|
Title: Kiman.b
Type: Worms
Remove Kiman.b. Removal instructions
Severity scale:
 (69 / 100)
Once executed, Kiman.b secretly installs itself to the system and runs a spreading routine. The worm copies itself to weakly protected network shares with randomly generated IP addresses. It also searches for vulnerable computers and attempts to exploit certain vulnerabilities. The parasite's payload is large and destructive. Kiman.b opens a back door providing the attacker with unauthorized remote access to the compromised computer. It allows the intruder to download and execute arbitrary files, manage the file system, control running processes, execute system commands, launch Denial of Service (DoS) attacks, send e-mail messages. The attacker can also run web and FTP servers, search for vulnerable hosts, intercept Internet traffic and restart the compromised computer. Kiman.b also alters system and network configurations and dsiables some Windows essential components. Kiman.b automatically runs on every Windows startup. Kiman.b properties: • Allows remote user connection • Connects itself to the internet • Hides from the user • Stays resident in background Automatic Kiman.b removal: 
We are testing STOPzilla's efficiency at removing Kiman.b
(2006-02-08 16:28:31)
We are testing Malwarebytes Anti Malware's efficiency at removing Kiman.b
(2006-02-08 16:28:31)
We are testing Spyware Doctor's efficiency at removing Kiman.b
(2006-02-08 16:28:31)
Kiman.b manual removal:Kill processes:hdcontroller.exe Delete registry values: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hard drive controller HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\hard drive controller HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Start=4 HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv\Start=4 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start=4 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\EnableDCOM=n HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\EnableRemoteConnect=n Delete files: hdcontroller.exe, a.bat, 1.reg Misc: Kiman.b uses TCP ports 135, 139, 443, 445, 1025 and UDP port 1434. Exact file location: a.bat - C: 1.reg - C:\Windows\Temp or C:\Winnt\Temp hdcontroller.exe - C:\Windows\System, C:\Windows\System32 or C:\Winnt\System32 
Information added: 2006-02-08 13:51:16
Information updated: 2006-02-08 13:51:16 Additional resources related to Kiman.b:Attention: If you know or you have a website or page about Kiman.b removal, feel free to add a link to this list: add url |
Latest spyware news:
Subscribe to news
Similar parasites:
|
FORUM:
HELP:
Spreading the knowledge:
It is very hard to fight Computer parasites alone in internet space. If you have a website we would be more than happy if you would help us to spread the knowledge about latest threats. You can help your
visitors to manage their Computer system manually without aditional expences. Knowledge is the power, we just need to spread it.
Post Comment: