Security news and informationNew SpywareQuake variant, xenadot.dll, found today
The makers of SpywareQuake seem to be on a roll this week. We find one variant and they release another. This time the file used is C:\Windows\System32\xenadot.dll.
Xenadot.dll is loaded via the following registry keys:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\
SharedTaskScheduler]
“{CD5E2AC9-25CE-A1C5-D1E2-DC6B28A6ED5A}”=”XenaDot Software”
[HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\
{CD5E2AC9-25CE-A1C5-D1E2-DC6B28A6ED5A}\InProcServer32]
@=”C:\WINDOWS\system32\xenadot.dll”
The SpywareQuake removal instructions have been updated for this variant.
