winitr32.exe - Dangerous
winitr32.exe
Jeff's Story:
My PC had gotten a bad rootkit that my ISP antivirus software (powered by McAfee) could not detect, nor could fix.
I sought a solution on the Internet and discovered your product and tried out the trial.
You quickly found the rootkit and SAVED my PC!
I haven't had any problems since, and I'm extremely grateful.
Manual removal instructions:
The worm also contains backdoor Trojan functionality, allowing unauthorised remote access to the infected computer via IRC channels.
It moves itself to the Windows system folder as winitr32.exe and creates the following registry entries to run itself on system logon:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Win32 Wmls Driver = winitr32.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce\Win32 Wmls Driver = winitr32.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\Win32 Wmls Driver = winitr32.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Win32 Wmls Driver = winitr32.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce\Win32 Wmls Driver = winitr32.exe
Attempts to spread to network machines using various exploits including the LSASS vulnerability.
Also, attempts to terminate several processes related to anti-virus and security related software.
Remove it from startup with RegRun Startup Optimizer.