f494.exe - Dangerous
f494.exe
Manual removal instructions:
Antivirus Report of f494.exe:
f494.exe
We suggest you to remove f494.exe from your computer as soon as possible.
F494.exe is Trojan/Backdoor.
Kill the process f494.exe and remove f494.exe from Windows startup.
File: C:\sand-box\f494.exe
Classification:
Antivirus Version Last Update Result
Avast 4.8.1335.0 2009.06.21 Win32:Ambler-D
AVG 8.5.0.339 2009.06.22 Dropper.Agent.MYU
BitDefender 7.2 2009.06.22 Trojan.Generic.CJ.BSK
Comodo 1392 2009.06.22 -
DrWeb 5.0.0.12182 2009.06.22 Trojan.Chrome.50
F-Secure 8.0.14470.0 2009.06.22 Trojan-Spy:W32/Ambler.gen!B
Kaspersky 7.0.0.125 2009.06.22 Trojan-Dropper.Win32.Agent.asuo
NOD32 4178 2009.06.22 Win32/Spy.Ambler.AE
Symantec 1.4.4.12 2009.06.22 Trojan.Adclicker
Additional information
File size: 39424 bytes
MD5 : 23163c1d88384f82682c3eeb8be8bb84
SHA1 : 129a371b4cfa04dc16781179544a577fe366adfb
Installation
When the program is executed, it creates the following registry subkeys and values:
----------------------------------
Keys added:6
----------------------------------
HKLM\SOFTWARE\Classes\CLSID\{AFF01325-0FC2-4749-8914-FBF0565AD9CC}
HKLM\SOFTWARE\Classes\CLSID\{AFF01325-0FC2-4749-8914-FBF0565AD9CC}\InprocServer32
HKLM\SOFTWARE\Classes\CLSID\{AFF01325-0FC2-4749-8914-FBF0565AD9CC}\ProgID
HKLM\SOFTWARE\Classes\CLSID\{AFF01325-0FC2-4749-8914-FBF0565AD9CC}\TypeLib
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AFF01325-0FC2-4749-8914-FBF0565AD9CC}
HKLM\SOFTWARE\Chrome
----------------------------------
Values added:9
----------------------------------
HKLM\SOFTWARE\Classes\CLSID\{AFF01325-0FC2-4749-8914-FBF0565AD9CC}\TypeLib\: "{EEB91A4D-223A-4b8b-B8F1-5A95E67A983B}"
HKLM\SOFTWARE\Classes\CLSID\{AFF01325-0FC2-4749-8914-FBF0565AD9CC}\ProgID\: "MS"
HKLM\SOFTWARE\Classes\CLSID\{AFF01325-0FC2-4749-8914-FBF0565AD9CC}\InprocServer32\: "jbnmck.dll"
HKLM\SOFTWARE\Classes\CLSID\{AFF01325-0FC2-4749-8914-FBF0565AD9CC}\InprocServer32\ThreadingModel: "Apartment"
HKLM\SOFTWARE\Classes\CLSID\{AFF01325-0FC2-4749-8914-FBF0565AD9CC}\: "Chrome copyright"
HKLM\SOFTWARE\Chrome\Ad: 67 64 65 7F 2A 3E 20 63 7E 69 64 66 6E 62 74 7C 75 7F 7C 75 3C 7C 75 70 7D 73 79 21 73 7E 62 3F 72 60 7E 77 21 60 79 7F
HKLM\SOFTWARE\Chrome\MainM: "AIEFH@OGG"
HKLM\SOFTWARE\Chrome\NUM: "lVQQ'&$%":'QT%:# #.:/.&#:QUQ'"!"VS.TTj"
HKLM\SOFTWARE\Chrome\NN: 38 35 38
----------------------------------
Values modified:0
----------------------------------
----------------------------------
Files added:2
----------------------------------
C:\WINDOWS\system32\jbnmck.dll
C:\WINDOWS\system32\sft.res
----------------------------------
Files deleted:1
----------------------------------
C:\sand-box\f494.exe
----------------------------------
Files [attributes?] modified:0
----------------------------------
----------------------------------
Folders added:0
----------------------------------
----------------------------------
Folders deleted:0
----------------------------------
----------------------------------
Total changes:18
----------------------------------
-------------------------------------------------------------------------------------
Detected by RegRun Reanimator:
Item Name: {AFF01325-0FC2-4749-8914-FBF0565AD9CC}
Author: Unknown
Related File: jbnmck.dll
Type: Browser Helper Objects
Removal Results: Success
Number of reboot: 1
Recommended software:
UnHackMe anti-rootkit and anti-malware
http://www.unhackme.com
RegRun Security Suite (Good choice for removal and protection)
| f494.exe | Malware |
| f494.exe | Dangerous |
| f494.exe | High Risk |
F494.exe is Trojan/Backdoor.
Kill the process f494.exe and remove f494.exe from Windows startup.
File: C:\sand-box\f494.exe
Classification:
Antivirus Version Last Update Result
Avast 4.8.1335.0 2009.06.21 Win32:Ambler-D
AVG 8.5.0.339 2009.06.22 Dropper.Agent.MYU
BitDefender 7.2 2009.06.22 Trojan.Generic.CJ.BSK
Comodo 1392 2009.06.22 -
DrWeb 5.0.0.12182 2009.06.22 Trojan.Chrome.50
F-Secure 8.0.14470.0 2009.06.22 Trojan-Spy:W32/Ambler.gen!B
Kaspersky 7.0.0.125 2009.06.22 Trojan-Dropper.Win32.Agent.asuo
NOD32 4178 2009.06.22 Win32/Spy.Ambler.AE
Symantec 1.4.4.12 2009.06.22 Trojan.Adclicker
Additional information
File size: 39424 bytes
MD5 : 23163c1d88384f82682c3eeb8be8bb84
SHA1 : 129a371b4cfa04dc16781179544a577fe366adfb
Installation
When the program is executed, it creates the following registry subkeys and values:
----------------------------------
Keys added:6
----------------------------------
HKLM\SOFTWARE\Classes\CLSID\{AFF01325-0FC2-4749-8914-FBF0565AD9CC}
HKLM\SOFTWARE\Classes\CLSID\{AFF01325-0FC2-4749-8914-FBF0565AD9CC}\InprocServer32
HKLM\SOFTWARE\Classes\CLSID\{AFF01325-0FC2-4749-8914-FBF0565AD9CC}\ProgID
HKLM\SOFTWARE\Classes\CLSID\{AFF01325-0FC2-4749-8914-FBF0565AD9CC}\TypeLib
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AFF01325-0FC2-4749-8914-FBF0565AD9CC}
HKLM\SOFTWARE\Chrome
----------------------------------
Values added:9
----------------------------------
HKLM\SOFTWARE\Classes\CLSID\{AFF01325-0FC2-4749-8914-FBF0565AD9CC}\TypeLib\: "{EEB91A4D-223A-4b8b-B8F1-5A95E67A983B}"
HKLM\SOFTWARE\Classes\CLSID\{AFF01325-0FC2-4749-8914-FBF0565AD9CC}\ProgID\: "MS"
HKLM\SOFTWARE\Classes\CLSID\{AFF01325-0FC2-4749-8914-FBF0565AD9CC}\InprocServer32\: "jbnmck.dll"
HKLM\SOFTWARE\Classes\CLSID\{AFF01325-0FC2-4749-8914-FBF0565AD9CC}\InprocServer32\ThreadingModel: "Apartment"
HKLM\SOFTWARE\Classes\CLSID\{AFF01325-0FC2-4749-8914-FBF0565AD9CC}\: "Chrome copyright"
HKLM\SOFTWARE\Chrome\Ad: 67 64 65 7F 2A 3E 20 63 7E 69 64 66 6E 62 74 7C 75 7F 7C 75 3C 7C 75 70 7D 73 79 21 73 7E 62 3F 72 60 7E 77 21 60 79 7F
HKLM\SOFTWARE\Chrome\MainM: "AIEFH@OGG"
HKLM\SOFTWARE\Chrome\NUM: "lVQQ'&$%":'QT%:# #.:/.&#:QUQ'"!"VS.TTj"
HKLM\SOFTWARE\Chrome\NN: 38 35 38
----------------------------------
Values modified:0
----------------------------------
----------------------------------
Files added:2
----------------------------------
C:\WINDOWS\system32\jbnmck.dll
C:\WINDOWS\system32\sft.res
----------------------------------
Files deleted:1
----------------------------------
C:\sand-box\f494.exe
----------------------------------
Files [attributes?] modified:0
----------------------------------
----------------------------------
Folders added:0
----------------------------------
----------------------------------
Folders deleted:0
----------------------------------
----------------------------------
Total changes:18
----------------------------------
-------------------------------------------------------------------------------------
Detected by RegRun Reanimator:
Item Name: {AFF01325-0FC2-4749-8914-FBF0565AD9CC}
Author: Unknown
Related File: jbnmck.dll
Type: Browser Helper Objects
Removal Results: Success
Number of reboot: 1
Recommended software:
UnHackMe anti-rootkit and anti-malware
http://www.unhackme.com
RegRun Security Suite (Good choice for removal and protection)
Dmitry Sokolov:
I created UnHackMe in 2006 to fix the problem that antivioruses did not fix: detecting rootkits.
Since that time I work every day to fix the issues that antiviruses cannot.
If your antivirus have not helped you solve the problem, you should try UnHackMe.
We are a small company and you can ask me directly, if you have any questions.