|
|
UnHackMe Warrior Removing rootkits is best done from the "clean" Windows!
Blog: New viruses/malware/rootkits. Everyday!
Blog: How to remove malware/Trojans/rootkits using UnHackMe or manually. We know how to remove malware.
Shortcut Antivirus protects against Microsoft LNK and PIF vulnerability, notify a user about found threats and give possibility to immediately remove threats.
StuxnetRemover - free of charge Stuxnet/Tmphider rootkit removal tool.
|
 kav32.exe - Dangerous
Fix it immediately
Kav32.exe is Trojan/Backdoor. Kill the process kav32.exe and remove kav32.exe from Windows startup. File: avp1.exe (C:\sand-box\avp1.exe) Classification: Antivirus Version Last Update Result Avast 4.8.1335.0 2009.07.24 Win32:Rootkit-gen AVG 8.5.0.387 2009.07.25 Suspicion: unknown virus BitDefender 7.2 2009.07.25 Gen:Trojan.Heur.PT.1030110101 Comodo 1742 2009.07.25 TrojWare.Win32.Magania.~CC DrWeb 5.0.0.12182 2009.07.25 - F-Secure 8.0.14470.0 2009.07.24 Suspicious:W32/Malware!Gemini Kaspersky 7.0.0.125 2009.07.25 Trojan-Downloader.Win32.Geral.axi Microsoft 1.4903 2009.07.25 TrojanDropper:Win32/Dogrobot.E NOD32 4277 2009.07.25 Win32/AutoRun.Agent.QQ Symantec 1.4.4.12 2009.07.25 Trojan.KillAV Additional information File size: 30642 bytes MD5 : 685de881f54eddd77911f4da916ff398 SHA1 : 26bb7236d7d2ea4bee21bb8d7b6e3a27916b7a3b Installation When the program is executed, it creates the following registry subkeys and values: ---------------------------------- Keys deleted:1 ---------------------------------- HKLM\SYSTEM\CurrentControlSet\Services\PCIDump ---------------------------------- Keys added:77 ---------------------------------- HKLM\SOFTWARE\Microsoft\ESENT\Process\extext123734t HKLM\SOFTWARE\Microsoft\ESENT\Process\extext123734t\DEBUG HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360delays.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safebox.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe ... HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsserv.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vstskmgr.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xcommsvr.exe HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ASYNCMAC HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ASYNCMAC\0000 HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PCIDUMP HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PCIDUMP\0000 HKLM\SYSTEM\CurrentControlSet\Services\pcidump HKLM\SYSTEM\CurrentControlSet\Services\pcidump\Security ---------------------------------- Values deleted:5 ---------------------------------- HKLM\SYSTEM\CurrentControlSet\Services\PCIDump\ErrorControl: 0x00000000 HKLM\SYSTEM\CurrentControlSet\Services\PCIDump\Group: "PCI Configuration" HKLM\SYSTEM\CurrentControlSet\Services\PCIDump\Start: 0x00000001 HKLM\SYSTEM\CurrentControlSet\Services\PCIDump\Tag: 0x00000001 HKLM\SYSTEM\CurrentControlSet\Services\PCIDump\Type: 0x00000001 ---------------------------------- Values added:119 ---------------------------------- HKLM\SOFTWARE\Microsoft\ESENT\Process\extext123734t\DEBUG\Trace Level: "" HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RsTray: "C:\WINDOWS\system32\scvhost.exe" HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360delays.exe\360delays.exe: "svchost.exe" HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safebox.exe\360Safebox.exe: "svchost.exe" HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe\360tray.exe: "svchost.exe" ... HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsserv.exe\vsserv.exe: "svchost.exe" HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vstskmgr.exe\vstskmgr.exe: "svchost.exe" HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xcommsvr.exe\xcommsvr.exe: "svchost.exe" HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ASYNCMAC\0000\Service: "AsyncMac" HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ASYNCMAC\0000\Legacy: 0x00000001 HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ASYNCMAC\0000\ConfigFlags: 0x00000000 HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ASYNCMAC\0000\Class: "LegacyDriver" HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ASYNCMAC\0000\ClassGUID: "{8ECC055D-047F-11D1-A537-0000F8753ED1}" HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ASYNCMAC\0000\DeviceDesc: "RAS Asynchronous Media Driver" HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ASYNCMAC\NextInstance: 0x00000001 HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PCIDUMP\0000\Service: "pcidump" HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PCIDUMP\0000\Legacy: 0x00000001 HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PCIDUMP\0000\ConfigFlags: 0x00000000 HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PCIDUMP\0000\Class: "LegacyDriver" HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PCIDUMP\0000\ClassGUID: "{8ECC055D-047F-11D1-A537-0000F8753ED1}" HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PCIDUMP\0000\DeviceDesc: "pcidump" HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PCIDUMP\NextInstance: 0x00000001 HKLM\SYSTEM\CurrentControlSet\Services\pcidump\Security\Security: 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 00 01 02 00 00 00 00 00 05 20 00 00 00 20 02 00 00 00 00 14 00 8D 01 02 00 01 01 00 00 00 00 00 05 0B 00 00 00 00 00 18 00 FD 01 02 00 01 02 00 00 00 00 00 05 20 00 00 00 23 02 00 00 01 01 00 00 00 00 00 05 12 00 00 00 01 01 00 00 00 00 00 05 12 00 00 00 HKLM\SYSTEM\CurrentControlSet\Services\pcidump\Type: 0x00000001 HKLM\SYSTEM\CurrentControlSet\Services\pcidump\Start: 0x00000004 HKLM\SYSTEM\CurrentControlSet\Services\pcidump\ErrorControl: 0x00000000 HKLM\SYSTEM\CurrentControlSet\Services\pcidump\ImagePath: "\??\C:\WINDOWS\system32\drivers\pcidump.sys" HKLM\SYSTEM\CurrentControlSet\Services\pcidump\DisplayName: "pcidump" HKLM\SYSTEM\CurrentControlSet\Services\pcidump\DeleteFlag: 0x00000001 HKCU\Software\Microsoft\Notepad\lfEscapement: 0x00000000 HKCU\Software\Microsoft\Notepad\lfOrientation: 0x00000000 HKCU\Software\Microsoft\Notepad\lfWeight: 0x00000190 HKCU\Software\Microsoft\Notepad\lfItalic: 0x00000000 HKCU\Software\Microsoft\Notepad\lfUnderline: 0x00000000 HKCU\Software\Microsoft\Notepad\lfStrikeOut: 0x00000000 HKCU\Software\Microsoft\Notepad\lfCharSet: 0x00000000 HKCU\Software\Microsoft\Notepad\lfOutPrecision: 0x00000001 HKCU\Software\Microsoft\Notepad\lfClipPrecision: 0x00000002 HKCU\Software\Microsoft\Notepad\lfQuality: 0x00000002 HKCU\Software\Microsoft\Notepad\lfPitchAndFamily: 0x00000031 HKCU\Software\Microsoft\Notepad\iPointSize: 0x00000064 HKCU\Software\Microsoft\Notepad\fWrap: 0x00000000 HKCU\Software\Microsoft\Notepad\StatusBar: 0x00000000 HKCU\Software\Microsoft\Notepad\fSaveWindowPositions: 0x00000000 HKCU\Software\Microsoft\Notepad\lfFaceName: "Lucida Console" HKCU\Software\Microsoft\Notepad\szHeader: "&f" HKCU\Software\Microsoft\Notepad\szTrailer: "Page &p" HKCU\Software\Microsoft\Notepad\iMarginTop: 0x000003E8 HKCU\Software\Microsoft\Notepad\iMarginBottom: 0x000003E8 HKCU\Software\Microsoft\Notepad\iMarginLeft: 0x000002EE HKCU\Software\Microsoft\Notepad\iMarginRight: 0x000002EE HKCU\Software\Microsoft\Notepad\fMLE_is_broken: 0x00000000 HKCU\Software\Microsoft\Notepad\iWindowPosX: 0x0000006E HKCU\Software\Microsoft\Notepad\iWindowPosY: 0x0000006E HKCU\Software\Microsoft\Notepad\iWindowPosDX: 0x00000258 HKCU\Software\Microsoft\Notepad\iWindowPosDY: 0x0000019B ---------------------------------- Values modified:2 ---------------------------------- HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Start: 0x00000002 HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Start: 0x00000004 ---------------------------------- Files added:5 ---------------------------------- C:\WINDOWS\system32\drivers\AsyncMac.sys C:\WINDOWS\system32\scvhost.exe C:\WINDOWS\extext123734t.exe C:\AUTORUN.INF C:\recycle.{645FF040-5081-101B-9F08-00AA002F954E}\kav32.exe ---------------------------------- Files deleted:2 ---------------------------------- C:\sand-box\avp1.exe C:\WINDOWS\system32\drivers\asyncmac.sys ---------------------------------- Files [attributes?] modified:1 ---------------------------------- C:\WINDOWS\system32\wbem\Logs\wbemcore.log ---------------------------------- Folders added:2 ---------------------------------- C:\recycle.{645FF040-5081-101B-9F08-00AA002F954E} C:\recycle.{645FF040-5081-101B-9F08-00AA002F954E}\safe. ---------------------------------- Folders deleted:0 ---------------------------------- ---------------------------------- Total changes:212 ---------------------------------- ------------------------------------------------------------------------------------- Detected by RegRun Reanimator: Item Name: RsTray Author: Unknown Related File: C:\WINDOWS\system32\scvhost.exe Type: Registry Run Item Name: C:\autorun.inf Author: Unknown Related File: C:\autorun.inf Type: Autorun.inf Removal Results: Success Number of reboot: 1 ------------------------------------------------------------------------------------- Recommended software: UnHackMe anti-rootkit and anti-malware http://www.unhackme.com RegRun Security Suite (Good choice for removal and protection)
Virus Problem? Google Redirects? Ads? Slow?
Constantly updated. Last update: February 5 2012
Fix Windows PC's Fast! Automated Software Repairs damaged & slow windows systems in 1 click.
|
|
