Necessary At your option Useless Dangerous Windows Programs - Useful, Useless or Malicious
Startupapps.com recommends you:

UnHackMe Warrior Removing rootkits is best done from the "clean" Windows!

UnHackMe Warrior

Blog: New viruses/malware/rootkits. Everyday!

Blog: How to remove malware/Trojans/rootkits using UnHackMe or manually. We know how to remove malware.

Shortcut Antivirus protects against Microsoft LNK and PIF vulnerability, notify a user about found threats and give possibility to immediately remove threats.

StuxnetRemover - free of charge Stuxnet/Tmphider rootkit removal tool.

Blog: System Software Research. What is under the hood? Who is faster? Antiviral and system software under microscope...

Dangerous fabarplus.dll - Dangerous

Fix it immediately

fabarplus.dll
We suggest you to remove wiznaviguide_20080725_update.exe from your computer as soon as possible.
Wiznaviguide_20080725_update.exe is Trojan/Backdoor.
Kill the process wiznaviguide_20080725_update.exe and remove wiznaviguide_20080725_update.exe from Windows startup.

Malware dropper:
C:\sand-box\wiznaviguide_20080725_update.exe

Removed:
C:\Program Files\wiznavi_ieguideplus\fabhoplus.dll
C:\Program Files\wiznavi_ieguideplus\wiznaviguide_update.exe
-------------------------------------------------------------------------------------
Classification:
Code:
Antivirus Version Last Update Result
F-Secure 8.0.14470.0 2009.10.07 -
Kaspersky 7.0.0.125 2009.10.07 -
McAfee 5763 2009.10.06 -
Microsoft 1.5101 2009.10.07 -
NOD32 4485 2009.10.06 -
Symantec 1.4.4.12 2009.10.07 -

Additional information
File size: 1096669 bytes
MD5 : eb76271126aeac5872bec5846f283bca
SHA1 : fd3a2062e68da0c5e2051095e2b8e43e4a6fe843
-------------------------------------------------------------------------------------
Installation
When the program is executed, it creates the following registry subkeys and values:

----------------------------------
Keys added:10
----------------------------------
HKLM\SOFTWARE\Classes\CLSID\{1357616F-E51A-4B5C-8C81-E9AC2FC42509}
HKLM\SOFTWARE\Classes\CLSID\{1357616F-E51A-4B5C-8C81-E9AC2FC42509}\Implemented Categories
HKLM\SOFTWARE\Classes\CLSID\{1357616F-E51A-4B5C-8C81-E9AC2FC42509}\Implemented Categories\{00021493-0000-0000-C000-000000000046}
HKLM\SOFTWARE\Classes\CLSID\{1357616F-E51A-4B5C-8C81-E9AC2FC42509}\InprocServer32
HKLM\SOFTWARE\Classes\CLSID\{62B8225A-9DFC-484F-B497-13C567358051}
HKLM\SOFTWARE\Classes\CLSID\{62B8225A-9DFC-484F-B497-13C567358051}\InprocServer32
HKLM\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{1357616F-E51A-4B5C-8C81-E9AC2FC42509}
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{62B8225A-9DFC-484F-B497-13C567358051}
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Wiznavi Guide Plus
HKLM\SOFTWARE\wiznaviguide_plus

----------------------------------
Values added:17
----------------------------------
HKLM\SOFTWARE\Classes\CLSID\{1357616F-E51A-4B5C-8C81-E9AC2FC42509}\Implemented Categories\{00021493-0000-0000-C000-000000000046}\: ""
HKLM\SOFTWARE\Classes\CLSID\{1357616F-E51A-4B5C-8C81-E9AC2FC42509}\InprocServer32\: "C:\Program Files\wiznavi_ieguideplus\fabarplus.dll"
HKLM\SOFTWARE\Classes\CLSID\{1357616F-E51A-4B5C-8C81-E9AC2FC42509}\InprocServer32\ThreadingModel: "Apartment"
HKLM\SOFTWARE\Classes\CLSID\{1357616F-E51A-4B5C-8C81-E9AC2FC42509}\: "A?A?µ?»cAI??®"
HKLM\SOFTWARE\Classes\CLSID\{62B8225A-9DFC-484F-B497-13C567358051}\InprocServer32\: "C:\Program Files\wiznavi_ieguideplus\fabhoplus.dll"
HKLM\SOFTWARE\Classes\CLSID\{62B8225A-9DFC-484F-B497-13C567358051}\InprocServer32\ThreadingModel: "Apartment"
HKLM\SOFTWARE\Classes\CLSID\{62B8225A-9DFC-484F-B497-13C567358051}\: "FreangBHO"
HKLM\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{1357616F-E51A-4B5C-8C81-E9AC2FC42509}\: ""
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{62B8225A-9DFC-484F-B497-13C567358051}\: ""
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Wiznavi Guide Plus\DisplayName: "Internet Explorer Wiznavi Guide Plus"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Wiznavi Guide Plus\UninstallString: ""C:\Program Files\wiznavi_ieguideplus\uninstall.exe""
HKLM\SOFTWARE\wiznaviguide_plus\ieguidever: "20080725"
HKLM\SOFTWARE\wiznaviguide_plus\sepver: "20080725"
HKLM\SOFTWARE\wiznaviguide_plus\addupver: "20080725"
HKLM\SOFTWARE\wiznaviguide_plus\pid: "notpid"
HKLM\SOFTWARE\wiznaviguide_plus\dir: "C:\Program Files\wiznavi_ieguideplus"
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\wiznaviguide_plus: "C:\Program Files\wiznavi_ieguideplus\wiznaviguide_update.exe"

----------------------------------
Values modified:0
----------------------------------

----------------------------------
Files added:7
----------------------------------
C:\Program Files\wiznavi_ieguideplus\config.exe
C:\Program Files\wiznavi_ieguideplus\fabarplus.dll
C:\Program Files\wiznavi_ieguideplus\fabhoplus.dll
C:\Program Files\wiznavi_ieguideplus\uninstall.exe
C:\Program Files\wiznavi_ieguideplus\wiznaviguide_plus.exe
C:\Program Files\wiznavi_ieguideplus\wiznaviguide_update.exe
C:\WINDOWS\system32\niebgt.dll

----------------------------------
Files deleted:1
----------------------------------
C:\sand-box\wiznaviguide_20080725_update.exe

----------------------------------
Files [attributes?] modified:0
----------------------------------

----------------------------------
Folders added:2
----------------------------------
C:\Program Files\wiznavi_ieguideplus
C:\Temp

----------------------------------
Folders deleted:0
----------------------------------

----------------------------------
Total changes:37
----------------------------------

-------------------------------------------------------------------------------------
Internet activity:
Code:
HTTP GET http://log.onmuz.com/logonmuz/adexp.php?...
HTTP GET http://log.onmuz.com/logonmuz/adexp.php?...
HTTP GET http://app.ieguide.co.kr/ucccguide/updat...
HTTP GET http://down.ieguide.co.kr/updatefile/wiz...
HTTP GET http://crl.thawte.com/ThawtePremiumServe...
HTTP GET http://crl.thawte.com/ThawteCodeSigningC...
-------------------------------------------------------------------------------------
Detected by UnHackMe:

Item Name: {62B8225A-9DFC-484F-B497-13C567358051}
Author: Unknown
Related File: C:\Program Files\wiznavi_ieguideplus\fabhoplus.dll
Type: Browser Helper Objects

Item Name: wiznaviguide_plus
Author:
Related File: C:\Program Files\wiznavi_ieguideplus\wiznaviguide_update.exe
Type: Registry Run

Removal Results: Success
Number of reboot: 1
-------------------------------------------------------------------------------------

Recommended software:
UnHackMe anti-rootkit and anti-malware
http://www.unhackme.com
RegRun Security Suite (Good choice for removal and protection)

Remove FABARPLUS.DLL.HTM now!

Install UnHackMe Install RegRun

Virus Problem? Google Redirects? Ads? Slow?

  1. First download the latest version UnHackMe: Download UnHackMe.
  2. Open the archive and start the unhackme_setup.exe.
  3. When the installation is over you will see the main UnHackMe screen.
  4. Click on the Advanced button and choose “Send report to the support center” in the popup menu. Follow the instructions. The report file (regrunlog.txt) will be saved on your Desktop.
  5. Go to the Support Center. Attach it to your ticket and click on the Browse button and then to the regrunlog.txt file. Don’t insert the report text directly into the message text! We won’t be able to analyse such a report. Describe your problem in detail. Add the screenshot, your antivirus log or suspicious files.

Constantly updated. Last update: February 5 2012

Fix Windows PC's Fast! Automated Software Repairs damaged & slow windows systems in 1 click.


Quick Links
What's new?
RSS Feed
Add to AppDatabase
Ask Experts
Join forum
Links

Articles
Virus or not? SPTD####.sys
What is mc21.tmp, mc22.tmp, mc23.tmp?

Select
Necessary
Useless
At your option
Dangerous
Copyright © 1998-2012 Greatis Software