Remove Piggi. Description and removal instructions

 
Title: Piggi

Type: Worms
Severity scale:Piggi severity is 57  (57 / 100)
 
Piggi is a worm that spreads by e-mail through messages with infected attachments that can be executables, images, web pages, text documents or media files.

Once the user opens such an attachment, the parasite secretly installs itself to the system and runs a spreading routine. It sends bogus e-mails to all the addresses it finds in the Windows Address Book and some local files. Piggi also creates hundreds of copies of itself in shared folders of popular peer-to-peer programs. This allows it to propagate through file sharing networks. Furthermore, it can infect remote computers by exploiting known security vulnerabilities.

Piggi also carries a payload. It disables Windows and Symantec security software updates. The worm uses an integrated rootkit to hide its presence in the system. It is able to bypass the Windows Firewall.

The parasite secretly runs on every Windows startup.


Related files: lsass.exe, svchost.exe, msfsr.sys, [X].sys

Piggi properties:
• Connects itself to the internet
• Hides from the user
• Stays resident in background

Automatic Piggi removal:

remover for Piggi

Piggi manual removal:

Kill processes:
lsass.exe, svchost.exe
Delete registry values:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\[filename]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell=explorer.exe %Windir%\lsass.exe
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\msfsr
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\[X]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\[filename]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv\Start=3
Delete files:
lsass.exe, svchost.exe, msfsr.sys, [X].sys
Misc:
[X] is a combination of 5 random characters.

Exact file location:
lsass.exe - C:\WINDOWS or C:\WINNT
msfsr.sys - C:\WINDOWS\System32 or C:\WINNT\System32
[X].sys - C:\WINDOWS\System32\drivers or C:\WINNT\System32\drivers
svchost.exe - C:\WINDOWS or C:\WINNT; C:\WINDOWS\System32\dllcache or C:\WINNT\System32\dllcache

Some files might be hidden by the rootkit.

Other programs to remove Piggi:

• SUPERAntiSpyware - Review - Download
• CounterSpy - Review - Download
• Windows Defender - Review - Download

Information added: 03/01/07
Information updated: 03/01/07

Additional resources related to Piggi:

Attention: If you know or you have a website or page about Piggi removal, feel free to add a link to this list: add url




more resources

Post Comment:

Attention: Use this form only if you have additional information about Piggi parasite, its removal instructions, additional resources or behavior. By clicking "post comment" button you agree not to post any copyrighted, unlawful, harmful, threatening, abusive, harassing, defamatory, vulgar, obscene, profane, hateful, racially, ethnically or otherwise objectionable material of any kind.



Enter security code:

Latest spyware news:
Similar parasites: