Necessary At your option Useless Dangerous Application database
Startupapps.com recommends you:

Detect and remove hidden rootkits using UnHackMe UnHackMe - Rootkit Killer Free fully functional 30-days trial.


RegRun Security Suite = 24 system utilities for protecting your computer. Try now!

Buy Now!

I would like to say that RegRun has helped me on more than 1 occasion when it comes to spyware/adware by letting me know automatically that a piece of it got added to Windows startup. There is so much spyware/addware out there today it's hard to imagine being without RegRun. I like many other features too including the daily registry backups and file protection.

Chris Wagers

00008690.dll
000sthk.exe
00b.exe
01.exe
0815.exe
0er8k4va.exe
0x32.exe
1.exe
100171be.exe
100176br.exe
10021.exe
1037v.exe
1111a.exe
1111swapmgr.exe
1111tapidef.dll
115255123116.exe
120-hp.exe
1226345244.exe
13567962ld.exe
138762763.exe
180.exe
180adsolution.exe
180ax.exe
180sainstaller.dll
180sainstallernusalm.exe
197_150_ni_3.exe
1dailups.exe
1hellbot.exe
1htk1j.exe
1on1.exe
1x32.exe
20050726-007-i32-1.exe
20061120.exe
2007rox.dll
2020searchtoolbar.exe
20242402.dll
2236_32.dll
23100247.exe
2kbug-mircfix.exe
2x32.exe
32 tick.exe
32rundll.exe
3339_32.dll
3721.4.dll
37568052ld.exe
386.exe
3fl9ckv5.exe
4.exe
412124.tmp
464rhdve.exe
4d1b90fddf6b.dll
4d1b90fddf6b.exe
4dflowerbox.scr
5.exe
514.exe
5-2-46-112.exe
53msong.exe
63mm.exe
64 spam.exe
666inse_1.exe
6a14ompd.exe
7kam04t8.exe
80d0.exe
876029.exe
888bar.dll
8ply92.dll
912_121.exe
9129837.exe
9181322ld.exe
919_133.exe
98s.exe
9sy.exe
a.exe
a@26m.exe
a_s.exe
a0003016.exe
a0006994.exe
a0014196.dll
a0032298.exe
a0101562.exe
a0159105.exe
a3dxx.dll
a5srchas.dll
a64sddd.exe
a65d.exe
a6befba6.exe
aaifil32.dll
aasr.exe
aaupdt.exe
abc2007.exe
abcdefgh.exe
abcxyz.exe
abrek.exe
abu.exe
abx_search.dll
ac2_0009.exe
ac2_0010.exe
acac.dll
accesobdsatel.dll
accesobdsunahip.dll
accessdrv.sys
accesssetup.266.exe
accesweb.exe
accodase.exe
account_details.doc.exe
accountingcore.dll
accovepv.exe
accra
acespy32.exe
acexe.exe
acid setup.exe
acid.exe
acidkor.exe
acidshivers.exe
aclcontrol.exe
aclient.dll
a-client2.exe
aclisitatualiza.exe
acpi89.sys
acpidisk.sys
acpmonsrv.exe
acrmon32.exe
acroup32.exe
acsysiom.exe
actalert.exe
actboost.exe
actionscr.exe
activationmanager.dll
activeds.exe
activescan.exe
activex.exe
actsrv.exe
ad12_cli.exe
ad12_srv.exe
adasoftw.exe
adcomplusanalytic.exe
addcls.exe
addhf32.exe
addlh32.exe
addol.exe
addqb32
addrmshelp.dll
addtm32.exe
addui32.exe
adgknqtx.exe
adidas.worm.exe
adir.dll
adirka.exe
adirss.exe
adl_dh.exe
adm4005.exe
admagic.exe
admilliservx.dll
admin$@.dll
adminmgr.exe
admintool.exe
admparse.exe
adn_sis.dll
adobe photoshop 7.0 serial key.exe
adobe32.exe
adobeacr.dll
adobemgr.exe
adobepnl.dll
adober.exe
adobes.exe
adp123.exe
adriss.exe
adrotate.dll
adrotate1.dll
adslcom.exe
adslcomdos.exe
adsnt.exe
adsnwy.exe
adspipe.dll
adstartup.exe
adstatkeep.exe
adstatserv.exe
adtech2006.exe
adtech2006a.exe
adult_chat1.exe
adult1.exe
adultcontentviewer[1].exe
adv32.exe
advantage.exe
advapi32.exe
advbot.exe
advchks.exe
advmon32.exe
advpack1.exe
advpsys.exe
advvpi32.dll
aecache.exe
aelupsvc32.dll
aervicesn.exe
aexl.exe
afilterplatform.exe
afkvvy.dll
ageheru.exe
agetltfeibe.exe
agldccotm.exe
agony.sys
agp32.exe
agrssg.exe
agseyapp.exe
agsystem2.exe
ahah.exe
ahdp.dll
ahjinst.exe
ahost.exe
ahtun.exe
aim reminder.exe
aim95.exe
aimplg.exe
aimsgr.exe
aimsng.exe
aimwindowsv.exe
airftp.exe
ais32.exe
ak47.dll
ak922.sys
akikaze.exe
akiller.dll
aklsp.dll
al2dll.dll
albus.sys
alczz.exe
alertic.exe
alg1.exe
alg2k.exe
alggg.exe
algose32.exe
algs.exe
algs5.exe
algsrvs.exe
algu.exe
alicesd.exe
all_files4.exe
allch.dll
alligt.exe
allinonespy.exe
allof.exe
alm.exe
alrsbatt.dll
alserv32.exe
altpayv2.exe
altsvc.exe
alxres.dll
amagent3.exe
amaware.dll
amazingtens.exe
amcxlss.exe
amd64.exe
amor.exe
amp2pl.exe
amsn.exe
amsndmgr.exe
amsngr.exe
amsnmgr.exe
amsnmsgrs.exe
anacon.exe
aneel.exe
angel.exe
aniee.exe
ann.exe
anoafpan.exe
ante browse trust.exe
anti.exe
anti_cih.exe
anti_trojan.exe
antiadware.exe
antiav.exe.exe
antibowsblue.exe
antidote[1.2].exe
antidote[1.3].exe
antigen.exe
antinuke.exe
antiprotect.exe
antispyrus.exe
antispystorm.exe
antispywareshield.exe
antispywareshield0.dll
antispywareshield1.dll
antispywareshield3.dll
antiv.exe
antivermeans.exe
antivermins.exe
antiverminspro.exe
antivir32.exe
antivirgear 3.7.exe
antivirscan.exe
antivirus.exe
anti-virus.exe
antiviruspro.exe
antiwpa.dll
anvshell32.exe
aol32.exe
aolclient.exe
aolconf.exe
aolfix.exe
aolmessenger.exe
aolmsg.exe
aolserviceshosts.exe
aolsnc.exe
aolstart.exe
aolsw.exe
aop2.exe
aosh.exe
aounsmn.exe
ap9h4qmo.exe
apd123.exe
apev.exe
aphex.exe
apicf32.exe
apicrypt.dll
apidxp.dll
apimonx.exe
aping32.exe
apipp.exe
apitr32.exe
apollo_04.exe
appache.exe
apparat.dll
appconf.exe
appconn.exe
appcontrol.exe
appdc.exe
appdl.dll
appds32.exe
append.dll
appft.exe
apphost.exe
appinit_dlls
appis.exe
application.exe
appmagr.dll
appmastercenter.exe
appmgr32.dll
appmon.dll
appmv.dll
apprn32.exe
apprp32.exe
appstraka316.exe
appunreg.exe
appxc32.exe
appxe.exe
appxt.exe
appzy32.exe
aprload.exe
apsvc.exe
apuliaiv.exe
apv.exe
aq3hel~1.exe
aql32.exe
arcac.exe
arcaderockstar32.exe
archgui.exe
archiver.exe
arcres.dll
arena.exe
arepxpsn.dll
argsmmsg.exe
ariel.exe
aritima.exe
arpl.exe
arrdt.exe
arse.exe
artchker.exe
artm_new.dll
arupdate.exe
asappsrv.dll
ascdl.exe
asclt.exe
asdapi.exe
asddll32.exe
asgag.exe
asgp32.dll
ashprot.sys
asian trojan.exe
asijdie.exe
aslru.exe
asmend.exe
asmonitor.exe
asmphoto1.exe
asmphoto2.exe
asmserv.exe
asmsjtm.exe
asn2.exe
aspam.exe
aspi242501.exe
aspimgr.exe
asr_sdm.exe
asr_sdmr.exe
asrupdate.exe
asscrpro.exe
assist4.exe
assistantwzd.exe
assistse.exe
astr.exe
asusrx20.dll
asusrx25.sys
aswboot.exe
aswnk.exe
asycfilt.exe
at12evxx.exe
atapidrv.exe
atba.exe
atecaca.exe
ati.exe
ati2kaag.dll
ati2ksag.sys
ati2vid.exe
ati2xxx.exe
ati3duag.exe
ati3evx.exe
aticpaxx.exe
atidrvxx.exe
atievx.exe
atigfx.exe
atip.exe
atipatxx.exe
atiphexx.exe
atiptext.exe
atira.exe
atirage4dpro.exe
atiupdate5.exe
atiupdpl.exe
atiupdxx.exe
ativvaxx.exe
atixd.exe
atixvdm.exe
atkuswo.exe
atl_helper.exe
atla.dll
atlag.exe
atland.sys
atlbe32.exe
atlcs32.exe
atliehelper.exe
atllsimm.exe
atlox32.exe
atlw.dll
atmconf.exe
atmdlusr.exe
atomic2.exe
atomiclog.exe
atommanager.exe
atoolbar.exe
atrconf.exe
atrusx.exe
atsiv.exe
attnengine.exe
au_.exe
au1g.exe
audconf.exe
audi32.exe
audiocfg.exe
audiodrv.exe
audiohq.exe
audioinf.exe
audiosrv.exe
auekxrz.exe
auf0.exe
aufa.dll
auqxbs.exe
aurareco.exe
aureco.exe
auribbqs.exe
aurora.exe
aurorahandler.dll
austr.dll
austria.exe
auto.exe
auto_update_install.exe
auto_update_loader.exe
autodisc.exe
autodisc32.dll
autoheal.exe
autohk.exe
automgr32.exe
automove.exe
automsupd.exe
autopdate.exe
autopoll.exe
autoprotect.exe
autosys.exe
autoupdaterinstaller[1].exe
autoupdatewin31.dll
autoupdatewin33.exe
aux32.exe
av.exe
avagnt.exe
avamx.exe
avantage32.exe
avg75f_431a836[1].exe
avg7srw.sys
avicap32.exe
avifile5.exe
avilifat.exe
avkernel.dll
avkir.exe
avmon.exe
avp_updates.exe
avp-32.exe
avpb.exe
avpe64.sys
avpg.exe
avpguard.exe
avpmondll.exe
avpmonitor.exe
avpo.exe
avpo0.dll
avpr.exe
avprotect.exe
avprotect9x.exe
avpsrv.exe
avserve.exe
avserve2.exe
avsynmgr32e.exe
avupdate.exe
avwav32.dll
awab.exe
awcrs.exe
awesome32.exe
awindll.exe
awinrar.exe
awola.exe
awrexec.exe
awstp.dll
awtqnkh.dll
awtqo.dll
awtrqpq.dll
awtsp.dll
awtsq.dll
awtss.dll
awwservice.exe
axdebugl.dll
axdist.exe
axfd.exe
axlet.dll
azbin.exe
azip32.dll

Dangerous  DANGEROUS - A
Updated weekly. Last update: April 9 2018

Improve boot up time Run a free scan to diagnose your PC and identify the system boottle necks slowing you down. Start Test

Fix Windows PC's Fast! Automated Software Repairs damaged & slow windows systems in 1 click.


00008690.dll
00008690.dll is a Trojan.Webloin.
00008690.dll executes the .dll file and deletes it.
Related files:
%System%\[Original file name of the Trojan].exe
%UserProfile%\Local Settings\Temp\[Random file name].dll
%System%\00008690.dll
More info:
http://securityresponse.symantec.com/avc...
Removal:
Remove ssmc.dll from Windows startup using RegRun Startup Optimizer.

000sthk.exe
000sthk.exe is Trojan/Backdoor.
Kill the process 000sthk.exe and remove 000sthk.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

00b.exe
Remote Access

01.exe
01.exe is Trojan.Flush.L.
Related files:
%System%\kd[3 RANDOM LETTERS].exe - hidden by a user mode rootkit
%UserProfile%\Local Settings\Temp\01.exe
%UserProfile%\Local Settings\Temp\02.exe
%ProgramFiles%\AdultAccess\Uninstall.exe
%UserProfile%\Start Menu\Programs\AdultAccess\Uninstall.lnk
Trojan.Flush.L is a Trojan horse that modifies the DNS server settings on the compromised computer and redirects the browser to potentially malicious Web sites.
Read more:
http://www.symantec.com/enterprise/secur...
Kill the process 01.exe and remove 01.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

0815.exe
0815.exe is Trojan/Backdoor.
Kill the process 0815.exe and remove 0815.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

0er8k4va.exe
Msnavc32.exe is the new generation of VX2 adware components.
Msnavc32.exe runs from Windows startup registry keys.
Also, Msnavc32 alters the AppInitDLLs registry value to track all started processes and Internet activity.
Msnavc32 copies its body to the Windows\System32 folder.
Msnavc32 can change WinSock2 LSP chain.
It inserts the dolsp.dll into the LSP chain.

Related files:
0er8k4va.exe
Mkfxut.exe
pkdacs.exe
ywrqku.exe
msnavc32.exe
AutoUpdate.exe
winntcreate.exe
vwix32.exe
sysmonnt.exe
winhcek32.exe
qlykdnb.dll
rypgvtoimrl.exe
spwgoc.exe
msnavc32.exe
sysmonnt
hpdll.exe
w?wexec.exe
ffisearch.exe

Delete the files.
They are may be hidden.

C:\Program Files\0er8k4va\0er8k4va.exe
C:\WINDOWS\System32\Mkfxut.exe
C:\WINDOWS\system32\pkdacs.exe
C:\WINDOWS\System32\ywrqku.exe
C:\windows\system32\msnavc32.exe
C:\Program Files\AutoUpdate\AutoUpdate.exe
C:\WINDOWS\System32\winntcreate.exe
C:\WINDOWS\System32\vwix32.exe
C:\WINDOWS\System32\sysmonnt.exe
C:\WINDOWS\System32\winhcek32.exe
C:\WINDOWS\System32\qlykdnb.dll
C:\WINDOWS\System32\rypgvtoimrl.exe
C:\WINDOWS\System32\spwgoc.exe
C:\windows\system32\msnavc32.exe
C:\WINDOWS\System32\sysmonnt
C:\Program Files\hpdll\hpdll.exe
C:\WINDOWS\System32\w?wexec.exe
C:\WINDOWS\isrvs\ffisearch.exe

Removal:
Use RegRun.
Clear Browser Helper Objects list.
Reset to default the AppInitDlls (Anti Spyware module).
Recover LSP using RegRun Winsock2 recovery.
Kill the processes and remove the virus files from Windows startup.

0x32.exe
0x32.exe is W32/Rbot-FWP.
Read more:
http://www.sophos.com/security/analyses/...
Kill the process 0x32.exe and remove 0x32.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

1.exe
DoS tool / ICQ trojan / Steals passwords (?)
Can be used to flood a chanel with thousands of messages.

100171be.exe
100171be.exe is Dialer.Asdplug.
Dialer.Asdplug is a dialer program that can be used to access pornographic material by dialling a high-cost number using the modem.
Read more:
http://www.symantec.com/security_respons...
Kill the process 100171be.exe and remove 100171be.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

100176br.exe
100176br.exe is Dialer.Asdplug.
Dialer.Asdplug is a dialer program that can be used to access pornographic material by dialling a high-cost number using the modem.
Read more:
http://www.symantec.com/security_respons...
Kill the process 100176br.exe and remove 100176br.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

10021.exe
10021.exe is Trojan/Backdoor.
Kill the process 10021.exe and remove 10021.exe from Windows startup.

1037v.exe
1037v.exe is Troj/Clagger-AR.
Read more:
http://www.sophos.com/security/analyses/...
Kill the process 1037v.exe and remove 1037v.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

1111a.exe
1111a.exe is W32.Dumaru.AH@mm.
W32.Dumaru.AH@mm is a multi-threaded, mass-mailing worm that opens a backdoor, runs a keylogger, and attempts to steal personal information. The worm uses its own SMTP engine to spread to email addresses that it finds in the files on an infected system.
Read more:
http://www.symantec.com/security_respons...
Kill the process 1111a.exe and remove 1111a.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

1111swapmgr.exe
1111swapmgr.exe is Troj/Bdoor-IC.
Related files:
1111swapmgr.exe
1111tapidef.dll
Read more:
http://www.sophos.com/virusinfo/analyses...
Kill the process 1111swapmgr.exe and remove 1111swapmgr.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

1111tapidef.dll
1111tapidef.dll is Troj/Bdoor-IC.
Related files:
1111swapmgr.exe
1111tapidef.dll
Read more:
http://www.sophos.com/virusinfo/analyses...
Kill the file 1111tapidef.dll and remove 1111tapidef.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

115255123116.exe
115255123116.EXE is Rootkit.DialCall.
Read more:
http://fileinfo.prevx.com/adware/qqa7fd6...
Kill the process 115255123116.EXE and remove 115255123116.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

120-hp.exe
120-HP.EXE is Trojan/Backdoor.
Kill the process 120-HP.EXE and remove 120-HP.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

1226345244.exe
1226345244.exe is RegiFast Adware.
Read more:
http://www3.ca.com/securityadvisor/pest/...
Kill the process 1226345244.exe and remove 1226345244.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

13567962ld.exe
13567962LD.EXE is Trojan.RPCC.Payload.
Read more:
http://fileinfo.prevx.com/adware/qq43045...
Kill the process 13567962LD.EXE and remove 13567962LD.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

138762763.exe
138762763.exe is Troj/FireSpy-A.
Read more:
http://www.sophos.com/security/analyses/...
Kill the process 138762763.exe and remove 138762763.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

180.exe
180.exe is 180Solutions Spyware.
180.exe monitors your browsing habits and distributes the data back to the author's servers for analysis.
Read more:
http://www3.ca.com/securityadvisor/pest/...
Kill the process 180.exe and remove 180.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

180adsolution.exe
180adsolution.exe is Trojan/Backdoor.
Kill the process 180adsolution.exe and remove 180adsolution.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

180ax.exe
Salm.exe is a Trojan Trojan.LowZones.
Salm.exe lowers Internet Explorer security settings.
Related files:
%Temp%\auto_update_install.exe
%Temp%\setup.inf
%Temp%\auf0.exe
%Temp%\cxtpls_loader.exe
%Temp%\iinstall.exe
%Temp%\sidefind.exe
%Temp%\WToolsA.exe
%Temp%\WToolsB.dll
%Temp%\AutoUpdaterInstaller[1].exe
%Temp%\nem220[1].dll
%Temp%\salm.exe
%Temp%\istbar.dll
%System%\auto_update_uninstall.exe
%Windir%\lohmvql.exe
%Windir%\nem220.dll
%Windir%\qoqek.exe
%Windir%\zeta.exe
More info:
http://securityresponse.symantec.com/avc...
Removal:
Kill salm.exe process and remove salm.exe from Windows startup using RegRun Startup Optimizer.

180sainstaller.dll
180SAInstaller.dll is an adware program Adware.180Search (180Solutions).
180SAInstaller.dll monitors the contents of Web browser windows.
180SAInstaller.dll opens the Web pages of partner sites when it sees certain keywords in search or shopping site windows.
Related files:
Msbb.exe
Boomerang.exe
ClientAX.dll
180SAInstaller.dll
setup4156.exe
sac.exe
sau.exe
%Program Files%\180search Assistant\sain.exe
%Program Files%\180search Assistant\hsr.dll
%Program Files%\180search Assistant\sau.exe
%Program Files%\180search Assistant\sau.log
%Program Files%\180search Assistant\sau.dll
%Program Files%\180search Assistant\sau_[three random letters].dat
%Program Files%\180search Assistant\sauau.dat
%Program Files%\180search Assistant\sac.exe
%Program Files%\180search Assistant\sauhook.dll
%Program Files%\180search Assistant\sachook.dll
%Program Files%\180searchassistant\salm.exe
%Program Files%\180searchassistant\salmau_update.dat
%Program Files%\180searchassistant\salmhook.dll
%Program Files%\180searchassistant\salm.dat
%Program Files%\180searchassistant\salm_[three random letters].dat
%Program Files%\180searchassistant\salm_[three random letters]_update.dat
%Windir%\Downloaded Program Files\ClientAx.dll
%Windir%\Downloaded Program Files\ClientAx.inf
%Temp%\180sainstallernusalm.exe
Adds the value:
"MSBB" = "[Path to adware file]"
"sau" = "%ProgramFiles%\180search assistant\sau.exe"
"sac" = "%ProgramFiles%\180searchassistant\sac.exe"
"sain" = "%ProgramFiles%\180search assistant\sain.exe"
"salm" = "%ProgramFiles%\180searchassistant\salm.exe"
to the Windows startup registry keys.
More info:
http://securityresponse.symantec.com/avc...
Removal:
Remove 180SAInstaller.dll from Windows startup using RegRun Startup Optimizer.

180sainstallernusalm.exe
180sainstallernusalm.exe is an adware program Adware.180Search (180Solutions).
180sainstallernusalm.exe monitors the contents of Web browser windows.
180sainstallernusalm.exe opens the Web pages of partner sites when it sees certain keywords in search or shopping site windows.
Related files:
Msbb.exe
Boomerang.exe
ClientAX.dll
180SAInstaller.dll
setup4156.exe
sac.exe
sau.exe
%Program Files%\180search Assistant\sain.exe
%Program Files%\180search Assistant\hsr.dll
%Program Files%\180search Assistant\sau.exe
%Program Files%\180search Assistant\sau.log
%Program Files%\180search Assistant\sau.dll
%Program Files%\180search Assistant\sau_[three random letters].dat
%Program Files%\180search Assistant\sauau.dat
%Program Files%\180search Assistant\sac.exe
%Program Files%\180search Assistant\sauhook.dll
%Program Files%\180search Assistant\sachook.dll
%Program Files%\180searchassistant\salm.exe
%Program Files%\180searchassistant\salmau_update.dat
%Program Files%\180searchassistant\salmhook.dll
%Program Files%\180searchassistant\salm.dat
%Program Files%\180searchassistant\salm_[three random letters].dat
%Program Files%\180searchassistant\salm_[three random letters]_update.dat
%Windir%\Downloaded Program Files\ClientAx.dll
%Windir%\Downloaded Program Files\ClientAx.inf
%Temp%\180sainstallernusalm.exe
Adds the value:
"MSBB" = "[Path to adware file]"
"sau" = "%ProgramFiles%\180search assistant\sau.exe"
"sac" = "%ProgramFiles%\180searchassistant\sac.exe"
"sain" = "%ProgramFiles%\180search assistant\sain.exe"
"salm" = "%ProgramFiles%\180searchassistant\salm.exe"
to the Windows startup registry keys.
More info:
http://securityresponse.symantec.com/avc...
Removal:
Kill 180sainstallernusalm.exe process and remove 180sainstallernusalm.exe from Windows startup using RegRun Startup Optimizer.

197_150_ni_3.exe
197_150_ni_3.exe is Trojan/Backdoor.
Kill the process 197_150_ni_3.exe and remove 197_150_ni_3.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

1dailups.exe
Steals passwords
It steals dailup passwords and hides them in Rasxnfo.dll, which is encrypted. It sends the file through a SMTP server to the following mail addresses: addr2@server.com , addr3@server.com, majlisb@yahoo.com.

1hellbot.exe
1hellbot.exe is W32.Mydoom.BO@mm.
W32.Mydoom.BO@mm is a worm that uses its own SMTP engine to send an email to addresses that it gathers from the compromised computer. The worm also opens a back door on TCP port 6677.
Read more:
http://www.symantec.com/security_respons...
Kill the process 1hellbot.exe and remove 1hellbot.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

1htk1j.exe
1htk1j.exe is Trojan/Backdoor.
Kill the process 1htk1j.exe and remove 1htk1j.exe from Windows startup.

1on1.exe
Dialer OneOnOne prno dialer.
This program gets access to various Web sites by dialing a high-cost phone number using the modem.
Removal:
Remove it from startup by RegRun Terminate feature.

1x32.exe
1x32.exe is W32/Rbot-FWX.
Read more:
http://www.sophos.com/security/analyses/...
Kill the process 1x32.exe and remove 1x32.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

20050726-007-i32-1.exe
20050726-007-i32-1.exe is Troj/Bancban-EC.
Read more:
http://www.sophos.com/virusinfo/analyses...
Kill the process 20050726-007-i32-1.exe and remove 20050726-007-i32-1.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

20061120.exe
20061120.EXE is Trojan/Backdoor.
Read more:
http://fileinfo.prevx.com/spyware/qq36c3...
Kill the process 20061120.EXE and remove 20061120.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

2007rox.dll
We suggest you to remove 2007rox.dll from your computer as soon as possible.
2007rox.dll is Trojan/Backdoor.
Kill the file 2007rox.dll and remove 2007rox.dll from Windows startup.

2020searchtoolbar.exe
2020searchtoolbar.exe is Adware.
Kill the process 2020searchtoolbar.exe and remove 2020searchtoolbar.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com
More info:
http://www.uninstall-i-lookup.com/remove...

20242402.dll
20242402.dll is Trojan/Backdoor.
Kill the file 20242402.dll and remove 20242402.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

2236_32.dll
2236_32.DLL is Trojan/Backdoor.
Read more:
http://fileinfo.prevx.com/fileinfo.asp?P...
Kill the file 2236_32.DLL and remove 2236_32.DLL from Windows startup using RegRun Reanimator.
http://www.regrun.com

23100247.exe
23100247.exe is Trojan Downloader.
Read more:
http://fileinfo.prevx.com/spyware/qqcbfb...
Kill the process 23100247.exe and remove 23100247.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

2kbug-mircfix.exe
Worm / Macro trojan / Virus dropper
Can load plug-ins from the Internet. From the start it used "Source of Chaos" in Japan.

2x32.exe
2x32.exe is W32/Rbot-FWY.
Read more:
http://www.sophos.com/security/analyses/...
Kill the process 2x32.exe and remove 2x32.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

32 tick.exe
32 TICK.EXE is Trojan/Backdoor.
Kill the process 32 TICK.EXE and remove 32 TICK.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

32rundll.exe
32rundll.exe is Trojan/Backdoor.
Kill the process 32rundll.exe and remove 32rundll.exe from Windows startup.

3339_32.dll
3339_32.dll is Trojan/Backdoor.
Read more:
http://fileinfo.prevx.com/fileinfo.asp?P...
Kill the file 3339_32.dll and remove 3339_32.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

3721.4.dll
3721.4.dll is TROJ_DELF.CUW.
Read more:
http://uk.trendmicro-europe.com/consumer...
Kill the file 3721.4.dll and remove 3721.4.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

37568052ld.exe
37568052LD.EXE is Trojan.RPCC.Payload.
Read more:
http://fileinfo.prevx.com/adware/qq2e006...
Kill the process 37568052LD.EXE and remove 37568052LD.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

386.exe
W32.IRCBot.D is a backdoor trojan horse that connects to a remote IRC server and awaits commands from the attacker.
Attempts to steal license keys for various games.
Allows unauthorized remote access to an infected computer.
Attempts to remove the following shares on the local drive: c$; d$; IPC$; admin$
Attempts to connect to the IRC server metal.electrogiant.com on TCP port 5599.
Joins a predefined channel, using a random username, and waits for commands from the IRC server.
These commands can allow the attacker to:
- Managing installation of back door.
- Transmitting the back door to designated IRC channels.
- Downloading and executing arbitrary files.
- Performing DoS attacks against attacker specified targets.
- Send out private information.
- Terminating arbitrary processes.
- Visiting websites.
- Start socks proxy service.
- Copying itself to shared folders on other machines.
- Steal license keys for different games

Manual removal:
Navigate to each of these keys:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
From each key that is found, delete the value: "Win32 USB2.0 Driver" = "386.exe"

3fl9ckv5.exe
3FL9CKV5.EXE is Trojan/Backdoor.
Read more:
http://fileinfo.prevx.com/adware/qqf54b5...
Kill the process 3FL9CKV5.EXE and remove 3FL9CKV5.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

4.exe
4.exe is Trojan/Backdoor.
Kill the process 4.exe and remove 4.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

412124.tmp
Back Orifice trojan

464rhdve.exe
464rhdve.exe is Trojan/Backdoor.
Kill the process 464rhdve.exe and remove 464rhdve.exe from Windows startup using RegRun.
www.regrun.com

4d1b90fddf6b.dll
4D1B90FDDF6B.dll is Troj/Lineag-BI.
Related files:
%Wndows%java\4D1B90FDDF6B.exe
%Current Folder%\1.bat
%Windows%\1.bat
%Windows%\java\4D1B90FDDF6B.dll
Read more:
http://www.sophos.com/security/analyses/...
Kill the file 4D1B90FDDF6B.dll and remove 4D1B90FDDF6B.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

4d1b90fddf6b.exe
4D1B90FDDF6B.exe is Troj/Lineag-BI.
Related files:
%Wndows%java\4D1B90FDDF6B.exe
%Current Folder%\1.bat
%Windows%\1.bat
%Windows%\java\4D1B90FDDF6B.dll
Read more:
http://www.sophos.com/security/analyses/...
Kill the process 4D1B90FDDF6B.exe and remove 4D1B90FDDF6B.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

4dflowerbox.scr
4DFlowerBox.scr is Trojan Trojan.Littlog.
4DFlowerBox.scr monitors user Internet activity and private information.
It sends stolen data to a hacker site.

Related files:
%System%\fontstyles.exe
%Windir%\mseiw.exe
%Windir%\4DFlowerBox.scr
%Windir%\syxsocks.dll
[original folder]\settings.ini
[original folder]\server.exe

Adds the value:
"Shell" = "explorer.exe 4DFlowerBox.scr"
"System" = "C:\WINNT\System32\fontstyles.exe"
to the Windows startup registry keys.

More info:
http://securityresponse.symantec.com/avc...

5.exe
5.exe is a Trojan.Esteems.D.
5.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Windir%\20050315095144d41d8.jpg
%Windir%\5.exe
%Windir%\514.exe
%System%\[original file].exe
%System%\[original file].asf
%System%\[original file].hke
%Program Files%\FileFly\notPad.exe
%Program Files%\FileFly\Install.dll
%Program Files%\FileFly\Sock.dll
%Program Files%\FileFly\FileFly.Dat
%System%\514.exe
%System%\514.asf
%System%\514.hke
Adds the value:
"system23" = "%Program Files%\FileFly\notPad.exe"
to the Windows startup registry keys.
More info:
http://securityresponse.symantec.com/avc...
Removal:
Kill 5.exe process and remove 5.exe from Windows startup using RegRun Startup Optimizer.

514.exe
514.exe is a Trojan.Esteems.D.
514.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Windir%\20050315095144d41d8.jpg
%Windir%\5.exe
%Windir%\514.exe
%System%\[original file].exe
%System%\[original file].asf
%System%\[original file].hke
%Program Files%\FileFly\notPad.exe
%Program Files%\FileFly\Install.dll
%Program Files%\FileFly\Sock.dll
%Program Files%\FileFly\FileFly.Dat
%System%\514.exe
%System%\514.asf
%System%\514.hke
Adds the value:
"system23" = "%Program Files%\FileFly\notPad.exe"
to the Windows startup registry keys.
More info:
http://securityresponse.symantec.com/avc...
Removal:
Kill 514.exe process and remove 514.exe from Windows startup using RegRun Startup Optimizer.

5-2-46-112.exe
5-2-46-112.exe is Trojan/Backdoor.
Read more:
http://www.castlecops.com/s56-5_2_46_112...
Kill the process 5-2-46-112.exe and remove 5-2-46-112.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

53msong.exe
Worm / File virus
Alters Win.ini. "Between midnight and 2.00am on Wednesdays the worm attempts to display an animated graphic of Adolf Hitler shooting himself in the head." (Sophos)

63mm.exe
63mm.exe is Trojan/Backdoor MultiDroppe.
Kill the process 63mm.exe and remove 63mm.exe from Windows startup.

64 spam.exe
64 spam.exe is Trojan/Backdoor.
Kill the 64 spam.exe process and remove it from Widnows startup.

666inse_1.exe
666inse_1.exe is Trojan W97M.Kukudro.A.
Related files:
my_Notebook.doc
Read more:
http://securityresponse.symantec.com/avc...
Kill the process 666inse_1.exe and remove 666inse_1.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

6a14ompd.exe
6a14ompd.exe is Trojan/Backdoor.
Kill the process 6a14ompd.exe and remove 6a14ompd.exe from Windows startup.

7kam04t8.exe
7KAM04T8.EXE is Trojan/Backdoor.
Read more:
http://fileinfo.prevx.com/adware/qq29917...
Kill the process 7KAM04T8.EXE and remove 7KAM04T8.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

80d0.exe
80d0.exe is Trojan/Backdoor.
Kill the process 80d0.exe and remove 80d0.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

876029.exe
876029.EXE is Adware.Mirar/NetNucleus.
Read more:
http://www.superadblocker.com/definition...
Kill the process 876029.EXE and remove 876029.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

888bar.dll
888BAR.DLL is Toolbar888 adware.
Read more:
http://www3.cai.com/securityadvisor/pest...
Kill the file 888BAR.DLL and remove 888BAR.DLL from Windows startup using RegRun Reanimator.
http://www.regrun.com

8ply92.dll
8PLY92.DLL is Trojan/Backdoor.
Read more:
http://fileinfo.prevx.com/spyware/qq7e71...
Kill the file 8PLY92.DLL and remove 8PLY92.DLL from Windows startup using RegRun Reanimator.
http://www.regrun.com

912_121.exe
912_121.exe is Tagasaurus adware.
Read more:
http://www.pestpatrol.com/spywarecenter/...
Kill the process 912_121.exe and remove 912_121.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

9129837.exe
9129837.EXE is Trojan/Backdoor.
Read more:
http://fileinfo.prevx.com/adware/qqd7704...
Kill the process 9129837.EXE and remove 9129837.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

9181322ld.exe
9181322LD.EXE is Trojan.RPCC.Payload.
Read more:
http://fileinfo.prevx.com/adware/qq5bb35...
Kill the process 9181322LD.EXE and remove 9181322LD.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

919_133.exe
919_133.exe is Downloader.Dyfuca.
Kill the process 919_133.exe and remove 919_133.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

98s.exe
DoS tool / ICQ trojan / Steals passwords (?)
Can be used to flood a chanel with thousands of messages.

9sy.exe
9SY.EXE is Win32/Looked.FM.
Read more:
http://www3.ca.com/securityadvisor/virus...
Kill the process 9SY.EXE and remove 9SY.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

a.exe
Remote Access
Alters Win.ini.

a@26m.exe
A@26m.exe is Troj/KillPar-B.
Read more:
http://www.sophos.com/security/analyses/...
Kill the process a@26m.exe and remove a@26m.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

a_s.exe
Remote Access
Alters Win.ini.

a0003016.exe
A0003016.exe is Trojan/Backdoor ICQCHK.
Kill the process A0003016.exe and remove A0003016.exe from Windows startup.
Related files in the %SysDir% folder (usually c:\ Windows\System32):
kaboom.dll
iewatch.exe
A0003016.exe
VideoCodec3_05b.exe
sysmon.exe
msx.dll
gtrack.dll
ietool1.exe
ietool2.exe
ietool3.exe

a0006994.exe
A0006994.exe is Trojan/Backdoor.
Kill the process a0006994.exe and remove a0006994.exe from Windows startup.

a0014196.dll
A0014196.dll is Spyware.Look2Me.
Kill the file A0014196.dll and remove A0014196.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

a0032298.exe
A0032298.exe is P2P-Worm.Win32.VB.dy.
Read more:
http://www.avira.com/en/threats/section/...
Kill the process A0032298.exe and remove A0032298.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

a0101562.exe
A0101562.exe is Trojan-Downloader.Win32.Adload.ch.
Kill the process A0101562.exe and remove A0101562.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

a0159105.exe
A0159105.exe is Trojan Delf-CB.
Read more:
http://www.sophos.com/security/analyses/...
Kill the process a0159105.exe and remove a0159105.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

a3dxx.dll
A3DXX.DLL is Trojan/Backdoor.
Kill the file A3DXX.DLL and remove A3DXX.DLL from Windows startup using RegRun Reanimator.
http://www.regrun.com

a5srchas.dll
A5SRCHAS.DLL is AskTBar Malware.
Read more:
http://www.pestpatrol.com/spywarecenter/...
Kill the file A5SRCHAS.DLL and remove A5SRCHAS.DLL from Windows startup using RegRun Reanimator.
http://www.regrun.com

a64sddd.exe
A64sddd.exe is Adware (ADW_MOTOR.A).
A64sddd.exe displays popup ads, monitors user Internet activity.
A64sddd.exe is often added to "free" applications.
Authors:
http://bins.media-motor.net/
Related Files:
# a64sddd.exe
# affbun.txt
# imgurla.exe
# mm63.ocx
# tempf.txt
# unstall.exe
# usta32.ini
More Info:
http://www.trendmicro.com/vinfo/grayware...
Remove A64sddd.exe from Windows startup.

a65d.exe
a65d.exe is an adware program Adware.Popuppers.
a65d.exe downloads and displays advertisements.
Related files:
a65d.exe
Adds the value:
"popuppers65" = "[path to file]"
to the Windows startup registry keys.
More info:
http://securityresponse.symantec.com/avc...
Removal:
Kill a65d.exe process and remove a65d.exe from Windows startup using RegRun Startup Optimizer.

a6befba6.exe
A6BEFBA6.EXE is Trojan.Sdern.
Read more:
http://fileinfo.prevx.com/adware/qq9cfd8...
Kill the process A6BEFBA6.EXE and remove A6BEFBA6.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

aaifil32.dll
AAIFIL32.DLL is Adware.Look2Me.
Read more:
http://atstake.com/avcenter/venc/data/ad...
Kill the file AAIFIL32.DLL and remove AAIFIL32.DLL from Windows startup using RegRun Reanimator.
http://www.regrun.com

aasr.exe
Aasr.exe is a part of PurityScan spyware.
Kill the process aasr.exe and remove aasr.exe from Windows startup.

aaupdt.exe
Aaupdt.exe is W32/Rbot-RQ.
Read more:
http://www.sophos.com/security/analyses/...
Kill the process aaupdt.exe and remove aaupdt.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

abc2007.exe
Abc2007.exe is Troj/Dloadr-ASH.
Related files:
\winduws\winduws1.ko
\winduws\winduws2.ko
\winduws\winduws4.ko
\winduws\winduws8.ko
Read more:
http://www.us.sophos.com/security/analys...
Kill the process abc2007.exe and remove abc2007.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

abcdefgh.exe
Abcdefgh.exe is DOWNLOADER.EPJ TROJAN.
Kill the process abcdefgh.exe and remove abcdefgh.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

abcxyz.exe
Abcxyz.exe is Trojan/Backdoor.
Kill the process abcxyz.exe and remove abcxyz.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

abrek.exe
Abrek.exe is Trojan/Backdoor.
Kill the process abrek.exe and remove abrek.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

abu.exe
Abu.exe is Trojan/Backdoor.
Kill the process abu.exe and remove abu.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

abx_search.dll
ABX_Search.dll is a Adware.ABXToolbar.
ABX_Search.dll is a browser helper object.
Related files:
ABX_Search.dll
More info:
http://securityresponse.symantec.com/avc...
Removal:
Remove ABX_Search.dll from Windows startup using RegRun Startup Optimizer.

ac2_0009.exe
Ac2_0009.exe is Downloader Drev A.
Related files:
%CACHE%\CONTENT.IE5\????????\AC2_0002[1].EXE
%CACHE%\CONTENT.IE5\????????\AC2_0003[1].EXE
%CACHE%\CONTENT.IE5\????????\AC2_0006[1].EXE
%CACHE%\CONTENT.IE5\????????\AC2_0009[1].EXE
%CACHE%\CONTENT.IE5\????????\AC2_0010[1].EXE
%CACHE%\CONTENT.IE5\????????\AC2_0011[1].EXE
%PROFILES%\ADMINISTRATOR\LOCAL SETTINGS\TEMP\AC2_0006.EXE
%profiles%\chris strange\local settings\temp\AC2_0007.EXE
%profiles%\enrique\local settings\temp\AC2_0004.EXE
Read more:
http://virusinfo.prevx.com/pxparall.asp?...
Kill the process ac2_0009.exe and remove ac2_0009.exe from Windows startup using RegRun.
www.regrun.com

ac2_0010.exe
Ac2_0010.exe is Downloader Drev A.
Related files:
%CACHE%\CONTENT.IE5\????????\AC2_0002[1].EXE
%CACHE%\CONTENT.IE5\????????\AC2_0003[1].EXE
%CACHE%\CONTENT.IE5\????????\AC2_0006[1].EXE
%CACHE%\CONTENT.IE5\????????\AC2_0009[1].EXE
%CACHE%\CONTENT.IE5\????????\AC2_0010[1].EXE
%CACHE%\CONTENT.IE5\????????\AC2_0011[1].EXE
%PROFILES%\ADMINISTRATOR\LOCAL SETTINGS\TEMP\AC2_0006.EXE
%profiles%\chris strange\local settings\temp\AC2_0007.EXE
%profiles%\enrique\local settings\temp\AC2_0004.EXE
Read more:
http://virusinfo.prevx.com/pxparall.asp?...
Kill the process ac2_0010.exe and remove ac2_0010.exe from Windows startup using RegRun.
www.regrun.com

acac.dll
Acac.dll is W32.Stration.D@mm.
Related files:
%System%\acac.dll
%System%\wmv9ir32.exe
%System%\cabvh323.dll
%System%\mp43msdm.dll
%System%\rasmnlht.dll
%System%\[RANDON NAME].tmp
%Temp%\~[RANDOM NUMBER].tmp
Read more:
http://www.symantec.com/enterprise/secur...
Kill the file acac.dll and remove acac.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

accesobdsatel.dll
ACCESOBDSATEL.DLL is Trojan/Backdoor.
Read more:
http://fileinfo.prevx.com/adware/qqcf255...
Kill the file ACCESOBDSATEL.DLL and remove ACCESOBDSATEL.DLL from Windows startup using RegRun Reanimator.
http://www.regrun.com

accesobdsunahip.dll
ACCESOBDSUNAHIP.DLL is Trojan/Backdoor.
Read more:
http://fileinfo.prevx.com/adware/qq2f915...
Kill the file ACCESOBDSUNAHIP.DLL and remove ACCESOBDSUNAHIP.DLL from Windows startup using RegRun Reanimator.
http://www.regrun.com

accessdrv.sys
AccessDrv.sys is Trojan.Agirvab.
Directory: %System%
Read more:
http://www.symantec.com/enterprise/secur...
Kill the file AccessDrv.sys and remove AccessDrv.sys from Windows startup using RegRun Reanimator.
http://www.regrun.com

accesssetup.266.exe
ACCESSSETUP.266.EXE is Trojan.AccessSetup.
Read more:
http://fileinfo.prevx.com/adware/qqa7306...
Kill the process ACCESSSETUP.266.EXE and remove ACCESSSETUP.266.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

accesweb.exe
Accesweb.exe is Trojan/Backdoor.
Kill the process accesweb.exe and remove accesweb.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

accodase.exe
ACCODASE.EXE is Trojan/Backdoor.
Read more:
http://fileinfo.prevx.com/adware/qqa8955...
Kill the process ACCODASE.EXE and remove ACCODASE.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

account_details.doc.exe
ACCOUNT_DETAILS.DOC.EXE is W32/Quaters-A.
Read more:
http://www.sophos.com/security/analyses/...
Kill the process ACCOUNT_DETAILS.DOC.EXE and remove ACCOUNT_DETAILS.DOC.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

accountingcore.dll
ACCOUNTINGCORE.DLL is Trojan/Backdoor.
Read more:
http://fileinfo.prevx.com/adware/qqce985...
Kill the file ACCOUNTINGCORE.DLL and remove ACCOUNTINGCORE.DLL from Windows startup using RegRun Reanimator.
http://www.regrun.com

accovepv.exe
ACCOVEPV.EXE is Trojan/Backdoor.
Read more:
http://fileinfo.prevx.com/adware/qq69f45...
Kill the process ACCOVEPV.EXE and remove ACCOVEPV.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

accra
Mocih.exe is Trojan/Backdoor.
Mocih.exe creates the service: ACCRA
Display Name: Trace network connections
Description: Managing network connections
Mocih.exe connects to the servers:
195.225.177.37
pigmailer.scarryserv.biz
and sends spam messages.
Kill the process mocih.exe and remove mocih.exe from Windows startup.
Disable ACCRA service.

acespy32.exe
Acespy32.exe is a Spyware.AceSpy.
Acespy32.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\acespy\ANSMTP.dll
%System%\acespy\Asycfilt.dll
%System%\acespy\Comcat.dll
%System%\acespy\Comdlg32.ocx
%System%\acespy\ijl11.dll
%System%\acespy\KTKbdHk.dll
%System%\acespy\Makecab.exe
%System%\acespy\Riched32.dll
%System%\acespy\Shlwapi.dll
%System%\acespy\systune.exe
%System%\acespy\Wininet.dll
%System%\ace16win.dll
Acespy32.exe
Adds the value:
systune"="%System%\acespy\systune.exe"
to the Windows startup registry keys.
More info:
http://securityresponse.symantec.com/avc...
Removal:
Kill Acespy32.exe process and remove Acespy32.exe from Windows startup using RegRun Startup Optimizer.

acexe.exe
Acexe.exe is Trojan/Backdoor.
Kill the process acexe.exe and remove acexe.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

acid setup.exe
Remote Access

acid.exe
Remote Access / FTP server

acidkor.exe
Remote Access
A very basic RAT.

acidshivers.exe
Remote Access

aclcontrol.exe
ACLControl.exe is W32.Icogon.
Directory: %UserProfile%\Local Settings\Temp
Read more:
http://securityresponse.symantec.com/avc...
Kill the process ACLControl.exe and remove ACLControl.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

aclient.dll
AClient.dll is Trojan/Backdoor.
Kill the file AClient.dll and remove AClient.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

a-client2.exe
Remote Access
Alters Win.ini.

aclisitatualiza.exe
ACLISITATUALIZA.EXE is Trojan/Backdoor.
Read more:
http://fileinfo.prevx.com/adware/qq44fc6...
Kill the process ACLISITATUALIZA.EXE and remove ACLISITATUALIZA.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

acpi89.sys
Trojan.Win32.KillDisk.f

This Trojan is extremely dangerous.
It installs itself on the system as a driver, and starting from 27th April 2004 it will delete data from the hard disk.

In systems running Windows 9x, the Trojan installs itself as the driver
MSGBS1.VXD

In systems running Windows NT/2000/XP and all subsequent versions, it installs itself as the driver
ACPI89.SYS

The Trojan also creates the following two files:

C:\Program Files\Internet Explorer\fileproc.txt
C:\Program Files\Internet Explorer\filepath.txt

acpidisk.sys
Acpidisk.sys is Trojan/Backdoor.
Kill the file acpidisk.sys and remove acpidisk.sys from Windows startup using RegRun Reanimator.
http://www.regrun.com

acpmonsrv.exe
Acpmonsrv.exe is Trojan-Proxy.Win32.Slaper.e.
Related files:
%system%\ acpmonsrv.exe
%system%\ helperqttsk.exe
%system%\ lmdm.exe
%system%\ qttsk.exe
4.exe
helperlmdm.exe
jmllibvm.exe
kbdsvc.exe
l4debug.exe
LRSYS5.EXE
skwonwua.exe
Read more:
http://research.sunbelt-software.com/thr...
Kill the process acpmonsrv.exe and remove acpmonsrv.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

acrmon32.exe
Acrmon32.exe is Troj/Small-ECT.
Read more:
http://www.sophos.com/security/analyses/...
Kill the process acrmon32.exe and remove acrmon32.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

acroup32.exe
Acroup32.exe is Troj/VanBot-BQ.
Troj/VanBot-BQ is a downloader Trojan which will download, install and run new software without notification that it is doing so.
Related files:
%StartupFolder%\taskman.exe
%System%\acroup32.exe
Read more:
http://www.sophos.com/security/analyses/...
Kill the process acroup32.exe and remove acroup32.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

acsysiom.exe
Acsysiom.exe is Trojan/Backdoor.
Kill the process acsysiom.exe and remove acsysiom.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

actalert.exe
Actalert.exe is an adware program Adware.NetOptimizer.
Actalert.exe downloads and displays advertisements.
Related files:
%ProgramFiles%\Internet Optimizer\actalert.exe
%ProgramFiles%\Internet Optimizer\optimize.exe
%ProgramFiles%\Internet Optimizer\update\actalert.exe
%Windir%\nemXXX.dll
%Windir%\optimize.exe
%Windir%\wsemXXX.dll
ioptiXXX.dll
nemXXX.dll
Adds the value:
"Internet Optimizer" = "C:\Program Files\Internet Optimizer\optimize.exe"
to the Windows startup registry keys.
More info:
http://securityresponse.symantec.com/avc...
Removal:
Kill actalert.exe process and remove actalert.exe from Windows startup using RegRun Startup Optimizer.

actboost.exe
Actboost.exe is W32.Bropia.R.
W32.Bropia.R is a worm that spreads via MSN Messenger and drops a variant of W32.Spybot.Worm.
Related files:
%System%\cfgpwnz.exe
%System%\actboost.exe
Read more:
http://www.symantec.com/security_respons...
Kill the process actboost.exe and remove actboost.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

actionscr.exe
ActionScr.exe is Wareout.
Read more:
http://startup.networktechs.com/srch-Act...
Kill the process ActionScr.exe and remove ActionScr.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

activationmanager.dll
We suggest you to remove ActivationManager.dll from your computer as soon as possible.
ActivationManager.dll is Trojan.Net-AM/NoGood.Process.
Read more:
http://www.fileresearchcenter.com/A/ACTI...
Kill the file ActivationManager.dll and remove ActivationManager.dll from Windows startup.

activeds.exe
WORM_OPASERV.T
This memory-resident worm a member of the OPASERV family of worms, spreads via shared network drives.
Its destructive payloads are executed when the system date is between December 24 to 31 or when the year is greater than 2002.
This worm deletes files, overwrites the boot sector and destroys the CMOS.
It also modifies the registry and the configuration file, WIN.INI, so that it automatically executes every Windows startup.
It uses a known exploit that enables malicious users to access shared drives, as discussed in a security bulletin from Microsoft.

Removing autostart entries from the registry prevents the malware from executing during startup:
HKEY_LOCAL_MACHINE>Software>Microsoft>Windows>CurrentVersion>Run
IASHLPR="%Windows%\IASHLPR.EXE"
FONTVIEW="%Windows%\FONTVIEW.EXE"
MPREXE="%Windows%\MPREXE.EXE"
Scr="%System\scr.scr"
BIOS1="%Windows%\BIOS1.EXE"

HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Run,
Winsrv=%Windows%\winsrv.exe
CLICONFG="%Windows%\CLICONFG.EXE"

HKEY_LOCAL_MACHINE>Software>Microsoft>Windows>CurrentVersion>RunServices
LoadManager="%Windows%\msload.exe"
ACTIVEDS="%Windows%\ACTIVEDS.EXE"

Use RegRun to automatically remove these registry items.

activescan.exe
Activescan.exe is W32/Rbot-FKQ.
Read more:
http://www.sophos.com/security/analyses/...
Kill the process activescan.exe and remove activescan.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

activex.exe
I-Worm.Calposa.
Stop this process and remove from startup.

actsrv.exe
ACTSRV.EXE is Trojan/Backdoor.
Kill the process ACTSRV.EXE and remove ACTSRV.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

ad12_cli.exe
Eavesdropper

ad12_srv.exe
Eavesdropper

adasoftw.exe
Adasoftw.exe is Trojan/Backdoor.
Kill the process adasoftw.exe and remove adasoftw.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

adcomplusanalytic.exe
Adcomplusanalytic.exe is Adware.AdCom.
Read more:
http://www.fileresearchcenter.com/A/ADCO...
Kill the process adcomplusanalytic.exe and remove adcomplusanalytic.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

addcls.exe
This is adware component and IE homepage hijacker.
What it does?
(this program works with Windows NT/2000/XP only)
1. It registers the dp.dll or dpr.dll.
This file is located in your Windows folder.
2. Changes Internet Explorer homepage.
3. Adds the "AddClass" or "Class Start" values to the Registry Run
key:
SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
4. Connects to the Internet to get own updates.
Removal?
Kill "ADDCLASS.EXE" by RegRun Process Manager or by Task Manager.
Unregister "dp.dll" or "dpr.dll" if they exists.
Use this command:
regsvr32 /u dp.dll
Delete all related files.

addhf32.exe
Addhf32.exe is Trojan.Startup.NameShifter.A.
Read more:
http://research.sunbelt-software.com/thr...
Kill the process addhf32.exe and remove addhf32.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

addlh32.exe
Addlh32.exe is Trojan/Backdoor.
Kill the process addlh32.exe and remove addlh32.exe from Windows startup.

addol.exe
Addol.exe is Trojan/Backdoor.
Kill the process addol.exe and remove addol.exe from Windows startup.

addqb32
Addqb32 is Trojan/Backdoor.
Kill the process addqb32 and remove addqb32 from Windows startup.

addrmshelp.dll
We suggest you to remove ADDRMSHELP.DLL from your computer as soon as possible.
ADDRMSHELP.DLL is Trojan/Backdoor.
Kill the file ADDRMSHELP.DLL and remove ADDRMSHELP.DLL from Windows startup.

addtm32.exe
Ntww.exe is dangerous Trojan/Backdoor.
Ntww.exe changes IE home page to www.v61.com.
Trojan runs a lot of its copies to make the removal hard.
Remove it using RegRun Startup Optmizer to get rid all processes at the same time.
[sdkfr32.exe] C:\WINDOWS\sdkfr32.exe
[mfcyp.exe] C:\WINDOWS\mfcyp.exe
[netrt.exe] C:\WINDOWS\netrt.exe
[ntww.exe] C:\WINDOWS\ntww.exe
[ntdf32.exe] C:\WINDOWS\system32\ntdf32.exe
[ntbw32.exe] C:\WINDOWS\ntbw32.exe
[crbn32.exe] C:\WINDOWS\system32\crbn32.exe
[sdkpn32.exe] C:\WINDOWS\sdkpn32.exe
[d3dl.exe] C:\WINDOWS\d3dl.exe
[mfcod.exe] C:\WINDOWS\mfcod.exe
[apiel.exe] C:\WINDOWS\system32\apiel.exe
[ntxo32.exe] C:\WINDOWS\ntxo32.exe
[atlag.exe] C:\WINDOWS\atlag.exe
[mszo32.exe] C:\WINDOWS\system32\mszo32.exe
[d3qk.exe] C:\WINDOWS\d3qk.exe
[javahd32.exe] C:\WINDOWS\system32\javahd32.exe
[appds32.exe] C:\WINDOWS\appds32.exe
[apipp.exe] C:\WINDOWS\system32\apipp.exe
[mfcnn.exe] C:\WINDOWS\mfcnn.exe
[mfckl.exe] C:\WINDOWS\system32\mfckl.exe
[netlc.exe] C:\WINDOWS\system32\netlc.exe
[atlyi32.exe] C:\WINDOWS\system32\atlyi32.exe
[addtm32.exe] C:\WINDOWS\system32\addtm32.exe
[crad.exe] C:\WINDOWS\crad.exe
[javapt.exe] C:\WINDOWS\system32\javapt.exe
[javauu32.exe] C:\WINDOWS\javauu32.exe
[d3yp.exe] C:\WINDOWS\system32\d3yp.exe
[crwo32.exe] C:\WINDOWS\crwo32.exe
[ieim32.exe] C:\WINDOWS\system32\ieim32.exe
[sysyu.exe] C:\WINDOWS\sysyu.exe
[mfcrr.exe] C:\WINDOWS\system32\mfcrr.exe
[atlfg.exe] C:\WINDOWS\system32\atlfg.exe
[winvr32.exe] C:\WINDOWS\winvr32.exe
[iebp.exe] C:\WINDOWS\system32\iebp.exe
[ipyn.exe] C:\WINDOWS\ipyn.exe
[mspm.exe] C:\WINDOWS\mspm.exe
[javaee.exe] C:\WINDOWS\system32\javaee.exe
[addfm32.exe] C:\WINDOWS\addfm32.exe
[addrs.exe] C:\WINDOWS\addrs.exe
[crfy.exe] C:\WINDOWS\system32\crfy.exe
[crrd.exe] C:\WINDOWS\crrd.exe
[apptr32.exe] C:\WINDOWS\system32\apptr32.exe
[d3wk.exe] C:\WINDOWS\d3wk.exe
[apilk32.exe] C:\WINDOWS\apilk32.exe
[iedm.exe] C:\WINDOWS\system32\iedm.exe
[javagm.exe] C:\WINDOWS\system32\javagm.exe
[ntjw32.exe] C:\WINDOWS\ntjw32.exe
[netdo32.exe] C:\WINDOWS\netdo32.exe
[sysuc32.exe] C:\WINDOWS\system32\sysuc32.exe
[sdknd32.exe] C:\WINDOWS\system32\sdknd32.exe
[addko.exe] C:\WINDOWS\addko.exe
[mfcdh32.exe] C:\WINDOWS\system32\mfcdh32.exe
[sdkij32.exe] C:\WINDOWS\system32\sdkij32.exe
[msen.exe] C:\WINDOWS\system32\msen.exe
[msug.exe] C:\WINDOWS\msug.exe
[crkf32.exe] C:\WINDOWS\crkf32.exe
[winqj.exe] C:\WINDOWS\system32\winqj.exe
[sysgh32.exe] C:\WINDOWS\sysgh32.exe
[d3ud32.exe] C:\WINDOWS\d3ud32.exe
[netnm.exe] C:\WINDOWS\system32\netnm.exe
[apihs32.exe] C:\WINDOWS\system32\apihs32.exe
[addfp.exe] C:\WINDOWS\addfp.exe
[sdkqf32.exe] C:\WINDOWS\sdkqf32.exe
[crpn32.exe] C:\WINDOWS\system32\crpn32.exe
[netae.exe] C:\WINDOWS\netae.exe
[iewb.exe] C:\WINDOWS\system32\iewb.exe
[addkz32.exe] C:\WINDOWS\system32\addkz32.exe
[ipdv.exe] C:\WINDOWS\ipdv.exe
[ntqs32.exe] C:\WINDOWS\system32\ntqs32.exe
[winoo.exe] C:\WINDOWS\system32\winoo.exe
[ipwi.exe] C:\WINDOWS\system32\ipwi.exe
[atlzb.exe] C:\WINDOWS\atlzb.exe
[sysss.exe] C:\WINDOWS\sysss.exe
[appfh32.exe] C:\WINDOWS\appfh32.exe
[sysyh.exe] C:\WINDOWS\sysyh.exe
[msge.exe] C:\WINDOWS\system32\msge.exe

addui32.exe
Addui32.exe is Trojan/Backdoor.
Kill the process addui32.exe and remove addui32.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

adgknqtx.exe
ADGKNQTX.exe is Trojan/Backdoor.
Kill the process ADGKNQTX.exe and remove ADGKNQTX.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

adidas.worm.exe
W32.Shoes@mm
It is a mass-mailing worm that sends itself to contacts in the Microsoft Outlook address book.
Changes the Internet Explorer Start page to a predetermined Web page, which may be located at one of the following domains:
www.porn-cam.com
www.sleazepit.com

Adds the value: "Adidas.Worm.exe"="%System%\Adidas.Worm.exe"
to the registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Sends an email to each entry in the Microsoft Outlook address book.
The email has the following characteristics:

Subject: Re: Here is your FREE porn web site username and password, I got it especially for you. Enjoy..!! ;-)

Body:
User Name : Anonymous Addict
PassWord : PoRnStAr2004
Go to this web site http:/ /18eighteen.com/pt=scrg6606/ then click on
MEMBERS CLICK HERE! and use this free username and password to log on,
Well i think This is the best FREE porn web site i`ve seen in a very long time..!!

Attachment: Adidas.Worm.exe

Use RegRun Startup Optimizer to remove this worm.

adir.dll
ADIR.DLL is SpywareQuake.
Read more:
http://fileinfo.prevx.com/adware/qq48ee4...
Kill the file ADIR.DLL and remove ADIR.DLL from Windows startup using RegRun Reanimator.
http://www.regrun.com

adirka.exe
ADIRKA.EXE is Trojan/Backdoor.
Read more:
http://fileinfo.prevx.com/adware/qqf5428...
Kill the process ADIRKA.EXE and remove ADIRKA.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

adirss.exe
ADIRSS.EXE is Trojan/Backdoor.
Read more:
http://fileinfo.prevx.com/adware/qq083a4...
Kill the process ADIRSS.EXE and remove ADIRSS.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

adl_dh.exe
Adl_dh.exe is Adware.W32.DealHelper.
Kill the process adl_dh.exe and remove adl_dh.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

adm4005.exe
Adm4005.exe is Trojan/Backdoor.
Kill the process adm4005.exe and remove adm4005.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

admagic.exe
Admagic.exe is W32/Smibag.worm.
Related files:
admagic.exe (90.112 bytes) - worm body
atl.dll (69,632 bytes) - Microsoft Visual C++ Active Template Library
raw32x.dll (121 bytes) - data file
sm.dll (57,344 bytes) - dll used by worm
uz.exe (50,688 bytes) - compression utility
test.txt (0 bytes)
Read more:
http://vil.nai.com/vil/content/v_100692....
Kill the process admagic.exe and remove admagic.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

admilliservx.dll
AdmilliServX.dll is Admilli Service Spyware.
AdmilliServX.dll is a part of an advertising program.
Manufacturer: Admilli
Kill the file AdmilliServX.dll and remove AdmilliServX.dll from Windows startup using RegRun.
www.regrun.com

admin$@.dll
ADMIN$@.DLL is Trojan/Backdoor.
Read more:
http://fileinfo.prevx.com/fileinfo.asp?P...
Kill the file ADMIN$@.DLL and remove ADMIN$@.DLL from Windows startup using RegRun Reanimator.
http://www.regrun.com

adminmgr.exe
We suggest you to remove adminmgr.exe from your computer as soon as possible.
Adminmgr.exe is Backdoor.Win32.VB.ate.
Related files:
%system%\ adminmgr.exe
clipboard.exe
Read more:
http://research.sunbelt-software.com/thr...
Kill the process adminmgr.exe and remove adminmgr.exe from Windows startup.

admintool.exe
Steals passwords / ICQ trojan

admparse.exe
Admparse.exe is Trojan/Backdoor.
Kill the process admparse.exe and remove admparse.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

adn_sis.dll
ADN_SIS.DLL is Trojan/Backdoor.
Read more:
http://fileinfo.prevx.com/fileinfo.asp?P...
Kill the file ADN_SIS.DLL and remove ADN_SIS.DLL from Windows startup using RegRun Reanimator.
http://www.regrun.com

adobe photoshop 7.0 serial key.exe
ADOBE PHOTOSHOP 7.0 SERIAL KEY.EXE is TrojanDropper.Win32.Small.E.
Read more:
http://fileinfo.prevx.com/adware/qq530f6...
Kill the process ADOBE PHOTOSHOP 7.0 SERIAL KEY.EXE and remove ADOBE PHOTOSHOP 7.0 SERIAL KEY.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

adobe32.exe
adobe32.exe is a Trojan.MancSyn-C.
adobe32.exe opens a back door.
Related files:
%Startup%\adobe32.exe
%System%\himem32.exe
%System%\mmapi32.dll
%Windows%\wucfg.dat
More info:
http://www.sophos.com/virusinfo/analyses...
Removal:
Kill adobe32.exe process and remove adobe32.exe from Windows startup using RegRun Startup Optimizer.

adobeacr.dll
Adobeacr.dll is Trojan/Backdoor.
Kill the file adobeacr.dll and remove adobeacr.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

adobemgr.exe
Adobemgr.exe is Trojan.Adclicker.
Trojan.Adclicker is a generic class of Trojan Horses that are designed to artificially generate traffic to certain Web sites. These Trojans send HTTP requests to simulate clicks on banner advertisements, or to inflate Web counter statistics.
Read more:
http://www.symantec.com/security_respons...
Kill the process adobemgr.exe and remove adobemgr.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

adobepnl.dll
Adobepnl.dll is Troj/SpyDldr-G.
Read more:
http://www.sophos.com/security/analyses/...
Kill the file adobepnl.dll and remove adobepnl.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

adober.exe
AdobeR.exe is Trojan.AdobeR/RavAV.
Read more:
http://www.superadblocker.com/definition...
Kill the process AdobeR.exe and remove AdobeR.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

adobes.exe
IRC Trojan.
Stop process and remove it from startup.

adp123.exe
Adp123.exe is Trojan/Backdoor.
Kill the process adp123.exe and remove adp123.exe from Windows startup.

adriss.exe
Adriss.exe is Troj/Spamsrv-E.
Read more:
http://www.sophos.com/security/analyses/...
Kill the process adriss.exe and remove adriss.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

adrotate.dll
Adrotate.dll is AdRotator/IconAds Adware.
Related files:
%local_settings%\ temp\ 11-9df8e247b1ab6e4ea9303b15294a3428.exe
%local_settings%\ temp\ s11k..exe
%PROGRAM_FILES%\ COMMON FILES\ SLMSS\ slmss.exe
%SYSTEM%\ adrot-uninst.exe
%SYSTEM%\ adrotate.dll
%SYSTEM%\ adrotate1.dll
%system%\ adspipe.dll
%SYSTEM%\ brrotate.dll
%system%\ cpmrotate.dll
%SYSTEM%\ drivers\ csrss.exe
%system%\ mwsvm.exe
%system%\ mwsvm.ocx
%SYSTEM%\ nodeipproc.dll
%SYSTEM%\ uninsticn.exe
Read more:
http://research.sunbelt-software.com/thr...
Kill the file adrotate.dll and remove adrotate.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

adrotate1.dll
Adrotate1.dll is AdRotator/IconAds Adware.
Related files:
%local_settings%\ temp\ 11-9df8e247b1ab6e4ea9303b15294a3428.exe
%local_settings%\ temp\ s11k..exe
%PROGRAM_FILES%\ COMMON FILES\ SLMSS\ slmss.exe
%SYSTEM%\ adrot-uninst.exe
%SYSTEM%\ adrotate.dll
%SYSTEM%\ adrotate1.dll
%system%\ adspipe.dll
%SYSTEM%\ brrotate.dll
%system%\ cpmrotate.dll
%SYSTEM%\ drivers\ csrss.exe
%system%\ mwsvm.exe
%system%\ mwsvm.ocx
%SYSTEM%\ nodeipproc.dll
%SYSTEM%\ uninsticn.exe
Read more:
http://research.sunbelt-software.com/thr...
Kill the file adrotate1.dll and remove adrotate1.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

adslcom.exe
Adslcom.exe is Troj/Clunky-A.
Related files:
IEXPLORER.EXE
adslcom.exe
adslcomdos.exe
wincontxt.dll
Adslcom.sys
msfport.dll
Read more:
http://www.sophos.com/virusinfo/analyses...
Kill the process adslcom.exe and remove adslcom.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

adslcomdos.exe
Adslcomdos.exe is Troj/Clunky-A.
Related files:
IEXPLORER.EXE
adslcom.exe
adslcomdos.exe
wincontxt.dll
Adslcom.sys
msfport.dll
Read more:
http://www.sophos.com/virusinfo/analyses...
Kill the process adslcomdos.exe and remove adslcomdos.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

adsnt.exe
AdsNT.exe is Trojan.DownLoader.316.
Read more:
http://research.eacceleration.com/threat...
Kill the process AdsNT.exe and remove AdsNT.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

adsnwy.exe
Adsnwy.exe is YahooSpyMon.
YahooSpyMon is a spyware program that records Yahoo! Instant Messenger information on the computer and saves it to a log file.
Related files:
%UserProfile%\Local Settings\Temp\DRDld\yimspymonitor.exe
%CommonProgramFiles%\Download Manager\Yahoo! Messenger Spy Monitor\LMDOWNLOADINFO.xml
%ProgramFiles%\YIMCS\data\dpnsvry.exe
%ProgramFiles%\YIMCS\data\emxfile003.dat
%ProgramFiles%\YIMCS\data\ps_demo_report.html
%ProgramFiles%\YIMCS\data\testftpok.html
%ProgramFiles%\YIMCS\data\vssvcy.exe
%ProgramFiles%\YIMCS\data\yimusr.ini
%ProgramFiles%\YIMCS\help.chm
%ProgramFiles%\YIMCS\License.txt
%ProgramFiles%\YIMCS\readme.txt
%ProgramFiles%\YIMCS\unins000.dat
%ProgramFiles%\YIMCS\unins000.exe
%ProgramFiles%\YIMCS\winyim.exe
%System%\adsnwy.exe
%System%\mxpvct22.dat
%System%\mxpvct25.dat
%System%\yimappini.ini
Read more:
http://www.symantec.com/enterprise/secur...
Kill the process adsnwy.exe and remove adsnwy.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

adspipe.dll
ADSPIPE.DLL is Adware.AdRotator.
Read more:
http://www.fileresearchcenter.com/A/ADSP...
Kill the file ADSPIPE.DLL and remove ADSPIPE.DLL from Windows startup using RegRun Reanimator.
http://www.regrun.com

adstartup.exe
Adstartup.exe is Adware.Adlogix.
Adware.Adlogix is a Browser Helper Object that downloads advertisements from a remote server and periodically displays them on the client machine.
Related files:
%ProgramFiles%\adlcontrolcomp.xml
%System%\adupdater.exe
%System%\.dll
%System%\a.xml
%System%\b.xml
%System%\c.exe
%System%\d.exe
%System%\e.xml
%System%\f.exe
%System%\unpack.exe
%System%\pacifisy.dll
%System%\*.dat
Read more:
http://www.symantec.com/security_respons...
Kill the process adstartup.exe and remove adstartup.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

adstatkeep.exe
AdStatKeep.exe is spyware component.
AdStatKeep tracks your Internet activity and sned information to the master web site.
Kill the AdStatKeep.exe process using RegRun Process Manager.

adstatserv.exe
AdStatServ.exe is spyware component.
AdStatServ tracks your Internet activity and sned information to the master web site.
Kill the AdStatServ.exe process using RegRun Process Manager.

adtech2006.exe
Adtech2006.exe is Trojan/Backdoor Start Page.
Kill the process adtech2006.exe and remove adtech2006.exe from Windows startup.

adtech2006a.exe
Adtech2006a.exe is Trojan Startpage.
Kill the process adtech2006a.exe and remove adtech2006a.exe from Windows startup.

adult_chat1.exe
Adult_chat1.exe is Adult content dialler.
Kill the process adult_chat1.exe and remove adult_chat1.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

adult1.exe
Adult1.exe is Dialer.Asdplug.
Dialer.Asdplug is a dialer program that can be used to access pornographic material by dialling a high-cost number using the modem.
Read more:
http://www.symantec.com/security_respons...
Kill the process adult1.exe and remove adult1.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

adultcontentviewer[1].exe
ADULTCONTENTVIEWER[1].EXE is Dialer Acv.
Read more:
http://fileinfo.prevx.com/adware/qq44fb5...
Kill the process ADULTCONTENTVIEWER[1].EXE and remove ADULTCONTENTVIEWER[1].EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

adv32.exe
Adv32.exe is W32/Sdbot-CWO.
Read more:
http://www.sophos.com/security/analyses/...
Kill the process adv32.exe and remove adv32.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

advantage.exe
AdVantage.exe is Adware.MediaAdVantage.
Adware.MediaAdVantage is an adware program that monitors the contents of Internet browser windows.
Related files:
%ProgramFiles%\AdVantage\AdVantage.exe
%ProgramFiles%\AdVantage\AdVantage.cch
%ProgramFiles%\AdVantage\AdVantage.db
%ProgramFiles%\AdVantage\AdVantage.htm
%ProgramFiles%\AdVantage\AdVUninst.exe
%ProgramFiles%\AdVantage\ffext.mod
%ProgramFiles%\AdVantage\TR.dll
%ProgramFiles%\AdVantage\user.db
Read more:
http://www.symantec.com/enterprise/secur...
Kill the process AdVantage.exe and remove AdVantage.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

advapi32.exe
Y3k trojan

advbot.exe
Advbot.exe is a worm W32.Kelvir.T.
Advbot.exe spreads by MSN Messenger and via open network shares.
Related files:
%ProgramFiles%\999\uncanny.exe
%ProgramFiles%\999\advbot.exe
More info:
http://securityresponse.symantec.com/avc...
Removal:
Kill advbot.exe process and remove advbot.exe from Windows startup using RegRun Startup Optimizer.

advchks.exe
Advchks.exe is Trojan/Backdoor.
Kill the process advchks.exe and remove advchks.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

advmon32.exe
Advmon32.exe is Troj/Crypter-C.
Read more:
http://www.sophos.com/virusinfo/analyses...
Kill the process advmon32.exe and remove advmon32.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

advpack1.exe
Advpack1.exe is Adware.IEDriver.
Read more:
http://www.fileresearchcenter.com/A/ADVP...
Kill the process advpack1.exe and remove advpack1.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

advpsys.exe
Advpsys.exe is Trojan/Backdoor.
Kill the process advpsys.exe and remove advpsys.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

advvpi32.dll
Advvpi32.dll is Backdoor.Mydopam.
Backdoor.Mydopam is a Trojan horse with back door capabilities that sends out spam emails.
Read more:
http://www.symantec.com/enterprise/secur...
Kill the file advvpi32.dll and remove advvpi32.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

aecache.exe
Aecache.exe is Trojan/Backdoor.
Kill the process aecache.exe and remove aecache.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

aelupsvc32.dll
Aelupsvc32.dll is Rogoo Hijacker (Chinese).
Read more:
http://www.castlecops.com/lsp-224.html
Kill the file aelupsvc32.dll and remove aelupsvc32.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

aervicesn.exe
Aervicesn.exe is W32/Randon-AO.
Read more:
http://www.sophos.com/security/analyses/...
Kill the process aervicesn.exe and remove aervicesn.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

aexl.exe
Aexl.exe is Trojan/Backdoor.
Kill the process aexl.exe and remove aexl.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

afilterplatform.exe
Afilterplatform.exe is W32/Rbot-OP.
Read more:
http://www.sophos.com/security/analyses/...
Kill the process afilterplatform.exe and remove afilterplatform.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

afkvvy.dll
AFKVVY.DLL is Trojan/Backdoor.
Kill the file AFKVVY.DLL and remove AFKVVY.DLL from Windows startup using RegRun Reanimator.
http://www.regrun.com

ageheru.exe
Ageheru.exe is Trojan/Backdoor.
Kill the process ageheru.exe and remove ageheru.exe from Windows startup.

agetltfeibe.exe
Agetltfeibe.exe is Infostealer.Huaxiat.
Read more:
http://www.symantec.com/enterprise/secur...
Kill the process agetltfeibe.exe and remove agetltfeibe.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

agldccotm.exe
AGLDCCOTM.EXE is Trojan/Backdoor.
Read more:
http://fileinfo.prevx.com/adware/qqc88f8...
Kill the process AGLDCCOTM.EXE and remove AGLDCCOTM.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

agony.sys
AGONY.SYS is Rootkit.Agony.
Read more:
http://research.sunbelt-software.com/thr...
Kill the file AGONY.SYS and remove AGONY.SYS from Windows startup using RegRun Reanimator.
http://www.regrun.com

agp32.exe
Agp32.exe is W32/Agobot-LE.
Read more:
http://www.sophos.com/security/analyses/...
Kill the process agp32.exe and remove agp32.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

agrssg.exe
Agrssg.exe is Trojan/Backdoor.
Kill the process agrssg.exe and remove agrssg.exe from Windows startup.

agseyapp.exe
Spyware.GoldenEye is spyware that can:
- Log all keystrokes
- List the names of all running programs
- Take periodic screenshots

Manual removal:

Navigate to the key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
and delete the value: " AGSeyApp" = "\AGSeyApp.exe"

Navigate to the key: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SharedDLLs
and delete the values:
C:\\OLEAUT32.DLL = 0x1
C:\\MSCOMCTL..OCX = 0x1
C:\\TabCtl32.ocx = 0x1
C:\\PICCLP32.OCX = 0x1
C:\\GEHP.dll = 0x1

agsystem2.exe
Agsystem2.exe is Trojan/Backdoor.
Related files:
agsystem2.exe
WinUpdate.exe
msrtspr1.exe
agony.sys
Kill the process agsystem2.exe and remove agsystem2.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

ahah.exe
Ahah.exe is Trojan.Tarodrop.
Read more:
http://www.symantec.com/enterprise/secur...
Kill the process ahah.exe and remove ahah.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

ahdp.dll
AHDP.DLL is Backdoor.Delf.ahv.
Kill the file AHDP.DLL and remove AHDP.DLL from Windows startup using Reg Run.
www.regrun.com

ahjinst.exe
Ahjinst.exe is Trojan/Backdoor.
Kill the process ahjinst.exe and remove ahjinst.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

ahost.exe
Ahost.exe is Trojan/Backdoor.
Kill the process ahost.exe and remove ahost.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

ahtun.exe
Ahtun.exe is Trojan/Backdoor.
Ahtun.exe is the system service called LAGOS.
Delete LAGOS service using RegRun Start Control.
Delete c:\windows\system32\Ahtun.exe

aim reminder.exe
"Trojan.Aol.Buddy"
http://www.viruslist.com/eng/viruslist.h...

aim95.exe
Aim95.exe is a Trojan Backdoor.Sdbot.
Aim95.exe spreads via Internet Relay Chat (IRC).
Aim95.exe tries to terminate antiviral programs installed on a user computer.
Aim95.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\Cnfgldr.exe
%System%\cthelp.exe
%System%\Sysmon16.exe
%System%\Sys3f2.exe
%System%\Syscfg32.exe
%System%\Mssql.exe
%System%\Aim95.exe
%System%\Svchosts.exe
%System%\FB_PNU.EXE
%System%\Cmd32.exe
%System%\Sys32.exe
%System%\Explorer.exe
%System%\IEXPL0RE.EXE
%System%\iexplore.exe
%System%\sock32.exe
%System%\MSTasks.exe
%System%\service.exe
%System%\Regrun.exe
%System%\ipcl32.exe
%System%\syswin32.exe
%System%\CMagesta.exe
%System%\YahooMsgr.exe
%System%\vcvw.exe
%System%\spooler.exe
%System%\MSsrvs32.exe
%System%\svhost.exe
%System%\winupdate32.exe
%System%\quicktimeprom.exe
More info:
http://securityresponse.symantec.com/avc...
Removal:
Kill Aim95.exe process and remove Aim95.exe from Windows startup using RegRun Startup Optimizer.

aimplg.exe
Aimplg.exe is W32/Sdbot-CNG.
Read more:
http://www.sophos.com/security/analyses/...
Kill the process aimplg.exe and remove aimplg.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

aimsgr.exe
Aimsgr.exe is Trojan/Backdoor.
Kill the process aimsgr.exe and remove aimsgr.exe from Windows startup.

aimsng.exe
Aimsng.exe is Trojan/Backdoor SDBOT-XE WORM.
Kill the process aimsng.exe and remove aimsng.exe from Windows startup.

aimwindowsv.exe
Aimwindowsv.exe is Trojan/Backdoor.
Kill the process aimwindowsv.exe and remove aimwindowsv.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

airftp.exe
Airftp.exe is Trojan/Backdoor.
Kill the process airftp.exe and remove airftp.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

ais32.exe
AIS32.EXE is Trojan/Backdoor.
Related files:
1 :?:\AIS32.EXE
2 :?:\AW32.EXE
3 :?:\PIR.EXE
Read more:
http://fileinfo.prevx.com/adware/qq87132...
Kill the process AIS32.EXE and remove AIS32.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

ak47.dll
AK47.DLL is Worm.Ircbot.Gen.
Read more:
http://fileinfo.prevx.com/adware/qqa28d6...
Kill the file AK47.DLL and remove AK47.DLL from Windows startup using RegRun Reanimator.
http://www.regrun.com

ak922.sys
AK922.sys is Trojan/Backdoor.
Kill the file AK922.sys and remove AK922.sys from Windows startup using RegRun Reanimator.
http://www.regrun.com

akikaze.exe
We suggest you to remove akikaze.exe from your computer as soon as possible.
Akikaze.exe is MSIL.Yakizake.
MSIL.Yakizake is a mass-mailing worm that runs within the .NET or Mono framework and requires that Thunderbird is installed.
Read more:
http://www.symantec.com/business/securit...
Kill the process akikaze.exe and remove akikaze.exe from Windows startup.

akiller.dll
AKiller.dll is W32/Eboscro.
Read more:
http://www.pspl.com/virus_info/worms/ebo...
Kill the file aKiller.dll and remove aKiller.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

aklsp.dll
Aklsp.dll is Virtumundo malware.
Kill the file aklsp.dll and remove aklsp.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

al2dll.dll
AL2DLL.DLL is Smitfraud Trojan.
Read more:
http://www.fbmsoftware.com/spyware-net/A...
Kill the file AL2DLL.DLL and remove AL2DLL.DLL from Windows startup using RegRun Reanimator.
http://www.regrun.com

albus.sys
Albus.SYS is Trojan.Downloader-ALBUS.Process.
Read more:
http://www.fileresearchcenter.com/A/ALBU...
Kill the file Albus.SYS and remove Albus.SYS from Windows startup using RegRun Reanimator.
http://www.regrun.com

alczz.exe
Alczz.exe is Trojan/Backdoor.
Related files:
%programfiles%\sav\symantec antivirus\ALCZZ1.EXE
%WINDIR%\SYSTEM32\ALCZZ1.EXE
Read more:
http://spywarefiles.prevx.com/RRFGHA3173...
Kill the process alczz.exe and remove alczz.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

alertic.exe
We suggest you to remove alertic.exe from your computer as soon as possible.
Alertic.exe is Trojan/Backdoor.
Kill the process alertic.exe and remove alertic.exe from Windows startup.

alg1.exe
Alg1.exe is Trojan VCClient.
Kill the process alg1.exe and remove alg1.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

alg2k.exe
Alg2k.exe is W32/Sdbot-CZO.
Read more:
http://www.sophos.com/virusinfo/analyses...
Kill the process alg2k.exe and remove alg2k.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

alggg.exe
Alggg.exe is Trojan/Backdoor.
Kill the process alggg.exe and remove alggg.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

algose32.exe
Algose32.exe is W32/Rbot-GDD.
W32/Rbot-GDD is a network worm with IRC backdoor functionality for the Windows platform.
W32/Rbot-GDD spreads by exploiting common network vulnerabilities.
W32/Rbot-GDD allows a remote attacker to gain access and control over the infected computer using IRC channels.
Read more:
http://www.sophos.com/security/analyses/...
Kill the process algose32.exe and remove algose32.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

algs.exe
Algs.exe is a worm W32.Linkbot.M.
Algs.exe opens a back door through IRC.
Algs.exe spreads by exploiting the Microsoft Windows LSASS Buffer Overrun Vulnerability (Microsoft Security Bulletin MS04-011).
Algs.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\lssas.exe
%System%\Isass.exe
%System%\csrs.exe
%System%\logon.exe
%System%\winlogon.exe
%System%\explorer.exe
%System%\winamp.exe
%System%\firewall.exe
%System%\spoolsvc.exe
%System%\spoolsv.exe
%System%\algs.exe
%System%\iexplore.exe
Adds the value:
"Local Security Authority Service" = "%System%\lssas.exe"
"Local Security Authority Service" = "%System%\Isass.exe"
"Client Server Runtime Process" = "%System%\csrs.exe"
"Windows Logon Application" = "%System%\logon.exe"
"Windows Logon Application" = "%System%\winIogon.exe"
"Windows Explorer" = "%System%\explorer.exe"
"Winamp Agent" = "%System%\winamp.exe"
"Windows Network Firewall" = "%System%\firewall.exe"
"Spooler SubSystem App" = "%System%\spoolsvc.exe"
"Spooler SubSystem App" = "%System%\spooIsv.exe"
"Application Layer Gateway Service" = "%System%\algs.exe"
"Microsoft Internet Explorer" = "%System%\iexplore.exe"
to the Windows startup registry keys.
More info:
http://securityresponse.symantec.com/avc...
Removal:
Kill algs.exe process and remove algs.exe from Windows startup using RegRun Startup Optimizer.

algs5.exe
ALGS5.EXE is Trojan/Backdoor.
Kill the process ALGS5.EXE and remove ALGS5.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

algsrvs.exe
Algsrvs.exe is WORM_VB.DAK.
Related files:
Fun.xls.exe
ALGSRVS.EXE
MSFUN80.EXE
MSIME82.EXE
Read more:
http://fr.trendmicro-europe.com/consumer...
Kill the process algsrvs.exe and remove algsrvs.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

algu.exe
Algu.exe is Troj/CWS-I.
Read more:
http://www.sophos.com/virusinfo/analyses...
Kill the process algu.exe and remove algu.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

alicesd.exe
Alicesd.exe is part of WareOut.
Kill the process alicesd.exe and remove alicesd.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

all_files4.exe
All_files4.exe is Trojan/Backdoor.
Kill the process all_files4.exe and remove all_files4.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

allch.dll
ALLCH.DLL is Adware.AdultLinks.
Read more:
http://www.fileresearchcenter.com/A/ALLC...
Kill the file ALLCH.DLL and remove ALLCH.DLL from Windows startup using RegRun Reanimator.
http://www.regrun.com

alligt.exe
Alligt.exe is W32.Slurk.A.
W32.Slurk.A is a worm that copies itself to all removable and shared drives, and drops other threats on to the compromised computer.
Related files:
%System%\alligt.exe
%System%\severe.exe
%System%\drivers\conime.exe
%System%\drivers\nkruls.exe
%System%\hx1.bat
%System%\noruns.reg
%System%\alligt.dll
[DRIVE LETTER]:\autorun.inf
[DRIVE LETTER]:\OSO.exe
Read more:
http://www.symantec.com/enterprise/secur...
Kill the process alligt.exe and remove alligt.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

allinonespy.exe
Allinonespy.exe is a Spyware.AllInOne.
Allinonespy.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
allinonespy.exe
inject.dll
run.exe
runwin95.exe
%System%\applog.dll
%System%\inetlog.dll
%System%\keylogger.dll
%System%\log.dll
%System%\remotelog.dll
%System%\screenlog.dll
%System%\soundlog.dll
More info:
http://securityresponse.symantec.com/avc...
Removal:
Kill allinonespy.exe process and remove allinonespy.exe from Windows startup using RegRun Startup Optimizer.

allof.exe
Allof.exe is Backdoor.Ranky.Y.
Read more:
http://www.symantec.com/enterprise/secur...
Kill the process allof.exe and remove allof.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

alm.exe
Alm.exe is Trojan/Backdoor.
Kill the process alm.exe and remove alm.exe from Windows startup.

alrsbatt.dll
Alrsbatt.dll is Trojan/Backdoor.
Kill the file alrsbatt.dll and remove alrsbatt.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

alserv32.exe
ALSERV32.EXE is Trojan/Backdoor.
Read more:
http://fileinfo.prevx.com/adware/qq7e0e7...
Kill the process ALSERV32.EXE and remove ALSERV32.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

altpayv2.exe
Altpayv2.exe is Trojan/Backdoor.
Kill the process altpayv2.exe and remove altpayv2.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

altsvc.exe
Altsvc.exe is Trojan/Backdoor.
Kill the process altsvc.exe and remove altsvc.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

alxres.dll
AlxRes.dll is Alexa Toolbar Spyware.
Read more:
http://www.auditmypc.com/process/alxres....
Kill the file AlxRes.dll and remove AlxRes.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

amagent3.exe
Amagent3.exe is a Spyware.ActivMonAgent.
Amagent3.exe opens a back door.
Amagent3.exe tries to terminate antiviral programs installed on a user computer.
Amagent3.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
amagent3.exe
amaware.dll
dconsole.dll
slgr.dll
swkbhkl.dll
swmain.dll
swsys.exe
More info:
http://securityresponse.symantec.com/avc...
Removal:
Kill amagent3.exe process and remove amagent3.exe from Windows startup using RegRun Startup Optimizer.

amaware.dll
Amaware.dll is a Spyware.ActivMonAgent.
Amaware.dll opens a back door.
Amaware.dll tries to terminate antiviral programs installed on a user computer.
Amaware.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
amagent3.exe
amaware.dll
dconsole.dll
slgr.dll
swkbhkl.dll
swmain.dll
swsys.exe
More info:
http://securityresponse.symantec.com/avc...
Removal:
Remove amaware.dll from Windows startup using RegRun Startup Optimizer.

amazingtens.exe
Amazingtens.exe is Trojan/Backdoor.
Kill the process amazingtens.exe and remove amazingtens.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

amcxlss.exe
Amcxlss.exe is Trojan/Backdoor.
Kill the process amcxlss.exe and remove amcxlss.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

amd64.exe
Amd64.exe is Trojan/Backdoor.
Kill the process amd64.exe and remove amd64.exe from Windows startup.

amor.exe
Amor.exe is Trojan/Backdoor Bankos.
Kill the process amor.exe and remove amor.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

amp2pl.exe
Amp2pl.exe is Trojan.FakeAlert.
Read more:
http://research.sunbelt-software.com/thr...
Kill the process amp2pl.exe and remove amp2pl.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

amsn.exe
Amsn.exe is Troj/Banker-BNZ.
Read more:
http://www.sophos.com/security/analyses/...
Kill the process amsn.exe and remove amsn.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

amsndmgr.exe
Amsndmgr.exe is KWBOT.R VIRUS.
Read more:
http://securityresponse.symantec.com/avc...
Kill the process amsndmgr.exe and remove amsndmgr.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

amsngr.exe
Amsngr.exe is Troj/Sdbot-XM.
Read more:
http://www.sophos.com/virusinfo/analyses...
Kill the process amsngr.exe and remove amsngr.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

amsnmgr.exe
AMSNMGR.EXE is Spybot Worm.
Kill the process AMSNMGR.EXE and remove AMSNMGR.EXE from Windows startup.

amsnmsgrs.exe
Amsnmsgrs.exe is Trojan/Backdoor.
Kill the process amsnmsgrs.exe and remove amsnmsgrs.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

anacon.exe
I-Worm.Nocana.a
Nocana is a worm virus spreading via the Internet as an e-mail file attachment via P2P file sharing networks.
The worm contains a backdoor routine.
- opens full access to disk files and system registry keys
- sends information about infected computer
- sends cached passwords
- sends keyboard log
- downloads and executes files from Web
- changes display resolution
- runs DoS attack on several servers

Note that the real attached .EXE file name is hidden by a false .JPG extension(an "extra functionality" of MS Outlook is used to accomplish this deception).
As a result the infected .EXE file is displayed as a .JPG image file, but upon opening the attachment it is executed as a true EXE file.

The worm then installs itself to the system, runs its spreading routine and payload.
While installing the worm copies itself to the Windows directory using the name "ANACON.EXE" and registers this file in the system registry auto-run keys:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run AHU= %SystemDir%\ANACON.EXE
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices Hvewsveqmg = %SystemDir%\ANACON.EXE
HKCU\Software\Microsoft\Windows\CurrentVersion\Run Cvfjx = %SystemDir%\ANACON.EXE

The Nocana worm also terminates several anti-virus and active firewall processes.
To send infected messages the worm uses MS Outlook and sends messages to all the addresses found in the Outlook address book.

It also formats the D: drive.
Deletes all files in the current directory (in most cases - Windows system directory).
On 1st, 4th, 8th, 12th, 16th, 20th, 24th and 28th of each month the worm deletes all *.DLL, *.NLS, *.OCX files in the current directory (in most cases - Windows directory).

Automatic Removal: Use RegRun Startup Optimizer to remove it from startup.

aneel.exe
Aneel.exe is W32.Neela.
W32.Neela is a worm that spreads by copying itself to removable devices. It also attempts to disable antivirus applications.
Related files:
C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\Recent\index.dat
C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\Recent\Word Template.LNK
C:\Documents and Settings\Administrator\Local Settings\Application Data\Administrator.task\csrss.exe
C:\Documents and Settings\Administrator\Local Settings\Application Data\Administrator.task\lsass.exe
C:\Documents and Settings\Administrator\Local Settings\Application Data\Administrator.task\services.exe
C:\Documents and Settings\Administrator\Local Settings\Application Data\Administrator.task\smss.exe
C:\Documents and Settings\Administrator\Local Settings\Application Data\Administrator.task\winlogon.exe
C:\Documents and Settings\Administrator\Local Settings\Temp\Word Template\2.doc
C:\Documents and Settings\Administrator\Local Settings\Temp\Word Template\lsass.doc
C:\Documents and Settings\Administrator\Local Settings\Temp\Word Template\services.doc
C:\Documents and Settings\Administrator\Local Settings\Temp\Word Template\smss.doc
C:\Documents and Settings\Administrator\Local Settings\Temp\Word Template\winlogon.doc
C:\Documents and Settings\All Users\Application Data\Normal.exe
C:\WINDOWS\system32\execute.exe
C:\WINDOWS\Tasks\At1.job
C:\WINDOWS\aneel.exe
C:\WINDOWS\l33na.exe
C:\WINDOWS\leena.ini
C:\Read This.exe
Read more:
http://www.symantec.com/enterprise/secur...
Kill the process aneel.exe and remove aneel.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

angel.exe
Remote Access

aniee.exe
We suggest you to remove aniee.exe from your computer as soon as possible.
Aniee.exe is W32.Stemclover.
W32.Stemclover is a worm that copies itself to network shares and removable media. It also drops a copy of VBS.Stemclover.
Related files:
%Windir%\system23\aniee.exe
%System%\hanny.exe
Read more:
http://www.symantec.com/business/securit...
Kill the process aniee.exe and remove aniee.exe from Windows startup.

ann.exe
Ann.exe is Trojan/Backdoor.
Read more:
http://www.spywaredata.com/spyware/malwa...
Kill the process ann.exe and remove ann.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

anoafpan.exe
Worm / Virus / Mail trojan
The worm patches Wsock32.dll. Hybris spreads to every address in Outlook. It always check the language version on the computer and is able to use messages in English, French, Spanish and Portuguese. When spread, the worm changes the name of the .exe file to another 8 characters. It exists at least 32 different plug-ins giving the worm various functions. The plug-ins are encrypted using an asymmetric 128-bit key algarythm and are downloaded frеn the newsgroup alt.comp.virus together with new encrypted instructions. One of the plug-ins makes Hybris to search for SubSeven infected computers on the Internet and infect them. The worm also probes into .zip and .rar archives, names .exe files to .ex$ and copies itself into the archive using the altered fileґs name.

ante browse trust.exe
IE toolbar hijacking you to www.Lop.com - Search The Web site.
This is global searching site with many popup and advertising windows.

Manual removal:
If this .exe is running, end it and remove the "Stupidmore" directory from C:/Program Files

anti.exe
Anti.exe is Trojan/Backdoor.
Kill the process anti.exe and remove anti.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

anti_cih.exe
Remote Access / Worm / Virus / Trojan dropper / Mail trojan / Downloading trojan
It tries to destroy up to eight different antivirus programs and makes it impossible to mail the AV company or visit its Web-site. Wsock32.dll is patched by the trojan. Whenever the user sends a mail, the trojan will mail another one to the same recipient with an attachment only. May be updated from the Internet.

anti_trojan.exe
ANTI_TROJAN.EXE is Trojan/Backdoor.
Kill the process ANTI_TROJAN.EXE and remove ANTI_TROJAN.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com
More info:
http://us.mcafee.com/virusInfo/default.a...

antiadware.exe
Antiadware.exe is Trojan/Backdoor.
Kill the process antiadware.exe and remove antiadware.exe from Windows startup.

antiav.exe.exe
antiav.exe.exe is Trojan/Backdoor.
Kill the process antiav.exe.exe and remove antiav.exe.exe from Windows startup.

antibowsblue.exe
Antibowsblue.exe is Trojan/Backdoor.
Kill the process antibowsblue.exe and remove antibowsblue.exe from Windows startup using RegRun.
www.regrun.com

antidote[1.2].exe
Remote Access / FTP Server

antidote[1.3].exe
Remote Access / FTP Server

antigen.exe
Steals passwords
Itsends the stolen information to these three mail addresses: jcrowl@usa.net, uragan@msn.com, and anarch666@iname.com.

antinuke.exe
Remote Access / ICQ trojan
Alters Win.ini.

antiprotect.exe
Antiprotect.exe is RBot.antiprotect.
Read more:
http://spyware-removal.thrcomputer.com/t...
Kill the process antiprotect.exe and remove antiprotect.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

antispyrus.exe
We suggest you to remove antispyrus.exe from your computer as soon as possible.
Antispyrus.exe is Troj/Zapchas-DV.
Related files:
%Temp%\gsf2\antispyrus.exe
%Temp%\gsf2\lindisecret.exe
%Temp%\gsf2\zlip.cpl
%Temp%\gsf2\zlip1.cpl
%Temp%\gsf2\zlip2.cpl
Read more:
http://www.sophos.co.uk/security/analyse...
Kill the process antispyrus.exe and remove antispyrus.exe from Windows startup.

antispystorm.exe
AntispyStorm.exe is a part of AntiSpyStorm software.
AntiSpyStorm is a Security Risk that may give exaggerated reports of threats on the computer. The program then prompts the user to purchase a registered version of the software in order to remove the reported threats.
Related files:
C:\Documents and Settings\All Users\Desktop\AntispyStorm.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\AntispyStorm\AntispyStorm.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\AntispyStorm\Uninstall AntispyStorm.lnk
C:\Program Files\AntispyStorm\AntispyStorm.exe
C:\Program Files\AntispyStorm\as_ie_monitor.dll
C:\Program Files\AntispyStorm\clsReg.dll
C:\Program Files\AntispyStorm\config.dat
C:\Program Files\AntispyStorm\filesbase.bin
C:\Program Files\AntispyStorm\global_virus_table.bin
C:\Program Files\AntispyStorm\ignoredomainsbase.bin
C:\Program Files\AntispyStorm\ignorefilesbase.bin
C:\Program Files\AntispyStorm\ignoreregsbase.bin
C:\Program Files\AntispyStorm\parser.exe
C:\Program Files\AntispyStorm\regbase.bin
C:\Program Files\AntispyStorm\stat.bin
C:\Program Files\AntispyStorm\uninstall.exe
C:\Program Files\AntispyStorm\uninstall.log
C:\Program Files\AntispyStorm\urlbase.bin
Read more:
http://www.symantec.com/enterprise/secur...
Kill the process AntispyStorm.exe and remove AntispyStorm.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

antispywareshield.exe
AntiSpywareShield.exe is a part of AntiSpywareShield software.
AntiSpywareShield is a misleading application described as a spyware removal utility that may give exaggerated reports about potential risks on the computer.
Related files:
%UserProfile%\Desktop\AntiSpywareShield.lnk
%UserProfile%\Start Menu\Programs\AntiSpywareShield\AntiSpywareShield.lnk
%ProgramFiles%\AntiSpywareShield\AntiSpywareShield.exe
%ProgramFiles%\AntiSpywareShield\AntiSpywareShield0.dll
%ProgramFiles%\AntiSpywareShield\AntiSpywareShield1.dll
%ProgramFiles%\AntiSpywareShield\AntiSpywareShield3.dll
%ProgramFiles%\AntiSpywareShield\AntiSpywareShield.lic
%ProgramFiles%\AntiSpywareShield\AntiSpywareShield0.ad
%ProgramFiles%\AntiSpywareShield\AntiSpywareShield1.ad
%UserProfile%\Start Menu\Programs\AntiSpywareShield\Uninstall.lnk
Read more:
http://www.symantec.com/enterprise/secur...
Kill the process AntiSpywareShield.exe and remove AntiSpywareShield.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

antispywareshield0.dll
AntiSpywareShield0.dll is a part of AntiSpywareShield software.
AntiSpywareShield is a misleading application described as a spyware removal utility that may give exaggerated reports about potential risks on the computer.
Related files:
%UserProfile%\Desktop\AntiSpywareShield.lnk
%UserProfile%\Start Menu\Programs\AntiSpywareShield\AntiSpywareShield.lnk
%ProgramFiles%\AntiSpywareShield\AntiSpywareShield.exe
%ProgramFiles%\AntiSpywareShield\AntiSpywareShield0.dll
%ProgramFiles%\AntiSpywareShield\AntiSpywareShield1.dll
%ProgramFiles%\AntiSpywareShield\AntiSpywareShield3.dll
%ProgramFiles%\AntiSpywareShield\AntiSpywareShield.lic
%ProgramFiles%\AntiSpywareShield\AntiSpywareShield0.ad
%ProgramFiles%\AntiSpywareShield\AntiSpywareShield1.ad
%UserProfile%\Start Menu\Programs\AntiSpywareShield\Uninstall.lnk
Read more:
http://www.symantec.com/enterprise/secur...
Kill the file AntiSpywareShield0.dll and remove AntiSpywareShield0.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

antispywareshield1.dll
AntiSpywareShield1.dll is is a part of AntiSpywareShield software.
AntiSpywareShield is a misleading application described as a spyware removal utility that may give exaggerated reports about potential risks on the computer.
Related files:
%UserProfile%\Desktop\AntiSpywareShield.lnk
%UserProfile%\Start Menu\Programs\AntiSpywareShield\AntiSpywareShield.lnk
%ProgramFiles%\AntiSpywareShield\AntiSpywareShield.exe
%ProgramFiles%\AntiSpywareShield\AntiSpywareShield0.dll
%ProgramFiles%\AntiSpywareShield\AntiSpywareShield1.dll
%ProgramFiles%\AntiSpywareShield\AntiSpywareShield3.dll
%ProgramFiles%\AntiSpywareShield\AntiSpywareShield.lic
%ProgramFiles%\AntiSpywareShield\AntiSpywareShield0.ad
%ProgramFiles%\AntiSpywareShield\AntiSpywareShield1.ad
%UserProfile%\Start Menu\Programs\AntiSpywareShield\Uninstall.lnk
Read more:
http://www.symantec.com/enterprise/secur...
Kill the file AntiSpywareShield1.dll and remove AntiSpywareShield1.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

antispywareshield3.dll
AntiSpywareShield3.dll is a part of AntiSpywareShield software.
AntiSpywareShield is a misleading application described as a spyware removal utility that may give exaggerated reports about potential risks on the computer.
Related files:
%UserProfile%\Desktop\AntiSpywareShield.lnk
%UserProfile%\Start Menu\Programs\AntiSpywareShield\AntiSpywareShield.lnk
%ProgramFiles%\AntiSpywareShield\AntiSpywareShield.exe
%ProgramFiles%\AntiSpywareShield\AntiSpywareShield0.dll
%ProgramFiles%\AntiSpywareShield\AntiSpywareShield1.dll
%ProgramFiles%\AntiSpywareShield\AntiSpywareShield3.dll
%ProgramFiles%\AntiSpywareShield\AntiSpywareShield.lic
%ProgramFiles%\AntiSpywareShield\AntiSpywareShield0.ad
%ProgramFiles%\AntiSpywareShield\AntiSpywareShield1.ad
%UserProfile%\Start Menu\Programs\AntiSpywareShield\Uninstall.lnk
Read more:
http://www.symantec.com/enterprise/secur...
Kill the file AntiSpywareShield3.dll and remove AntiSpywareShield3.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

antiv.exe
Antiv.exe is Trojan/Backdoor.
Kill the process antiv.exe and remove antiv.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

antivermeans.exe
Antivermeans.exe is Trojan/Backdoor.
Kill the process antivermeans.exe and remove antivermeans.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

antivermins.exe
AntiVermins.exe is a rogue antispyware Antivermins.
Kill the process AntiVermins.exe and remove AntiVermins.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

antiverminspro.exe
Antiverminspro.exe is Trojan/Backdoor.
Kill the process antiverminspro.exe and remove antiverminspro.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

antivir32.exe
ANTIVIR32.EXE is Worm.Ircbot.Gen.
Read more:
http://fileinfo.prevx.com/adware/qqb8bd6...
Kill the process ANTIVIR32.EXE and remove ANTIVIR32.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

antivirgear 3.7.exe
AntiVirGear 3.7.exe is a part of AntiVirGear software.
AntiVirGear is a misleading application that may give exaggerated reports of threats on the computer.
Related files:
%UserProfile%\Desktop\AntiVirGear 3.7.lnk
%UserProfile%\Start Menu\AntiVirGear 3.7.lnk Clean
%UserProfile%\Start Menu\Programs\AntiVirGear 3.7
%UserProfile%\Start Menu\Programs\AntiVirGear 3.7\AntiVirGear 3.7 Website.lnk Clean
%UserProfile%\Start Menu\Programs\AntiVirGear 3.7\AntiVirGear 3.7.lnk Clean
%UserProfile%\Start Menu\Programs\AntiVirGear 3.7\Uninstall AntiVirGear 3.7.lnk Clean
%ProgramFiles%\AntiVirGear 3.7
%ProgramFiles%\AntiVirGear 3.7\AntiVirGear 3.7.exe
%ProgramFiles%\AntiVirGear 3.7\AntiVirGear 3.7.url
%ProgramFiles%\AntiVirGear 3.7\avrg.dat
%ProgramFiles%\AntiVirGear 3.7\blacklist.txt
%ProgramFiles%\AntiVirGear 3.7\Lang\English.ini
%ProgramFiles%\AntiVirGear 3.7\msvcp71.dll
%ProgramFiles%\AntiVirGear 3.7\msvcr71.dll
%ProgramFiles%\AntiVirGear 3.7\uninst.exe
Read more:
http://www.symantec.com/enterprise/secur...
Kill the process AntiVirGear 3.7.exe and remove AntiVirGear 3.7.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

antivirscan.exe
AntiVirScan.exe is Trojan/Backdoor.
Kill the process AntiVirScan.exe and remove AntiVirScan.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

antivirus.exe
Antivirus.exe is Trojan/Backdoor.
Kill the process antivirus.exe and remove antivirus.exe from Windows startup.

anti-virus.exe
Anti-Virus.exe is AntiVirusAndSpyware.
AntiVirusAndSpyware is a misleading application that may give exaggerated reports of potential risks on a users computer. The program then prompts the user to purchase a registered version of the software in order to remove the reported risks.
Related files:
%ProgramFiles%\Anti-Virus&Spyware\Anti-Virus.exe
%ProgramFiles%\Anti-Virus&Spyware\Anti_Virus Help.chm
%ProgramFiles%\Anti-Virus&Spyware\EGhostLog.txt
%ProgramFiles%\Anti-Virus&Spyware\hook.dll
%ProgramFiles%\Anti-Virus&Spyware\Products.htm
%ProgramFiles%\Anti-Virus&Spyware\SkinPlusPlusDLL.dll
%ProgramFiles%\Anti-Virus&Spyware\unins000.dat
%ProgramFiles%\Anti-Virus&Spyware\unins000.exe
%ProgramFiles%\Anti-Virus&Spyware\virus.update
%ProgramFiles%\Anti-Virus&Spyware\Visit Our Site.url
%ProgramFiles%\Anti-Virus&Spyware\XPCorona.ssk
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Anti-Virus&Spyware.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\Anti-Virus&Spyware\Anti-Virus&Spyware.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\Anti-Virus&Spyware\Help.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\Anti-Virus&Spyware\Our Products.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\Anti-Virus&Spyware\Uninstall.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\Anti-Virus&Spyware\Visit Our Site.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\Anti-Virus&Spyware.lnk
Read more:
http://www.symantec.com/enterprise/secur...
Kill the process Anti-Virus.exe and remove Anti-Virus.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

antiviruspro.exe
We suggest you to remove AntiVirusPro.exe from your computer as soon as possible.
AntiVirusPro.exe is a part of AntiVirusPro software.
AntiVirusPro is a misleading application that may give exaggerated reports about potential risks on the computer.
Related files:
%UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\Anti Virus Pro spyware remover.lnk
%UserProfile%\Desktop\\Anti Virus Pro spyware remover.lnk
C:\Documents and Settings\All Users\Start Menu\Programs \Anti Virus Pro spyware remover\Register Anti Virus Pro spyware remover.lnk
C:\Documents and Settings\All Users\Start Menu\Programs \Anti Virus Pro spyware remover\Start Anti Virus Pro spyware remover.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\Anti Virus Pro spyware remover\Uninstall.lnk
%ProgramFiles%\AntiVirusPro\AntiVirusPro.exe
%ProgramFiles%\AntiVirusPro\AntiVirusPro.exe.local
%ProgramFiles%\AntiVirusPro\Core.dll
%ProgramFiles%\AntiVirusPro\database.pkg
%ProgramFiles%\AntiVirusPro\Localization.dll
%ProgramFiles%\AntiVirusPro\msvcp71.dll
%ProgramFiles%\AntiVirusPro\msvcr71.dll
%ProgramFiles%\AntiVirusPro\Uninstall.exe
%ProgramFiles%\AntiVirusPro\WndSystem.dll
%UserProfile%\Application Data\Anti-virus-Pro.com
Read more:
http://www.symantec.com/business/securit...
Kill the process AntiVirusPro.exe and remove AntiVirusPro.exe from Windows startup.

antiwpa.dll
Antiwpa.dll is Troj/Antiwpa-A.
Read more:
http://www.sophos.com/security/analyses/...
Kill the file antiwpa.dll and remove antiwpa.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

anvshell32.exe
Anvshell32.exe is Troj/VB-XU.
Related files:
%Windows%\cursors\windows16.exe
%System%\config\anvshell32.exe
%System%\drivers\wmilib32.exe
%System%\windows32.exe
Read more:
http://www.sophos.com/virusinfo/analyses...
Kill the process anvshell32.exe and remove anvshell32.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

aol32.exe
Aol32.exe is Trojan/Backdoor.
Kill the process aol32.exe and remove aol32.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

aolclient.exe
Aolclient.exe is Trojan/Backdoor Backdoor.Spyboter.gen.
Kill the process aolclient.exe and remove aolclient.exe from Windows startup.
http://securityresponse.symantec.com/avc...

aolconf.exe
Aolconf.exe is Trojan/Backdoor.
Kill the process aolconf.exe and remove aolconf.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

aolfix.exe
Aolfix.exe is W32/Sdbot-ABJ.
Read more:
http://www.sophos.com/security/analyses/...
Kill the process aolfix.exe and remove aolfix.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

aolmessenger.exe
Aolmessenger.exe is Trojan/Backdoor.
Kill the process aolmessenger.exe and remove aolmessenger.exe from Windows startup.

aolmsg.exe
Aolmsg.exe is Trojan/Backdoor.
Kill the process aolmsg.exe and remove aolmsg.exe from Windows startup.

aolserviceshosts.exe
Aolserviceshosts.exe is Trojan/Backdoor.
Kill the process aolserviceshosts.exe and remove aolserviceshosts.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

aolsnc.exe
AOLSNC.EXE is Backdoor.Win32.AimBot.263168 (W32.Spybot.Worm(Symantec)).
Read more:
http://www.hauri.net/virus/virusinfo_rea...
Kill the process AOLSNC.EXE and remove AOLSNC.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

aolstart.exe
Aolstart.exe is Trojan/Backdoor.
Kill the process aolstart.exe and remove aolstart.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

aolsw.exe
Aolsw.exe is Trojan/Backdoor.
Kill the process aolsw.exe and remove aolsw.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

aop2.exe
Aop2.exe is Trojan/Backdoor Crypt.
Kill the process aop2.exe and remove aop2.exe from Windows startup.

aosh.exe
AOSH.EXE is Trojan/Backdoor.
Read more:
http://fileinfo.prevx.com/adware/qqbc516...
Kill the process AOSH.EXE and remove AOSH.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

aounsmn.exe
AounsmN.exe is Trojan/Backdoor.
Kill the process aounsmN.exe and remove aounsmN.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

ap9h4qmo.exe
Ap9h4qmo.exe is Spyware.ShopAtHomeSelect.Process.
Related to ShopAtHomeSelect.com.
Kill the process ap9h4qmo.exe and remove ap9h4qmo.exe from Windows startup.

apd123.exe
APD123.exe is Adware.
Kill the process APD123.exe and remove APD123.exe from Windows startup.

apev.exe
Apev.exe is Trojan/Backdoor.
Kill the process apev.exe and remove apev.exe from Windows startup.

aphex.exe
Aphex.exe is a Adware.GameSpyArcade.
Aphex.exe download and display advertisements.
Related files:
Aphex.exe
fpupdate.exe
GSAPak.exe
RptCrash.exe
ArcRes.dll
gslan.dll
gsws.dll
pw32.dll
%Windir%\Downloaded Program Files\gsda.dll
More info:
http://securityresponse.symantec.com/avc...
Removal:
Kill Aphex.exe process and remove Aphex.exe from Windows startup using RegRun Startup Optimizer.

apicf32.exe
Apicf32.exe is Trojan/Backdoor.
Kill the process apicf32.exe and remove apicf32.exe from Windows startup using RegRun.
www.regrun.com

apicrypt.dll
Apicrypt.dll is Troj/Goldun-Z.
Read more:
http://www.sophos.com/security/analyses/...
Kill the file apicrypt.dll and remove apicrypt.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

apidxp.dll
APIDXP.DLL is Trojan/Backdoor.
Read more:
http://fileinfo.prevx.com/adware/qqff6f6...
Kill the file APIDXP.DLL and remove APIDXP.DLL from Windows startup using RegRun Reanimator.
http://www.regrun.com

apimonx.exe
Apimonx.exe is Trojan/Backdoor.
Kill the process apimonx.exe and remove apimonx.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

aping32.exe
Aping32.exe is Trojan/Backdoor.
Kill the process aping32.exe and remove aping32.exe from Windows startup.

apipp.exe
Ntww.exe is dangerous Trojan/Backdoor.
Ntww.exe changes IE home page to www.v61.com.
Trojan runs a lot of its copies to make the removal hard.
Remove it using RegRun Startup Optmizer to get rid all processes at the same time.
[sdkfr32.exe] C:\WINDOWS\sdkfr32.exe
[mfcyp.exe] C:\WINDOWS\mfcyp.exe
[netrt.exe] C:\WINDOWS\netrt.exe
[ntww.exe] C:\WINDOWS\ntww.exe
[ntdf32.exe] C:\WINDOWS\system32\ntdf32.exe
[ntbw32.exe] C:\WINDOWS\ntbw32.exe
[crbn32.exe] C:\WINDOWS\system32\crbn32.exe
[sdkpn32.exe] C:\WINDOWS\sdkpn32.exe
[d3dl.exe] C:\WINDOWS\d3dl.exe
[mfcod.exe] C:\WINDOWS\mfcod.exe
[apiel.exe] C:\WINDOWS\system32\apiel.exe
[ntxo32.exe] C:\WINDOWS\ntxo32.exe
[atlag.exe] C:\WINDOWS\atlag.exe
[mszo32.exe] C:\WINDOWS\system32\mszo32.exe
[d3qk.exe] C:\WINDOWS\d3qk.exe
[javahd32.exe] C:\WINDOWS\system32\javahd32.exe
[appds32.exe] C:\WINDOWS\appds32.exe
[apipp.exe] C:\WINDOWS\system32\apipp.exe
[mfcnn.exe] C:\WINDOWS\mfcnn.exe
[mfckl.exe] C:\WINDOWS\system32\mfckl.exe
[netlc.exe] C:\WINDOWS\system32\netlc.exe
[atlyi32.exe] C:\WINDOWS\system32\atlyi32.exe
[addtm32.exe] C:\WINDOWS\system32\addtm32.exe
[crad.exe] C:\WINDOWS\crad.exe
[javapt.exe] C:\WINDOWS\system32\javapt.exe
[javauu32.exe] C:\WINDOWS\javauu32.exe
[d3yp.exe] C:\WINDOWS\system32\d3yp.exe
[crwo32.exe] C:\WINDOWS\crwo32.exe
[ieim32.exe] C:\WINDOWS\system32\ieim32.exe
[sysyu.exe] C:\WINDOWS\sysyu.exe
[mfcrr.exe] C:\WINDOWS\system32\mfcrr.exe
[atlfg.exe] C:\WINDOWS\system32\atlfg.exe
[winvr32.exe] C:\WINDOWS\winvr32.exe
[iebp.exe] C:\WINDOWS\system32\iebp.exe
[ipyn.exe] C:\WINDOWS\ipyn.exe
[mspm.exe] C:\WINDOWS\mspm.exe
[javaee.exe] C:\WINDOWS\system32\javaee.exe
[addfm32.exe] C:\WINDOWS\addfm32.exe
[addrs.exe] C:\WINDOWS\addrs.exe
[crfy.exe] C:\WINDOWS\system32\crfy.exe
[crrd.exe] C:\WINDOWS\crrd.exe
[apptr32.exe] C:\WINDOWS\system32\apptr32.exe
[d3wk.exe] C:\WINDOWS\d3wk.exe
[apilk32.exe] C:\WINDOWS\apilk32.exe
[iedm.exe] C:\WINDOWS\system32\iedm.exe
[javagm.exe] C:\WINDOWS\system32\javagm.exe
[ntjw32.exe] C:\WINDOWS\ntjw32.exe
[netdo32.exe] C:\WINDOWS\netdo32.exe
[sysuc32.exe] C:\WINDOWS\system32\sysuc32.exe
[sdknd32.exe] C:\WINDOWS\system32\sdknd32.exe
[addko.exe] C:\WINDOWS\addko.exe
[mfcdh32.exe] C:\WINDOWS\system32\mfcdh32.exe
[sdkij32.exe] C:\WINDOWS\system32\sdkij32.exe
[msen.exe] C:\WINDOWS\system32\msen.exe
[msug.exe] C:\WINDOWS\msug.exe
[crkf32.exe] C:\WINDOWS\crkf32.exe
[winqj.exe] C:\WINDOWS\system32\winqj.exe
[sysgh32.exe] C:\WINDOWS\sysgh32.exe
[d3ud32.exe] C:\WINDOWS\d3ud32.exe
[netnm.exe] C:\WINDOWS\system32\netnm.exe
[apihs32.exe] C:\WINDOWS\system32\apihs32.exe
[addfp.exe] C:\WINDOWS\addfp.exe
[sdkqf32.exe] C:\WINDOWS\sdkqf32.exe
[crpn32.exe] C:\WINDOWS\system32\crpn32.exe
[netae.exe] C:\WINDOWS\netae.exe
[iewb.exe] C:\WINDOWS\system32\iewb.exe
[addkz32.exe] C:\WINDOWS\system32\addkz32.exe
[ipdv.exe] C:\WINDOWS\ipdv.exe
[ntqs32.exe] C:\WINDOWS\system32\ntqs32.exe
[winoo.exe] C:\WINDOWS\system32\winoo.exe
[ipwi.exe] C:\WINDOWS\system32\ipwi.exe
[atlzb.exe] C:\WINDOWS\atlzb.exe
[sysss.exe] C:\WINDOWS\sysss.exe
[appfh32.exe] C:\WINDOWS\appfh32.exe
[sysyh.exe] C:\WINDOWS\sysyh.exe
[msge.exe] C:\WINDOWS\system32\msge.exe

apitr32.exe
APITR32.EXE is Trojan/Backdoor.
Kill the process APITR32.EXE and remove APITR32.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

apollo_04.exe
APOLLO_04.EXE is Trojan/Backdoor.
Read more:
http://fileinfo.prevx.com/fileinfo.asp?P...
Kill the process APOLLO_04.EXE and remove APOLLO_04.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

appache.exe
ApPache.exe is a Trojan W32.Rbot-YP.
ApPache.exe opens a back door on IRC channels.
ApPache.exe spreads via open network shares.
ApPache.exe tries to terminate antiviral programs installed on a user computer.
ApPache.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
More info:
http://www.sophos.com/virusinfo/analyses...
Removal:
Kill ApPache.exe process and remove ApPache.exe from Windows startup using RegRun Startup Optimizer.

apparat.dll
Apparat.dll is Trojan.Apparat.BHO.
Read more:
http://www.fileresearchcenter.com/A/APPA...
Kill the file apparat.dll and remove apparat.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

appconf.exe
Appconf.exe is Trojan/Backdoor.
Kill the process appconf.exe and remove appconf.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

appconn.exe
Appconn.exe is Trojan/Backdoor.
Kill the process appconn.exe and remove appconn.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

appcontrol.exe
Appcontrol.exe is WORM_SDBOT.CFT.
Read more:
http://www.trendmicro.com/vinfo/virusenc...
Kill the process appcontrol.exe and remove appcontrol.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

appdc.exe
Appdc.exe is Trojan/Backdoor.
Kill the process appdc.exe and remove appdc.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

appdl.dll
Appdl.dll is Trojan/Backdoor.
Kill the file appdl.dll and remove appdl.dll from Windows startup using RegRun.
www.regrun.com

appds32.exe
Ntww.exe is dangerous Trojan/Backdoor.
Ntww.exe changes IE home page to www.v61.com.
Trojan runs a lot of its copies to make the removal hard.
Remove it using RegRun Startup Optmizer to get rid all processes at the same time.
[sdkfr32.exe] C:\WINDOWS\sdkfr32.exe
[mfcyp.exe] C:\WINDOWS\mfcyp.exe
[netrt.exe] C:\WINDOWS\netrt.exe
[ntww.exe] C:\WINDOWS\ntww.exe
[ntdf32.exe] C:\WINDOWS\system32\ntdf32.exe
[ntbw32.exe] C:\WINDOWS\ntbw32.exe
[crbn32.exe] C:\WINDOWS\system32\crbn32.exe
[sdkpn32.exe] C:\WINDOWS\sdkpn32.exe
[d3dl.exe] C:\WINDOWS\d3dl.exe
[mfcod.exe] C:\WINDOWS\mfcod.exe
[apiel.exe] C:\WINDOWS\system32\apiel.exe
[ntxo32.exe] C:\WINDOWS\ntxo32.exe
[atlag.exe] C:\WINDOWS\atlag.exe
[mszo32.exe] C:\WINDOWS\system32\mszo32.exe
[d3qk.exe] C:\WINDOWS\d3qk.exe
[javahd32.exe] C:\WINDOWS\system32\javahd32.exe
[appds32.exe] C:\WINDOWS\appds32.exe
[apipp.exe] C:\WINDOWS\system32\apipp.exe
[mfcnn.exe] C:\WINDOWS\mfcnn.exe
[mfckl.exe] C:\WINDOWS\system32\mfckl.exe
[netlc.exe] C:\WINDOWS\system32\netlc.exe
[atlyi32.exe] C:\WINDOWS\system32\atlyi32.exe
[addtm32.exe] C:\WINDOWS\system32\addtm32.exe
[crad.exe] C:\WINDOWS\crad.exe
[javapt.exe] C:\WINDOWS\system32\javapt.exe
[javauu32.exe] C:\WINDOWS\javauu32.exe
[d3yp.exe] C:\WINDOWS\system32\d3yp.exe
[crwo32.exe] C:\WINDOWS\crwo32.exe
[ieim32.exe] C:\WINDOWS\system32\ieim32.exe
[sysyu.exe] C:\WINDOWS\sysyu.exe
[mfcrr.exe] C:\WINDOWS\system32\mfcrr.exe
[atlfg.exe] C:\WINDOWS\system32\atlfg.exe
[winvr32.exe] C:\WINDOWS\winvr32.exe
[iebp.exe] C:\WINDOWS\system32\iebp.exe
[ipyn.exe] C:\WINDOWS\ipyn.exe
[mspm.exe] C:\WINDOWS\mspm.exe
[javaee.exe] C:\WINDOWS\system32\javaee.exe
[addfm32.exe] C:\WINDOWS\addfm32.exe
[addrs.exe] C:\WINDOWS\addrs.exe
[crfy.exe] C:\WINDOWS\system32\crfy.exe
[crrd.exe] C:\WINDOWS\crrd.exe
[apptr32.exe] C:\WINDOWS\system32\apptr32.exe
[d3wk.exe] C:\WINDOWS\d3wk.exe
[apilk32.exe] C:\WINDOWS\apilk32.exe
[iedm.exe] C:\WINDOWS\system32\iedm.exe
[javagm.exe] C:\WINDOWS\system32\javagm.exe
[ntjw32.exe] C:\WINDOWS\ntjw32.exe
[netdo32.exe] C:\WINDOWS\netdo32.exe
[sysuc32.exe] C:\WINDOWS\system32\sysuc32.exe
[sdknd32.exe] C:\WINDOWS\system32\sdknd32.exe
[addko.exe] C:\WINDOWS\addko.exe
[mfcdh32.exe] C:\WINDOWS\system32\mfcdh32.exe
[sdkij32.exe] C:\WINDOWS\system32\sdkij32.exe
[msen.exe] C:\WINDOWS\system32\msen.exe
[msug.exe] C:\WINDOWS\msug.exe
[crkf32.exe] C:\WINDOWS\crkf32.exe
[winqj.exe] C:\WINDOWS\system32\winqj.exe
[sysgh32.exe] C:\WINDOWS\sysgh32.exe
[d3ud32.exe] C:\WINDOWS\d3ud32.exe
[netnm.exe] C:\WINDOWS\system32\netnm.exe
[apihs32.exe] C:\WINDOWS\system32\apihs32.exe
[addfp.exe] C:\WINDOWS\addfp.exe
[sdkqf32.exe] C:\WINDOWS\sdkqf32.exe
[crpn32.exe] C:\WINDOWS\system32\crpn32.exe
[netae.exe] C:\WINDOWS\netae.exe
[iewb.exe] C:\WINDOWS\system32\iewb.exe
[addkz32.exe] C:\WINDOWS\system32\addkz32.exe
[ipdv.exe] C:\WINDOWS\ipdv.exe
[ntqs32.exe] C:\WINDOWS\system32\ntqs32.exe
[winoo.exe] C:\WINDOWS\system32\winoo.exe
[ipwi.exe] C:\WINDOWS\system32\ipwi.exe
[atlzb.exe] C:\WINDOWS\atlzb.exe
[sysss.exe] C:\WINDOWS\sysss.exe
[appfh32.exe] C:\WINDOWS\appfh32.exe
[sysyh.exe] C:\WINDOWS\sysyh.exe
[msge.exe] C:\WINDOWS\system32\msge.exe

append.dll
Append.dll is Trojan/Backdoor.
Kill the file append.dll and remove append.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

appft.exe
Appft.exe is CWS.SearchX.
Read more:
http://www.fbmsoftware.com/spyware-net/p...
Kill the process appft.exe and remove appft.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

apphost.exe
Apphost.exe is Trojan/Backdoor.
Kill the process apphost.exe and remove apphost.exe from Windows startup.

appinit_dlls
Dice Rootkit Trojan.
It’s user mode rootkits.
Dice Rootkits hide files, processes and registry entries.
Added to registry:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
AppInit_DLLs
More info:
http://www.sophos.com/security/analyses/...

appis.exe
Appis.exe is Trojan/Backdoor.
Kill the process appis.exe and remove appis.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

application.exe
APPLICATION.exe is Trojan/Backdoor.
Kill the process APPLICATION.exe and remove APPLICATION.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

appmagr.dll
Appmagr.dll is SpywareQuake.
Kill the file appmagr.dll and remove appmagr.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

appmastercenter.exe
Appmastercenter.exe is Trojan/Backdoor.
Kill the process appmastercenter.exe and remove appmastercenter.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

appmgr32.dll
Appmgr32.dll is Trojan/Backdoor.
Kill the file appmgr32.dll and remove appmgr32.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

appmon.dll
AppMon.dll is Spyware.XpcSpy.
Related files:
XPCSpyPro.exe;
AppSpy.dll;
IESpy.dll;
KeySpy.dll;
SysDll32.dll;
Rx.exe;
Systemout.exe;
AppMon.dll;
IEMon.dll;
systemin.sys.
Read more:
http://www.symantec.com/avcenter/venc/da...
Kill the file AppMon.dll and remove AppMon.dll from Windows startup using RegRun.
www.regrun.com

appmv.dll
Appmv.dll is Trojan/Backdoor.
Kill the file appmv.dll and remove appmv.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

apprn32.exe
Apprn32.exe is Trojan/Backdoor.
Kill the process apprn32.exe and remove apprn32.exe from Windows startup.

apprp32.exe
Apprp32.exe is Trojan/Backdoor.
Kill the process apprp32.exe and remove apprp32.exe from Windows startup.

appstraka316.exe
Appstraka316.exe is a Spyware.AppsTraka.
Appstraka316.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Userprofile%\Start Menu\Programs\AppsTraka\AppsTraka.lnk
%Userprofile%\Desktop\AppsTraka.lnk
%ProgramFiles%\AppsTraka\AppsTraka.exe
%ProgramFiles%\AppsTraka\Appstraka.html
%ProgramFiles%\AppsTraka\Register.html
%ProgramFiles%\AppsTraka\unins000.dat
%ProgramFiles%\AppsTraka\unins000.exe
%System%\Akeylg32.dll
%System%\Appdlg32.dll
appstraka316.exe
Adds the value:
"ATSpooler" = ""C:\Program Files\AppsTraka\AppsTraka.exe" /r"
to the Windows startup registry keys.
More info:
http://securityresponse.symantec.com/avc...
Removal:
Kill appstraka316.exe process and remove appstraka316.exe from Windows startup using RegRun Startup Optimizer.

appunreg.exe
Appunreg.exe is Trojan.Iesguide.
Related files:
%System%\appunreg.exe
%System%\esbupchk.exe
%System%\iepupchk.exe
%System%\iesginstall.exe
%System%\iesguide.dll
%System%\iesguninstall.exe
%System%\[7 RANDOM CHARACTERS].exe
%System%\sinstenv.ini
%System%\[7 RANDOM CHARACTERS].exe
%System%\vbbho.tlb
%System%\iepsvcpv.exe
%System%\iesbsvcv.exe
Read more:
http://www.symantec.com/enterprise/secur...
Kill the process appunreg.exe and remove appunreg.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

appxc32.exe
Appxc32.exe is Trojan/Backdoor.
Kill the process appxc32.exe and remove appxc32.exe from Windows startup.

appxe.exe
APPXE.EXE is Trojan/Backdoor.
Kill the process APPXE.EXE and remove APPXE.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

appxt.exe
Appxt.exe is Trojan/Backdoor.
Kill the process appxt.exe and remove appxt.exe from Windows startup.

appzy32.exe
Appzy32.exe is Trojan/Backdoor.
Kill the process appzy32.exe and remove appzy32.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

aprload.exe
Aprload.exe is Spyware installed with People on People toolbar.
Made by ContextPlus
http://contextplus.net/
Aprload.exe used for getting updates.
Kill the process aprload.exe and remove aprload.exe from Windows startup.

apsvc.exe
Apsvc.exe is Spyware.SpyPal.
Spyware.SpyPal is a spyware program that monitors user activity on the computer.
Related files:
%System%\psreginf.ini
%UserProflie%\Local Settings\Temp\~DF[RANDOM CHARACTERS].tmp
%ProgramFiles%\SPSS\apsvc.exe
%ProgramFiles%\SPSS\data\data.dat
%ProgramFiles%\SPSS\data\ps_demo_report.html
%ProgramFiles%\SPSS\data\reginf.ini
%ProgramFiles%\SPSS\data\testftpok.html
%ProgramFiles%\SPSS\data\usrproc.exe
%ProgramFiles%\SPSS\data\winserv.exe
%ProgramFiles%\SPSS\help.chm
%ProgramFiles%\SPSS\License.txt
%ProgramFiles%\SPSS\readme.txt
%ProgramFiles%\SPSS\scrshot\[RANDOM FILE NAME].jpg
%ProgramFiles%\SPSS\unins000.dat
%ProgramFiles%\SPSS\unins000.exe
%System%\fltmc001.dat
%System%\fltmc002.dat
%System%\fltmc003.dat
%System%\reghost.exe
Read more:
http://www.symantec.com/enterprise/secur...
Kill the process apsvc.exe and remove apsvc.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

apuliaiv.exe
Worm / Mail trojan
If the victimґs copy of WinZip is not registred, the worm tries to do it. Apulia 4 uses all addresses in Outlook and sends a mail with the subject "Crack for ICQ".

apv.exe
Apv.exe is Trojan-Clicker.Win32.Spywad.e.
Read more:
http://www.pestpatrol.com/spywarecenter/...
Kill the process apv.exe and remove apv.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

aq3hel~1.exe
AQ3HEL~1.EXE is Adware.GAIN/Aquatica.
Read more:
http://www.superadblocker.com/definition...
Kill the process AQ3HEL~1.EXE and remove AQ3HEL~1.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

aql32.exe
Aql32.exe is Troj/Rbot-GCY.
Read more:
http://www.sophos.com/security/analyses/...
Kill the process aql32.exe and remove aql32.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

arcac.exe
ARCAC.EXE is Trojan.Downloader-Gen/Arc.
Read more:
http://www.fileresearchcenter.com/A/ARCA...
Kill the process ARCAC.EXE and remove ARCAC.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

arcaderockstar32.exe
Arcaderockstar32.exe is a part of Arcaderockstar Free Arcade Games and Prize Tournaments.
"The program itself is clean, but the TOS and privacy statement say that you agree to allow the program to track/report your surfing and put popup advertising on your computer."
Read more:
http://www.castlecops.com/s14249-arcader...
Kill the process arcaderockstar32.exe and remove arcaderockstar32.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

archgui.exe
ARCHGUI.EXE is Trojan/Backdoor.
Read more:
http://fileinfo.prevx.com/adware/qq2d7f6...
Kill the process ARCHGUI.EXE and remove ARCHGUI.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

archiver.exe
Keylogger

arcres.dll
ArcRes.dll is a Adware.GameSpyArcade.
ArcRes.dll download and display advertisements.
Related files:
Aphex.exe
fpupdate.exe
GSAPak.exe
RptCrash.exe
ArcRes.dll
gslan.dll
gsws.dll
pw32.dll
%Windir%\Downloaded Program Files\gsda.dll
More info:
http://securityresponse.symantec.com/avc...
Removal:
Remove ArcRes.dll from Windows startup using RegRun Startup Optimizer.

arena.exe
Arena.exe is W32.Deletemusic.
W32.Deletemusic is a worm that copies itself to all drives on the compromised computer. It also deletes all .mp3 files from the compromised computer.
Related files:
%System%\contig\csrss.exe
%Windir%\media\arena.exe
%System%\logon.bat
%System%\contig\?utorun.inf
Read more:
http://www.symantec.com/enterprise/secur...
Kill the process arena.exe and remove arena.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

arepxpsn.dll
AREPXPSN.DLL is Trojan/Backdoor.
Read more:
http://fileinfo.prevx.com/adware/qq57bf5...
Kill the file AREPXPSN.DLL and remove AREPXPSN.DLL from Windows startup using RegRun Reanimator.
http://www.regrun.com

argsmmsg.exe
ARGSMMSG.exe is Trojan/Backdoor.
Kill the process ARGSMMSG.exe and remove ARGSMMSG.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

ariel.exe
Remote Access

aritima.exe
Aritima.exe is ARITIMA VIRUS.
Read more:
http://securityresponse.symantec.com/avc...
Kill the process aritima.exe and remove aritima.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

arpl.exe
Arpl.exe is Trojan/Backdoor.
Kill the process arpl.exe and remove arpl.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

arrdt.exe
Arrdt.exe is Trojan/Backdoor.
Kill the process arrdt.exe and remove arrdt.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

arse.exe
Arse.exe is Trojan/Backdoor.
Kill the process arse.exe and remove arse.exe from Windows startup.

artchker.exe
Artchker.exe is Trojan/Backdoor.
Kill the process artchker.exe and remove artchker.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

artm_new.dll
Artm_new.dll is Trojan.ARTM/Polymorph.
Read more:
http://www.superadblocker.com/definition...
Kill the file artm_new.dll and remove artm_new.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

arupdate.exe
Adware.AdRoar is a Browser Helper Object that is used to display pop-up advertisements.
In some circumstances, you may see the message:
This module was compiled with a trial version of Delphi. The trial period has expired.

If the file Cpr.dll is found in the System folder this mean you are infected.
This adware must be manually installed or installed as a component of another program.

Creates the following registry keys:
HKEY_CLASSES_ROOT\cpr.IEHelperOP
HKEY_CLASSES_ROOT\CLSID\{FAC6E0E1-5D45-4907-BC00-302D702DCC73}
HKEY_CURRENT_USER\Software\Cpr
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\CPR

Periodically contacts iads.adroar.com to download advertisements.
May download and install updated versions of itself.

This threat can be detected only by Symantec products that support expanded threats.
Use RegRun Start Control to remove arupdate.exe and cpr.dll.

asappsrv.dll
Asappsrv.dll is SpySheriff Adware.
Kill the file asappsrv.dll and remove asappsrv.dll from Windows startup.

ascdl.exe
Ascdl.exe is Trojan/Backdoor.
Kill the process ascdl.exe and remove ascdl.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

asclt.exe
Asclt.exe is W32/Sdbot-OA.
Read more:
http://www.sophos.com/security/analyses/...
Kill the process asclt.exe and remove asclt.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

asdapi.exe
Asdapi.exe is CABRO VIRUS.
Read more:
http://securityresponse.symantec.com/avc...
Kill the process asdapi.exe and remove asdapi.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

asddll32.exe
AsdDLL32.exe is the Trojan (PCIDEV).
Removal:
Use RegRun AntiSpyware.
Reset to default:
[Current Home Page]
HOMEOldSP=
http://%77%71%6F%78%61%6E%2E%74%2E%6D%75...
[Search Assistant]
SearchAssistant=http://%77%71%6F%78%61%6E%2E%74%2E%6D%75...
[URLSearchHook] {7CE941D9-51CE-9950-7B79-1A0C1569D890}=C:\WINDOWS\Iamcahxj.dll
[Toolbars] {91464AB2-0115-27ED-FBD9-47A7A7A7A7E5}=C:\WINDOWS\Iamcahxj.dll
[Registry Run] PCI Device 32=C:\WINDOWS\SYSTEM\PCIDev32.exe
Open RegRun Start Control Right click and choose Terminate.
Repeat for
[Registry Run] WIN16/DOS Network Interface Service Process=C:\WINDOWS\SYSTEM\Mprexe16.com
[Startup Folder] Validate Antivirus.lnk=C:\ANYWARE\AAWIN.EXE
Check if it is legitimate file.
Remove:
[Win.ini] run=C:\WINDOWS\AsdDLL32.exe
Kill the process AsdDLL32.exe using RegRun Process Manager.

asgag.exe
Asgag.exe is Trojan/Backdoor.
Kill the process asgag.exe and remove asgag.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

asgp32.dll
Asgp32.dll is SmitFraud adware.
Read more:
http://www.pandasoftware.com/virus_info/...
Kill the file asgp32.dll and remove asgp32.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

ashprot.sys
We suggest you to remove ashprot.sys from your computer as soon as possible.
Ashprot.sys is Spyware.SpySure.
Spyware.SpySure is a spyware program that may steal sensitive information from the computer.
Related files:
C:\Documents and Settings\All Users\Application Data\spysure\servircess.exe
C:\Documents and Settings\All Users\Application Data\spysure\servirsess.exe
C:\Documents and Settings\All Users\Application Data\spysure\setup.dat
C:\Documents and Settings\All Users\Application Data\spysure\spysure.zip
C:\Documents and Settings\All Users\Application Data\spysure\spysureinstallzip.exe
C:\Documents and Settings\All Users\Application Data\spysure\syservice.exe
C:\Documents and Settings\All Users\Application Data\spysure\test.bmp
C:\Documents and Settings\All Users\Application Data\spysure\testlog.txt
C:\Documents and Settings\All Users\Application Data\spysure\testlog2.txt
C:\Documents and Settings\All Users\Application Data\spysure\updater.exe
C:\Documents and Settings\All Users\Application Data\spysure\ashcd.dat
C:\Documents and Settings\All Users\Application Data\spysure\ashprot.sys
C:\Documents and Settings\All Users\Application Data\spysure\ashsetup.dat
C:\Documents and Settings\All Users\Application Data\spysure\DrvFltIp.sys
C:\Documents and Settings\All Users\Application Data\spysure\gmon.out
C:\Documents and Settings\All Users\Application Data\spysure\help.html
C:\Documents and Settings\All Users\Application Data\spysure\logo.gif
C:\Documents and Settings\All Users\Application Data\spysure\Project2.dll
C:\Documents and Settings\All Users\Application Data\spysure\readme.txt
%System%\ashprot.sys
%System%\DrvFltIp.sys
Read more:
http://www.symantec.com/business/securit...
Kill the file ashprot.sys and remove ashprot.sys from Windows startup.

asian trojan.exe
Remote Access / Steals passwords
The client also drops a server! The hacker could choose to log passwords only or all text written. One of the functions is to kill antivirus software.

asijdie.exe
Asijdie.exe is Trojan/Backdoor.
Kill the process asijdie.exe and remove asijdie.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

aslru.exe
Aslru.exe is Troj/Bancos-CU.
Read more:
http://www.sophos.com/virusinfo/analyses...
Kill the process aslru.exe and remove aslru.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

asmend.exe
Asmend.exe is Trojan/Backdoor.
Read more:
http://www.spywaredata.com/spyware/malwa...
Kill the process asmend.exe and remove asmend.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

asmonitor.exe
ASMONITOR.EXE is Spyware.w32.ActualSpy.
Kill the process ASMONITOR.EXE and remove ASMONITOR.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

asmphoto1.exe
Mail trojan / Autodialer / ICQ trojan / Steals passwords
It deletes the two system files Regedit.exe and Msconfig.exe.

asmphoto2.exe
Mail trojan / Autodialer / ICQ trojan / Steals passwords
It deletes the two system files Regedit.exe and Msconfig.exe.

asmserv.exe
ASMSERV.EXE is Trojan/Backdoor.
Read more:
http://fileinfo.prevx.com/adware/qqd1186...
Kill the process ASMSERV.EXE and remove ASMSERV.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

asmsjtm.exe
Asmsjtm.exe is Trojan/Backdoor.
Kill the process asmsjtm.exe and remove asmsjtm.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

asn2.exe
Asn2.exe is Worm Ircbot Gen.
Read more:
http://virusinfo.prevx.com/pxparall.asp?...
Kill the process asn2.exe and remove asn2.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

aspam.exe
Remote Access
Disguised as an Microsoft Anti-Spam tool, that comes attached to a spoofed mail from the company.

aspi242501.exe
ASPI242501.EXE is Trojan/Backdoor.
Read more:
http://fileinfo.prevx.com/adware/qq9d8e7...
Kill the process ASPI242501.EXE and remove ASPI242501.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

aspimgr.exe
Aspimgr.exe is Trojan.Asprox.
Trojan.Asprox is a Trojan horse that uses the compromised computer as a proxy server.
Related files:
%System%\aspimgr.exe
%Windir%\s32.txt
%Windir%\db32.txt
%Windir%\g32.txt
%Windir%\gs32.txt
%Windir%\ws386.ini
%Temp%\_check32.bat
Read more:
http://www.symantec.com/enterprise/secur...
Kill the process aspimgr.exe and remove aspimgr.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

asr_sdm.exe
Asr_sdm.exe is a Trojan Backdoor.Ryejet.
Asr_sdm.exe opens a back door on a random TCP port.
Related files:
%System%\asr_sdm.exe
%System%\asr_sdmr.exe
%System%\asr_ssmr
%System%\sal.mdb
%System%\rpe.sys
%Windir%\svchost.exe
More info:
http://securityresponse.symantec.com/avc...
Removal:
Kill asr_sdm.exe process and remove asr_sdm.exe from Windows startup using RegRun Startup Optimizer.

asr_sdmr.exe
Asr_sdmr.exe is a Trojan Backdoor.Ryejet.
Asr_sdmr.exe opens a back door on a random TCP port.
Related files:
%System%\asr_sdm.exe
%System%\asr_sdmr.exe
%System%\asr_ssmr
%System%\sal.mdb
%System%\rpe.sys
%Windir%\svchost.exe
More info:
http://securityresponse.symantec.com/avc...
Removal:
Kill asr_sdmr.exe process and remove asr_sdmr.exe from Windows startup using RegRun Startup Optimizer.

asrupdate.exe
Asrupdate.exe is Trojan/Backdoor.
Kill the process asrupdate.exe and remove asrupdate.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

asscrpro.exe
Asscrpro.exe is Trojan/Backdoor.
Read more:
http://www.incodesolutions.com/threats/W...
Kill the process asscrpro.exe and remove asscrpro.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

assist4.exe
Assist4.exe is Trojan/Backdoor CNSMIN.
Kill the process assist4.exe and remove assist4.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

assistantwzd.exe
Assistantwzd.exe is Trojan/Backdoor CNSMIN.
Kill the process assistantwzd.exe and remove assistantwzd.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

assistse.exe
Assistse.exe is Trojan/Backdoor CNSMIN.
Kill the process assistse.exe and remove assistse.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

astr.exe
Astr.exe is Trojan/Backdoor.
Kill the process astr.exe and remove astr.exe from Windows startup using Reg Run.
www.regrun.com

asusrx20.dll
Asusrx20.dll is Troj/Haxdoor-CZ.
Related files:
%System%\asusrx20.dll
%System%\asusrx25.sys
%System%\ksl48.bin
Read more:
http://www.sophos.com/security/analyses/...
Kill the file asusrx20.dll and remove asusrx20.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

asusrx25.sys
Asusrx25.sys is Troj/Haxdoor-CZ.
Related files:
%System%\asusrx20.dll
%System%\asusrx25.sys
%System%\ksl48.bin
Read more:
http://www.sophos.com/security/analyses/...
Kill the file asusrx25.sys and remove asusrx25.sys from Windows startup using RegRun Reanimator.
http://www.regrun.com

aswboot.exe
AswBoot.exe is Trojan/Backdoor W32.Bagz.H@mm.
Kill the process aswBoot.exe and remove aswBoot.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com
Read more:
www.sarc.com/avcenter/venc/data/pf/w32.bagz.h@mm.html

aswnk.exe
Aswnk.exe is Adult content dialler.
Kill the process aswnk.exe and remove aswnk.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

asycfilt.exe
ASYCFILT.EXE is AZESEARCH adware.
Read more:
http://www.spywaredata.com/spyware/threa...
Kill the process ASYCFILT.EXE and remove ASYCFILT.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

at12evxx.exe
At12evxx.exe is Trojan/Backdoor.
Kill the process at12evxx.exe and remove at12evxx.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

atapidrv.exe
Atapidrv.exe is W32/Agobot-SL.
Read more:
http://www.sophos.com/virusinfo/analyses...
Kill the process atapidrv.exe and remove atapidrv.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

atba.exe
Atba.exe is MediaTicketInstaller Adware.
Kill the process atba.exe and remove atba.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

atecaca.exe
Atecaca.exe is Trojan/Backdoor.
Kill the process atecaca.exe and remove atecaca.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

ati.exe
ATI.exe is Win32.Rbot.EBB.
Read more:
http://www.ca.com/us/securityadvisor/vir...
Kill the process ATI.exe and remove ATI.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

ati2kaag.dll
Ati2kaag.dll is Trojan/Backdoor.
Kill the file ati2kaag.dll and remove ati2kaag.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

ati2ksag.sys
Ati2ksag.sys is Trojan/Backdoor.
Kill the file ati2ksag.sys and remove ati2ksag.sys from Windows startup using RegRun Reanimator.
http://www.regrun.com

ati2vid.exe
Ati2vid.exe is Trojan/Backdoor SDBOT.
Kill the process ati2vid.exe and remove ati2vid.exe from Windows startup.

ati2xxx.exe
Ati2xxx.exe is W32/Rbot-AIK.
Read more:
http://www.sophos.com/security/analyses/...
Kill the process ati2xxx.exe and remove ati2xxx.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

ati3duag.exe
Ati3duag.exe is Adware.
Kill the process ati3duag.exe and remove ati3duag.exe from Windows startup.

ati3evx.exe
ATI3EVX.EXE is Trojan/Backdoor.
Read more:
http://fileinfo.prevx.com/adware/qq49467...
Kill the process ATI3EVX.EXE and remove ATI3EVX.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

aticpaxx.exe
Aticpaxx.exe is Trojan/Backdoor.
Kill the process aticpaxx.exe and remove aticpaxx.exe from Windows startup.

atidrvxx.exe
Atidrvxx.exe is W32/Rbot-VZ.
Read more:
http://www.sophos.com/security/analyses/...
Kill the process atidrvxx.exe and remove atidrvxx.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

atievx.exe
Atievx.exe is W32/IRCBot-TL.
Read more:
http://www.sophos.com/security/analyses/...
Kill the process atievx.exe and remove atievx.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

atigfx.exe
ATIGFX.EXE is Trojan/Backdoor.
Read more:
http://fileinfo.prevx.com/adware/qq45774...
Kill the process ATIGFX.EXE and remove ATIGFX.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

atip.exe
Atip.exe is Win32.Tactslay.
Read more:
http://vic.zonelabs.com/tmpl/body/CA/vir...
Kill the process atip.exe and remove atip.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

atipatxx.exe
Atipatxx.exe is Troj/Small-ED.
Read more:
http://www.sophos.com/virusinfo/analyses...
Kill the process atipatxx.exe and remove atipatxx.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

atiphexx.exe
Atiphexx.exe is Trojan/Backdoor Agobot.
Kill the process atiphexx.exe and remove atiphexx.exe from Windows startup.
www.sophos.com/virusinfo/analyses/w32agobotnv.html

atiptext.exe
Atiptext.exe is Troj/Cosiam-A.
Read more:
http://www.sophos.com/security/analyses/...
Kill the process atiptext.exe and remove atiptext.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

atira.exe
W32.Kotira is a virus that overwrites executable files.
May display the following message:
Your Computer already infected by Atira Worm+virus.

Copies itself as the following:
%System%\Arita.exe
%Windir%\Arita.exe
C:\Program Files\Atira.exe

Adds the value: "System"="C:\Progra~1\Atira.exe"
to the registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CurrentVersion\Run

Attempts to create the following key: HKEY_LOCAL_MACHINE\Software\Microsoft\CurrentVersion\arita by Lasiaf

Automatic removal:
Use RegRun Startup Optimizer to remove it from startup.

atirage4dpro.exe
Atirage4dpro.exe is W32/Agobot-OG.
Read more:
http://www.sophos.com/security/analyses/...
Kill the process atirage4dpro.exe and remove atirage4dpro.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

atiupdate5.exe
ATIUPDATE5.EXE is Trojan/Backdoor.
Read more:
http://www.castlecops.com/s271-ATIUPDATE...
Kill the process ATIUPDATE5.EXE and remove ATIUPDATE5.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

atiupdpl.exe
Atiupdpl.exe is Trojan/Backdoor.
Kill the process atiupdpl.exe and remove atiupdpl.exe from Windows startup.

atiupdxx.exe
Atiupdxx.exe is W32/Rbot-ABX.
Read more:
http://www.sophos.com/virusinfo/analyses...
Kill the process atiupdxx.exe and remove atiupdxx.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

ativvaxx.exe
Ativvaxx.exe is Adware.
Kill the process ativvaxx.exe and remove ativvaxx.exe from Windows startup.

atixd.exe
Atixd.exe is W32/Rbot-FOV.
Read more:
http://www.sophos.com/security/analyses/...
Kill the process atixd.exe and remove atixd.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

atixvdm.exe
Atixvdm.exe is Win32.Rbot.DMW.
Read more:
http://www.ca.com/us/securityadvisor/vir...
Kill the process atixvdm.exe and remove atixvdm.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

atkuswo.exe
Atkuswo.exe is the mail worm
Atkuswo spreads via LAN and by e-mail.
Kill atkuswo.exe process using RegRun Process Manager.

atl_helper.exe
Atl_helper.exe is Trojan/Backdoor.
Kill the process atl_helper.exe and remove atl_helper.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

atla.dll
Atla.dll is a Spyware.Apropos.
Atla.dll is a Browser Helper Object.
Atla.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Windir%\Downloaded Program Files\load.exe
%Windir%\Downloaded Program Files\monpop.exe
%Windir%\Downloaded Program Files\pop225.dll
%Windir%\Downloaded Program Files\pophook4.dll
%Windir%\Downloaded Program Files\PopSrv225.exe
%Temp%\auto_update_loader.exe
%Temp%\install_ct.exe
%Temp%\CXtPls.exe
%Temp%\ProxyStub.dll
%Temp%\WinGenerics.dll
%Temp%\ace.dll
%Temp%\atla.dll
%Temp%\atlw.dll
%Temp%\data.bin
%Temp%\libexpat.dll
%Temp%\ph.exe
%Temp%\pm.exe
%Temp%\setup.inf
%Temp%\uninstaller.exe
%Temp%\atl.dll
%System%\atmon.exe
%System%\intfaxui.exe
Adds the value:
"POP" = "C:\WINDOWS\Downloaded Program Files\PopSrv225.exe"
"AutoLoaderEnvoloAutoUpdater" = "auto_update_loader.exe"
"[random name]" = "intfaxui.exe"
"[random name]" = "atmon.exe"
to the Windows startup registry keys.
More info:
http://securityresponse.symantec.com/avc...
Removal:
Remove atla.dll from Windows startup using RegRun Startup Optimizer.

atlag.exe
Ntww.exe is dangerous Trojan/Backdoor.
Ntww.exe changes IE home page to www.v61.com.
Trojan runs a lot of its copies to make the removal hard.
Remove it using RegRun Startup Optmizer to get rid all processes at the same time.
[sdkfr32.exe] C:\WINDOWS\sdkfr32.exe
[mfcyp.exe] C:\WINDOWS\mfcyp.exe
[netrt.exe] C:\WINDOWS\netrt.exe
[ntww.exe] C:\WINDOWS\ntww.exe
[ntdf32.exe] C:\WINDOWS\system32\ntdf32.exe
[ntbw32.exe] C:\WINDOWS\ntbw32.exe
[crbn32.exe] C:\WINDOWS\system32\crbn32.exe
[sdkpn32.exe] C:\WINDOWS\sdkpn32.exe
[d3dl.exe] C:\WINDOWS\d3dl.exe
[mfcod.exe] C:\WINDOWS\mfcod.exe
[apiel.exe] C:\WINDOWS\system32\apiel.exe
[ntxo32.exe] C:\WINDOWS\ntxo32.exe
[atlag.exe] C:\WINDOWS\atlag.exe
[mszo32.exe] C:\WINDOWS\system32\mszo32.exe
[d3qk.exe] C:\WINDOWS\d3qk.exe
[javahd32.exe] C:\WINDOWS\system32\javahd32.exe
[appds32.exe] C:\WINDOWS\appds32.exe
[apipp.exe] C:\WINDOWS\system32\apipp.exe
[mfcnn.exe] C:\WINDOWS\mfcnn.exe
[mfckl.exe] C:\WINDOWS\system32\mfckl.exe
[netlc.exe] C:\WINDOWS\system32\netlc.exe
[atlyi32.exe] C:\WINDOWS\system32\atlyi32.exe
[addtm32.exe] C:\WINDOWS\system32\addtm32.exe
[crad.exe] C:\WINDOWS\crad.exe
[javapt.exe] C:\WINDOWS\system32\javapt.exe
[javauu32.exe] C:\WINDOWS\javauu32.exe
[d3yp.exe] C:\WINDOWS\system32\d3yp.exe
[crwo32.exe] C:\WINDOWS\crwo32.exe
[ieim32.exe] C:\WINDOWS\system32\ieim32.exe
[sysyu.exe] C:\WINDOWS\sysyu.exe
[mfcrr.exe] C:\WINDOWS\system32\mfcrr.exe
[atlfg.exe] C:\WINDOWS\system32\atlfg.exe
[winvr32.exe] C:\WINDOWS\winvr32.exe
[iebp.exe] C:\WINDOWS\system32\iebp.exe
[ipyn.exe] C:\WINDOWS\ipyn.exe
[mspm.exe] C:\WINDOWS\mspm.exe
[javaee.exe] C:\WINDOWS\system32\javaee.exe
[addfm32.exe] C:\WINDOWS\addfm32.exe
[addrs.exe] C:\WINDOWS\addrs.exe
[crfy.exe] C:\WINDOWS\system32\crfy.exe
[crrd.exe] C:\WINDOWS\crrd.exe
[apptr32.exe] C:\WINDOWS\system32\apptr32.exe
[d3wk.exe] C:\WINDOWS\d3wk.exe
[apilk32.exe] C:\WINDOWS\apilk32.exe
[iedm.exe] C:\WINDOWS\system32\iedm.exe
[javagm.exe] C:\WINDOWS\system32\javagm.exe
[ntjw32.exe] C:\WINDOWS\ntjw32.exe
[netdo32.exe] C:\WINDOWS\netdo32.exe
[sysuc32.exe] C:\WINDOWS\system32\sysuc32.exe
[sdknd32.exe] C:\WINDOWS\system32\sdknd32.exe
[addko.exe] C:\WINDOWS\addko.exe
[mfcdh32.exe] C:\WINDOWS\system32\mfcdh32.exe
[sdkij32.exe] C:\WINDOWS\system32\sdkij32.exe
[msen.exe] C:\WINDOWS\system32\msen.exe
[msug.exe] C:\WINDOWS\msug.exe
[crkf32.exe] C:\WINDOWS\crkf32.exe
[winqj.exe] C:\WINDOWS\system32\winqj.exe
[sysgh32.exe] C:\WINDOWS\sysgh32.exe
[d3ud32.exe] C:\WINDOWS\d3ud32.exe
[netnm.exe] C:\WINDOWS\system32\netnm.exe
[apihs32.exe] C:\WINDOWS\system32\apihs32.exe
[addfp.exe] C:\WINDOWS\addfp.exe
[sdkqf32.exe] C:\WINDOWS\sdkqf32.exe
[crpn32.exe] C:\WINDOWS\system32\crpn32.exe
[netae.exe] C:\WINDOWS\netae.exe
[iewb.exe] C:\WINDOWS\system32\iewb.exe
[addkz32.exe] C:\WINDOWS\system32\addkz32.exe
[ipdv.exe] C:\WINDOWS\ipdv.exe
[ntqs32.exe] C:\WINDOWS\system32\ntqs32.exe
[winoo.exe] C:\WINDOWS\system32\winoo.exe
[ipwi.exe] C:\WINDOWS\system32\ipwi.exe
[atlzb.exe] C:\WINDOWS\atlzb.exe
[sysss.exe] C:\WINDOWS\sysss.exe
[appfh32.exe] C:\WINDOWS\appfh32.exe
[sysyh.exe] C:\WINDOWS\sysyh.exe
[msge.exe] C:\WINDOWS\system32\msge.exe

atland.sys
ATLAND.SYS is Trojan/Backdoor.
Kill the file ATLAND.SYS and remove ATLAND.SYS from Windows startup using RegRun Reanimator.
http://www.regrun.com

atlbe32.exe
Atlbe32.exe is Trojan/Backdoor.
Kill the process atlbe32.exe and remove atlbe32.exe from Windows startup.

atlcs32.exe
Atlcs32.exe is Trojan/Backdoor.
Kill the process atlcs32.exe and remove atlcs32.exe from Windows startup.

atliehelper.exe
ATLIEHELPER.exe is a part of WareOut.
Read more:
http://research.sunbelt-software.com/thr...
Kill the process ATLIEHELPER.exe and remove ATLIEHELPER.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

atllsimm.exe
ATLLSIMM.EXE is SDBOT Trojan.
Kill the process ATLLSIMM.EXE and remove ATLLSIMM.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

atlox32.exe
Atlox32.exe is Trojan/Backdoor.
Kill the process atlox32.exe and remove atlox32.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

atlw.dll
Atlw.dll is a Spyware.Apropos.
Atlw.dll is a Browser Helper Object.
Atlw.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Windir%\Downloaded Program Files\load.exe
%Windir%\Downloaded Program Files\monpop.exe
%Windir%\Downloaded Program Files\pop225.dll
%Windir%\Downloaded Program Files\pophook4.dll
%Windir%\Downloaded Program Files\PopSrv225.exe
%Temp%\auto_update_loader.exe
%Temp%\install_ct.exe
%Temp%\CXtPls.exe
%Temp%\ProxyStub.dll
%Temp%\WinGenerics.dll
%Temp%\ace.dll
%Temp%\atla.dll
%Temp%\atlw.dll
%Temp%\data.bin
%Temp%\libexpat.dll
%Temp%\ph.exe
%Temp%\pm.exe
%Temp%\setup.inf
%Temp%\uninstaller.exe
%Temp%\atl.dll
%System%\atmon.exe
%System%\intfaxui.exe
Adds the value:
"POP" = "C:\WINDOWS\Downloaded Program Files\PopSrv225.exe"
"AutoLoaderEnvoloAutoUpdater" = "auto_update_loader.exe"
"[random name]" = "intfaxui.exe"
"[random name]" = "atmon.exe"
to the Windows startup registry keys.
More info:
http://securityresponse.symantec.com/avc...
Removal:
Remove atlw.dll from Windows startup using RegRun Startup Optimizer.

atmconf.exe
Atmconf.exe is Trojan/Backdoor.
Kill the process atmconf.exe and remove atmconf.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

atmdlusr.exe
We suggest you to remove atmdlusr.exe from your computer as soon as possible.
Atmdlusr.exe is Trojan/Backdoor.
Read more:
http://www.castlecops.com/s316-atmdlusr_...
Kill the process atmdlusr.exe and remove atmdlusr.exe from Windows startup.

atomic2.exe
Steals passwords
It steals dailup passwords and hides them in Rasxnfo.dll, which is encrypted. It sends the file through a SMTP server to the following mail addresses: addr2@server.com , addr3@server.com, majlisb@yahoo.com.

atomiclog.exe
Atomiclog.exe is AtomicLog software.
From the vendor web site (
http://www.atomiclog.com): 'AtomicLog is a tool for monitoring and controlling the connections from your desktop to the Internet.'
Read more: http://www3.ca.com/securityadvisor/pest/...
Kill the process atomiclog.exe and remove atomiclog.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

atommanager.exe
Atommanager.exe is Adware.
Kill the process atommanager.exe and remove atommanager.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

atoolbar.exe
AToolBar.exe is Adware.
Kill the process AToolBar.exe and remove AToolBar.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

atrconf.exe
Atrconf.exe is Worm Warezov.
Read more:
http://fileinfo.prevx.com/adware/qqd1904...
Kill the process atrconf.exe and remove atrconf.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

atrusx.exe
Atrusx.exe is Trojan/Backdoor.
Kill the process atrusx.exe and remove atrusx.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

atsiv.exe
Atsiv.exe is SecurityRisk.Atsiv.
SecurityRisk.Atsiv is a Security Risk that allows the loading of signed or unsigned drivers on 32-bit and 64-bit versions of Windows XP, Windows 2003 and Windows Vista.
Read more:
http://www.symantec.com/enterprise/secur...
Kill the process atsiv.exe and remove atsiv.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

attnengine.exe
Attnengine.exe is Trojan/Backdoor.
Kill the process attnengine.exe and remove attnengine.exe from Windows startup.

au_.exe
AU_.EXE is Trojan SpyFalcon.
Read more:
http://www.fbmsoftware.com/spyware-net/P...
Kill the process AU_.EXE and remove AU_.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

au1g.exe
Troj/Bancos-N is a Trojan for the Windows platform.
It may come in an self-extracting archive which will drop au1g.exe into the directory.

Then activated, the Trojan displays a Internet Explorer dialog box with title ' Internet Banking - Microsoft Internet Explorer'.
The content of the dialog box is in spanish which is similar to an online banking form related to the bank.
Any details entered into this form is emailed out.

Manual removal:
Locate the HKEY_LOCAL_MACHINE entry: HKLM\Software\Microsoft\WindowsCurrentVersion\Run\
and delete the value = \au1g.exe

audconf.exe
Audconf.exe is Trojan/Backdoor.
Read more:
http://fileinfo.prevx.com/adware/qq95404...
Kill the process audconf.exe and remove audconf.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

audi32.exe
We suggest you to remove audi32.exe from your computer as soon as possible.
Audi32.exe is Troj/Ranck-FL.
Read more:
http://www.sophos.com/security/analyses/...
Kill the process audi32.exe and remove audi32.exe from Windows startup.

audiocfg.exe
We suggest you to remove audiocfg.exe from your computer as soon as possible.
Audiocfg.exe is Trojan/Backdoor.
Kill the process audiocfg.exe and remove audiocfg.exe from Windows startup.

audiodrv.exe
We suggest you to remove audiodrv.exe from your computer as soon as possible.
Audiodrv.exe is Troj/Crypter-C.
Related files:
audiodrv.exe
audioinf.exe
bluecol.exe
cmdcon.exe
diskinf.exe
dllreg.exe
enhance32.exe
infdisk.exe
kbddrv32.exe
kbdrvinf.exe
main16.exe
main32.exe
mousedrv.exe
mswavedll.exe
msurl32.exe
netdll32.exe
netdllex.exe
p4mx4.exe
m32info.exe
pwr32ctr.exe
pwr32crtl.exe
sd32info.exe
vid32cntl.exe
vidcntl.exe
Read more:
http://www.sophos.com/virusinfo/analyses...
Kill the process audiodrv.exe and remove audiodrv.exe from Windows startup.

audiohq.exe
Audiohq.exe is Troj/Banker-EHK.
Read more:
http://www.sophos.com/security/analyses/...
Kill the process audiohq.exe and remove audiohq.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

audioinf.exe
We suggest you to remove audioinf.exe from your computer as soon as possible.
Audioinf.exe is Troj/Crypter-C.
Related files:
audiodrv.exe
audioinf.exe
bluecol.exe
cmdcon.exe
diskinf.exe
dllreg.exe
enhance32.exe
infdisk.exe
kbddrv32.exe
kbdrvinf.exe
main16.exe
main32.exe
mousedrv.exe
mswavedll.exe
msurl32.exe
netdll32.exe
netdllex.exe
p4mx4.exe
m32info.exe
pwr32ctr.exe
pwr32crtl.exe
sd32info.exe
vid32cntl.exe
vidcntl.exe
Read more:
http://www.sophos.com/virusinfo/analyses...
Kill the process audioinf.exe and remove audioinf.exe from Windows startup.

audiosrv.exe
Audiosrv.exe is Adware.IEDriver.
Related files:
%System%\Sb.htm
%System%\Sx.htm
%System%\iedriver\iedriver.bin
%System%\iedrive\iedriver.exe
%System%\iedrive\ieupdate.exe
%System%\iedrive\Td.exe
%System%\iedrive\Sx.htm
%System%\iedrive\Vi.tty
%System%\iedrive\Vii.tty
%System%\iedrive\3.exe
%System%\iedrive\5.exe
Read more:
http://sarc.com/avcenter/venc/data/pf/ad...
Kill the process audiosrv.exe and remove audiosrv.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

auekxrz.exe
We suggest you to remove auekxrz.exe from your computer as soon as possible.
Auekxrz.exe is Trojan/Backdoor.
Kill the process auekxrz.exe and remove auekxrz.exe from Windows startup.

auf0.exe
Auf0.exe is a Trojan Trojan.LowZones.
Auf0.exe lowers Internet Explorer security settings.
Related files:
%Temp%\auto_update_install.exe
%Temp%\setup.inf
%Temp%\auf0.exe
%Temp%\cxtpls_loader.exe
%Temp%\iinstall.exe
%Temp%\sidefind.exe
%Temp%\WToolsA.exe
%Temp%\WToolsB.dll
%Temp%\AutoUpdaterInstaller[1].exe
%Temp%\nem220[1].dll
%Temp%\salm.exe
%Temp%\istbar.dll
%System%\auto_update_uninstall.exe
%Windir%\lohmvql.exe
%Windir%\nem220.dll
%Windir%\qoqek.exe
%Windir%\zeta.exe
More info:
http://securityresponse.symantec.com/avc...
Removal:
Kill auf0.exe process and remove auf0.exe from Windows startup using RegRun Startup Optimizer.

aufa.dll
AUFA.DLL is Trojan/Backdoor.
Read more:
http://fileinfo.prevx.com/adware/qq62d76...
Kill the file AUFA.DLL and remove AUFA.DLL from Windows startup using RegRun Reanimator.
http://www.regrun.com

auqxbs.exe
AUQXBS.EXE is Trojan/Backdoor.
Read more:
http://fileinfo.prevx.com/adware/qq67666...
Kill the process AUQXBS.EXE and remove AUQXBS.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

aurareco.exe
Aurareco.exe is Trojan/Backdoor.
Kill the process aurareco.exe and remove aurareco.exe from Windows startup.

aureco.exe
Aureco.exe is Adware.
Kill the process aureco.exe and remove aureco.exe from Windows startup.

auribbqs.exe
Auribbqs.exe is Trojan/Backdoor.
Kill the process Auribbqs.exe and remove it from Windows startup.

aurora.exe
Aurora.exe is Spyware/Trojan/Backdoor.
Aurora.exe spreads via loadcash.biz or of crackz.ws.
Related files:
Bolger.dll, Aurora.exe, svcproc.exe, Poller.exe, uacupg.exe, Nail.exe, DrPMon.dll, thnall1ac.html.
Nail.exe generates "exe" files in the System32 folder with random names.
Go to the Windows Safe mode.
Kill the process Aurora.exe and remove Aurora.exe from Windows startup.
Kill other Aurora's components.

aurorahandler.dll
AuroraHandler.dll is a part of Trojan/Backdoor.
Remove AuroraHandler.dll from BHO list and delete AuroraHandler.dll file.

austr.dll
Austr.dll is Trojan/Backdoor.
Kill the file austr.dll and remove austr.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

austria.exe
We suggest you to remove austria.exe from your computer as soon as possible.
Austria.exe is AsdPlug premium rate adult content dialer variant.
Dialer.Asdplug is a dialer program that can be used to access pornographic material by dialling a high-cost number using the modem.
Read more:
http://www.symantec.com/security_respons...
Kill the process austria.exe and remove austria.exe from Windows startup.

auto.exe
Auto.exe is W32/Winko-A.
Related files:
%Root%\auto.exe
%System%\%random string%.exe
%Root%\autorun.inf - Detected as W32/SillyFD-G
%System%\%random string%.dll - Detected as Mal/Behav-027.
%System%\delme.bat - Not inherently malicious, may be safely deleted.
Read more:
http://www.sophos.com/security/analyses/...
Kill the process auto.exe and remove auto.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

auto_update_install.exe
Auto_update_install.exe is a Trojan Trojan.LowZones.
Auto_update_install.exe lowers Internet Explorer security settings.
Related files:
%Temp%\auto_update_install.exe
%Temp%\setup.inf
%Temp%\auf0.exe
%Temp%\cxtpls_loader.exe
%Temp%\iinstall.exe
%Temp%\sidefind.exe
%Temp%\WToolsA.exe
%Temp%\WToolsB.dll
%Temp%\AutoUpdaterInstaller[1].exe
%Temp%\nem220[1].dll
%Temp%\salm.exe
%Temp%\istbar.dll
%System%\auto_update_uninstall.exe
%Windir%\lohmvql.exe
%Windir%\nem220.dll
%Windir%\qoqek.exe
%Windir%\zeta.exe
More info:
http://securityresponse.symantec.com/avc...
Removal:
Kill auto_update_uninstall.exe process and remove auto_update_uninstall.exe from Windows startup using RegRun Startup Optimizer.

auto_update_loader.exe
Auto_update_loader.exe is a Spyware.Apropos.
Auto_update_loader.exe is a Browser Helper Object.
Auto_update_loader.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Windir%\Downloaded Program Files\load.exe
%Windir%\Downloaded Program Files\monpop.exe
%Windir%\Downloaded Program Files\pop225.dll
%Windir%\Downloaded Program Files\pophook4.dll
%Windir%\Downloaded Program Files\PopSrv225.exe
%Temp%\auto_update_loader.exe
%Temp%\install_ct.exe
%Temp%\CXtPls.exe
%Temp%\ProxyStub.dll
%Temp%\WinGenerics.dll
%Temp%\ace.dll
%Temp%\atla.dll
%Temp%\atlw.dll
%Temp%\data.bin
%Temp%\libexpat.dll
%Temp%\ph.exe
%Temp%\pm.exe
%Temp%\setup.inf
%Temp%\uninstaller.exe
%Temp%\atl.dll
%System%\atmon.exe
%System%\intfaxui.exe
Adds the value:
"POP" = "C:\WINDOWS\Downloaded Program Files\PopSrv225.exe"
"AutoLoaderEnvoloAutoUpdater" = "auto_update_loader.exe"
"[random name]" = "intfaxui.exe"
"[random name]" = "atmon.exe"
to the Windows startup registry keys.
More info:
http://securityresponse.symantec.com/avc...
Removal:
Kill auto_update_loader.exe process and remove auto_update_loader.exe from Windows startup using RegRun Startup Optimizer.

autodisc.exe
We suggest you to remove autodisc.exe from your computer as soon as possible.
Autodisc.exe is W32/Spybot-CB.
Read more:
http://www.sophos.com/security/analyses/...
Kill the process autodisc.exe and remove autodisc.exe from Windows startup.

autodisc32.dll
Autodisc32.dll is "TX 4" BrowserAd adware.
Kill the file autodisc32.dll and remove autodisc32.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

autoheal.exe
Autoheal.exe is an adware program Adware.BargainBuddy.
Autoheal.exe downloads and displays advertisements.
Related files:
Apuc.dll
Autoheal.exe
%System%\angelex.exe
%System%\instsrv.exe
%System%\msexreg.exe
%System%\bbchk.exe
%System%\exclean.exe
%System%\exdl.exe
%System%\exdl0.exe
%System%\exdl1.exe
%System%\exul.exe
%System%\msbe.dll
%System%\msxct.exe
%ProgramFiles%\BullsEye Network\bin\adv.exe
%ProgramFiles%\BullsEye Network\bin\adx.exe
%ProgramFiles%\BullsEye Network\bin\bargains.exe
%ProgramFiles%\BullsEye Network\Uninstall.exe
%Windows%\bbchk.exe
%Windows%\exclean.exe
%Windows%\exdl.exe
%Windows%\exul.exe
%Windows%\msbe.dll
%Windows%\msxct.exe
%Windows%\zeta.exe
Adds the value:
"[File name of adware]" = "[File path to adware]"
to the Windows startup registry keys.
More info:
http://securityresponse.symantec.com/avc...
Removal:
Kill Autoheal.exe process and remove Autoheal.exe from Windows startup using RegRun Startup Optimizer.

autohk.exe
Autohk.exe is Trojan/Backdoor.
Kill the process autohk.exe and remove autohk.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

automgr32.exe
We suggest you to remove automgr32.exe from your computer as soon as possible.
Automgr32.exe is Trojan/Backdoor.
Kill the process automgr32.exe and remove automgr32.exe from Windows startup.

automove.exe
We suggest you to remove automove.exe from your computer as soon as possible.
Automove.exe is 2nd Thought advertising program by CPM Media.
Kill the process automove.exe and remove automove.exe from Windows startup.

automsupd.exe
We suggest you to remove automsupd.exe from your computer as soon as possible.
Automsupd.exe is Trojan/Backdoor.
Kill the process automsupd.exe and remove automsupd.exe from Windows startup.

autopdate.exe
We suggest you to remove autopdate.exe from your computer as soon as possible.
Autopdate.exe is W32/Rbot-AGL.
Read more:
http://www.sophos.com/virusinfo/analyses...
Kill the process autopdate.exe and remove autopdate.exe from Windows startup.

autopoll.exe
Remote Access

autoprotect.exe
We suggest you to remove autoprotect.exe from your computer as soon as possible.
Autoprotect.exe is Trojan/Backdoor.
Kill the process autoprotect.exe and remove autoprotect.exe from Windows startup.

autosys.exe
Autosys.exe is Trojan/Backdoor.
Kill the process autosys.exe and remove autosys.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

autoupdaterinstaller[1].exe
AutoUpdaterInstaller[1].exe is a Trojan Trojan.LowZones.
AutoUpdaterInstaller[1].exe lowers Internet Explorer security settings.
Related files:
%Temp%\auto_update_install.exe
%Temp%\setup.inf
%Temp%\auf0.exe
%Temp%\cxtpls_loader.exe
%Temp%\iinstall.exe
%Temp%\sidefind.exe
%Temp%\WToolsA.exe
%Temp%\WToolsB.dll
%Temp%\AutoUpdaterInstaller[1].exe
%Temp%\nem220[1].dll
%Temp%\salm.exe
%Temp%\istbar.dll
%System%\auto_update_uninstall.exe
%Windir%\lohmvql.exe
%Windir%\nem220.dll
%Windir%\qoqek.exe
%Windir%\zeta.exe
More info:
http://securityresponse.symantec.com/avc...
Removal:
Kill AutoUpdaterInstaller[1].exe process and remove AutoUpdaterInstaller[1].exe from Windows startup using RegRun Startup Optimizer.

autoupdatewin31.dll
AutoUpdateWin31.dll is Trojan/Backdoor.
Kill the file AutoUpdateWin31.dll and remove AutoUpdateWin31.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

autoupdatewin33.exe
AutoUpdateWin33.exe is Trojan/Backdoor.
Kill the process AutoUpdateWin33.exe and remove AutoUpdateWin33.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

aux32.exe
W32.Aizu is a worm that attempts to exploit the Microsoft Windows Local Security Authority Service Remote Buffer Overflow (described in Microsoft Security Bulletin MS04-011) using TCP port 445.
This worm propagates by scanning randomly selected IP addresses for vulnerable systems.
Copies itself as %System%\aux32.exe and adds the value: "auxAudioDevice"="c:\winnt\system32\aux32.exe"
to the registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Pings a randomly generated IP address to determine whether a remote computer is online.
If the remote computer appears to be online, the worm connects to it on TCP port 445 and sends shell code to it.
Downloads zu.exe, which is a corrupted Trojan, from 67.19.12.122.
Also, attempts to connect to 67.19.12.122/zuu.php.

Remove this spyware with RegRun Startuip Optimizer.

av.exe
Added as a result of the Trojan.Sinkin.

Trojan.Sinkin is a Trojan Horse that changes the Internet Explorer start and search pages, and sends AOL Instant Messenger information to a remote host.
This Trojan may also display advertisements when you are browsing the Web.

Trojan.Sinkin performs the following actions:
Create the C:\Av.exe file.

Adds the value:
"Antivirus"="av.exe"
to the registry key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Changes the Internet Explorer search and start pages to realphx.com.

Reads AOL Instant Messenger user data, including the login name and password, from
HKEY_LOCAL_MACHINE\Software\America Online\AOL Instant Messenger TM)\CurrentVersion\
and forwards it to realphx.com.

Executes JavaScripts located on the realphx.com servers to display advertisements while browsing in Internet Explorer.

Automatic removal: Use RegRun Startup Optimizer to remove it from startup.

avagnt.exe
Avagnt.exe is Trojan/Backdoor.
Kill the process avagnt.exe and remove avagnt.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

avamx.exe
We suggest you to remove avamx.exe from your computer as soon as possible.
Avamx.exe is W32/Rbot-ABJ.
Read more:
http://www.sophos.com/virusinfo/analyses...
Kill the process avamx.exe and remove avamx.exe from Windows startup.

avantage32.exe
Avantage32.exe is Trojan/Backdoor.
Directory: %WinDir%
Kill the process avantage32.exe and remove avantage32.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

avg75f_431a836[1].exe
AVG75F_431A836[1].EXE is Trojan/Backdoor.
Read more:
http://fileinfo.prevx.com/fileinfo.asp?P...
Kill the process AVG75F_431A836[1].EXE and remove AVG75F_431A836[1].EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

avg7srw.sys
Avg7srw.sys is Trojan/Backdoor.
Remove avg7srw.sys from Windows using Regrun.
www.regrun.com

avicap32.exe
Avicap32.exe is IEDriver adware.
Read more:
http://www.spywaredata.com/spyware/threa...
Kill the process avicap32.exe and remove avicap32.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com
avicap32.exe may be legitimate. Read more: http://www.spywaredata.com/spyware/threa...

avifile5.exe
We suggest you to remove avifile5.exe from your computer as soon as possible.
Avifile5.exe is Trojan/Backdoor.
Kill the process avifile5.exe and remove avifile5.exe from Windows startup.

avilifat.exe
AVILIFAT.EXE is Trojan/Backdoor.
Read more:
http://fileinfo.prevx.com/adware/qqe6b88...
Kill the process AVILIFAT.EXE and remove AVILIFAT.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

avkernel.dll
Avkernel.dll is Rogue.WinAntiVirus.
Directory: %programfiles%\winantivirus pro 2006\
Read more:
http://virusinfo.prevx.com/pxparall.asp?...
Kill the file avkernel.dll and remove avkernel.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

avkir.exe
We suggest you to remove avkir.exe from your computer as soon as possible.
Avkir.exe is W32/Rbot-GJP.
Read more:
http://www.sophos.com/security/analyses/...
Kill the process avkir.exe and remove avkir.exe from Windows startup.

avmon.exe
AVmon.exe is a mass-mailing worm W32.Kedebe@mm.
AVmon.exe tries to terminate antiviral programs installed on a user computer.
AVmon.exe spreads by e-mail and via open network shares.
Related files:
%System%\winssc32.exe
%System%\mscppdmg.exe
%System%\kernel32hlp.exe
%System%\NAVctrl.exe
%System%\dwrdgr32.exe
%System%\gcasctrl.exe
%System%\AVmon.exe
%System%\winxplt.exe
%System%\gcasAV32.exe
%System%\LUCOMS~2.EXE
%System%\zlbclient.exe
%system%\win32infchkr.exe
Adds the value:
"Windows Console Monitor" = "%System%\[path to the worm]"
"load" = "%Userprofile%\LOCALS~1\Applic~1\MICROS~1\Windows\[path to the worm]"
to the Windows startup registry keys.
More info:
http://securityresponse.symantec.com/avc...
Removal:
Kill AVmon.exe process and remove AVmon.exe from Windows startup using RegRun Startup Optimizer.

avp_updates.exe
Remote Access / Worm / Virus / Trojan dropper / Mail trojan / Downloading trojan
It tries to destroy up to eight different antivirus programs and makes it impossible to mail the AV company or visit its Web-site. Wsock32.dll is patched by the trojan. Whenever the user sends a mail, the trojan will mail another one to the same recipient with an attachment only. May be updated from the Internet.

avp-32.exe
We suggest you to remove avp-32.exe from your computer as soon as possible.
Avp-32.exe is WORM_AGOBOT.FS.
Read more:
http://www.trendmicro.com/vinfo/virusenc...
Kill the process avp-32.exe and remove avp-32.exe from Windows startup.

avpb.exe
Avpb.exe is Trojan.Baiso.
Trojan.Baiso is a Trojan horse that downloads files from the Internet, which contain URLs that are used to display Web pages and download other threats.
Related files:
%Windir%\realupdate.exe - a file used to update itself
%Windir%\winampb.exe
%System%\A4\baisob\avpb.exe
%System%\A4\baisob\dllhostb.dll
%System%\A4\baisob\novel.exe
%System%\A4\baisob\up.dat
%System%\A4\baisob\verx.dat
Read more:
http://www.symantec.com/security_respons...
Kill the process avpb.exe and remove avpb.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

avpe64.sys
AVPE64.SYS is Trojan/Backdoor.
Kill the process AVPE64.SYS and remove AVPE64.SYS from Windows startup.

avpg.exe
We suggest you to remove avpg.exe from your computer as soon as possible.
Avpg.exe is W32/Forbot-BX.
Read more:
http://www.sophos.com/virusinfo/analyses...
Kill the process avpg.exe and remove avpg.exe from Windows startup.

avpguard.exe
We suggest you to remove avpguard.exe from your computer as soon as possible.
Avpguard.exe is W32.Netsky.J@mm.
W32.Netsky.J@mm is a mass-mailing worm that uses its own SMTP engine to send itself to the email addresses it finds when scanning hard drives and mapped drives.
Read more:
http://www.symantec.com/security_respons...
Kill the process avpguard.exe and remove avpguard.exe from Windows startup.

avpmondll.exe
We suggest you to remove avpmondll.exe from your computer as soon as possible.
Avpmondll.exe is Trojan/Backdoor.
Kill the process avpmondll.exe and remove avpmondll.exe from Windows startup.

avpmonitor.exe
Name: Shorm
Worm / Steals passwords / Network trojan
Propagates to all shared discs. Autostarts using Windows Startup directory. Passwords and users names are mailed to two addresses in Russia. The .exe file is compressed using ASPack. It connects to a Web page in Russia, both to receive IP addresses to scan and to update itself.

avpo.exe
We suggest you to remove avpo.exe from your computer as soon as possible.
Avpo.exe is W32/SillyFDC-BB.
Related files:
%Temp%\9.sys
%Temp%\lu5.dll
%System%\avpo0.dll
Read more:
http://www.sophos.com/security/analyses/...
Kill the process avpo.exe and remove avpo.exe from Windows startup.

avpo0.dll
We suggest you to remove avpo0.dll from your computer as soon as possible.
Avpo0.dll is W32/SillyFDC-BB.
Related files:
%Temp%\9.sys
%Temp%\lu5.dll
%System%\avpo0.dll
Read more:
http://www.sophos.com/security/analyses/...
Kill the file avpo0.dll and remove avpo0.dll from Windows startup.

avpr.exe
I-Worm.Mydoom.aa is a modification of Mydoom.a.
It spreads via the Internet as an attachment to infected emails and via the Kazaa file-sharing network.
Only activated if the user opens the archive and launches the infected file.
The worm changes the standard 'hosts' file and users of infected machines will be unable to access some domains.
The worm also attempts to download a file named 'scran.jpg' from a specific site and to save it in the C: root directory under the name 'Scran.exe'.
This file is Worm.P2P.Scranor.a, another network worm.
The worm's mass mailing function is almost identical to that of Mydoom.a.
'tcp5424.dll', which is installed by the worm, is a backdoor which opens TCP port 5424 to receive commands.
The worm searches the system registry for the 'ICQ Net' and 'MsnMsgr' values and deletes them.

Use RegRun Startup Optimizer to remove it from startup.

avprotect.exe
W32.Netsky.L@mm is a mass-mailing worm that uses its own SMTP engine to send itself to the email addresses it finds when scanning hard drives and mapped drives.

Copies itself as %Windir%\AVprotect.exe.

Adds the value:
"HtProtect"="%Windir%\AVprotect.exe"
to the registry key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
so that the worm runs when you start Windows.

Retrieves email addresses from the files that have these extensions:
.adb .asp .cgi .dbx .dhtm .doc .eml .htm .html .jsp .msg .oft .php .pl .rtf
.sht .shtm .tbb .txt .uin .vbs .wab .wsh .xml

The email has the following characteristics:
From:

Subject: The subject is one of the following:
Re: Important
Re: Your document
Re: Your details
Re: Approved

Message: The message is one of the following:

Your file is attached.
Please read the document.
Your document is attached.
Please read the attached file.
Please see the attached file for details.

Attachment: The attachment is one of the following:
your_file_%s.pif, details_%s.pif, document_%s.pif, %s.pif
where %s is the portion of the "To" address before the "@".

Manual removal:
Navigate to the key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
and delete the value:
"HtProtect"="%Windir%\AVprotect.exe"

Automatic Removal:
Use RegRun Startup Optimizer to remove it from startup.

avprotect9x.exe
I-Worm.Netsky.m worm spreads via the Internet as an attachment to infected messages.
Еhe worm scans all disks for files with the predefined extensions and sends copies of itself to email addresses harvested from these files.
Сopies itself to the Windows directory as Avprotect9x.exe.
The worm opens a group of several ports. The port numbers are increased incrementally across the whole group every few seconds.

Manual removal:
Find and delete the key in the system registry:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run:] 9xHtProtect = \AVprotect9x.exe

avpsrv.exe
AVPSrv.exe is Troj/OnLine-Gen.
Related directory:
%WinDir%
Related files:
AVPSrv.exe
TIMHost.exe
WinForm.exe
AVPSrv.DLL
TIMHost.DLL
WinForm.DLL
Read more:
http://www.sophos.com/security/analyses/...
Kill the process AVPSrv.exe and remove AVPSrv.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

avserve.exe
Worm.Win32.Sasser.a
Sasser is an Internet worm that exploits the MS Windows LSASS vulnerability described in Microsoft Security Bulletin MS04-011.
Microsoft released a patch for this vulnerability on April 13, 2004, while Sasser.a was first detected on April 30, 2004.
Sasser operates in a very similar manner to Lovesan, except that Lovesan exploited a vulnerability in the PRC DCOM service, not the LSASS service.
Sasser affects computers running Windows 2000, Windows XP, Windows Server 2003.
Sasser functions on all other versions of Windows but is unable to infect them by attacking via the vulnerability.
An error message about the LSASS service failing which usually also causes the system to reboot.
Sasser creates the file 'win.log' in the C drive root directory where the worm records the IP-addresses of all attacked machines.

Copies itself into the Windows root directory under the name avserve.exe
and registers this file in the system registry autorun key: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avserve.exe" = "%WINDIR%\avserve.exe"

Use RegRun Startuip Optimizer to remove this worm.

avserve2.exe
Worm.Win32.Sasser.b
This worm spreads via the Internet using a vulnerability in the Microsoft Windows LSASS service.
The vulnerability is described in Microsoft Security Bulletin MS04-011, which can be found at:
http://www.microsoft.com/technet/securit...

When launching, the worm registers itself in the system registry autorun key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
avserve2.exe = %WINDIR%\avserve2.exe

The worm scans IP addresses, searching for computers which have the vulnerability described in MS04-011.
A vulnerable computer will launch the command packet "cmd.exe" on TCP port 9996, and will then accept commands to download and launch copies of the worm.

Downloading is carried out via FTP protocol.
In order to do this the worm launches an FTP server on TCP port 5554 and on request from the victim computer loads a copy of itself.
The copy of the worm will be loaded under the name "_up.exe", where "_" is a random number.

To remove this worm you can download free utility from www.kaspersky.com

avsynmgr32e.exe
We suggest you to remove avsynmgr32e.exe from your computer as soon as possible.
Avsynmgr32e.exe is Trojan.Framar.
Trojan.Framar is a Trojan Horse that terminates various process and opens TCP port 23435.
Read more:
http://www.symantec.com/security_respons...
Kill the process avsynmgr32e.exe and remove avsynmgr32e.exe from Windows startup.

avupdate.exe
Worm / Destructive trojan
Overwrites all files on the computer, except the running programs. Tricks the user to write a mail address and then propagates using any mail client using MAPI.

avwav32.dll
Avwav32.dll is W32.Tupofse.
W32.Tupofse is a file-infecting virus that infects Microsoft Word and Microsoft Excel files.
Related files:
%System%\kspool.exe
%System%\avwav32.dll
%Temp%\UNINSTX[SINGLE CHARACTER].tmp
Read more:
http://www.symantec.com/enterprise/secur...
Kill the file avwav32.dll and remove avwav32.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

awab.exe
We suggest you to remove awab.exe from your computer as soon as possible.
Awab.exe is Trojan/Backdoor.
Kill the process awab.exe and remove awab.exe from Windows startup.

awcrs.exe
Awcrs.exe is Trojan/Backdoor.
Kill the process awcrs.exe and remove awcrs.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

awesome32.exe
We suggest you to remove awesome32.exe from your computer as soon as possible.
Awesome32.exe is Trojan/Backdoor.
Kill the process awesome32.exe and remove awesome32.exe from Windows startup.

awindll.exe
Steals passwords

awinrar.exe
We suggest you to remove awinrar.exe from your computer as soon as possible.
Awinrar.exe is Trojan/Backdoor.
Kill the process awinrar.exe and remove awinrar.exe from Windows startup.

awola.exe
We suggest you to remove Awola.exe from your computer as soon as possible.
Awola.exe is a part of Awola software.
Awola is a misleading application that may give exaggerated reports about potential risks on the computer.
Related files:
C:\Documents and Settings\Administrator\Application Data\Awola\Awola.exe
C:\Documents and Settings\Administrator\Application Data\Awola\Awola001.bas
C:\Documents and Settings\Administrator\Application Data\Awola\settings.ini
C:\Documents and Settings\Administrator\Application Data\[RANDOM NAME].dat
C:\Documents and Settings\Administrator\Start Menu\Programs\Awola\Awola Anti-Spyware 6.0.lnk
Read more:
http://www.symantec.com/business/securit...
Kill the process Awola.exe and remove Awola.exe from Windows startup.

awrexec.exe
Awrexec.exe is Trojan/Backdoor.
Kill the process awrexec.exe and remove awrexec.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

awstp.dll
Awstp.dll is Trojan Vundo.
Read more:
http://vil.nai.com/vil/content/v_127690....
Kill the file awstp.dll and remove awstp.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

awtqnkh.dll
Awtqnkh.dll is Virtumonde adware.
Read more:
http://research.sunbelt-software.com/thr...
Kill the file awtqnkh.dll and remove awtqnkh.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

awtqo.dll
AWTQO.DLL is Adware.Vundo.
Read more:
http://www.fileresearchcenter.com/A/AWTQ...
Kill the file AWTQO.DLL and remove AWTQO.DLL from Windows startup using RegRun Reanimator.
http://www.regrun.com

awtrqpq.dll
Awtrqpq.dll is Adware.Virtumonde.
Kill the file awtrqpq.dll and remove awtrqpq.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

awtsp.dll
Awtsp.dll is Trojan/Backdoor.
Kill the file awtsp.dll and remove awtsp.dll from Windows startup.

awtsq.dll
Awtsq.dll is Winfixer Spyware.
Read more:
http://www3.ca.com/securityadvisor/pest/...
Kill the file awtsq.dll and remove awtsq.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

awtss.dll
AWTSS.dll is Trojan/Backdoor.
Kill the file AWTSS.dll and remove AWTSS.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

awwservice.exe
Awwservice.exe is Trojan/Backdoor.
Kill the process awwservice.exe and remove awwservice.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

axdebugl.dll
AXDEBUGL.DLL is Trojan TR/PSW.PdP.CT.1.E.3.
Read more:
http://www.avira.com/en/threats/section/...
Kill the file AXDEBUGL.DLL and remove AXDEBUGL.DLL from Windows startup using RegRun Reanimator.
http://www.regrun.com

axdist.exe
Remote Access / Destructive trojan / Virus dropper
It copies itself to c:\recycled to avoid detection by some antivirus programs.

axfd.exe
Axfd.exe is Trojan/Backdoor.
Kill the process axfd.exe and remove axfd.exe from Windows startup.

axlet.dll
Axlet.dll is Trojan/Backdoor.
Kill the file axlet.dll and remove axlet.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

azbin.exe
AZBIN.EXE is Trojan/Backdoor.
Read more:
http://fileinfo.prevx.com/adware/qqdbee7...
Kill the process AZBIN.EXE and remove AZBIN.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

azip32.dll
Azip32.dll is Trojan/Backdoor.
Kill the file azip32.dll and remove azip32.dll from Windows startup.


Quick Links
What's new?
RSS Feed
Add to AppDatabase
Ask Experts
Join forum
Links

Articles
Virus or not? SPTD####.sys
What is mc21.tmp, mc22.tmp, mc23.tmp?

Select
Necessary
Useless
At your option
Dangerous

Copyright © 1998-2010 Greatis Software