Thursday, January 1, 2009

KaZaA Worm

KaZaA malware description and removal detail
Categories:Worm
Also known as:

[Panda]Adware/BrilliantDigital,Adware/Medload,Adware/TopMoxie
Visible Symptoms:
Files in system folders:
[%APPDATA%]\Microsoft\Internet Explorer\Quick Launch\Launch Kazaa.lnk
[%DESKTOP%]\kazaa media desktop.lnk
[%DESKTOP%]\kazaa promotions.url
[%DESKTOP%]\kazaa shop.lnk
[%DESKTOP%]\kazaa shop.url
[%DESKTOP%]\Kazaa.lnk
[%DESKTOP%]\kazaalite.lnk
[%DESKTOP%]\kazaa_setup.exe
[%DESKTOP%]\kazza.lnk
[%DESKTOP%]\kli.lnk
[%DESKTOP%]\kza.lnk
[%DESKTOP%]\my shared folder.lnk
[%DESKTOP%]\my shared folder.url
[%DESKTOP%]\play poker now!.lnk
[%DESKTOP%]\your free casino chips!.lnk
[%PROFILE%]\administrator\start menu\programs\altnet\peer points manager.lnk
[%PROFILE_TEMP%]\altnet\adm25.dll
[%PROFILE_TEMP%]\altnet\admdata.dll
[%PROFILE_TEMP%]\altnet\admdloader.dll
[%PROFILE_TEMP%]\altnet\admfdi.dll
[%PROFILE_TEMP%]\altnet\atl.dll
[%PROFILE_TEMP%]\altnet\msvcirt.dll
[%PROFILE_TEMP%]\altnet\setup.exe
[%PROFILE_TEMP%]\p2psetup.exe
[%PROGRAMS%]\kazaa media desktop\kazaa media desktop.lnk
[%PROGRAMS%]\kazaa.lnk
[%PROGRAMS%]\kazaaliyr.lnk
[%PROGRAMS%]\kza.lnk
[%SYSTEM%]\bifq5x5n.exe
[%SYSTEM%]\cd_clint.dll
[%SYSTEM%]\irqy.exe
[%SYSTEM%]\marshal.dll
[%SYSTEM%]\p2p networking v125.cpl
[%SYSTEM%]\p2pnetworking.exe
[%WINDOWS%]\cache371\b_371_0_1_586300.htm
[%WINDOWS%]\cache371\b_371_0_1_589300.htm
[%WINDOWS%]\cache371\b_371_0_1_589500.htm
[%WINDOWS%]\cache371\b_371_0_1_589600.htm
[%WINDOWS%]\cache371\b_371_0_1_591900.htm
[%WINDOWS%]\cache371\b_371_0_1_592000.htm
[%WINDOWS%]\cache371\b_371_0_1_592200.htm
[%WINDOWS%]\cache371\b_371_0_1_646000.htm
[%WINDOWS%]\cache371\b_371_0_1_648100.htm
[%WINDOWS%]\cache371\b_371_0_1_664000.htm
[%WINDOWS%]\cache371\b_371_0_1_668500.htm
[%WINDOWS%]\cache371\b_371_0_1_737400.htm
[%WINDOWS%]\cache371\b_371_0_1_775900.htm
[%WINDOWS%]\cache371\b_371_0_1_794100.htm
[%WINDOWS%]\cache371\b_371_2_1_536000.htm
[%WINDOWS%]\cache371\b_371_2_1_566600.htm
[%WINDOWS%]\cache371\b_371_2_1_567900.htm
[%WINDOWS%]\cache371\b_371_2_1_574200.htm
[%WINDOWS%]\cache371\b_371_2_1_576200.htm
[%WINDOWS%]\cache371\b_371_2_1_577800.htm
[%WINDOWS%]\cache371\b_371_2_1_593200.htm
[%WINDOWS%]\cache371\b_371_2_1_635400.htm
[%WINDOWS%]\cache371\b_371_2_1_649800.htm
[%WINDOWS%]\cache371\b_371_2_1_655600.htm
[%WINDOWS%]\cache371\b_371_2_1_662100.htm
[%WINDOWS%]\cache371\b_371_2_1_663900.htm
[%WINDOWS%]\cache371\b_371_2_1_667100.htm
[%WINDOWS%]\cache371\b_371_2_1_738900.htm
[%WINDOWS%]\cache371\b_371_2_1_739900.htm
[%WINDOWS%]\cache371\b_371_2_1_746100.htm
[%WINDOWS%]\cache371\b_371_2_1_755100.htm
[%WINDOWS%]\cache371\b_371_2_1_755600.htm
[%WINDOWS%]\cache371\b_371_2_1_756100.htm
[%WINDOWS%]\cache371\b_371_2_1_775400.htm
[%WINDOWS%]\cache371\b_371_2_1_777800.htm
[%WINDOWS%]\cache371\b_371_2_2_568100.htm
[%WINDOWS%]\cache371\b_371_2_2_570100.htm
[%WINDOWS%]\cache371\b_371_2_2_572300.htm
[%WINDOWS%]\cache371\b_371_2_2_573900.htm
[%WINDOWS%]\cache371\b_371_2_2_576000.htm
[%WINDOWS%]\cache371\b_371_2_2_649600.htm
[%WINDOWS%]\cache371\b_371_2_2_703900.htm
[%WINDOWS%]\cache371\b_371_2_2_712000.htm
[%WINDOWS%]\cache371\b_371_2_2_730800.htm
[%WINDOWS%]\cache371\b_371_2_2_731300.htm
[%WINDOWS%]\cache371\b_371_2_2_778600.htm
[%WINDOWS%]\cache371\b_371_2_3_519700.htm
[%WINDOWS%]\cache371\b_371_2_3_532200.htm
[%WINDOWS%]\cache371\b_371_2_3_558300.htm
[%WINDOWS%]\cache371\b_371_2_3_563900.htm
[%WINDOWS%]\cache371\b_371_2_3_588100.htm
[%WINDOWS%]\cache371\b_371_2_3_642300.htm
[%WINDOWS%]\cache371\b_371_2_3_670700.htm
[%WINDOWS%]\cache371\b_371_2_3_679500.htm
[%WINDOWS%]\cache371\b_371_2_3_778600.htm
[%WINDOWS%]\cache371\b_500600.htm
[%WINDOWS%]\cache371\b_501000.htm
[%WINDOWS%]\cache371\b_525900.htm
[%WINDOWS%]\cache371\b_604700.htm
[%WINDOWS%]\cache371\b_605600.htm
[%WINDOWS%]\cache371\b_605800.htm
[%WINDOWS%]\cache371\b_647400.htm
[%WINDOWS%]\cache371\b_647800.htm
[%WINDOWS%]\cache371\b_670300.htm
[%WINDOWS%]\cache371\b_727700.htm
[%WINDOWS%]\cache371\b_743700.htm
[%WINDOWS%]\cache371\b_753400.htm
[%WINDOWS%]\cache371\b_754300.htm
[%WINDOWS%]\cache371\b_775700.htm
[%WINDOWS%]\cache371\b_790700.htm
[%WINDOWS%]\cache371\t_b_371_0_1_591900.htm
[%WINDOWS%]\cache371\t_b_371_0_1_592000.htm
[%WINDOWS%]\cache371\t_b_371_0_1_592200.htm
[%WINDOWS%]\cache371\t_b_371_2_1_574200.htm
[%WINDOWS%]\cache371\t_b_371_2_1_576200.htm
[%WINDOWS%]\cache371\t_b_371_2_1_635400.htm
[%WINDOWS%]\cache371\t_b_371_2_1_662100.htm
[%WINDOWS%]\cache371\t_b_371_2_1_775400.htm
[%WINDOWS%]\cache371\t_b_371_2_2_712000.htm
[%WINDOWS%]\cache371\t_b_371_2_2_778600.htm
[%WINDOWS%]\cache371\t_b_371_2_3_558300.htm
[%WINDOWS%]\cache371\t_b_371_2_3_642300.htm
[%WINDOWS%]\cache371\t_b_500600.htm
[%WINDOWS%]\cache371\t_b_525900.htm
[%WINDOWS%]\cache371\t_b_604700.htm
[%WINDOWS%]\cache371\t_b_647400.htm
[%WINDOWS%]\cache371\t_b_647800.htm
[%WINDOWS%]\cache371\t_b_670300.htm
[%WINDOWS%]\cache371\t_b_727700.htm
[%WINDOWS%]\cache371\t_b_743700.htm
[%WINDOWS%]\cache371\t_b_753400.htm
[%WINDOWS%]\cache371\t_b_754300.htm
[%WINDOWS%]\cache371\t_b_775700.htm
[%WINDOWS%]\cache371\t_b_790700.htm
[%APPDATA%]\Microsoft\Internet Explorer\Quick Launch\Launch Kazaa.lnk
[%DESKTOP%]\kazaa media desktop.lnk
[%DESKTOP%]\kazaa promotions.url
[%DESKTOP%]\kazaa shop.lnk
[%DESKTOP%]\kazaa shop.url
[%DESKTOP%]\Kazaa.lnk
[%DESKTOP%]\kazaalite.lnk
[%DESKTOP%]\kazaa_setup.exe
[%DESKTOP%]\kazza.lnk
[%DESKTOP%]\kli.lnk
[%DESKTOP%]\kza.lnk
[%DESKTOP%]\my shared folder.lnk
[%DESKTOP%]\my shared folder.url
[%DESKTOP%]\play poker now!.lnk
[%DESKTOP%]\your free casino chips!.lnk
[%PROFILE%]\administrator\start menu\programs\altnet\peer points manager.lnk
[%PROFILE_TEMP%]\altnet\adm25.dll
[%PROFILE_TEMP%]\altnet\admdata.dll
[%PROFILE_TEMP%]\altnet\admdloader.dll
[%PROFILE_TEMP%]\altnet\admfdi.dll
[%PROFILE_TEMP%]\altnet\atl.dll
[%PROFILE_TEMP%]\altnet\msvcirt.dll
[%PROFILE_TEMP%]\altnet\setup.exe
[%PROFILE_TEMP%]\p2psetup.exe
[%PROGRAMS%]\kazaa media desktop\kazaa media desktop.lnk
[%PROGRAMS%]\kazaa.lnk
[%PROGRAMS%]\kazaaliyr.lnk
[%PROGRAMS%]\kza.lnk
[%SYSTEM%]\bifq5x5n.exe
[%SYSTEM%]\cd_clint.dll
[%SYSTEM%]\irqy.exe
[%SYSTEM%]\marshal.dll
[%SYSTEM%]\p2p networking v125.cpl
[%SYSTEM%]\p2pnetworking.exe
[%WINDOWS%]\cache371\b_371_0_1_586300.htm
[%WINDOWS%]\cache371\b_371_0_1_589300.htm
[%WINDOWS%]\cache371\b_371_0_1_589500.htm
[%WINDOWS%]\cache371\b_371_0_1_589600.htm
[%WINDOWS%]\cache371\b_371_0_1_591900.htm
[%WINDOWS%]\cache371\b_371_0_1_592000.htm
[%WINDOWS%]\cache371\b_371_0_1_592200.htm
[%WINDOWS%]\cache371\b_371_0_1_646000.htm
[%WINDOWS%]\cache371\b_371_0_1_648100.htm
[%WINDOWS%]\cache371\b_371_0_1_664000.htm
[%WINDOWS%]\cache371\b_371_0_1_668500.htm
[%WINDOWS%]\cache371\b_371_0_1_737400.htm
[%WINDOWS%]\cache371\b_371_0_1_775900.htm
[%WINDOWS%]\cache371\b_371_0_1_794100.htm
[%WINDOWS%]\cache371\b_371_2_1_536000.htm
[%WINDOWS%]\cache371\b_371_2_1_566600.htm
[%WINDOWS%]\cache371\b_371_2_1_567900.htm
[%WINDOWS%]\cache371\b_371_2_1_574200.htm
[%WINDOWS%]\cache371\b_371_2_1_576200.htm
[%WINDOWS%]\cache371\b_371_2_1_577800.htm
[%WINDOWS%]\cache371\b_371_2_1_593200.htm
[%WINDOWS%]\cache371\b_371_2_1_635400.htm
[%WINDOWS%]\cache371\b_371_2_1_649800.htm
[%WINDOWS%]\cache371\b_371_2_1_655600.htm
[%WINDOWS%]\cache371\b_371_2_1_662100.htm
[%WINDOWS%]\cache371\b_371_2_1_663900.htm
[%WINDOWS%]\cache371\b_371_2_1_667100.htm
[%WINDOWS%]\cache371\b_371_2_1_738900.htm
[%WINDOWS%]\cache371\b_371_2_1_739900.htm
[%WINDOWS%]\cache371\b_371_2_1_746100.htm
[%WINDOWS%]\cache371\b_371_2_1_755100.htm
[%WINDOWS%]\cache371\b_371_2_1_755600.htm
[%WINDOWS%]\cache371\b_371_2_1_756100.htm
[%WINDOWS%]\cache371\b_371_2_1_775400.htm
[%WINDOWS%]\cache371\b_371_2_1_777800.htm
[%WINDOWS%]\cache371\b_371_2_2_568100.htm
[%WINDOWS%]\cache371\b_371_2_2_570100.htm
[%WINDOWS%]\cache371\b_371_2_2_572300.htm
[%WINDOWS%]\cache371\b_371_2_2_573900.htm
[%WINDOWS%]\cache371\b_371_2_2_576000.htm
[%WINDOWS%]\cache371\b_371_2_2_649600.htm
[%WINDOWS%]\cache371\b_371_2_2_703900.htm
[%WINDOWS%]\cache371\b_371_2_2_712000.htm
[%WINDOWS%]\cache371\b_371_2_2_730800.htm
[%WINDOWS%]\cache371\b_371_2_2_731300.htm
[%WINDOWS%]\cache371\b_371_2_2_778600.htm
[%WINDOWS%]\cache371\b_371_2_3_519700.htm
[%WINDOWS%]\cache371\b_371_2_3_532200.htm
[%WINDOWS%]\cache371\b_371_2_3_558300.htm
[%WINDOWS%]\cache371\b_371_2_3_563900.htm
[%WINDOWS%]\cache371\b_371_2_3_588100.htm
[%WINDOWS%]\cache371\b_371_2_3_642300.htm
[%WINDOWS%]\cache371\b_371_2_3_670700.htm
[%WINDOWS%]\cache371\b_371_2_3_679500.htm
[%WINDOWS%]\cache371\b_371_2_3_778600.htm
[%WINDOWS%]\cache371\b_500600.htm
[%WINDOWS%]\cache371\b_501000.htm
[%WINDOWS%]\cache371\b_525900.htm
[%WINDOWS%]\cache371\b_604700.htm
[%WINDOWS%]\cache371\b_605600.htm
[%WINDOWS%]\cache371\b_605800.htm
[%WINDOWS%]\cache371\b_647400.htm
[%WINDOWS%]\cache371\b_647800.htm
[%WINDOWS%]\cache371\b_670300.htm
[%WINDOWS%]\cache371\b_727700.htm
[%WINDOWS%]\cache371\b_743700.htm
[%WINDOWS%]\cache371\b_753400.htm
[%WINDOWS%]\cache371\b_754300.htm
[%WINDOWS%]\cache371\b_775700.htm
[%WINDOWS%]\cache371\b_790700.htm
[%WINDOWS%]\cache371\t_b_371_0_1_591900.htm
[%WINDOWS%]\cache371\t_b_371_0_1_592000.htm
[%WINDOWS%]\cache371\t_b_371_0_1_592200.htm
[%WINDOWS%]\cache371\t_b_371_2_1_574200.htm
[%WINDOWS%]\cache371\t_b_371_2_1_576200.htm
[%WINDOWS%]\cache371\t_b_371_2_1_635400.htm
[%WINDOWS%]\cache371\t_b_371_2_1_662100.htm
[%WINDOWS%]\cache371\t_b_371_2_1_775400.htm
[%WINDOWS%]\cache371\t_b_371_2_2_712000.htm
[%WINDOWS%]\cache371\t_b_371_2_2_778600.htm
[%WINDOWS%]\cache371\t_b_371_2_3_558300.htm
[%WINDOWS%]\cache371\t_b_371_2_3_642300.htm
[%WINDOWS%]\cache371\t_b_500600.htm
[%WINDOWS%]\cache371\t_b_525900.htm
[%WINDOWS%]\cache371\t_b_604700.htm
[%WINDOWS%]\cache371\t_b_647400.htm
[%WINDOWS%]\cache371\t_b_647800.htm
[%WINDOWS%]\cache371\t_b_670300.htm
[%WINDOWS%]\cache371\t_b_727700.htm
[%WINDOWS%]\cache371\t_b_743700.htm
[%WINDOWS%]\cache371\t_b_753400.htm
[%WINDOWS%]\cache371\t_b_754300.htm
[%WINDOWS%]\cache371\t_b_775700.htm
[%WINDOWS%]\cache371\t_b_790700.htm

In order to ensure that the KaZaA is launched automatically each time the system is booted, the KaZaA adds a link to its executable file in the system registry:
HKLM\Microsoft\Windows\CurrentVersion\Run
[%DESKTOP%]\kazaa_setup.exe
[%PROFILE_TEMP%]\altnet\setup.exe
[%PROFILE_TEMP%]\p2psetup.exe
[%SYSTEM%]\bifq5x5n.exe
[%SYSTEM%]\irqy.exe
[%SYSTEM%]\p2pnetworking.exe

Platforms / OS: Windows 95, Windows 98, Windows 98 SE, Windows NT, Windows ME, Windows 2000, Windows XP, Windows 2003, Windows Vista

Detecting KaZaA:

Files:
[%APPDATA%]\Microsoft\Internet Explorer\Quick Launch\Launch Kazaa.lnk
[%DESKTOP%]\kazaa media desktop.lnk
[%DESKTOP%]\kazaa promotions.url
[%DESKTOP%]\kazaa shop.lnk
[%DESKTOP%]\kazaa shop.url
[%DESKTOP%]\Kazaa.lnk
[%DESKTOP%]\kazaalite.lnk
[%DESKTOP%]\kazaa_setup.exe
[%DESKTOP%]\kazza.lnk
[%DESKTOP%]\kli.lnk
[%DESKTOP%]\kza.lnk
[%DESKTOP%]\my shared folder.lnk
[%DESKTOP%]\my shared folder.url
[%DESKTOP%]\play poker now!.lnk
[%DESKTOP%]\your free casino chips!.lnk
[%PROFILE%]\administrator\start menu\programs\altnet\peer points manager.lnk
[%PROFILE_TEMP%]\altnet\adm25.dll
[%PROFILE_TEMP%]\altnet\admdata.dll
[%PROFILE_TEMP%]\altnet\admdloader.dll
[%PROFILE_TEMP%]\altnet\admfdi.dll
[%PROFILE_TEMP%]\altnet\atl.dll
[%PROFILE_TEMP%]\altnet\msvcirt.dll
[%PROFILE_TEMP%]\altnet\setup.exe
[%PROFILE_TEMP%]\p2psetup.exe
[%PROGRAMS%]\kazaa media desktop\kazaa media desktop.lnk
[%PROGRAMS%]\kazaa.lnk
[%PROGRAMS%]\kazaaliyr.lnk
[%PROGRAMS%]\kza.lnk
[%SYSTEM%]\bifq5x5n.exe
[%SYSTEM%]\cd_clint.dll
[%SYSTEM%]\irqy.exe
[%SYSTEM%]\marshal.dll
[%SYSTEM%]\p2p networking v125.cpl
[%SYSTEM%]\p2pnetworking.exe
[%WINDOWS%]\cache371\b_371_0_1_586300.htm
[%WINDOWS%]\cache371\b_371_0_1_589300.htm
[%WINDOWS%]\cache371\b_371_0_1_589500.htm
[%WINDOWS%]\cache371\b_371_0_1_589600.htm
[%WINDOWS%]\cache371\b_371_0_1_591900.htm
[%WINDOWS%]\cache371\b_371_0_1_592000.htm
[%WINDOWS%]\cache371\b_371_0_1_592200.htm
[%WINDOWS%]\cache371\b_371_0_1_646000.htm
[%WINDOWS%]\cache371\b_371_0_1_648100.htm
[%WINDOWS%]\cache371\b_371_0_1_664000.htm
[%WINDOWS%]\cache371\b_371_0_1_668500.htm
[%WINDOWS%]\cache371\b_371_0_1_737400.htm
[%WINDOWS%]\cache371\b_371_0_1_775900.htm
[%WINDOWS%]\cache371\b_371_0_1_794100.htm
[%WINDOWS%]\cache371\b_371_2_1_536000.htm
[%WINDOWS%]\cache371\b_371_2_1_566600.htm
[%WINDOWS%]\cache371\b_371_2_1_567900.htm
[%WINDOWS%]\cache371\b_371_2_1_574200.htm
[%WINDOWS%]\cache371\b_371_2_1_576200.htm
[%WINDOWS%]\cache371\b_371_2_1_577800.htm
[%WINDOWS%]\cache371\b_371_2_1_593200.htm
[%WINDOWS%]\cache371\b_371_2_1_635400.htm
[%WINDOWS%]\cache371\b_371_2_1_649800.htm
[%WINDOWS%]\cache371\b_371_2_1_655600.htm
[%WINDOWS%]\cache371\b_371_2_1_662100.htm
[%WINDOWS%]\cache371\b_371_2_1_663900.htm
[%WINDOWS%]\cache371\b_371_2_1_667100.htm
[%WINDOWS%]\cache371\b_371_2_1_738900.htm
[%WINDOWS%]\cache371\b_371_2_1_739900.htm
[%WINDOWS%]\cache371\b_371_2_1_746100.htm
[%WINDOWS%]\cache371\b_371_2_1_755100.htm
[%WINDOWS%]\cache371\b_371_2_1_755600.htm
[%WINDOWS%]\cache371\b_371_2_1_756100.htm
[%WINDOWS%]\cache371\b_371_2_1_775400.htm
[%WINDOWS%]\cache371\b_371_2_1_777800.htm
[%WINDOWS%]\cache371\b_371_2_2_568100.htm
[%WINDOWS%]\cache371\b_371_2_2_570100.htm
[%WINDOWS%]\cache371\b_371_2_2_572300.htm
[%WINDOWS%]\cache371\b_371_2_2_573900.htm
[%WINDOWS%]\cache371\b_371_2_2_576000.htm
[%WINDOWS%]\cache371\b_371_2_2_649600.htm
[%WINDOWS%]\cache371\b_371_2_2_703900.htm
[%WINDOWS%]\cache371\b_371_2_2_712000.htm
[%WINDOWS%]\cache371\b_371_2_2_730800.htm
[%WINDOWS%]\cache371\b_371_2_2_731300.htm
[%WINDOWS%]\cache371\b_371_2_2_778600.htm
[%WINDOWS%]\cache371\b_371_2_3_519700.htm
[%WINDOWS%]\cache371\b_371_2_3_532200.htm
[%WINDOWS%]\cache371\b_371_2_3_558300.htm
[%WINDOWS%]\cache371\b_371_2_3_563900.htm
[%WINDOWS%]\cache371\b_371_2_3_588100.htm
[%WINDOWS%]\cache371\b_371_2_3_642300.htm
[%WINDOWS%]\cache371\b_371_2_3_670700.htm
[%WINDOWS%]\cache371\b_371_2_3_679500.htm
[%WINDOWS%]\cache371\b_371_2_3_778600.htm
[%WINDOWS%]\cache371\b_500600.htm
[%WINDOWS%]\cache371\b_501000.htm
[%WINDOWS%]\cache371\b_525900.htm
[%WINDOWS%]\cache371\b_604700.htm
[%WINDOWS%]\cache371\b_605600.htm
[%WINDOWS%]\cache371\b_605800.htm
[%WINDOWS%]\cache371\b_647400.htm
[%WINDOWS%]\cache371\b_647800.htm
[%WINDOWS%]\cache371\b_670300.htm
[%WINDOWS%]\cache371\b_727700.htm
[%WINDOWS%]\cache371\b_743700.htm
[%WINDOWS%]\cache371\b_753400.htm
[%WINDOWS%]\cache371\b_754300.htm
[%WINDOWS%]\cache371\b_775700.htm
[%WINDOWS%]\cache371\b_790700.htm
[%WINDOWS%]\cache371\t_b_371_0_1_591900.htm
[%WINDOWS%]\cache371\t_b_371_0_1_592000.htm
[%WINDOWS%]\cache371\t_b_371_0_1_592200.htm
[%WINDOWS%]\cache371\t_b_371_2_1_574200.htm
[%WINDOWS%]\cache371\t_b_371_2_1_576200.htm
[%WINDOWS%]\cache371\t_b_371_2_1_635400.htm
[%WINDOWS%]\cache371\t_b_371_2_1_662100.htm
[%WINDOWS%]\cache371\t_b_371_2_1_775400.htm
[%WINDOWS%]\cache371\t_b_371_2_2_712000.htm
[%WINDOWS%]\cache371\t_b_371_2_2_778600.htm
[%WINDOWS%]\cache371\t_b_371_2_3_558300.htm
[%WINDOWS%]\cache371\t_b_371_2_3_642300.htm
[%WINDOWS%]\cache371\t_b_500600.htm
[%WINDOWS%]\cache371\t_b_525900.htm
[%WINDOWS%]\cache371\t_b_604700.htm
[%WINDOWS%]\cache371\t_b_647400.htm
[%WINDOWS%]\cache371\t_b_647800.htm
[%WINDOWS%]\cache371\t_b_670300.htm
[%WINDOWS%]\cache371\t_b_727700.htm
[%WINDOWS%]\cache371\t_b_743700.htm
[%WINDOWS%]\cache371\t_b_753400.htm
[%WINDOWS%]\cache371\t_b_754300.htm
[%WINDOWS%]\cache371\t_b_775700.htm
[%WINDOWS%]\cache371\t_b_790700.htm
[%APPDATA%]\Microsoft\Internet Explorer\Quick Launch\Launch Kazaa.lnk
[%DESKTOP%]\kazaa media desktop.lnk
[%DESKTOP%]\kazaa promotions.url
[%DESKTOP%]\kazaa shop.lnk
[%DESKTOP%]\kazaa shop.url
[%DESKTOP%]\Kazaa.lnk
[%DESKTOP%]\kazaalite.lnk
[%DESKTOP%]\kazaa_setup.exe
[%DESKTOP%]\kazza.lnk
[%DESKTOP%]\kli.lnk
[%DESKTOP%]\kza.lnk
[%DESKTOP%]\my shared folder.lnk
[%DESKTOP%]\my shared folder.url
[%DESKTOP%]\play poker now!.lnk
[%DESKTOP%]\your free casino chips!.lnk
[%PROFILE%]\administrator\start menu\programs\altnet\peer points manager.lnk
[%PROFILE_TEMP%]\altnet\adm25.dll
[%PROFILE_TEMP%]\altnet\admdata.dll
[%PROFILE_TEMP%]\altnet\admdloader.dll
[%PROFILE_TEMP%]\altnet\admfdi.dll
[%PROFILE_TEMP%]\altnet\atl.dll
[%PROFILE_TEMP%]\altnet\msvcirt.dll
[%PROFILE_TEMP%]\altnet\setup.exe
[%PROFILE_TEMP%]\p2psetup.exe
[%PROGRAMS%]\kazaa media desktop\kazaa media desktop.lnk
[%PROGRAMS%]\kazaa.lnk
[%PROGRAMS%]\kazaaliyr.lnk
[%PROGRAMS%]\kza.lnk
[%SYSTEM%]\bifq5x5n.exe
[%SYSTEM%]\cd_clint.dll
[%SYSTEM%]\irqy.exe
[%SYSTEM%]\marshal.dll
[%SYSTEM%]\p2p networking v125.cpl
[%SYSTEM%]\p2pnetworking.exe
[%WINDOWS%]\cache371\b_371_0_1_586300.htm
[%WINDOWS%]\cache371\b_371_0_1_589300.htm
[%WINDOWS%]\cache371\b_371_0_1_589500.htm
[%WINDOWS%]\cache371\b_371_0_1_589600.htm
[%WINDOWS%]\cache371\b_371_0_1_591900.htm
[%WINDOWS%]\cache371\b_371_0_1_592000.htm
[%WINDOWS%]\cache371\b_371_0_1_592200.htm
[%WINDOWS%]\cache371\b_371_0_1_646000.htm
[%WINDOWS%]\cache371\b_371_0_1_648100.htm
[%WINDOWS%]\cache371\b_371_0_1_664000.htm
[%WINDOWS%]\cache371\b_371_0_1_668500.htm
[%WINDOWS%]\cache371\b_371_0_1_737400.htm
[%WINDOWS%]\cache371\b_371_0_1_775900.htm
[%WINDOWS%]\cache371\b_371_0_1_794100.htm
[%WINDOWS%]\cache371\b_371_2_1_536000.htm
[%WINDOWS%]\cache371\b_371_2_1_566600.htm
[%WINDOWS%]\cache371\b_371_2_1_567900.htm
[%WINDOWS%]\cache371\b_371_2_1_574200.htm
[%WINDOWS%]\cache371\b_371_2_1_576200.htm
[%WINDOWS%]\cache371\b_371_2_1_577800.htm
[%WINDOWS%]\cache371\b_371_2_1_593200.htm
[%WINDOWS%]\cache371\b_371_2_1_635400.htm
[%WINDOWS%]\cache371\b_371_2_1_649800.htm
[%WINDOWS%]\cache371\b_371_2_1_655600.htm
[%WINDOWS%]\cache371\b_371_2_1_662100.htm
[%WINDOWS%]\cache371\b_371_2_1_663900.htm
[%WINDOWS%]\cache371\b_371_2_1_667100.htm
[%WINDOWS%]\cache371\b_371_2_1_738900.htm
[%WINDOWS%]\cache371\b_371_2_1_739900.htm
[%WINDOWS%]\cache371\b_371_2_1_746100.htm
[%WINDOWS%]\cache371\b_371_2_1_755100.htm
[%WINDOWS%]\cache371\b_371_2_1_755600.htm
[%WINDOWS%]\cache371\b_371_2_1_756100.htm
[%WINDOWS%]\cache371\b_371_2_1_775400.htm
[%WINDOWS%]\cache371\b_371_2_1_777800.htm
[%WINDOWS%]\cache371\b_371_2_2_568100.htm
[%WINDOWS%]\cache371\b_371_2_2_570100.htm
[%WINDOWS%]\cache371\b_371_2_2_572300.htm
[%WINDOWS%]\cache371\b_371_2_2_573900.htm
[%WINDOWS%]\cache371\b_371_2_2_576000.htm
[%WINDOWS%]\cache371\b_371_2_2_649600.htm
[%WINDOWS%]\cache371\b_371_2_2_703900.htm
[%WINDOWS%]\cache371\b_371_2_2_712000.htm
[%WINDOWS%]\cache371\b_371_2_2_730800.htm
[%WINDOWS%]\cache371\b_371_2_2_731300.htm
[%WINDOWS%]\cache371\b_371_2_2_778600.htm
[%WINDOWS%]\cache371\b_371_2_3_519700.htm
[%WINDOWS%]\cache371\b_371_2_3_532200.htm
[%WINDOWS%]\cache371\b_371_2_3_558300.htm
[%WINDOWS%]\cache371\b_371_2_3_563900.htm
[%WINDOWS%]\cache371\b_371_2_3_588100.htm
[%WINDOWS%]\cache371\b_371_2_3_642300.htm
[%WINDOWS%]\cache371\b_371_2_3_670700.htm
[%WINDOWS%]\cache371\b_371_2_3_679500.htm
[%WINDOWS%]\cache371\b_371_2_3_778600.htm
[%WINDOWS%]\cache371\b_500600.htm
[%WINDOWS%]\cache371\b_501000.htm
[%WINDOWS%]\cache371\b_525900.htm
[%WINDOWS%]\cache371\b_604700.htm
[%WINDOWS%]\cache371\b_605600.htm
[%WINDOWS%]\cache371\b_605800.htm
[%WINDOWS%]\cache371\b_647400.htm
[%WINDOWS%]\cache371\b_647800.htm
[%WINDOWS%]\cache371\b_670300.htm
[%WINDOWS%]\cache371\b_727700.htm
[%WINDOWS%]\cache371\b_743700.htm
[%WINDOWS%]\cache371\b_753400.htm
[%WINDOWS%]\cache371\b_754300.htm
[%WINDOWS%]\cache371\b_775700.htm
[%WINDOWS%]\cache371\b_790700.htm
[%WINDOWS%]\cache371\t_b_371_0_1_591900.htm
[%WINDOWS%]\cache371\t_b_371_0_1_592000.htm
[%WINDOWS%]\cache371\t_b_371_0_1_592200.htm
[%WINDOWS%]\cache371\t_b_371_2_1_574200.htm
[%WINDOWS%]\cache371\t_b_371_2_1_576200.htm
[%WINDOWS%]\cache371\t_b_371_2_1_635400.htm
[%WINDOWS%]\cache371\t_b_371_2_1_662100.htm
[%WINDOWS%]\cache371\t_b_371_2_1_775400.htm
[%WINDOWS%]\cache371\t_b_371_2_2_712000.htm
[%WINDOWS%]\cache371\t_b_371_2_2_778600.htm
[%WINDOWS%]\cache371\t_b_371_2_3_558300.htm
[%WINDOWS%]\cache371\t_b_371_2_3_642300.htm
[%WINDOWS%]\cache371\t_b_500600.htm
[%WINDOWS%]\cache371\t_b_525900.htm
[%WINDOWS%]\cache371\t_b_604700.htm
[%WINDOWS%]\cache371\t_b_647400.htm
[%WINDOWS%]\cache371\t_b_647800.htm
[%WINDOWS%]\cache371\t_b_670300.htm
[%WINDOWS%]\cache371\t_b_727700.htm
[%WINDOWS%]\cache371\t_b_743700.htm
[%WINDOWS%]\cache371\t_b_753400.htm
[%WINDOWS%]\cache371\t_b_754300.htm
[%WINDOWS%]\cache371\t_b_775700.htm
[%WINDOWS%]\cache371\t_b_790700.htm

Folders:
[%PROFILE%]\start menu\programs\kazaa media desktop
[%PROFILE_TEMP%]\admcache
[%PROGRAMS%]\kazaa
[%PROGRAM_FILES%]\kazaa
[%WINDOWS%]\browserxtras\pn
[%WINDOWS%]\cache329

Registry Keys:
HKEY_CLASSES_ROOT\clsid\{66fc8717-efa7-4546-8c4a-e224f3a80c76}
HKEY_CLASSES_ROOT\clsid\{726c99d0-50c5-404f-9efd-7b2834dfed50}
HKEY_CLASSES_ROOT\clsid\{f78b32d6-d6d8-4137-a18f-91ebe1a4aedb}
HKEY_CURRENT_USER\software\kazaa
HKEY_CURRENT_USER\software\kazaa tmp 0
HKEY_LOCAL_MACHINE\software\classes\adm.adm
HKEY_LOCAL_MACHINE\software\classes\adm.adm.1
HKEY_LOCAL_MACHINE\software\classes\adm25.adm25
HKEY_LOCAL_MACHINE\software\classes\adm25.adm25.1
HKEY_LOCAL_MACHINE\software\classes\adm4.adm4
HKEY_LOCAL_MACHINE\software\classes\adm4.adm4.1
HKEY_LOCAL_MACHINE\software\classes\appid\{8b0fef15-54dc-49f5-8377-8172de975f75}
HKEY_LOCAL_MACHINE\software\classes\appid\{99a8e2b2-3405-4c0d-9110-131c14caaf62}
HKEY_LOCAL_MACHINE\software\classes\clsid\{66fc8717-efa7-4546-8c4a-e224f3a80c76}
HKEY_LOCAL_MACHINE\software\classes\clsid\{c91e8926-d4be-4685-99f4-0d996b96bac0}
HKEY_LOCAL_MACHINE\software\classes\jcde_stack
HKEY_LOCAL_MACHINE\software\classes\jcde_stack.1
HKEY_LOCAL_MACHINE\software\classes\signingmodule.signingmodule
HKEY_LOCAL_MACHINE\software\classes\signingmodule.signingmodule.1
HKEY_LOCAL_MACHINE\software\classes\webp2pinstaller.installer
HKEY_LOCAL_MACHINE\software\classes\webp2pinstaller.installer.1
HKEY_LOCAL_MACHINE\software\kazaa
HKEY_LOCAL_MACHINE\software\lcaleb
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app management\arpcache\kazaa
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app management\arpcache\kza
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app management\arpcache\p2p networking
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\kazaa
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\kli
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\kza
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{01083175-01cc-42aa-9090-81dd0f88f28f}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{38c76428-6c9c-4cc6-b747-3ab6a4770225}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{726c99d0-50c5-404f-9efd-7b2834dfed50}
HKEY_LOCAL_MACHINE\software\sharman networks ltd

Registry Values:
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{548d52a1-5620-4c11-8fa7-b95404fd9fcd}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{548d52a1-5620-4c11-8fa7-b95404fd9fcd}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{548d52a1-5620-4c11-8fa7-b95404fd9fcd}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{548d52a1-5620-4c11-8fa7-b95404fd9fcd}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{548d52a1-5620-4c11-8fa7-b95404fd9fcd}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{548d52a1-5620-4c11-8fa7-b95404fd9fcd}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{548d52a1-5620-4c11-8fa7-b95404fd9fcd}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{548d52a1-5620-4c11-8fa7-b95404fd9fcd}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{548d52a1-5620-4c11-8fa7-b95404fd9fcd}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{548d52a1-5620-4c11-8fa7-b95404fd9fcd}

Removing KaZaA:

An up-to-date copy of ExterminateIt should detect and prevent infection from KaZaA.

If you do not have ExterminateIt and you are worried that you may have infected computer, you could run trial version of ExterminateIt, or remove KaZaA manually.

To completely manually remove KaZaA malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with KaZaA.

  1. Use Task Manager to terminate the KaZaA process.
  2. Delete the original KaZaA file and folders.
  3. Delete the system registry key parameters
  4. Update your antivirus databases or buy antivirus software and perform a full scan of the computer.

We recommends that all Internet users back up any important information on their computers, enable maximum protection from network attacks and malicious code on their computers, refrain from executing suspicious programs received from untrustworthy sources.

ExterminateIt effectively and automatically removes KaZaA from you computer and is a good solution for those who are seeking easy and effective protection for their computer from Trojan Horses, Rootkits, Backdoors, spyware, botnets, keystroke loggers, dialers and other malicious software(malware).

Download ExterminateIt! to instantly get rid of KaZaA!

Also Be Aware of the Following Threats:
Watchful.Eye Spyware Information
Removing dynamics.de Tracking Cookie

Posted by at

No comments:

Post a Comment

Subscribe to: Post Comments (Atom)