Haxfix version 5.0.50

Version 5.0.50
2008 12 27

Infection: Goldun

O20 - Winlogon Notify: modzlib - C:\WINDOWS\system32\modzlib.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\modzlib

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\gzvba.sys
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\gzvba.sys

Files:
system32\modzlib.dll
system32\gzvba.sys


Infection: Trojan-Downloader.Win32.BHO.aej - TrojanSpy:Win32/Ambler.D - Trojan-Dropper.Win32.Ambler

O2 - BHO: Google plugin - {18CACF0E-72A4-4be1-AA42-DC2ECDB197F1} - C:\WINDOWS\system32\kcms.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18CACF0E-72A4-4be1-AA42-DC2ECDB197F1}

Files:
system32\alog.txt
system32\bb1.dat
system32\kcms.dll
system32\mx
system32\ps1.dat
system32\rc.dat


Infection: Virus.Neshta - Trojan-Banker.Win32.Banker.ghd - TSPY_BANKER.LJU TrojanSpy:Win32/Ambler.A - Trojan-Spy.Win32.Banker

Files:
system32\accs.txt
system32\cookie.dat
system32\ps.dat



Use haxfix to remove this infection.
Removalinstructions for this infection, you can find here or here.

Haxfix version 5.0.49

Version 5.0.49
2008 12 26

Infection: Goldun

O20 - Winlogon Notify: syncps - C:\WINDOWS\system32\syncps.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\syncps

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\syncmc
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\syncmc.sys
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\syncmc.sys

Files:
system32\syncmc.sys
system32\syncps.dll



Use haxfix to remove this infection.
Removalinstructions for this infection, you can find here or here.

Haxfix version 5.0.48

Version 5.0.48
2008 12 24

Infection: Goldun

Updated the appinit detection.


Infection: Spy.Banker - TrojanSpy:Win32/Ambler.D

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{63845B64-69B6-4b9a-9461-C59B2AFDC0A9}

File:
system32\vgf32.dll


Use haxfix to remove this infection.
Removalinstructions for this infection, you can find here or here.

Haxfix version 5.0.47

Version 5.0.47
2008 12 23

Infection: Goldun

Updated the appinit detection.


Infection: Spy.Banker - TrojanSpy:Win32/Ambler.D

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F6E0EF5F-5F03-43f9-8E02-BBAAA95EAA9C}

File:
system32\nods32.dll


Infection: Goldun

O20 - Winlogon Notify: modgzip - C:\WINDOWS\system32\modgzip.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\modgzip\modgzip

File:
system32\modgzip.dll



Use haxfix to remove this infection.
Removalinstructions for this infection, you can find here or here.

Haxfix version 5.0.46

Version 5.0.46
2008 12 20

Infection: Goldun

O20 - Winlogon Notify: snjava - C:\WINDOWS\system32\snjava.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snjava

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\java2.sys
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\java2.sys

Files:
system32\snjava.dll
system32\java2.sys


Use haxfix to remove this infection.
Removalinstructions for this infection, you can find here or here.

Haxfix version 5.0.45

Version 5.0.45
2008 12 19

Infection: Goldun

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\gzvba.sys
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\gzvba.sys
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\gzvba

File:
system32\gzvba.sys


Use haxfix to remove this infection.
Removalinstructions for this infection, you can find here or here.

Haxfix version 5.0.44

Version 5.0.44
2008 12 18

Infection: Goldun

O20 - Winlogon Notify: xliftm - C:\WINDOWS\system32\xliftm.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\xliftm

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\xlift.sys
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\xlift.sys
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\xlift

system32\cardb.dat
system32\xlift.sys
system32\xliftm.dll



Use haxfix to remove this infection.
Removalinstructions for this infection, you can find here or here.