|
|
Malware Tests - removal of the newest malware.
Detect and remove hidden rootkits using
UnHackMe
RegRun Security Suite = 24 system utilities for protecting your computer. Get it! |
 f494.exe - Dangerous
F494.exe is Trojan/Backdoor. Kill the process f494.exe and remove f494.exe from Windows startup. File: C:\sand-box\f494.exe Classification: Antivirus Version Last Update Result Avast 4.8.1335.0 2009.06.21 Win32:Ambler-D AVG 8.5.0.339 2009.06.22 Dropper.Agent.MYU BitDefender 7.2 2009.06.22 Trojan.Generic.CJ.BSK Comodo 1392 2009.06.22 - DrWeb 5.0.0.12182 2009.06.22 Trojan.Chrome.50 F-Secure 8.0.14470.0 2009.06.22 Trojan-Spy:W32/Ambler.gen!B Kaspersky 7.0.0.125 2009.06.22 Trojan-Dropper.Win32.Agent.asuo NOD32 4178 2009.06.22 Win32/Spy.Ambler.AE Symantec 1.4.4.12 2009.06.22 Trojan.Adclicker Additional information File size: 39424 bytes MD5 : 23163c1d88384f82682c3eeb8be8bb84 SHA1 : 129a371b4cfa04dc16781179544a577fe366adfb Installation When the program is executed, it creates the following registry subkeys and values: ---------------------------------- Keys added:6 ---------------------------------- HKLM\SOFTWARE\Classes\CLSID\{AFF01325-0FC2-4749-8914-FBF0565AD9CC} HKLM\SOFTWARE\Classes\CLSID\{AFF01325-0FC2-4749-8914-FBF0565AD9CC}\InprocServer32 HKLM\SOFTWARE\Classes\CLSID\{AFF01325-0FC2-4749-8914-FBF0565AD9CC}\ProgID HKLM\SOFTWARE\Classes\CLSID\{AFF01325-0FC2-4749-8914-FBF0565AD9CC}\TypeLib HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AFF01325-0FC2-4749-8914-FBF0565AD9CC} HKLM\SOFTWARE\Chrome ---------------------------------- Values added:9 ---------------------------------- HKLM\SOFTWARE\Classes\CLSID\{AFF01325-0FC2-4749-8914-FBF0565AD9CC}\TypeLib\: "{EEB91A4D-223A-4b8b-B8F1-5A95E67A983B}" HKLM\SOFTWARE\Classes\CLSID\{AFF01325-0FC2-4749-8914-FBF0565AD9CC}\ProgID\: "MS" HKLM\SOFTWARE\Classes\CLSID\{AFF01325-0FC2-4749-8914-FBF0565AD9CC}\InprocServer32\: "jbnmck.dll" HKLM\SOFTWARE\Classes\CLSID\{AFF01325-0FC2-4749-8914-FBF0565AD9CC}\InprocServer32\ThreadingModel: "Apartment" HKLM\SOFTWARE\Classes\CLSID\{AFF01325-0FC2-4749-8914-FBF0565AD9CC}\: "Chrome copyright" HKLM\SOFTWARE\Chrome\Ad: 67 64 65 7F 2A 3E 20 63 7E 69 64 66 6E 62 74 7C 75 7F 7C 75 3C 7C 75 70 7D 73 79 21 73 7E 62 3F 72 60 7E 77 21 60 79 7F HKLM\SOFTWARE\Chrome\MainM: "AIEFH@OGG" HKLM\SOFTWARE\Chrome\NUM: "lVQQ'&$%":'QT%:# #.:/.&#:QUQ'"!"VS.TTj" HKLM\SOFTWARE\Chrome\NN: 38 35 38 ---------------------------------- Values modified:0 ---------------------------------- ---------------------------------- Files added:2 ---------------------------------- C:\WINDOWS\system32\jbnmck.dll C:\WINDOWS\system32\sft.res ---------------------------------- Files deleted:1 ---------------------------------- C:\sand-box\f494.exe ---------------------------------- Files [attributes?] modified:0 ---------------------------------- ---------------------------------- Folders added:0 ---------------------------------- ---------------------------------- Folders deleted:0 ---------------------------------- ---------------------------------- Total changes:18 ---------------------------------- ------------------------------------------------------------------------------------- Detected by RegRun Reanimator: Item Name: {AFF01325-0FC2-4749-8914-FBF0565AD9CC} Author: Unknown Related File: jbnmck.dll Type: Browser Helper Objects Removal Results: Success Number of reboot: 1 Recommended software: UnHackMe anti-rootkit and anti-malware http://www.unhackme.com RegRun Security Suite (Good choice for removal and protection) http://www.regrun.com Removal: f494.exe is removed by RegRun.
Read more... Removal instructions...
UnHackMe - Rootkit/Malware killer
Also recommended software: UnHackMe is a part of RegRun Security Suite Platinum.
What is hidden in MSDN? Why software developers prefer Win32.FreeTechSecrets.com? All Unix Manuals in Alphabetical Order C# controls for .NET in 3 simple steps. Constantly updated. Last update: November 16 2009
Interesting information about Vista programs... Need consultation? Would you like to add your opinion?
|
|
