imiupd32.exe - Dangerous
imiupd32.exe
Jeff's Story:
My PC had gotten a bad rootkit that my ISP antivirus software (powered by McAfee) could not detect, nor could fix.
I sought a solution on the Internet and discovered your product and tried out the trial.
You quickly found the rootkit and SAVED my PC!
I haven't had any problems since, and I'm extremely grateful.
Manual removal instructions:
Imiupd32.exe is Trojan/Backdoor.
Kill the process imiupd32.exe and remove imiupd32.exe from Windows startup.
Classification:
Antivirus Version Last Update Result
Sunbelt 3.2.1858.2 2009.06.03 BehavesLike.Win32.Malware (v)
Additional information
File size: 31232 bytes
MD5 : 34c3f3fa819259d5874fb55f299fc8
7c
SHA1 : 5e3ac3707208856ebc8e39315ec4a53f08883404
Installation
When the program is executed, it creates the following registry subkeys and values:
----------------------------------
Keys deleted:0
----------------------------------
----------------------------------
Keys added:0
----------------------------------
----------------------------------
Values deleted:0
----------------------------------
----------------------------------
Values added:0
----------------------------------
----------------------------------
Values modified:2
----------------------------------
HKLM\SYSTEM\CurrentControlSet\Control\Lsa\LsaPid: 0x00000208
HKLM\SYSTEM\CurrentControlSet\Control\Lsa\LsaPid: 0x00000200
----------------------------------
Files added:3
----------------------------------
C:\Documents and Settings\Administrator\Application Data\wiaserva.log
C:\Documents and Settings\Administrator\Local Settings\Temp\~TM4.tmp
C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\imiupd32.exe
----------------------------------
Files deleted:1
----------------------------------
C:\sand-box\load.exe
----------------------------------
Files [attributes?] modified:0
----------------------------------
----------------------------------
Folders added:0
----------------------------------
----------------------------------
Folders deleted:0
----------------------------------
----------------------------------
Total changes:6
----------------------------------
-------------------------------------------------------------------------------------
Detected by RegRun Reanimator:
Type: Sturtyp Folder
Item Name: imiupd32.exe
Related File: C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\imiupd32.exe
Removal Results: Success
Number of reboot: 1