|
|
UnHackMe Warrior Removing rootkits is best done from the "clean" Windows!
Blog: New viruses/malware/rootkits. Everyday!
Blog: How to remove malware/Trojans/rootkits using UnHackMe or manually. We know how to remove malware.
Shortcut Antivirus protects against Microsoft LNK and PIF vulnerability, notify a user about found threats and give possibility to immediately remove threats.
StuxnetRemover - free of charge Stuxnet/Tmphider rootkit removal tool.
|
 realsvc.exe - Dangerous
Fix it immediately
Realsvc.exe is Trojan/Backdoor. Kill the process realsvc.exe and remove realsvc.exe from Windows startup. File: ppp.exe ------------------------------------------------------------------------------------- Classification: Antivirus Version Last Update Result Code: Avast 4.8.1335.0 2009.08.11 - AVG 8.5.0.406 2009.08.12 Win32/Heur BitDefender 7.2 2009.08.12 GenPack:Trojan.Autorun.TK Comodo 1949 2009.08.12 TrojWare.Win32.Trojan.Agent.Gen DrWeb 5.0.0.12182 2009.08.12 Win32.HLLW.Autoruner.2174 F-Secure 8.0.14470.0 2009.08.11 - Kaspersky 7.0.0.125 2009.08.12 Trojan-Downloader.Win32.Baser.dn Microsoft 1.4903 2009.08.11 Worm:Win32/Autorun.G NOD32 4327 2009.08.11 a variant of Win32/Kryptik.NX Symantec 1.4.4.12 2009.08.12 Suspicious.MH690.A Additional information File size: 55808 bytes MD5 : 12db26505da2f165bb8e0b0b8601f63f SHA1 : 9306ac5b8c3fc2f2a66a1b74a32709389c98913e ------------------------------------------------------------------------------------- Installation When the program is executed, it creates the following registry subkeys and values: ---------------------------------- Keys added:5 ---------------------------------- HKLM\SOFTWARE\Microsoft\DownloadManager HKLM\SYSTEM\CurrentControlSet\Services\Indexingbox HKLM\SYSTEM\CurrentControlSet\Services\Indexingbox\Enum HKLM\SYSTEM\CurrentControlSet\Services\Indexingbox\Security HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012009081220090813 ---------------------------------- Values added:18 ---------------------------------- HKLM\SYSTEM\CurrentControlSet\Services\Indexingbox\Security\Security: 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 00 01 02 00 00 00 00 00 05 20 00 00 00 20 02 00 00 00 00 14 00 8D 01 02 00 01 01 00 00 00 00 00 05 0B 00 00 00 00 00 18 00 FD 01 02 00 01 02 00 00 00 00 00 05 20 00 00 00 23 02 00 00 01 01 00 00 00 00 00 05 12 00 00 00 01 01 00 00 00 00 00 05 12 00 00 00 HKLM\SYSTEM\CurrentControlSet\Services\Indexingbox\Enum\0: "Root\LEGACY_WINDOWS_REGEDIT_HELPS\0000" HKLM\SYSTEM\CurrentControlSet\Services\Indexingbox\Enum\Count: 0x00000001 HKLM\SYSTEM\CurrentControlSet\Services\Indexingbox\Enum\NextInstance: 0x00000001 HKLM\SYSTEM\CurrentControlSet\Services\Indexingbox\Type: 0x00000110 HKLM\SYSTEM\CurrentControlSet\Services\Indexingbox\Start: 0x00000002 HKLM\SYSTEM\CurrentControlSet\Services\Indexingbox\ErrorControl: 0x00000000 HKLM\SYSTEM\CurrentControlSet\Services\Indexingbox\ImagePath: "%WINDIR%\system\realsvc.exe" HKLM\SYSTEM\CurrentControlSet\Services\Indexingbox\DisplayName: "Indexings helps" HKLM\SYSTEM\CurrentControlSet\Services\Indexingbox\ObjectName: "LocalSystem" HKLM\SYSTEM\CurrentControlSet\Services\Indexingbox\Description: "Indexingbox" HKCU\Software\Microsoft\CTF\MSUTB\ShowDeskBand: 0x00000001 HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012009081220090813\CachePath: "%USERPROFILE%\Local Settings\History\History.IE5\MSHist012009081220090813" HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012009081220090813\CachePrefix: ":2009081220090813: " HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012009081220090813\CacheLimit: 0x00002000 HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012009081220090813\CacheOptions: 0x0000000B HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012009081220090813\CacheRepair: 0x00000000 HKCU\Software\WinRAR SFX\C%%WINDOWS%system: "C:\WINDOWS\system" ---------------------------------- Values modified:38 ---------------------------------- HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit: "C:\WINDOWS\system32\userinit.exe," HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit: "C:\WINDOWS\system32\userinit.exe,rundll32.exe C:\WINDOWS\system32\winsys16_061230.dll start" HKLM\SYSTEM\CurrentControlSet\Services\Dhcp\Parameters\{0445ABC5-DCB0-4E8B-A5BE-DA7B973EBA30}: FC 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1C 87 81 4A 06 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 ED 8D 81 4A C0 A8 AE 01 0F 00 00 00 00 00 00 00 0B 00 00 00 00 00 00 00 ED 8D 81 4A 6C 6F 63 61 6C 64 6F 6D 61 69 6E 00 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 ED 8D 81 4A FF FF FF 00 33 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 ED 8D 81 4A 00 00 07 08 36 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 ED 8D 81 4A C0 A8 AE FE 35 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 ED 8D 81 4A 05 00 00 00 HKLM\SYSTEM\CurrentControlSet\Services\Dhcp\Parameters\{0445ABC5-DCB0-4E8B-A5BE-DA7B973EBA30}: 06 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 8D 58 82 4A C0 A8 AE 01 0F 00 00 00 00 00 00 00 0B 00 00 00 00 00 00 00 8D 58 82 4A 6C 6F 63 61 6C 64 6F 6D 61 69 6E 00 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 8D 58 82 4A FF FF FF 00 33 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 8D 58 82 4A 00 00 07 08 36 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 8D 58 82 4A C0 A8 AE FE 35 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 8D 58 82 4A 05 00 00 00 HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{0445ABC5-DCB0-4E8B-A5BE-DA7B973EBA30}\LeaseObtainedTime: 0x4A8186E5 HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{0445ABC5-DCB0-4E8B-A5BE-DA7B973EBA30}\LeaseObtainedTime: 0x4A825185 HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{0445ABC5-DCB0-4E8B-A5BE-DA7B973EBA30}\T1: 0x4A818A69 HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{0445ABC5-DCB0-4E8B-A5BE-DA7B973EBA30}\T1: 0x4A825509 HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{0445ABC5-DCB0-4E8B-A5BE-DA7B973EBA30}\T2: 0x4A818D0C HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{0445ABC5-DCB0-4E8B-A5BE-DA7B973EBA30}\T2: 0x4A8257AC HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{0445ABC5-DCB0-4E8B-A5BE-DA7B973EBA30}\LeaseTerminatesTime: 0x4A818DED HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{0445ABC5-DCB0-4E8B-A5BE-DA7B973EBA30}\LeaseTerminatesTime: 0x4A82588D HKLM\SYSTEM\CurrentControlSet\Services\{0445ABC5-DCB0-4E8B-A5BE-DA7B973EBA30}\Parameters\Tcpip\LeaseObtainedTime: 0x4A8186E5 HKLM\SYSTEM\CurrentControlSet\Services\{0445ABC5-DCB0-4E8B-A5BE-DA7B973EBA30}\Parameters\Tcpip\LeaseObtainedTime: 0x4A825185 HKLM\SYSTEM\CurrentControlSet\Services\{0445ABC5-DCB0-4E8B-A5BE-DA7B973EBA30}\Parameters\Tcpip\T1: 0x4A818A69 HKLM\SYSTEM\CurrentControlSet\Services\{0445ABC5-DCB0-4E8B-A5BE-DA7B973EBA30}\Parameters\Tcpip\T1: 0x4A825509 HKLM\SYSTEM\CurrentControlSet\Services\{0445ABC5-DCB0-4E8B-A5BE-DA7B973EBA30}\Parameters\Tcpip\T2: 0x4A818D0C HKLM\SYSTEM\CurrentControlSet\Services\{0445ABC5-DCB0-4E8B-A5BE-DA7B973EBA30}\Parameters\Tcpip\T2: 0x4A8257AC HKLM\SYSTEM\CurrentControlSet\Services\{0445ABC5-DCB0-4E8B-A5BE-DA7B973EBA30}\Parameters\Tcpip\LeaseTerminatesTime: 0x4A818DED HKLM\SYSTEM\CurrentControlSet\Services\{0445ABC5-DCB0-4E8B-A5BE-DA7B973EBA30}\Parameters\Tcpip\LeaseTerminatesTime: 0x4A82588D HKCU\Software\Microsoft\Internet Explorer\Desktop\Components\GeneralFlags: 0x00000004 HKCU\Software\Microsoft\Internet Explorer\Desktop\Components\GeneralFlags: 0x00000005 HKCU\Software\Microsoft\Internet Explorer\Main\Window_Placement: 2C 00 00 00 02 00 00 00 03 00 00 00 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF 00 00 00 00 00 00 00 00 20 03 00 00 3A 02 00 00 HKCU\Software\Microsoft\Internet Explorer\Main\Window_Placement: 2C 00 00 00 00 00 00 00 01 00 00 00 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF 00 00 00 00 00 00 00 00 20 03 00 00 3A 02 00 00 HKCU\Software\Microsoft\Internet Explorer\Security\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F\UserFile: 01 00 00 00 D0 8C 9D DF 01 15 D1 11 8C 7A 00 C0 4F C2 97 EB 01 00 00 00 A2 C5 D9 2F 35 B2 BE 40 BC E1 10 8F D5 25 9D F2 00 00 00 ... A2 6C 4E CC 96 D6 CF 25 42 C7 5B 2A CD B0 B3 6B 1B 1E 21 BA 72 8F 3A E3 EC EA DC 4F 3E F9 9C D1 9F FE 05 B0 DB C7 C8 4B 8D B5 E5 04 4A 46 2F 0F 6B 7C 81 11 C0 D2 A4 B6 27 81 7E 26 2F 09 1C 19 2F 34 81 21 6F 6F C1 A3 0C 31 EB AE EC DB A7 2A F2 6F 12 CB C6 47 0D DC E0 C5 33 15 A9 D0 A0 BC 69 F9 B6 9E ED 88 14 00 00 00 62 F0 EB A1 04 04 45 CA AD 38 31 E6 A2 ED C5 70 5D 68 13 6B HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\iexplore\Count: 0x00000002 HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\iexplore\Count: 0x00000003 HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\iexplore\Time: D9 07 08 00 02 00 0B 00 0E 00 3A 00 24 00 B1 01 HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\iexplore\Time: D9 07 08 00 03 00 0C 00 05 00 17 00 21 00 E9 00 HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E2E2DD38-D088-4134-82B7-F2BA38496583}\iexplore\Count: 0x00000002 HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E2E2DD38-D088-4134-82B7-F2BA38496583}\iexplore\Count: 0x00000003 HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E2E2DD38-D088-4134-82B7-F2BA38496583}\iexplore\Time: D9 07 08 00 02 00 0B 00 0E 00 3A 00 24 00 1E 02 HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E2E2DD38-D088-4134-82B7-F2BA38496583}\iexplore\Time: D9 07 08 00 03 00 0C 00 05 00 17 00 21 00 76 01 HKCU\Software\Microsoft\Windows\CurrentVersion\NetCache\AdminPinStartTime: E2 9A 62 AB 93 1A CA 01 HKCU\Software\Microsoft\Windows\CurrentVersion\NetCache\AdminPinStartTime: 4C D1 A3 E1 0C 1B CA 01 HKCU\Software\Microsoft\Windows\CurrentVersion\NetCache\AdminPinFinishTime: E2 9A 62 AB 93 1A CA 01 HKCU\Software\Microsoft\Windows\CurrentVersion\NetCache\AdminPinFinishTime: 00 96 A8 E1 0C 1B CA 01 ---------------------------------- Files added:10 ---------------------------------- C:\Documents and Settings\Administrator\Local Settings\History\History.IE5\MSHist012009081220090813\index.dat C:\WINDOWS\system\realsvc.exe C:\WINDOWS\system\realsvc.reg C:\WINDOWS\system32\AlxRes061230.exe C:\WINDOWS\system32\dd.exe C:\WINDOWS\system32\scrsys061230.scr C:\WINDOWS\system32\scrsys16_061230.scr C:\WINDOWS\system32\winsys16_061230.dll C:\WINDOWS\system32\winsys32_061230.dll C:\WINDOWS\mywinsys.ini ---------------------------------- Files deleted:1 ---------------------------------- C:\sand-box\ppp.exe ---------------------------------- Files [attributes?] modified:2 ---------------------------------- C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat ---------------------------------- Folders added:1 ---------------------------------- C:\Documents and Settings\Administrator\Local Settings\History\History.IE5\MSHist012009081220090813 ---------------------------------- Folders deleted:0 ---------------------------------- ---------------------------------- Total changes:75 ---------------------------------- ------------------------------------------------------------------------------------- Internet activity: HTTP GET hxxp://dns5.8866.org/hxw/hx/200512.exe HTTP GET hxxp://dns5.8866.org/hxw/hx/dd.exe ------------------------------------------------------------------------------------- Detected by RegRun Reanimator: Item Name: UserInit Author: Unknown Related File: C:\WINDOWS\system32\userinit.exe,rundll32.exe C:\WINDOWS\system32\winsys16_061230.dll start Type: UserInit Value Item Name: Indexingbox Author: Related File: C:\WINDOWS\system\realsvc.exe Type: Auto Services Item Name: winsys16_061230.dll Author: Unknown Related File: C:\WINDOWS\system32\winsys16_061230.dll Type: Detected using Heuristic Algorithm Item Name: AlxRes061230.exe Author: Unknown Related File: C:\WINDOWS\system32\AlxRes061230.exe Type: Detected using Heuristic Algorithm Item Name: scrsys061230.scr Author: Unknown Related File: C:\WINDOWS\system32\scrsys061230.scr Type: Detected using Heuristic Algorithm Item Name: scrsys16_061230.scr Author: Unknown Related File: C:\WINDOWS\system32\scrsys16_061230.scr Type: Detected using Heuristic Algorithm Item Name: winsys32_061230.dll Author: Unknown Related File: C:\WINDOWS\system32\winsys32_061230.dll Type: Detected using Heuristic Algorithm Item Name: xydzyh Author: Unknown Related File: C:\WINDOWS\system32\xydzyh.exe Type: Registry Run Removal Results: Success Number of reboot: 1 ------------------------------------------------------------------------------------- winsys16_061230.dll Code: Antivirus Version Last Update Result Avast 4.8.1335.0 2009.05.11 Win32:Trojan-gen {Other} AVG 8.5.0.327 2009.05.12 Win32/PolyCrypt BitDefender 7.2 2009.05.12 Trojan.Agent.AHCM Comodo 1157 2009.05.08 TrojWare.Win32.Pakes.csp DrWeb 5.0.0.12182 2009.05.12 Trojan.Hitpop F-Secure 8.0.14470.0 2009.05.12 Trojan.Win32.Pakes.csp Kaspersky 7.0.0.125 2009.05.12 Trojan.Win32.Pakes.csp Microsoft 1.4602 2009.05.12 Trojan:Win32/Agent NOD32 4067 2009.05.12 Win32/Spy.Delf.NEN Symantec 1.4.4.12 2009.05.12 Infostealer.Gampass Additional information File size: 30720 bytes MD5 : 49940b40ae39bc1d115c7d12666218d5 SHA1 : 36dee6e8f8685023db66f4f4986ad0c16dccc75b ------------------------------------------------------------------------------------- realsvc.exe Code: Antivirus Version Last Update Result Avast 4.8.1335.0 2009.08.04 - AVG 8.5.0.406 2009.08.03 Win32/Heur BitDefender 7.2 2009.08.04 GenPack:Trojan.Downloader.Delf.ALF Comodo 1843 2009.08.04 - DrWeb 5.0.0.12182 2009.08.04 - F-Secure 8.0.14470.0 2009.08.04 - Kaspersky 7.0.0.125 2009.08.04 - Microsoft 1.4903 2009.08.03 TrojanDownloader:Win32/Small.gen!C NOD32 4302 2009.08.03 a variant of Win32/Kryptik.NX Symantec 1.4.4.12 2009.08.04 Suspicious.MH690.A Additional information File size: 144680 bytes MD5 : c1d472b949ed743da275af30fa5be219 SHA1 : 77eab9ff4658dbdd2cf27cc59ea68ddc27fe0609 ------------------------------------------------------------------------------------- Recommended software: UnHackMe anti-rootkit and anti-malware http://www.unhackme.com RegRun Security Suite (Good choice for removal and protection)
Virus Problem? Google Redirects? Ads? Slow?
Constantly updated. Last update: February 5 2012
Fix Windows PC's Fast! Automated Software Repairs damaged & slow windows systems in 1 click.
|
|
