|
|
Malware Tests - removal of the newest malware.
Detect and remove hidden rootkits using
UnHackMe
RegRun Security Suite = 24 system utilities for protecting your computer. Get it! |
 kav32.exe - Dangerous
Kav32.exe is Trojan/Backdoor. Kill the process kav32.exe and remove kav32.exe from Windows startup. File: avp1.exe (C:\sand-box\avp1.exe) Classification: Antivirus Version Last Update Result Avast 4.8.1335.0 2009.07.24 Win32:Rootkit-gen AVG 8.5.0.387 2009.07.25 Suspicion: unknown virus BitDefender 7.2 2009.07.25 Gen:Trojan.Heur.PT.1030110101 Comodo 1742 2009.07.25 TrojWare.Win32.Magania.~CC DrWeb 5.0.0.12182 2009.07.25 - F-Secure 8.0.14470.0 2009.07.24 Suspicious:W32/Malware!Gemini Kaspersky 7.0.0.125 2009.07.25 Trojan-Downloader.Win32.Geral.axi Microsoft 1.4903 2009.07.25 TrojanDropper:Win32/Dogrobot.E NOD32 4277 2009.07.25 Win32/AutoRun.Agent.QQ Symantec 1.4.4.12 2009.07.25 Trojan.KillAV Additional information File size: 30642 bytes MD5 : 685de881f54eddd77911f4da916ff398 SHA1 : 26bb7236d7d2ea4bee21bb8d7b6e3a27916b7a3b Installation When the program is executed, it creates the following registry subkeys and values: ---------------------------------- Keys deleted:1 ---------------------------------- HKLM\SYSTEM\CurrentControlSet\Services\PCIDump ---------------------------------- Keys added:77 ---------------------------------- HKLM\SOFTWARE\Microsoft\ESENT\Process\extext123734t HKLM\SOFTWARE\Microsoft\ESENT\Process\extext123734t\DEBUG HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360delays.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safebox.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe ... HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsserv.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vstskmgr.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xcommsvr.exe HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ASYNCMAC HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ASYNCMAC\0000 HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PCIDUMP HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PCIDUMP\0000 HKLM\SYSTEM\CurrentControlSet\Services\pcidump HKLM\SYSTEM\CurrentControlSet\Services\pcidump\Security ---------------------------------- Values deleted:5 ---------------------------------- HKLM\SYSTEM\CurrentControlSet\Services\PCIDump\ErrorControl: 0x00000000 HKLM\SYSTEM\CurrentControlSet\Services\PCIDump\Group: "PCI Configuration" HKLM\SYSTEM\CurrentControlSet\Services\PCIDump\Start: 0x00000001 HKLM\SYSTEM\CurrentControlSet\Services\PCIDump\Tag: 0x00000001 HKLM\SYSTEM\CurrentControlSet\Services\PCIDump\Type: 0x00000001 ---------------------------------- Values added:119 ---------------------------------- HKLM\SOFTWARE\Microsoft\ESENT\Process\extext123734t\DEBUG\Trace Level: "" HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RsTray: "C:\WINDOWS\system32\scvhost.exe" HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360delays.exe\360delays.exe: "svchost.exe" HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safebox.exe\360Safebox.exe: "svchost.exe" HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe\360tray.exe: "svchost.exe" ... HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsserv.exe\vsserv.exe: "svchost.exe" HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vstskmgr.exe\vstskmgr.exe: "svchost.exe" HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xcommsvr.exe\xcommsvr.exe: "svchost.exe" HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ASYNCMAC\0000\Service: "AsyncMac" HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ASYNCMAC\0000\Legacy: 0x00000001 HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ASYNCMAC\0000\ConfigFlags: 0x00000000 HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ASYNCMAC\0000\Class: "LegacyDriver" HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ASYNCMAC\0000\ClassGUID: "{8ECC055D-047F-11D1-A537-0000F8753ED1}" HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ASYNCMAC\0000\DeviceDesc: "RAS Asynchronous Media Driver" HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ASYNCMAC\NextInstance: 0x00000001 HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PCIDUMP\0000\Service: "pcidump" HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PCIDUMP\0000\Legacy: 0x00000001 HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PCIDUMP\0000\ConfigFlags: 0x00000000 HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PCIDUMP\0000\Class: "LegacyDriver" HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PCIDUMP\0000\ClassGUID: "{8ECC055D-047F-11D1-A537-0000F8753ED1}" HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PCIDUMP\0000\DeviceDesc: "pcidump" HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PCIDUMP\NextInstance: 0x00000001 HKLM\SYSTEM\CurrentControlSet\Services\pcidump\Security\Security: 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 00 01 02 00 00 00 00 00 05 20 00 00 00 20 02 00 00 00 00 14 00 8D 01 02 00 01 01 00 00 00 00 00 05 0B 00 00 00 00 00 18 00 FD 01 02 00 01 02 00 00 00 00 00 05 20 00 00 00 23 02 00 00 01 01 00 00 00 00 00 05 12 00 00 00 01 01 00 00 00 00 00 05 12 00 00 00 HKLM\SYSTEM\CurrentControlSet\Services\pcidump\Type: 0x00000001 HKLM\SYSTEM\CurrentControlSet\Services\pcidump\Start: 0x00000004 HKLM\SYSTEM\CurrentControlSet\Services\pcidump\ErrorControl: 0x00000000 HKLM\SYSTEM\CurrentControlSet\Services\pcidump\ImagePath: "\??\C:\WINDOWS\system32\drivers\pcidump.sys" HKLM\SYSTEM\CurrentControlSet\Services\pcidump\DisplayName: "pcidump" HKLM\SYSTEM\CurrentControlSet\Services\pcidump\DeleteFlag: 0x00000001 HKCU\Software\Microsoft\Notepad\lfEscapement: 0x00000000 HKCU\Software\Microsoft\Notepad\lfOrientation: 0x00000000 HKCU\Software\Microsoft\Notepad\lfWeight: 0x00000190 HKCU\Software\Microsoft\Notepad\lfItalic: 0x00000000 HKCU\Software\Microsoft\Notepad\lfUnderline: 0x00000000 HKCU\Software\Microsoft\Notepad\lfStrikeOut: 0x00000000 HKCU\Software\Microsoft\Notepad\lfCharSet: 0x00000000 HKCU\Software\Microsoft\Notepad\lfOutPrecision: 0x00000001 HKCU\Software\Microsoft\Notepad\lfClipPrecision: 0x00000002 HKCU\Software\Microsoft\Notepad\lfQuality: 0x00000002 HKCU\Software\Microsoft\Notepad\lfPitchAndFamily: 0x00000031 HKCU\Software\Microsoft\Notepad\iPointSize: 0x00000064 HKCU\Software\Microsoft\Notepad\fWrap: 0x00000000 HKCU\Software\Microsoft\Notepad\StatusBar: 0x00000000 HKCU\Software\Microsoft\Notepad\fSaveWindowPositions: 0x00000000 HKCU\Software\Microsoft\Notepad\lfFaceName: "Lucida Console" HKCU\Software\Microsoft\Notepad\szHeader: "&f" HKCU\Software\Microsoft\Notepad\szTrailer: "Page &p" HKCU\Software\Microsoft\Notepad\iMarginTop: 0x000003E8 HKCU\Software\Microsoft\Notepad\iMarginBottom: 0x000003E8 HKCU\Software\Microsoft\Notepad\iMarginLeft: 0x000002EE HKCU\Software\Microsoft\Notepad\iMarginRight: 0x000002EE HKCU\Software\Microsoft\Notepad\fMLE_is_broken: 0x00000000 HKCU\Software\Microsoft\Notepad\iWindowPosX: 0x0000006E HKCU\Software\Microsoft\Notepad\iWindowPosY: 0x0000006E HKCU\Software\Microsoft\Notepad\iWindowPosDX: 0x00000258 HKCU\Software\Microsoft\Notepad\iWindowPosDY: 0x0000019B ---------------------------------- Values modified:2 ---------------------------------- HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Start: 0x00000002 HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Start: 0x00000004 ---------------------------------- Files added:5 ---------------------------------- C:\WINDOWS\system32\drivers\AsyncMac.sys C:\WINDOWS\system32\scvhost.exe C:\WINDOWS\extext123734t.exe C:\AUTORUN.INF C:\recycle.{645FF040-5081-101B-9F08-00AA002F954E}\kav32.exe ---------------------------------- Files deleted:2 ---------------------------------- C:\sand-box\avp1.exe C:\WINDOWS\system32\drivers\asyncmac.sys ---------------------------------- Files [attributes?] modified:1 ---------------------------------- C:\WINDOWS\system32\wbem\Logs\wbemcore.log ---------------------------------- Folders added:2 ---------------------------------- C:\recycle.{645FF040-5081-101B-9F08-00AA002F954E} C:\recycle.{645FF040-5081-101B-9F08-00AA002F954E}\safe. ---------------------------------- Folders deleted:0 ---------------------------------- ---------------------------------- Total changes:212 ---------------------------------- ------------------------------------------------------------------------------------- Detected by RegRun Reanimator: Item Name: RsTray Author: Unknown Related File: C:\WINDOWS\system32\scvhost.exe Type: Registry Run Item Name: C:\autorun.inf Author: Unknown Related File: C:\autorun.inf Type: Autorun.inf Removal Results: Success Number of reboot: 1 ------------------------------------------------------------------------------------- Recommended software: UnHackMe anti-rootkit and anti-malware http://www.unhackme.com RegRun Security Suite (Good choice for removal and protection) http://www.regrun.com Removal: kav32.exe is removed by RegRun.
Read more... Removal instructions...
UnHackMe - Rootkit/Malware killer
Also recommended software: UnHackMe is a part of RegRun Security Suite Platinum.
What is hidden in MSDN? Why software developers prefer Win32.FreeTechSecrets.com? All Unix Manuals in Alphabetical Order C# controls for .NET in 3 simple steps. Constantly updated. Last update: November 16 2009
Interesting information about Vista programs... Need consultation? Would you like to add your opinion?
|
|
