|
|
Malware Tests - removal of the newest malware.
Detect and remove hidden rootkits using
UnHackMe
RegRun Security Suite = 24 system utilities for protecting your computer. Get it! |
 u5.exe - Dangerous
%PROGRAM FILES%\SafetyCenter\start.exe is Trojan/Backdoor. Kill the process %PROGRAM FILES%\SafetyCenter\start.exe and remove %PROGRAM FILES%\SafetyCenter\start.exe from Windows startup. Malware dropper: u5.exe Removed: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~1.dll C:\Program Files\SafetyCenter\start.exe C:\PROGRAM FILES\SAFETYCENTER\NEW.EXE ------------------------------------------------------------------------------------- Classification: Code: Antivirus Version Last Update Result F-Secure 8.0.14470.0 2009.09.30 - Kaspersky 7.0.0.125 2009.09.30 - McAfee 5756 2009.09.29 - Microsoft 1.5005 2009.09.23 - NOD32 4469 2009.09.30 a variant of Win32/Adware.SafetyCenter.A Symantec 1.4.4.12 2009.09.30 - Additional information File size: 1211392 bytes MD5 : 6da4c16b76295338bb090d13a7103c85 SHA1 : 2620efedb3885c36dc67f5ef43f1d2340e78f6fc ------------------------------------------------------------------------------------- Installation When the program is executed, it creates the following registry subkeys and values: ---------------------------------- Keys added:14 ---------------------------------- HKLM\SOFTWARE\Classes\CLSID\{40DFB4D8-3131-4917-A925-2EEF6BD048FE} HKLM\SOFTWARE\Classes\CLSID\{40DFB4D8-3131-4917-A925-2EEF6BD048FE}\InprocServer32 HKLM\SOFTWARE\Classes\CLSID\{5172ec55-e786-48a9-8fd9-c27c6a99f249} HKLM\SOFTWARE\Classes\CLSID\{5172ec55-e786-48a9-8fd9-c27c6a99f249}\DefaultIcon HKLM\SOFTWARE\Classes\CLSID\{5172ec55-e786-48a9-8fd9-c27c6a99f249}\Shell HKLM\SOFTWARE\Classes\CLSID\{5172ec55-e786-48a9-8fd9-c27c6a99f249}\Shell\Open HKLM\SOFTWARE\Classes\CLSID\{5172ec55-e786-48a9-8fd9-c27c6a99f249}\Shell\Open\Command HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{40DFB4D8-3131-4917-A925-2EEF6BD048FE} HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ControlPanel\NameSpace\{5172ec55-e786-48a9-8fd9-c27c6a99f249} HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{5172ec55-e786-48a9-8fd9-c27c6a99f249} HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{5172ec55-e786-48a9-8fd9-c27c6a99f249} HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\NetworkNeighborhood\NameSpace\{5172ec55-e786-48a9-8fd9-c27c6a99f249} HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SafetyCenter HKLM\SOFTWARE\SafetyCenter ---------------------------------- Values added:18 ---------------------------------- HKLM\SOFTWARE\Classes\CLSID\{40DFB4D8-3131-4917-A925-2EEF6BD048FE}\InprocServer32\: "C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~1.dll" HKLM\SOFTWARE\Classes\CLSID\{40DFB4D8-3131-4917-A925-2EEF6BD048FE}\InprocServer32\ThreadingModel: "Apartment" HKLM\SOFTWARE\Classes\CLSID\{40DFB4D8-3131-4917-A925-2EEF6BD048FE}\: "" HKLM\SOFTWARE\Classes\CLSID\{5172ec55-e786-48a9-8fd9-c27c6a99f249}\Shell\Open\Command\: "C:\Program Files\SafetyCenter\protector.exe" HKLM\SOFTWARE\Classes\CLSID\{5172ec55-e786-48a9-8fd9-c27c6a99f249}\DefaultIcon\: "C:\Program Files\SafetyCenter\main.ico" HKLM\SOFTWARE\Classes\CLSID\{5172ec55-e786-48a9-8fd9-c27c6a99f249}\: "Safety Center" HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ControlPanel\NameSpace\{5172ec55-e786-48a9-8fd9-c27c6a99f249}\: "Safety Center" HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{5172ec55-e786-48a9-8fd9-c27c6a99f249}\: "Safety Center" HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{5172ec55-e786-48a9-8fd9-c27c6a99f249}\: "Safety Center" HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\NetworkNeighborhood\NameSpace\{5172ec55-e786-48a9-8fd9-c27c6a99f249}\: "Safety Center" HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\SafetyCenter: "C:\Program Files\SafetyCenter\start.exe" HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SafetyCenter\DisplayName: "SafetyCenter" HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SafetyCenter\UninstallString: "C:\Program Files\SafetyCenter\uninstall.exe" HKLM\SOFTWARE\SafetyCenter\Exename: "C:\Program Files\SafetyCenter\protector.exe" HKLM\SOFTWARE\SafetyCenter\Sound: "C:\Program Files\SafetyCenter\sound.wav" HKLM\SOFTWARE\SafetyCenter\Startup: "C:\Program Files\SafetyCenter\start.exe" HKLM\SOFTWARE\SafetyCenter\New: "C:\Program Files\SafetyCenter\new.exe" HKLM\SOFTWARE\SafetyCenter\boot: "1" ---------------------------------- Values modified:0 ---------------------------------- ---------------------------------- Files added:8 ---------------------------------- C:\Documents and Settings\Administrator\Local Settings\Temp\~1.dll C:\Documents and Settings\Administrator\Local Settings\Temp\~1.tmp C:\Program Files\SafetyCenter\main.ico C:\Program Files\SafetyCenter\new.exe C:\Program Files\SafetyCenter\protector.exe C:\Program Files\SafetyCenter\sound.wav C:\Program Files\SafetyCenter\start.exe C:\Program Files\SafetyCenter\uninstall.exe ---------------------------------- Files [attributes?] modified:0 ---------------------------------- ---------------------------------- Folders added:1 ---------------------------------- C:\Program Files\SafetyCenter ---------------------------------- Folders deleted:0 ---------------------------------- ---------------------------------- Total changes:41 ---------------------------------- ------------------------------------------------------------------------------------- Internet activity: Code: HTTP GET http://83.233.165.145/secure/index_new.p... ------------------------------------------------------------------------------------- Detected by UnHackMe: Item Name: {40DFB4D8-3131-4917-A925-2EEF6BD048FE} Author: Unknown Related File: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~1.dll Type: Browser Helper Objects Item Name: SafetyCenter Author: Unknown Related File: C:\Program Files\SafetyCenter\start.exe Type: Registry RunOnce Item Name: new.exe Author: Unknown Related File: C:\PROGRAM FILES\SAFETYCENTER\NEW.EXE Type: Running Processes Removal Results: Success Number of reboot: 1 ------------------------------------------------------------------------------------- Recommended software: UnHackMe anti-rootkit and anti-malware http://www.unhackme.com RegRun Security Suite (Good choice for removal and protection) http://www.regrun.com Removal: u5.exe is removed by RegRun.
Read more... Removal instructions...
UnHackMe - Rootkit/Malware killer
Also recommended software: UnHackMe is a part of RegRun Security Suite Platinum.
What is hidden in MSDN? Why software developers prefer Win32.FreeTechSecrets.com? All Unix Manuals in Alphabetical Order C# controls for .NET in 3 simple steps. Constantly updated. Last update: November 16 2009
Interesting information about Vista programs... Need consultation? Would you like to add your opinion?
|
|
