Free Spyware Adware Worm and Virus Trojan Horse Download Removal Tools » backdoor http://www.softe.org FREE Computer Repair Sun, 04 Dec 2011 21:36:51 +0000 en hourly 1 http://wordpress.org/?v=3.3.1 BackDoor-EVC!8F7F8F47​013F Network Trojan and how to remove http://www.softe.org/backdoor-evc8f7f8f47%e2%80%8b013f-network-trojan-and-how-to-remove.html http://www.softe.org/backdoor-evc8f7f8f47%e2%80%8b013f-network-trojan-and-how-to-remove.html#comments Fri, 30 Sep 2011 04:39:12 +0000 admin http://www.softe.org/?p=166 This backdoor Trojan  infects  files, registry, and network communication.

The following registry elements have been created:

  • HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\
  • HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\
  • HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{BF50AC63-19DA-487E-AD4A-0B452D823B59}\
  • HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\CLSID\{BF50AC63-19DA-487E-AD4A-0B452D823B59}\
  • HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\CLSID\{BF50AC63-19DA-487E-AD4A-0B452D823B59}\INPROCSERVER32\
  • HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{BF50AC63-19DA-487E-AD4A-0B452D823B59}\
This virus can be removed with microsoft security essentials. If your PC gets locked you are getting a black screen, you might want to run scan in safe mode.
Other names to reffer to.
]]> http://www.softe.org/backdoor-evc8f7f8f47%e2%80%8b013f-network-trojan-and-how-to-remove.html/feed 0 So how do you Remove Koobface the facebook worm virus http://www.softe.org/so-how-do-you-remove-koobface-the-facebook-worm-virus.html http://www.softe.org/so-how-do-you-remove-koobface-the-facebook-worm-virus.html#comments Thu, 08 Sep 2011 18:50:02 +0000 admin http://www.softe.org/?p=159 Koobface Virus threat is one that is taking by storm, specially because it uses a host such as facebook social network to spread the virus.  This Koobface virus finds methods to seek into the users PC and spread malware into the computer so its considered as a worm which replicates itself within your computer.  So how does KoobFace infect your PC, well its simple really, if you use facebook, and you receive a strange email, stating something along the lines of ” click here to see your face look stupid” which attracts you to click the link,  once clicked, a virus code will be downloaded to your PC which will then spread the worm to your PC and start to redirect your search results from google to malicious software and websites. Simple huh?

So how do you Remove Koobface worm virus?

With  anti-malware software such as melwarebytes and spybot, you might be able to remove this worm, but sometimes this is not possible and you need to manually remove it.

Using The Add Remove Program in control panel:

  • Go to Add\Remove in control panel
  • Look up for the Koobface malware to remove and uninstall it.

if you do not see the koobface there, go to registry and search for: ( if you do not know how to use your registry, you might really screw up your PC for good, so take note, this step is for advanced users who have messed around with the registry and know their way around.)

  • Search for “koobface” in Mycomputer using find utility.
  • Note down Koobface file path some where.
  • Press Ctrl+Alt+Del to open ‘Task Manager’
  • End the “Koobface” processes.

End the following processes

  1. %SYSTEMROOT%\bolivar28.exe
  2. che07.exe
  3. bolivar28.exe
  4. %WinDir%\system32\nScan\ekrn.exe
  5. %WinDir%\system32\nScan\ecls.exe
  6. %WinDir%\system32\splm\ncsjapi32.exe
  7. %WinDir%\bolivar28.exe
  8. C:\Windows\fbtre6.exe

now change Registry Files

  • Type ‘regedit’ in Run and press Enter.
  • The Registry Editor will appear, locate the above mentioned process files and delete them.
  • Locate “Koobface” registry entries and delete them, they are as the follows:
  1. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\Intelli Mouse Pro Version 2.0B\StubPath: “%WinDir% \System32\splm\ncsjapi32.exe”
  2. HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\RunOnce\*Intelli Mouse Pro Version 2.0B*: “%WinDir% \System32\splm\ncsjapi32.exe”
  3. HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Run\Intelli Mouse Pro Version 2.0B: “%WinDir% \System32\splm\ncsjapi32.exe”
  4. HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Hidden: “2″
  5. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\*Intelli Mouse Pro Version 2.0B*: “%WinDir% \System32\splm\ncsjapi32.exe”
  6. HKEY_USERS\Software\Microsoft\Windows\nScan32\ExecuteDate: “14\8\2008″
  7. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Current Version\Run\”systray” = “c:\windows\mstre6.exe”
  8. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Current Version\Run\”systray” = “C:\Windows\fbtre6.exe”
  9. HKEY_CURRENT_USER\AppEvents\Schemes\Apps\Explorer\Navigating

Now you have to unregister the dll files

  • Go to start and type in ‘cmd’ to open comman prompt.
  • First locate the following dll files using ‘dir’ command.
  1. %WinDir%\system32\nScan\ekrnEmon.dll
  2. %WinDir%\system32\nScan\ekrnScan.dll
  3. %WinDir%\system32\nScan\ekrnEpfw.dll
  4. %WinDir%\system32\nScan\ekrnAmon.dll
  5. %WinDir%\system32\splm\lmfunit32.dll
  6. %WinDir%\system32\splm\mcaserv32.dll
  7. %WinDir%\system32\splm\kbdsapi.dll
  • Now change the current directory using ‘cd’ command leave a space after ‘cd’ and then the path of dll file, which you have located above. Press enter after this.
  • Now unregister dll file by typing “directory path+’regsvr32/u’+dll file name”. Press enter, the file will be unregistered.

 

]]> http://www.softe.org/so-how-do-you-remove-koobface-the-facebook-worm-virus.html/feed 0 Generic BackDoor!djf!5D41C80E​A0DA malware Trojan Virus http://www.softe.org/generic-backdoordjf5d41c80e%e2%80%8ba0da-malware-trojan-virus.html http://www.softe.org/generic-backdoordjf5d41c80e%e2%80%8ba0da-malware-trojan-virus.html#comments Wed, 20 Jul 2011 22:58:29 +0000 admin http://www.softe.org/?p=154 These files were added to the system:

  • %APPDATA%\services.exe
  • %TEMP%\e3c1c08557a0d0feee33b9c9d18b4e6c129b553f.exe

This Trojan will attempt to fiddle with your network conection, e.g hxxp://www.maxmind.com/app/***

Virus app’s
 Detection Names
EMSI Software Trojan.Backdoor.Ircbot!IK
avast Win32:Ruskill-F
Kaspersky Backdoor.Win32.IRCBot.tjd
BitDefender Backdoor.Bot.138642
Microsoft VirTool:Win32/CeeInject.gen!EI
Symantec Backdoor.IRC.Bot
Eset a variant of Win32/Injector.GLN trojan
norman W32/Suspicious_Gen3.TYCW
Sophos Mal/Generic-L
Trend Micro PAK_Generic.001
vba32 Backdoor.IRCBot.tjd

How to remove Generic BackDoor!djf!5D41C80E​A0DA

Removal should be easy given the fact that you are able to follow directions ;)

First thing to do is disconnect your network or internet. Now you will need to reboot your PC and enter safe mode, if you do not know how to enter safe mode, please search above for ” how to enter safe mode”

Now you will need to do a system scan using these apps below:

1. your favorite virus app, i suggest AVG or Microsoft security essentials
2. do a system scan using Malwarebytes
3. do a system scan using spybot
4. do a system scan using hijackthis

if the virus  is not letting you do these scans, you must :

1.Disable System Restore on Windows ME and windows XP only.
2.Update to current engine and DAT files for detection and removal.
3.Run a complete system scan.

This should remove the threat, this threat is a low security threat but never the less it should always be cleaned before using the world wide web.

]]> http://www.softe.org/generic-backdoordjf5d41c80e%e2%80%8ba0da-malware-trojan-virus.html/feed 0 Virus Profile: BackDoor-CEP.gen how to clean http://www.softe.org/virus-profile-backdoor-cep-gen-how-to-clean.html http://www.softe.org/virus-profile-backdoor-cep-gen-how-to-clean.html#comments Fri, 20 May 2011 06:16:16 +0000 admin http://www.softe.org/?p=140 Virus Profile: BackDoor-CEP.gen.cq!CF151229CE1E

avast Win32:Caxnet [Trj]
AVG (GriSoft) Rootkit-Pakes.BG (Trojan horse)
avira TR/Koutodoor.psa
Kaspersky HEUR:Trojan.Win32.Generic
BitDefender Gen:Variant.Koutodoor.18
clamav Trojan.Dropper-27717
Dr.Web Trojan.MulDrop.origin
F-Prot W32/Koutodoor.N.gen!Eldorado
FortiNet W32/Koutodoor.KWD!tr.bdr
Microsoft Trojan:Win32/Koutodoor.E
Symantec Trojan.Koutodoor
Eset Win32/Koutodoor.HM trojan (variant)
norman W32/Suspicious_Gen2.LZIQS (trojan)
panda Trj/Genetic.gen
rising Trojan.Win32.Generic.1282E422
Sophos Troj/Kouto-D
Trend Micro TROJ_DLOADR.SMOM
vba32 Trojan.Downloader.gen.h (suspected)

The following files have been added to the system:
%WINDIR%\SYSTEM32\szccw.dll
%TEMP%\nsd12.tmp
%PROGRAMFILES%\Microsoft\ie13\Internat Explorer\target.lnk
%ALLUSERSPROFILE%\Desktop\Internat Explorer.jgp
%WINDIR%\SYSTEM32\drivers\fmsde.sys
%PROGRAMFILES%\Microsoft\ie13\Internat Explorer\Desktop.ini
The following files were temporarily written to disk then later removed:
%TEMP%\hmufctw.bat
%TEMP%\nsq13.tmp
%TEMP%\ygnpyvce.bat
%TEMP%\nsi11.tmp
%WINDIR%\SYSTEM32\mhzscp.bat
%TEMP%\faxjdr.exe
%TEMP%\tmp.bat
%TEMP%\yxcdiz.exe
%TEMP%\nsq13.tmp\System.dll
%TEMP%\wcyolgo.bat
%TEMP%\ftrnkqxw.bat

This is a Trojan detection Unlike viruses Trojans do not self replicate they are spread manually under the premise that they are beneficial. The most common installation methods involve system security exploitation unsuspecting users manually executing unknown programs. Distribution channels include email malicious or hacked Web pages, Internet Relay Chat (IRC), peer-to-peer networks and what have you.

]]> http://www.softe.org/virus-profile-backdoor-cep-gen-how-to-clean.html/feed 0 Generic Trojan BackDoor!cyh!E437DACF​F88B Virus Threat Removal http://www.softe.org/generic-trojan-backdoorcyhe437dacf%e2%80%8bf88b-virus-threat-removal.html http://www.softe.org/generic-trojan-backdoorcyhe437dacf%e2%80%8bf88b-virus-threat-removal.html#comments Wed, 09 Mar 2011 05:22:04 +0000 admin http://www.softe.org/?p=128 ystem Changes

Some path values have been replaced with environment variables as the exact location may vary with different configurations.
e.g.
%WINDIR% = \WINDOWS (Windows 9x/ME/XP/Vista/7), \WINNT (Windows NT/2000)
%PROGRAMFILES% = \Program Files

The following registry elements have been created:

  • HKEY_CURRENT_USER\SOFTWARE\ENIGMA PROTECTOR\
  • HKEY_CURRENT_USER\SOFTWARE\ENIGMA PROTECTOR\29AEB4A0365755F6-B862CAE984EA4D0E\
  • HKEY_CURRENT_USER\SOFTWARE\ENIGMA PROTECTOR\29AEB4A0365755F6-B862CAE984EA4D0E\02F01F553A112DCE-00C9DB38C18D5FD1\
  • HKEY_CURRENT_USER\SOFTWARE\ENIGMADEVELOPERS\

The following files have been added to the system:

* %WINDIR%\SYSTEM32\svhest.dll

* %WINDIR%\SYSTEM32\svhest.exe

To remove Generic Trojan BackDoor!cyh!E437DACF​F88B Virus

Download Malwarebytes’ Anti-Malware if you do now have this free software, from  here and save it to your computer.

  • Double click mbam-setup.exe and install
  • At the end of the installation be sure a checkmark
    • Update Malwarebytes’ Anti-Malware
    • and Launch Malwarebytes’ Anti-Malware
    • do a full scan and allow your computer to fix your virus.
]]> http://www.softe.org/generic-trojan-backdoorcyhe437dacf%e2%80%8bf88b-virus-threat-removal.html/feed 0 How to remove BackDoor.SmallX.VX virus trojan http://www.softe.org/how-to-remove-backdoor-smallx-vx-virus-trojan.html http://www.softe.org/how-to-remove-backdoor-smallx-vx-virus-trojan.html#comments Tue, 13 Jul 2010 20:02:33 +0000 admin http://www.softe.org/?p=75 Backdoor.smallX.VX is a nasty virus that enters the PC adn opens system back doors in Windows XP and Vista and could enter windows 7, once in your computer, the virus starts to download countless packed malware threats and gives distant hackers access to the infected machine via open ports.

Stopzilla says to use their app to remove this threat, but you can simply use http://www.malwarebytes.org to remove this threat. Make sure you first download this app, update it, disconnect your PC from the internet, then run malwarebytes.

]]> http://www.softe.org/how-to-remove-backdoor-smallx-vx-virus-trojan.html/feed 0