Troj/PPdoor-J

Please follow the instructions for removing Trojans.

Windows NT/2000/XP/2003

In Windows NT/2000/XP/2003 you will also need to edit the following registry entry. The removal of this entry is optional in Windows 95/98/Me. Please read the warning about editing the registry.

At the taskbar, click Start|Run. Type 'Regedit' and press Return. The registry editor opens.

Before you edit the registry, you should make a backup. On the 'Registry' menu, click 'Export Registry File'. In the 'Export range' panel, click 'All', then save your registry as Backup.

Locate the HKEY_LOCAL_MACHINE entry:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Client Agent
<path of Trojan with random filename>

and delete it if it exists.

Close the registry editor.

Troj/PPdoor-J is a backdoor Trojan for the Windows platform.

Once executed Troj/PPdoor-J attempts to copy itself to the Windows system folder,and in order to be able to run automatically when Windows starts up sets the registry entry with the path to the copy:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Client Agent
<path of Trojan with random filename>

When Troj/PPdoor-J is installed the following files are created:

<System>\ovdcmaaa.dll
<System>\vnetbsh.dll

The Trojan creates shell_qc.dll and following registry entries:

HKCR\CLSID\11F1576E-3AB4-439A-A5C9- 4D77B4087863
InProcServer32
\shel1_qc.dll

The following registry entry is created to run code exported by the Trojan library on startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ ShellServiceObjectDelayLoad
Internet Agent
(11F1576E-3AB4-439A-A5C9-4D77B4087863)

Troj/PPdoor-J terminates the following AV and security related applications:

*ahnlab
*antispy
*avast
*avg
*buddybuddy
*firewall
*kasper
*kav6
*kerio
*mcafee
*netshield
*norton
*panda
*sahagent
*sygate
*symant
*trend micro
180ax
32\angelex
aawsepers
actalert
ad-aware.
ap9h4qmo
apvxdw
ares.
autoruns
aveage
avguard.exe
avp32
avpcc
avpm
avpupd
bargains
bcpc.exe
bigfix
bpc2_re_inst
bpcv2.exe
bpcv2_inst
bpt.exe
btv.exe
ca.exe
cashback
ccapp
cpd.exe
cxtpls.exe
dap\dap.
dc8.e
deskad
drweb
drwtsn32
dwwin
exdl.
firewall
gah95on6
gcasdts
gcasserv
giantanti
hbsrv.
istsvc.
kav32.
kavi
kwatch
mediaacc
mksc.0
mpus
navapp.
navapw
navw32
ncasepackage
netpia
nls.exe
nscheck
nsvsvc.exe
optimize.exe
ossproxy
outpost
pavsrv
pc-clean
pccgu
pccl
pccnt
persfw
pib.exe
powerscan
procexp
pskill
radio.e
razin.exe
rootkit
saap.e
sais.e
salm
secure.e
security igu
sidefind
sistray
smc.exe
smcserv
spider
spybot
spynet.
spyspotter
spysweeper
ssk.e
sskupd
startupmonitor
stopsignav
stopzilla
swdoctor
sygate
syscheckbop32
Sysdll32
Sysexplr
sysgut
targetsaver
tbps
teatimer.
tmlist
unsmss
uppicsvr
vcpdll.
vcrmon.
vptray
vsmon
wareout
webrebat
winadctl.exe
wsup
wtools
wuauclt
wuauserv
zlclient