Troj/Padodor-L

Please follow the instructions for removing Trojans.

You will also need to edit the following registry entry, if it is present. Please read the warning about editing the registry.

At the taskbar, click Start|Run. Type 'Regedit' and press Return. The registry editor opens.

Before you edit the registry, you should make a backup. On the 'Registry' menu, click 'Export Registry File'. In the 'Export range' panel, click 'All', then save your registry as Backup.

Locate the HKEY_LOCAL_MACHINE entry:

HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Microsoft DirectXb = (79FEACFF-FFCE-815E-A900-316290B5B738)

and delete it if it exists..

Locate the HKEY_CLASSES_ROOT entry:

HKCR\CLSID\(79FEACFF-FFCE-815E-A900-316290B5B738)\InProcServer32\

and remove any reference to any file you deleted.

Close the registry editor.

You should also change your Internet Explorer settings using Tools|Internet options|General to remove any modifications made by the Trojan.

Troj/Padodor-L is a data-stealing Trojan. When executed the Trojan copies itself to the Windows system folder using a randomly generated name. Troj/Padodor-L is a data-stealing Trojan. When executed the Trojan copies itself to the Windows system folder using a randomly generated name. A helper DLL is also created and placed into the Windows system folder using a randomly generated name. Troj/Padodor-L creates the following registry entries so as to auto-start:

HKCR\CLSID\(79FEACFF-FFCE-815E-A900-316290B5B738)\InProcServer32\
= <path to helper dll>

HKLM\Software\Microsoft\Windows\CurrentVersion\
ShellServiceObjectDelayLoad\
Microsoft DirectXb = (79FEACFF-FFCE-815E-A900-316290B5B738)

HKCR\CLSID\(79FEACFF-FFCE-815E-A900-316290B5B738)\InProcServer32\
ThreadingModel = Apartment

Internet Explorer Security settings are altered so as to reduce overall security.