Pcclient Trojan

Pcclient malware description and removal detail
Categories:Trojan,Backdoor
Also known as:

[Kaspersky]Trojan.Win32.Pakes,Backdoor.Win32.PcClient.gg,Backdoor.Win32.Pcclient.ty,Backdoor.Win32.PCClient.vr,Backdoor.Win32.Pcclient.ii,Backdoor.Win32.PcClient.fc,Backdoor.Win32.PcClient.wi,Backdoor.Win32.PcClient.aai;
[Eset]Win32/PcClient.B trojan;
[McAfee]BackDoor-CKB,Backdoor-CKB.gen;
[Computer Associates]Win32.Pcclient.B,Win32/PcClient.Trojan;
[Other]Win32/Pcclient.BA,Win32/PcClient.GG!Trojan,Backdoor.Formador,Troj/Bckdr-HRX,Win32/Pcclient.BD,win32/Pcclient.BC,Win32/Pcclient!generic,Win32/Pcclient.BJ,Backdoor.Pcclient.B,Win32/Pcclient.BH,Win32/Pcclient.BO,Win32.Pcclient.CD
Visible Symptoms:
Files in system folders:
[%RECYCLER%]\autorun.exe
[%SYSTEM%]\autorun3.exe
[%SYSTEM%]\KOfcpfwSvcs.exe
[%SYSTEM%]\OfcpfwSvcs.exe
[%DESKTOP%]\My Lockbox.lnk
[%PROGRAM_FILES%]\xerox\folderlockbox.exe
[%SYSTEM%]\drivers\mprifl.sys
[%SYSTEM%]\drivers\Yrfzvmec.sys
[%SYSTEM%]\Xubkmwau.d1l
[%SYSTEM%]\Xubkmwau.sys
[%SYSTEM%]\Yrfzvmec.d1l
[%RECYCLER%]\autorun.exe
[%SYSTEM%]\autorun3.exe
[%SYSTEM%]\KOfcpfwSvcs.exe
[%SYSTEM%]\OfcpfwSvcs.exe
[%DESKTOP%]\My Lockbox.lnk
[%PROGRAM_FILES%]\xerox\folderlockbox.exe
[%SYSTEM%]\drivers\mprifl.sys
[%SYSTEM%]\drivers\Yrfzvmec.sys
[%SYSTEM%]\Xubkmwau.d1l
[%SYSTEM%]\Xubkmwau.sys
[%SYSTEM%]\Yrfzvmec.d1l

In order to ensure that the Pcclient is launched automatically each time the system is booted, the Pcclient adds a link to its executable file in the system registry:
HKLM\Microsoft\Windows\CurrentVersion\Run
[%RECYCLER%]\autorun.exe
[%SYSTEM%]\autorun3.exe
[%SYSTEM%]\KOfcpfwSvcs.exe
[%SYSTEM%]\OfcpfwSvcs.exe
[%PROGRAM_FILES%]\xerox\folderlockbox.exe

Platforms / OS: Windows 95, Windows 98, Windows 98 SE, Windows NT, Windows ME, Windows 2000, Windows XP, Windows 2003, Windows Vista

Detecting Pcclient:

Files:
[%RECYCLER%]\autorun.exe
[%SYSTEM%]\autorun3.exe
[%SYSTEM%]\KOfcpfwSvcs.exe
[%SYSTEM%]\OfcpfwSvcs.exe
[%DESKTOP%]\My Lockbox.lnk
[%PROGRAM_FILES%]\xerox\folderlockbox.exe
[%SYSTEM%]\drivers\mprifl.sys
[%SYSTEM%]\drivers\Yrfzvmec.sys
[%SYSTEM%]\Xubkmwau.d1l
[%SYSTEM%]\Xubkmwau.sys
[%SYSTEM%]\Yrfzvmec.d1l
[%RECYCLER%]\autorun.exe
[%SYSTEM%]\autorun3.exe
[%SYSTEM%]\KOfcpfwSvcs.exe
[%SYSTEM%]\OfcpfwSvcs.exe
[%DESKTOP%]\My Lockbox.lnk
[%PROGRAM_FILES%]\xerox\folderlockbox.exe
[%SYSTEM%]\drivers\mprifl.sys
[%SYSTEM%]\drivers\Yrfzvmec.sys
[%SYSTEM%]\Xubkmwau.d1l
[%SYSTEM%]\Xubkmwau.sys
[%SYSTEM%]\Yrfzvmec.d1l

Folders:
[%PROGRAMS%]\Folder Lockbox
[%PROGRAMS%]\My Lockbox
[%PROGRAM_FILES%]\Folder Lockbox
[%PROGRAM_FILES%]\My Lockbox

Registry Keys:
HKEY_CLASSES_ROOT\clsid\{1627e1fe-69fa-4943-9d87-2a40de9075bf}
HKEY_CLASSES_ROOT\flockbox.dochostuihandler
HKEY_CURRENT_USER\software\fspro labs\folder lockbox
HKEY_LOCAL_MACHINE\software\fspro labs\folder lockbox
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\folder lockbox_is1
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\my lockbox_is1
HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\legacy_mprifl
HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\legacy_yrfzvmec
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\mprifl
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\xubkmwau
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\yrfzvmec

Registry Values:
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run

Removing Pcclient:

An up-to-date copy of ExterminateIt should detect and prevent infection from Pcclient.

If you do not have ExterminateIt and you are worried that you may have infected computer, you could run trial version of ExterminateIt, or remove Pcclient manually.

To completely manually remove Pcclient malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Pcclient.

  1. Use Task Manager to terminate the Pcclient process.
  2. Delete the original Pcclient file and folders.
  3. Delete the system registry key parameters
  4. Update your antivirus databases or buy antivirus software and perform a full scan of the computer.

We recommends that all Internet users back up any important information on their computers, enable maximum protection from network attacks and malicious code on their computers, refrain from executing suspicious programs received from untrustworthy sources.

ExterminateIt effectively and automatically removes Pcclient from you computer and is a good solution for those who are seeking easy and effective protection for their computer from Trojan Horses, Rootkits, Backdoors, spyware, botnets, keystroke loggers, dialers and other malicious software(malware).

Download ExterminateIt! to instantly get rid of Pcclient!

Also Be Aware of the Following Threats:
Removing Avispa Trojan
Removing Bancos.HCH Trojan
Napster[v0.v1.4].remote.crash DoS Information
Remove Little.Brother Trojan
Aresdor Backdoor Information

0 comments:

Post a Comment

Subscribe to: Post Comments (Atom)

Blog Archive