Remove Dagonit. Description and removal instructions

 
Title: Dagonit

Type: Backdoors
Severity scale:Dagonit severity is 75  (75 / 100)
 
Dagonit is a dangerous backdoor that gives the remote attacker full unauthorized access to the compromised computer. Once executed, the parasite enables specific system services (Telnet, Server, Terminal Services, Remote Desktop Help Session Manager) that allow remote users to connect to and control the system. Then it reconfigures related security settings and creates a user account. This account is used by the intruder to take over a control of the compromised system. Dagonit also deletes cached system files.


Dagonit properties:
• Allows remote user connection
• Hides from the user
• Stays resident in background

Automatic Dagonit removal:

remover for Dagonit

Dagonit manual removal:

Kill processes:
dalia2.exe, winspool.exe, wpap.exe
Delete files:
dalia2.exe, winspool.exe, wpap.exe, system.bat, dali.reg
Misc:
Disable and delete the user account called Service.

Dagonit modifies the values of the following registry entries to:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver\Start=2
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RDSessMgr\Start=2
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermService\Start=2
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TlntSvr\Start=2
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\fDenyTSConnections=0
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\idleWinStationPoolCount=1
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\TSAdvertise=1
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\TSAppCompat=1
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\TSEnabled=1
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\TSUserEnabled=1
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\Licensing Core\EnableConcurrentSessions=0
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\Licensing Core\WinStations\RDP-Tcp\fEnableWinStation=1
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\Licensing Core\WinStations\RDP-Tcp\MaxInstanceCount=1

All Dagonit files can be found in the default system directory, which is one of the following: C:\Windows\System, C:\Windows\System32 or C:\Winnt\System32.

Other programs to remove Dagonit:

• Malwarebytes Anti Malware - Review - Download
• Malwarebytes Anti Malware - Review - Download
• Windows Defender - Review - Download

Information added: 27/09/05
Information updated: 27/09/05

Additional resources related to Dagonit:

Attention: If you know or you have a website or page about Dagonit removal, feel free to add a link to this list: add url




more resources

Post Comment:

Attention: Use this form only if you have additional information about Dagonit parasite, its removal instructions, additional resources or behavior. By clicking "post comment" button you agree not to post any copyrighted, unlawful, harmful, threatening, abusive, harassing, defamatory, vulgar, obscene, profane, hateful, racially, ethnically or otherwise objectionable material of any kind.



Enter security code:

Latest spyware news:
Similar parasites: