|
|
UnHackMe Warrior Removing rootkits is best done from the "clean" Windows!
Blog: New viruses/malware/rootkits. Everyday!
Blog: How to remove malware/Trojans/rootkits using UnHackMe or manually. We know how to remove malware.
Shortcut Antivirus protects against Microsoft LNK and PIF vulnerability, notify a user about found threats and give possibility to immediately remove threats.
StuxnetRemover - free of charge Stuxnet/Tmphider rootkit removal tool.
|
 f494.exe - Dangerous
Fix it immediately
F494.exe is Trojan/Backdoor. Kill the process f494.exe and remove f494.exe from Windows startup. File: C:\sand-box\f494.exe Classification: Antivirus Version Last Update Result Avast 4.8.1335.0 2009.06.21 Win32:Ambler-D AVG 8.5.0.339 2009.06.22 Dropper.Agent.MYU BitDefender 7.2 2009.06.22 Trojan.Generic.CJ.BSK Comodo 1392 2009.06.22 - DrWeb 5.0.0.12182 2009.06.22 Trojan.Chrome.50 F-Secure 8.0.14470.0 2009.06.22 Trojan-Spy:W32/Ambler.gen!B Kaspersky 7.0.0.125 2009.06.22 Trojan-Dropper.Win32.Agent.asuo NOD32 4178 2009.06.22 Win32/Spy.Ambler.AE Symantec 1.4.4.12 2009.06.22 Trojan.Adclicker Additional information File size: 39424 bytes MD5 : 23163c1d88384f82682c3eeb8be8bb84 SHA1 : 129a371b4cfa04dc16781179544a577fe366adfb Installation When the program is executed, it creates the following registry subkeys and values: ---------------------------------- Keys added:6 ---------------------------------- HKLM\SOFTWARE\Classes\CLSID\{AFF01325-0FC2-4749-8914-FBF0565AD9CC} HKLM\SOFTWARE\Classes\CLSID\{AFF01325-0FC2-4749-8914-FBF0565AD9CC}\InprocServer32 HKLM\SOFTWARE\Classes\CLSID\{AFF01325-0FC2-4749-8914-FBF0565AD9CC}\ProgID HKLM\SOFTWARE\Classes\CLSID\{AFF01325-0FC2-4749-8914-FBF0565AD9CC}\TypeLib HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AFF01325-0FC2-4749-8914-FBF0565AD9CC} HKLM\SOFTWARE\Chrome ---------------------------------- Values added:9 ---------------------------------- HKLM\SOFTWARE\Classes\CLSID\{AFF01325-0FC2-4749-8914-FBF0565AD9CC}\TypeLib\: "{EEB91A4D-223A-4b8b-B8F1-5A95E67A983B}" HKLM\SOFTWARE\Classes\CLSID\{AFF01325-0FC2-4749-8914-FBF0565AD9CC}\ProgID\: "MS" HKLM\SOFTWARE\Classes\CLSID\{AFF01325-0FC2-4749-8914-FBF0565AD9CC}\InprocServer32\: "jbnmck.dll" HKLM\SOFTWARE\Classes\CLSID\{AFF01325-0FC2-4749-8914-FBF0565AD9CC}\InprocServer32\ThreadingModel: "Apartment" HKLM\SOFTWARE\Classes\CLSID\{AFF01325-0FC2-4749-8914-FBF0565AD9CC}\: "Chrome copyright" HKLM\SOFTWARE\Chrome\Ad: 67 64 65 7F 2A 3E 20 63 7E 69 64 66 6E 62 74 7C 75 7F 7C 75 3C 7C 75 70 7D 73 79 21 73 7E 62 3F 72 60 7E 77 21 60 79 7F HKLM\SOFTWARE\Chrome\MainM: "AIEFH@OGG" HKLM\SOFTWARE\Chrome\NUM: "lVQQ'&$%":'QT%:# #.:/.&#:QUQ'"!"VS.TTj" HKLM\SOFTWARE\Chrome\NN: 38 35 38 ---------------------------------- Values modified:0 ---------------------------------- ---------------------------------- Files added:2 ---------------------------------- C:\WINDOWS\system32\jbnmck.dll C:\WINDOWS\system32\sft.res ---------------------------------- Files deleted:1 ---------------------------------- C:\sand-box\f494.exe ---------------------------------- Files [attributes?] modified:0 ---------------------------------- ---------------------------------- Folders added:0 ---------------------------------- ---------------------------------- Folders deleted:0 ---------------------------------- ---------------------------------- Total changes:18 ---------------------------------- ------------------------------------------------------------------------------------- Detected by RegRun Reanimator: Item Name: {AFF01325-0FC2-4749-8914-FBF0565AD9CC} Author: Unknown Related File: jbnmck.dll Type: Browser Helper Objects Removal Results: Success Number of reboot: 1 Recommended software: UnHackMe anti-rootkit and anti-malware http://www.unhackme.com RegRun Security Suite (Good choice for removal and protection)
Virus Problem? Google Redirects? Ads? Slow?
Constantly updated. Last update: February 5 2012
Fix Windows PC's Fast! Automated Software Repairs damaged & slow windows systems in 1 click.
|
|
