Tuesday, October 14, 2008

BT Trojan

Removing BT
Categories: Trojan
This loose category includes a variety of Trojans that damage victim machines or threaten data integrity, or impair the functioning of the victim machine.

Multi-purpose Trojans are also included in this group, as some virus writers create multi-functional Trojans rather than Trojan packs.

BT Also known as:

[Kaspersky]Trojan-Downloader.Win32.Nurech.bd;
[Other]Win32/Dialer.BT,TrojanDownloader:Win32/Smallagent,TROJ_DLOADER.PWQ,Downloader

Visible Symptoms:
Files in system folders:
[%SYSTEM%]\igfxsvc.exe
[%SYSTEM%]\spoolw.exe
[%WINDOWS%]\iexplore_32.exe
[%WINDOWS%]\w32dbg.exe
[%SYSTEM%]\igfxsvc.exe
[%SYSTEM%]\spoolw.exe
[%WINDOWS%]\iexplore_32.exe
[%WINDOWS%]\w32dbg.exe

How to detect BT:

Files:
[%SYSTEM%]\igfxsvc.exe
[%SYSTEM%]\spoolw.exe
[%WINDOWS%]\iexplore_32.exe
[%WINDOWS%]\w32dbg.exe
[%SYSTEM%]\igfxsvc.exe
[%SYSTEM%]\spoolw.exe
[%WINDOWS%]\iexplore_32.exe
[%WINDOWS%]\w32dbg.exe

Registry Values:
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\explorer.exe
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\iexplore.exe
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\explorer.exe
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\iexplore.exe

Removing BT:

You can download trial version of "Exterminate-It" antivirus software here, to check your computer instantly.

Or buy it to remove ALL viruses from your computer.

Also Be Aware of the Following Threats:
AntiSpyware.Soldier Adware Symptoms
Zlob.Fam.Protection Tools Trojan Information
ZSearch BHO Information
IGetNet.Keywords BHO Cleaner
TrojanDownloader.Win32.Small.nu Trojan Cleaner

No comments: