HaxFix version 5.095

5.095
2010 10 10

Infection: Haxdoor
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\boot32
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\boot32.sys
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\boot32.sys

Files:
system32\boot32.sys


Use haxfix to remove this infection.
Removalinstructions for this infection, you can find here or here.
Haxfix has been updated for Windows Vista (32-bit) en Windows 7 (32-bit).

HaxFix Version 5.094

5.094
2010 04 04

Infection: Goldun
Updated the detection for random services.

Haxfix version 5.0.93

5.093
2010 01 28

Infection: Goldun
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\lixgap
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lixgax
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\lixgax.sys
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\lixgax.sys

Files:
system32\a99k.bin
system32\lixgax.sys
system32\lixgap.dll
system32\mod_st.dat
windows\pxysdb.dat


Use haxfix to remove this infection.
Removalinstructions for this infection, you can find here or here.
Haxfix has been updated for Windows Vista (32-bit) en Windows 7 (32-bit).

Haxfix version 5.0.92

5.092
2010 01 20

Infection: Goldun
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\xxop81
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\lingap
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lingax
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\lingax.sys
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\lingax.sys

Infection: Trojan Ambler
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{209a54af-418a-4b1e-a68d-21fc33494303}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E14B6F5F-3F90-4871-AC57-18DFE244EE8F}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A1E88A88-9B9B-45D8-9CDC-39A934318E46}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3063ABBF-1257-4B23-A672-9E29A508A2FA}

Files:
system32\nnurri9.dll
system32\jtaqhghuc47.dll
system32\xxupuykyz65.dll
system32\ywud.dll
system32\ijqwv45.dll
system32\lingap.dll
system32\lingax.sys


Use haxfix to remove this infection.
Removalinstructions for this infection, you can find here or here.
Haxfix has been updated for Windows Vista (32-bit) en Windows 7 (32-bit).

Haxfix version 5.0.91

Version 5.091
2010 01 09

Haxfix has been updated for Windows Vista (32-bit) en Windows 7 (32-bit).



Use haxfix to remove this infection.
Removalinstructions for this infection, you can find here or here.

Greetings...

They said there'd be snow at Christmas...

To everybody who occasionally takes a look at this blog.
I wish you a merry Christmas and happy New Year.

Haxfix version 5.0.90

Version 5.090
2009 12 19

Infection: Goldun
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\simdpp
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\simdpx
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\simdpx.sys
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\simdpx.sys

Files:
system32\mod_st.dat
system32\simdpx.sys
system32\simdpp.dll


Infection: Goldun
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\saifx
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sorrd
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sorrd.sys
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\sorrd.sys

Files:
system32\saifx.dll
system32\sorrd.sys


Infection Goldun:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\linkap
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\linkax
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\linkax.sys
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\linkax.sys

Files:
system32\linkap.dll
system32\linkax.sys