Wednesday, January 28, 2009

AntiSpyStorm Ransomware

Removing AntiSpyStorm
Categories: Ransomware
The term ransomware is commonly used to describe such software,
although the field known as cryptovirology predates the term "ransomware".

This type of ransom attack can be accomplished by (for example) attaching
a specially crafted file/program to an e-mail message and sending this to the victim.

Visible Symptoms:
Files in system folders:
[%COMMON_DESKTOPDIRECTORY%]\AntispyStorm.lnk
[%PROGRAM_FILES%]\AntispyStorm\AntispyStorm.exe
[%COMMON_DESKTOPDIRECTORY%]\AntispyStorm.lnk
[%PROGRAM_FILES%]\AntispyStorm\AntispyStorm.exe

How to detect AntiSpyStorm:

Files:
[%COMMON_DESKTOPDIRECTORY%]\AntispyStorm.lnk
[%PROGRAM_FILES%]\AntispyStorm\AntispyStorm.exe
[%COMMON_DESKTOPDIRECTORY%]\AntispyStorm.lnk
[%PROGRAM_FILES%]\AntispyStorm\AntispyStorm.exe

Folders:
[%APPDATA%]\AntispyStorm
[%COMMON_PROGRAMS%]\AntispyStorm
[%PROGRAM_FILES%]\AntispyStorm

Registry Keys:
HKEY_CLASSES_ROOT\as_ie_monitor.ie_monitor
HKEY_CLASSES_ROOT\CLSID\{0723CAE4-C2AB-4995-B749-6BC9BE984564}
HKEY_CLASSES_ROOT\CLSID\{EA201C93-F34A-47A5-B65D-AA7C95068E92}
HKEY_CLASSES_ROOT\Interface\{4619EC5B-EF8F-44E9-9A74-6E7B5F1C4188}
HKEY_CLASSES_ROOT\Interface\{EFBD98B0-0C01-4325-85F8-5E791AB33570}
HKEY_CLASSES_ROOT\mdReg.clsReg
HKEY_CLASSES_ROOT\TypeLib\{C8EBBFFA-881D-4F15-9D29-7435462E4294}
HKEY_CLASSES_ROOT\TypeLib\{D8478214-61AD-4C83-9D76-2BE980A51452}
HKEY_LOCAL_MACHINE\SOFTWARE\AntispyStorm
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AntispyStorm

Registry Values:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Removing AntiSpyStorm:

You can download trial version of "Exterminate-It" antivirus software here, to check your computer instantly.

Or buy it to remove ALL viruses from your computer.

Also Be Aware of the Following Threats:
HS.Bot Trojan Symptoms
SdBot.gen Worm Information

No comments: