|
|
Malware Tests - removal of the newest malware.
Detect and remove hidden rootkits using
UnHackMe
RegRun Security Suite = 24 system utilities for protecting your computer. Get it! |
 zsipady.dll - Dangerous
Zsipady.dll is Trojan/Backdoor. Kill the file zsipady.dll and remove zsipady.dll from Windows startup. Malware dropper: file.exe Removed: c:\windows\system32\zsipady.dll ------------------------------------------------------------------------------------- Classification: Code: Antivirus Version Last Update Result F-Secure 8.0.14470.0 2009.10.14 Trojan-Dropper.Win32.Boaxxe.ac Kaspersky 7.0.0.125 2009.10.14 Trojan-Dropper.Win32.Boaxxe.ac McAfee 5770 2009.10.13 Suspect-02!9A856C53A8A6 Microsoft 1.5101 2009.10.14 - NOD32 4507 2009.10.14 - Symantec 1.4.4.12 2009.10.14 Trojan.Dropper Additional information File size: 204288 bytes MD5 : 9a856c53a8a6195ce88f7aa1eec92746 SHA1 : f992d46c083659b28bef49e4a6f77123e9132ce0 ------------------------------------------------------------------------------------- Installation When the program is executed, it creates the following registry subkeys and values: ---------------------------------- Keys added:9 ---------------------------------- HKLM\SOFTWARE\Classes\CLSID\{3B3B5023-B120-45F6-80B1-BA86D04D66F1} HKLM\SOFTWARE\Classes\CLSID\{3B3B5023-B120-45F6-80B1-BA86D04D66F1}\InprocServer32 HKLM\SOFTWARE\Classes\CLSID\{3B3B5023-B120-45F6-80B1-BA86D04D66F1}\ProgID HKLM\SOFTWARE\Classes\Anzqsyzt HKLM\SOFTWARE\Classes\Anzqsyzt\CLSID HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3B3B5023-B120-45F6-80B1-BA86D04D66F1} HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\yrkyntqw HKLM\SYSTEM\CurrentControlSet\Services\ooffeyur HKLM\SYSTEM\CurrentControlSet\Services\ooffeyur\Parameters ---------------------------------- Values added:21 ---------------------------------- HKLM\SOFTWARE\Classes\CLSID\{3B3B5023-B120-45F6-80B1-BA86D04D66F1}\ProgID\: "Anzqsyzt" HKLM\SOFTWARE\Classes\CLSID\{3B3B5023-B120-45F6-80B1-BA86D04D66F1}\InprocServer32\: "c:\windows\system32\zsipady.dll" HKLM\SOFTWARE\Classes\CLSID\{3B3B5023-B120-45F6-80B1-BA86D04D66F1}\InprocServer32\ThreadingModel: "Apartment" HKLM\SOFTWARE\Classes\CLSID\{3B3B5023-B120-45F6-80B1-BA86D04D66F1}\: "" HKLM\SOFTWARE\Classes\CLSID\{3B3B5023-B120-45F6-80B1-BA86D04D66F1}\Version: 0x00000047 HKLM\SOFTWARE\Classes\Anzqsyzt\CLSID\: "{3B3B5023-B120-45F6-80B1-BA86D04D66F1}" HKLM\SOFTWARE\Classes\Anzqsyzt\: "" HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\yrkyntqw\Asynchronous: 0x00000000 HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\yrkyntqw\Impersonate: 0x00000000 HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\yrkyntqw\DLLName: "zsipady.dll" HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\yrkyntqw\Logoff: "WLEventLogoff" HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\yrkyntqw\Logon: "WLEventLogon" HKLM\SYSTEM\CurrentControlSet\Services\Schedule\AtTaskMaxHours: 0x00000048 HKLM\SYSTEM\CurrentControlSet\Services\ooffeyur\Parameters\ServiceDll: "C:\WINDOWS\system32\zsipady.dll" HKLM\SYSTEM\CurrentControlSet\Services\ooffeyur\ImagePath: "%SystemRoot%\System32\svchost.exe -k netsvcs" HKLM\SYSTEM\CurrentControlSet\Services\ooffeyur\Description: "Direct Parallel Link" HKLM\SYSTEM\CurrentControlSet\Services\ooffeyur\DisplayName: "Direct Parallel Link Helper" HKLM\SYSTEM\CurrentControlSet\Services\ooffeyur\ErrorControl: 0x00000001 HKLM\SYSTEM\CurrentControlSet\Services\ooffeyur\ObjectName: "LocalSystem" HKLM\SYSTEM\CurrentControlSet\Services\ooffeyur\Start: 0x00000002 HKLM\SYSTEM\CurrentControlSet\Services\ooffeyur\Type: 0x00000020 ---------------------------------- Values modified:12 ---------------------------------- HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\netsvcs: '6to4 AppMgmt AudioSrv Browser CryptSvc DMServer DHCP ERSvc EventSystem FastUserSwitchingCompatibility HidServ Ias Iprip Irmon LanmanServer LanmanWorkstation Messenger Netman Nla Ntmssvc NWCWorkstation Nwsapagent Rasauto Rasman Remoteaccess Schedule Seclogon SENS Sharedaccess SRService Tapisrv Themes TrkWks W32Time WZCSVC Wmi WmdmPmSp winmgmt wscsvc xmlprov napagent hkmsvc BITS wuauserv ShellHWDetection helpsvc WmdmPmSN' HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\netsvcs: '6to4 AppMgmt AudioSrv Browser CryptSvc DMServer DHCP ERSvc EventSystem FastUserSwitchingCompatibility HidServ Ias Iprip Irmon LanmanServer LanmanWorkstation Messenger Netman Nla Ntmssvc NWCWorkstation Nwsapagent Rasauto Rasman Remoteaccess Schedule Seclogon SENS Sharedaccess SRService Tapisrv Themes TrkWks W32Time WZCSVC Wmi WmdmPmSp winmgmt ooffeyur wscsvc xmlprov napagent hkmsvc BITS wuauserv ShellHWDetection helpsvc WmdmPmSN' HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\DisableSR: 0x00000001 HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\DisableSR: 0x00000000 HKLM\SYSTEM\CurrentControlSet\Services\Schedule\NextAtJobId: 0x00000001 HKLM\SYSTEM\CurrentControlSet\Services\Schedule\NextAtJobId: 0x00000002 HKLM\SYSTEM\CurrentControlSet\Services\sr\Start: 0x00000004 HKLM\SYSTEM\CurrentControlSet\Services\sr\Start: 0x00000000 HKLM\SYSTEM\CurrentControlSet\Services\sr\ImagePath: "\SystemRoot\system32\DRIVERS\sr.sys" HKLM\SYSTEM\CurrentControlSet\Services\sr\ImagePath: "system32\DRIVERS\sr.sys" HKLM\SYSTEM\CurrentControlSet\Services\sr\Parameters\FirstRun: 0x00000001 HKLM\SYSTEM\CurrentControlSet\Services\sr\Parameters\FirstRun: 0x00000000 ---------------------------------- Files added:4 ---------------------------------- C:\WINDOWS\system32\Restore\MachineGuid.txt C:\WINDOWS\system32\cnijzsq.dll C:\WINDOWS\system32\zsipady.dll C:\WINDOWS\Tasks\At1.job ---------------------------------- Files [attributes?] modified:0 ---------------------------------- ---------------------------------- Folders added:0 ---------------------------------- ---------------------------------- Folders deleted:0 ---------------------------------- ---------------------------------- Total changes:46 ---------------------------------- ------------------------------------------------------------------------------------- Detected by UnHackMe: Item Name: {3B3B5023-B120-45F6-80B1-BA86D04D66F1} Author: Microsoft Corporation Related File: c:\windows\system32\zsipady.dll Type: Browser Helper Objects Item Name: yrkyntqw Author: Microsoft Corporation Related File: zsipady.dll Type: Winlogon Notification Item Name: ooffeyur Author: Unknown Related File: C:\WINDOWS\system32\zsipady.dll Type: Svchost DLLs After first reboot detected by UnHackMe: Item Name: {3B3B5023-B120-45F6-80B1-BA86D04D66F1} Author: Related File: c:\windows\system32\zsipady.dll Type: Browser Helper Objects Removal Results: Success Number of reboot: 1 ------------------------------------------------------------------------------------- Recommended software: UnHackMe anti-rootkit and anti-malware http://www.unhackme.com RegRun Security Suite (Good choice for removal and protection) http://www.regrun.com Removal: zsipady.dll is removed by RegRun.
Read more... Removal instructions...
UnHackMe - Rootkit/Malware killer
Also recommended software: UnHackMe is a part of RegRun Security Suite Platinum.
What is hidden in MSDN? Why software developers prefer Win32.FreeTechSecrets.com? All Unix Manuals in Alphabetical Order C# controls for .NET in 3 simple steps. Constantly updated. Last update: November 16 2009
Interesting information about Vista programs... Need consultation? Would you like to add your opinion?
|
|
