fooding.exe - Dangerous
fooding.exe
Jeff's Story:
My PC had gotten a bad rootkit that my ISP antivirus software (powered by McAfee) could not detect, nor could fix.
I sought a solution on the Internet and discovered your product and tried out the trial.
You quickly found the rootkit and SAVED my PC!
I haven't had any problems since, and I'm extremely grateful.
Manual removal instructions:
Copies itself as %Windir%\fooding.exe.
Deletes some values from the registry key (see avguard.exe - W32.Netsky.G@mm)
Scans the files on drives C through Z for email addresses.
Uses its own SMTP engine to send itself to the email addresses it found above, sending to each address once.
The email has the following characteristics:
From: service@yahoo.com
Subject: (One of the following)
Mail account expired
Mail account closed
Mail account deactivated
Body: (One of the following)
Your mail account expired. Please follow the link to reactivate.
Your mail account has been closed. Click on the link for further details.
Your mail account has been deactivated. To reactivate, follow the link.
Attachment:
http:/ /www.[recipient domain]/[user]/index.scr
For example, a message to joe@hotmail.com would have the attachment name http:/ /www.hotmail.com/joe/index.scr.
Manual removal:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
and delete the value: "Tiny AV"="%Windir%\fooding.exe -antivirus service"
Or use RegRun Startup Optimizer to automatical remove it from the system registry.