eletronico.exe - Dangerous

Application database

Startupapps.com recommends you:

Malware Tests - removal of the newest malware.

Detect and remove hidden rootkits using UnHackMe Free fully functional 30-days trial.

RegRun Security Suite = 24 system utilities for protecting your computer. Get it!

I would like to say that RegRun has helped me on more than 1 occasion when it comes to spyware/adware by letting me know automatically that a piece of it got added to Windows startup. There is so much spyware/addware out there today it's hard to imagine being without RegRun. I like many other features too including the daily registry backups and file protection.

Chris Wagers

eletronico.exe - Dangerous

eletronico.exe

We suggest you to remove DNT.SYS from your computer as soon as possible.
DNT.SYS is Trojan/Backdoor.
Kill the file DNT.SYS and remove DNT.SYS from Windows startup.

File: eletronico.exe
Classification:
Antivirus Version Last Update Result
Avast 4.8.1335.0 2009.08.02 -
AVG 8.5.0.406 2009.08.02 -
BitDefender 7.2 2009.08.03 Gen:Trojan.Heur.@hZ@rjKqUIpGh
Comodo 1847 2009.08.03 -
DrWeb 5.0.0.12182 2009.08.03 -
F-Secure 8.0.14470.0 2009.08.03 Trojan-Banker.Win32.Banker.etk
Kaspersky 7.0.0.125 2009.08.03 Trojan-Banker.Win32.Banker.etk
Microsoft 1.4903 2009.08.03 -
NOD32 4299 2009.08.02 a variant of Win32/Spy.Banker.QEP
Symantec 1.4.4.12 2009.08.03 -

File size: 4245776 bytes
MD5...: ac8f6fe8c008b2d948e6e2e67f7414a2
SHA1..: c05279bdf5b06b1f52fe1acde1d36ee1c8d04b0e

Installation
When the program is executed, it creates the following registry subkeys and values:

----------------------------------
Keys deleted:0
----------------------------------

----------------------------------
Keys added:3
----------------------------------
HKLM\SYSTEM\CurrentControlSet\Services\DNT
HKLM\SYSTEM\CurrentControlSet\Services\DNT\Security
HKCU\avg

----------------------------------
Values deleted:0
----------------------------------

----------------------------------
Values added:8
----------------------------------
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\EnableLUA: 0x00000000
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\: "C:\Windows\System32\avg.exe"
HKLM\SYSTEM\CurrentControlSet\Services\DNT\Security\Security: 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 00 01 02 00 00 00 00 00 05 20 00 00 00 20 02 00 00 00 00 14 00 8D 01 02 00 01 01 00 00 00 00 00 05 0B 00 00 00 00 00 18 00 FD 01 02 00 01 02 00 00 00 00 00 05 20 00 00 00 23 02 00 00 01 01 00 00 00 00 00 05 12 00 00 00 01 01 00 00 00 00 00 05 12 00 00 00
HKLM\SYSTEM\CurrentControlSet\Services\DNT\Type: 0x00000001
HKLM\SYSTEM\CurrentControlSet\Services\DNT\Start: 0x00000001
HKLM\SYSTEM\CurrentControlSet\Services\DNT\ErrorControl: 0x00000001
HKLM\SYSTEM\CurrentControlSet\Services\DNT\ImagePath: "\??\c:\windows\system32\DNT.sys"
HKLM\SYSTEM\CurrentControlSet\Services\DNT\DisplayName: "Driver"

----------------------------------
Values modified:2
----------------------------------
HKCU\Software\Microsoft\Windows NT\CurrentVersion\TaskManager\Preferences: 9C 02 00 00 E8 03 00 00 02 00 00 00 01 00 00 00 01 00 00 00 0A 00 00 00 0A 00 00 00 9E 01 00 00 C9 01 00 00 00 00 00 00 00 00 00 00 02 00 00 00 03 00 00 00 04 00 00 00 FF FF FF FF 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF 00 00 00 00 00 00 01 00 00 00 02 00 00 00 03 00 00 00 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF 01 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 02 00 00 00 04 00 00 00 06 00 00 00 FF FF FF FF 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF 00 00 00 00 01 00 00 00 02 00 00 00 03 00 00 00 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF 47 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
HKCU\Software\Microsoft\Windows NT\CurrentVersion\TaskManager\Preferences: 9C 02 00 00 E8 03 00 00 02 00 00 00 01 00 00 00 01 00 00 00 0A 00 00 00 0A 00 00 00 9E 01 00 00 C9 01 00 00 01 00 00 00 00 00 00 00 02 00 00 00 03 00 00 00 04 00 00 00 FF FF FF FF 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF 00 00 00 00 00 00 01 00 00 00 02 00 00 00 03 00 00 00 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF 01 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 02 00 00 00 04 00 00 00 06 00 00 00 FF FF FF FF 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 00 00 00 6B 00 00 00 23 00 00 00 46 00 00 00 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF 00 00 00 00 01 00 00 00 02 00 00 00 03 00 00 00 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF 47 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

----------------------------------
Files added:2
----------------------------------
C:\WINDOWS\system32\avg.exe
C:\WINDOWS\system32\DNT.SYS

----------------------------------
Files [attributes?] modified:0
----------------------------------

----------------------------------
Folders added:0
----------------------------------

----------------------------------
Folders deleted:0
----------------------------------

----------------------------------
Total changes:15
----------------------------------

-------------------------------------------------------------------------------------
Detected by RegRun Reanimator:

Item Name:
Author: Unknown
Related File: C:\Windows\System32\avg.exe
Type: Registry Run

Removal Results: Success
Number of reboot: 1
-------------------------------------------------------------------------------------
Detected by RegRun Reanimator in Deep Level Scanning mode:

Item Name: DNT
Author:
Related File: \??\c:\windows\system32\DNT.sys
Type: Services detected by Partizan

Removal Results: Success
Number of reboot: 1
-------------------------------------------------------------------------------------
avg.exe

Antivirus Version Last Update Result
Avast 4.8.1335.0 2009.07.29 -
AVG 8.5.0.387 2009.07.29 -
BitDefender 7.2 2009.07.29 Trojan.PWS.OnlineGames.KCQU
Comodo 1790 2009.07.30 TrojWare.Win32.Rootkit.Banker.c
DrWeb 5.0.0.12182 2009.07.29 -
F-Secure 8.0.14470.0 2009.07.29 Rootkit.Win32.Banker.c
Kaspersky 7.0.0.125 2009.07.29 Rootkit.Win32.Banker.c
Microsoft 1.4903 2009.07.29 -
NOD32 4289 2009.07.29 -
Symantec 1.4.4.12 2009.07.29 -

Additional information
File size: 7936 bytes
MD5 : f5df99a99eb5d8a320210f4c1f29fc61
SHA1 : 229e8212abe70e53e49bac18d3e08d2f39382e39
-------------------------------------------------------------------------------------
DNT.sys

Antivirus Version Last Update Result
Avast 4.8.1335.0 2009.08.02 -
AVG 8.5.0.406 2009.08.02 -
BitDefender 7.2 2009.08.03 Gen:Trojan.Heur.5pW@rbDN@4aGh
Comodo 1847 2009.08.03 -
DrWeb 5.0.0.12182 2009.08.03 -
F-Secure 8.0.14470.0 2009.08.03 Trojan-Banker.Win32.Banker.etk
Kaspersky 7.0.0.125 2009.08.03 Trojan-Banker.Win32.Banker.etk
Microsoft 1.4903 2009.08.03 TrojanSpy:Win32/Bancos.gen!B
NOD32 4299 2009.08.02 a variant of Win32/Spy.Banker.QEP
Symantec 1.4.4.12 2009.08.03 -

Additional information
File size: 4084224 bytes
MD5...: 1e010b60f464b971ebfc8247c80e6c31
SHA1..: 36dcaca8bf3181e22e12dc01b5361a82ced6aca2
-------------------------------------------------------------------------------------
Recommended software:
UnHackMe anti-rootkit and anti-malware
http://www.unhackme.com
RegRun Security Suite (Good choice for removal and protection)
http://www.regrun.com

Removal: eletronico.exe is removed by RegRun.

UnHackMe - Rootkit/Malware killer

Also recommended software:
RegRun Security Suite Platinum - removal and protection.

UnHackMe is a part of RegRun Security Suite Platinum.

RegRun - User's Choice

Vista Programs - full info...

What is hidden in MSDN?
.NET Secrets Revealed

Why software developers prefer Win32.FreeTechSecrets.com?

All Unix Manuals in Alphabetical Order

C# controls for .NET in 3 simple steps.

Constantly updated. Last update: November 16 2009

Interesting information about Vista programs...
Need consultation?

Would you like to add your opinion?

Quick Links: What's new?
RSS Feed
Add to AppDatabase
Ask Experts
Join forum
Links
Articles: Virus or not? SPTD####.sys
What is mc21.tmp, mc22.tmp, mc23.tmp?
Select: Necessary
Useless
At your option
Dangerous