eibmw7.exe, wuaucldt.exe

Last Updated on Wednesday, 08 August 2012 18:38 Saturday, 15 May 2010 09:15

Files by the names eibmw7.exe, r3dijq62.exe, wuaucldt.exe, Dmar Messenger Pass.exe, vrt2.tmp are created by a computer virus program that affects the computers running on the Microsoft windows operating systems. It's analysis report is given below

Files found - view
%AppData%\addon.dat
%My Documents%\Dmar Messenger Pass.exe
%UserProfile%\wuaucldt.exe
C:\Windows\System32\wuaucldt.exe
C:\Windows\Temp\7.tmp
C:\Windows\Temp\E.tmp
C:\Windows\Temp\eibmw7.exe
C:\Windows\Temp\F.tmp
C:\Windows\Temp\g36pp0.log
C:\Windows\Temp\r3dijq62.exe
C:\Windows\Temp\VRT2.tmp

It modifies a lot of windows program files

It stops windows services -
"Application Layer Gateway Service",
"Windows Firewall/Internet Connection Sharing (ICS)",
"Security Center".

Symantec has a free removal tool for this virus. You can download it from this link.

There may be more files created by this virus program. You can find them out. First locate and note down the "date of creation" of any of the files mentioned above, and after that, search the hard disk for other files created on that date or onward. See image

Necessary steps required to remove this virus program

To stop the malicious services created by the virus program
To start the services that are stopped by the virus program
To remove processes created by the virus program from the Task Manager
To search and delete files created by the virus program from the hard disk. Enable to view "hidden files and folders" before you search. Otherwise files created by the virus program inside the hidden folders will not be found
To remove obsolete registry keys using CCleaner

Detailed instructions and free Tools

Preventive steps to avoid virus programs

Reprinted with permission from Threatexpert.com

Disclaimer

Vocabulary of the technical terms used in this article