Haxfix Version 5.0.24

Version 5.0.24
2008 10 05

Infection: Goldun

[HKEY_LOCAL_MACHINESOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\mt47hub]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\svitch]
mt47hub.dll
svitch.sys


Use haxfix to remove this infection.
Removalinstructions for this infection, you can find here or here.

Haxfix Version 5.0.23

Version 5.023
2008 10 03

Infection: Goldun

Added detection for a new kind of files, using the Appinitkey.

Haxfix Version 5.0.22

Version 5.0.22
2008 10 02

Infection: Goldun

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D032570A-5F63-4812-A094-87D007C23012}]
%System%\IEBHO.dll


Use haxfix to remove this infection.
Removalinstructions for this infection, you can find here or here.

Haxfix version 5.0.21

Version 5.021
2008 09 29

Infection: Trojan.Win32.Agent

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CIJBDYZA"="%systemroot%\CIJBDYZA.exe"

%System%\tremir.bin


Use haxfix to remove this infection.
Removalinstructions for this infection, you can find here or here.

Haxfix version 5.0.20

Version 5.0.20
2008 09 22

Infection: Goldun

O20 - Winlogon Notify: asplug - C:\WINDOWS\SYSTEM32\asplug.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\asplug]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\asplg]
DirectSound KDriver: \??\C:\WINDOWS\SYSTEM32\asplg.sys

C:\WINDOWS\SYSTEM32\asplg.sys
C:\WINDOWS\SYSTEM32\asplug.dll

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"solo"=-


Use haxfix to remove this infection.
Removalinstructions for this infection, you can find here or here.

Haxfix version 5.0.19

Version 5.0.19
2008 09 18

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\gzipmod]

gzipmod.dll
vbagz.sys


Use haxfix to remove this infection.
Removalinstructions for this infection, you can find here or here.

Haxfix Version 5.0.18

Version 5.018
2008 09 15

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ddrawxt]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cabpck]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"braviax"=-
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"braviax"=-

Files:
ddrawxt.dll
cabpck.dll
ddraw.sys
krnlcab.sys
braviax.exe

I changed the script that is checking for othter haxdoor and goldunfiles.
If known rootkitfiles are present, haxfix will find and delete them.


Use haxfix to remove this infection.
Removalinstructions for this infection, you can find here or here.