Remove Hyborate

What is Hyborate and removal instructions

Hyborate is a trojan that deletes user video files and text documents. Once executed, the parasite displays fake error message and installs itself to the system. Then it runs a payload. Hyborate searches all local hard drives for video and PDF files, and deletes all the files it finds. It also changes numerous Windows Explorer and Internet Explorer settings, disables the Registry Editor, hides certain system utilities. The trojan changes Windows registration details and lowers system security settings. It also terminates essential system tools such as the Command Prompt and the Task Manager. Hyborate runs on every Windows startup and every time the user opens a text file.

Hyborate manual removal:

Kill processes:
dlhost.exe, lodctr32.exe, note.exe
Delete registry values:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell=explorer.exe lodctr32.exe
HKEY_CLASSES_ROOT\txtfile\Shell\Open\Command\(Default)=%System%\note.exe %1
HKEY_CLASSES_ROOT\Directory\DefaultIcon\(Default)=%Windir%\lodctr32.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify=1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusOverride=0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify=1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallOverride=0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify=1
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFind=1
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRun=1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFind=1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRun=1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DisableCAD=1
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools=1
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\LocalUser\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools=1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools=1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy Objects\LocalUser\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools=1
HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info\DefCompany=[X]
HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info\DefName=[X]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\RegisteredOrganization=[X]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\RegisteredOwner=[X]
Delete files:
dlhost.exe, lodctr32.exe, note.exe
Misc:
[X] is the string ".BoRaX.BoRaX.BoRaX.BoRaX.BoRaX."

Exact file location:
lodctr32.exe - C:\Windows or C:\Winnt
dlhost.exe - C:\Documents and Settings\[Current User]\My Documents
note.exe - C:\Windows\System, C:\Windows\System32 or C:\Winnt\System32

Related Spyware Removal

Previous: Hyder Next: HVL RAT

| 1-9 | O | P | Q | R | S | T | U | V | W | X | Y | N | M | L | A | B | C | D | E | F | G | H | I | J | K | Z