drvsys.exe - Dangerous
drvsys.exe
Jeff's Story:
My PC had gotten a bad rootkit that my ISP antivirus software (powered by McAfee) could not detect, nor could fix.
I sought a solution on the Internet and discovered your product and tried out the trial.
You quickly found the rootkit and SAVED my PC!
I haven't had any problems since, and I'm extremely grateful.
Manual removal instructions:
This worm spreads via the Internet as an attachment to infected messages.
Characteristics of infected messages
Sender's address (chosen at random from the following):
Message header (chosen at random from the following):
Message body:
There is a wide range of possible message texts.
Attachment name:
Random, with one of the following extensions: .exe .com .scr .cpl. hta .vbs .zip
The worm searches the system register for keys created by other worms (e.g. Netsky) and deletes them.
The worm also attempts to connect to a range of remote sites, and to save information about the victim computer on these sites.
The worm searches the computer for files and sends itself to all email addresses found in these files.
It uses its own SMTP-server to send messages.
The worm attempts to combat antivirus programs and firewalls by terminating memory processes.
Manual removal:
Delete the value "drvsys.exe" = "%system%\drvsys.exe"
in the system registry autorun key: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run