Remove Theals. Description and removal instructions

 
Title: Theals

Type: Worms
Severity scale:Theals severity is 69  (69 / 100)
 
Theals is a dangerous multifunctional Internet worm that distributes itself by e-mail and infects network computers running Windows operating system with unpatched security vulnerabilities. The parasite arrives in malicious e-mail messages with attached password protected archives containing the worm. A typical message includes an image with a password, which is required to open an archive. Once the user unpacks an archive, Theals secretly installs itself to the system. It starts to search for running Microsoft Outlook, Microsoft Outlook Express and The Bat! mail programs. If the worm finds them, it initiates its mass-mailing propagation function. Theals is designed to steal user sensitive data and money. It collects information about the system and steals confidential account details and files of installed WebMoney software, which is used to conduct real-time money transactions. Gathered data is sent to a predetermined e-mail address or transferred to a particular remote host. Theals also performs DDOS attacks against popular antivirus sites and blocks access to numerous computer security and other reputable Internet resources. The worm is able to hide its active processes, related files and registry keys and therefore stays totally invisible. Theals automatically runs on every Windows startup.


Theals properties:
• Sends out logs by FTP or email
• Connects itself to the internet
• Hides from the user
• Stays resident in background

Automatic Theals removal:

remover for Theals

Theals manual removal:

Kill processes:
stealth.exe, stealth.dcom.exe, stealth.ddos.exe, stealth.injector.exe, stealth.stat.exe, stealth.wm.exe, stealth.worm.exe
Delete registry values:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\stealth.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\stealth.dcom.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\stealth.ddos.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\stealth.injector.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\stealth.stat.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\stealth.wm.exe
Delete files:
stealth.exe, stealth.dcom.exe, stealth.ddos.exe, stealth.injector.exe, stealth.stat.exe, stealth.wm.exe, stealth.worm.exe, stealth.shared.dll
Misc:
Typical names of archived files attached to malicious e-mail messages: document.zip, foto.zip, porno.zip, secret.zip, tetris.zip

All parasite files are located in the root of the main hard disk (C:). However, they usually are hidden.

Other programs to remove Theals:

• SUPERAntiSpyware - Review - Download
• CounterSpy - Review - Download
• Windows Defender - Review - Download

Information added: 09/09/05
Information updated: 09/09/05

Additional resources related to Theals:

Attention: If you know or you have a website or page about Theals removal, feel free to add a link to this list: add url




more resources

Post Comment:

Attention: Use this form only if you have additional information about Theals parasite, its removal instructions, additional resources or behavior. By clicking "post comment" button you agree not to post any copyrighted, unlawful, harmful, threatening, abusive, harassing, defamatory, vulgar, obscene, profane, hateful, racially, ethnically or otherwise objectionable material of any kind.



Enter security code:

Latest spyware news:
Similar parasites: