msnss.exe - Dangerous
msnss.exe
Jeff's Story:
My PC had gotten a bad rootkit that my ISP antivirus software (powered by McAfee) could not detect, nor could fix.
I sought a solution on the Internet and discovered your product and tried out the trial.
You quickly found the rootkit and SAVED my PC!
I haven't had any problems since, and I'm extremely grateful.
Manual removal instructions:
It is a repacked variant of W32.Gaobot.SN.
The worm spreads through open network shares and through backdoors that the Mydoom family of worms open.
Steals CD keys from a number of computer games.
Gives the creator backdoor access to the computer via IRC channel:
- Download and execute files
- Scan the network
- List, stop, and start processes
- Control the file system (Delete, create, and list files)
- Launch Denial of Service (DoS) attacks
- Perform port redirection
- Steal system information and email it to the attacker
Attempts to copy itself to computers with weak passwords.
Scans for computers that have been infected by Mydoom variants.
If it finds any, it uses the backdoor installed by Mydoom to copy itself onto the computer as Msgfix.exe.
Manual removal:
Navigate to the keys:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
and delete the values, if present:
"Configuration Loader"="msnss.exe"
"Configuration Loader"="msgfix.exe"