|
|
UnHackMe Warrior Removing rootkits is best done from the "clean" Windows!
Blog: New viruses/malware/rootkits. Everyday!
Blog: How to remove malware/Trojans/rootkits using UnHackMe or manually. We know how to remove malware.
Shortcut Antivirus protects against Microsoft LNK and PIF vulnerability, notify a user about found threats and give possibility to immediately remove threats.
StuxnetRemover - free of charge Stuxnet/Tmphider rootkit removal tool.
|
 1578696e.sys - Dangerous
Fix it immediately
WNZIP32.EXE is Trojan/Backdoor. Kill the process WNZIP32.EXE and remove WNZIP32.EXE from Windows startup. Malware dropper: C:\sand-box\IC.exe Removed: C:\RECYCLER\S-1-5-21-8391779261-4920982649-599871515-4456\WNZIP32.EXE \SystemRoot\System32\drivers\1578696e.sys ------------------------------------------------------------------------------------- Classification: Code: Antivirus Version Last Update Result Avast 4.8.1351.0 2009.09.08 - AVG 8.5.0.409 2009.09.08 Generic14.AOCB BitDefender 7.2 2009.09.08 Trojan.Generic.CJ.OCO Comodo 2204 2009.09.08 - DrWeb 5.0.0.12182 2009.09.08 Win32.HLLW.Autoruner.7153 F-Secure 8.0.14470.0 2009.09.08 Trojan-Downloader.Win32.Small.kep Kaspersky 7.0.0.125 2009.09.08 Trojan-Downloader.Win32.Small.kep Microsoft 1.5005 2009.09.08 - NOD32 4407 2009.09.08 Win32/TrojanDownloader.Small.OOT Symantec 1.4.4.12 2009.09.08 Trojan Horse Additional information File size: 11776 bytes MD5 : 2411929f09080cb6eb98db400a1a9d77 SHA1 : 95dc909be3a4d43a52c59480b9e36556c7a7baae ------------------------------------------------------------------------------------- Installation When the program is executed, it creates the following registry subkeys and values: ---------------------------------- Keys added:5 ---------------------------------- HKLM\SOFTWARE\Classes\.key HKLM\SOFTWARE\Microsoft\RFC1156Agent HKLM\SOFTWARE\Microsoft\RFC1156Agent\CurrentVersion HKLM\SOFTWARE\Microsoft\RFC1156Agent\CurrentVersion\Parameters HKLM\SYSTEM\CurrentControlSet\Services\1578696e ---------------------------------- Values added:7 ---------------------------------- HKLM\SOFTWARE\Classes\.key\: "regfile" HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman: "C:\RECYCLER\S-1-5-21-8391779261-4920982649-599871515-4456\wnzip32.exe" HKLM\SOFTWARE\Microsoft\RFC1156Agent\CurrentVersion\Parameters\TrapPollTimeMilliSecs: 0x00003A98 HKLM\SYSTEM\CurrentControlSet\Services\1578696e\ImagePath: "\SystemRoot\System32\drivers\1578696e.sys" HKLM\SYSTEM\CurrentControlSet\Services\1578696e\Type: 0x00000001 HKLM\SYSTEM\CurrentControlSet\Services\1578696e\Start: 0x00000001 HKLM\SYSTEM\CurrentControlSet\Services\1578696e\ErrorControl: 0x00000001 ---------------------------------- Values modified:0 ---------------------------------- ---------------------------------- Files added:5 ---------------------------------- C:\Documents and Settings\Administrator\Local Settings\Temp\2.tmp C:\RECYCLER\S-1-5-21-8391779261-4920982649-599871515-4456\Desktop.ini C:\RECYCLER\S-1-5-21-8391779261-4920982649-599871515-4456\wnzip32.exe C:\WINDOWS\system32\drivers\1578696e.sys C:\euewf.exe ---------------------------------- Files deleted:1 ---------------------------------- C:\sand-box\IC.exe ---------------------------------- Files [attributes?] modified:0 ---------------------------------- ---------------------------------- Folders added:1 ---------------------------------- C:\RECYCLER\S-1-5-21-8391779261-4920982649-599871515-4456 ---------------------------------- Folders deleted:0 ---------------------------------- ---------------------------------- Folders attributes changed:1 ---------------------------------- C:\RECYCLER ---------------------------------- Total changes:20 ---------------------------------- ------------------------------------------------------------------------------------- Internet activity: Code: HTTP GET http://abonlinelive.com/progs/jhnrrff/sc... HTTP GET http://abonlinelive.com/progs/jhnrrff/zj... HTTP GET http://abonlinelive.com/progs/jhnrrff/ek... HTTP GET http://abonlinelive.com/progs/jhnrrff/qj... HTTP GET http://abonlinelive.com/progs/jhnrrff/zw... HTTP GET http://abonlinelive.com/uniq.php?id=-140... HTTP GET http://abonlinelive.com/progs/jhnrrff/ag... HTTP GET http://abonlinelive.com/progs/jhnrrff/xd... HTTP POST http://myart-gallery.com/senm.php?data=v... HTTP POST http://yourkoarts.com/senm.php?data=v22M... HTTP POST http://bestartcollection.com/senm.php?da... HTTP GET http://abonlinelive.com/progs/jhnrrff/cl... HTTP GET http://abonlinelive.com/progs/jhnrrff/ro... ------------------------------------------------------------------------------------- Detected by RegRun Reanimator: Item Name: wnzip32.exe Author: Unknown Related File: C:\RECYCLER\S-1-5-21-8391779261-4920982649-599871515-4456\WNZIP32.EXE Type: Running Processes After first reboot detected by RegRun Reanimator: Item Name: 1578696e Author: Related File: \SystemRoot\System32\drivers\1578696e.sys Type: Services detected by Partizan Removal Results: Success Number of reboot: 1 ------------------------------------------------------------------------------------- Recommended software: UnHackMe anti-rootkit and anti-malware http://www.unhackme.com RegRun Security Suite (Good choice for removal and protection)
Virus Problem? Google Redirects? Ads? Slow?
Constantly updated. Last update: February 5 2012
Fix Windows PC's Fast! Automated Software Repairs damaged & slow windows systems in 1 click.
|
|
