Remove Ritdoor. Description and removal instructions

Title: Ritdoor
Type: Worms	Severity scale: (76 / 100)

Ritdoor is a dangerous Internet worm that spreads through file sharing networks, via unprotected network shares and by exploiting vulnerable computers running Microsoft Windows operating system with unpatched security flaws.

Once executed, Ritdoor secretly installs itself to the system and runs a spreading routine. The parasite creates infected files and copies them to unprotected network shares and shared folders of installed peer-to-peer applications. These files usually do not have meaningful names.

The worm's payload is comprised of several harmful functions. Ritdoor opens a back door, which provides the attacker with unauthorized remote access to a compromised computer. The intruder can download, upload and execute arbitrary files, disable installed security-related programs and modify the system Hosts file. Ritdoor attempts to terminate running processes of some antiviruses, firewalls, security-related programs and even viruses. It also blocks access to popular security-related web sites and online services. The worm may disable Windows Firewall, certain system services and tools.

Ritdoor automatically runs on every Windows startup.

FORUM:
Discuss Ritdoor in
spyware removal forum

Ritdoor properties:
• Allows remote user connection
• Connects itself to the internet
• Hides from the user
• Stays resident in background

Automatic Ritdoor removal:

remover for Ritdoor

Ritdoor manual removal:

Kill processes:
msdefr.exe, nb32ext4.exe, services.exe

HELP:
how to kill malicious processes

Delete registry values:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rpcserv32g
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\helloworld3
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit %System%\userinit.exe,%Windows%\services.exe
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\iepsdgxc=1
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\DisableRegistryTools=0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DisableRegistryTools=0
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Start=4

HELP:
how to remove registry entries

Delete files:
msdefr.exe, nb32ext4.exe, services.exe

HELP:
how to remove harmful files

Misc:
Ritdoor files can be found in C:\Windows or C:\Winnt folder.

Other programs to remove Ritdoor:

• SUPERAntiSpyware - Review - Download
• CounterSpy - Review - Download
• Windows Defender - Review - Download

Information added: 05/11/05
Information updated: 05/11/05

Additional resources related to Ritdoor:

Attention: If you know or you have a website or page about Ritdoor removal, feel free to add a link to this list: add url

more resources

Post Comment:

Attention: Use this form only if you have additional information about Ritdoor parasite, its removal instructions, additional resources or behavior. By clicking "post comment" button you agree not to post any copyrighted, unlawful, harmful, threatening, abusive, harassing, defamatory, vulgar, obscene, profane, hateful, racially, ethnically or otherwise objectionable material of any kind.