Remove Hyborate. Description and removal instructions

 
Title: Hyborate

Type: Trojans
Severity scale:Hyborate severity is 62  (62 / 100)
 
Hyborate is a trojan that deletes user video files and text documents. Once executed, the parasite displays fake error message and installs itself to the system. Then it runs a payload. Hyborate searches all local hard drives for video and PDF files, and deletes all the files it finds. It also changes numerous Windows Explorer and Internet Explorer settings, disables the Registry Editor, hides certain system utilities. The trojan changes Windows registration details and lowers system security settings. It also terminates essential system tools such as the Command Prompt and the Task Manager. Hyborate runs on every Windows startup and every time the user opens a text file.


Hyborate properties:
• Changes browser settings
• Hides from the user
• Stays resident in background

Automatic Hyborate removal:

remover for Hyborate

Hyborate manual removal:

Kill processes:
dlhost.exe, lodctr32.exe, note.exe
Delete registry values:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell=explorer.exe lodctr32.exe
HKEY_CLASSES_ROOT\txtfile\Shell\Open\Command\(Default)=%System%\note.exe %1
HKEY_CLASSES_ROOT\Directory\DefaultIcon\(Default)=%Windir%\lodctr32.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify=1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusOverride=0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify=1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallOverride=0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify=1
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFind=1
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRun=1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFind=1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRun=1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DisableCAD=1
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools=1
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\LocalUser\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools=1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools=1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy Objects\LocalUser\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools=1
HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info\DefCompany=[X]
HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info\DefName=[X]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\RegisteredOrganization=[X]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\RegisteredOwner=[X]
Delete files:
dlhost.exe, lodctr32.exe, note.exe
Misc:
[X] is the string ".BoRaX.BoRaX.BoRaX.BoRaX.BoRaX."

Exact file location:
lodctr32.exe - C:\Windows or C:\Winnt
dlhost.exe - C:\Documents and Settings\[Current User]\My Documents
note.exe - C:\Windows\System, C:\Windows\System32 or C:\Winnt\System32

Other programs to remove Hyborate:

• Malwarebytes Anti Malware - Review - Download
• Malwarebytes Anti Malware - Review - Download
• Windows Defender - Review - Download

Information added: 04/05/06
Information updated: 04/05/06

Additional resources related to Hyborate:

Attention: If you know or you have a website or page about Hyborate removal, feel free to add a link to this list: add url




more resources

Post Comment:

Attention: Use this form only if you have additional information about Hyborate parasite, its removal instructions, additional resources or behavior. By clicking "post comment" button you agree not to post any copyrighted, unlawful, harmful, threatening, abusive, harassing, defamatory, vulgar, obscene, profane, hateful, racially, ethnically or otherwise objectionable material of any kind.



Enter security code:

Latest spyware news:
Similar parasites: