNETS\0000 HKLM\SYSTEM\CurrentControlSet\Services\telnets HKLM\SYSTEM\CurrentControlSet\Services\telnets\Parameters HKLM\SYSTEM\CurrentControlSet\Services\telnets\Security ---------------------------------- Values added:16 ---------------------------------- HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_TELNETS\0000\Service: "telnets" HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_TELNETS\0000\Legacy: 0x00000001 HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_TELNETS\0000\ConfigFlags: 0x00000000 HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_TELNETS\0000\Class: "LegacyDriver" HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_TELNETS\0000\ClassGUID: "{8ECC055D-047F-11D1-A537-0000F8753ED1}" HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_TELNETS\0000\DeviceDesc: "telnets" HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_TELNETS\NextInstance: 0x00000001 HKLM\SYSTEM\CurrentControlSet\Services\telnets\Security\Security: 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 00 01 02 00 00 00 00 00 05 20 00 00 00 20 02 00 00 00 00 14 00 8D 01 02 00 01 01 00 00 00 00 00 05 0B 00 00 00 00 00 18 00 FD 01 02 00 01 02 00 00 00 00 00 05 20 00 00 00 23 02 00 00 01 01 00 00 00 00 00 05 12 00 00 00 01 01 00 00 00 00 00 05 12 00 00 00 HKLM\SYSTEM\CurrentControlSet\Services\telnets\Parameters\ServiceDLL: "%SystemRoot%\0sSrUqJ8.dll" HKLM\SYSTEM\CurrentControlSet\Services\telnets\Type: 0x00000110 HKLM\SYSTEM\CurrentControlSet\Services\telnets\Start: 0x00000002 HKLM\SYSTEM\CurrentControlSet\Services\telnets\ErrorControl: 0x00000000 HKLM\SYSTEM\CurrentControlSet\Services\telnets\ImagePath: "%SystemRoot%\System32\svchost.exe -k netsvcs" HKLM\SYSTEM\CurrentControlSet\Services\telnets\DisplayName: "telnets" HKLM\SYSTEM\CurrentControlSet\Services\telnets\ObjectName: "LocalSystem" HKLM\SYSTEM\CurrentControlSet\Services\telnets\Description: "telnets" ---------------------------------- Values modified:2 ---------------------------------- HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\netsvcs: '6to4 AppMgmt AudioSrv Browser CryptSvc DMServer DHCP ERSvc EventSystem FastUserSwitchingCompatibility HidServ Ias Iprip Irmon LanmanServer LanmanWorkstation Messenger Netman Nla Ntmssvc NWCWorkstation Nwsapagent Rasauto Rasman Remoteaccess Schedule Seclogon SENS Sharedaccess SRService Tapisrv Themes TrkWks W32Time WZCSVC Wmi WmdmPmSp winmgmt wscsvc xmlprov napagent hkmsvc BITS wuauserv ShellHWDetection helpsvc WmdmPmSN' HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\netsvcs: '6to4 AppMgmt AudioSrv Browser CryptSvc DMServer DHCP ERSvc EventSystem FastUserSwitchingCompatibility HidServ Ias Iprip Irmon LanmanServer LanmanWorkstation Messenger Netman Nla Ntmssvc NWCWorkstation Nwsapagent Rasauto Rasman Remoteaccess Schedule Seclogon SENS Sharedaccess SRService Tapisrv Themes TrkWks W32Time WZCSVC Wmi WmdmPmSp winmgmt wscsvc xmlprov napagent hkmsvc BITS wuauserv ShellHWDetection helpsvc WmdmPmSN telnets' ---------------------------------- Files added:3 ---------------------------------- C:\WINDOWS\system32\0sSrUqJ8.dll C:\WINDOWS\system32\3s6Ef0eSOU.del C:\WINDOWS\system32\3s6Ef0eSOU.ini ---------------------------------- Files [attributes?] modified:0 ---------------------------------- ---------------------------------- Folders added:0 ---------------------------------- ---------------------------------- Folders deleted:0 ---------------------------------- ---------------------------------- Total changes:26 ---------------------------------- ------------------------------------------------------------------------------------- Detected by RegRun Reanimator: Type: Svchost DLLs Item Name: telnets Related File: %SystemRoot%\0sSrUqJ8.dll Removal Results: Success Number of reboot: 1 Removal: 0ssruqj8.dll is removed by RegRun.
Read more... Removal instructions...
UnHackMe - Rootkit/Malware killer
Also recommended software: UnHackMe is a part of RegRun Security Suite Platinum.
What is hidden in MSDN? Why software developers prefer Win32.FreeTechSecrets.com? All Unix Manuals in Alphabetical Order C# controls for .NET in 3 simple steps. Constantly updated. Last update: November 16 2009
Interesting information about Vista programs... Need consultation? Would you like to add your opinion?
|
|
