Ola Javier77,
Name: Application.NirCmd
Threat Level: Info
Description: Application.NirCmd is a collection of third party tools packed in one executable that can be used to remove threats in an infected machine. However it can also be used by users with malicious intent to do a different activity.
Type: TT_Info
For this being remnants of legit removal tools like ComboScript etc. read here:
http://www.techsupportteam.org/forum/malware-removal/2298-nircmds-legacy_catchme-swearware-plus-other-threats.html
Following is the virus description and detail of NIRCMD.EXE removal:
For successful remove NIRCMD.EXE removal , following the instruction:
-
Temporarily Disable System Restore .
-
Update the virus definitions. Reboot computer in SafeMode,;
3.Stop NIRCMD.EXE removal virus files process if you can find on the task list;
-
Locate NIRCMD.EXE removal virus files and double-click on it to uninstall virus files program.
Follow the screen step-by-step screen instructions to complete uninstallation of NIRCMD.EXE removal.
Do not worry about this if you cannot find it in Add/Remove window.
-
Delete/Modify any values added to the registry related with NIRCMD.EXE removal,
Exit registry editor and restart the computer;
-
Clean/delete all infected file(s):NIRCMD.EXE removal,or rename NIRCMD.EXE removal virus files;
-
Please delete all your IE temp files manually,or download the tool ATF Cleaner to delete all your IE temp files.
-
Use antivirus program run a whole scan;
Following is the information of the virus file NIRCMD.EXE removal
NIRCMD.EXE:The filename NIRCMD.EXE was first seen on Mar 14 2008 in The UNITED ARAB EMIRATES.
It has also been seen in the following geographical regions of the Prevx community:
* SPAIN on Apr 12 2008
* INDONESIA on May 30 2008
The filename NIRCMD.EXE refers to many versions of an executable program.
The most common file size is 28,672 bytes. But the following file sizes have also been seen:
* 37,888 bytes
* 33,788 bytes
* 57,856 bytes
* 74,240 bytes
These files have no vendor, product or version information specified in the file header.
NIRCMD.EXE has been seen to perform the following behavior(s):
* The Process is packed and/or encrypted using a software packing process
* This Process Creates Other Processes On Disk
* Executes a Process
* This Process Deletes Other Processes From Disk
NIRCMD.EXE has been the subject of the following behavior(s):
* Created as a process on disk
* Executed as a Process
* Deleted as a process from disk
NIRCMD.EXE can also use the following file names:
* 62870304.DAT
* 88596536.EXE
* 09786665.EXE
* 32238923.EXE
* A0002000.EXE
* THUNDERBIRDPORTABLE CONTROL/NIRCMD.EXE
* 44237495.EXE
* 64487119.EXE
* I.EXE
* 53152372.EXE
Malware Fighter Info,
Con Dios,
polonus