fooding.exe - Dangerous


Manual removal instructions:

Antivirus Report of fooding.exe:
fooding.exe Malware
fooding.exeHigh Risk
W32.Netsky.I@mm is a mass-mailing worm that uses its own SMTP engine to send itself to the email addresses it finds when scanning hard drives and mapped drives.

Copies itself as %Windir%\fooding.exe.
Deletes some values from the registry key (see avguard.exe - W32.Netsky.G@mm)
Scans the files on drives C through Z for email addresses.
Uses its own SMTP engine to send itself to the email addresses it found above, sending to each address once.

The email has the following characteristics:

Subject: (One of the following)
Mail account expired
Mail account closed
Mail account deactivated

Body: (One of the following)
Your mail account expired. Please follow the link to reactivate.
Your mail account has been closed. Click on the link for further details.
Your mail account has been deactivated. To reactivate, follow the link.

http:/ /www.[recipient domain]/[user]/index.scr
For example, a message to would have the attachment name http:/ /

Manual removal:
and delete the value: "Tiny AV"="%Windir%\fooding.exe -antivirus service"

Or use RegRun Startup Optimizer to automatical remove it from the system registry.

Remove fooding.exe now!

Dmitry Sokolov:

I created UnHackMe in 2006 to fix the problem that antivioruses did not fix: detecting rootkits.

Since that time I work every day to fix the issues that antiviruses cannot.

If your antivirus have not helped you solve the problem, you should try UnHackMe.

We are a small company and you can ask me directly, if you have any questions.


You can read UnHackMe testimonials here.