Application Database

Application database

Startupapps.com recommends you:

Detect and remove hidden rootkits using UnHackMe Free fully functional 30-days trial.

RegRun Security Suite = 24 system utilities for protecting your computer. Try now!

I would like to say that RegRun has helped me on more than 1 occasion when it comes to spyware/adware by letting me know automatically that a piece of it got added to Windows startup. There is so much spyware/addware out there today it's hard to imagine being without RegRun. I like many other features too including the daily registry backups and file protection.

Chris Wagers

DANGEROUS - ?,0-9

Updated weekly. Last update: August 29 2010

We recommend! Click Here to Update All your PC's Outdated drivers

%system%\bloodred.exe

W32.Netsky.AE@mm is a mass-mailing worm.
1. Copies it body to the following files:
%System%\bloodred.exe
%System%\Windows_kernel32.exe
%Windir%\bloodred.zip (A zipped copy of the worm. The file name within is Urgent_Info.pif.)
%System%\base64exe.sys (detected as W32.Netsky.AE@mm!enc)
%System%\base64zip.sys (detected as W32.Netsky.AE@mm!enc)
2. Adds the value:
"Microsoft Kernel"="%System%\Windows_kernel32.exe"
to registry Run key.
3. Infects the HOSTS file.
Blocks access to antiviral sites and to Microsoft update.
4. Sends e-mails.

Removal:
Remove it from startup using RegRun Startup Optimizer.
Restore the HOSTS file using RegRun Anti-Spyware.
Stop the service and set it to disabled state.
Remove files.

%windir%\lsass.exe

Nickser trojan program.
When run the trojan copies itself under the name lsass.exe name to the Windows directory and registers itself in the registry run key.
It allows to fully control victim computer.
Suggest to stop it by RegRun Startup Optimizer.

%windir%_e51.exe

%WINDIR%_E51.EXE is Trojan/Backdoor.
Related files:
1 :%CACHE%\CONTENT.IE5\????????\WINDOWS_E[1].EXE
2 :%profiles%\default user\l...s\content.ie5\8heb0peb\WINDOWS_E[1].EXE
3 :?:\%WINDIR%_E52.EXE
4 :?:\~temp\WINDOWS_E51.EXE
5 :?:\091106\WINDOWS_E51.EXE
6 :?:\WINDOWS_E51.EXE
Read more: http://fileinfo.prevx.com/fileinfo.asp?P...
Kill the process %WINDIR%_E51.EXE and remove %WINDIR%_E51.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

.exe

VL RAT. 5.3.0 trojan

winpal32.dll

winpal32.dll is Adware.Look2ME.
Kill the file winpal32.dll and remove winpal32.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

x-mas.exe

Worm / Macro trojan / Virus dropper
Can load plug-ins from the Internet. From the start it used "Source of Chaos" in Japan.

!readme.exe

!readme.exe is worm Apost.
Kill the process !readme.exe and remove !readme.exe from Windows startup.
Read more:
http://www.f-secure.com/v-descs/readme.s...

!update.exe

!update.exe is Adware component.
Kill the process !update.exe and remove !update.exe from Windows startup.

"%program files%\common files\%generated clsid%\update.exe" mc-110-12-0000272

"%PROGRAM FILES%\Common Files\%generated CLSID%\Update.exe" mc-110-12-0000272 is Trojan.DR.MultiDrop.AL.
Read more: http://www.avira.com/en/threats/section/...
Kill the file "%PROGRAM FILES%\Common Files\%generated CLSID%\Update.exe" and remove "%PROGRAM FILES%\Common Files\%generated CLSID%\Update.exe" mc-110-12-0000272 from Windows startup using RegRun Reanimator.
http://www.regrun.com

"%windir%\acdsee demo.exe"

Mass mailing worm W32.Salga.A@mm.
Copies itself to the Windows, Programs Files, Documents and Settings folders.
Creates the file D:\autorun.inf containing the following lines:
[autorun]
open=FUN.ZIP.EXE
And the similar files to all disks.
Opens a Web browser and displays a Web page from the domain originalicons.com.
Creates the file D:\new computer worm alert\virus alert.txt.
Sends its body by e-mail.
Remove it from startup. Delete all copies from hard disk.

"%windir%\system\system copy.exe"

"renamed server".exe

Remote Access / Steals passwords
The client also drops a server! The hacker could choose to log passwords only or all text written. One of the functions is to kill antivirus software.

##exmodul.exe

##exmodul.exe is Trojan/Backdoor (## - numbers).
Kill the process ##exmodul.exe and remove ##exmodul.exe from Windows startup using RegRun.
www.regrun.com

$_3472452.exe

$_3472452.exe is Trojan/Backdoor.
Kill the process $_3472452.exe and remove $_3472452.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

$sys$drmserver.exe

$sys$DRMServer.exe is Sony DRM rootkit.
$sys$DRMServer.exe installed as system service 'Plug and Play Device Manager'.
Kill the process $sys$DRMServer.exe and remove $sys$DRMServer.exe from Windows startup.
More info:
http://www.bleepingcomputer.com/forums/t...

$sys$sonytimer.exe

$sys$sonytimer.exe is Trojan.Welomoch.
Trojan.Welomoch is a Trojan horse that attempts to utilize XCP software to hide W32.HLLW.Antinny, which it drops on to the compromised computer. The XCP software is installed by inserting certain Sony BMG content-protected music CDs into the computer.
Related files:
%System%\$sys$WeLoveMcCOL.exe
%System%\$sys$sos$sys$.exe
%System%\$sys$sonyTimer.exe
Read more: http://www.symantec.com/security_respons...
Kill the process $sys$sonytimer.exe and remove $sys$sonytimer.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

$sys$sos$sys$.exe

$sys$sos$sys$.exe is Trojan.Welomoch.
Trojan.Welomoch is a Trojan horse that attempts to utilize XCP software to hide W32.HLLW.Antinny, which it drops on to the compromised computer. The XCP software is installed by inserting certain Sony BMG content-protected music CDs into the computer.
Related files:
%System%\$sys$WeLoveMcCOL.exe
%System%\$sys$sos$sys$.exe
%System%\$sys$sonyTimer.exe
Read more: http://www.symantec.com/security_respons...
Kill the process $sys$sos$sys$.exe and remove $sys$sos$sys$.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

$sys$welovemccol.exe

$sys$welovemccol.exe is Trojan.Welomoch.
Trojan.Welomoch is a Trojan horse that attempts to utilize XCP software to hide W32.HLLW.Antinny, which it drops on to the compromised computer. The XCP software is installed by inserting certain Sony BMG content-protected music CDs into the computer.
Related files:
%System%\$sys$WeLoveMcCOL.exe
%System%\$sys$sos$sys$.exe
%System%\$sys$sonyTimer.exe
Read more: http://www.symantec.com/security_respons...
Kill the process $sys$welovemccol.exe and remove $sys$welovemccol.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%common files%\delsim\del.exe

%Common Files%\delsim\del.exe is Win32/Yaptaf.A.
Read more: http://ca.com/ru/securityadvisor/virusin...
Kill the process %Common Files%\delsim\del.exe and remove %Common Files%\delsim\del.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%common files%\services\svchost.exe

We suggest you to remove %Common Files%\services\svchost.exe from your computer as soon as possible.
%Common Files%\services\svchost.exe is W32/Hoxe-B.
Read more: http://www.sophos.com/security/analyses/...
Kill the process %Common Files%\services\svchost.exe and remove %Common Files%\services\svchost.exe from Windows startup.

%downloaded program files%\explorer.exe

%Downloaded Program Files%\explorer.exe is Troj/Crybot-G.
Read more: http://www.sophos.com/security/analyses/...
Kill the process %Downloaded Program Files%\explorer.exe and remove %Downloaded Program Files%\explorer.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%program files%\180search assistant\hsr.dll

%program files%\180search assistant\sachook.dll

%program files%\180search assistant\sain.exe

%program files%\180search assistant\sau.dll

%program files%\180search assistant\sauhook.dll

%program files%\2search\getst.exe

Getst.exe is a Adware.2search.
Getst.exe monitors user Internet activity.
Related files:
C:\Program Files\2Search\getst.exe
C:\Program Files\2Search\main.exe
C:\Program Files\2Search\plugin.dll
C:\Program Files\2Search\svchost.exe
%System%\007guard.exe
%System%\2searchinstaller.exe
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill getst.exe process and remove getst.exe from Windows startup using RegRun Startup Optimizer.

%program files%\2search\main.exe

Main.exe is a Adware.2search.
Main.exe monitors user Internet activity.
Related files:
C:\Program Files\2Search\getst.exe
C:\Program Files\2Search\main.exe
C:\Program Files\2Search\plugin.dll
C:\Program Files\2Search\svchost.exe
%System%\007guard.exe
%System%\2searchinstaller.exe
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill main.exe process and remove main.exe from Windows startup using RegRun Startup Optimizer.

%program files%\2search\plugin.dll

Plugin.dll is a Adware.2search.
Plugin.dll monitors user Internet activity.
Related files:
C:\Program Files\2Search\getst.exe
C:\Program Files\2Search\main.exe
C:\Program Files\2Search\plugin.dll
C:\Program Files\2Search\svchost.exe
%System%\007guard.exe
%System%\2searchinstaller.exe
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove plugin.dll from Windows startup using RegRun Startup Optimizer.

%program files%\5whgue21\5whgue21.exe

5whgue21.exe is an adware program Adware.ClearSearch.
5whgue21.exe downloads and displays advertisements.
Related files:
%Program Files%\ClearSearch\Loader.exe
%Program Files%\ClearSearch\Delete me.exe
%Program Files%\ClearSearch\CSP001.exe
%Program Files%\ClearSearch\csLDRupdater.DLL
%Program Files%\ClearSearch\csAOLinst.DLL
%Program Files%\ClearSearch\CSIE.dll
%Program Files%\ClearSearch\CSIEINST.dll
%ProgramFiles%\5whgue21\5whgue21.exe
Adds the value:
"ClrSchLoader" = "[original executable path]"
"CSV10P1" = "%ProgramFiles%\CSBB\CSP001.exe"
"5whgue21" = "%ProgramFiles%\5whgue21\5whgue21.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill 5whgue21.exe process and remove 5whgue21.exe from Windows startup using RegRun Startup Optimizer.

%program files%\acm\acmconfig.exe

ACMConfig.exe is a Spyware.ACM.
ACMConfig.exe monitors all forms of user activity on a computer.
Related files:
%ProgramFiles%\ACM\ACMConfig.exe
%ProgramFiles%\ACM\ACMDLL.dll
%ProgramFiles%\ACM\ACMService.exe
%ProgramFiles%\ACM\polarcrypto.dll
%ProgramFiles%\ACM\PolarZIPLight.dll
%ProgramFiles%\ACM\zsHook.dll
%ProgramFiles%\ACM\unins000.exe
%System%\ccrpTmr6.dll
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill ACMConfig.exe process and remove ACMConfig.exe from Windows startup using RegRun Startup Optimizer.

%program files%\acm\acmdll.dll

ACMDLL.dll is a Spyware.ACM.
ACMDLL.dll monitors all forms of user activity on a computer.
Related files:
%ProgramFiles%\ACM\ACMConfig.exe
%ProgramFiles%\ACM\ACMDLL.dll
%ProgramFiles%\ACM\ACMService.exe
%ProgramFiles%\ACM\polarcrypto.dll
%ProgramFiles%\ACM\PolarZIPLight.dll
%ProgramFiles%\ACM\zsHook.dll
%ProgramFiles%\ACM\unins000.exe
%System%\ccrpTmr6.dll
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove ACMDLL.dll from Windows startup using RegRun Startup Optimizer.

%program files%\acm\acmservice.exe

ACMService.exe is a Spyware.ACM.
ACMService.exe monitors all forms of user activity on a computer.
Related files:
%ProgramFiles%\ACM\ACMConfig.exe
%ProgramFiles%\ACM\ACMDLL.dll
%ProgramFiles%\ACM\ACMService.exe
%ProgramFiles%\ACM\polarcrypto.dll
%ProgramFiles%\ACM\PolarZIPLight.dll
%ProgramFiles%\ACM\zsHook.dll
%ProgramFiles%\ACM\unins000.exe
%System%\ccrpTmr6.dll
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill ACMService.exe process and remove ACMService.exe from Windows startup using RegRun Startup Optimizer.

%program files%\acm\zshook.dll

zsHook.dll is a Spyware.ACM.
zsHook.dll monitors all forms of user activity on a computer.
Related files:
%ProgramFiles%\ACM\ACMConfig.exe
%ProgramFiles%\ACM\ACMDLL.dll
%ProgramFiles%\ACM\ACMService.exe
%ProgramFiles%\ACM\polarcrypto.dll
%ProgramFiles%\ACM\PolarZIPLight.dll
%ProgramFiles%\ACM\zsHook.dll
%ProgramFiles%\ACM\unins000.exe
%System%\ccrpTmr6.dll
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove zsHook.dll from Windows startup using RegRun Startup Optimizer.

%program files%\acs-style\acs.exe

acs.exe is a worm W32.Kelvir.W.
acs.exe spreads by MSN Messenger and via open network shares .
acs.exe tries to terminate antiviral programs installed on a user computer.
acs.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%ProgramFiles%\ACS-Style\rxBot.exe
%ProgramFiles%\ACS-Style\acs.exe
%system%\winsystem32xp.exe
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill acs.exe process and remove acs.exe from Windows startup using RegRun Startup Optimizer.

%program files%\activity keylogger\actik.exe

%program files%\activity keylogger\akeylogger.exe

%program files%\activity keylogger\hidden.dll

%program files%\activity logger\alaware.dll

%program files%\activity logger\alogcfg.exe

%program files%\activity logger\alogger.exe

%program files%\activity logger\alsys.exe

%program files%\activity logger\emailer.dll

%program files%\activity logger\logexp.dll

%program files%\activity logger\mfc42.dll

%program files%\activity logger\msvcrt.dll

%program files%\activity logger\slgrl.dll

%program files%\activity logger\swkbhkl.dll

%program files%\actual spy\actualspy.exe

ActualSpy.exe is a Spyware.ActualSpy.
ActualSpy.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%ProgramFiles%\Actual Spy\ActualSpy.chm
%ProgramFiles%\Actual Spy\ActualSpy.exe
%ProgramFiles%\Actual Spy\FILE_ID.DIZ
%ProgramFiles%\Actual Spy\hkdll.dll
%ProgramFiles%\Actual Spy\hprog.dll
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill ActualSpy.exe process and remove ActualSpy.exe from Windows startup using RegRun Startup Optimizer.

%program files%\actual spy\hkdll.dll

Hkdll.dll is a Spyware.ActualSpy.
Hkdll.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%ProgramFiles%\Actual Spy\ActualSpy.chm
%ProgramFiles%\Actual Spy\ActualSpy.exe
%ProgramFiles%\Actual Spy\FILE_ID.DIZ
%ProgramFiles%\Actual Spy\hkdll.dll
%ProgramFiles%\Actual Spy\hprog.dll
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove hkdll.dll from Windows startup using RegRun Startup Optimizer.

%program files%\actual spy\hprog.dll

Hprog.dll is a Spyware.ActualSpy.
Hprog.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%ProgramFiles%\Actual Spy\ActualSpy.chm
%ProgramFiles%\Actual Spy\ActualSpy.exe
%ProgramFiles%\Actual Spy\FILE_ID.DIZ
%ProgramFiles%\Actual Spy\hkdll.dll
%ProgramFiles%\Actual Spy\hprog.dll
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove hprog.dll from Windows startup using RegRun Startup Optimizer.

%program files%\adobe\acrobat.exe

%PROGRAM FILES%\Adobe\acrobat.exe is Trojan.Mdropper.V.
Related files:
%Temp%\ahah.exe - detected as Trojan.Dropper
%Temp%\sav.exe - detected as Backdoor.Trojan
%Temp%\temp.doc - a clean Microsoft Word file
C:\Program Files\Adobe\acrobat.exe - identical to %Temp%\sav.exe
Read more: http://www.symantec.com/enterprise/secur...
Kill the process %PROGRAM FILES%\Adobe\acrobat.exe and remove %PROGRAM FILES%\Adobe\acrobat.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%program files%\adstatcomm.dll

AdStatComm.dll is an adware program Adware.WinTaskAd.
AdStatComm.dll downloads and displays advertisements.
Related files:
%ProgramFiles%\AdStatServ.exe
%ProgramFiles%\AdStatKeep.exe
%ProgramFiles%\AdStatComm.dll
%ProgramFiles%\PrevAdComm.dll
%ProgramFiles%\WinTaskAd.exe
%ProgramFiles%\WinSched.exe
%ProgramFiles%\WinProject.dll
%Windir%\Temp\creditdan_WinTaskAdInstPack.exe
Adds the value:
"Windows TaskAd" = "[path to Adware.WinTaskAd]"
"AdStatus Service" = "[path to Adware.WinTaskAd]"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove AdStatComm.dll from Windows startup using RegRun Startup Optimizer.

%program files%\advsearch\cliner.exe

%program files%\advsearch\finddll.dll

%program files%\advsearch\mailbook.exe

%program files%\advsearch\mailbookproxy.dll

%program files%\advsearch\mydll.dll

%program files%\advsearch\nn7dll.dll

%program files%\advsearch\nndll.dll

%program files%\advsearch\spredirect.dll

%program files%\advsearch\updater.exe

%program files%\advsearch\updaterproxy.dll

%program files%\aolx\as.exe

As.exe is a Backdoor W32.Allim.B.
As.exe spreads through America Online Instant Messenger (AIM).
As.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%ProgramFiles%\aolx\as.exe
%ProgramFiles%\aolx\proto.exe
%System%\procmsg.exe
Adds the value:
"Windows Generic Proc" = "procmsg.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill as.exe process and remove as.exe from Windows startup using RegRun Startup Optimizer.

%program files%\appstraka\appstraka.exe

AppsTraka.exe is a Spyware.AppsTraka.
AppsTraka.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Userprofile%\Start Menu\Programs\AppsTraka\AppsTraka.lnk
%Userprofile%\Desktop\AppsTraka.lnk
%ProgramFiles%\AppsTraka\AppsTraka.exe
%ProgramFiles%\AppsTraka\Appstraka.html
%ProgramFiles%\AppsTraka\Register.html
%ProgramFiles%\AppsTraka\unins000.dat
%ProgramFiles%\AppsTraka\unins000.exe
%System%\Akeylg32.dll
%System%\Appdlg32.dll
appstraka316.exe
Adds the value:
"ATSpooler" = ""C:\Program Files\AppsTraka\AppsTraka.exe" /r"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill AppsTraka.exe process and remove AppsTraka.exe from Windows startup using RegRun Startup Optimizer.

%program files%\appstraka\unins000.exe

unins000.exe is a Spyware.AppsTraka.
unins000.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Userprofile%\Start Menu\Programs\AppsTraka\AppsTraka.lnk
%Userprofile%\Desktop\AppsTraka.lnk
%ProgramFiles%\AppsTraka\AppsTraka.exe
%ProgramFiles%\AppsTraka\Appstraka.html
%ProgramFiles%\AppsTraka\Register.html
%ProgramFiles%\AppsTraka\unins000.dat
%ProgramFiles%\AppsTraka\unins000.exe
%System%\Akeylg32.dll
%System%\Appdlg32.dll
appstraka316.exe
Adds the value:
"ATSpooler" = ""C:\Program Files\AppsTraka\AppsTraka.exe" /r"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill unins000.exe process and remove unins000.exe from Windows startup using RegRun Startup Optimizer.

%program files%\archive.exe

Archive.exe is a Trojan.Dloadr-ABP.
Archive.exe opens a back door.
Archive.exe downloads code from the internet.
Related files:
%Program Files%\Archive\Archive.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill Archive.exe process and remove Archive.exe from Windows startup using RegRun Startup Optimizer.

%program files%\ardamax keylogger\il.dll

il.dll is a Spyware.Ardakey.B..
il.dll logs keystrokes.
Related files:
%ProgramFiles%\Ardamax Keylogger\AKL.exe
%ProgramFiles%\Ardamax Keylogger\AKV.exe
%ProgramFiles%\Ardamax Keylogger\kh.dll
%ProgramFiles%\Ardamax Keylogger\il.dll
Adds the value:
"Ardamax Keylogger" = "%ProgramFiles%\Ardamax Keylogger\akl.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove il.dll from Windows startup using RegRun Startup Optimizer.

%program files%\ardamax keylogger\kh.dll

kh.dll is a Spyware.Ardakey.B..
kh.dll logs keystrokes.
Related files:
%ProgramFiles%\Ardamax Keylogger\AKL.exe
%ProgramFiles%\Ardamax Keylogger\AKV.exe
%ProgramFiles%\Ardamax Keylogger\kh.dll
%ProgramFiles%\Ardamax Keylogger\il.dll
Adds the value:
"Ardamax Keylogger" = "%ProgramFiles%\Ardamax Keylogger\akl.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove kh.dll from Windows startup using RegRun Startup Optimizer.

%program files%\asys\stb.exe

Stb.exe is a Trojan.Cmapp.
Stb.exe downloads and display advertisements.
Stb.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%ProgramFiles%\CMAPP\cmappstub.exe
%ProgramFiles%\CMAPP\Client\cmappclient.exe
%ProgramFiles%\CMAPP\Client\cmappmf.dll
%ProgramFiles%\asys\Stb.exe
%ProgramFiles%\asys\VFX8.0-1.exe
%Windir%\sysnet.exe
%Windir%\snuninst.exe
%Windir%\svc.exe
%Windir%\visfxun.exe
%UserProfile%\Local Settings\Temp\cmappsetup.exe
Adds the value:
"CMAPP" = ""%ProgramFiles%\CMAPP\Client\cmappclient.exe""
"Sysnet" = "%Windir%\sysnet.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill Stb.exe process and remove Stb.exe from Windows startup using RegRun Startup Optimizer.

%program files%\asys\vfx8.0-1.exe

VFX8.0-1.exe is a Trojan.Cmapp.
VFX8.0-1.exe downloads and display advertisements.
VFX8.0-1.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%ProgramFiles%\CMAPP\cmappstub.exe
%ProgramFiles%\CMAPP\Client\cmappclient.exe
%ProgramFiles%\CMAPP\Client\cmappmf.dll
%ProgramFiles%\asys\Stb.exe
%ProgramFiles%\asys\VFX8.0-1.exe
%Windir%\sysnet.exe
%Windir%\snuninst.exe
%Windir%\svc.exe
%Windir%\visfxun.exe
%UserProfile%\Local Settings\Temp\cmappsetup.exe
Adds the value:
"CMAPP" = ""%ProgramFiles%\CMAPP\Client\cmappclient.exe""
"Sysnet" = "%Windir%\sysnet.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill VFX8.0-1.exe process and remove VFX8.0-1.exe from Windows startup using RegRun Startup Optimizer.

%program files%\auto keylogger\kbhook4.dll

%program files%\auto keylogger\kl.exe

%program files%\auto keylogger\klkernel.exe

%program files%\autosearch.dll

Autosearch.dll is a mass-mailing worm Adware.YellowPages.
Autosearch.dll installs an Internet Explorer toolbar.
Related files:
%ProgramFiles%\Autosearch.dll
Adds the value:
"windump"="%ProgramFiles%\autosearch.dll"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove Autosearch.dll from Windows startup using RegRun Startup Optimizer.

%program files%\autoupdate\autoupdate.exe

%program files%\bazookabar\activewin32.exe

ActiveWin32.exe is a Spyware.Bazookabar.
ActiveWin32.exe monitors user Internet activity.
Related files:
%ProgramFiles%\BazookaBar\ActiveWin32.exe
%ProgramFiles%\BazookaBar\Bar.exe
%ProgramFiles%\BazookaBar\BazookaBar.exe
%ProgramFiles%\BazookaBar\CloseExplorer.exe
%ProgramFiles%\BazookaBar\CloseExploreru.exe
%ProgramFiles%\BazookaBar\RegMfc.exe
%ProgramFiles%\BazookaBar\userstararticsbar.dll
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill ActiveWin32.exe process and remove ActiveWin32.exe from Windows startup using RegRun Startup Optimizer.

%program files%\bazookabar\bar.exe

Bar.exe is a Spyware.Bazookabar.
Bar.exe monitors user Internet activity.
Related files:
%ProgramFiles%\BazookaBar\ActiveWin32.exe
%ProgramFiles%\BazookaBar\Bar.exe
%ProgramFiles%\BazookaBar\BazookaBar.exe
%ProgramFiles%\BazookaBar\CloseExplorer.exe
%ProgramFiles%\BazookaBar\CloseExploreru.exe
%ProgramFiles%\BazookaBar\RegMfc.exe
%ProgramFiles%\BazookaBar\userstararticsbar.dll
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill Bar.exe process and remove Bar.exe from Windows startup using RegRun Startup Optimizer.

%program files%\bazookabar\bazookabar.exe

BazookaBar.exe is a Spyware.Bazookabar.
BazookaBar.exe monitors user Internet activity.
Related files:
%ProgramFiles%\BazookaBar\ActiveWin32.exe
%ProgramFiles%\BazookaBar\Bar.exe
%ProgramFiles%\BazookaBar\BazookaBar.exe
%ProgramFiles%\BazookaBar\CloseExplorer.exe
%ProgramFiles%\BazookaBar\CloseExploreru.exe
%ProgramFiles%\BazookaBar\RegMfc.exe
%ProgramFiles%\BazookaBar\userstararticsbar.dll
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill BazookaBar.exe process and remove BazookaBar.exe from Windows startup using RegRun Startup Optimizer.

%program files%\bazookabar\regmfc.exe

RegMfc.exe is a Spyware.Bazookabar.
RegMfc.exe monitors user Internet activity.
Related files:
%ProgramFiles%\BazookaBar\ActiveWin32.exe
%ProgramFiles%\BazookaBar\Bar.exe
%ProgramFiles%\BazookaBar\BazookaBar.exe
%ProgramFiles%\BazookaBar\CloseExplorer.exe
%ProgramFiles%\BazookaBar\CloseExploreru.exe
%ProgramFiles%\BazookaBar\RegMfc.exe
%ProgramFiles%\BazookaBar\userstararticsbar.dll
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill RegMfc.exe process and remove RegMfc.exe from Windows startup using RegRun Startup Optimizer.

%program files%\bazookabar\userstararticsbar.dll

userstararticsbar.dll is a Spyware.Bazookabar.
userstararticsbar.dll monitors user Internet activity.
Related files:
%ProgramFiles%\BazookaBar\ActiveWin32.exe
%ProgramFiles%\BazookaBar\Bar.exe
%ProgramFiles%\BazookaBar\BazookaBar.exe
%ProgramFiles%\BazookaBar\CloseExplorer.exe
%ProgramFiles%\BazookaBar\CloseExploreru.exe
%ProgramFiles%\BazookaBar\RegMfc.exe
%ProgramFiles%\BazookaBar\userstararticsbar.dll
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove userstararticsbar.dll from Windows startup using RegRun Startup Optimizer.

%program files%\bifrost\server.exe

%PROGRAM FILES%\Bifrost\server.exe is Backdoor.Bifrose.I.
Related files:
%ProgramFiles%\Bifrost\server.exe
%ProgramFiles%\Bifrost\klog.dat
Backdoor.Bifrose.I is a Trojan horse that opens a back door on the compromised computer.
Read more: http://www.symantec.com/enterprise/secur...
Kill the process %PROGRAM FILES%\Bifrost\server.exe and remove %PROGRAM FILES%\Bifrost\server.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%program files%\blackbox7\class0117.exe

Class0117.exe is a Spyware.Blackbox.
Class0117.exe monitors user Internet activity.
Related files:
%ProgramFiles%\Blackbox7\class0117.exe
%ProgramFiles%\Blackbox7\Console.exe
%ProgramFiles%\Blackbox7\Dll\integ.dll
%ProgramFiles%\Blackbox7\Dll\Ldll.dll
%ProgramFiles%\Blackbox7\Dll\sysclass.dll
Adds the value:
"Registry" = "C:\Program Files\Blackbox7\class0117.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill class0117.exe process and remove class0117.exe from Windows startup using RegRun Startup Optimizer.

%program files%\blackbox7\console.exe

Console.exe is a Spyware.Blackbox.
Console.exe monitors user Internet activity.
Related files:
%ProgramFiles%\Blackbox7\class0117.exe
%ProgramFiles%\Blackbox7\Console.exe
%ProgramFiles%\Blackbox7\Dll\integ.dll
%ProgramFiles%\Blackbox7\Dll\Ldll.dll
%ProgramFiles%\Blackbox7\Dll\sysclass.dll
Adds the value:
"Registry" = "C:\Program Files\Blackbox7\class0117.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill Console.exe process and remove Console.exe from Windows startup using RegRun Startup Optimizer.

%program files%\blackbox7\dll\integ.dll

integ.dll is a Spyware.Blackbox.
integ.dll monitors user Internet activity.
Related files:
%ProgramFiles%\Blackbox7\class0117.exe
%ProgramFiles%\Blackbox7\Console.exe
%ProgramFiles%\Blackbox7\Dll\integ.dll
%ProgramFiles%\Blackbox7\Dll\Ldll.dll
%ProgramFiles%\Blackbox7\Dll\sysclass.dll
Adds the value:
"Registry" = "C:\Program Files\Blackbox7\class0117.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove integ.dll from Windows startup using RegRun Startup Optimizer.

%program files%\blackbox7\dll\ldll.dll

Ldll.dll is a Spyware.Blackbox.
Ldll.dll monitors user Internet activity.
Related files:
%ProgramFiles%\Blackbox7\class0117.exe
%ProgramFiles%\Blackbox7\Console.exe
%ProgramFiles%\Blackbox7\Dll\integ.dll
%ProgramFiles%\Blackbox7\Dll\Ldll.dll
%ProgramFiles%\Blackbox7\Dll\sysclass.dll
Adds the value:
"Registry" = "C:\Program Files\Blackbox7\class0117.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove Ldll.dll from Windows startup using RegRun Startup Optimizer.

%program files%\blackbox7\dll\sysclass.dll

Sysclass.dll is a Spyware.Blackbox.
Sysclass.dll monitors user Internet activity.
Related files:
%ProgramFiles%\Blackbox7\class0117.exe
%ProgramFiles%\Blackbox7\Console.exe
%ProgramFiles%\Blackbox7\Dll\integ.dll
%ProgramFiles%\Blackbox7\Dll\Ldll.dll
%ProgramFiles%\Blackbox7\Dll\sysclass.dll
Adds the value:
"Registry" = "C:\Program Files\Blackbox7\class0117.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove sysclass.dll from Windows startup using RegRun Startup Optimizer.

%program files%\browser pal\adblck.dll

Adblck.dll is an adware program Adware.BrowserPal.
Adblck.dll is a Browser Helper Object.
Bp.exe downloads and displays advertisements.
Related files:
browserpal.exe
%ProgramFiles%\Browser Pal\adblck.dll
%ProgramFiles%\Browser Pal\adblck.exe
%ProgramFiles%\Browser Pal\BABarWnd.dll
%ProgramFiles%\Browser Pal\blckbho.dll
%ProgramFiles%\Browser Pal\blckhk.dll
%ProgramFiles%\Browser Pal\bp.exe
%ProgramFiles%\Browser Pal\bptlb.dll
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove adblck.dll from Windows startup using RegRun Startup Optimizer.

%program files%\browser pal\adblck.exe

Adblck.exe is an adware program Adware.BrowserPal.
Adblck.exe is a Browser Helper Object.
Adblck.exe downloads and displays advertisements.
Related files:
browserpal.exe
%ProgramFiles%\Browser Pal\adblck.dll
%ProgramFiles%\Browser Pal\adblck.exe
%ProgramFiles%\Browser Pal\BABarWnd.dll
%ProgramFiles%\Browser Pal\blckbho.dll
%ProgramFiles%\Browser Pal\blckhk.dll
%ProgramFiles%\Browser Pal\bp.exe
%ProgramFiles%\Browser Pal\bptlb.dll
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill adblck.exe process and remove adblck.exe from Windows startup using RegRun Startup Optimizer.

%program files%\browser pal\babarwnd.dll

BABarWnd.dll is an adware program Adware.BrowserPal.
BABarWnd.dll is a Browser Helper Object.
BABarWnd.dll downloads and displays advertisements.
Related files:
browserpal.exe
%ProgramFiles%\Browser Pal\adblck.dll
%ProgramFiles%\Browser Pal\adblck.exe
%ProgramFiles%\Browser Pal\BABarWnd.dll
%ProgramFiles%\Browser Pal\blckbho.dll
%ProgramFiles%\Browser Pal\blckhk.dll
%ProgramFiles%\Browser Pal\bp.exe
%ProgramFiles%\Browser Pal\bptlb.dll
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove BABarWnd.dll from Windows startup using RegRun Startup Optimizer.

%program files%\browser pal\blckbho.dll

Blckbho.dll is an adware program Adware.BrowserPal.
Blckbho.dll is a Browser Helper Object.
Blckbho.dll downloads and displays advertisements.
Related files:
browserpal.exe
%ProgramFiles%\Browser Pal\adblck.dll
%ProgramFiles%\Browser Pal\adblck.exe
%ProgramFiles%\Browser Pal\BABarWnd.dll
%ProgramFiles%\Browser Pal\blckbho.dll
%ProgramFiles%\Browser Pal\blckhk.dll
%ProgramFiles%\Browser Pal\bp.exe
%ProgramFiles%\Browser Pal\bptlb.dll
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove blckbho.dll from Windows startup using RegRun Startup Optimizer.

%program files%\browser pal\blckhk.dll

Blckhk.dll is an adware program Adware.BrowserPal.
Blckhk.dll is a Browser Helper Object.
Blckhk.dll downloads and displays advertisements.
Related files:
browserpal.exe
%ProgramFiles%\Browser Pal\adblck.dll
%ProgramFiles%\Browser Pal\adblck.exe
%ProgramFiles%\Browser Pal\BABarWnd.dll
%ProgramFiles%\Browser Pal\blckbho.dll
%ProgramFiles%\Browser Pal\blckhk.dll
%ProgramFiles%\Browser Pal\bp.exe
%ProgramFiles%\Browser Pal\bptlb.dll
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove blckhk.dll from Windows startup using RegRun Startup Optimizer.

%program files%\browser pal\bp.exe

Bp.exe is an adware program Adware.BrowserPal.
Bp.exe is a Browser Helper Object.
Bp.exe downloads and displays advertisements.
Related files:
browserpal.exe
%ProgramFiles%\Browser Pal\adblck.dll
%ProgramFiles%\Browser Pal\adblck.exe
%ProgramFiles%\Browser Pal\BABarWnd.dll
%ProgramFiles%\Browser Pal\blckbho.dll
%ProgramFiles%\Browser Pal\blckhk.dll
%ProgramFiles%\Browser Pal\bp.exe
%ProgramFiles%\Browser Pal\bptlb.dll
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill bp.exe process and remove bp.exe from Windows startup using RegRun Startup Optimizer.

%program files%\browser pal\bptlb.dll

Bptlb.dll is an adware program Adware.BrowserPal.
Bptlb.dll is a Browser Helper Object.
Bptlb.dll downloads and displays advertisements.
Related files:
browserpal.exe
%ProgramFiles%\Browser Pal\adblck.dll
%ProgramFiles%\Browser Pal\adblck.exe
%ProgramFiles%\Browser Pal\BABarWnd.dll
%ProgramFiles%\Browser Pal\blckbho.dll
%ProgramFiles%\Browser Pal\blckhk.dll
%ProgramFiles%\Browser Pal\bp.exe
%ProgramFiles%\Browser Pal\bptlb.dll
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove bptlb.dll from Windows startup using RegRun Startup Optimizer.

%program files%\btv\breg_inst.exe

Breg_inst.exe is a mass-mailing worm .
Breg_inst.exe monitors user Internet activity.
Breg_inst.exe displays advertising information.
Related files:
%ProgramFiles%\BTV\btv.exe
%ProgramFiles%\BTV\breg_inst.exe
%ProgramFiles%\BTV\btvclean.exe
%ProgramFiles%\Common Files\Java\breg.cfg
%ProgramFiles%\Common Files\Java\breg.exe
Adds the value:
"BTV"="%ProgramFiles%\BTV\btv.exe"
"Breg"="%ProgramFiles%\Common Files\Java\breg.exe"
"BtvC"="%ProgramFiles%\BTV\btvclean.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill breg_inst.exe process and remove breg_inst.exe from Windows startup using RegRun Startup Optimizer.

%program files%\btv\btv.exe

Btv.exe is a mass-mailing worm .
Btv.exe monitors user Internet activity.
Btv.exe displays advertising information.
Related files:
%ProgramFiles%\BTV\btv.exe
%ProgramFiles%\BTV\breg_inst.exe
%ProgramFiles%\BTV\btvclean.exe
%ProgramFiles%\Common Files\Java\breg.cfg
%ProgramFiles%\Common Files\Java\breg.exe
Adds the value:
"BTV"="%ProgramFiles%\BTV\btv.exe"
"Breg"="%ProgramFiles%\Common Files\Java\breg.exe"
"BtvC"="%ProgramFiles%\BTV\btvclean.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill btv.exe process and remove btv.exe from Windows startup using RegRun Startup Optimizer.

%program files%\btv\btvclean.exe

Btvclean.exe is a mass-mailing worm .
Btvclean.exe monitors user Internet activity.
Btvclean.exe displays advertising information.
Related files:
%ProgramFiles%\BTV\btv.exe
%ProgramFiles%\BTV\breg_inst.exe
%ProgramFiles%\BTV\btvclean.exe
%ProgramFiles%\Common Files\Java\breg.cfg
%ProgramFiles%\Common Files\Java\breg.exe
Adds the value:
"BTV"="%ProgramFiles%\BTV\btv.exe"
"Breg"="%ProgramFiles%\Common Files\Java\breg.exe"
"BtvC"="%ProgramFiles%\BTV\btvclean.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill btvclean.exe process and remove btvclean.exe from Windows startup using RegRun Startup Optimizer.

%program files%\buddylinks.net\blpref.exe

Blpref.exe is an adware program Adware.Buddylinks.
Blpref.exe spreads by AOL Instant Messenger.
Blpref.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%ProgramFiles%\buddylinks.net\Blpref.exe
%ProgramFiles%\Common Files\PSD Tools\ChannelUp.exe
%ProgramFiles%\Common Files\PSD Tools\Blaim.dll
%ProgramFiles%\Common Files\PSD Tools\Blengine.dll
%ProgramFiles%\Common Files\PSD Tools\Blengine.exe
%ProgramFiles%\Common Files\PSD Tools\Bldll.exe
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill Blpref.exe process and remove Blpref.exe from Windows startup using RegRun Startup Optimizer.

%program files%\bullseye network\bin\adv.exe

adv.exe is an adware program Adware.BargainBuddy.
adv.exe downloads and displays advertisements.
Related files:
Apuc.dll;
Autoheal.exe
%System%\angelex.exe
%System%\instsrv.exe
%System%\msexreg.exe
%System%\bbchk.exe
%System%\exclean.exe
%System%\exdl.exe
%System%\exdl0.exe
%System%\exdl1.exe
%System%\exul.exe
%System%\msbe.dll
%System%\msxct.exe
%ProgramFiles%\BullsEye Network\bin\adv.exe
%ProgramFiles%\BullsEye Network\bin\adx.exe
%ProgramFiles%\BullsEye Network\bin\bargains.exe
%ProgramFiles%\BullsEye Network\Uninstall.exe
%Windows%\bbchk.exe
%Windows%\exclean.exe
%Windows%\exdl.exe
%Windows%\exul.exe
%Windows%\msbe.dll
%Windows%\msxct.exe
%Windows%\zeta.exe
Adds the value:
"[File name of adware]" = "[File path to adware]"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill adv.exe process and remove adv.exe from Windows startup using RegRun Startup Optimizer.

%program files%\bullseye network\bin\adx.exe

Adx.exe is an adware program Adware.BargainBuddy.
Adx.exe downloads and displays advertisements.
Related files:
Apuc.dll;
Autoheal.exe
%System%\angelex.exe
%System%\instsrv.exe
%System%\msexreg.exe
%System%\bbchk.exe
%System%\exclean.exe
%System%\exdl.exe
%System%\exdl0.exe
%System%\exdl1.exe
%System%\exul.exe
%System%\msbe.dll
%System%\msxct.exe
%ProgramFiles%\BullsEye Network\bin\adv.exe
%ProgramFiles%\BullsEye Network\bin\adx.exe
%ProgramFiles%\BullsEye Network\bin\bargains.exe
%ProgramFiles%\BullsEye Network\Uninstall.exe
%Windows%\bbchk.exe
%Windows%\exclean.exe
%Windows%\exdl.exe
%Windows%\exul.exe
%Windows%\msbe.dll
%Windows%\msxct.exe
%Windows%\zeta.exe
Adds the value:
"[File name of adware]" = "[File path to adware]"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill adx.exe process and remove adx.exe from Windows startup using RegRun Startup Optimizer.

%program files%\calorie-count.com toolbar\toolbar.dll

%PROGRAM FILES%\Calorie-Count.com Toolbar\toolbar.dll is Calorie-Count.com Toolbar by Conduit/EffectiveBrand.
Read more: http://www.castlecops.com/tk31159-Calori...
Kill the file %PROGRAM FILES%\Calorie-Count.com Toolbar\toolbar.dll and remove %PROGRAM FILES%\Calorie-Count.com Toolbar\toolbar.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

%program files%\cas\client\casmf.dll

Casmf.dll is an adware program Adware.CasinoClient.
Casmf.dll displays advertisements.
Casmf.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%ProgramFiles%\Cas\Client\casclient.exe
%ProgramFiles%\Cas\Client\casmf.dll
%ProgramFiles%\CasStub\casstub.exe
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove casmf.dll from Windows startup using RegRun Startup Optimizer.

%program files%\casstub\casstub.exe

Casstub.exe is an adware program Adware.CasinoClient.
Casstub.exe displays advertisements.
Casstub.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%ProgramFiles%\Cas\Client\casclient.exe
%ProgramFiles%\Cas\Client\casmf.dll
%ProgramFiles%\CasStub\casstub.exe
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill casstub.exe process and remove casstub.exe from Windows startup using RegRun Startup Optimizer.

%program files%\catcher.dll

Catcher.dll is an adware program Adware.Shorty.
Catcher.dll is a Browser Helper Object.
Catcher.dll monitors user Internet activity.
Related files:
CommonProgramFiles%\services.exe
%CommonProgramFiles%\system32.dll
%Temp%\version.txt
%ProgramFiles%\Catcher.dll
%ProgramFiles%\gui.exe
%ProgramFiles%\cwebpage.dll
%ProgramFiles%\version.txt
%ProgramFiles%\x.bmp
%ProgramFiles%\*.dat
Adds the value:
"DNS" = "%CommonProgramFiles%\[FILE NAME].exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove Catcher.dll from Windows startup using RegRun Startup Optimizer.

%program files%\chironexsoftware\browserspy\browserspy.dll

BrowserSpy.dll is a Spyware.BrowserSpy.
BrowserSpy.dll is an Internet Explorer spy utility.
BrowserSpy.dll monitors user Internet activity.
Related files:
%ProgramFiles%\ChironexSoftware\BrowserSpy\BrowserSpy.dll
%ProgramFiles%\ChironexSoftware\BrowserSpy\SciLexer.dll
Adds the value:
"SciLexer"="%ProgramFiles%\ChironexSoftware\BrowserSpy\SciLexer.dll"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove BrowserSpy.dll from Windows startup using RegRun Startup Optimizer.

%program files%\chironexsoftware\browserspy\scilexer.dll

SciLexer.dll is a Spyware.BrowserSpy.
SciLexer.dll is an Internet Explorer spy utility.
SciLexer.dll monitors user Internet activity.
Related files:
%ProgramFiles%\ChironexSoftware\BrowserSpy\BrowserSpy.dll
%ProgramFiles%\ChironexSoftware\BrowserSpy\SciLexer.dll
Adds the value:
"SciLexer"="%ProgramFiles%\ChironexSoftware\BrowserSpy\SciLexer.dll"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove SciLexer.dll from Windows startup using RegRun Startup Optimizer.

%program files%\clearsearch\csaolinst.dll

csAOLinst.DLL is an adware program Adware.ClearSearch.
csAOLinst.DLL downloads and displays advertisements.
Related files:
%Program Files%\ClearSearch\Loader.exe
%Program Files%\ClearSearch\Delete me.exe
%Program Files%\ClearSearch\CSP001.exe
%Program Files%\ClearSearch\csLDRupdater.DLL
%Program Files%\ClearSearch\csAOLinst.DLL
%Program Files%\ClearSearch\CSIE.dll
%Program Files%\ClearSearch\CSIEINST.dll
%ProgramFiles%\5whgue21\5whgue21.exe
Adds the value:
"ClrSchLoader" = "[original executable path]"
"CSV10P1" = "%ProgramFiles%\CSBB\CSP001.exe"
"5whgue21" = "%ProgramFiles%\5whgue21\5whgue21.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove csAOLinst.DLL from Windows startup using RegRun Startup Optimizer.

%program files%\clearsearch\csie.dll

CSIE.dll is an adware program Adware.ClearSearch.
CSIE.dll downloads and displays advertisements.
Related files:
%Program Files%\ClearSearch\Loader.exe
%Program Files%\ClearSearch\Delete me.exe
%Program Files%\ClearSearch\CSP001.exe
%Program Files%\ClearSearch\csLDRupdater.DLL
%Program Files%\ClearSearch\csAOLinst.DLL
%Program Files%\ClearSearch\CSIE.dll
%Program Files%\ClearSearch\CSIEINST.dll
%ProgramFiles%\5whgue21\5whgue21.exe
Adds the value:
"ClrSchLoader" = "[original executable path]"
"CSV10P1" = "%ProgramFiles%\CSBB\CSP001.exe"
"5whgue21" = "%ProgramFiles%\5whgue21\5whgue21.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove CSIE.dll from Windows startup using RegRun Startup Optimizer.

%program files%\clearsearch\csieinst.dll

CSIEINST.dll is an adware program Adware.ClearSearch.
CSIEINST.dll downloads and displays advertisements.
Related files:
%Program Files%\ClearSearch\Loader.exe
%Program Files%\ClearSearch\Delete me.exe
%Program Files%\ClearSearch\CSP001.exe
%Program Files%\ClearSearch\csLDRupdater.DLL
%Program Files%\ClearSearch\csAOLinst.DLL
%Program Files%\ClearSearch\CSIE.dll
%Program Files%\ClearSearch\CSIEINST.dll
%ProgramFiles%\5whgue21\5whgue21.exe
Adds the value:
"ClrSchLoader" = "[original executable path]"
"CSV10P1" = "%ProgramFiles%\CSBB\CSP001.exe"
"5whgue21" = "%ProgramFiles%\5whgue21\5whgue21.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove CSIEINST.dll from Windows startup using RegRun Startup Optimizer.

%program files%\clearsearch\csldrupdater.dll

csLDRupdater.DLL is an adware program Adware.ClearSearch.
csLDRupdater.DLL downloads and displays advertisements.
Related files:
%Program Files%\ClearSearch\Loader.exe
%Program Files%\ClearSearch\Delete me.exe
%Program Files%\ClearSearch\CSP001.exe
%Program Files%\ClearSearch\csLDRupdater.DLL
%Program Files%\ClearSearch\csAOLinst.DLL
%Program Files%\ClearSearch\CSIE.dll
%Program Files%\ClearSearch\CSIEINST.dll
%ProgramFiles%\5whgue21\5whgue21.exe
Adds the value:
"ClrSchLoader" = "[original executable path]"
"CSV10P1" = "%ProgramFiles%\CSBB\CSP001.exe"
"5whgue21" = "%ProgramFiles%\5whgue21\5whgue21.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove csLDRupdater.DLL from Windows startup using RegRun Startup Optimizer.

%program files%\clearsearch\csp001.exe

CSP001.exe is an adware program Adware.ClearSearch.
CSP001.exe downloads and displays advertisements.
Related files:
%Program Files%\ClearSearch\Loader.exe
%Program Files%\ClearSearch\Delete me.exe
%Program Files%\ClearSearch\CSP001.exe
%Program Files%\ClearSearch\csLDRupdater.DLL
%Program Files%\ClearSearch\csAOLinst.DLL
%Program Files%\ClearSearch\CSIE.dll
%Program Files%\ClearSearch\CSIEINST.dll
%ProgramFiles%\5whgue21\5whgue21.exe
Adds the value:
"ClrSchLoader" = "[original executable path]"
"CSV10P1" = "%ProgramFiles%\CSBB\CSP001.exe"
"5whgue21" = "%ProgramFiles%\5whgue21\5whgue21.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill CSP001.exe process and remove CSP001.exe from Windows startup using RegRun Startup Optimizer.

%program files%\clearsearch\delete me.exe

Delete me.exe is an adware program Adware.ClearSearch.
Delete me.exe downloads and displays advertisements.
Related files:
%Program Files%\ClearSearch\Loader.exe
%Program Files%\ClearSearch\Delete me.exe
%Program Files%\ClearSearch\CSP001.exe
%Program Files%\ClearSearch\csLDRupdater.DLL
%Program Files%\ClearSearch\csAOLinst.DLL
%Program Files%\ClearSearch\CSIE.dll
%Program Files%\ClearSearch\CSIEINST.dll
%ProgramFiles%\5whgue21\5whgue21.exe
Adds the value:
"ClrSchLoader" = "[original executable path]"
"CSV10P1" = "%ProgramFiles%\CSBB\CSP001.exe"
"5whgue21" = "%ProgramFiles%\5whgue21\5whgue21.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill Delete me.exe process and remove Delete me.exe from Windows startup using RegRun Startup Optimizer.

%program files%\cmapp\client\cmappclient.exe

Cmappclient.exe is a Trojan.Cmapp.
Cmappclient.exe downloads and display advertisements.
Cmappclient.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%ProgramFiles%\CMAPP\cmappstub.exe
%ProgramFiles%\CMAPP\Client\cmappclient.exe
%ProgramFiles%\CMAPP\Client\cmappmf.dll
%ProgramFiles%\asys\Stb.exe
%ProgramFiles%\asys\VFX8.0-1.exe
%Windir%\sysnet.exe
%Windir%\snuninst.exe
%Windir%\svc.exe
%Windir%\visfxun.exe
%UserProfile%\Local Settings\Temp\cmappsetup.exe
Adds the value:
"CMAPP" = ""%ProgramFiles%\CMAPP\Client\cmappclient.exe""
"Sysnet" = "%Windir%\sysnet.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill cmappclient.exe process and remove cmappclient.exe from Windows startup using RegRun Startup Optimizer.

%program files%\cmapp\client\cmappmf.dll

Cmappmf.dll is a Trojan.Cmapp.
Cmappmf.dll downloads and display advertisements.
Cmappmf.dll tries to terminate antiviral programs installed on a user computer.
Related files:
%ProgramFiles%\CMAPP\cmappstub.exe
%ProgramFiles%\CMAPP\Client\cmappclient.exe
%ProgramFiles%\CMAPP\Client\cmappmf.dll
%ProgramFiles%\asys\Stb.exe
%ProgramFiles%\asys\VFX8.0-1.exe
%Windir%\sysnet.exe
%Windir%\snuninst.exe
%Windir%\svc.exe
%Windir%\visfxun.exe
%UserProfile%\Local Settings\Temp\cmappsetup.exe
Adds the value:
"CMAPP" = ""%ProgramFiles%\CMAPP\Client\cmappclient.exe""
"Sysnet" = "%Windir%\sysnet.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove cmappmf.dll from Windows startup using RegRun Startup Optimizer.

%program files%\cmapp\cmappstub.exe

Cmappstub.exe is a Trojan.Cmapp.
Cmappstub.exe downloads and display advertisements.
Cmappstub.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%ProgramFiles%\CMAPP\cmappstub.exe
%ProgramFiles%\CMAPP\Client\cmappclient.exe
%ProgramFiles%\CMAPP\Client\cmappmf.dll
%ProgramFiles%\asys\Stb.exe
%ProgramFiles%\asys\VFX8.0-1.exe
%Windir%\sysnet.exe
%Windir%\snuninst.exe
%Windir%\svc.exe
%Windir%\visfxun.exe
%UserProfile%\Local Settings\Temp\cmappsetup.exe
Adds the value:
"CMAPP" = ""%ProgramFiles%\CMAPP\Client\cmappclient.exe""
"Sysnet" = "%Windir%\sysnet.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill cmappstub.exe process and remove cmappstub.exe from Windows startup using RegRun Startup Optimizer.

%program files%\coding workshop\cnalvin.exe

Cnalvin.exe is a Spyware.PCSuperSpy.
Cnalvin.exe logs keystrokes.
Cnalvin.exe monitors user Internet activity.
Related files:
%ProgramFiles%\Coding Workshop\cnalvin.exe
%ProgramFiles%\Coding Workshop\cnalvwsi.exe
%System%\SSPng.dll
%System%\SSubTmr6.dll
%System%\vbalGrid6.ocx
%System%\vbalIml6.ocx
%System%\vbar332.dll
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill cnalvin.exe process and remove cnalvin.exe from Windows startup using RegRun Startup Optimizer.

%program files%\coding workshop\cnalvwsi.exe

Cnalvwsi.exe is a Spyware.PCSuperSpy.
Cnalvwsi.exe logs keystrokes.
Cnalvwsi.exe monitors user Internet activity.
Related files:
%ProgramFiles%\Coding Workshop\cnalvin.exe
%ProgramFiles%\Coding Workshop\cnalvwsi.exe
%System%\SSPng.dll
%System%\SSubTmr6.dll
%System%\vbalGrid6.ocx
%System%\vbalIml6.ocx
%System%\vbar332.dll
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill cnalvwsi.exe process and remove cnalvwsi.exe from Windows startup using RegRun Startup Optimizer.

%program files%\common files\installshield\driver\7\intel 32\_isres1033.dll

_ISRES1033.dll is a Spyware.PCTattletale.
_ISRES1033.dll logs keystrokes.
_ISRES1033.dll monitors user Internet activity.
Related files:
%ProgramFiles%\Common Files\InstallShield\Driver\7\Intel 32\IDriver.exe
%ProgramFiles%\Common Files\InstallShield\Driver\7\Intel 32\IScript7.dll
%ProgramFiles%\Common Files\InstallShield\Driver\7\Intel 32\ISRT.dll
%ProgramFiles%\Common Files\InstallShield\Driver\7\Intel 32\IUser7.dll
%ProgramFiles%\Common Files\InstallShield\Driver\7\Intel 32\objps7.dll
%ProgramFiles%\Common Files\InstallShield\Driver\7\Intel 32\_ISRES1033.dll
%System%\explorer32\AutoUpdate.dll
%System%\explorer32\AutoUpdateClient.exe
%System%\explorer32\chattext.dll
%System%\explorer32\msn6mngr.exe
%System%\explorer32\Netlogon.exe
%System%\explorer32\Wincmd.exe
%System%\explorer32\WinSysMngr.exe
%System%\MSN32.dll
%System%\PCTT.exe
%System%\UninstallPCTT.exe
%System%\Unzip32.dll
%System%\WinLoad.exe
%System%\zip32.dll
Adds the value:
"(default)" = ""
"WinLoad" = "%System%\Winload.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove _ISRES1033.dll from Windows startup using RegRun Startup Optimizer.

%program files%\common files\installshield\driver\7\intel 32\idriver.exe

IDriver.exe is a Spyware.PCTattletale.
IDriver.exe logs keystrokes.
IDriver.exe monitors user Internet activity.
Related files:
%ProgramFiles%\Common Files\InstallShield\Driver\7\Intel 32\IDriver.exe
%ProgramFiles%\Common Files\InstallShield\Driver\7\Intel 32\IScript7.dll
%ProgramFiles%\Common Files\InstallShield\Driver\7\Intel 32\ISRT.dll
%ProgramFiles%\Common Files\InstallShield\Driver\7\Intel 32\IUser7.dll
%ProgramFiles%\Common Files\InstallShield\Driver\7\Intel 32\objps7.dll
%ProgramFiles%\Common Files\InstallShield\Driver\7\Intel 32\_ISRES1033.dll
%System%\explorer32\AutoUpdate.dll
%System%\explorer32\AutoUpdateClient.exe
%System%\explorer32\chattext.dll
%System%\explorer32\msn6mngr.exe
%System%\explorer32\Netlogon.exe
%System%\explorer32\Wincmd.exe
%System%\explorer32\WinSysMngr.exe
%System%\MSN32.dll
%System%\PCTT.exe
%System%\UninstallPCTT.exe
%System%\Unzip32.dll
%System%\WinLoad.exe
%System%\zip32.dll
Adds the value:
"(default)" = ""
"WinLoad" = "%System%\Winload.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill IDriver.exe process and remove IDriver.exe from Windows startup using RegRun Startup Optimizer.

%program files%\common files\installshield\driver\7\intel 32\iscript7.dll

IScript7.dll is a Spyware.PCTattletale.
IScript7.dll logs keystrokes.
IScript7.dll monitors user Internet activity.
Related files:
%ProgramFiles%\Common Files\InstallShield\Driver\7\Intel 32\IDriver.exe
%ProgramFiles%\Common Files\InstallShield\Driver\7\Intel 32\IScript7.dll
%ProgramFiles%\Common Files\InstallShield\Driver\7\Intel 32\ISRT.dll
%ProgramFiles%\Common Files\InstallShield\Driver\7\Intel 32\IUser7.dll
%ProgramFiles%\Common Files\InstallShield\Driver\7\Intel 32\objps7.dll
%ProgramFiles%\Common Files\InstallShield\Driver\7\Intel 32\_ISRES1033.dll
%System%\explorer32\AutoUpdate.dll
%System%\explorer32\AutoUpdateClient.exe
%System%\explorer32\chattext.dll
%System%\explorer32\msn6mngr.exe
%System%\explorer32\Netlogon.exe
%System%\explorer32\Wincmd.exe
%System%\explorer32\WinSysMngr.exe
%System%\MSN32.dll
%System%\PCTT.exe
%System%\UninstallPCTT.exe
%System%\Unzip32.dll
%System%\WinLoad.exe
%System%\zip32.dll
Adds the value:
"(default)" = ""
"WinLoad" = "%System%\Winload.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove IScript7.dll from Windows startup using RegRun Startup Optimizer.

%program files%\common files\installshield\driver\7\intel 32\isrt.dll

ISRT.dll is a Spyware.PCTattletale.
ISRT.dll logs keystrokes.
ISRT.dll monitors user Internet activity.
Related files:
%ProgramFiles%\Common Files\InstallShield\Driver\7\Intel 32\IDriver.exe
%ProgramFiles%\Common Files\InstallShield\Driver\7\Intel 32\IScript7.dll
%ProgramFiles%\Common Files\InstallShield\Driver\7\Intel 32\ISRT.dll
%ProgramFiles%\Common Files\InstallShield\Driver\7\Intel 32\IUser7.dll
%ProgramFiles%\Common Files\InstallShield\Driver\7\Intel 32\objps7.dll
%ProgramFiles%\Common Files\InstallShield\Driver\7\Intel 32\_ISRES1033.dll
%System%\explorer32\AutoUpdate.dll
%System%\explorer32\AutoUpdateClient.exe
%System%\explorer32\chattext.dll
%System%\explorer32\msn6mngr.exe
%System%\explorer32\Netlogon.exe
%System%\explorer32\Wincmd.exe
%System%\explorer32\WinSysMngr.exe
%System%\MSN32.dll
%System%\PCTT.exe
%System%\UninstallPCTT.exe
%System%\Unzip32.dll
%System%\WinLoad.exe
%System%\zip32.dll
Adds the value:
"(default)" = ""
"WinLoad" = "%System%\Winload.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove ISRT.dll from Windows startup using RegRun Startup Optimizer.

%program files%\common files\installshield\driver\7\intel 32\iuser7.dll

IUser7.dll is a Spyware.PCTattletale.
IUser7.dll logs keystrokes.
IUser7.dll monitors user Internet activity.
Related files:
%ProgramFiles%\Common Files\InstallShield\Driver\7\Intel 32\IDriver.exe
%ProgramFiles%\Common Files\InstallShield\Driver\7\Intel 32\IScript7.dll
%ProgramFiles%\Common Files\InstallShield\Driver\7\Intel 32\ISRT.dll
%ProgramFiles%\Common Files\InstallShield\Driver\7\Intel 32\IUser7.dll
%ProgramFiles%\Common Files\InstallShield\Driver\7\Intel 32\objps7.dll
%ProgramFiles%\Common Files\InstallShield\Driver\7\Intel 32\_ISRES1033.dll
%System%\explorer32\AutoUpdate.dll
%System%\explorer32\AutoUpdateClient.exe
%System%\explorer32\chattext.dll
%System%\explorer32\msn6mngr.exe
%System%\explorer32\Netlogon.exe
%System%\explorer32\Wincmd.exe
%System%\explorer32\WinSysMngr.exe
%System%\MSN32.dll
%System%\PCTT.exe
%System%\UninstallPCTT.exe
%System%\Unzip32.dll
%System%\WinLoad.exe
%System%\zip32.dll
Adds the value:
"(default)" = ""
"WinLoad" = "%System%\Winload.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove IUser7.dll from Windows startup using RegRun Startup Optimizer.

%program files%\common files\installshield\driver\7\intel 32\objps7.dll

objps7.dll is a Spyware.PCTattletale.
objps7.dll logs keystrokes.
objps7.dll monitors user Internet activity.
Related files:
%ProgramFiles%\Common Files\InstallShield\Driver\7\Intel 32\IDriver.exe
%ProgramFiles%\Common Files\InstallShield\Driver\7\Intel 32\IScript7.dll
%ProgramFiles%\Common Files\InstallShield\Driver\7\Intel 32\ISRT.dll
%ProgramFiles%\Common Files\InstallShield\Driver\7\Intel 32\IUser7.dll
%ProgramFiles%\Common Files\InstallShield\Driver\7\Intel 32\objps7.dll
%ProgramFiles%\Common Files\InstallShield\Driver\7\Intel 32\_ISRES1033.dll
%System%\explorer32\AutoUpdate.dll
%System%\explorer32\AutoUpdateClient.exe
%System%\explorer32\chattext.dll
%System%\explorer32\msn6mngr.exe
%System%\explorer32\Netlogon.exe
%System%\explorer32\Wincmd.exe
%System%\explorer32\WinSysMngr.exe
%System%\MSN32.dll
%System%\PCTT.exe
%System%\UninstallPCTT.exe
%System%\Unzip32.dll
%System%\WinLoad.exe
%System%\zip32.dll
Adds the value:
"(default)" = ""
"WinLoad" = "%System%\Winload.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove objps7.dll from Windows startup using RegRun Startup Optimizer.

%program files%\common files\java\breg.exe

Breg.exe is a mass-mailing worm .
Breg.exe monitors user Internet activity.
Breg.exe displays advertising information.
Related files:
%ProgramFiles%\BTV\btv.exe
%ProgramFiles%\BTV\breg_inst.exe
%ProgramFiles%\BTV\btvclean.exe
%ProgramFiles%\Common Files\Java\breg.cfg
%ProgramFiles%\Common Files\Java\breg.exe
Adds the value:
"BTV"="%ProgramFiles%\BTV\btv.exe"
"Breg"="%ProgramFiles%\Common Files\Java\breg.exe"
"BtvC"="%ProgramFiles%\BTV\btvclean.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill breg.exe process and remove breg.exe from Windows startup using RegRun Startup Optimizer.

%program files%\common files\psd tools\blaim.dll

Blaim.dll is an adware program Adware.Buddylinks.
Blaim.dll spreads by AOL Instant Messenger.
Blaim.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%ProgramFiles%\buddylinks.net\Blpref.exe
%ProgramFiles%\Common Files\PSD Tools\ChannelUp.exe
%ProgramFiles%\Common Files\PSD Tools\Blaim.dll
%ProgramFiles%\Common Files\PSD Tools\Blengine.dll
%ProgramFiles%\Common Files\PSD Tools\Blengine.exe
%ProgramFiles%\Common Files\PSD Tools\Bldll.exe
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove Blaim.dll from Windows startup using RegRun Startup Optimizer.

%program files%\common files\psd tools\bldll.exe

Bldll.exe is an adware program Adware.Buddylinks.
Bldll.exe spreads by AOL Instant Messenger.
Bldll.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%ProgramFiles%\buddylinks.net\Blpref.exe
%ProgramFiles%\Common Files\PSD Tools\ChannelUp.exe
%ProgramFiles%\Common Files\PSD Tools\Blaim.dll
%ProgramFiles%\Common Files\PSD Tools\Blengine.dll
%ProgramFiles%\Common Files\PSD Tools\Blengine.exe
%ProgramFiles%\Common Files\PSD Tools\Bldll.exe
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill Bldll.exe process and remove Bldll.exe from Windows startup using RegRun Startup Optimizer.

%program files%\common files\psd tools\blengine.dll

Blengine.dll is an adware program Adware.Buddylinks.
Blengine.dll spreads by AOL Instant Messenger.
Blengine.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%ProgramFiles%\buddylinks.net\Blpref.exe
%ProgramFiles%\Common Files\PSD Tools\ChannelUp.exe
%ProgramFiles%\Common Files\PSD Tools\Blaim.dll
%ProgramFiles%\Common Files\PSD Tools\Blengine.dll
%ProgramFiles%\Common Files\PSD Tools\Blengine.exe
%ProgramFiles%\Common Files\PSD Tools\Bldll.exe
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove Blengine.dll from Windows startup using RegRun Startup Optimizer.

%program files%\common files\psd tools\blengine.exe

Blengine.exe is an adware program Adware.Buddylinks.
Blengine.exe spreads by AOL Instant Messenger.
Blengine.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%ProgramFiles%\buddylinks.net\Blpref.exe
%ProgramFiles%\Common Files\PSD Tools\ChannelUp.exe
%ProgramFiles%\Common Files\PSD Tools\Blaim.dll
%ProgramFiles%\Common Files\PSD Tools\Blengine.dll
%ProgramFiles%\Common Files\PSD Tools\Blengine.exe
%ProgramFiles%\Common Files\PSD Tools\Bldll.exe
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill Blengine.exe process and remove Blengine.exe from Windows startup using RegRun Startup Optimizer.

%program files%\common files\services.exe

Mass mailing worm W32.Crowt.
Adds the values:
"Services Logon" = "%Templates%\services.exe"
"Services Startup" = "%CommonProgramFiles%\services.exe"
to Windows startup registry keys.
%Templates% is a variable that refers to the Templates folder. By default this is C:\Documents and Settings\[user name]\Templates.
Opens a browser window displaying a Web page on the www.cnn.com domain.
Steals passwords to %Windir%\temp\keys.tmp.
Opens a backdoor by connecting to the host cocoazul.ath.cx on TCP port 80.
Allows teh remote control.
Kill it using RegRun Startup Optimizer,

%program files%\common files\system\ado\mssrv.exe

Mssrv.exe is a Trojan PWSteal.Drorar.
Mssrv.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Program Files%\Common Files\system\ado\mssrv.exe
%Program Files%\Common Files\system\svchost.exe
%Windir%\WindowsUpdate.dat
%Windir%\sclureg32a.dll
%Windir%\winsock_32a.dll
Adds the value:
"PathName" = "%Windir%\winsock_32a.dll"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill mssrv.exe process and remove mssrv.exe from Windows startup using RegRun Startup Optimizer.

%program files%\common files\systemdata\svchost.exe

%PROGRAM FILES%\Common Files\Systemdata\svchost.exe is W32.Kenety.
W32.Kenety is a worm that opens a back door on the compromised computer and spreads by exploiting the RealVNC Remote Authentication Bypass Vulnerability (BID 17978).
Read more: http://www.symantec.com/enterprise/secur...
Kill the process %PROGRAM FILES%\Common Files\Systemdata\svchost.exe and remove %PROGRAM FILES%\Common Files\Systemdata\svchost.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%program files%\common files\update\update.exe

%program files%\common files\updmgr\updmgr.exe

Adware supplied by eUniverse.com. KeenValue/v1 runs at startup, generates popup ads,
and is the original version. KeenValue/Incredifind adds capability, via a second process:
monitors web sites visited, so that ads may be targeted;

- hijacks the hosts file and redirects Netscape searches to incredifind.com;
- hijacks error pages and address bar searches to incredifind.com, which is then redirected to
sirsearch.com;
- adds an Internet Explorer toolbar providing a search field directed to sirsearch.com.
Read more:
http://pestpatrol.com/pestinfo/e/euniver...
Remove it from startup.

%program files%\cwebpage.dll

Cwebpage.dll is an adware program Adware.Shorty.
Cwebpage.dll is a Browser Helper Object.
Cwebpage.dll monitors user Internet activity.
Related files:
CommonProgramFiles%\services.exe
%CommonProgramFiles%\system32.dll
%Temp%\version.txt
%ProgramFiles%\Catcher.dll
%ProgramFiles%\gui.exe
%ProgramFiles%\cwebpage.dll
%ProgramFiles%\version.txt
%ProgramFiles%\x.bmp
%ProgramFiles%\*.dat
Adds the value:
"DNS" = "%CommonProgramFiles%\[FILE NAME].exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove cwebpage.dll from Windows startup using RegRun Startup Optimizer.

%program files%\dap\dapbho.dll

%PROGRAM FILES%\DAP\dapbho.dll is Adware.DAP.
Kill the file %PROGRAM FILES%\DAP\dapbho.dll and remove %PROGRAM FILES%\DAP\dapbho.dll from Windows startup using RegRun.
www.regrun.com
Read more: http://www.speedbit.com/Symantec_Securit...

%program files%\dashbar.dll

DashBar.dll is a spyware SPYW_DASHBAR.300.
DashBar.dll installs an Internet Explorer toolbar.
Related files:
%Program Files%\DashBar25.dll
%Program Files%\DashBarSetup.log
%Program Files%\DASHBARWEBSITE.URL
%Program Files%\DbAu.exe
%Program Files%\DashBar.dll
More info: http://www.trendmicro.com/vinfo/grayware...
Removal:
Remove DashBar.dll using RegRun "Scan for Viruses" feature.
http://www.regrun.com

%program files%\dashbar25.dll

DashBar25.dll is a spyware SPYW_DASHBAR.300.
DashBar25.dll installs an Internet Explorer toolbar.
Related files:
%Program Files%\DashBar25.dll
%Program Files%\DashBarSetup.log
%Program Files%\DASHBARWEBSITE.URL
%Program Files%\DbAu.exe
%Program Files%\DashBar.dll
More info: http://www.trendmicro.com/vinfo/grayware...
Removal:
Remove DashBar25.dll using RegRun "Scan for Viruses" feature.
http://www.regrun.com

%program files%\dbau.exe

DbAu.exe is a spyware SPYW_DASHBAR.300.
DbAu.exe installs an Internet Explorer toolbar.
Related files:
%Program Files%\DashBar25.dll
%Program Files%\DashBarSetup.log
%Program Files%\DASHBARWEBSITE.URL
%Program Files%\DbAu.exe
%Program Files%\DashBar.dll
More info: http://www.trendmicro.com/vinfo/grayware...
Removal:
Kill the process DbAu.exe and remove DbAu.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%program files%\desktop scout 3\dtsview.dll

Dtsview.dll is a Spyware.DesktopScout.
Dtsview.dll monitors user activity and can control the computer.
Related files:
%ProgramFiles%\Desktop Scout 3\svcagnt.exe
%ProgramFiles%\Desktop Scout 3\dtsview.exe
%ProgramFiles%\Desktop Scout 3\dtsview.dll
%ProgramFiles%\Desktop Scout 3\unins000.exe
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove dtsview.dll from Windows startup using RegRun Startup Optimizer.

%program files%\desktop scout 3\dtsview.exe

Dtsview.exe is a Spyware.DesktopScout.
Dtsview.exe monitors user activity and can control the computer.
Related files:
%ProgramFiles%\Desktop Scout 3\svcagnt.exe
%ProgramFiles%\Desktop Scout 3\dtsview.exe
%ProgramFiles%\Desktop Scout 3\dtsview.dll
%ProgramFiles%\Desktop Scout 3\unins000.exe
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill dtsview.exe process and remove dtsview.exe from Windows startup using RegRun Startup Optimizer.

%program files%\desktop scout 3\svcagnt.exe

Svcagnt.exe is a Spyware.DesktopScout.
Svcagnt.exe monitors user activity and can control the computer.
Related files:
%ProgramFiles%\Desktop Scout 3\svcagnt.exe
%ProgramFiles%\Desktop Scout 3\dtsview.exe
%ProgramFiles%\Desktop Scout 3\dtsview.dll
%ProgramFiles%\Desktop Scout 3\unins000.exe
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill svcagnt.exe process and remove svcagnt.exe from Windows startup using RegRun Startup Optimizer.

%program files%\digikeygen\digikeygen.exe

%PROGRAM FILES%\DigiKeygen\digikeygen.exe is Trojan/Backdoor.
More info: http://www.sophos.com/virusinfo/analyses...
Kill the process digikeygen.exe and remove digikeygen.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%program files%\ds\config.exe

Config.exe is a Spyware.DSpy.
Config.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%ProgramFiles%\DS\UNWISE.EXE
%System%\ijl11.dll
%System%\msvbvm60.dll
%ProgramFiles%\DS\DSPY.exe
%ProgramFiles%\DS\ijl11.dll
%ProgramFiles%\DS\Config.exe
%ProgramFiles%\DS\DSPY.cnt
%ProgramFiles%\DS\Dspy.hlp
Adds the value:
"DHPY" = "%ProgramFiles%\DS\DSPY.EXE"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill Config.exe process and remove Config.exe from Windows startup using RegRun Startup Optimizer.

%program files%\ds\dspy.exe

DSPY.exe is a Spyware.DSpy.
DSPY.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%ProgramFiles%\DS\UNWISE.EXE
%System%\ijl11.dll
%System%\msvbvm60.dll
%ProgramFiles%\DS\DSPY.exe
%ProgramFiles%\DS\ijl11.dll
%ProgramFiles%\DS\Config.exe
%ProgramFiles%\DS\DSPY.cnt
%ProgramFiles%\DS\Dspy.hlp
Adds the value:
"DHPY" = "%ProgramFiles%\DS\DSPY.EXE"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill DSPY.exe process and remove DSPY.exe from Windows startup using RegRun Startup Optimizer.

%program files%\ds\unwise.exe

UNWISE.EXE is a Spyware.DSpy.
UNWISE.EXE monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%ProgramFiles%\DS\UNWISE.EXE
%System%\ijl11.dll
%System%\msvbvm60.dll
%ProgramFiles%\DS\DSPY.exe
%ProgramFiles%\DS\ijl11.dll
%ProgramFiles%\DS\Config.exe
%ProgramFiles%\DS\DSPY.cnt
%ProgramFiles%\DS\Dspy.hlp
Adds the value:
"DHPY" = "%ProgramFiles%\DS\DSPY.EXE"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill UNWISE.EXE process and remove UNWISE.EXE from Windows startup using RegRun Startup Optimizer.

%program files%\e2g\iebhos.dll

iebhos.dll is a Spyware.e2give.
iebhos.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%ProgramFiles%\E2g\iebhos.dll
%Windir%\pi1.exe
%System%\pruttct.exe
%System%\skytown.exe
%System%\prutpct.exe
%System%\ptech.exe
%System%\prutsct.exe
%System%\ptech.exe
%System%\askearth17.exe
%UserProfile%\Desktop\filgmo.exe
%UserProfile%\Local Settings\Temp\ei.exe
Adds the value:
"pruttct" = "[path to Adware]"
"filgmo" = "C:\Documents and Settings\symantec\Desktop\filgmo.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove iebhos.dll from Windows startup using RegRun Startup Optimizer.

%program files%\eiafasrk.dll

eiafasrk.dll is a worm W32.Dasher-D.
eiafasrk.dll spreads by exploiting the MSDTC (MS05-051) vulnerability.
eiafasrk.dll tries to terminate antiviral programs installed on a user computer.
Related files:
%Program Files%\eiafasrk.dl1
%Program Files%\eiafasrk.dll
%Program Files%\eiafasrk.sys
%System%\wins\SqlExp.exe
%System%\wins\SqlExp1.exe
%System%\wins\SqlExp2.exe
%System%\wins\SqlExp3.exe
%System%\wins\SqlScan.exe
%System%\wins\Sqltob.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove eiafasrk.dll from Windows startup using RegRun Startup Optimizer.

%program files%\eitcwd\eitcwd.exe

Eitcwd.exe is a Spyware.ExploitChildWD.
Eitcwd.exe logs keystrokes.
Eitcwd.exe monitors user Internet activity.
Related files:
%ProgramFiles%\eitcwd\eitcwd.exe
%ProgramFiles%\eitcwd\eitwmon.exe
%System%\SSPng.dll
%System%\SSubTmr6.dll
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill eitcwd.exe process and remove eitcwd.exe from Windows startup using RegRun Startup Optimizer.

%program files%\eitcwd\eitwmon.exe

Eitwmon.exe is a Spyware.ExploitChildWD.
Eitwmon.exe logs keystrokes.
Eitwmon.exe monitors user Internet activity.
Related files:
%ProgramFiles%\eitcwd\eitcwd.exe
%ProgramFiles%\eitcwd\eitwmon.exe
%System%\SSPng.dll
%System%\SSubTmr6.dll
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill eitwmon.exe process and remove eitwmon.exe from Windows startup using RegRun Startup Optimizer.

%program files%\eqadvice\eqadvice.exe

%PROGRAM FILES%\eqadvice\eqadvice.exe is Trojan/Backdoor.
Kill the process eqadvice.exe and remove %PROGRAM FILES%\eqadvice\ from Windows.

%program files%\esyndicate\esyn.dll

Esyn.dll is an adware program Adware.eSyndicate.
Esyn.dll display advertisements.
Esyn.dll monitors user Internet activity.
It sends stolen data to a hacker site.
Related files:
%ProgramFiles%\eSyndicate\esyn.dll
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove esyn.dll from Windows startup using RegRun Startup Optimizer.

%program files%\evol.exe

Evol.exe is a mass-mailing worm W32.Alco.AB@mm.
Evol.exe opens a back door on random TCP port.
Evol.exe spreads by e-mail and via open network shares.
Related files:
%Windir%\Taskman.exe
%Windir%\Notepad.exe
%Windir%\Wjview.exe
%Windir%\Errorlog.exe
%ProgramFiles%\Evol.exe
%ProgramFiles%\Msn.exe
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill Evol.exe process and remove Evol.exe from Windows startup using RegRun Startup Optimizer.

%program files%\fastfinder\fftoolbar.dll

fftoolbar.dll is a Adware.FFToolBar.
fftoolbar.dll display advertisements.
Related files:
%ProgramFiles%\FastFinder\fftoolbar.dll
%System%\ShowFF.exe
%Windir%\CJet.exe
%Windir%\nnmgr.exe
%Windir%\omi.dll
Adds the value:
"ShowFF" = "C:\Windows\System32\ShowFF.exe"
"nnmgr" = "C:\Windows\nnmgr.exe"
"CJET" = "C:\Windows\CJet.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove fftoolbar.dll from Windows startup using RegRun Startup Optimizer.

%program files%\firefly\windebug.exe

WinDeBug.exe is a Trojan.FireFly-A.
WinDeBug.exe opens a back door.
Related files:
%Program Files%\FireFly\WinDeBug.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill WinDeBug.exe process and remove WinDeBug.exe from Windows startup using RegRun Startup Optimizer.

%program files%\freemovies.exe

%program files%\ggauoxh\abjc.exe

ABJC.EXE is Adware/Spyware.
Kill the process ABJC.EXE and remove ABJC.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

%program files%\gui.exe

Gui.exe is an adware program Adware.Shorty.
Gui.exe is a Browser Helper Object.
Gui.exe monitors user Internet activity.
Related files:
CommonProgramFiles%\services.exe
%CommonProgramFiles%\system32.dll
%Temp%\version.txt
%ProgramFiles%\Catcher.dll
%ProgramFiles%\gui.exe
%ProgramFiles%\cwebpage.dll
%ProgramFiles%\version.txt
%ProgramFiles%\x.bmp
%ProgramFiles%\*.dat
Adds the value:
"DNS" = "%CommonProgramFiles%\[FILE NAME].exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill gui.exe process and remove gui.exe from Windows startup using RegRun Startup Optimizer.

%program files%\hamemov.exe

Hamemov.exe is a Trojan.Myftu.
Hamemov.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Program Files%\hamemov.exe
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill hamemov.exe process and remove hamemov.exe from Windows startup using RegRun Startup Optimizer.

%program files%\hqvideo\uninstall.exe

%Program Files%\HQvideo\Uninstall.exe is Trojan.Flush.J.
Related files:
%UserProfile%\Start Menu\Programs\HQvideo\Uninstall.lnk
%Program Files%\HQvideo\Uninstall.exe
%System%\[RANDOM NAME].exe
Read more: http://www.symantec.com/enterprise/secur...
Kill the process %Program Files%\HQvideo\Uninstall.exe and remove %Program Files%\HQvideo\Uninstall.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%program files%\humour toolbar\humour.dll

%PROGRAM FILES%\Humour Toolbar\humour.dll is Adware.MegaKiss.
Kill the file %PROGRAM FILES%\Humour Toolbar\humour.dll and remove %PROGRAM FILES%\Humour Toolbar\humour.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

%program files%\ietoolbar\toolbar.dll

%PROGRAM FILES%\IEToolbar\toolbar.dll is Spyware.IEToolbar.
Related files:
Searchit_toolbar.exe
searchit_toolbar.cab
Kill the file %PROGRAM FILES%\IEToolbar\toolbar.dll from Windows using RegRun.
www.regrun.com
Read more: http://securityresponse.symantec.com/avc...

%program files%\instafink\instafin.dll

instafin.dll is an Adware.InstaFinder.
instafin.dll is a Browser Helper Object.
instafin.dll displays advertisements.
instafin.dll downloads other adware programs.
Related files:
%ProgramFiles%\INSTAFINK\instafink.dll
%ProgramFiles%\INSTAFINK\instafin.dll
%ProgramFiles%\INSTAFINK\instafinderk_inst.exe
%ProgramFiles%\INSTAFINK\instafinder_inst.exe
Adds the value:
"InstaFinderK" = "%ProgramFiles%\INSTAFINK\InstaFinderK_inst.exe"
to the Windows startup registry keys.
More info: http://www.symantec.com/avcenter/venc/da...
Removal:
Remove instafin.dll using RegRun "Scan for Viruses" feature.
http://www.regrun.com

%program files%\instafink\instafinder_inst.exe

instafinder_inst.exe is an Adware.InstaFinder.
instafinder_inst.exe is a Browser Helper Object.
instafinder_inst.exe displays advertisements.
instafinder_inst.exe downloads other adware programs.
Related files:
%ProgramFiles%\INSTAFINK\instafink.dll
%ProgramFiles%\INSTAFINK\instafin.dll
%ProgramFiles%\INSTAFINK\instafinderk_inst.exe
%ProgramFiles%\INSTAFINK\instafinder_inst.exe
Adds the value:
"InstaFinderK" = "%ProgramFiles%\INSTAFINK\InstaFinderK_inst.exe"
to the Windows startup registry keys.
More info: http://www.symantec.com/avcenter/venc/da...
Removal:
Kill the process instafinder_inst.exe and remove instafinder_inst.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%program files%\instafink\instafinderk_inst.exe

instafinderk_inst.exe is an Adware.InstaFinder.
instafinderk_inst.exe is a Browser Helper Object.
instafinderk_inst.exe displays advertisements.
instafinderk_inst.exe downloads other adware programs.
Related files:
%ProgramFiles%\INSTAFINK\instafink.dll
%ProgramFiles%\INSTAFINK\instafin.dll
%ProgramFiles%\INSTAFINK\instafinderk_inst.exe
%ProgramFiles%\INSTAFINK\instafinder_inst.exe
Adds the value:
"InstaFinderK" = "%ProgramFiles%\INSTAFINK\InstaFinderK_inst.exe"
to the Windows startup registry keys.
More info: http://www.symantec.com/avcenter/venc/da...
Removal:
Kill the process instafinderk_inst.exe and remove instafinderk_inst.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%program files%\instafink\instafink.dll

instafink.dll is an Adware.InstaFinder.
instafink.dll is a Browser Helper Object.
instafink.dll displays advertisements.
instafink.dll downloads other adware programs.
Related files:
%ProgramFiles%\INSTAFINK\instafink.dll
%ProgramFiles%\INSTAFINK\instafin.dll
%ProgramFiles%\INSTAFINK\instafinderk_inst.exe
%ProgramFiles%\INSTAFINK\instafinder_inst.exe
Adds the value:
"InstaFinderK" = "%ProgramFiles%\INSTAFINK\InstaFinderK_inst.exe"
to the Windows startup registry keys.
More info: http://www.symantec.com/avcenter/venc/da...
Removal:
Remove instafink.dll using RegRun "Scan for Viruses" feature.
http://www.regrun.com

%program files%\internet explorer\setup12.exe

%PROGRAM FILES%\internet explorer\setup12.exe is HotWebFinder.Winbrume adware.
Related files:
%PROGRAM_FILES%\ internet explorer\ lock.exe
%PROGRAM_FILES%\ internet explorer\ setup12.exe
%PROGRAM_FILES%\ internet explorer\ update.exe
%SYSTEM%\ ke7dnl.sys
%SYSTEM%\ win32hlp.exe
%SYSTEM%\ win32hp.dll
%SYSTEM%\ winbrume.dll
%windows%\ cpu.exe
0.exe
1184.exe
c:\ eexplek.exe
c:\ exefile.exe
c:\ hpdjyy.exe
c:\ tytymh.exe
exefile.exe
lock2.exe
new.exe
new2.exe
setup.exe
socks.exe
test.exe
tmp01.exe
w.exe
win32hp.dll
winbrume.dll
Read more: http://research.sunbelt-software.com/thr...
Kill the process %PROGRAM FILES%\internet explorer\setup12.exe and remove %PROGRAM FILES%\internet explorer\setup12.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%program files%\internet explorer\syssmss.exe

syssmss.exe is a Trojan.Lanxue-K.
syssmss.exe opens a back door.
syssmss.exe spreads via open network shares.
Related files:
%Program Files%\Internet Explorer\syssmss.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill syssmss.exe process and remove syssmss.exe from Windows startup using RegRun Startup Optimizer.

%program files%\internet explorer\systrsy.exe

Systrsy.exe is a Trojan.Cdtray.
Systrsy.exe opens and closes the CD-ROM drive.
Related files:
%ProgramFiles%\Internet Explorer\Systrsy.exe
%ProgramFiles%\Autorun.inf
Adds the value:
"(Default)" = "%Progam Files%\Internet Explorer\Systrsy.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill Systrsy.exe process and remove Systrsy.exe from Windows startup using RegRun Startup Optimizer.

%program files%\internet keyword\inetmgr.exe

Internet Keyword\inetmgr.exe is Trojan/Backdoor.
Kill the process inetmgr.exe and remove %PROGRAM FILES%\Internet Keyword\inetmgr.exe from Windows startup.

%program files%\ipwins\ipwins.exe

%PROGRAM FILES%\ipwins\ipwins.exe is Adware Maxfiles.
Related files:
%APPDATA%\SECTASKMAN\IPWINS.EXE.Q_B744601_Q
%CACHE%\CONTENT.IE5\????????\119[1].AVI
%profiles%\owen\local set...s\content.ie5\fy8jftgh\119[1].AVI
Kill the process %PROGRAM FILES%\ipwins\ipwins.exe and remove %PROGRAM FILES%\ipwins\ipwins.exe from Windows startup using RegRun.
www.regrun.com

%program files%\jthabckeylogger\abckey.dll

Abckey.dll is a Spyware.ABCKeylogger.
Abckey.dll is a keystroke and screenshot-logging program.
Related files:
%ProgramFiles%\JthABCKeylogger\abckey.dll
%ProgramFiles%\JthABCKeylogger\forgotpass.exe
%ProgramFiles%\JthABCKeylogger\keylogger.exe
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove abckey.dll from Windows startup using RegRun Startup Optimizer.

%program files%\jthabckeylogger\forgotpass.exe

Forgotpass.exe is a Spyware.ABCKeylogger.
Forgotpass.exe is a keystroke and screenshot-logging program.
Related files:
%ProgramFiles%\JthABCKeylogger\abckey.dll
%ProgramFiles%\JthABCKeylogger\forgotpass.exe
%ProgramFiles%\JthABCKeylogger\keylogger.exe
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill forgotpass.exe process and remove forgotpass.exe from Windows startup using RegRun Startup Optimizer.

%program files%\keycl\keytrial.exe

keytrial.exe is a Spyware.KeyCollect.
keytrial.exe logs keystrokes.
Related files:
%Windir%\winrv3e.exe
%ProgramFiles%\keycl\keytrial.exe
%ProgramFiles%\keycl\readme.txt
Adds the value:
"Wdrvfig7" = "%Windir%\WINRV3E.EXE"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill keytrial.exe process and remove keytrial.exe from Windows startup using RegRun Startup Optimizer.

%program files%\keykey\keykey.exe

Keykey.exe is a Spyware.KeyKey.
Keykey.exe logs keystrokes and takes screenshots.
Related files:
%ProgramFiles%\KEYKEY\slman.exe
%ProgramFiles%\KEYKEY\slview.exe
%System%\sldrv.dll
%System%\zlib.dll
%System%\loadwin.exe
%ProgramFiles%\KEYKEY\keykey.exe
%ProgramFiles%\KEYKEY\kkmon.exe
%System%\kkdrv.dll
%System%\loadkk.exe
Adds the value:
"SL Loader" = "loadwin.exe"
"KK Loader" = "%System%\loadkk.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill keykey.exe process and remove keykey.exe from Windows startup using RegRun Startup Optimizer.

%program files%\keykey\kkmon.exe

Kkmon.exe is a Spyware.KeyKey.
Kkmon.exe logs keystrokes and takes screenshots.
Related files:
%ProgramFiles%\KEYKEY\slman.exe
%ProgramFiles%\KEYKEY\slview.exe
%System%\sldrv.dll
%System%\zlib.dll
%System%\loadwin.exe
%ProgramFiles%\KEYKEY\keykey.exe
%ProgramFiles%\KEYKEY\kkmon.exe
%System%\kkdrv.dll
%System%\loadkk.exe
Adds the value:
"SL Loader" = "loadwin.exe"
"KK Loader" = "%System%\loadkk.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill kkmon.exe process and remove kkmon.exe from Windows startup using RegRun Startup Optimizer.

%program files%\keykey\slman.exe

Slman.exe is a Spyware.KeyKey.
Slman.exe logs keystrokes and takes screenshots.
Related files:
%ProgramFiles%\KEYKEY\slman.exe
%ProgramFiles%\KEYKEY\slview.exe
%System%\sldrv.dll
%System%\zlib.dll
%System%\loadwin.exe
%ProgramFiles%\KEYKEY\keykey.exe
%ProgramFiles%\KEYKEY\kkmon.exe
%System%\kkdrv.dll
%System%\loadkk.exe
Adds the value:
"SL Loader" = "loadwin.exe"
"KK Loader" = "%System%\loadkk.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill slman.exe process and remove slman.exe from Windows startup using RegRun Startup Optimizer.

%program files%\keykey\slview.exe

Slview.exe is a Spyware.KeyKey.
Slview.exe logs keystrokes and takes screenshots.
Related files:
%ProgramFiles%\KEYKEY\slman.exe
%ProgramFiles%\KEYKEY\slview.exe
%System%\sldrv.dll
%System%\zlib.dll
%System%\loadwin.exe
%ProgramFiles%\KEYKEY\keykey.exe
%ProgramFiles%\KEYKEY\kkmon.exe
%System%\kkdrv.dll
%System%\loadkk.exe
Adds the value:
"SL Loader" = "loadwin.exe"
"KK Loader" = "%System%\loadkk.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill slview.exe process and remove slview.exe from Windows startup using RegRun Startup Optimizer.

%program files%\mbkwbar\ietoolbar.dll

IEToolBar.dll is an adware program Adware.MBKWbar.
IEToolBar.dll displays advertisements.
Related files:
%ProgramFiles%\MBKWBar\IEToolBar.dll
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove IEToolBar.dll from Windows startup using RegRun Startup Optimizer.

%program files%\mch.exe

%program files%\media access\mediaaccc.dll

MediaAccC.dll is a Trojan.Podrop-C.
MediaAccC.dll tries to terminate antiviral programs installed on a user computer.
Related files:
%Program Files%\Media Access\Info.txt
%Program Files%\Media Access\MediaAccC.dll
%Program Files%\Media Access\MediaAccK.exe
%Program Files%\Media Access\MediaAccess.exe
%Windows%\win.exe
%System%\nub-san.exe
%System%\xpjava.exe
%System%\msdirectx.sys
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove MediaAccC.dll from Windows startup using RegRun Startup Optimizer.

%program files%\messenger\msmsgs.exe.exe

msmsgs.exe.exe is a mass-mailing worm W32.Minusia-A.
msmsgs.exe.exe opens a back door on IRC channels.
msmsgs.exe.exe spreads by e-mail and via open network shares.
msmsgs.exe.exe deletes files off the computer.
msmsgs.exe.exe tries to terminate antiviral programs installed on a user computer.
msmsgs.exe.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Program Files%\Messenger\msmsgs.exe.exe
%Windows%\Config\system.update.exe.exe
%Windows%\mmsg\mcAfee.Update.exe.exe
%Windows%\mmsg\mmsg.exe.exe
%System%\svchost.exe
%System%\ERSvc.exe
%Windows%\Registry1.dll
%Windows%\Registry2.dll
%Windows%\system_log.txt
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill the process msmsgs.exe.exe and remove msmsgs.exe.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%program files%\mirc\downloads\wwe divas.exe

WWE DIVAS.exe is a mass-mailing worm W32.Elitper.B@mm.
WWE DIVAS.exe spreads via open network shares.
WWE DIVAS.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%Windir%\TASKMANAGER.exe
%Program Files%\Windows Media Player\ wmlaunch .exe
%Program Files%\mIRC\Downloads\WWE DIVAS.exe
Adds the value:
"Firewall" = "%Program files%\Windows Media Player\[space]wmlaunch[space].exe"
"Protection" = "%Program files%\Internet Explorer\Firewall.exe"
"SysRes" = "%Windir%\TASKMANAGER.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill WWE DIVAS.exe process and remove WWE DIVAS.exe from Windows startup using RegRun Startup Optimizer.

%program files%\moviecommander\uninstall.exe

%PROGRAM FILES%\MovieCommander\Uninstall.exe is Trojan.Tvcodec.
Trojan.Tvcodec is a Trojan horse that installs a rootkit on the compromised computer.
Related files:
%UserProfile%\Administrator\Start Menu\Programs\MovieCommander\Uninstall.lnk
%ProgramFiles%\MovieCommander\Uninstall.exe
%System%\[FIVE RANDOM LETTERS].exe
Read more: http://www.symantec.com/enterprise/secur...
Kill the process %PROGRAM FILES%\MovieCommander\Uninstall.exe and remove %PROGRAM FILES%\MovieCommander\Uninstall.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%program files%\movies.exe

movies.exe is a Trojan.Myftu.
movies.exe registers porn service without notification.
movies.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Program Files%\playMovie.exe
%Program Files%\playDvdMovie.exe
%Program Files%\update.exe
%Program Files%\mch.exe
%Program Files%\movies.exe
%Program Files%\movload.exe
%Program Files%\mv99.exe
%Program Files%\freeMovies.exe
%Program Files%\WINSKJP.DLL
%Program Files%\MSINET.OCX
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill movies.exe process and remove movies.exe from Windows startup using RegRun Startup Optimizer.

%program files%\movload.exe

%program files%\msaolim\msaolim.exe

Msaolim.exe is a Spyware.MessageSpy.
Msaolim.exe records online chat conversations.
Related files:
%ProgramFiles%\msaolim\msaolim.exe
%ProgramFiles%\msaolim\unins.exe
%ProgramFiles%\msaolim\unins000.dat
%ProgramFiles%\msaolim\unins000.exe
%System%\polarcrypto.dll
%System%\polarziplight.dll
%System%\Richtx32.ocx
Adds the value:
"msaim" = "C:\Program Files\msaolim\msaolim.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill msaolim.exe process and remove msaolim.exe from Windows startup using RegRun Startup Optimizer.

%program files%\msaolim\unins.exe

Unins.exe is a Spyware.MessageSpy.
Unins.exe records online chat conversations.
Related files:
%ProgramFiles%\msaolim\msaolim.exe
%ProgramFiles%\msaolim\unins.exe
%ProgramFiles%\msaolim\unins000.dat
%ProgramFiles%\msaolim\unins000.exe
%System%\polarcrypto.dll
%System%\polarziplight.dll
%System%\Richtx32.ocx
Adds the value:
"msaim" = "C:\Program Files\msaolim\msaolim.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill unins.exe process and remove unins.exe from Windows startup using RegRun Startup Optimizer.

%program files%\msmovies.exe

MsMovies.exe is a worm W32.Alcra-E.
MsMovies.exe opens a back door.
Related files:
%Program Files%\MsMovies\MsMovies.exe
%Program Files%\MsMovies\p.zip
%System%\winlogi.exe
%System%\cmd.com
%System%\netstat.com
%System%\ping.com
%System%\regedit.com
%System%\taskkill.com
%System%\tasklist.com
%System%\tracert.com
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill MsMovies.exe process and remove MsMovies.exe from Windows startup using RegRun Startup Optimizer.

%program files%\mv99.exe

mv99.exe is a Trojan.Myftu.
mv99.exe registers porn service without notification.
mv99.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Program Files%\playMovie.exe
%Program Files%\playDvdMovie.exe
%Program Files%\update.exe
%Program Files%\mch.exe
%Program Files%\movies.exe
%Program Files%\movload.exe
%Program Files%\mv99.exe
%Program Files%\freeMovies.exe
%Program Files%\WINSKJP.DLL
%Program Files%\MSINET.OCX
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill mv99.exe process and remove mv99.exe from Windows startup using RegRun Startup Optimizer.

%program files%\mywebsearch\bar\2.bin\mwsbar.dll

Mwsbar.dll is a Spyware.MyWebSearch.
Mwsbar.dll is a Browser Helper Object.
Mwsbar.dll monitors user Internet activity.
Related files:
%Program Files%\MyWebSearch\bar\2.bin\MWSOEMON.EXE
%Program Files%\MyWebSearch\bar\2.bin\MWSOESTB.DLL
%program files%\mywebsearch\bar\2.bin\mwsbar.dll
%program files%\mywebsearch\srchastt\2.bin\mwssrcas.dll
Removal:
Remove mwsbar.dll from Windows startup using RegRun Startup Optimizer.

%program files%\mywebsearch\bar\2.bin\mwsoemon.exe

MWSOEMON.EXE is a Spyware.MyWebSearch.
MWSOEMON.EXE is a Browser Helper Object.
MWSOEMON.EXE monitors user Internet activity.
Related files:
%Program Files%\MyWebSearch\bar\2.bin\MWSOEMON.EXE
%Program Files%\MyWebSearch\bar\2.bin\MWSOESTB.DLL
%program files%\mywebsearch\bar\2.bin\mwsbar.dll
%program files%\mywebsearch\srchastt\2.bin\mwssrcas.dll
Removal:
Kill MWSOEMON.EXE process and remove MWSOEMON.EXE from Windows startup using RegRun Startup Optimizer.

%program files%\mywebsearch\bar\2.bin\mwsoestb.dll

MWSOESTB.DLL is a Spyware.MyWebSearch.
MWSOESTB.DLL is a Browser Helper Object.
MWSOESTB.DLL monitors user Internet activity.
Related files:
%Program Files%\MyWebSearch\bar\2.bin\MWSOEMON.EXE
%Program Files%\MyWebSearch\bar\2.bin\MWSOESTB.DLL
%program files%\mywebsearch\bar\2.bin\mwsbar.dll
%program files%\mywebsearch\srchastt\2.bin\mwssrcas.dll
Removal:
Remove MWSOESTB.DLL from Windows startup using RegRun Startup Optimizer.

%program files%\mywebsearch\srchastt\2.bin\mwssrcas.dll

Mwssrcas.dll is a Spyware.MyWebSearch.
Mwssrcas.dll is a Browser Helper Object.
Mwssrcas.dll monitors user Internet activity.
Related files:
%Program Files%\MyWebSearch\bar\2.bin\MWSOEMON.EXE
%Program Files%\MyWebSearch\bar\2.bin\MWSOESTB.DLL
%program files%\mywebsearch\bar\2.bin\mwsbar.dll
%program files%\mywebsearch\srchastt\2.bin\mwssrcas.dll
Removal:
Remove mwssrcas.dll from Windows startup using RegRun Startup Optimizer.

%program files%\need2find\bar\1.bin\nd2fnbar.dll

ND2FNBAR.DLL is a Spyware.W32.Gator (Need2Find).
ND2FNBAR.DLL displays advertisements.
Remove ND2FNBAR.DLL using RegRun "Scan for Viruses" feature.

%program files%\newdot~1.dll\newdot~1.dll

NEWDOT~1.DLL is a Spyware.NewDotNet.
Remove NEWDOT~1.DLL using RegRun "Scan for Viruses" feature.
http://www.regrun.com

%program files%\newdot~1\newdot.exe

newdot.exe is a Spyware.NewDotNet.
Kill the process newdot.exe and remove newdot.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%program files%\newdot~1\newdot~2.dll

NEWDOT~2.DLL is a Spyware.NewDotNet.
Remove NEWDOT~2.DLL using RegRun "Scan for Viruses" feature.
http://www.regrun.com

%program files%\newdotnet\newdotnet7_22.dll

newdotnet7_22.dll is an Adware.NewDotNet.
Remove newdotnet7_22.dll using RegRun "Scan for Viruses" feature.

%program files%\nsk\akl.exe

AKL.exe is a Spyware.Ardakey.
AKL.exe logs keystrokes.
Related files:
%ProgramFiles%\NSK\AKV.exe
%ProgramFiles%\NSK\AKL.EXE
%ProgramFiles%\NSK\NSK.exe
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill AKL.exe process and remove AKL.exe from Windows startup using RegRun Startup Optimizer.

%program files%\nsk\akv.exe

AKV.exe is a Spyware.Ardakey.
AKV.exe logs keystrokes.
Related files:
%ProgramFiles%\NSK\AKV.exe
%ProgramFiles%\NSK\AKL.EXE
%ProgramFiles%\NSK\NSK.exe
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill AKV.exe process and remove AKV.exe from Windows startup using RegRun Startup Optimizer.

%program files%\nsk\nsk.exe

NSK.exe is a Spyware.Ardakey.
NSK.exe logs keystrokes.
Related files:
%ProgramFiles%\NSK\AKV.exe
%ProgramFiles%\NSK\AKL.EXE
%ProgramFiles%\NSK\NSK.exe
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill NSK.exe process and remove NSK.exe from Windows startup using RegRun Startup Optimizer.

%program files%\odsp\blowfish.dll

%program files%\odsp\cximage.dll

%program files%\odsp\encrypt.dll

%program files%\odsp\flash.exe

%program files%\odsp\killproc.exe

%program files%\odsp\messagebox.exe

%program files%\odsp\odsphost.dll

%program files%\odsp\odsphost_nt.exe

%program files%\odsp\odsplay.exe

%program files%\odsp\utility.dll

%program files%\odsp\welcome.exe

%program files%\odsp\xt1931lib.dll

%program files%\outlook express\serop.exe

serop.exe is a Trojan.GrayBrd-I.
serop.exe opens a back door.
Related files:
%Program Files%\Outlook Express\serop.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill serop.exe process and remove serop.exe from Windows startup using RegRun Startup Optimizer.

%program files%\pcs\pcs.exe

pcs.exe is a Spyware.PCSpy.
pcs.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%ProgramFiles%\PCS\pcs.exe
%Windir%\Crrst32.exe
%Windir%\Temp_Ig
Adds the value:
"Dconfig7"="%Windir%\crrst.32.exe"
to the Windows startup registry keys.
More info: http://www.symantec.com/avcenter/venc/da...
Removal:
Kill the process pcs.exe and remove pcs.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%program files%\peoplepc\toolbar\ppctoolbar.dll

%PROGRAM FILES%\peoplepc\toolbar\PPCToolbar.dll is Adware-PalToolbar.
This is not a virus or a Trojan. It is an adware application and may generate extra pop-up ads while using Internet Explorer.
Directory:
%PROGRAMFILES%\Peoplepc
Related files:
ppaluninst.exe
peoplepal.htm
peoplepc.ico
Read more: http://vil.nai.com/vil/content/v_136377....
Kill the file %PROGRAM FILES%\peoplepc\toolbar\PPCToolbar.dll and remove %PROGRAM FILES%\peoplepc\toolbar\PPCToolbar.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

%program files%\pesttrap\pesttrap.exe

PestTrap\PestTrap.exe is Spyware.
Kill the process PestTrap.exe and remove PestTrap.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%program files%\playdvdmovie.exe

%program files%\playmovie.exe

playMovie.exe is a Trojan.Myftu.
playMovie.exe registers porn service without notification.
playMovie.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Program Files%\playMovie.exe
%Program Files%\playDvdMovie.exe
%Program Files%\update.exe
%Program Files%\mch.exe
%Program Files%\movies.exe
%Program Files%\movload.exe
%Program Files%\mv99.exe
%Program Files%\freeMovies.exe
%Program Files%\WINSKJP.DLL
%Program Files%\MSINET.OCX
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill playMovie.exe process and remove playMovie.exe from Windows startup using RegRun Startup Optimizer.

%program files%\prevadcomm.dll

PrevAdComm.dll is an adware program Adware.WinTaskAd.
PrevAdComm.dll downloads and displays advertisements.
Related files:
%ProgramFiles%\AdStatServ.exe
%ProgramFiles%\AdStatKeep.exe
%ProgramFiles%\AdStatComm.dll
%ProgramFiles%\PrevAdComm.dll
%ProgramFiles%\WinTaskAd.exe
%ProgramFiles%\WinSched.exe
%ProgramFiles%\WinProject.dll
%Windir%\Temp\creditdan_WinTaskAdInstPack.exe
Adds the value:
"Windows TaskAd" = "[path to Adware.WinTaskAd]"
"AdStatus Service" = "[path to Adware.WinTaskAd]"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove PrevAdComm.dll from Windows startup using RegRun Startup Optimizer.

%program files%\printv~1\pvmodule.exe

%PROGRAM FILES%\PRINTV~1\pvmodule.exe is TR/Dldr.Agent.alb.
Note. The legitimate PrintView program locates in the C:\CBR folder.
Kill the process pvmodule.exe and remove pvmodule.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%program files%\qyule\qyuleinstall.exe

QyuleInstall.exe is a Trojan.Dloader-ZM.
QyuleInstall.exe downloads code from the internet.
Related files:
%Program Files%\Qyule\QyuleInstall.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill QyuleInstall.exe process and remove QyuleInstall.exe from Windows startup using RegRun Startup Optimizer.

%program files%\recommended hotfix - 421701d\v15\rh.dll

RH.dll is a Spyware.Look2Me.
RH.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Temp%nsdtmp09.dll
%Program Files%\Recommended Hotfix - 421701D\v15\RH.DLL
%Program Files%\Recommended Hotfix - 421701D\v15\RH.exe
%Program Files%\SED\SE.exe
%Program Files%\SED\SED.exe
%Windir%\system\UpdInstall.exe
%System%\InetFuel.exe
%System%\[random file name].dll
Adds the value:
"SESync" = "%Program Files%\SED\SED.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove RH.dll from Windows startup using RegRun Startup Optimizer.

%program files%\recommended hotfix - 421701d\v15\rh.exe

RH.exe is a Spyware.Look2Me.
RH.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Temp%nsdtmp09.dll
%Program Files%\Recommended Hotfix - 421701D\v15\RH.DLL
%Program Files%\Recommended Hotfix - 421701D\v15\RH.exe
%Program Files%\SED\SE.exe
%Program Files%\SED\SED.exe
%Windir%\system\UpdInstall.exe
%System%\InetFuel.exe
%System%\[random file name].dll
Adds the value:
"SESync" = "%Program Files%\SED\SED.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill RH.exe process and remove RH.exe from Windows startup using RegRun Startup Optimizer.

%program files%\sacc\sacc.exe

Sacc.exe is an adware program Adware.SurfAccuracy.
Sacc.exe display advertisements.
Sacc.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%ProgramFiles%\sacc\sacc.cfg
%ProgramFiles%\sacc\sacc.exe
Adds the value:
"SACC" = "%ProgramFiles%\sacc\sacc.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill sacc.exe process and remove sacc.exe from Windows startup using RegRun Startup Optimizer.

%program files%\save\save.exe

%PROGRAM FILES%\Save\Save.exe is WhenU.Save adware.
Read more: http://research.sunbelt-software.com/thr...
Kill the process Save.exe and remove Save.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%program files%\sbss\sbss.exe

Sbss.exe is an adware program Adware.SideBySide.
Sbss.exe displays advertisements.
Related files:
%ProgramFiles%\sbss\sbss.exe
%ProgramFiles%\sbss\Stop sbss.lnk
%ProgramFiles%\sbss\Uninstall sbss.exe
Adds the value:
"sbss Launcher" = "%ProgramFiles%\sbss\sbss.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill sbss.exe process and remove sbss.exe from Windows startup using RegRun Startup Optimizer.

%program files%\screenspy\winacsr.exe

Winacsr.exe is a Spyware.AceScreenSpy.
Winacsr.exe is a commercial screen logger program.
Related files:
%System%\SmartMenuXP.dll
%ProgramFiles%\ScreenSpy\winacsr.exe
Adds the value:
"Winacsr"="%ProgramFiles%\ScreenSpy\Winacsr.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill winacsr.exe process and remove winacsr.exe from Windows startup using RegRun Startup Optimizer.

%program files%\searchnet\serveup.exe

SERVEUP.EXE is Trojan/Backdoor.
Kill the process SERVEUP.EXE and remove SERVEUP.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

%program files%\security toolbar\security toolbar.dll

%PROGRAM FILES%\Security Toolbar\Security Toolbar.dll is a Bundleware.
Kill the file %PROGRAM FILES%\Security Toolbar\Security Toolbar.dll and remove %PROGRAM FILES%\Security Toolbar\Security Toolbar.dll from Windows startup using RegRun.
www.regrun.com

%program files%\sed\se.exe

SE.exe is a Spyware.Look2Me.
SE.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Temp%nsdtmp09.dll
%Program Files%\Recommended Hotfix - 421701D\v15\RH.DLL
%Program Files%\Recommended Hotfix - 421701D\v15\RH.exe
%Program Files%\SED\SE.exe
%Program Files%\SED\SED.exe
%Windir%\system\UpdInstall.exe
%System%\InetFuel.exe
%System%\[random file name].dll
Adds the value:
"SESync" = "%Program Files%\SED\SED.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill SE.exe process and remove SE.exe from Windows startup using RegRun Startup Optimizer.

%program files%\sed\sed.exe

SED.exe is a Spyware.Look2Me.
SED.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Temp%nsdtmp09.dll
%Program Files%\Recommended Hotfix - 421701D\v15\RH.DLL
%Program Files%\Recommended Hotfix - 421701D\v15\RH.exe
%Program Files%\SED\SE.exe
%Program Files%\SED\SED.exe
%Windir%\system\UpdInstall.exe
%System%\InetFuel.exe
%System%\[random file name].dll
Adds the value:
"SESync" = "%Program Files%\SED\SED.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill SED.exe process and remove SED.exe from Windows startup using RegRun Startup Optimizer.

%program files%\seekmo\seekmohook.dll

SEEKMOHOOK.DLL is an adware Seekmo180solutions.
Remove SEEKMOHOOK.DLL using RegRun "Scan for Viruses" feature.
http://www.regrun.com

%program files%\shopperreports\bin\1.1.0.0\shprrprt.dll

SHPRRPRT.DLL is an Adware.HotBar/ShopperReports.Explorer Bar.
SHPRRPRT.DLL displays advertisements.
Remove SHPRRPRT.DLL using RegRun "Scan for Viruses" feature.

%program files%\sk51\sk51.exe

Sk51.exe is a Spyware.SaveKeys.
Sk51.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%PROGRAM FILES%\SK51\Sk51.exe
%PROGRAM FILES%\SK51\Sk51config.exe
%PROGRAM FILES%\SK62\sku62.exe
%PROGRAM FILES%\SK60\sk60.exe
%SysDir%\Regkey32.Dll
Adds the value:
"SK51"="C:\PROGRAM FILES\SK51\SK51.EXE"
"SK60"="C:\PROGRAM FILES\SK60\SK60.EXE"
"(default)"="C:\PROGRAM FILES\SKU62\SKU62.EXE"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill Sk51.exe process and remove Sk51.exe from Windows startup using RegRun Startup Optimizer.

%program files%\sk51\sk51config.exe

Sk51config.exe is a Spyware.SaveKeys.
Sk51config.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%PROGRAM FILES%\SK51\Sk51.exe
%PROGRAM FILES%\SK51\Sk51config.exe
%PROGRAM FILES%\SK62\sku62.exe
%PROGRAM FILES%\SK60\sk60.exe
%SysDir%\Regkey32.Dll
Adds the value:
"SK51"="C:\PROGRAM FILES\SK51\SK51.EXE"
"SK60"="C:\PROGRAM FILES\SK60\SK60.EXE"
"(default)"="C:\PROGRAM FILES\SKU62\SKU62.EXE"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill Sk51config.exe process and remove Sk51config.exe from Windows startup using RegRun Startup Optimizer.

%program files%\sk60\sk60.exe

Sk60.exe is a Spyware.SaveKeys.
Sk60.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%PROGRAM FILES%\SK51\Sk51.exe
%PROGRAM FILES%\SK51\Sk51config.exe
%PROGRAM FILES%\SK62\sku62.exe
%PROGRAM FILES%\SK60\sk60.exe
%SysDir%\Regkey32.Dll
Adds the value:
"SK51"="C:\PROGRAM FILES\SK51\SK51.EXE"
"SK60"="C:\PROGRAM FILES\SK60\SK60.EXE"
"(default)"="C:\PROGRAM FILES\SKU62\SKU62.EXE"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill Sk60.exe process and remove Sk60.exe from Windows startup using RegRun Startup Optimizer.

%program files%\sk62\sku62.exe

Sk62.exe is a Spyware.SaveKeys.
Sk62.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%PROGRAM FILES%\SK51\Sk51.exe
%PROGRAM FILES%\SK51\Sk51config.exe
%PROGRAM FILES%\SK62\sku62.exe
%PROGRAM FILES%\SK60\sk60.exe
%SysDir%\Regkey32.Dll
Adds the value:
"SK51"="C:\PROGRAM FILES\SK51\SK51.EXE"
"SK60"="C:\PROGRAM FILES\SK60\SK60.EXE"
"(default)"="C:\PROGRAM FILES\SKU62\SKU62.EXE"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill Sk62.exe process and remove Sk62.exe from Windows startup using RegRun Startup Optimizer.

%program files%\sony\vaio action setup\msvbdll32.exe

Worm W32.Aimdes.A@mm.
MsVBdll spreads via e0mail and AOL Instant Messenger.
Adds the value:
"MsVBdll" = "%Windir%\MsVBdll.pif"
to the Windows startup registry keys.
Adds the registry entries:
"FirewallDisableNotify" = "1"
"UpdatesDisableNotify" = "1"
"AntiVirusDisableNotify" = "1"
to the following registry keys
HKEY_CURRENT_USER\Software\Microsoft\security center
HKEY_LOCAL_MACHINE\Software\Microsoft\security center
to lower computer security.
MsVBdll adds:
"DisableTaskMgr" = "1"
"DisableRegistryTools" = "1"
to the registry key
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
Policies\System
to disable access to the Windows Task Manager and registry editing tools.
MsVBdll adds the registry entry:
"NoAutoUpdate" = "1"
to the registry key
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\AU
to disable Windows Update.
MsVBdll deletes the following registry key if present:
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\
CurrentVersion\Run\"Windows" = "Auto Update.exe"
MsVBdll tries to copy itself to:
A:\homework.exe
Kills the system processes:
* svchost.exe
* lsass.exe
It will break network connections.

%program files%\spytech software\spytech spyagent\deploy.exe

Deploy.exe is a Spyware.SpyAgent.B.
Deploy.exe is a commercial keylogger/system-monitoring program.
Related files:
%System%\ntinvisible.dll
%Windir%\libimg.dll
%Windir%\sbrowse.exe
%Windir%\snmpapi.dll
%Windir%\yahoodll.dll
%ProgramFiles%\Spytech Software\Spytech SpyAgent\sagent.exe
%ProgramFiles%\Spytech Software\Spytech SpyAgent\deploy.exe
%ProgramFiles%\Spytech Software\Spytech SpyAgent\nostealth.exe
%ProgramFiles%\Spytech Software\Spytech SpyAgent\sysdiag.exe
Adds the value:
"System32"="%ProgramFiles%\Spytech Software\Spytech SpyAgent\sysdiag.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill deploy.exe process and remove deploy.exe from Windows startup using RegRun Startup Optimizer.

%program files%\spyware cleaner\scservice.exe

SCService.exe is a Trojan/Backdoor.
Kill the process SCService.exe and remove SCService.exe from Windows startup.

%program files%\spyware cleaner\spywarecleaner.exe

SpywareCleaner.Exe is a Trojan/Backdoor.
Kill the process SpywareCleaner.Exe and remove SpywareCleaner.Exe from Windows startup.

%program files%\spyware stormer\spywarestormer.exe

%program files%\spywarequake\spywarequake.exe

SPYWAREQUAKE.EXE is a Spyware SpywareQuake.
Kill the process SPYWAREQUAKE.EXE and remove SPYWAREQUAKE.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

%program files%\spywarestormer\spywarestormer.exe

%PROGRAM FILES%\SpywareStormer\SpywareStormer.Exe is Trojan/Backdoor.
Kill the process SpywareStormer.Exe and remove %PROGRAM FILES%\SpywareStormer\SpywareStormer.Exe from Windows using RegRun.
www.regrun.com
Read more: http://www.symantec.com/avcenter/venc/da...

%program files%\starr\starrcmd.exe

starrcmd.exe is Spyware.Starr.
starrcmd.exe is a spyware program that captures screenshots, logs keystrokes, and monitors Internet chatting.
starrcmd.exe can run in stealth mode.
Related files:
starrp.exe
ssys.exe
wsys.exe
wsys.dll.
Kill the process starrcmd.exe and remove starrcmd.exe from Windows startup using RegRun.
www.regrun.com
Read more: http://www.symantec.com/avcenter/venc/da...

%program files%\stwwsrvs\zmgci4rn.exe

ZMGCI4RN.EXE is Trojan/Backdoor.
Kill the process ZMGCI4RN.EXE and remove ZMGCI4RN.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

%program files%\svchost.exe

Spyware.Spytech
Monitors the following items:
- Keystrokes typed
- Website visits
- Applications run
- Internet connections made
- Files and documents viewed
- Chat conversations
- Windows opened
- Outgoing email and webmail

This Spyware gives the person who installed it a Web-based interface with summaries of logged information on the host computer.

Copies itself as C:\Program Files\svchost.exe.
Adds the value: "Srv32Win" = "C:\Program Files\svchost.exe"
to the registry key: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

Also can downloads updates from www.spytech-web.com.

Remove it with RegRun.

%program files%\svhost32.exe

Svhost32.exe is a Trojan PWSteal.Wowcraft.
Svhost32.exe tries to terminate antiviral programs installed on a user computer.
Svhost32.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%ProgramFiles%\svhost32.exe
%ProgramFiles%\rundll32.exe
%ProgramFiles%\Internat.exe
%System%\msdll.dll
Adds the value:
"load" = "[Path of the dropped file from step 1]"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill svhost32.exe process and remove svhost32.exe from Windows startup using RegRun Startup Optimizer.

%program files%\swis\wsw.exe

WSW.exe is a Spyware.WebSurfWatch.
WSW.exe monitors user Internet activity.
Related files:
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\WIND0WS.EXE
%ProgramFiles%\SWIS\WSW.exe
%Windir%\RSR2B.EXE
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill WSW.exe process and remove WSW.exe from Windows startup using RegRun Startup Optimizer.

%program files%\swpr\web.dll

web.dll is a Spyware.StealthWebPage.
web.dll records Internet activity.
Related files:
%ProgramFiles%\SWPR\web.dll
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove web.dll from Windows startup using RegRun Startup Optimizer.

%program files%\tbon.exe

tbon.exe is an Adware.Tbon.The Best Offer Networks.
tbon.exe displays advertisements.
tbon.exe monitors user Internet activity.
Related files:
%Windir%\tboninst.cfg
%Windir%\TBONUnst.htm
%ProgramFiles%\tboninst.cfg
%ProgramFiles%\Uninstall.exe
%ProgramFiles%\tbon.exe
Adds the value:
"tbon" = "[PATH TO ADWARE] /r"
to the Windows startup registry keys.
More info:
Removal:
Kill the process tbon.exe and remove tbon.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%program files%\time sync\time.exe

%PROGRAM FILES%\TIME SYNC\TIME.EXE is Troj/Dloader-IO.
Read more: http://www.sophos.com/security/analyses/...
Kill the process %PROGRAM FILES%\TIME SYNC\TIME.EXE and remove %PROGRAM FILES%\TIME SYNC\TIME.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

%program files%\unspypc\unspypc.exe

UnSpyPC.exe is an UnSpyPC.
Related files:
%ProgramFiles%\UnSpyPC\UnSpyPC.exe
%ProgramFiles%\UnSpyPC\UnSpyPCUpdate.exe
%ProgramFiles%\UnSpyPC\uninstall.exe
%ProgramFiles%\UnSpyPC\uns.ico
%ProgramFiles%\UnSpyPC\warez.dat
%ProgramFiles%\UnSpyPC\wover.dat
Adds the value:
"UnSpyPC" = "%ProgramFiles%\UnSpyPC\UnSpyPC.exe"
to the Windows startup registry keys.
More info: http://www.symantec.com/avcenter/venc/da...
Removal:
Kill the process UnSpyPC.exe and remove UnSpyPC.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%program files%\unspypc\unspypcupdate.exe

UnSpyPCUpdate.exe is an UnSpyPC.
Related files:
%ProgramFiles%\UnSpyPC\UnSpyPC.exe
%ProgramFiles%\UnSpyPC\UnSpyPCUpdate.exe
%ProgramFiles%\UnSpyPC\uninstall.exe
%ProgramFiles%\UnSpyPC\uns.ico
%ProgramFiles%\UnSpyPC\warez.dat
%ProgramFiles%\UnSpyPC\wover.dat
Adds the value:
"UnSpyPC" = "%ProgramFiles%\UnSpyPC\UnSpyPC.exe"
to the Windows startup registry keys.
More info: http://www.symantec.com/avcenter/venc/da...
Removal:
Kill the process UnSpyPCUpdate.exe and remove UnSpyPCUpdate.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%program files%\update.exe

update.exe is a Trojan.Myftu.
update.exe registers porn service without notification.
update.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Program Files%\playMovie.exe
%Program Files%\playDvdMovie.exe
%Program Files%\update.exe
%Program Files%\mch.exe
%Program Files%\movies.exe
%Program Files%\movload.exe
%Program Files%\mv99.exe
%Program Files%\freeMovies.exe
%Program Files%\WINSKJP.DLL
%Program Files%\MSINET.OCX
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill update.exe process and remove update.exe from Windows startup using RegRun Startup Optimizer.

%program files%\video access activex object\pmsnrr.exe

%PROGRAM FILES%\VIDEO ACCESS ACTIVEX OBJECT\PMSNRR.EXE is Trojan-Downloader.Zlob.Media-Codec.
Read more: http://research.sunbelt-software.com/thr...
Kill the process %PROGRAM FILES%\VIDEO ACCESS ACTIVEX OBJECT\PMSNRR.EXE and remove %PROGRAM FILES%\VIDEO ACCESS ACTIVEX OBJECT\PMSNRR.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

%program files%\vvylx.exe

%PROGRAM FILES%\VVYLX.EXE is Trojan/Backdoor.
Kill the process VVYLX.EXE and remove VVYLX.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

%program files%\weirdontheweb\weirdontheweb.exe

weirdontheweb.exe is an adware program Adware.WeirdOnTheWeb.
weirdontheweb.exe downloads and displays advertisements.
Related files:
%ProgramFiles%\WeirdOnTheWeb\weirdontheweb.exe
Adds the value:
"WeirdOnTheWeb" = "C:\Program Files\WeirdOnTheWeb\WeirdOnTheWeb.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill weirdontheweb.exe process and remove weirdontheweb.exe from Windows startup using RegRun Startup Optimizer.

%program files%\whenusearch\search.exe

%PROGRAM FILES%\WhenUSearch\search.exe is Adware-WhenUSearch.
Related files:
search.exe
search.dll
whse.exe
uninst.exe
Read more: http://vil.nai.com/vil/content/v_124768....
Kill the process %PROGRAM FILES%\WhenUSearch\search.exe and remove %PROGRAM FILES%\WhenUSearch\search.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%program files%\windows adstatus\winstatcomm.dll

WinStatComm.dll is a virus W32.Bleshare!dr.
WinStatComm.dll spreads via open network shares.
Related files:
bleh.exe
slinstaller.exe
emote.exe
loudnew.exe
mmxharr0.exe
toolbar.exe
%Program Files%\windows adstatus\WinStat.exe
%Program Files%\windows adstatus\WinStatComm.dll
%Program Files%\windows adstatus\WinStatKeep.exe
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove WinStatComm.dll from Windows startup using RegRun Startup Optimizer.

%program files%\windows media player\ wmlaunch .exe

wmlaunch .exe is a mass-mailing worm W32.Elitper.B@mm.
wmlaunch .exe spreads via open network shares.
wmlaunch .exe tries to terminate antiviral programs installed on a user computer.
Related files:
%Windir%\TASKMANAGER.exe
%Program Files%\Windows Media Player\ wmlaunch .exe
%Program Files%\mIRC\Downloads\WWE DIVAS.exe
Adds the value:
"Firewall" = "%Program files%\Windows Media Player\[space]wmlaunch[space].exe"
"Protection" = "%Program files%\Internet Explorer\Firewall.exe"
"SysRes" = "%Windir%\TASKMANAGER.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill wmlaunch .exe process and remove wmlaunch .exe from Windows startup using RegRun Startup Optimizer.

%program files%\windows nt\dialer.exe

%PROGRAM FILES%\Windows NT\dialer.exe is Worm/Rindu.D.
Related files:
%SYSDIR%\logonui.scr
%SYSDIR%\MyComp.scr
%SYSDIR%\userinit.exe
%SYSDIR%\sndvol32.exe
%SYSDIR%\calc.exe
%SYSDIR%\notepad.exe
%SYSDIR%\mspaint.exe
C:\MSOCache\dlcache\Lagu.scr
C:\MSOCache\dlcache\Gambar.scr
C:\MSOCache\dlcache\Film.scr
C:\MSOCache\dlcache\Dokumen Penting.scr
%PROGRAM FILES%\outlook express.scr
%PROGRAM FILES%\winamp.scr
%PROGRAM FILES%\Windows Media Player.scr
%PROGRAM FILES%\Windows NT\dialer.exe
%PROGRAM FILES%\Internet Explorer\IEXPLORE.EXE
Read more: http://www.avira.com/en/threats/section/...
Kill the process %PROGRAM FILES%\Windows NT\dialer.exe and remove %PROGRAM FILES%\Windows NT\dialer.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%program files%\winproject.dll

WinProject.dll is an adware program Adware.WinTaskAd.
WinProject.dll downloads and displays advertisements.
Related files:
%ProgramFiles%\AdStatServ.exe
%ProgramFiles%\AdStatKeep.exe
%ProgramFiles%\AdStatComm.dll
%ProgramFiles%\PrevAdComm.dll
%ProgramFiles%\WinTaskAd.exe
%ProgramFiles%\WinSched.exe
%ProgramFiles%\WinProject.dll
%Windir%\Temp\creditdan_WinTaskAdInstPack.exe
Adds the value:
"Windows TaskAd" = "[path to Adware.WinTaskAd]"
"AdStatus Service" = "[path to Adware.WinTaskAd]"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove WinProject.dll from Windows startup using RegRun Startup Optimizer.

%program files%\winrecon\codex.exe

Codex.exe is a Spyware.WinRecon.
Codex.exe logs keystrokes and takes screenshots.
Related files:
%ProgramFiles%\WinRecon\codex.exe
%ProgramFiles%\WinRecon\condex.exe
%ProgramFiles%\WinRecon\Dataview.exe
%ProgramFiles%\WinRecon\sp5.exe
%System%\kpAccess.dll
%System%\kpunzip.dll
%System%\kpzip.dll
%System%\MSSTDFMT.DLL
%Windir%\LastGood\System32\OLEAUT32.DLL
%Windir%\LastGood\System32\OLEPRO32.DLL
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill codex.exe process and remove codex.exe from Windows startup using RegRun Startup Optimizer.

%program files%\winrecon\condex.exe

Condex.exe is a Spyware.WinRecon.
Condex.exe logs keystrokes and takes screenshots.
Related files:
%ProgramFiles%\WinRecon\codex.exe
%ProgramFiles%\WinRecon\condex.exe
%ProgramFiles%\WinRecon\Dataview.exe
%ProgramFiles%\WinRecon\sp5.exe
%System%\kpAccess.dll
%System%\kpunzip.dll
%System%\kpzip.dll
%System%\MSSTDFMT.DLL
%Windir%\LastGood\System32\OLEAUT32.DLL
%Windir%\LastGood\System32\OLEPRO32.DLL
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill condex.exe process and remove condex.exe from Windows startup using RegRun Startup Optimizer.

%program files%\winrecon\dataview.exe

Dataview.exe is a Spyware.WinRecon.
Dataview.exe logs keystrokes and takes screenshots.
Related files:
%ProgramFiles%\WinRecon\codex.exe
%ProgramFiles%\WinRecon\condex.exe
%ProgramFiles%\WinRecon\Dataview.exe
%ProgramFiles%\WinRecon\sp5.exe
%System%\kpAccess.dll
%System%\kpunzip.dll
%System%\kpzip.dll
%System%\MSSTDFMT.DLL
%Windir%\LastGood\System32\OLEAUT32.DLL
%Windir%\LastGood\System32\OLEPRO32.DLL
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill Dataview.exe process and remove Dataview.exe from Windows startup using RegRun Startup Optimizer.

%program files%\winrecon\sp5.exe

sp5.exe is a Spyware.WinRecon.
sp5.exe logs keystrokes and takes screenshots.
Related files:
%ProgramFiles%\WinRecon\codex.exe
%ProgramFiles%\WinRecon\condex.exe
%ProgramFiles%\WinRecon\Dataview.exe
%ProgramFiles%\WinRecon\sp5.exe
%System%\kpAccess.dll
%System%\kpunzip.dll
%System%\kpzip.dll
%System%\MSSTDFMT.DLL
%Windir%\LastGood\System32\OLEAUT32.DLL
%Windir%\LastGood\System32\OLEPRO32.DLL
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill sp5.exe process and remove sp5.exe from Windows startup using RegRun Startup Optimizer.

%program files%\winskjp.dll

%program files%\wintaskad.exe

WinTaskAd.exe is an adware program Adware.WinTaskAd.
WinTaskAd.exe downloads and displays advertisements.
Related files:
%ProgramFiles%\AdStatServ.exe
%ProgramFiles%\AdStatKeep.exe
%ProgramFiles%\AdStatComm.dll
%ProgramFiles%\PrevAdComm.dll
%ProgramFiles%\WinTaskAd.exe
%ProgramFiles%\WinSched.exe
%ProgramFiles%\WinProject.dll
%Windir%\Temp\creditdan_WinTaskAdInstPack.exe
Adds the value:
"Windows TaskAd" = "[path to Adware.WinTaskAd]"
"AdStatus Service" = "[path to Adware.WinTaskAd]"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill WinTaskAd.exe process and remove WinTaskAd.exe from Windows startup using RegRun Startup Optimizer.

%program files%\wintective\wintective.exe

Wintective.exe is a Spyware.Wintective.
Wintective.exe logs keystrokes.
Wintective.exe monitors user Internet activity.
Related files:
%ProgramFiles%\wintective\wintective.exe
%System%\VB6STKIT.DLL
%System%\wintective.dll
%Windir%\ST6UNST.EXE
Adds the value:
"wintective" = "%ProgramFiles%\wintective\wintective.exe"
"UninstallString" = "C:\WINDOWS\st6unst.exe -n "C:\Program Files\wintective\ST6UNST.LOG" "
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill wintective.exe process and remove wintective.exe from Windows startup using RegRun Startup Optimizer.

%program files%\wv\wv.exe

wv.exe is a Spyware.Winvest.
wv.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%ProgramFiles%\wv\wvh.dll
%ProgramFiles%\wv\wvres.dll
%ProgramFiles%\wv\wv.exe
%Windir%\sysninit.dll
%Windir%\spoder.dll
%Windir%\syswvnt.dll
%Windir%\syswvh.dll
%Windir%\loaddll.exe
%Windir%\syswvwin.dll
%Windir%\syswvmail.dll
%Windir%\loaddll.dll
Adds the value:
"loaddll" = "loaddll.exe"
"(Default)" = "C:\Program Files\wv\wv.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill wv.exe process and remove wv.exe from Windows startup using RegRun Startup Optimizer.

%program files%\wv\wvh.dll

wvh.dll is a Spyware.Winvest.
wvh.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%ProgramFiles%\wv\wvh.dll
%ProgramFiles%\wv\wvres.dll
%ProgramFiles%\wv\wv.exe
%Windir%\sysninit.dll
%Windir%\spoder.dll
%Windir%\syswvnt.dll
%Windir%\syswvh.dll
%Windir%\loaddll.exe
%Windir%\syswvwin.dll
%Windir%\syswvmail.dll
%Windir%\loaddll.dll
Adds the value:
"loaddll" = "loaddll.exe"
"(Default)" = "C:\Program Files\wv\wv.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove wvh.dll from Windows startup using RegRun Startup Optimizer.

%program files%\xpcspypro\keyspy.dll

KeySpy.dll is a Spyware.XpcSpy.
KeySpy.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%ProgramFiles%\XSoftware\Working\XPCSpyPro.exe
%ProgramFiles%\XSoftware\XPCSpyPro\AppSpy.dll
%ProgramFiles%\XSoftware\XPCSpyPro\IESpy.dll
%ProgramFiles%\XSoftware\XPCSpyPro\KeySpy.dll
%ProgramFiles%\XSoftware\Working\AppMon.dll
%ProgramFiles%\XSoftware\Working\IEMon.dll
%ProgramFiles%\XSoftware\Working\KeyMon.dll
%System%\systemout.exe
%System%\SysDll32.dll
%System%\rx.exe
%System%\wintft.dll
Adds the value:
"System Check" = "Rundll32.exe SysDll32.dll,SystemCheck"
"ImagePath" = "%System%\systemout.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove KeySpy.dll from Windows startup using RegRun Startup Optimizer.

%program files%\xsoftware\working\appmon.dll

AppMon.dll is a Spyware.XpcSpy.
AppMon.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%ProgramFiles%\XSoftware\Working\XPCSpyPro.exe
%ProgramFiles%\XSoftware\XPCSpyPro\AppSpy.dll
%ProgramFiles%\XSoftware\XPCSpyPro\IESpy.dll
%ProgramFiles%\XSoftware\XPCSpyPro\KeySpy.dll
%ProgramFiles%\XSoftware\Working\AppMon.dll
%ProgramFiles%\XSoftware\Working\IEMon.dll
%ProgramFiles%\XSoftware\Working\KeyMon.dll
%System%\systemout.exe
%System%\SysDll32.dll
%System%\rx.exe
%System%\wintft.dll
Adds the value:
"System Check" = "Rundll32.exe SysDll32.dll,SystemCheck"
"ImagePath" = "%System%\systemout.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove AppMon.dll from Windows startup using RegRun Startup Optimizer.

%program files%\xsoftware\working\iemon.dll

IEMon.dll is a Spyware.XpcSpy.
IEMon.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%ProgramFiles%\XSoftware\Working\XPCSpyPro.exe
%ProgramFiles%\XSoftware\XPCSpyPro\AppSpy.dll
%ProgramFiles%\XSoftware\XPCSpyPro\IESpy.dll
%ProgramFiles%\XSoftware\XPCSpyPro\KeySpy.dll
%ProgramFiles%\XSoftware\Working\AppMon.dll
%ProgramFiles%\XSoftware\Working\IEMon.dll
%ProgramFiles%\XSoftware\Working\KeyMon.dll
%System%\systemout.exe
%System%\SysDll32.dll
%System%\rx.exe
%System%\wintft.dll
Adds the value:
"System Check" = "Rundll32.exe SysDll32.dll,SystemCheck"
"ImagePath" = "%System%\systemout.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove IEMon.dll from Windows startup using RegRun Startup Optimizer.

%program files%\xsoftware\working\keymon.dll

KeyMon.dll is a Spyware.XpcSpy.
KeyMon.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%ProgramFiles%\XSoftware\Working\XPCSpyPro.exe
%ProgramFiles%\XSoftware\XPCSpyPro\AppSpy.dll
%ProgramFiles%\XSoftware\XPCSpyPro\IESpy.dll
%ProgramFiles%\XSoftware\XPCSpyPro\KeySpy.dll
%ProgramFiles%\XSoftware\Working\AppMon.dll
%ProgramFiles%\XSoftware\Working\IEMon.dll
%ProgramFiles%\XSoftware\Working\KeyMon.dll
%System%\systemout.exe
%System%\SysDll32.dll
%System%\rx.exe
%System%\wintft.dll
Adds the value:
"System Check" = "Rundll32.exe SysDll32.dll,SystemCheck"
"ImagePath" = "%System%\systemout.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove KeyMon.dll from Windows startup using RegRun Startup Optimizer.

%program files%\xsoftware\working\xpcspypro.exe

XPCSpyPro.exe is a Spyware.XpcSpy.
XPCSpyPro.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%ProgramFiles%\XSoftware\Working\XPCSpyPro.exe
%ProgramFiles%\XSoftware\XPCSpyPro\AppSpy.dll
%ProgramFiles%\XSoftware\XPCSpyPro\IESpy.dll
%ProgramFiles%\XSoftware\XPCSpyPro\KeySpy.dll
%ProgramFiles%\XSoftware\Working\AppMon.dll
%ProgramFiles%\XSoftware\Working\IEMon.dll
%ProgramFiles%\XSoftware\Working\KeyMon.dll
%System%\systemout.exe
%System%\SysDll32.dll
%System%\rx.exe
%System%\wintft.dll
Adds the value:
"System Check" = "Rundll32.exe SysDll32.dll,SystemCheck"
"ImagePath" = "%System%\systemout.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill XPCSpyPro.exe process and remove XPCSpyPro.exe from Windows startup using RegRun Startup Optimizer.

%program files%\xsoftware\xpcspypro\appspy.dll

AppSpy.dll is a Spyware.XpcSpy.
AppSpy.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%ProgramFiles%\XSoftware\Working\XPCSpyPro.exe
%ProgramFiles%\XSoftware\XPCSpyPro\AppSpy.dll
%ProgramFiles%\XSoftware\XPCSpyPro\IESpy.dll
%ProgramFiles%\XSoftware\XPCSpyPro\KeySpy.dll
%ProgramFiles%\XSoftware\Working\AppMon.dll
%ProgramFiles%\XSoftware\Working\IEMon.dll
%ProgramFiles%\XSoftware\Working\KeyMon.dll
%System%\systemout.exe
%System%\SysDll32.dll
%System%\rx.exe
%System%\wintft.dll
Adds the value:
"System Check" = "Rundll32.exe SysDll32.dll,SystemCheck"
"ImagePath" = "%System%\systemout.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove AppSpy.dll from Windows startup using RegRun Startup Optimizer.

%program files%\xsoftware\xpcspypro\iespy.dll

IESpy.dll is a Spyware.XpcSpy.
IESpy.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%ProgramFiles%\XSoftware\Working\XPCSpyPro.exe
%ProgramFiles%\XSoftware\XPCSpyPro\AppSpy.dll
%ProgramFiles%\XSoftware\XPCSpyPro\IESpy.dll
%ProgramFiles%\XSoftware\XPCSpyPro\KeySpy.dll
%ProgramFiles%\XSoftware\Working\AppMon.dll
%ProgramFiles%\XSoftware\Working\IEMon.dll
%ProgramFiles%\XSoftware\Working\KeyMon.dll
%System%\systemout.exe
%System%\SysDll32.dll
%System%\rx.exe
%System%\wintft.dll
Adds the value:
"System Check" = "Rundll32.exe SysDll32.dll,SystemCheck"
"ImagePath" = "%System%\systemout.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove IESpy.dll from Windows startup using RegRun Startup Optimizer.

%program files%\ykpmd\ykpnd.exe

YKPND.exe is a Spyware.CMK.
YKPND.exe tries to terminate antiviral programs installed on a user computer.
YKPND.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%ProgramFiles%\YKPMD\EventScheduler.mdb
%ProgramFiles%\YKPMD\Help.rtf
%ProgramFiles%\YKPMD\riched32.dll
%ProgramFiles%\YKPMD\YKPND.exe
%Windir%\Installer\cf1272.msi
%System%\actskn43.ocx
%System%\dijpg.dll
%System%\richtx32.ocx
%System%\skinboxer43.dll
Adds the value:
"C:\Program Files\YKPMD\" = "YKPND.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill YKPND.exe process and remove YKPND.exe from Windows startup using RegRun Startup Optimizer.

%program files%\zango applications\zango tv times\cryptoapi.dll

CryptoAPI.dll is an adware program Adware.ZangoSearch.
CryptoAPI.dll monitors user Internet activity.
Related files:
%ProgramFiles%\ZangoClient\zanu.exe
%ProgramFiles%\ZangoClient\zanuhook.dll
%ProgramFiles%\Zango Applications\Zango TV Times\CryptoAPI.dll
%ProgramFiles%\Zango Applications\Zango TV Times\TvSkin.dll
%ProgramFiles%\Zango Applications\Zango TV Times\ZangoTVTimes.exe
Adds the value:
"zanu" = "%ProgramFiles%\ZangoClient\zanu.exe"
"Zango TvTimes" = ""C:\PROGRA~1\ZANGOA~1\ZANGOT~1\ZANGOT~1.EXE" :auto"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove CryptoAPI.dll from Windows startup using RegRun Startup Optimizer.

%program files%\zango applications\zango tv times\tvskin.dll

TvSkin.dll is an adware program Adware.ZangoSearch.
TvSkin.dll monitors user Internet activity.
Related files:
%ProgramFiles%\ZangoClient\zanu.exe
%ProgramFiles%\ZangoClient\zanuhook.dll
%ProgramFiles%\Zango Applications\Zango TV Times\CryptoAPI.dll
%ProgramFiles%\Zango Applications\Zango TV Times\TvSkin.dll
%ProgramFiles%\Zango Applications\Zango TV Times\ZangoTVTimes.exe
Adds the value:
"zanu" = "%ProgramFiles%\ZangoClient\zanu.exe"
"Zango TvTimes" = ""C:\PROGRA~1\ZANGOA~1\ZANGOT~1\ZANGOT~1.EXE" :auto"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove TvSkin.dll from Windows startup using RegRun Startup Optimizer.

%program files%\zango applications\zango tv times\zangotvtimes.exe

ZangoTVTimes.exe is an adware program Adware.ZangoSearch.
ZangoTVTimes.exe monitors user Internet activity.
Related files:
%ProgramFiles%\ZangoClient\zanu.exe
%ProgramFiles%\ZangoClient\zanuhook.dll
%ProgramFiles%\Zango Applications\Zango TV Times\CryptoAPI.dll
%ProgramFiles%\Zango Applications\Zango TV Times\TvSkin.dll
%ProgramFiles%\Zango Applications\Zango TV Times\ZangoTVTimes.exe
Adds the value:
"zanu" = "%ProgramFiles%\ZangoClient\zanu.exe"
"Zango TvTimes" = ""C:\PROGRA~1\ZANGOA~1\ZANGOT~1\ZANGOT~1.EXE" :auto"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill ZangoTVTimes.exe process and remove ZangoTVTimes.exe from Windows startup using RegRun Startup Optimizer.

%program files%\zango programs\zango toolbar\zangotb.dll

zangotb.dll is a 180Solutions Zango Spyware.
zangotb.dll downloads and displays advertisements.
zangotb.dll monitors user Internet activity.
Remove zangotb.dll using RegRun "Scan for Viruses" feature.
http://www.regrun.com

%program files%\zangoclient\zanu.exe

Zanu.exe is an adware program Adware.ZangoSearch.
Zanu.exe monitors user Internet activity.
Related files:
%ProgramFiles%\ZangoClient\zanu.exe
%ProgramFiles%\ZangoClient\zanuhook.dll
%ProgramFiles%\Zango Applications\Zango TV Times\CryptoAPI.dll
%ProgramFiles%\Zango Applications\Zango TV Times\TvSkin.dll
%ProgramFiles%\Zango Applications\Zango TV Times\ZangoTVTimes.exe
Adds the value:
"zanu" = "%ProgramFiles%\ZangoClient\zanu.exe"
"Zango TvTimes" = ""C:\PROGRA~1\ZANGOA~1\ZANGOT~1\ZANGOT~1.EXE" :auto"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill zanu.exe process and remove zanu.exe from Windows startup using RegRun Startup Optimizer.

%program files%\zangoclient\zanuhook.dll

Zanuhook.dll is an adware program Adware.ZangoSearch.
Zanuhook.dll monitors user Internet activity.
Related files:
%ProgramFiles%\ZangoClient\zanu.exe
%ProgramFiles%\ZangoClient\zanuhook.dll
%ProgramFiles%\Zango Applications\Zango TV Times\CryptoAPI.dll
%ProgramFiles%\Zango Applications\Zango TV Times\TvSkin.dll
%ProgramFiles%\Zango Applications\Zango TV Times\ZangoTVTimes.exe
Adds the value:
"zanu" = "%ProgramFiles%\ZangoClient\zanu.exe"
"Zango TvTimes" = ""C:\PROGRA~1\ZANGOA~1\ZANGOT~1\ZANGOT~1.EXE" :auto"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove zanuhook.dll from Windows startup using RegRun Startup Optimizer.

%programfiles%\errclean\sysrep.exe

%programfiles%\intcodec\uninst.exe

%ProgramFiles%\IntCodec\uninst.exe is Trojan.Emcodec.F.
Related files:
%ProgramFiles%\IntCodec\zcodec.exe (Trojan.Zlob)
Read more: http://www.symantec.com/enterprise/secur...
Kill the process %ProgramFiles%\IntCodec\uninst.exe and remove %ProgramFiles%\IntCodec\uninst.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%programfiles%\internet exp1orer\iexplore.exe

%ProgramFiles%\Internet Exp1orer\iexplore.exe is W32.Lecna.D.
Related files:
%System%\netscv.exe
%System%\netsvcs.exe
%Windir%\DriverNum.dat
Read more: http://www.symantec.com/enterprise/secur...
Kill the process %ProgramFiles%\Internet Exp1orer\iexplore.exe and remove %ProgramFiles%\Internet Exp1orer\iexplore.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%programfiles%\quick launch\mousehook.dll

%programfiles%\safestrip\sysbackup\explorer.exe

%programfiles%\safestrip\sysbackup\ntoskrnl.exe

%programfiles%\safestrip\sysbackup\wininet.dll

%programfiles%\winspy demo\riched32.dll

%sysdir%\ ymagic.dll

%SysDir%\ YMagic.dll is Trojan/Backdoor.
Remove YMagic.dll using RegRun "Scan for Viruses" feature.
http://www.regrun.com

%sysdir%\$sys$drv.exe

$sys$drv.exe is a Trojan Backdoor.Ryknos.
$sys$drv.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\$sys$drv.exe
Adds the value:
"$sys$drv" = "$sys$drv.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill $sys$drv.exe process and remove $sys$drv.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\$sys$filesystem\aries.sys

aries.sys is rootkit SecurityRisk.First4DRM.
aries.sys is used to hide files, processes and registry with string �$sys$�.
aries.sys is a kernel mode rootkit.
Rootkit creates new system driver.
Related files:
%System%\$sys$filesystem\aries.sys
Adds the value:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\$sys$aries
to the Windows startup registry keys.
More info: http://www.symantec.com/security_respons...

%sysdir%\$sys$xp.exe

$sys$xp.exe is a Trojan.Stinx-F.
$sys$xp.exe opens a back door.
$sys$xp.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\$sys$xp.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill $sys$xp.exe process and remove $sys$xp.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\%sysdir%\xptptt.dll

%SysDir%\xptptt.dll is Trojan/Backdoor.
Remove xptptt.dll using RegRun "Scan for Viruses" feature.
http://www.regrun.com

%sysdir%\?user.exe

User.exe is a mass-mailing worm W32.Kedebe.D@mm.
User.exe tries to terminate antiviral programs installed on a user computer.
User.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\nbtstat.exe
%System%\usrinit.exe
%System%\user.exe
%System%\winhlp32.exe
%System%\telnet.exe
%System%\locator.exe
%System%\recover.exe
%System%\logman.exe
%System%\dlhost.exe
%System%\logonui.exe
%System%\winspol.exe
%System%\services.exe
%System%\svchost.exe
%System%\lsas.exe
%System%\rundl32.exe
%System%\regedt32.exe
%System%\winlogon.exe
%System%\wuauclt.exe
Adds the value:
"Run" = "[PATH TO %System%\[FILE NAME]]"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill user.exe process and remove user.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\[random letters]\svchost.exe

%SysDir%\[RANDOM LETTERS]\svchost.exe is W32.Kelvir.LS.
Read more: http://www.symantec.com/enterprise/secur...
Kill the process %SysDir%\[RANDOM LETTERS]\svchost.exe and remove %SysDir%\[RANDOM LETTERS]\svchost.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\\loader.exe

%SysDir%\\Loader.exe is Trojan/Backdoor Backdoor.Simali.
Kill the process %SysDir%\\Loader.exe and remove %SysDir%\\Loader.exe from Windows startup.
Register itesf in Active Setup registry key.
http://securityresponse.symantec.com/avc...

%sysdir%\\windrive.exe

Trojan Backdoor.Sdbot.AF
Opens a backdoor on the infected computer by connecting to an IRC server at TCP port 6667 on one or more of the following hosts:
sizz.afraid.org
Spreads to the following network shares using pass dictionary.
Remove it from Windows startup using RegRun Startup Optimizer.

%sysdir%\___j.dll

___j.dll is rootkit W32.Maslan.A@mm.
___j.dll is used to hide files, processes and registry.
___j.dll is a user mode rootkit.
___j.dll opens a back door.
Rootkit injects itself into the svchost.exe process.
___j.dll tries to terminate antiviral programs installed on a user computer.
___j.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\___j.dll
%System%\___r.exe
%System%\___synmgr.exe
%System%\___n.exe
%System%\___e
%System%\___u
Adds the value:
"Microsoft Synchronization Manager" = "___synmgr.exe"
"Microsoft Windows DHCP" = "___r.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

"Microsoft Synchronization Manager" = "___synmgr.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
to the Windows startup registry keys.
Added to registry:

More info: http://www.symantec.com/security_respons...

%sysdir%\_accwiz.exe

_accwiz.exe is a Trojan.Certif-N.
_accwiz.exe monitors user Internet activity and bank information.
It sends stolen data to a hacker site.
Related files:
%System%\_accwiz.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill _accwiz.exe process and remove _accwiz.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\_kerne1.exe

_Kerne1.exe is a Trojan.Lineage-AN.
_Kerne1.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\_Kerne1.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill _Kerne1.exe process and remove _Kerne1.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\_msopen.exe

_msopen.exe is a Trojan.Dremn-B.
_msopen.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\Policy\policy.dll
%System%\Policy\syspol.exe
%System%\_msopen.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill _msopen.exe process and remove _msopen.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\{fbd2ebd0-e6df-456e-b300-a4d10a90c683}.dll

%SysDir%\{FBD2EBD0-E6DF-456E-B300-A4D10A90C683}.dll is Trojan/Backdoor BigMeanGorilla.
Kill the file %SysDir%\{FBD2EBD0-E6DF-456E-B300-A4D10A90C683}.dll and remove %SysDir%\{FBD2EBD0-E6DF-456E-B300-A4D10A90C683}.dll from Windows startup.

%sysdir%\007guard.exe

007guard.exe is a Adware.2search.
007guard.exe monitors user Internet activity.
Related files:
C:\Program Files\2Search\getst.exe
C:\Program Files\2Search\main.exe
C:\Program Files\2Search\plugin.dll
C:\Program Files\2Search\svchost.exe
%System%\007guard.exe
%System%\2searchinstaller.exe
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill 007guard.exe process and remove 007guard.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\0mcamcap.exe

%SysDir%\0MCAMCAP.EXE is Trojan/Backdoor.
Kill the process 0MCAMCAP.EXE and remove 0MCAMCAP.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\0pengld.exe

0penGLD.exe is a worm W32.Yimp-A.
0penGLD.exe spreads via the Yahoo and AOL Instant Messenger IM clients.
Related files:
%System%\0penGLD.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill 0penGLD.exe process and remove 0penGLD.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\1021\services.exe

%SysDir%\1021\SERVICES.EXE is Trojan/Backdoor.
Kill the process %SysDir%\1021\SERVICES.EXE and remove %SysDir%\1021\SERVICES.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\1sass.exe

%SysDir%\1sass.exe is Trojan/Backdoor.
Kill the process 1sass.exe and remove %SysDir%\1sass.exe from Windows using RegRun.
www.regrun.com

%sysdir%\1u7.exe

1u7.exe is Trojan/Backdoor.
Kill the process 1u7.exe and remove 1u7.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\2_0_1browserhelper2.dll

2_0_1browserhelper2.dll is an adware program Adware.BlazeFind.
2_0_1browserhelper2.dll is a Browser Helper Object.
2_0_1browserhelper2.dll downloads and displays advertisements.
Related files:
%System%\2_0_1browserhelper2.dll
%System%\UnstSA2.exe
%System%\key2.txt
%System%\installer2.exe
%System%\Omniscienthook.dll
%System%\omniband.dll
%System%\wsaupdater.exe
Adds the value:
"Windows SA" = "[path to the adware program]"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove 2_0_1browserhelper2.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\28.tmp

%SysDir%\28.tmp is Trojan/Backdoor.
Installed as "Services" value.
Kill the process %SysDir%\28.tmp and remove %SysDir%\28.tmp from Windows startup.

%sysdir%\2searchinstaller.exe

2searchinstaller.exe is a Adware.2search.
2searchinstaller.exe monitors user Internet activity.
Related files:
C:\Program Files\2Search\getst.exe
C:\Program Files\2Search\main.exe
C:\Program Files\2Search\plugin.dll
C:\Program Files\2Search\svchost.exe
%System%\007guard.exe
%System%\2searchinstaller.exe
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill 2searchinstaller.exe process and remove 2searchinstaller.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\33.exe

33.exe is a mass-mailing worm W32.Anpes@mm.
33.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\33.exe
%Windir%\vtemp.dll
%Windir%\vtemp.vbs
%Windir%\winsnav.vbs
%Windir%\win32sp.vbs
Adds the value:
"winXP" = "%System"\33.exe/background"
"windef" = "Win32sp.vbs -quiet"
"NAV Agent" = "%Windir%\winsnav.vbs"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill 33.exe process and remove 33.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\3d_sound.exe

3d_sound.exe is a Trojan.Riados-A.
3d_sound.exe opens a back door.
Related files:
%System%\3d_sound.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill 3d_sound.exe process and remove 3d_sound.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\4d.tmp

4D.TMP is Trojan/Backdoor.
Kill the file 4D.TMP and remove 4D.TMP from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\56171d04\e5c5bdb4.exe

E5C5BDB4.exe is an adware program Adware.CashSaver.
E5C5BDB4.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
csinstall.exe
%System%\mscsclient.exe
%System%\cashsaverbho.dll
%System%\csuninstall.exe
%System%\56171D04\E5C5BDB4.exe
%System%\csupdate.info
%System%\mscsclient.ekw
Adds the value:
"00D34A52" = "%System%\56171D04\E5C5BDB4.exe"
"MSCSCLIENT" = "%System%\mscsclient.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill E5C5BDB4.exe process and remove E5C5BDB4.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\8g.dll

8g.DLL is a Trojan Backdoor.Graybird.O.
8g.DLL monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%ProgramFiles%\Server\Server.exe
%System%\8g.DLL
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove 8g.DLL from Windows startup using RegRun Startup Optimizer.

%sysdir%\a15svcs.exe

a15svcs.exe is a Trojan.PPdoor-Q.
a15svcs.exe opens a back door.
a15svcs.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\dpnetmsg.exe
%System%\iueninet.dll
%System%\fsmgntfs.dll
%System%\ntmapast.dll
%System%\ir50psrv.exe
%System%\kbd1uery.dll
%System%\lfyockaa.dll
%System%\a15svcs.exe
%System%\dpnmdlib.exe
%System%\c_28usic.dll
%System%\atiysnpn.dll
%System%\treemqoa.dll
%System%\arptutdn.dll
%System%\eulapart.dll
%System%\smlo8thk.exe
%System%\odbcfwci.ime
%System%\hgakheg.dll
%System%\jkwbhew.dll
%System%\testtest.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill a15svcs.exe process and remove a15svcs.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\a1g.exe

W32.Atak.B@mm
Adds to Windows startup.
Uses own SMTP engine to send e-mails.
Remove it from startup using Regrun Startup Optimizer.

%sysdir%\aantx.dll

AANTX.DLL is a Adware.Getup.B.
AANTX.DLL is a Browser Helper Object.
AANTX.DLL displays advertisements.
Related files:
%System%\AANTX.DLL
%System%\WinExplore.exe
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove AANTX.DLL from Windows startup using RegRun Startup Optimizer.

%sysdir%\ab1dll.dll

ab1dll.dll is Trojan.Lineage-BB.
ab1dll.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\explorer.exe
%System%\ab1dll.dll.
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove ab1dll.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\abcedg21.dll

Abcedg21.dll is a Trojan Backdoor.Homutex.
Abcedg21.dll spreads via open network shares.
Abcedg21.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\abcedg21.dll
%System%\drivers\usbcamd0.sys
Adds the value:
"PackedCatalogItem" = "%System%\abcedg21.dll"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove abcedg21.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\abrada.dll

%SysDir%\abrada.dll is Trojan/Backdoor.
Remove abrada.dll using RegRun "Scan for Viruses" feature.
http://www.regrun.com

%sysdir%\abrada.exe

abrada.exe is a spyware TSPY_GOLDUN.CP.
abrada.exe spreads by e-mail.
abrada.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\abrada.dat
%System%\abrada.exe
%System%\abrada.ini
%System%\abradal.dll
%System%\abradaload.dll
More info: http://www.trendmicro.com/vinfo/grayware...
Removal:
Kill the process abrada.exe and remove abrada.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\abradal.dll

abradal.dll is a spyware TSPY_GOLDUN.CP.
abradal.dll spreads by e-mail.
abradal.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\abrada.dat
%System%\abrada.exe
%System%\abrada.ini
%System%\a