The following registry elements have been created:

• HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\

• HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\

• HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{BF50AC63-19DA-487E-AD4A-0B452D823B59}\

• HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\CLSID\{BF50AC63-19DA-487E-AD4A-0B452D823B59}\

• HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\CLSID\{BF50AC63-19DA-487E-AD4A-0B452D823B59}\INPROCSERVER32\

• HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{BF50AC63-19DA-487E-AD4A-0B452D823B59}\

To clean, simply run your anti virus software, we suggest Microsoft Security Essentials. If your anti-spyware app closes, this means the virus has blocked access to your app. You may either do a system scan online via Panda, or try running your antispyware in safemode.

Other Aliases from other anti virus companies

The following files were analyzed:

3766d83c6754d41c912c87b1f001fe2a1eea6747

• %APPDATA%\services.exe

• %TEMP%\e3c1c08557a0d0feee33b9c9d18b4e6c129b553f.exe

This Trojan will attempt to fiddle with your network conection, e.g hxxp://www.maxmind.com/app/***

How to remove Generic BackDoor!djf!5D41C80E​A0DA

Removal should be easy given the fact that you are able to follow directions

First thing to do is disconnect your network or internet. Now you will need to reboot your PC and enter safe mode, if you do not know how to enter safe mode, please search above for ” how to enter safe mode”

Now you will need to do a system scan using these apps below:

1. your favorite virus app, i suggest AVG or Microsoft security essentials
2. do a system scan using Malwarebytes
3. do a system scan using spybot
4. do a system scan using hijackthis

if the virus  is not letting you do these scans, you must :

1.Disable System Restore on Windows ME and windows XP only.
2.Update to current engine and DAT files for detection and removal.
3.Run a complete system scan.

This should remove the threat, this threat is a low security threat but never the less it should always be cleaned before using the world wide web.

go to start menu, then run, now type in MSCONFIG, go to startup tab and look for a long string of command that has random letters and sometimes numbers, disable that line and save.

Download Malwarebytes, update malwarebytes then do a full system scan. if any virus is found, it will delete it.

Now download spybot, do an update and a full scan, delete any melware or spyware it finds.

You surly must have a virus protection software, if not, download Microsoft Security Essentials, its free, update the app then a full scan.

These steps above should fix and delete the Trojan.win32.Generic.pak!cobra.Engine virus

Here are other virus trojans that are smiler to the one above and can be cleaned the same way.

Trojan.Win32.Generic!BT: Trojan
Trojan-Spy.Win32.Zbot.gen: Trojan
Exploit.PDF-JS.Gen (v): Exploit
Trojan.Win32.Generic!SB.0: Trojan
INF.Autorun (v): Trojan
Trojan.Win32.Hiloti.gen.d (v): Trojan
Trojan.Win32.Generic.pak!cobra: Trojan
Trojan.Win32.Adware: Adware (General)
MyWebSearch Toolbar: Potentially Unwanted Program
Trojan.Win32.Malware: Trojan

These bots have  injected “badware” i like to call it, into your server, which gives them a backdoor entrance to your server, changing password might slow the bots down from cracking the code, but over all you must clean your server and files. Download a free FTP application, a good one is Filezilla, you can get it here  http://filezilla-project.org/download.php
make sure you check your main config files where your database info is, and make sure permissions are 744
Now  download all of your files on the server to your hard drive, then scan them with your virus software. AVG or Microsoft Security Essentials are free virus apps and work great.

Once your entire server has been download to your hard drive, sort the files and folders by date. Now the dates that are the most recent are the files and folders that have been altered.
You might have to edit all the php files, most likely the files are index.php files and any other file that has a recent date. Edit these files with your favorite html editor and look for base64 codes, or any code that is within an iframe or a redirect code, these codes are always either on top of the source code or on the bottom right before ?>

They also plant the code in many files along with .js files, if you have more than one domain on your server, then be sure that they will plant more threats on your other domain files.

Once again,download your entire site to your PC, and do a virus scan locally on the files and make sure no virus files have been planted, then go through all your folders one by one checking the date, if date is new, then open the php file and look to see if there is a code.

These backdoor viruses are planted because plugins and wordperss  is not updated, make sure you update wordpress/joomla etc.  as soon as they come out with a new version. also update the plugins if needed, that is under the WP admin dashboard as well.

Once you are sure your files are clean and everything above has been done,  go to google webmaster tools www.google.com/webmasters/tools/
and click on threats and see if your site in there says infected, if so, you must send an email right through the tools section to google telling them your site is now clean, if not, google will block your sites from firefox and chrome saying its infected.

If all goes well, your site should be backup and indexed properly within a few weeks.

PS: if you do not care about your files or database, its easier to just delete all files in your server and reinstall your script and create a new database.

1.Disable System Restore windows XP only, Win 7 will not work.

2.Update to current engine and DAT files for detection and removal.

3.Run a complete system scan using AGG or Microsoft security or Kaspersky

Modifications made to the system Registry  files for the purposes of hooking system startup will be removed if cleaning with the recommended engine and DAT combination.

Stop the Fake Microsoft Security Essentials Alert Trojan processes below by pressing CTRL + Alt + Delete:

antispy.exe
defender.exe
tmp.exe
hotfix.exe

Remove these Fake Microsoft Security Essentials Alert Trojan Registry Entries:
Click start menu and type “regedit”

HKEY_CURRENT_USER\Software\PAV
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings “WarnonBadCertRecving” = “0?
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings “WarnOnPostRedirect” = “0?
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “tmp”
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce “SelfdelNT”
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon “Shell” = “%UserProfile%\Application Data\antispy.exe”
Remove these Fake Microsoft Security Essentials Alert Trojan files:
%UserProfile%\Application Data\PAV\
%UserProfile%\Application Data\antispy.exe
%UserProfile%\Application Data\defender.exe
%UserProfile%\Application Data\tmp.exe
%UserProfile%\Application Data\hotfix.exe
%UserProfile%\Local Settings\Temp\[random characters].bat

For Vista/7:
%UserProfile%\AppData\Local\antispy.exe
%UserProfile%\AppData\Local\defender.exe
%UserProfile%\AppData\Local\tmp.exe
%UserProfile%\AppData\Local\hotfix.exe

C:\END
It is impossible to list all file names and locations of modern parasites. You can identify remaining parasites, other Fake Microsoft Security Essentials Alert Trojan infected files and get help in Fake Microsoft Security Essentials Alert Trojan removal by using free Malwarebytes.

In AV Comparative’s most recent report on malware removal, Microsoft Security Essentials was the only free antivirus app rated TOP in comparison to  Norton, Kaspersky, Mcafee.  Microsoft Security Essentials also beat out technician favorite ESET which managed only an Advanced rating.

So not only has Microsoft Security Essentials beaten free competitors like AVG, Avira, and Avast, it also posted test scores equal to or better than a dozen anti-virus programs you’d have to pay for and that includes the heavy bottle necking Norton and Mcafee which slow down your PC in a big way.

So if you are in it to win it, i suggest you grab yourself a cup of coffee,  go to Microsoft.com and downlaod Microsoft Security Essentials, it will sure put a smile on your face.