Virus Profile: BackDoor Trojan Removal FAFB!2C8CB3D1155C

Posted on October 11th, 2012 by admin

Upon execution the Trojan drop a files in the below location

%system32\drivers\oreans32.sys

The following registry key have been added to the system

  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\oreans32
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\oreans32\Security
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\oreans32\Enum
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\oreans32
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\oreans32\Security
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\oreans32\Enum


The following registry key values have been added to the system

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_OREANS32\0000\Control\

  • *NewlyCreated*: 0×00000000
  •  ActiveService: “oreans32″


HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_OREANS32\0000\

  • Service: “oreans32″
  •  Legacy: 0×00000001
  • ConfigFlags: 0×00000000
  •  Class: “LegacyDriver”
  • ClassGUID: “{8ECC055D-047F-11D1-A537-0000F8753ED1}”
  • DeviceDesc: “oreans32″
  • NextInstance: 0×00000001


HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\oreans32\Enum\0: “Root\LEGACY_OREANS32\0000″ HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\oreans32\Enum\Count: 0×00000001 HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\oreans32\Enum\NextInstance: 0×0000000 HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\oreans32\Security\Security: 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 00 01 02 00 00 00 00 00 05 20 00 00 00 20 02 00 00 00 00 14 00 8D 01 02 00 01 01 00 00 00 00 00 05 0B 00 00 00 00 00 18 00 FD 01 02 00 01 02 00 00 00 00 00 05 20 00 00 00 23 02 00 00 01 01 00 00 00 00 00 05 12 00 00 00 01 01 00 00 00 00 00 05 12 00 00 00
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\oreans32\

  • Type: 0×00000001
  •  Start: 0×00000001
  •   ErrorControl: 0×00000001
  •   ImagePath: “\??\C:\WINDOWS\system32\drivers\oreans32.sys”
  •   DisplayName: “oreans32″

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_OREANS32\0000\Control\

  • *NewlyCreated*: 0×00000000
  •  ActiveService: “oreans32″
  •  Service: “oreans32″
  •   Legacy: 0×00000001
  •   ConfigFlags: 0×00000000
  •  Class: “LegacyDriver”
  •  ClassGUID: “{8ECC055D-047F-11D1-A537-0000F8753ED1}”
  • DeviceDesc: “oreans32″


HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_OREANS32\NextInstance: 0×00000001 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\oreans32\Enum\0: “Root\LEGACY_OREANS32\0000″ HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\oreans32\Enum\Count: 0×00000001 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\oreans32\Enum\NextInstance: 0×00000001 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\oreans32\Security\Security: 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 00 01 02 00 00 00 00 00 05 20 00 00 00 20 02 00 00 00 00 14 00 8D 01 02 00 01 01 00 00 00 00 00 05 0B 00 00 00 00 00 18 00 FD 01 02 00 01 02 00 00 00 00 00 05 20 00 00 00 23 02 00 00 01 01 00 00 00 00 00 05 12 00 00 00 01 01 00 00 00 00 00 05 12 00 00 00
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\oreans32\

  • Type: 0×00000001
  • Start: 0×00000001
  •  ErrorControl: 0×00000001
  •   ImagePath: “\??\C:\WINDOWS\system32\drivers\oreans32.sys”
  •   DisplayName: “oreans32″

The above registry entry ensures that it creates a service with name” oreans32” and it starts automatically whenever the system restarts.

 
Posted in Virus Profile: BackDoor Trojan Removal FAFB!2C8CB3D1155C | Tags: , , , , | Comments Off

PeakProtection2010 Adware Windows 2003/XP/2000/NT/ME/98/95

Posted on December 4th, 2011 by admin

Brief Description
PeakProtection2010is spyware and adware program which lets the end PC users know of the latest spyware and virus threats in their PC’ computers, much like spybot, AVG, melwarebytes and so on.PeakProtection2010 can reach the computer when the user accesses certain websites which can display banner ads and pop ups and what have you which can lead to the download of this program. It can also be reached via email spam, email link and so forth.

Visible Symptoms
PeakProtection2010is pretty simple to recognize.

  • When the app runs in windows, it will display the installer like the one below.PeakProtection2010 installation window
  • Once installed, the computer is restarted and the following screen is displayed where only one option can be selected:Screen displayed by PeakProtection2010
  • When users click on this button, it stats scanning the system and once ended, it shows the results with the infected and restored files:Results of the scan carried out by PeakProtection2010
 
Posted in PeakProtection2010 Adware Windows 2003/XP/2000/NT/ME/98/95 | Tags: , , , , , , , | Comments Off
« Older Entries
 
 

Blogroll

Tags

anti malware antivirus AVG backdoor fake security software generic infected Internet Explorer IRC virus malwarebytes melwarebytes messaging Microsoft Security Essentials Popup Blocker quicktime removal scareware spyware threat Trojan trojan horse Virus virus removal Vulnerability w32 W32/Autorun windows worm

Resources