AntiLamer Light manual removal:
Kill processes:
config.exe, editsrv.exe, [program files]\\websx\\int327777.exe, [program files]\\websx\\int339890.exe, runw.exe, server.exe, [system root]\\runwin32.exe, [system root]\\system\\runwin.exe, [system root]\\system\\runwindows32.exe, trojan1.exe, trojan2.exe
Delete registry values:HKEY_LOCAL_MACHINE\software\antilamer backdoor\color1 HKEY_LOCAL_MACHINE\software\anti-lamer backdoor\color1 HKEY_LOCAL_MACHINE\software\antilamer backdoor\color2 HKEY_LOCAL_MACHINE\software\anti-lamer backdoor\color2 HKEY_LOCAL_MACHINE\software\antilamer backdoor\color3 HKEY_LOCAL_MACHINE\software\anti-lamer backdoor\color3 HKEY_LOCAL_MACHINE\software\antilamer backdoor\downloadfolder HKEY_LOCAL_MACHINE\software\anti-lamer backdoor\downloadfolder HKEY_LOCAL_MACHINE\software\antilamer backdoor\ip HKEY_LOCAL_MACHINE\software\anti-lamer backdoor\ip HKEY_LOCAL_MACHINE\software\antilamer backdoor\lang HKEY_LOCAL_MACHINE\software\antilamer backdoor\loggerport HKEY_LOCAL_MACHINE\software\anti-lamer backdoor\loggerport HKEY_LOCAL_MACHINE\software\antilamer backdoor\nick HKEY_LOCAL_MACHINE\software\anti-lamer backdoor\nick HKEY_LOCAL_MACHINE\software\antilamer backdoor\port HKEY_LOCAL_MACHINE\software\anti-lamer backdoor\port HKEY_LOCAL_MACHINE\software\classes\acontixcontrol HKEY_LOCAL_MACHINE\software\classes\clsid\{7589eee6-e336-11d4-8a7e-ee1d971d9b47} HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{7589eee6-e336-11d4-8a7e-ee1d971d9b47} HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{7589eee6-e336-11d4-8a7e-ee1d971d9b47}\installer HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{7589eee6-e336-11d4-8a7e-ee1d971d9b47}\systemcomponent HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\keyconfig\af HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\keyconfig\av HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\keyconfig\con HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\keyconfig\con1 HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\keyconfig\con2 HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\keyconfig\myp HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\keyconfig\number HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\keyconfig\numberon HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\keyconfig\ps HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\moduleusage\c:/windows/downloaded program files/acontix.ocx\.owner HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\moduleusage\c:/windows/downloaded program files/acontix.ocx\{7589eee6-e336-11d4-8a7e-ee1d971d9b47} HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\runwin32 HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\runwindows HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\5-1-14-24\displayicon HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\5-1-14-24\displayname HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\5-1-14-24\uninstallstring
Unregister DLLs:edit.dll
Delete files:_iu14d2n.tmp-065eaffd.pf, 6.26.2004.10.53.33....0.reg, 6.26.2004.10.53.34....1.dat 6.26.2004.10.53.34....1.reg aconti.exe-105d3294.pf alb.exe-01f9e69e.pf alb.exe-0e801625.pf alb.exe-0fe358f0.pf alb.exe-328f3713.pf antilamer light.txt backdoor.antilam.13.a.exe-3ab6a254.pf backdoor.antilam.20.j.exe-25e4239f.pf collecteddata_127.xml collecteddata_196.xml collecteddata_200.xml collecteddata_202.xml collecteddata_210.xml collecteddata_218.xml config.exe config.exe-0b915f83.pf config.exe-28993197.pf [desktop]\\5-1-14-24.lnk drwtsn32.exe-2b4b52ac.pf edit.dll editsrv.exe editsrv.exe-020c4fa9.pf edtsrv.exe-34c94755.pf edtsrv.exe-3861317c.pf edtsrv.exe-39d44f73.pf edtsrv.exe-3af77064.pf english.reg int327777.exe-22f4e5c7.pf int327777.exe-317926e6.pf int327777.sdb joiner.exe-37b4e594.pf new_alb.exe-080f644e.pf [profile path]\\administrator\\start menu\\5-1-14-24.lnk [profile path]\\administrator\\start menu\\programs\\5-1-14-24.lnk [program files]\\websx\\int327777.exe [program files]\\websx\\int339890.exe [program files]\\websx\\websx.ini readme.htm readme.txt runw.exe runw.exe-0acf03f1.pf server.exe server.exe-04168f44.pf server.exe-19885956.pf server.exe-1e8ebe0c.pf server.exe-1ea17666.pf server.exe-1fb68265.pf server.exe-1ff20139.pf smt.exe-245bb5ee.pf [system root]\\runwin32.exe [system root]\\system\\runwin.exe [system root]\\system\\runwindows32.exe trojan.exe-0c7fe615.pf trojan.psw.allight.10.b trojan1.exe trojan1.exe-007581cd.pf trojan1.exe-0d8b60b3.pf trojan2.exe trojan2.exe-12ee91de.pf trojan2.exe-2c402d8d.pf unins000.exe-1da47506.pf websx.dlg
Delete directories:[program files]\websx
Post Comment: