Remove Kiman.b. Description and removal instructions

Title: Kiman.b
Type: Worms	Severity scale: (69 / 100)

Kiman.b is a dangerous and complex Internet worm, which spreads via network shares protected by weak passwords or by exploiting known system security vulnerabilities. The system can be infected without any user interaction.

Once executed, Kiman.b secretly installs itself to the system and runs a spreading routine. The worm copies itself to weakly protected network shares with randomly generated IP addresses. It also searches for vulnerable computers and attempts to exploit certain vulnerabilities.

The parasite's payload is large and destructive. Kiman.b opens a back door providing the attacker with unauthorized remote access to the compromised computer. It allows the intruder to download and execute arbitrary files, manage the file system, control running processes, execute system commands, launch Denial of Service (DoS) attacks, send e-mail messages. The attacker can also run web and FTP servers, search for vulnerable hosts, intercept Internet traffic and restart the compromised computer. Kiman.b also alters system and network configurations and dsiables some Windows essential components.

Kiman.b automatically runs on every Windows startup.

FORUM:
Discuss Kiman.b in
spyware removal forum

Kiman.b properties:
• Allows remote user connection
• Connects itself to the internet
• Hides from the user
• Stays resident in background

Automatic Kiman.b removal:

remover for Kiman.b

Kiman.b manual removal:

Kill processes:
hdcontroller.exe

HELP:
how to kill malicious processes

Delete registry values:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hard drive controller
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\hard drive controller
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Start=4
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv\Start=4
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start=4
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\EnableDCOM=n
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\EnableRemoteConnect=n

HELP:
how to remove registry entries

Delete files:
hdcontroller.exe, a.bat, 1.reg

HELP:
how to remove harmful files

Misc:
Kiman.b uses TCP ports 135, 139, 443, 445, 1025 and UDP port 1434.

Exact file location:
a.bat - C:
1.reg - C:\Windows\Temp or C:\Winnt\Temp
hdcontroller.exe - C:\Windows\System, C:\Windows\System32 or C:\Winnt\System32

Other programs to remove Kiman.b:

• SUPERAntiSpyware - Review - Download
• CounterSpy - Review - Download
• Windows Defender - Review - Download

Information added: 08/02/06
Information updated: 08/02/06

Additional resources related to Kiman.b:

Attention: If you know or you have a website or page about Kiman.b removal, feel free to add a link to this list: add url

more resources

Post Comment:

Attention: Use this form only if you have additional information about Kiman.b parasite, its removal instructions, additional resources or behavior. By clicking "post comment" button you agree not to post any copyrighted, unlawful, harmful, threatening, abusive, harassing, defamatory, vulgar, obscene, profane, hateful, racially, ethnically or otherwise objectionable material of any kind.