|
|
UnHackMe Warrior Removing rootkits is best done from the "clean" Windows!
Blog: New viruses/malware/rootkits. Everyday!
Blog: How to remove malware/Trojans/rootkits using UnHackMe or manually. We know how to remove malware.
Shortcut Antivirus protects against Microsoft LNK and PIF vulnerability, notify a user about found threats and give possibility to immediately remove threats.
StuxnetRemover - free of charge Stuxnet/Tmphider rootkit removal tool.
|
 xyyy.exe - Dangerous
Fix it immediately
Xyyy.exe is Trojan/Backdoor. Kill the process xyyy.exe and remove xyyy.exe from Windows startup. File: xyyy.exe Classification: Antivirus Version Last Update Result Avast 4.8.1335.0 2009.06.07 Win32:Agent-MJK AVG 8.5.0.339 2009.06.07 Downloader.Agent.RXM BitDefender 7.2 2009.06.08 Trojan.Agent.ABRR Comodo 1283 2009.06.08 TrojWare.Win32.TrojanDownloader.Agent.DDL DrWeb 5.0.0.12182 2009.06.08 Win32.Ntldrbot F-Secure 8.0.14470.0 2009.06.08 Trojan-Downloader.Win32.Agent.ddl NOD32 4136 2009.06.07 Win32/TrojanDownloader.Agent.DDL Symantec 1.4.4.12 2009.06.08 Trojan Horse Additional information File size: 28160 bytes MD5 : c42bf7fe10d42044915549a3e30d996a SHA1 : 804ff3c4f8ec50f5a5123832d303ab43e8afa249 Installation When the program is executed, it creates the following registry subkeys and values: ---------------------------------- Keys added:4 ---------------------------------- HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_F1B566AF.SYS HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_F1B566AF.SYS\0000 HKLM\SYSTEM\CurrentControlSet\Services\f1b566af.sys HKLM\SYSTEM\CurrentControlSet\Services\f1b566af.sys\Security ---------------------------------- Values added:13 ---------------------------------- HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_F1B566AF.SYS\0000\Service: "f1b566af.sys" HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_F1B566AF.SYS\0000\Legacy: 0x00000001 HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_F1B566AF.SYS\0000\ConfigFlags: 0x00000000 HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_F1B566AF.SYS\0000\Class: "LegacyDriver" HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_F1B566AF.SYS\0000\ClassGUID: "{8ECC055D-047F-11D1-A537-0000F8753ED1}" HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_F1B566AF.SYS\0000\DeviceDesc: "f1b566af.sys" HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_F1B566AF.SYS\NextInstance: 0x00000001 HKLM\SYSTEM\CurrentControlSet\Services\f1b566af.sys\Security\Security: 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 00 01 02 00 00 00 00 00 05 20 00 00 00 20 02 00 00 00 00 14 00 8D 01 02 00 01 01 00 00 00 00 00 05 0B 00 00 00 00 00 18 00 FD 01 02 00 01 02 00 00 00 00 00 05 20 00 00 00 23 02 00 00 01 01 00 00 00 00 00 05 12 00 00 00 01 01 00 00 00 00 00 05 12 00 00 00 HKLM\SYSTEM\CurrentControlSet\Services\f1b566af.sys\Type: 0x00000001 HKLM\SYSTEM\CurrentControlSet\Services\f1b566af.sys\Start: 0x00000001 HKLM\SYSTEM\CurrentControlSet\Services\f1b566af.sys\ErrorControl: 0x00000000 HKLM\SYSTEM\CurrentControlSet\Services\f1b566af.sys\ImagePath: "\??\C:\WINDOWS\system32\drivers\f1b566af.sys" HKLM\SYSTEM\CurrentControlSet\Services\f1b566af.sys\DisplayName: "f1b566af.sys" ---------------------------------- Values modified:0 ---------------------------------- ---------------------------------- Files added:1 ---------------------------------- C:\WINDOWS\system32\drivers\f1b566af.sys ---------------------------------- Files [attributes?] modified:0 ---------------------------------- ---------------------------------- Folders added:0 ---------------------------------- ---------------------------------- Folders deleted:0 ---------------------------------- ---------------------------------- Total changes:18 ---------------------------------- ------------------------------------------------------------------------------------- Detected by RegRun Reanimator: Item Name: f1b566af.sys Author: Related File: \??\C:\WINDOWS\system32\drivers\f1b566af.sys Type: Services detected by Partizan Removal Results: Success Number of reboot: 1 Recommended software: UnHackMe anti-rootkit and anti-malware http://www.unhackme.com RegRun Security Suite (Good choice for removal and protection)
Virus Problem? Google Redirects? Ads? Slow?
Constantly updated. Last update: February 5 2012
Fix Windows PC's Fast! Automated Software Repairs damaged & slow windows systems in 1 click.
|
|
