Registry Cleaner Geeks

February 25, 2009 6:21:40 AM

Windows XP, Windows Server 2003, Windows 2000

In order to remove Remove W32.Spamuzle.E you need to Download the ‘No Adware’ remover software. Based on our testing this was the best peforming remover of W32.Spamuzle.E..

You will see the download link on their website, once installed it will perform a full system scan on your machine for free.

When the Trojan executes, it infects the following files:

* %Windir%\explorer.exe
* %System%\dllcache\explorer.exe

Note: The above files are detected as W32.Spamuzle.E!inf.

The infected explorer.exe files drop the following file when executed:

%System%\[RANDOM CHARACTERS].dll

Note: Multiple files with random file names will be created.

The Trojan then creates a backup copy of %System%\sfc_os.dll in the following location:
%System%\trash[RANDOM CHARACTERS]

It then deletes the following files:

* %System%\dllcache\sfc.dll
* %System%\dllcache\sfc_os.dll

It then modifies the following files:

* %System%\drivers\tcpip.sys
* %System%\sfc_os.dll

The Trojan then creates the following registry entry so that it runs whenever Windows starts:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor\"RunOnce" = "[RANDOM CHARACTERS]"

It also creates the following registry subkey:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor\1\[RANDOM CHARACTERS]

The Trojan then modifies the following registry entries:

* HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\"SFCDisable" = "ffffff9d"
* HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\"SFCScan" = "0"

The Trojan also modifies the following registry entry:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\"PrivDiscUiShown" = "1"

The Trojan then attempts to end the following process:
ashmaisv.exe

The Trojan has rootkit capabilities that enable it to hide its presence.

Next, the Trojan deletes the following DNS cache entries:

* 63.226.12.96
* 216.231.41.2
* 204.117.214.10

The Trojan may then perform the following actions on the compromised computer:

* Gather email addresses in order to send spam
* Download files

* Check for the presence of certain software by searching the registry

The Trojan sends the gathered information to a remote server by connecting to the following URL:
[http://]91.194.76.145/ht[REMOVED]

MANUAL REMOVAL: Please click here for manual removal instructions.