Wednesday, December 10, 2008

ActMon Spyware

Removing ActMon
Categories: Spyware
Spyware programs can collect various types of personal information,
such as Internet surfing habit, sites that have been visited,
but can also interfere with user control of the computer in other ways,
such as installing additional software, redirecting Web browser activity,
accessing websites blindly that will cause more harmful viruses,
or diverting advertising revenue to a third party.

Visible Symptoms:
Files in system folders:
[%PROFILE%]\start menu\programs\actmoncm\actmon cm control center.lnk
[%PROFILE%]\start menu\programs\actmoncm\actmon computer monitoring manual.lnk
[%PROGRAMS%]\actmoncm\actmon cm control center.lnk
[%PROGRAMS%]\actmoncm\actmon computer monitoring manual.lnk
[%SYSTEM%]\acm-manual.chm
[%SYSTEM%]\acmcc.exe
[%SYSTEM%]\actmon.exe
[%SYSTEM%]\drivers\acm-manual.chm
[%SYSTEM%]\drivers\wskrnlc.sys
[%SYSTEM%]\rbwinx1.dll
[%SYSTEM%]\wskrnl.exe
[%SYSTEM%]\wskrnlb.dll
[%SYSTEM%]\wskrnlb.exe
[%SYSTEM%]\wskrnlc.dll
[%SYSTEM%]\wskrnlc.vxd
[%SYSTEM%]\wskrnld.dll
[%SYSTEM%]\wskrnle.dll
[%PROFILE%]\start menu\programs\actmoncm\actmon cm control center.lnk
[%PROFILE%]\start menu\programs\actmoncm\actmon computer monitoring manual.lnk
[%PROGRAMS%]\actmoncm\actmon cm control center.lnk
[%PROGRAMS%]\actmoncm\actmon computer monitoring manual.lnk
[%SYSTEM%]\acm-manual.chm
[%SYSTEM%]\acmcc.exe
[%SYSTEM%]\actmon.exe
[%SYSTEM%]\drivers\acm-manual.chm
[%SYSTEM%]\drivers\wskrnlc.sys
[%SYSTEM%]\rbwinx1.dll
[%SYSTEM%]\wskrnl.exe
[%SYSTEM%]\wskrnlb.dll
[%SYSTEM%]\wskrnlb.exe
[%SYSTEM%]\wskrnlc.dll
[%SYSTEM%]\wskrnlc.vxd
[%SYSTEM%]\wskrnld.dll
[%SYSTEM%]\wskrnle.dll

How to detect ActMon:

Files:
[%PROFILE%]\start menu\programs\actmoncm\actmon cm control center.lnk
[%PROFILE%]\start menu\programs\actmoncm\actmon computer monitoring manual.lnk
[%PROGRAMS%]\actmoncm\actmon cm control center.lnk
[%PROGRAMS%]\actmoncm\actmon computer monitoring manual.lnk
[%SYSTEM%]\acm-manual.chm
[%SYSTEM%]\acmcc.exe
[%SYSTEM%]\actmon.exe
[%SYSTEM%]\drivers\acm-manual.chm
[%SYSTEM%]\drivers\wskrnlc.sys
[%SYSTEM%]\rbwinx1.dll
[%SYSTEM%]\wskrnl.exe
[%SYSTEM%]\wskrnlb.dll
[%SYSTEM%]\wskrnlb.exe
[%SYSTEM%]\wskrnlc.dll
[%SYSTEM%]\wskrnlc.vxd
[%SYSTEM%]\wskrnld.dll
[%SYSTEM%]\wskrnle.dll
[%PROFILE%]\start menu\programs\actmoncm\actmon cm control center.lnk
[%PROFILE%]\start menu\programs\actmoncm\actmon computer monitoring manual.lnk
[%PROGRAMS%]\actmoncm\actmon cm control center.lnk
[%PROGRAMS%]\actmoncm\actmon computer monitoring manual.lnk
[%SYSTEM%]\acm-manual.chm
[%SYSTEM%]\acmcc.exe
[%SYSTEM%]\actmon.exe
[%SYSTEM%]\drivers\acm-manual.chm
[%SYSTEM%]\drivers\wskrnlc.sys
[%SYSTEM%]\rbwinx1.dll
[%SYSTEM%]\wskrnl.exe
[%SYSTEM%]\wskrnlb.dll
[%SYSTEM%]\wskrnlb.exe
[%SYSTEM%]\wskrnlc.dll
[%SYSTEM%]\wskrnlc.vxd
[%SYSTEM%]\wskrnld.dll
[%SYSTEM%]\wskrnle.dll

Folders:
[%APPDATA%]\vxdkrn

Registry Keys:
HKEY_LOCAL_MACHINE\software\lxass
HKEY_LOCAL_MACHINE\software\srvprc
HKEY_LOCAL_MACHINE\software\syswin
HKEY_LOCAL_MACHINE\software\vxdkrn
HKEY_LOCAL_MACHINE\software\wskrnl
HKEY_LOCAL_MACHINE\system\controlset001\services\wskrnlc
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\lxass
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\srvprc
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\syswinc
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\vxdkrn
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\wskrnlc

Registry Values:
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run

Removing ActMon:

You can download trial version of "Exterminate-It" antivirus software here, to check your computer instantly.

Or buy it to remove ALL viruses from your computer.

Also Be Aware of the Following Threats:
Remove Derek Trojan

No comments: