Troj/Soromo-A

Please follow the instructions for removing Trojans.

You will also need to edit the following registry entries, if they are present. Please read the warning about editing the registry.

At the taskbar, click Start|Run. Type 'Regedit' and press Return. The registry editor opens.

Before you edit the registry, you should make a backup. On the 'Registry' menu, click 'Export Registry File'. In the 'Export range' panel, click 'All', then save your registry as Backup.

Locate the HKEY_LOCAL_MACHINE entries:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\System Update
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce\System Update

and delete them if they exist.

Close the registry editor.

Troj/Soromo-A is a browser-hijacking Trojan.

In order to run automatically when Windows starts up the Trojan copies itself to one of the following filenames in the Windows system folder:

update.exe
explorer.exe
winlogon.exe
system.exe
taskman.exe
taskmon.exe
svchost.exe
services.exe
wupdmgr.exe
winspool.exe
webcheck.exe
wininet.exe

Troj/Soromo-A then adds the following registry entry, pointing to the copy of itself:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\System Update

The Trojan also adds the following registry entry in order to delete the original file:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce\System Update

Troj/Soromo-A periodically starts up a browser and directs it to a URL chosen randomly from a list of websites configured by the author.