| EBlaster 5.0 removal| Spyware EBlaster 5.0 Information |
|---|
Name: EBlaster 5.0
Category: Keylogger
Date: 2004-12-25
Dangerous: Yes |
Eblaster is keylogger software, which, by definition, isn´t malware, but it could be used for malicious purposes. It is recommended to use some sort of spyware remover if you suspect your computer to be infected.
>> Delete EBlaster 5.0 automatically - Download Spyware Doctor
| EBlaster 5.0 Removal Instructions |
|---|
Kill the following processes biosboot.exe, eb50setup.exe, chkdisk.exe, logmon.exe, netbcam.exe, netutil.exe, profwin.exe, svrwin.exe, v32wsock.exe, usbw32.exe, w32sub.exe | Unregister the following DLLs and reboot ceract.dll, chkcer.dll, hosthex32.dll, netras.dll, perfboot.dll, rtfmidi.dll, statslink.dll.
autprof.dll, biosuni.dll, catmidi.dll, cfgtcp.dll, cfgvga.dll, compserver.dll, conflib32.dll, ctldde.dll, ctldll.dll, ddectl.dll, devcrypt.dll, dhcpkbd.dll, dllcmd.dll, httpsserver32.dll, ipdll32.dll, kbdman.dll, macnetb32.dll, midical.dll, modipx.dll, modstats.dll, msdde.dll, netbaut.dll, netipx.dll, odbckey.dll, olehost.dll, regdb.dll, rtfftp.dll, sqlhost32.dll, statip.dll, tcpterm.dll, uniserver.dll, vgalog.dll, xmlbot32.dll, xpcmd.dll in Windows\system32\
| Delete these registry entries HKEY_LOCAL_MACHINE\software\classes\clsid\{0e289927-69b7-4c4c-8502-354e048c8e92}
HKEY_LOCAL_MACHINE\software\classes\clsid\{191922d9-d5ae-453d-b290-f26a9c270402}
HKEY_LOCAL_MACHINE\software\classes\clsid\{27474baa-705f-4769-a44f-e13a8be4e610}
HKEY_LOCAL_MACHINE\software\classes\clsid\{2be166ed-f16c-46de-b623-3575fd9b5d6d}\wivdevenum
HKEY_LOCAL_MACHINE\software\classes\clsid\{2efe6983-b0bf-4ebf-9637-a7c10ec3eebb}
HKEY_LOCAL_MACHINE\software\classes\clsid\{30b92215-0e32-400e-a05d-e583bf1d6c49}
HKEY_LOCAL_MACHINE\software\classes\clsid\{5343160f-29a0-49e3-8782-c08b11e0675f}
HKEY_LOCAL_MACHINE\software\classes\clsid\{75c3efc9-45ba-48f4-96a9-f4708a4b32db}
HKEY_LOCAL_MACHINE\software\classes\clsid\{812e1c52-8b82-4bc7-bdfa-cfdaedb63f41}
HKEY_LOCAL_MACHINE\software\classes\clsid\{81cdda69-0eec-4142-8eb4-de2a433c91a2}
HKEY_LOCAL_MACHINE\software\classes\clsid\{855edf42-f91b-4818-8df1-b58ca6043290}
HKEY_LOCAL_MACHINE\software\classes\clsid\{99c193ba-d72b-4934-8612-6bc25640cb1f}
HKEY_LOCAL_MACHINE\software\classes\clsid\{b7013911-76cf-4750-b174-2b573bc2f14c}
HKEY_LOCAL_MACHINE\software\classes\clsid\{ce0babb4-3a61-4dbb-a6c7-f69896a47540}
HKEY_LOCAL_MACHINE\software\classes\clsid\{e4b58522-89aa-45ed-bf8d-ebe7207a5d2a}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload\caleng
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload\lanras
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload\netbcab
| Remove the following files appms.drv, biosboot.exe, ceract.dll, chkcer.dll, eb50setup.exe, eblaster 5.0.txt, hosthex32.dll, msqkvowin.msj, msqkvowin.rcv, msquf32.msj, msquf32.rcv, netras.dll, perfboot.dll, rtfmidi.dll, statslink.dll, usbw32.exe, w32sub.exe.
autprof.dll, biosuni.dll, catmidi.dll, cfgtcp.dll, cfgvga.dll, chkdisk.exe, compserver.dll, conflib32.dll, ctldde.dll, ctldll.dll, ddectl.dll, devcrypt.dll, dhcpkbd.dll, dllcmd.dll, httpsserver32.dll, ipdll32.dll, kbdman.dll, logmon.exe, macnetb32.dll, midical.dll, modipx.dll, modstats.dll, msdde.dll, netbaut.dll, netbcam.exe, netipx.dll, netutil.exe, odbckey.dll, olehost.dll, profwin.exe, regdb.dll, rtfftp.dll, sqlhost32.dll, statip.dll, svrwin.exe, tcpterm.dll, uniserver.dll, v32wsock.exe, vgalog.dll, xmlbot32.dll, xpcmd.dll in Windows\system32\
ctlstats.drv in Windows\system32\ddecom\
statfat.drv in Windows\system32\ipxip\
diskstats.drv in Windows\system32\modnetb\
docmfc.drv in Windows\system32\niccam\
diskmod.drv in Windows\system32\submon\
macreg.drv in Windows\system32\termme\
termlink.drv in Windows\system32\usbdel\
| Remove the following directories Windows\system32\ddecom
Windows\system32\ipxip
Windows\system32\modnetb
Windows\system32\niccam
Windows\system32\submon
Windows\system32\termme
|
Bookmark EBlaster 5.0 page
| Visitor Comments on EBlaster 5.0 |
|---|
2005-09-16 00:36:29, Guest:
If you are using Salfeld's Child Control software, your spyware detector may alert you that you have EBlaster on your system. I think one of Salfeld's files is named "winsvr.exe." | 2006-01-25 20:40:59, Guest:
Yes, and the same file is also labelled as svrwin.exe |
|