TROJ_INJECTO.BP

August 22, 2013

ALIASES:

Trojan:Win32/Matsnu.gen!A (Microsoft); Trojan.Win32.Inject.ebaw (Kaspersky)

PLATFORM:

Windows 2000, Windows XP, Windows Server 2003

OVERALL RISK RATING:

DAMAGE POTENTIAL:

DISTRIBUTION POTENTIAL:

REPORTED INFECTION:

INFORMATION EXPOSURE:

Threat Type: Trojan
Destructiveness: No
Encrypted:
In the wild: Yes

OVERVIEW

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It disables Task Manager, Registry Editor, and Folder Options. It deletes registry entries, causing some applications and programs to not function properly.

It does not have any propagation routine.

TECHNICAL DETAILS

File Size:

51,217 bytes

File Type:

EXE

Memory Resident:

Yes

Initial Samples Received Date:

06 Apr 2013

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following copies of itself into the affected system:

%User Temp%\{random filename}.pre
%Application Data%\{random}\{random filename}.exe
%System%\{random filename}.exe

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.. %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.. %System% is the Windows system folder, which is usually C:\Windows\System32.)

It creates the following folders:

%Application Data%\{random filename}

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.)

It injects codes into the following process(es):

svchost.exe

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{random value} = "%Application Data%\{random}\{random filename}.exe"

It modifies the following registry entries to ensure it automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon
userinit = "%system%\userinit.exe,%system%\{random filename}.exe,"

(Note: The default value data of the said registry entry is %Windows%\system32\userinit.exe,.)

Other System Modifications

This Trojan adds the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
System
DisableRegedit = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
taskmgr.exe
Debugger = "P9KDMF.EXE"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\policies\
system
DisableRegedit = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
msconfig.exe
Debugger = "P9KDMF.EXE"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
regedit.exe
Debugger = "P9KDMF.EXE"

It creates the following registry entry(ies) to disable Task Manager, Registry Tools and Folder Options:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
System
DisableRegistryTools = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\policies\
system
DisableTaskMgr = "1"

It deletes the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot
AlternateShell = "cmd.exe"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Minimal\
AppMgmt
[Default] = "Service"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Minimal\
Base
[Default] = "Driver Group"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Minimal\
Boot Bus Extender
[Default] = "Driver Group"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Minimal\
Boot file system
[Default] = "Driver Group"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Minimal\
CryptSvc
[Default] = "Service"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Minimal\
DcomLaunch
[Default] = "Service"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Minimal\
dmadmin
[Default] = "Service"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Minimal\
dmboot.sys
[Default] = "Driver"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Minimal\
dmio.sys
[Default] = "Driver"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Minimal\
dmload.sys
[Default] = "Driver"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Minimal\
dmserver
[Default] = "Service"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Minimal\
EventLog
[Default] = "Service"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Minimal\
File system
[Default] = "Driver Group"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Minimal\
Filter
[Default] = "Driver Group"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Minimal\
HelpSvc
[Default] = "Service"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Minimal\
Netlogon
[Default] = "Service"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Minimal\
PCI Configuration
[Default] = "Driver Group"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Minimal\
PlugPlay
[Default] = "Service"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Minimal\
PNP Filter
[Default] = "Driver Group"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Minimal\
Primary disk
[Default] = "Driver Group"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Minimal\
RpcSs
[Default] = "Service"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Minimal\
SCSI Class
[Default] = "Driver Group"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Minimal\
sermouse.sys
[Default] = "Driver"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Minimal\
sr.sys
[Default] = "FSFilter System Recovery"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Minimal\
SRService
[Default] = "Service"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Minimal\
System Bus Extender
[Default] = "Driver Group"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Minimal\
vga.sys
[Default] = "Driver"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Minimal\
vgasave.sys
[Default] = "Driver"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Minimal\
WinMgmt
[Default] = "Service"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Minimal\
{36FC9E60-C465-11CF-8056-444553540000}
[Default] = "Universal Serial Bus controllers"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Minimal\
{4D36E965-E325-11CE-BFC1-08002BE10318}
[Default] = "CD-ROM Drive"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Minimal\
{4D36E967-E325-11CE-BFC1-08002BE10318}
[Default] = "DiskDrive"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Minimal\
{4D36E969-E325-11CE-BFC1-08002BE10318}
[Default] = "Standard floppy disk controller"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Minimal\
{4D36E96A-E325-11CE-BFC1-08002BE10318}
[Default] = "Hdc"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Minimal\
{4D36E96B-E325-11CE-BFC1-08002BE10318}
[Default] = "Keyboard"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Minimal\
{4D36E96F-E325-11CE-BFC1-08002BE10318}
[Default] = "Mouse"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Minimal\
{4D36E977-E325-11CE-BFC1-08002BE10318}
[Default] = "PCMCIA Adapters"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Minimal\
{4D36E97B-E325-11CE-BFC1-08002BE10318}
[Default] = "SCSIAdapter"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Minimal\
{4D36E97D-E325-11CE-BFC1-08002BE10318}
[Default] = "System"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Minimal\
{4D36E980-E325-11CE-BFC1-08002BE10318}
[Default] = "Floppy disk drive"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Minimal\
{71A27CDD-812A-11D0-BEC7-08002BE2092F}
[Default] = "Volume"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Minimal\
{745A17A0-74D3-11D0-B6FE-00A0C90F57DA}
[Default] = "Human Interface Devices"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Network\
AFD
[Default] = "Service"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Network\
AppMgmt
[Default] = "Service"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Network\
Base
[Default] = "Driver Group"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Network\
Boot Bus Extender
[Default] = "Driver Group"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Network\
Boot file system
[Default] = "Driver Group"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Network\
Browser
[Default] = "Service"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Network\
CryptSvc
[Default] = "Service"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Network\
DcomLaunch
[Default] = "Service"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Network\
Dhcp
[Default] = "Service"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Network\
dmadmin
[Default] = "Service"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Network\
dmboot.sys
[Default] = "Driver"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Network\
dmio.sys
[Default] = "Driver"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Network\
dmload.sys
[Default] = "Driver"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Network\
dmserver
[Default] = "Service"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Network\
DnsCache
[Default] = "Service"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Network\
EventLog
[Default] = "Service"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Network\
File system
[Default] = "Driver Group"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Network\
Filter
[Default] = "Driver Group"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Network\
HelpSvc
[Default] = "Service"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Network\
ip6fw.sys
[Default] = "Driver"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Network\
ipnat.sys
[Default] = "Driver"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Network\
LanmanServer
[Default] = "Service"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Network\
LanmanWorkstation
[Default] = "Service"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Network\
LmHosts
[Default] = "Service"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Network\
Messenger
[Default] = "Service"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Network\
NDIS
[Default] = "Driver Group"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Network\
NDIS Wrapper
[Default] = "Driver Group"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Network\
Ndisuio
[Default] = "Service"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Network\
NetBIOS
[Default] = "Service"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Network\
NetBIOSGroup
[Default] = "Driver Group"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Network\
NetBT
[Default] = "Service"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Network\
NetDDEGroup
[Default] = "Driver Group"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Network\
Netlogon
[Default] = "Service"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Network\
NetMan
[Default] = "Service"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Network\
Network
[Default] = "Driver Group"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Network\
NetworkProvider
[Default] = "Driver Group"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Network\
NtLmSsp
[Default] = "Service"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Network\
PCI Configuration
[Default] = "Driver Group"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Network\
PlugPlay
[Default] = "Service"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Network\
PNP Filter
[Default] = "Driver Group"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Network\
PNP_TDI
[Default] = "Driver Group"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Network\
Primary disk
[Default] = "Driver Group"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Network\
rdpcdd.sys
[Default] = "Driver"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Network\
rdpdd.sys
[Default] = "Driver"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Network\
rdpwd.sys
[Default] = "Driver"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Network\
rdsessmgr
[Default] = "Service"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Network\
RpcSs
[Default] = "Service"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Network\
SCSI Class
[Default] = "Driver Group"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Network\
sermouse.sys
[Default] = "Driver"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Network\
SharedAccess
[Default] = "Service"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Network\
sr.sys
[Default] = "FSFilter System Recovery"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Network\
SRService
[Default] = "Service"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Network\
Streams Drivers
[Default] = "Driver Group"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Network\
System Bus Extender
[Default] = "Driver Group"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Network\
Tcpip
[Default] = "Service"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Network\
TDI
[Default] = "Driver Group"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Network\
tdpipe.sys
[Default] = "Driver"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Network\
tdtcp.sys
[Default] = "Driver"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Network\
termservice
[Default] = "Service"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Network\
vga.sys
[Default] = "Driver"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Network\
vgasave.sys
[Default] = "Driver"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Network\
WinMgmt
[Default] = "Service"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Network\
WZCSVC
[Default] = "Service"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Network\
{36FC9E60-C465-11CF-8056-444553540000}
[Default] = "Universal Serial Bus controllers"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Network\
{4D36E965-E325-11CE-BFC1-08002BE10318}
[Default] = "CD-ROM Drive"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Network\
{4D36E967-E325-11CE-BFC1-08002BE10318}
[Default] = "DiskDrive"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Network\
{4D36E969-E325-11CE-BFC1-08002BE10318}
[Default] = "Standard floppy disk controller"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Network\
{4D36E96A-E325-11CE-BFC1-08002BE10318}
[Default] = "Hdc"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Network\
{4D36E96B-E325-11CE-BFC1-08002BE10318}
[Default] = "Keyboard"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Network\
{4D36E96F-E325-11CE-BFC1-08002BE10318}
[Default] = "Mouse"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Network\
{4D36E972-E325-11CE-BFC1-08002BE10318}
[Default] = "Net"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Network\
{4D36E973-E325-11CE-BFC1-08002BE10318}
[Default] = "NetClient"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Network\
{4D36E974-E325-11CE-BFC1-08002BE10318}
[Default] = "NetService"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Network\
{4D36E975-E325-11CE-BFC1-08002BE10318}
[Default] = "NetTrans"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Network\
{4D36E977-E325-11CE-BFC1-08002BE10318}
[Default] = "PCMCIA Adapters"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Network\
{4D36E97B-E325-11CE-BFC1-08002BE10318}
[Default] = "SCSIAdapter"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Network\
{4D36E97D-E325-11CE-BFC1-08002BE10318}
[Default] = "System"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Network\
{4D36E980-E325-11CE-BFC1-08002BE10318}
[Default] = "Floppy disk drive"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Network\
{71A27CDD-812A-11D0-BEC7-08002BE2092F}
[Default] = "Volume"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Network\
{745A17A0-74D3-11D0-B6FE-00A0C90F57DA}
[Default] = "Human Interface Devices"

Propagation

This Trojan does not have any propagation routine.

Other Details

This Trojan connects to the following possibly malicious URL:

http://dom1ver.{BLOCKED}ill.com/all/dg797FDFddd.php
http://dom1ver.{BLOCKED}ng.us/all/dg797FDFddd.php
http://dom1ver.{BLOCKED}e.cl/all/dg797FDFddd.php
http://dom1ver.{BLOCKED}00.com/all/dg797FDFddd.php
http://dom1ver.{BLOCKED}9.com/all/dg797FDFddd.php

SOLUTION

Minimum Scan Engine:

9.300

FIRST VSAPI PATTERN FILE:

9.174.02

FIRST VSAPI PATTERN DATE:

06 Jun 2012

VSAPI OPR PATTERN File:

9.175.00

VSAPI OPR PATTERN Date:

07 Jun 2012

Step 1

Before doing any scans, Windows XP, Windows Vista, and Windows 7 users must disable System Restore to allow full scanning of their computers.

Step 2

Identify and delete files detected as TROJ_INJECTO.BP using either the Startup Disk or Recovery Console

[ Learn More ]

To identify and delete the malware/grayware file:

• On Windows XP and Server 2003 systems:

Scan your computer with your Trend Micro product and then take note of the names of the malware/grayware files detected.
Click Start>Run. In the Open input box, type secpol.msc and press Enter.
In the left panel, double-click Local Policies>Security Options.
In the right panel, double-click Recovery Console: Allow floppy copy and access to all drives and folders.
Select Enabled and click OK.
Insert the Windows Installation CD into the CD drive, then restart your computer.
When prompted, press any key to boot from the CD.
On the main menu, type r to go to the Recovery Console.
Type the number that corresponds to the drive and directory that contains Windows (usually C:\WINDOWS) and press Enter.
Type the Administrator password and press Enter.
In the input box, type the following then press Enter:
SET AllowAllPaths = TRUE
del "{malware/grayware path and file name}"
Type exit and press Enter to restart the system normally.

• On Windows Vista and 7 systems:

Scan your computer with your Trend Micro product and then take note of the names of the malware/grayware files detected.
Insert your Windows Installation DVD in the DVD drive, then Press the restart button.
When prompted, press any key to boot from the CD.
Depending on your Windows Installation DVD, you might be required to select the installation language. Then on the Install Windows window, choose your language, locale, and keyboard layout or input method. Click Next, then click Repair your computer.
Select Use recovery tools that can help fix problems starting Windows. Select your installation of Windows. Click Next.
If the Startup Repair window appears, click Cancel, Yes, then Finish.
In the System Recovery Options window, click Command Prompt.
In the Command Prompt window, type the following then press Enter:
BootRec.exe /fixmbr
del "{malware/grayware path and file name}"
Type exit and press Enter to close the Command Prompt window.
Click Restart to restart the system normally.

Step 3

Restore modified and/or deleted registry value/s using this VBScript

<div>On Error Resume Next</div><div>Set shl = WScript.CreateObject("WScript.Shell")</div><div>shl.RegDelete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools"</div><div>shl.RegDelete "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools"</div><div>shl.RegDelete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr"</div><div>shl.RegDelete "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr"</div><div>shl.RegDelete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions"</div><div>shl.RegDelete "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions"</div><div>shl.RegDelete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\"</div><div>shl.RegDelete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\"</div><div>shl.RegDelete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\"</div><div>shl.RegDelete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegedit"</div><div>shl.RegDelete "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegedit"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\AlternateShell", "cmd.exe", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AppMgmt\", "Service", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Base\", "Driver Group", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Boot Bus Extender\", "Driver Group", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Boot file system\", "Driver Group", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CryptSvc\", "Service", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\DcomLaunch\", "Service", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\dmadmin\", "Service", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\dmboot.sys\", "Driver", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\dmio.sys\", "Driver", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\dmload.sys\", "Driver", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\dmserver\", "Service", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\EventLog\", "Service", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\File system\", "Driver Group", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Filter\", "Driver Group", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HelpSvc\", "Service", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Netlogon\", "Service", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PCI Configuration\", "Driver Group", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PlugPlay\", "Service", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PNP Filter\", "Driver Group", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Primary disk\", "Driver Group", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\RpcSs\", "Service", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SCSI Class\", "Driver Group", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sermouse.sys\", "Driver", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sr.sys\", "FSFilter System Recovery", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SRService\", "Service", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\System Bus Extender\", "Driver Group", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vga.sys\", "Driver", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vgasave.sys\", "Driver", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinMgmt\", "Service", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{36FC9E60-C465-11CF-8056-444553540000}\", "Universal Serial Bus controllers", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E965-E325-11CE-BFC1-08002BE10318}\", "CD-ROM Drive", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}\", "DiskDrive", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E969-E325-11CE-BFC1-08002BE10318}\", "Standard floppy disk controller", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96A-E325-11CE-BFC1-08002BE10318}\", "Hdc", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96B-E325-11CE-BFC1-08002BE10318}\", "Keyboard", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96F-E325-11CE-BFC1-08002BE10318}\", "Mouse", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E977-E325-11CE-BFC1-08002BE10318}\", "PCMCIA Adapters", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E97B-E325-11CE-BFC1-08002BE10318}\", "SCSIAdapter", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E97D-E325-11CE-BFC1-08002BE10318}\", "System", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E980-E325-11CE-BFC1-08002BE10318}\", "Floppy disk drive", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{71A27CDD-812A-11D0-BEC7-08002BE2092F}\", "Volume", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{745A17A0-74D3-11D0-B6FE-00A0C90F57DA}\", "Human Interface Devices", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\AFD\", "Service", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\AppMgmt\", "Service", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Base\", "Driver Group", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Boot Bus Extender\", "Driver Group", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Boot file system\", "Driver Group", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Browser\", "Service", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\CryptSvc\", "Service", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\DcomLaunch\", "Service", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Dhcp\", "Service", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\dmadmin\", "Service", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\dmboot.sys\", "Driver", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\dmio.sys\", "Driver", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\dmload.sys\", "Driver", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\dmserver\", "Service", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\DnsCache\", "Service", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\EventLog\", "Service", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\File system\", "Driver Group", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Filter\", "Driver Group", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\HelpSvc\", "Service", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\ip6fw.sys\", "Driver", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\ipnat.sys\", "Driver", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\LanmanServer\", "Service", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\LanmanWorkstation\", "Service", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\LmHosts\", "Service", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Messenger\", "Service", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\NDIS\", "Driver Group", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\NDIS Wrapper\", "Driver Group", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Ndisuio\", "Service", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\NetBIOS\", "Service", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\NetBIOSGroup\", "Driver Group", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\NetBT\", "Service", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\NetDDEGroup\", "Driver Group", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Netlogon\", "Service", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\NetMan\", "Service", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Network\", "Driver Group", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\NetworkProvider\", "Driver Group", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\nm\", "Service", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\nm.sys\", "Driver", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\NtLmSsp\", "Service", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\PCI Configuration\", "Driver Group", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\PlugPlay\", "Service", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\PNP Filter\", "Driver Group", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\PNP_TDI\", "Driver Group", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Primary disk\", "Driver Group", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\rdpcdd.sys\", "Driver", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\rdpdd.sys\", "Driver", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\rdpwd.sys\", "Driver", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\rdsessmgr\", "Service", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\RpcSs\", "Service", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SCSI Class\", "Driver Group", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\sermouse.sys\", "Driver", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SharedAccess\", "Service", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\sr.sys\", "FSFilter System Recovery", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SRService\", "Service", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Streams Drivers\", "Driver Group", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\System Bus Extender\", "Driver Group", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Tcpip\", "Service", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\TDI\", "Driver Group", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\tdpipe.sys\", "Driver", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\tdtcp.sys\", "Driver", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\termservice\", "Service", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\vga.sys\", "Driver", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\vgasave.sys\", "Driver", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WinMgmt\", "Service", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WZCSVC\", "Service", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{36FC9E60-C465-11CF-8056-444553540000}\", "Universal Serial Bus controllers", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E965-E325-11CE-BFC1-08002BE10318}\", "CD-ROM Drive", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318}\", "DiskDrive", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E969-E325-11CE-BFC1-08002BE10318}\", "Standard floppy disk controller", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E96A-E325-11CE-BFC1-08002BE10318}\", "Hdc", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E96B-E325-11CE-BFC1-08002BE10318}\", "Keyboard", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E96F-E325-11CE-BFC1-08002BE10318}\", "Mouse", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\", "Net", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E973-E325-11CE-BFC1-08002BE10318}\", "NetClient", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E974-E325-11CE-BFC1-08002BE10318}\", "NetService", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E975-E325-11CE-BFC1-08002BE10318}\", "NetTrans", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E977-E325-11CE-BFC1-08002BE10318}\", "PCMCIA Adapters", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E97B-E325-11CE-BFC1-08002BE10318}\", "SCSIAdapter", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E97D-E325-11CE-BFC1-08002BE10318}\", "System", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E980-E325-11CE-BFC1-08002BE10318}\", "Floppy disk drive", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{71A27CDD-812A-11D0-BEC7-08002BE2092F}\", "Volume", "REG_SZ"</div><div>shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{745A17A0-74D3-11D0-B6FE-00A0C90F57DA}\", "Human Interface Devices", "REG_SZ"</div>

To restore the modified and/or deleted registry value/s:

Open Notepad.
» For Windows 2000, Windows XP, and Windows Server 2003 users, click Start>Run. In the Open input box, type notepad then press Enter.
» For Windows Vista and Windows 7 users, click Start, type notepad in the Search input field then press Enter.
Copy and paste the following script:
On Error Resume Next Set shl = WScript.CreateObject("WScript.Shell") shl.RegDelete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools" shl.RegDelete "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools" shl.RegDelete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr" shl.RegDelete "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr" shl.RegDelete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions" shl.RegDelete "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions" shl.RegDelete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\" shl.RegDelete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\" shl.RegDelete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\" shl.RegDelete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegedit" shl.RegDelete "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegedit" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\AlternateShell", "cmd.exe", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AppMgmt\", "Service", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Base\", "Driver Group", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Boot Bus Extender\", "Driver Group", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Boot file system\", "Driver Group", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CryptSvc\", "Service", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\DcomLaunch\", "Service", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\dmadmin\", "Service", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\dmboot.sys\", "Driver", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\dmio.sys\", "Driver", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\dmload.sys\", "Driver", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\dmserver\", "Service", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\EventLog\", "Service", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\File system\", "Driver Group", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Filter\", "Driver Group", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HelpSvc\", "Service", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Netlogon\", "Service", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PCI Configuration\", "Driver Group", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PlugPlay\", "Service", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PNP Filter\", "Driver Group", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Primary disk\", "Driver Group", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\RpcSs\", "Service", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SCSI Class\", "Driver Group", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sermouse.sys\", "Driver", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sr.sys\", "FSFilter System Recovery", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SRService\", "Service", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\System Bus Extender\", "Driver Group", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vga.sys\", "Driver", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vgasave.sys\", "Driver", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinMgmt\", "Service", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{36FC9E60-C465-11CF-8056-444553540000}\", "Universal Serial Bus controllers", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E965-E325-11CE-BFC1-08002BE10318}\", "CD-ROM Drive", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}\", "DiskDrive", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E969-E325-11CE-BFC1-08002BE10318}\", "Standard floppy disk controller", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96A-E325-11CE-BFC1-08002BE10318}\", "Hdc", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96B-E325-11CE-BFC1-08002BE10318}\", "Keyboard", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96F-E325-11CE-BFC1-08002BE10318}\", "Mouse", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E977-E325-11CE-BFC1-08002BE10318}\", "PCMCIA Adapters", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E97B-E325-11CE-BFC1-08002BE10318}\", "SCSIAdapter", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E97D-E325-11CE-BFC1-08002BE10318}\", "System", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E980-E325-11CE-BFC1-08002BE10318}\", "Floppy disk drive", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{71A27CDD-812A-11D0-BEC7-08002BE2092F}\", "Volume", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{745A17A0-74D3-11D0-B6FE-00A0C90F57DA}\", "Human Interface Devices", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\AFD\", "Service", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\AppMgmt\", "Service", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Base\", "Driver Group", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Boot Bus Extender\", "Driver Group", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Boot file system\", "Driver Group", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Browser\", "Service", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\CryptSvc\", "Service", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\DcomLaunch\", "Service", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Dhcp\", "Service", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\dmadmin\", "Service", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\dmboot.sys\", "Driver", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\dmio.sys\", "Driver", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\dmload.sys\", "Driver", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\dmserver\", "Service", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\DnsCache\", "Service", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\EventLog\", "Service", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\File system\", "Driver Group", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Filter\", "Driver Group", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\HelpSvc\", "Service", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\ip6fw.sys\", "Driver", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\ipnat.sys\", "Driver", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\LanmanServer\", "Service", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\LanmanWorkstation\", "Service", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\LmHosts\", "Service", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Messenger\", "Service", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\NDIS\", "Driver Group", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\NDIS Wrapper\", "Driver Group", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Ndisuio\", "Service", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\NetBIOS\", "Service", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\NetBIOSGroup\", "Driver Group", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\NetBT\", "Service", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\NetDDEGroup\", "Driver Group", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Netlogon\", "Service", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\NetMan\", "Service", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Network\", "Driver Group", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\NetworkProvider\", "Driver Group", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\nm\", "Service", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\nm.sys\", "Driver", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\NtLmSsp\", "Service", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\PCI Configuration\", "Driver Group", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\PlugPlay\", "Service", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\PNP Filter\", "Driver Group", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\PNP_TDI\", "Driver Group", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Primary disk\", "Driver Group", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\rdpcdd.sys\", "Driver", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\rdpdd.sys\", "Driver", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\rdpwd.sys\", "Driver", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\rdsessmgr\", "Service", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\RpcSs\", "Service", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SCSI Class\", "Driver Group", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\sermouse.sys\", "Driver", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SharedAccess\", "Service", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\sr.sys\", "FSFilter System Recovery", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SRService\", "Service", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Streams Drivers\", "Driver Group", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\System Bus Extender\", "Driver Group", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Tcpip\", "Service", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\TDI\", "Driver Group", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\tdpipe.sys\", "Driver", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\tdtcp.sys\", "Driver", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\termservice\", "Service", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\vga.sys\", "Driver", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\vgasave.sys\", "Driver", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WinMgmt\", "Service", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WZCSVC\", "Service", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{36FC9E60-C465-11CF-8056-444553540000}\", "Universal Serial Bus controllers", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E965-E325-11CE-BFC1-08002BE10318}\", "CD-ROM Drive", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318}\", "DiskDrive", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E969-E325-11CE-BFC1-08002BE10318}\", "Standard floppy disk controller", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E96A-E325-11CE-BFC1-08002BE10318}\", "Hdc", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E96B-E325-11CE-BFC1-08002BE10318}\", "Keyboard", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E96F-E325-11CE-BFC1-08002BE10318}\", "Mouse", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\", "Net", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E973-E325-11CE-BFC1-08002BE10318}\", "NetClient", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E974-E325-11CE-BFC1-08002BE10318}\", "NetService", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E975-E325-11CE-BFC1-08002BE10318}\", "NetTrans", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E977-E325-11CE-BFC1-08002BE10318}\", "PCMCIA Adapters", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E97B-E325-11CE-BFC1-08002BE10318}\", "SCSIAdapter", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E97D-E325-11CE-BFC1-08002BE10318}\", "System", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E980-E325-11CE-BFC1-08002BE10318}\", "Floppy disk drive", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{71A27CDD-812A-11D0-BEC7-08002BE2092F}\", "Volume", "REG_SZ" shl.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{745A17A0-74D3-11D0-B6FE-00A0C90F57DA}\", "Human Interface Devices", "REG_SZ"
Save this file as C:\RESTORE.VBS.
Run C:\RESTORE.VBS.
» For Windows 2000, XP, and Server 2003 users, click Start>Run. In the Open input box, type C:\RESTORE.VBS then press Enter.
» For Windows Vista and Windows 7 users, click Start, type C:\RESTORE.VBS in the Search input field then press Enter.

Step 4

Delete this registry value

[ Learn More ]

Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry.

In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
- {random value} = "%Application Data%\{random}\{random filename}.exe"

Step 5

Restore these modified registry values

[ Learn More ]

Important:Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this only if you know how to or you can seek your system administrator's help. You may also check out this Microsoft article first before modifying your computer's registry.

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
- From: Userinit = "%system%\userinit.exe,%system%\{random filename}.exe,"
  To: Userinit = "%system%\userinit.exe,"

Step 6

Search and delete these components

[ Learn More ]

There may be some components that are hidden. Please make sure you check the Search Hidden Files and Folders checkbox in the "More advanced options" option to include all hidden files and folders in the search result.

%Application Data%\{random}
%Application Data%\{random}\{random filename}.exe
%System%\{random filename}.exe

Step 7

Scan your computer with your Trend Micro product to delete files detected as TROJ_INJECTO.BP. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.

Did this description help? Tell us how we did.

TROJ_INJECTO.BP

OVERVIEW

TECHNICAL DETAILS

SOLUTION

Resources

Support

About Trend

Country Headquarters

TROJ_INJECTO.BP

OVERVIEW

TECHNICAL DETAILS

SOLUTION

Resources

Support

About Trend

Country Headquarters

The Americas

Middle East & Africa

Europe

Asia & Pacific