Trojan.ADH – Heuristic.ADH

Updated: April 25, 2012 Trojan 15 Comments

Trojan.ADH or Heuristic.ADH is a very harmful Trojan that will infect executable files on the compromised computer. Trojan.ADH and Heuristic.ADH are generic detection for a malicious files or computer virus with the same functionalities and payload once executed on the system. It brings several malfunctions to affected computer and endangers the operating system.

Alias: Trojan-Banker.Win32.Bancos.isn, W32/Koobface.worm.gen.o, Mal/EncPk-KX, Mal/EncPk-LC, PWS:Win32/Zbot.gen!Q

Damage Level: Medium

Systems Affected: Windows 9x, 2000, XP, Windows Vista, Windows 7

Characteristics
Once running on the computer, Trojan.ADH will perform various malicious tasks including the following:

  • Trojan.ADH may allow a remote attacker to gain unauthorized access to compromised system.
  • This Trojan also downloads malicious files from its hosts and updates itself.
  • Infected computer may experience a slowdown in performance when this Trojan runs several processes in the background.
  • It steals sensitive financial data like online banking details and credit card account.
  • Apply a rootkit functionality to hide its presence on the computer.
  • Capture screen shot images and sends it to a remote location through email.

Distribution
Trojan.ADH uses several methods to spread a copy. In most cases, it is injected to illegal files like key generator and program cracks. These files are widely available over the Internet. Various web sites and peer-to-peer connections are significant sources that may bring Trojan.ADH on one’s computer without their consent.

Detection and Removal
Trojan.ADH is a generic detection process. Certain anti-virus vendors designed the method to identify new malware threats using highly sensitive detection skills. In most cases, files detected as Trojan.ADH are somehow malicious or may contain suspicious behavior. However, this detection process may rarely identify valid files and legitimate programs that show similar characteristics of the Trojan. Hence, deleting valid files may result to system or program malfunction. Therefore, it is important to check files that are identified as Trojan.ADH before executing any actions.

[cf]regis[/cf] [cf]files[/cf]

How to Remove Trojan.ADH – Heuristic.ADH

Restore Windows Components

During an infection, Trojan.ADH drops various files. The worm intentionally hides system files by setting options in the registry. With these accomplishments, the best solution is to return Windows to previous working state is trough System Restore. If previous restore point is saved, you may proceed with Windows System Restore.

Manual Removal Procedure

1. If an anti-virus program is present, update the definition file. Each anti-virus program has its own way to update the database. Please refer to your software manufacturer’s manual.

2. Reboot Windows in Safe Mode to ensure that only minimal Windows components are loaded.
- After turning on the power of the computer, press F8 on your keyboard.
- It will display the Boot Options menu, select Safe Mode.

3. Run a full system scan and clean/delete all infected files related to Backdoor.Cycbot.

4. Delete or modify any values added by Backdoor.Cycbot to the registry if present. Please see the reference.
- To edit the registry, click on Start > Run and type regedit.exe in the field.
- Alternatively, you may press Windows Key + R on your keyboard to open the RUN command.

5. Exit registry editor when done. You may now restart the computer.

Removal Tool

A free removal tool from Norton Antivirus was developed to remove virus and unfamiliar threats without using the traditional AV signatures. Download the tool from this location and start scanning the computer for viruses and Trojans.

Alternative Removal Method for Trojan.ADH – Heuristic.ADH

Option 1 : Use Windows System Restore to return Windows to previous state

If Trojan.ADH – Heuristic.ADH enters the computer, there is a big chance that Windows files, registry entries and other essential components are also infected. System Restore can reinstate clean system files by restoring the configuration to an earlier date. The method also replaces compromised files with a clean version. If you have a saved restore point before Trojan.ADH – Heuristic.ADH infiltrates the PC, we highly encourage you to execute this procedure if none of the above works. You may proceed with Windows System Restore, click here to see the full procedure.

Option 2 : Trojan.ADH – Heuristic.ADH manual uninstall guide

IMPORTANT! Manual removal of Trojan.ADH – Heuristic.ADH requires technical skills. Deleting system files and registry entries by mistake may result to total disability of Windows system. We advise you to perform a backup of registry before proceeding with this guide.

1. Kill any running process that belongs to Trojan.ADH – Heuristic.ADH.
- Press Ctrl+Alt+Del on your keyboard.
- When Windows Task Manager appears, look for Trojan.ADH – Heuristic.ADH files (refer to Technical Reference) and click End Process.

End Task

2. Delete all registry entries that belong to this malware.
- Press [Windows Key]+R on your keyboard.
- In the 'Open' dialog box, type regedit and press Enter. This will open registry editor.
- Find and delete registry entries as mentioned in Technical Reference section below.
- Close registry editor. Changes made will be save automatically.

Run Regedit

3. Scan the computer with antivirus program.
- Connect to Internet and open your antivirus software. Please update to obtain the latest database and necessary files.
- Restart the computer in Safe Mode.
- Just before Windows logo begins to load press F8 on your keyboard.
- On Windows Advanced Boot Options, select Safe Mode and press Enter.

4. Delete all files dropped by Trojan.ADH – Heuristic.ADH.
- While still in Safe Mode, search and delete malicious files. Please refer to 'Technical Reference'. Make sure that you execute 'End Task' first before deleting the file. Otherwise, the system will not let you perform this action.

Technical Reference

Associated Files and Folders:Added Registry Entries: