Remove Tarno.r

Tarno.r Description

Tarno.r is a trojan that monitors software windows and accessed web pages for predefined keywords. Once the spyware detects such a keyword, it starts recording all the keystrokes that the user enters into many window fields and web forms. Gathered data is saved to several files, which are regularly transferred to a predetermined remote web server.

Tarno.r arrives in bogus e-mail with malicious executable attachements. Once the user runs such an attachment, the trojan secretly downloads its main components from the Internet and installs itself to the computer. Tarno.r is able to bypass the Windows Firewall.

The trojan works as an Internet Explorer add-on and therefore runs every time the user launches the web browser.

Remove Tarno.r

Stop the following Tarno.r processes:
file1185.exe
ndppbzn.exe
winsetup.exe

Remove the following Tarno.r registry keys:
3A4E6FF3-BF59-446E-9DC8-731BCE2F349A
HKEY_LOCAL_MACHINESOFTWAREClassessvchost.Update
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyStandardProfileAuthorizedApplicationsList[filename]

Unregister the following Tarno.r DLL files:
svchost.dll
sui.dll

Delete the following Tarno.r files:
file1185.exe
ndppbzn.exe
winsetup.exe
svchost.dll
sui.dll
update.sys
wint.ini
ierror.rep

Other Spyware

0-9