Troj/Dloader-HF

Please follow the instructions for removing Trojans.

Windows NT/2000/XP/2003

In Windows NT/2000/XP/2003 you will also need to edit the following registry entry. The removal of this entry is optional in Windows 95/98/Me. Please read the warning about editing the registry.

At the taskbar, click Start|Run. Type 'Regedit' and press Return. The registry editor opens.

Before you edit the registry, you should make a backup. On the 'Registry' menu, click 'Export Registry File'. In the 'Export range' panel, click 'All', then save your registry as Backup.

Locate the HKEY_LOCAL_MACHINE entry:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
ControlPanel =
<Windows system folder>\cmd32.exe internat.dll,LoadKeyboardProfile

and delete it if it exists.

Close the registry editor.

Troj/Dloader-HF is a downloader Trojan.

Troj/Dloader-HF attempts to copy itself to the Windows system folder with the filename CMD32.EXE and to set the following entry in the registry so as to run itself on system startup, resetting this value periodically:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
ControlPanel =
<Windows system folder>\cmd32.exe internat.dll,LoadKeyboardProfile

Troj/Dloader-HF attempts to download files from the following websites to numbered files with DAT extensions or to the files CC.C or UU.U:

http://dapsol.com
http://www.awmcash.biz

Troj/Dloader-HF then copies the downloaded files to the Windows system folder with the following filenames and executes them:

usxxcxzcb.exe
lpzxczxct.exe
izxczxcr.exe
intrcxzcxzcon.exe
intffdsronsad.exe
intfsdffdsronsad.exe
intronsad.exe