aa29.exe - Dangerous
aa29.exe
Manual removal instructions:
Antivirus Report of aa29.exe:
aa29.exe
We suggest you to remove aa29.exe from your computer as soon as possible.
Aa29.exe is Trojan/Backdoor.
Kill the process aa29.exe and remove aa29.exe from Windows startup.
Classification:
Antivirus Version Last Update Result
Avast 4.8.1335.0 2009.06.11 Win32:Agent-ACMH
AVG 8.5.0.339 2009.06.11 PSW.OnlineGames3.FWC
BitDefender 7.2 2009.06.12 Generic.Onlinegames.14.
8CB1D663
DrWeb 5.0.0.12182 2009.06.12 Trojan.PWS.Wsgame.12056
F-Secure 8.0.14470.0 2009.06.12 Trojan-GameThief.Win32.Magania.bfrp
NOD32 4149 2009.06.11 probably a variant of Win32/PSW.OnLineGames.NRD
Symantec 1.4.4.12 2009.06.12 Infostealer.Gampass
Additional information
File size: 24192 bytes
MD5 : ed2f3e779672d8e96e032a412b49e298
SHA1 : d71d8f54c39ebc2bb8081e49c1ed992308795bb8
Installation
When the program is executed, it creates the following registry subkeys and values:
----------------------------------
Keys added:2
----------------------------------
HKLM\SOFTWARE\Classes\CLSID\{4679E74B-E5EE-458F-B613-2324AA1C817E}
HKLM\SOFTWARE\Classes\CLSID\{4679E74B-E5EE-458F-B613-2324AA1C817E}\InprocServer32
----------------------------------
Values added:3
----------------------------------
HKLM\SOFTWARE\Classes\CLSID\{4679E74B-E5EE-458F-B613-2324AA1C817E}\InprocServer32\: "C:\WINDOWS\system32\mR7Sg4vSx5TR.dll"
HKLM\SOFTWARE\Classes\CLSID\{4679E74B-E5EE-458F-B613-2324AA1C817E}\InprocServer32\ThreadingModel: "Apartment"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{4679E74B-E5EE-458F-B613-2324AA1C817E}: ""
----------------------------------
Values modified:0
----------------------------------
----------------------------------
Files deleted:2
----------------------------------
C:\sand-box\aa29.exe
C:\WINDOWS\system32\verclsid.exe
----------------------------------
Files [attributes?] modified:0
----------------------------------
----------------------------------
Folders added:0
----------------------------------
----------------------------------
Folders deleted:0
----------------------------------
----------------------------------
Total changes:7
----------------------------------
-------------------------------------------------------------------------------------
Detected by RegRun Reanimator:
Type: Shell Execute Hooks
Item Name: 4679E74B-E5EE-458F-B613-2324AA1C817E
Related File: C:\WINDOWS\system32\mR7Sg4vSx5TR.dll
Removal Results: Success
Number of reboot: 1
| aa29.exe | Malware |
| aa29.exe | Dangerous |
| aa29.exe | High Risk |
Aa29.exe is Trojan/Backdoor.
Kill the process aa29.exe and remove aa29.exe from Windows startup.
Classification:
Antivirus Version Last Update Result
Avast 4.8.1335.0 2009.06.11 Win32:Agent-ACMH
AVG 8.5.0.339 2009.06.11 PSW.OnlineGames3.FWC
BitDefender 7.2 2009.06.12 Generic.Onlinegames.14.
8CB1D663
DrWeb 5.0.0.12182 2009.06.12 Trojan.PWS.Wsgame.12056
F-Secure 8.0.14470.0 2009.06.12 Trojan-GameThief.Win32.Magania.bfrp
NOD32 4149 2009.06.11 probably a variant of Win32/PSW.OnLineGames.NRD
Symantec 1.4.4.12 2009.06.12 Infostealer.Gampass
Additional information
File size: 24192 bytes
MD5 : ed2f3e779672d8e96e032a412b49e298
SHA1 : d71d8f54c39ebc2bb8081e49c1ed992308795bb8
Installation
When the program is executed, it creates the following registry subkeys and values:
----------------------------------
Keys added:2
----------------------------------
HKLM\SOFTWARE\Classes\CLSID\{4679E74B-E5EE-458F-B613-2324AA1C817E}
HKLM\SOFTWARE\Classes\CLSID\{4679E74B-E5EE-458F-B613-2324AA1C817E}\InprocServer32
----------------------------------
Values added:3
----------------------------------
HKLM\SOFTWARE\Classes\CLSID\{4679E74B-E5EE-458F-B613-2324AA1C817E}\InprocServer32\: "C:\WINDOWS\system32\mR7Sg4vSx5TR.dll"
HKLM\SOFTWARE\Classes\CLSID\{4679E74B-E5EE-458F-B613-2324AA1C817E}\InprocServer32\ThreadingModel: "Apartment"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{4679E74B-E5EE-458F-B613-2324AA1C817E}: ""
----------------------------------
Values modified:0
----------------------------------
----------------------------------
Files deleted:2
----------------------------------
C:\sand-box\aa29.exe
C:\WINDOWS\system32\verclsid.exe
----------------------------------
Files [attributes?] modified:0
----------------------------------
----------------------------------
Folders added:0
----------------------------------
----------------------------------
Folders deleted:0
----------------------------------
----------------------------------
Total changes:7
----------------------------------
-------------------------------------------------------------------------------------
Detected by RegRun Reanimator:
Type: Shell Execute Hooks
Item Name: 4679E74B-E5EE-458F-B613-2324AA1C817E
Related File: C:\WINDOWS\system32\mR7Sg4vSx5TR.dll
Removal Results: Success
Number of reboot: 1
Dmitry Sokolov:
I created UnHackMe in 2006 to fix the problem that antivioruses did not fix: detecting rootkits.
Since that time I work every day to fix the issues that antiviruses cannot.
If your antivirus have not helped you solve the problem, you should try UnHackMe.
We are a small company and you can ask me directly, if you have any questions.