Tuesday, January 20, 2009

EBlaster Trojan

How To Remove EBlaster?
You must download trial version of "Exterminate-It" antivirus software,to check your computer instantly.
EBlaster is dangerous virus:
This loose category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

Multi-purpose Trojans are also included in this group, as some virus writers
create multi-functional Trojans rather than Trojan packs.
Spyware is computer software that is installed surreptitiously on a personal computer
to intercept or take partial control over the user's interaction
with the computer, without the user's informed consent.

While the term spyware suggests software that secretly monitors the user's behavior,
the functions of spyware extend well beyond simple monitoring.

Spyware programs can collect various types of personal information,
such as Internet surfing habit, sites that have been visited,
but can also interfere with user control of the computer in other ways,
such as installing additional software, redirecting Web browser activity,
accessing websites blindly that will cause more harmful viruses,
or diverting advertising revenue to a third party.

Spyware can even change computer settings, resulting in slow connection speeds,
different home pages, and loss of Internet or other programs.
In an attempt to increase the understanding of spyware, a more formal classification
of its included software types is captured under the term privacy-invasive software.
The BHO (Browser Helper Object) waits for the user to post personal information to a monitored website.
As this information is entered by the user, it is captured by the BHO and sent back to the attacker.


EBlaster It also known as:

[Panda]Trj/Reboot.htm

EBlaster Symptoms:

Files:
[%SYSTEM%]\chkdisk.exe
[%SYSTEM%]\svrwin.exe
[%SYSTEM%]\wmscmod.chm
[%DESKTOP%]\pestpatrolbait.exe
[%FAVORITES%]\pestpatrolbait.exe
[%PROFILE%]\pestpatrolbait.exe
[%PROGRAMS%]\pestpatrolbait.exe
[%PROGRAM_FILES%]\pestpatrolbait.exe
[%STARTUP%]\pestpatrolbait.exe
[%SYSTEM%]\autprof.dll
[%SYSTEM%]\biosuni.dll
[%SYSTEM%]\catmidi.dll
[%SYSTEM%]\cfgtcp.dll
[%SYSTEM%]\cfgvga.dll
[%SYSTEM%]\compserver.dll
[%SYSTEM%]\conflib32.dll
[%SYSTEM%]\ctldde.dll
[%SYSTEM%]\ctldll.dll
[%SYSTEM%]\ddectl.dll
[%SYSTEM%]\devcrypt.dll
[%SYSTEM%]\dhcpkbd.dll
[%SYSTEM%]\dllcmd.dll
[%SYSTEM%]\httpsserver32.dll
[%SYSTEM%]\ipdll32.dll
[%SYSTEM%]\kbdman.dll
[%SYSTEM%]\logmon.exe
[%SYSTEM%]\macnetb32.dll
[%SYSTEM%]\midical.dll
[%SYSTEM%]\modipx.dll
[%SYSTEM%]\modstats.dll
[%SYSTEM%]\msdde.dll
[%SYSTEM%]\msnetsrv\msvfjbwin.dll
[%SYSTEM%]\msnetsrv\msvfjbwin.sys
[%SYSTEM%]\msnetsrv\winmsvfjbwin.drv
[%SYSTEM%]\MSWEBHLP.DLL
[%SYSTEM%]\netbaut.dll
[%SYSTEM%]\netbcam.exe
[%SYSTEM%]\netipx.dll
[%SYSTEM%]\netutil.exe
[%SYSTEM%]\odbckey.dll
[%SYSTEM%]\olehost.dll
[%SYSTEM%]\profwin.exe
[%SYSTEM%]\regdb.dll
[%SYSTEM%]\rtfftp.dll
[%SYSTEM%]\sqlhost32.dll
[%SYSTEM%]\statip.dll
[%SYSTEM%]\tcpterm.dll
[%SYSTEM%]\uniserver.dll
[%SYSTEM%]\v32wsock.exe
[%SYSTEM%]\vgalog.dll
[%SYSTEM%]\xmlbot32.dll
[%SYSTEM%]\xpcmd.dll
[%WINDOWS%]\pestpatrolbait.exe
[%WINDOWS%]\system\mstv9swin.dll
[%WINDOWS%]\system\mstv9swin.ocx
[%WINDOWS%]\system\mswebhlp.dll
[%WINDOWS%]\system\winmstv9swin.drv
[%SYSTEM%]\chkdisk.exe
[%SYSTEM%]\svrwin.exe
[%SYSTEM%]\wmscmod.chm
[%DESKTOP%]\pestpatrolbait.exe
[%FAVORITES%]\pestpatrolbait.exe
[%PROFILE%]\pestpatrolbait.exe
[%PROGRAMS%]\pestpatrolbait.exe
[%PROGRAM_FILES%]\pestpatrolbait.exe
[%STARTUP%]\pestpatrolbait.exe
[%SYSTEM%]\autprof.dll
[%SYSTEM%]\biosuni.dll
[%SYSTEM%]\catmidi.dll
[%SYSTEM%]\cfgtcp.dll
[%SYSTEM%]\cfgvga.dll
[%SYSTEM%]\compserver.dll
[%SYSTEM%]\conflib32.dll
[%SYSTEM%]\ctldde.dll
[%SYSTEM%]\ctldll.dll
[%SYSTEM%]\ddectl.dll
[%SYSTEM%]\devcrypt.dll
[%SYSTEM%]\dhcpkbd.dll
[%SYSTEM%]\dllcmd.dll
[%SYSTEM%]\httpsserver32.dll
[%SYSTEM%]\ipdll32.dll
[%SYSTEM%]\kbdman.dll
[%SYSTEM%]\logmon.exe
[%SYSTEM%]\macnetb32.dll
[%SYSTEM%]\midical.dll
[%SYSTEM%]\modipx.dll
[%SYSTEM%]\modstats.dll
[%SYSTEM%]\msdde.dll
[%SYSTEM%]\msnetsrv\msvfjbwin.dll
[%SYSTEM%]\msnetsrv\msvfjbwin.sys
[%SYSTEM%]\msnetsrv\winmsvfjbwin.drv
[%SYSTEM%]\MSWEBHLP.DLL
[%SYSTEM%]\netbaut.dll
[%SYSTEM%]\netbcam.exe
[%SYSTEM%]\netipx.dll
[%SYSTEM%]\netutil.exe
[%SYSTEM%]\odbckey.dll
[%SYSTEM%]\olehost.dll
[%SYSTEM%]\profwin.exe
[%SYSTEM%]\regdb.dll
[%SYSTEM%]\rtfftp.dll
[%SYSTEM%]\sqlhost32.dll
[%SYSTEM%]\statip.dll
[%SYSTEM%]\tcpterm.dll
[%SYSTEM%]\uniserver.dll
[%SYSTEM%]\v32wsock.exe
[%SYSTEM%]\vgalog.dll
[%SYSTEM%]\xmlbot32.dll
[%SYSTEM%]\xpcmd.dll
[%WINDOWS%]\pestpatrolbait.exe
[%WINDOWS%]\system\mstv9swin.dll
[%WINDOWS%]\system\mstv9swin.ocx
[%WINDOWS%]\system\mswebhlp.dll
[%WINDOWS%]\system\winmstv9swin.drv

Folders:
[%DESKTOP%]\pestpatrolbaitdirectory
[%FAVORITES%]\pestpatrolbaitdirectory
[%PROFILE%]\pestpatrolbaitdirectory
[%PROGRAMS%]\pestpatrolbaitdirectory
[%PROGRAM_FILES%]\pestpatrolbaitdirectory
[%STARTUP%]\pestpatrolbaitdirectory
[%SYSTEM%]\ddecom
[%SYSTEM%]\ipxip
[%SYSTEM%]\modnetb
[%SYSTEM%]\niccam
[%SYSTEM%]\submon
[%SYSTEM%]\termme
[%SYSTEM%]\usbdel
[%WINDOWS%]\pestpatrolbaitdirectory

Registry Keys:
HKEY_CLASSES_ROOT\clsid\{2be166ed-f16c-46de-b623-3575fd9b5d6d}
HKEY_CLASSES_ROOT\clsid\{89044184-f260-4fdd-8fab-2662814846e5}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{89044184-f260-4fdd-8fab-2662814846e5}
HKEY_CLASSES_ROOT\clsid\{6314e760-e667-11d2-ba98-0080c8e9491a}\ole\shell\commands
HKEY_CLASSES_ROOT\clsid\{deca39c1-f713-11d2-ba99-0080c8e9491a}
HKEY_CLASSES_ROOT\pestpatrolbait\key
HKEY_CURRENT_USER\software\pestpatrolbait\key
HKEY_LOCAL_MACHINE\software\classes\clsid\{0e289927-69b7-4c4c-8502-354e048c8e92}
HKEY_LOCAL_MACHINE\software\classes\clsid\{191922d9-d5ae-453d-b290-f26a9c270402}
HKEY_LOCAL_MACHINE\software\classes\clsid\{27474baa-705f-4769-a44f-e13a8be4e610}
HKEY_LOCAL_MACHINE\software\classes\clsid\{2efe6983-b0bf-4ebf-9637-a7c10ec3eebb}
HKEY_LOCAL_MACHINE\software\classes\clsid\{30b92215-0e32-400e-a05d-e583bf1d6c49}
HKEY_LOCAL_MACHINE\software\classes\clsid\{5343160f-29a0-49e3-8782-c08b11e0675f}
HKEY_LOCAL_MACHINE\software\classes\clsid\{75c3efc9-45ba-48f4-96a9-f4708a4b32db}
HKEY_LOCAL_MACHINE\software\classes\clsid\{812e1c52-8b82-4bc7-bdfa-cfdaedb63f41}
HKEY_LOCAL_MACHINE\software\classes\clsid\{81cdda69-0eec-4142-8eb4-de2a433c91a2}
HKEY_LOCAL_MACHINE\software\classes\clsid\{855edf42-f91b-4818-8df1-b58ca6043290}
HKEY_LOCAL_MACHINE\software\classes\clsid\{99c193ba-d72b-4934-8612-6bc25640cb1f}
HKEY_LOCAL_MACHINE\software\classes\clsid\{b7013911-76cf-4750-b174-2b573bc2f14c}
HKEY_LOCAL_MACHINE\software\classes\clsid\{ce0babb4-3a61-4dbb-a6c7-f69896a47540}
HKEY_LOCAL_MACHINE\software\classes\clsid\{e4b58522-89aa-45ed-bf8d-ebe7207a5d2a}
HKEY_LOCAL_MACHINE\software\pestpatrolbait\key

Registry Values:
HKEY_LOCAL_MACHINE\software\classes\clsid\{2be166ed-f16c-46de-b623-3575fd9b5d6d}
HKEY_CLASSES_ROOT\pestpatrolbait
HKEY_CLASSES_ROOT\pestpatrolbait
HKEY_CURRENT_USER\software\pestpatrolbait
HKEY_CURRENT_USER\software\pestpatrolbait
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload
HKEY_LOCAL_MACHINE\software\pestpatrolbait
HKEY_LOCAL_MACHINE\software\pestpatrolbait


You must clean you computer ASAP !!!
Download Free Trial Version of antivirus software here, to check your computer instantly.

Also Be Aware of the Following Threats:
Mumb Trojan Information
Mywife.C Worm Cleaner
Remove Iinun Trojan
MainEntryPoint Tracking Cookie Symptoms

No comments: