Troj/Soromo-A is a browser-hijacking Trojan.
In order to run automatically when Windows starts up the Trojan copies itself to one of the following filenames in the Windows system folder:
update.exe; explorer.exe; winlogon.exe; system.exe; taskman.exe; taskmon.exe; svchost.exe; services.exe; wupdmgr.exe; winspool.exe; webcheck.exe; wininet.exe
Troj/Soromo-A periodically starts up a browser and directs it to a URL chosen randomly from a list of websites configured by the author.
Manual removal:
Locate the HKEY_LOCAL_MACHINE entries:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\System Update
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce\System Update
and delete them if they exist.
Removal: webcheck.exe is removed by RegRun.
Read more... Removal instructions...
Recommended software:
UnHackMe - easy removal Rootkits/Adware/Spyware.
http://www.unhackme.com
RegRun Security Suite - removal and protection.
http://www.regrun.com
RegRun Reanimator - free removal tool.
greatis.com/reanimator
RegRun - User's Choice
Vista Programs - full info...
What is hidden in MSDN?
.NET Secrets Revealed
Why software developers prefer Win32.FreeTechSecrets.com?
All Unix Manuals in Alphabetical Order
C# controls for .NET in 3 simple steps.
Constantly updated. Last update:
May 12 2008
Interesting information about Vista programs...
Need consultation?
Would you like to add your opinion?