How to remove Power PC (trojan.gendal bundled)
Nov.25, 2011 in
Anti trojan software
Power PC is a rogue application of South Korea origin. Pretends to be performance optimization and ActiveX cleaning software. Probably, shows nonexistent problems to make people purchase it. Does not effect performance of infected PC. You need to remove Power PC as soon as you spotted its activity. Here is the main window of the software:
Download Power PC Removal Tool
Here you can find VirusTotal Report on installation file of this trojan:
http://www.virustotal.com/file-scan/report.html?id=7c1967d22a23d4a1ed9ad442d45233c6692f22bd68090530a71b8cf12e58f642-1322215847
Here you can find ThreatExpert Report on Power PC:
http://www.threatexpert.com/report.aspx?md5=88e1aa6e60da0587388d04e49a36881e
Manual Removal of Power PC
Here are the files and registry keys created by malware:
----------------------------------
Keys added:2
----------------------------------
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PowerPcDel
HKLM\SOFTWARE\PowerPc
----------------------------------
Values added:14
----------------------------------
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PowerPc: ""c:\program files\powerpc\powerup.exe" boot"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PowerPcDel\DisplayName: "ÆÄ¿öPC 1.0"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PowerPcDel\DisplayVersion: "1.0"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PowerPcDel\HelpLink: "http://www.power-pc.co.kr/"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PowerPcDel\InstallLocation: "C:\Program Files\PowerPC\"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PowerPcDel\UninstallString: "C:\Program Files\PowerPC\pwuninstall.exe"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PowerPcDel\URLInfoAbout: "http://www.power-pc.co.kr/"
HKLM\SOFTWARE\PowerPc\Part: "neov"
HKLM\SYSTEM\ControlSet001\Services\kmixer\Enum\0: "SW\{b7eafdc0-a680-11d0-96d8-00aa0051e51d}\{9B365890-165F-11D0-A195-0020AFD156E4}"
HKLM\SYSTEM\CurrentControlSet\Services\kmixer\Enum\0: "SW\{b7eafdc0-a680-11d0-96d8-00aa0051e51d}\{9B365890-165F-11D0-A195-0020AFD156E4}"
HKU\S-1-5-21-1202660629-527237240-1417001333-500\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\HRZR_EHACNGU:P:\Qbphzragf naq Frggvatf\Nqzvavfgengbe\Qrfxgbc\cbjrecp2.0_frghc.rkr: 01 00 00 00 06 00 00 00 E0 39 8F 60 59 AB CC 01
HKU\S-1-5-21-1202660629-527237240-1417001333-500\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\Documents and Settings\Administrator\Desktop\powerpc2.0_setup.exe: "????2.0 ?? ???????. "
HKU\S-1-5-21-1202660629-527237240-1417001333-500\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\is-IFK5A.tmp\is-2FK0E.tmp: "Setup/Uninstall"
HKU\S-1-5-21-1202660629-527237240-1417001333-500\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\Program Files\PowerPC\PowerPc.exe: "www.power-pc.co.kr"
----------------------------------
Values modified:7
----------------------------------
HKLM\SOFTWARE\Microsoft\Cryptography\RNG\Seed: A2 09 E9 89 5A 76 FC 7E C9 79 E0 04 EF B9 4E BE EC 1B 2A 0C C6 95 A3 AB CE 1D CE 1B E8 6C 08 D2 C7 FE FB 27 81 9A 16 69 74 B9 09 5F 3E FA E9 C4 DE 54 7D 47 DE EF 29 5A 43 0D E0 D0 0F 36 B9 6F 31 EA EF 7B 90 93 A6 C7 D5 80 9C B1 CD 17 62 13
HKLM\SOFTWARE\Microsoft\Cryptography\RNG\Seed: 72 C4 B5 A0 01 52 CF 40 CC D8 87 53 A1 FA F4 B8 C3 51 51 A2 74 29 F7 7A F3 DD 99 FE 9A B0 4C 5A C6 D6 D8 3E 3C DB 0A 02 10 2F 96 37 B9 73 05 43 98 AF 48 26 A6 B1 64 78 62 FA B2 A8 D2 F2 DF 95 60 13 F4 C6 F1 46 BA D8 86 E0 52 FF 95 FA DA 4D
HKLM\SYSTEM\ControlSet001\Services\kmixer\Enum\Count: 0x00000000
HKLM\SYSTEM\ControlSet001\Services\kmixer\Enum\Count: 0x00000001
HKLM\SYSTEM\ControlSet001\Services\kmixer\Enum\NextInstance: 0x00000000
HKLM\SYSTEM\ControlSet001\Services\kmixer\Enum\NextInstance: 0x00000001
HKLM\SYSTEM\CurrentControlSet\Services\kmixer\Enum\Count: 0x00000000
HKLM\SYSTEM\CurrentControlSet\Services\kmixer\Enum\Count: 0x00000001
HKLM\SYSTEM\CurrentControlSet\Services\kmixer\Enum\NextInstance: 0x00000000
HKLM\SYSTEM\CurrentControlSet\Services\kmixer\Enum\NextInstance: 0x00000001
HKU\S-1-5-21-1202660629-527237240-1417001333-500\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\HRZR_EHACNGU: 01 00 00 00 27 00 00 00 50 B1 A6 1B 59 AB CC 01
HKU\S-1-5-21-1202660629-527237240-1417001333-500\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\HRZR_EHACNGU: 01 00 00 00 28 00 00 00 E0 39 8F 60 59 AB CC 01
HKU\S-1-5-21-1202660629-527237240-1417001333-500\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\HRZR_HVFPHG: 01 00 00 00 14 00 00 00 00 0D 92 1A 59 AB CC 01
HKU\S-1-5-21-1202660629-527237240-1417001333-500\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\HRZR_HVFPHG: 01 00 00 00 15 00 00 00 10 98 7E 60 59 AB CC 01
----------------------------------
Files added:15
----------------------------------
C:\Documents and Settings\All Users\Start Menu\Programs\ÆÄ¿öPC\ÆÄ¿öPC.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\ÆÄ¿öPC\ÆÄ¿öPCÁ¦°Å.lnk
C:\Program Files\PowerPC\graph.swf
C:\Program Files\PowerPC\outfile.dt
C:\Program Files\PowerPC\powerpc.exe
C:\Program Files\PowerPC\powerup.exe
C:\Program Files\PowerPC\prodbFile.dat
C:\Program Files\PowerPC\pwpcop.dat
C:\Program Files\PowerPC\pwtray.exe
C:\Program Files\PowerPC\pwuninstall.exe
C:\Program Files\PowerPC\version.dat
C:\WINDOWS\Prefetch\IS-2FK0E.TMP-11D91B44.pf
C:\WINDOWS\Prefetch\POWERPC.EXE-075B2380.pf
C:\WINDOWS\Prefetch\POWERPC2.0_SETUP.EXE-1D961ADD.pf
C:\WINDOWS\system32\powerpc.not
----------------------------------
Files [attributes?] modified:5
----------------------------------
C:\Documents and Settings\Administrator\Cookies\index.dat
C:\Documents and Settings\Administrator\Local Settings\History\History.IE5\index.dat
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat
C:\Documents and Settings\Administrator\ntuser.dat.LOG
C:\WINDOWS\system32\config\software.LOG
----------------------------------
Folders added:2
----------------------------------
C:\Documents and Settings\All Users\Start Menu\Programs\ÆÄ¿öPC
C:\Program Files\PowerPC
----------------------------------
Total changes:45
----------------------------------Remove Power PC Automatically
Removing all above files and registry keys (or modifying changed ones) should help you get rid of this rogue application called Power PC. If you will have any problems removing it or it will not allow you to remove certain files you can either remove them from Safe Mode or use special removal tool:
Leave a Reply