<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>micromux &#187; Virus</title>
	<atom:link href="http://www.micromux.com/category/virus/feed/" rel="self" type="application/rss+xml" />
	<link>http://www.micromux.com</link>
	<description>Commentary on the state of my microcosm.</description>
	<lastBuildDate>Thu, 02 May 2013 02:54:46 +0000</lastBuildDate>
	<language>en-US</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.5.1</generator>
		<item>
		<title>Windows Crashes Deliverer</title>
		<link>http://www.micromux.com/2011/06/09/windows-crashes-deliverer/</link>
		<comments>http://www.micromux.com/2011/06/09/windows-crashes-deliverer/#comments</comments>
		<pubDate>Fri, 10 Jun 2011 02:07:02 +0000</pubDate>
		<dc:creator>Eric</dc:creator>
				<category><![CDATA[Malware]]></category>
		<category><![CDATA[Microsoft]]></category>
		<category><![CDATA[Security]]></category>
		<category><![CDATA[Virus]]></category>

		<guid isPermaLink="false">http://www.micromux.com/?p=483</guid>
		<description><![CDATA[There are quite a few kinds of malware that can infect your PC, and Windows Crashes Deliverer is among one of the tricker to extricate. It masquerades as an anti-virus application and in fact gives the appearance of a valid &#8230; <a href="http://www.micromux.com/2011/06/09/windows-crashes-deliverer/">Continue reading <span class="meta-nav">&#8594;</span></a>]]></description>
				<content:encoded><![CDATA[<p>There are quite a few kinds of malware that can infect your PC, and <em>Windows Crashes Deliverer</em> is among one of the tricker to extricate. It masquerades as an anti-virus application and in fact gives the appearance of a valid application, this malware is part of a relatively new class of malicious programs that can be described as rogue anti-spyware or <em>scareware</em>. For these programs, the objective is to convince you to buy it to protect your machine and in the process of doing so create the appearance of damage on your machine.</p>
<p><span id="more-483"></span></p>
<p><a href="http://www.micromux.com/wp-content/uploads/2011/06/windows_crashes_deliverer.jpg"><img class="aligncenter size-full wp-image-487" title="Windows Crashes Deliverer" src="http://www.micromux.com/wp-content/uploads/2011/06/windows_crashes_deliverer.jpg" alt="Windows Crashes Deliverer" width="500" height="269" /></a></p>
<p>After this is installed on your system, it will take over your Windows desktop shell. As a result, when your computer restarts rather than run the standard Windows desktop you will be running Crashes Deliverer instead. This program actually creates a randomly assigned file name for the application and places that in:</p>
<p><code>%ApplicationData%\User Profile\Microsoft\[random].exe</code></p>
<p>Where [random] is in fact a random series of letters and numbers. Removal will require something like <a href="http://www.bleepingcomputer.com/download/anti-virus/rkill">RKill</a> to eliminate Crashes Deliverer from memory, I will explain in a little more detail how this can work.</p>
<ol>
<li><strong>Run Fake Scan</strong>. On reboot, Crashes Deliverer will take over your desktop. Follow the instructions to run the fake scan and then press <em>Fix Errors.</em> You won&#8217;t be able to get to your Windows desktop (or at least a crippled version of that) until completing the fake scan.</li>
<li><strong>Close Crashes Deliverer Window</strong>. Close this window after completing the fake scan. Be aware that the program doesn&#8217;t actually exit, it will continue to run in the background thwarting many activities. For example, if you attempt to open Window Task Manager at this time it would erroneously identify that as a virus. Ignore all these warnings, this is not a true anti-virtus program.</li>
<li><strong>Run RKill</strong>. Use <a href="http://www.bleepingcomputer.com/download/anti-virus/rkill">RKill</a> to terminate Crashes Deliverer, since you can&#8217;t bring up Task Manager or many other popular utilities for process management, RKill is going to be your best bet. Note that Crashes Deliverer can identify RKILL.EXE, so you must rename the program in order for it to run.</li>
<li><strong>Update Your Registry</strong>. Remove the invalid registry key for the Windows logon shell, this will be pointing to the invalid Crashes Deliverer [random].exe. The following registry path should be purged: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon\Shell.</li>
<li><strong>Remove Malware Executable</strong>. Remove the malware executable under %ApplicationData%\User Profile\Microsoft\[random].exe. You can use the name of the executable from the previous step or look for a sufficiently cryptic program name.</li>
<li><strong>Run Anti-Virus</strong>. This should be something other than the anti-virus you were running before Crashes Deliverer, since it was unable to detect it. You can use something like <a href="http://www.malwarebytes.org/">Malwarebytes</a> or <a href="http://www.safer-networking.org">Spybot</a>.</li>
<li><strong>Reboot</strong>.</li>
</ol>
<p>It&#8217;s easy to see how you might get lured into running this program, it purports to be a trustworthy source for anti-virus protection. In fact, the only intention is to convince you to spend money on a program that will actually do nothing for you. If you do enter your credit card information, you should contact your credit card company and inform them of what has happened</p>
]]></content:encoded>
			<wfw:commentRss>http://www.micromux.com/2011/06/09/windows-crashes-deliverer/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
	</channel>
</rss>

<!-- Dynamic Page Served (once) in 0.364 seconds -->
