Troj/Dumaru-B

Please follow the instructions for removing Trojans.

You will also need to edit the following registry entries, if they are present. Please read the warning about editing the registry.

At the taskbar, click Start|Run. Type 'Regedit' and press Return. The registry editor opens.

Before you edit the registry, you should make a backup. On the 'Registry' menu, click 'Export Registry File'. In the 'Export range' panel, click 'All', then save your registry as Backup.

Locate the HKEY_LOCAL_MACHINE entry:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\load32

and delete it if it exists.

Each user has a registry area named HKEY_USERS\[code number indicating user]\. For each user locate the entry:

HKU\[code number]\Software\Microsoft\Windows NT\
CurrentVersion\Winlogon\Shell

and delete any reference to any file you deleted. Do not delete references to any other files.

Close the registry editor.

Delete the file fa4537ef.tmp in the Windows temp folder, if it exists.

Replace the Hosts file from a backup or edit it in Notepad to remove the changes that the Trojan has made. If you have not customised the HOSTS file, you can safely delete it.

Troj/Dumaru-B is a password stealing backdoor Trojan.

In order to run automatically when Windows starts up the Trojan copies itself to
the files netda.exe and netdc.exe in the Windows system folder and adds the following registry entries pointing to these files:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\load32 and
HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell.

The Trojan also copies itself to the Startup folder of the current user as the
file netdb.exe.

Troj/Dumaru-B drops the file prntsvr.dll into the Windows folder and creates the HTML files fe43e701.htm and feff35a0.htm in the Windows temp folder. The Trojan starts explorer to run one of the HTML files which contains instructions to send passwords and other information to a remote website.

The Trojan modifies to file drivers\etc\hosts in the Windows system folder
and may also create the temporary log file fa4537ef.tmp in the Windows temp
folder.

The Trojan stores internal settings in registry entries below

HKCU\Software\SARS.

Troj/Dumaru-B injects itself into the address space of InternetExplorer and runs in this context.

The Trojan starts a proxy server on a random TCP port and opens the backdoor
ports 1001 and 10000 enabling a malicious user to remotely control an infected
computer.

Troj/Dumaru-B also contains keylogging and password stealing functionality.
The Trojan periodically attempts to send the collected information to a remote
email address and access a remote website.