You are here: Brothersoft.com > Windows > Security > Anti Virus >

Win32.Sober.S-AD Removal Tool Download

Win32.Sober.S-AD Removal Tool

A useful tool that removes the Sober virus infection from software.

Download 38KB

Last Week downloads: 0

Total downloads: 852

Last Updated: Sep 9, 2010
License: Freeware Free
OS: Windows 7/Vista/2003/XP/2000/2008/98/Me/NT
Requirements: No special requirements

Publisher: BitDefender LLC (46 more Applications)

view larger (1)

User reviews

0 out of 5 based on 0 ratings for Win32.Sober.S-AD Removal Tool

For Win32.Sober.S-AD Removal Tool Publisher's description

The the virus creates the folder WinSecurity in the %WINDIR% folder and Drops the above files in it. It then executes the executable just dropped named
%WINDIR%\WinSecurity\services.exe
Then executes
%WINDIR%\WinSecurity\smss.exe
and finally
%WINDIR%\WinSecurity\crss.exe
Each of these processes play a specific role :
crss.exe examines if the registry key
HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENT VERSION\RUN\ Windows = C:\WINNT\WinSecurity\services.exe
has been deleted and rewrites it if this is the case
services.exe starts searching the victim’s Folders for files containing e-mail addresses on wich to propagate.
Files with the following extension are scanned:
stm slk inbox imb csv bak imh x html imm imh cms nws vcf ctl dhtm cgi pp ppt msg jsp oft vbs uin ldb abc pst cfg mdw mbx mdx mda ade sln dsw mde frm bas adr clsxls nsf txt wab eml hlp mht nfo,etc. It creates the registry key
HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENT VERSION\RUN\
Windows = C:\WINNT\WinSecurity\services.exe
in order to assure it will be run at every OS startup. If this key is deleted from the registry while the virus is running in memory, it will try to put it back, having a dedicated thread to do this job.
The virus tries to download a file from the Internet and run it:
http://home.pages.at/.../S??.exe
The worm implements it’s own SMTP engine for spreading via e-mail.
The virus also spoofs the sender’s domain address, wich will appear to originate from one of the following domains
microsoft.com, BigFoot.com, yahoo.com, t-online.de, Google.com, hotmail.com., mx1.mail.yahoo, mxbw.bluewin.ch etc.
The virus then searches list of active processes for Process names from the list below :
Microsoftanti gcas gcip hijack,etc. and tries to kill them.
For Win XP operating systems, the virus also tries to patch the tcpip.sys driver to allow it to open a virtually unlimited number of connections from the victim’s computer. you can free download Win32.Sober.S-AD Removal Tool now.

For Win32.Sober.S-AD Removal Tool Related Software

2,196,977 downloadsAMV Convert Tool 4.00
365,704 downloadsAMV Convert Tool 5.09
249,790 downloadsAMV Convert Tool 3.57
85,033 downloadsKaspersky Virus Removal Tool 2010 9.0.0.722 2011.04.19

For Win32.Sober.S-AD Removal Tool

Statement

Please be aware that Brothersoft do not supply any crack, patches, serial numbers or keygen for Win32.Sober.S-AD Removal Tool,and please consult directly with program authors for any problem with Win32.Sober.S-AD Removal Tool.

DOWNLOAD Win32.Sober.S-AD Removal Tool

Top Freeware

in Anti Virus

Top Shareware

in Anti Virus

New Software

in Anti Virus

Win32.Sober.S-AD Removal Tool Download

Categories

Win32.Sober.S-AD Removal Tool

A useful tool that removes the Sober virus infection from software.

User reviews

For Win32.Sober.S-AD Removal Tool Publisher's description

For Win32.Sober.S-AD Removal Tool Related Software

Tags

Statement

Top Freeware

Top Shareware

Popular Searches

New Software