Troj/PAdmin-C

Please follow the instructions for removing Trojans.

Windows NT/2000/XP/2003

In Windows NT/2000/XP/2003 you will also need to edit the following registry entry. The removal of this entry is optional in Windows 95/98/Me. Please read the warning about editing the registry.

At the taskbar, click Start|Run. Type 'Regedit' and press Return. The registry editor opens.

Before you edit the registry, you should make a backup. On the 'Registry' menu, click 'Export Registry File'. In the 'Export range' panel, click 'All', then save your registry as Backup.

Locate the HKEY_LOCAL_MACHINE entry:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
Windows Task Procedure

and delete it if it exists.

Close the registry editor.

Troj/PAdmin-C is a configurable backdoor Trojan that installs itself to the Windows system32 folder, sets the following registry entry to make sure the Trojan will be executed at the next restart:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
Windows Task Procedure

Troj/PAdmin-C also creates the following registry entries:

HKU\Software\VB and VBA Program Settings\lifesux\pAdmin v1.1\version
HKU\Software\VB and VBA Program Settings\lifesux\settings\hidden
HKU\Software\VB and VBA Program Settings\lifesux\settings\port
HKU\Software\VB and VBA Program Settings\lifesux\settings\nrPort
HKU\Software\VB and VBA Program Settings\lifesux\settings\nrHost
HKU\Software\VB and VBA Program Settings\lifesux\settings\nrRPort
HKU\Software\VB and VBA Program Settings\lifesux\settings\bncPort
HKU\Software\VB and VBA Program Settings\lifesux\settings\bncPass
HKU\Software\VB and VBA Program Settings\lifesux\settings\httpMin
HKU\Software\VB and VBA Program Settings\lifesux\settings\identResponse
HKU\Software\VB and VBA Program Settings\lifesux\settings\showWeb
HKU\Software\VB and VBA Program Settings\lifesux\settings\showScan

Troj/PAdmin-C logs onto a predefined IRC server and waits for backdoor commands.