class type: spyware, malware, combo
brief description
how to remove registry & folders
have to boot up safe modeok, here goes:Info:
- Name: Antivirus Scan
- Class Type: Malware
- Safe-mode: Yes
site and this bugger would go unnoticed until you reboot the PC and when you do, that is it, you have to manually turn off the pc, so
you can get into safe mode, you can't tell you have this backstabber til its too late.remover process:
Spoiler
Antivirus Scan creates the following files and foldersC:\Documents and Settings\Administrator\Local Settings\Temp\{RANDOM}\
C:\Documents and Settings\Administrator\Local Settings\Temp\{RANDOM}\{RANDOM}.exeAntivirus Scan creates the following registry keys and valuesHKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\PhishingFilter | “Enabled†= “0″
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings | “ProxyOverride†= “â€
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings | “ProxyServer†= “http=127.0.0.1:30215″
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings | “ProxyEnable†= “1″
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run | {RANDOM}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run | {RANDOM}
C:\Documents and Settings\Administrator\Local Settings\Temp\{RANDOM}\{RANDOM}.exeAntivirus Scan creates the following registry keys and valuesHKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\PhishingFilter | “Enabled†= “0″
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings | “ProxyOverride†= “â€
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings | “ProxyServer†= “http=127.0.0.1:30215″
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings | “ProxyEnable†= “1″
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run | {RANDOM}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run | {RANDOM}
