|
Title: Sygyp
Type: Worms
Remove Sygyp. Removal instructions
Also known as: Gypsy
Severity scale:
 (67 / 100)
Once executed, Sygyp silently installs itself to the system and runs a spreading routine. The worm uses Microsoft Outlook Express to send malicious letters to all the addresses it harvests from files found on the compromised computer. Sygyp searches through text and spreadsheet documents, programming files and local web pages. It also creates files purportedly related to Windows Update and shares them with other network or Internet users. The parasite's payload is quite large and dangerous. Sygyp terminates running antiviruses, firewalls and other security-related programs. It disables the Windows Firewall and the Windows Security Center, lowers essential system security and file sharing settings, blocks access to numerous web sites including popular security-related resources. Sygyp also deletes all scheduled tasks, disables the Registry Editor and the Task Manager. The worm may also display certain messages and shutdown the compromised computer without user knowledge and consent. Sygyp automatically runs on every Windows startup. Sygyp properties: • Hides from the user • Stays resident in background Automatic Sygyp removal: 
We are testing STOPzilla's efficiency at removing Sygyp
(2006-01-24 09:49:33)
We are testing Malwarebytes Anti Malware's efficiency at removing Sygyp
(2006-01-24 09:49:33)
We are testing Spyware Doctor's efficiency at removing Sygyp
(2006-01-24 09:49:33)
Sygyp manual removal:Kill processes:asistant_alert.exe, googleearthsetup.exe, netalert_v2.4.exe, netwatch_v1.0.3.exe, regverif32.exe, exploit_patcher_v1.0.0.exe Delete registry values: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\regvfy32 HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall=0 HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\crashonauditfail=0 HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\forceguest=0 HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\limitblankpassworduse=0 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify=0 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusOverride=0 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify=0 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallOverride=0 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify=0 HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools=1 HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskmgr=1 HKEY_CURRENT_USER\Identities\[Current User ID]\Software\Microsoft\Outlook Express\[Version]\Dont Show Dialogs\Compact Do Not Ask Again=1 HKEY_CURRENT_USER\Identities\[Current User ID]\Software\Microsoft\Outlook Express\[Version]\Dont Show Dialogs\Delete Thread Warning=6 HKEY_CURRENT_USER\Identities\[Current User ID]\Software\Microsoft\Outlook Express\[Version]\Dont Show Dialogs\Mail Empty Subject Warning=1 HKEY_CURRENT_USER\Identities\[Current User ID]\Software\Microsoft\Outlook Express\[Version]\Dont Show Dialogs\Send Mail Warning=1 HKEY_LOCAL_MACHINE\SOFTWARE\Gypsy\W32.Gypsy Delete files: asistant_alert.exe, googleearthsetup.exe, netalert_v2.4.exe, netwatch_v1.0.3.exe, regverif32.exe, exploit_patcher_v1.0.0.exe, fwall32.reg, ntfs32.reg, oe32.reg, reg32.reg, sec32.reg, sys32.reg, w32info.reg Delete directories: C:\Program Files\WindowsUpdate Misc: The googleearthsetup.exe file arrives attached to Sygyp e-mail messages. Exact file location: googleearthsetup.exe - C:\Windows or C:\Winnt asistant_alert.exe, netalert_v2.4.exe - C:\Program Files\WindowsUpdate\System Security exploit_patcher_v1.0.0.exe, netwatch_v1.0.3.exe - C:\Program Files\WindowsUpdate\System Security\Updates.tmp regverif32.exe, fwall32.reg, ntfs32.reg, oe32.reg, reg32.reg, sec32.reg, sys32.reg, w32info.reg - C:\Windows\System, C:\Windows\System32 or C:\Winnt\System32 
Information added: 2006-01-24 07:12:18
Information updated: 2006-01-24 07:12:18 Additional resources related to Sygyp:Attention: If you know or you have a website or page about Sygyp removal, feel free to add a link to this list: add url |
Latest spyware news:
Subscribe to news
Similar parasites:
|
FORUM:
HELP:
Spreading the knowledge:
It is very hard to fight Computer parasites alone in internet space. If you have a website we would be more than happy if you would help us to spread the knowledge about latest threats. You can help your
visitors to manage their Computer system manually without aditional expences. Knowledge is the power, we just need to spread it.
Post Comment: