How to Remove Trojan.winreg.LowZones.f

The following is a detail page of Virtual Grub Street's Adware & Malware Indentifier Index:

The information in the Adware & Malware Indentifier Index is the result of thousands of web searches. It can not, however, possibly be complete. The subject is vast and constantly changing. Moreover, vendor uninstall tools and other removal tools do not necessarily remove all of an infection from your computer. Vendor uninstall tools, for instance, may silently leave cookies or other tracking software installed. It is suggestible to follow up a removal with one or more adware scans and/or to do an inspection using a HijackThis log. The information on the page is not guaranteed correct and any use you may choose to make of it is entirely at your own risk.


Trojan.LowZones.f

• Associated Worms/Trojans: Trojan.WinREG.LowZones.f is a.k.a. Downloader-QG; QLowZones-26; Trojan.WinREG.LowZones.f; Troj/LowZone-AL .
• Executable Files: Temporary Internet Files\Content.IE5\[Random Alpha-Numeric]\lg[1].exekansup.reg; Temporary Internet Files\Content.IE5\[Random Alpha-Numeric]\lg[1].exe/kans.reg; [Random Alpha-Numeric].exe/kansup.reg; \[Random Alpha-Numeric].exe/kans.reg; temp\kansup.reg.
• Dynamic Link Libraries: N/A.
• Directory/Search Page: N/A.
• Uninstall page URL: N/A.
• Related Articles: Fighting Malware with Standard Windows Tools (February 25, 2007). You may have more in your bag of tricks than you realize. Important Removal Tool Note.
• Notes: This trojan has also been used to download registry permissions and files for ISearchTech adware and Mirar Toolbar.
• This infection can be removed by using Ewido Security Suite trialware.

VGS encourages you to post comments about the service it offers, and, in particular, about your experiences with the removal tools suggested in its pages. Removal tool comments will be most effective in helping those who come after you if you post them to the individual detail page for the malware item you used the tool to remove. Please be as clear and as detailed as possible. The most effective comments might include such information as: 1) What browser and operating system you are are running on your computer (i.e. Windows 98, NT, XP, Linux, Internet Explorer 6.0, Firefox); 2) What updates are installed (i.e. SP1, SP2); 3) What anti-virus/malware package(s) are resident in your computer

A Word to the Wise.

I've been the target of a number of direct attacks against my computer over the last several months. I'm providing the relevant Norton logs below, including the "remote address" (the IP of the attacker). My own IP is x'd out for obvious reasons.


8/6/2006 @ 6:13:42 PM: Rule "Default Block NetBus Trojan horse" blocked (207.12.157.2, NetBus(12345)).
Inbound TCP connection.
Local address, service is (XXX.XXX.XX.XX), NetBus(12345).
Remote address, service is (207.12.157.2, 3018).
Process name is "N/A".

See: Wikipedia page User talk:207.12.157.2; DNS Stuff/WhoIs page.


8/4/2006 @ 9:42:57 PM: Rule "Default Block Backdoor/SubSeven Trojan horse" blocked (209.159.206.135, 27374).
Inbound TCP connection.
Local address, service is (XXX.XXX.XX.XX, 27374).
Remote address, service is (209.159.206.135, 2783).
Process name is "N/A".


7/11/2006 @ 8:07:05 PM: Rule "Default Block Senna Spy Trojan horse" blocked (206.165.215.13, 13000).
Inbound TCP connection.
Local address, service is (XXX.XXX.XX.XX, 13000).
Remote address, service is (206.165.215.13, 13000).
Process name is "N/A".


5/10/2006 @ 10:53:19 PM: Rule "Default Block NetBus Trojan horse" blocked (209.214.148.159, NetBus(12345)).
Inbound TCP connection.
Local address, service is (XXX.XXX.XX.X, NetBus(12345)).
Remote address, service is (209.214.148.159, 1123).
Process name is "N/A".


Although not many Wiki Watchdog pages are getting indexed by the search engines these days, I hope that the IPs will be of help to you should you Google one or more of them in relation to an attack on your own computer.



Related posts:

• * Since I Began Wiki Watchdog (5/15/06);
• * "All we are saying is give jackbooted fascism a chance.";
• * '...the "democratic" people's MAFIA...';
• * "...normal person, plus anonymity, plus large audience, equals flaming f**kwad.";
• * Is Wikipedia Handing Out Your Browsing Information to Thousands?

How to Remove ISearchTech.SideFind

The following is a detail page of Virtual Grub Street's Adware & Malware Indentifier Index:

The information in the Adware & Malware Indentifier Index is the result of thousands of web searches. It can not, however, possibly be complete. The subject is vast and constantly changing. Moreover, vendor uninstall tools and other removal tools do not necessarily remove all of an infection from your computer. Vendor uninstall tools, for instance, may silently leave cookies or other tracking software installed. It is suggestible to follow up a removal with one or more adware scans and/or to do an inspection using a HijackThis log. The information on the page is not guaranteed correct and any use you may choose to make of it is entirely at your own risk.


ISearchTech.SideFind

• Associated Worms/Trojans: Downloader.Dyfica.3.L; Troj/LowZone-AL [a.k.a. Downloader-QG; QLowZones-26; Trojan.WinREG.LowZones.f ]; Troj/SideFind-A; TR/Spy.Shutcom; TrojanDownloader:Win32/IstBar.EO; W32/Istbar.O@dl.
• Executable Files: sfexd001.exe; sidefind.exe; sidefind[1].exe; istrecover[1].exe; sskc.exe; ISTsvc.exe.
• Dynamic Link Libraries: sfbho.dll; sidefind.dll.
• Directory/Search Page: http://www.sidefind.com/ist/softwares/sidefind/; http://www.sidefind.com/ist/softwares/sidefind/v1.3/.
• Uninstall page URL: ISearchTech claims that it provides a removal tool for "IST toolbar" (A generic designation for all ISearchTech toolbars? Just a YSB family?) at this location: http://www.ysbweb.com/uninstall.html. It provides two tools each of which requires you to install new software the nature of which is not described.
• Related Articles: Fighting Malware with Standard Windows Tools (February 25, 2007). You may have more in your bag of tricks than you realize. How to Remove the ISearchTech Family; ISearchTech.SideFind Update (08-27-05); How to Remove YourSiteBar; How to Remove Trojan.winreg.LowZones.f; Important Removal Tool Note.
• Notes: Click this link for instructions on >>> How to remove generic / stand-alone versions of Trojan.winREG.LowZones.f.
• Variations on this infection are also known as Troj/SideFind-A [Sophos], ADW_SideFind-A [B, C][TrendMicro] and ADW_sideFind-C [TrendMicro]. This group of trojan downloaded side bars may be identified by the following value being detected in the HKEY_USERS section of the registry: {8CBA1B49-8144-4721-A7B1-64C578C9EED7}.
• According to Sophos, Troj/SideFind-A versions of this infection 'can be uninstalled via the Add or Remove Programs dialog in the Windows Control Panel (Start -> Settings -> Control Panel -> Add/Remove Programs) by selecting "SideFind".' According to the YourSiteBar uninstall page, all versions of this software (i.e. SideFind) can be removed from the standard Windows Add/Remove Programs utility.
• Most versions of this infection can now be removed by using Spybot S&D.

Also See:

• Man-Boy Love Advocate Accused of Using Wikipedia to Troll for Interested Parties (March 4, 2007). Rookie Revolyob, Clayboy, Zanthalon, et al: Why is Wikpedia a Pedophile Haven?