Troyano en aplicaciones para PSP

Fuente BADBOY en los foros de pspupdates

Trojan removing for files That are file size 1,55 MB (1.635.884 bytes)
Wel today there are trojan on the loose so far two file names

Devhook_0.50_installer_pa ckage_BETA
And
PSP_manger

the come in a rar but can be zip etc to

when you download that file and unzip it its an exe
with filesize 1,55 MB (1.635.884 bytes)

(first of all DO NOT RUN IT)

(Also if you run it you got an error screen somting about memorey error)

Second if you did run it this is a small tutorial how to remove it (i had that today so i know what files that where installed and placed)

Also what this trojan dos is

It download those (belowe me) files
Then its opening a port and its uploading bankaccounts, passwords , personial files to (sowhere dont know)


-----

to get rid of it do this

Boot in save mode
go to explorer click on tools => Folder options select tap View then select
Show hidden files and folders
and unselect
Hide protected operating system files (recommended)
DELITE the file c:\windows\services.exe
DELITE the file c:\windows\system\sservic e.exe
DELITE the file c:\windows\system32\fserv ice.exe
empty this dir C:\WINDOWS\Prefetch
empty this dir C:\WINDOWS\Temp empty dir
empty this dir C:\Documents and Settings\YOUREUSERNAME\Lo cal Settings\Temp empty dir
then go to start => run (windows key+r) => regedit
go to
HKEY_LOCAL_MACHINE\SOFTWA RE\Microsoft\Windows\Curr entVersion\policies\Explo rer\Run
delite the key "DirectX For Microsoft® Windows"
then go to
HKEY_LOCAL_MACHINE\SOFTWA RE\Microsoft\Windows NT\CurrentVersion\Winlogo n
Then you see a key named "shell" dubbel klik that and rename
Explorer.exe C:\WINDOWS\system32\fserv ice.exe
to
Explorer.exe

go to HKEY_LOCAL_MACHINE\SOFTWA RE\Microsoft\Active Setup\Installed Components\

and find {5Y99AE78-58TT-11dW-BE53-Y67078979Y} and delite it

now reboot to normal mode and youre clean of it

Edit: why are there spaces in my text? :s

Edit: found out that it is called "Backdoor.Prorat" more info
http://www.symantec.com/security_res...216-99&tabid=2
-------------------------------------------------------------------

Por mi parte dar la confirmacion de que estos ficheros estan en las reded P2P.

y que se han enviado a varios desarroladores de antivirus
es de antivirus y han confirmado la presencia de codigo malicioso.

Hello.
New malicious software was found in the attached file.
It's detection will be included in the next update. Thank you for your help.
-----------------
Regards, Alexander Markov
Virus Analyst, Kaspersky Lab.