Necessary At your option Useless Dangerous Application database
Startupapps.com recommends you:

Detect and remove hidden rootkits using UnHackMe UnHackMe - Rootkit Killer Free fully functional 30-days trial.


RegRun Security Suite = 24 system utilities for protecting your computer. Try now!

Buy Now!

I would like to say that RegRun has helped me on more than 1 occasion when it comes to spyware/adware by letting me know automatically that a piece of it got added to Windows startup. There is so much spyware/addware out there today it's hard to imagine being without RegRun. I like many other features too including the daily registry backups and file protection.

Chris Wagers

w?auboot.exe
w031319.stub.exe
w046393b.dll
w1nt45k.exe
w32_ss.exe
w32dbg.exe
w32dnsl.exe
w32dtc.exe
w32ntupdt.exe
w32svc.exe
w32tcomr.dll
w32tcomr.exe
w6378v10.exe
wa7pcw.exe
waauclt.exe
wabegec.exe
wac2.exe
waclt~1.exe
wad.exe
walcult.exe
wandrv.exe
wanman.exe
wapisvit.exe
wapp.exe
warebundle.exe
wareout.exe
warn tool.exe
warn0900.exe
was5scan.exe
was6.exe
was7.exe
wasffnt.exe
wats.exe
wauclt.exe
waucult.exe
wault.exe
waultc.exe
wave.exe
waverevenue.exe
wavesnet.exe
wawadisk.exe
waynet.dll
waytray.exe
wbecheck.exe
wbemstest.exe
wbhshare.dll
wbwedt.exe
wbwedt1.exe
wc.exe
wc98pp.dll
wcdrtc32.dll
wce8fdc4.dll,i2 0006c9ec0ce8fdc4
wcheckup.exe
wconf32.exe
wcsntfy.exe
wcupdater.exe
wdfmgr32.exe
wdfmrg.exe
wdigest.exe
wdirpgis.dll
wdismon.exe
wdmupd.exe
wdokbye.dll
wdrun32.exe
wdsapi32.dll
we love lien van de kelder.exe
web event logger
web ex 1.4.exe
web ex[1.2].exe
web ex[1.3].exe
web_torpedo.exe
web2.exe
web32view.dll
webassist.dll
webbuying.exe
webcheck.exe
webdir.dll
webdl.exe
webdlg32.dll
webhdll.dll
webhelp.drv
webhelper.dll
webrebates.exe
webrebates0.exe
websearch.exe
webshow.dll
webshow.drv
webspyshield.dll
webspyshield.exe
wer8274.dll
werecv.exe
werweb.dll
werweb.exe
wfdmgr.exe
wfx5.exe
wfxqhv.exe
wgareg.exe
wgavn.exe
wgs3.exe
wgt.exe
wgtstarter.exe
whack.exe
whackamole.exe
whagent.exe
whagent_update.exe
whakamole170.exe
whakmole.exe
whatsnewbot.exe
whenu.exe
whiehlpr.dll
whieshm.dll
whinstaller.exe
whismng.exe
whsurvey.exe
whyw.exe
wiacs.exe
wiacss.exe
wiamp.exe
wibsvc.exe
wichtig.exe
wide02.exe
wierrcsy.dll
wiit.exe
wildapp.dll
wilokyl.exe
wimsqaad.exe
win.exe
win_.exe
win1.exe
win16.exe
win19.tmp.exe
win2005.exe
win32.exe
win3208240613220.exe
win320859188624462006.exe
win321.exe
win32app.exe
win32boot.exe
win32bootcfg.exe
win32cfg.exe
win32config.exe
win32exe.exe
win32exec.exe
win32h.exe
win32hlp.exe
win32host.exe
win32ip.exe
win32logon.exe
win32ole.exe
win32res.exe
win32sbk.exe
win32service.dll
win32snd.exe
win32so.exe
win32sprot.exe
win32sys.exe
win32udt.exe
win32update.exe
win32usb.exe
win32x.exe
win32xp.dll
win32xpsys.exe
win3c2.tmp.exe
win3cb.tmp.exe
win47.tmp.exe
win5.exe
win57046.dll
win710.exe
win86.exe
win86.tmp.exe
win98.exe
win98nuke.exe
win9x.exe
wina2b3.pif
winabc3.exe
winable.exe
winadctlx.dll
winadll.exe
winadservx.dll
winadtools.exe
winadx.dll
winafd32.dll
winaff32.dll
winamp32.exe
winampb.exe
winampp.exe
winamps.exe
winang.dll
winapi23.exe
winapi32.exe
winapi64.exe
winaqr32.dll
winaspsnet.exe
winavx.exe
winavxx.exe
winbjt32.dll
winbjv32.dll
winbl8.exe
winbo32.exe
winboot.exe
winbug32.dll
win-bugsfix.exe
winbxwrn.exe
wincab.sys
wincalc.exe
winccf32.dll
wincfg.exe
wincfg32.exe
wincfgkop9.exe
wincheck.exe
winclean.exe
wincmp32.exe
wincntrl.exe
wincom32.sys
wincore.exe
wincore32.exe
wincrash.exe
wincrash-e.exe
wincreat.dll
wincrt.exe
wincsg32.dll
winctl.dll
winctl32.exe
winctladx.dll
winctrl16.exe
winctrl32.exe
winctrl64.exe
wind0ws.exe
wind32.exe
windat.exe
windb32.exe
windbg48.sys
windbv3.exe
windcmdt.exe
windexserv.dll
windfire.exe
windg32.exe
windir.exe
windir32.exe
windll.dll
windll.exe
windll32.exe
windll332.exe
windllc.exe
windmxm32.exe
windns.exe
windns32.exe
window.exe
windown.exe
windows 32-bit pnp driver
windows explorer.exe
windows.exe
windows-.exe
windows_critical_update.exe
windows_e52.exe
windows16.exe
windows32.exe
windowscfg.exe
windowsdll.exe
windowseditor.exe
windowshosts.exe
windowslockdown.exe
windowsmedi.exe
windowsnfo.exe
windowsupd1.exe
windowsupd2.exe
windowsupdate.exe
windowsupdaterr.exe
windowsupdates.exe
windowsxxx.exe
windowxs.exe
windowz.exe
windr32.exe
windriv32.exe
windrive32.exe
windriver.exe
windriver32.exe
windrives.exe
windrv32.exe
windrvdl.exe
windservc.exe
windumprep32.exe
windvd98.exe
windwrwsk.exe
windws.exe
windwv32.dll
windx32.dll
windxp.exe
winecx32.dll
winegi32.dll
wineij32.dll
wineil32.dll
winemx32.dll
winepi32.dll
winetn32.dll
winetw32.dll
wineva32.dll
winex.exe
winexe.exe
winexec32.exe
winexplorer.exe
winext.exe
winexy32.dll
winexz32.dll
winezn32.dll
winf49.sys
winfat32.exe
winfbi32.dll
winfire.exe
winfirewall.exe
winfix.exe
winfixer.exe
winfont.exe
winform.exe
winforma4.exe
winformkeep.exe
winformx.dll
winfp.exe
winftsap.dll
winfunctions.exe
winfw32.exe
wingenerics.dll
wingew32.dll
winghy32.dll
wingko32.dll
wingoa32.dll
wingob32.dll
wingsa32.dll
wingtp.exe
wingua.exe
winguard.exe
winguz32.dll
wingv32.dll
wingzm32.dll
winhab32.dll
winhdn32.dll
winhe1p.exe
winhelp.exe
winhid64.dll
winhld32.dll
winhlp16.exe
winhlpp32.exe
winhoo32.dll
winhook32.exe
winhoq32.dll
winhost.exe
winhost32.exe
winhound.exe
winhttp.exe
winhv.exe
wini.exe
winik.sys
winimsg.exe
wininfo.exe
winini.exe
wininit32.exe
winins.exe
wininxt.exe
winiogon.exe
winipx.exe
winipxa.exe
winiqa32.dll
winis.exe
winistitit.exe
winit.exe
winitr32.exe
winjgf32.dll
winjks32.dll
winjrp32.dll
winjrs32.dll
winjyg32.dll
winjyp32.dll
wink9sk3.exe
winkcp.exe
winkernel.exe
winkernel32.exe
winket.exe
winkif.exe
winkit.exe
winkld.dll
winkrnl386.exe
winkve32.dll
winkvh32.dll
winl.dll
winldg32.dll
winldra.exe
winldra1.exe
winlgcver.exe
winlgcvers.exe
winlgcverx.exe
winlgon.exe
winlig32.dll
winlink32.exe
winload.dll
winload32.exe
winloader.exe
winloadhh.dll
winlog0a.exe
winlog0n.exe
winlogin1.exe
winlogin32.exe
winlogin6.exe
winlogins.exe
winlogon.scr
winlogon32.bat
winlogon32.exe
winlogong.exe
winlogonn.exe
winlogons.exe
winlogoservice.exe
winlru32 dll
winlxj32.dll
winlzh32.dll
winm32.exe
winm32.sys
winm64.sys
winmain.exe
winmap.exe
winmapi.exe
winmbj32.dll
winmdw32.dll
winme.exe
winmedplay.exe
winmem.exe
winmfu32.dll
winmgm32.exe
winmgmt32.exe
winmgnt.exe
winmgr32.exe
winmine.exe
winmmt32.dll
winmon32.exe
winmpa.exe
winmplayer.exe
winmqx32.dll
winms.exe
winmsfw.exe
winmsg.exe
winmsg32.exe
winmsi.exe
winmsrv32.exe
winmuschi.exe
winmuse.exe
winmxw32.dll
winn.exe
winn321.exe
winnb58.dll
winnet32.exe
winnjj32.dll
winnl.exe
winnod.exe
winnook.exe
winnr.dll
winnthosts.exe
winntify.exe
winnuke.exe
winny_patch.exe
winocx.exe
winods.exe
winoldap.exe
winopn32.dll
winoqy32.dll
winosz32.dll
winotify.dll
winow.dll
winow.exe
winp2p.exe
winpack.exe
winpad.exe
winpaz32.dll
winpdc32.dll
winpe.exe
winpfw32.exe
winpgi.dll
winpnp32
winpnp32.exe
winpo32.exe
winpol.exe
winpop.exe
winppr32.exe
winproc32.exe
winprot.exe
winprotect.exe
winprotecte.exe
winpsa32.dll
winpsd.exe
winpto32.dll
winpup32.exe
winpva32.dll
winqgn32.dll
winqio32.dll
winqne32.dll
winqpq32.dll
winra.exe
winred32.dll
winreg.exe
winreg32.exe
winres.dll
winrestores.exe
winrge32.dll
winrkp32.dll
winrnt32.dll
winrpc.exe
winrpcsrv.exe
winrr32.exe
winrt32.exe
winruff.exe
winrun.exe
winrundll32.exe
winrvc.dll
winrvc.exe
winrvc32.dll
winrxp32.dll
winsap32.dll
winsatan.exe
winsaver.exe
winsc32.dll
winsearch.dll
winsecure.exe
winsecure32.exe
winser.exe
winsersec.exe
winserv.exe
winservadx.dll
winservicces.cab.bak.exe
winservices.exe
winservnt32.exe
winservs.exe
winshell.exe
winshock.exe
winshost.exe
winshow.exe
winshvc.exe
winsi32.exe
winsit.exe
winsl.exe
winslh.dll
winslh32.exe
winslmanager.exe
winsmd.exe
winsms.dll
winsock.exe
winsock.vbs
winsock2.exe
winsound1.exe
winsp2_1_.exe
winsp3.exe
winspc13.exe
winspool.exe
winspooll.exe
winspoolwowexec.exe
winsprm.exe
winspsrv.exe
winspy.exe
winspydemo.exe
winsrcv.exe
winsrvc.exe
winssc32.exe
winssi.exe
winssk32.exe
winssv.exe
winstall.exe
winstart.exe
winstat.exe
winstatkeep.exe
winstop32.exe
winststkeep.exe
winsupdater.exe
winsvcc.exe
winsvcmgr.exe
winsvcmon.exe
winsvcup.exe
winsvr.exe
winsvrc.exe
winsyncupx.exe
winsys.exe
winsys_32.exe
winsys2.exe
winsys2f.dll
winsys32.exe
winsys32_070109.dll
winsys32_070206.dll
winsys32dll.vbs
winsys64.sys
winsysban1.exe
winsysban10.exe
winsysban11.exe
winsysban12.exe
winsysban2.exe
winsysban3.exe
winsysban4.exe
winsysban5.exe
winsysban6.exe
winsysban7.exe
winsysban8.exe
winsysban9.exe
winsyscfg.exe
winsysengine.exe
winsyshp.exe
winsysi.exe
winsyslog.exe
winsysmngr32.exe
winsysmp.exe
winsyst.exe
winsystem.exe
winsystem16.exe
winsystem32.exe
winsystem32xp.exe
winsysupd1.exe
winsysupd10.exe
winsysupd11.exe
winsysupd12.exe
winsysupd2.exe
winsysupd3.exe
winsysupd4.exe
winsysupd5.exe
winsysupd6.exe
winsysupd7.exe
winsysupd8.exe
winsysupd9.exe
winsysupds.exe
wintask.exe
wintaskadx.dll
wintasks32.exe
wintcp.exe
winte32.exe
wintec.sys
wintems.exe
wintfj32.dll
wintftp.exe
winthg32.dll
wintjv32.dll
wintlb.exe
wintli32.dll
wintn32.dll
wintn32.exe
wintouch.exe
wintouchinstaller.exe
wintour.exe
wintrust.exe
wintrust32.exe
wintst.dll
winttr.exe
wintuh32.dll
wintwt32.dll
winu32.exe
winub32.exe
winubg32.dll
winug32.exe
winuj32.exe
winuns.dll
winuns32.dll
winup.exe
winupcd.exe
winupd.exe
winupd32.exe
winupdate.exe
winupdate32.exe
winupdatez.exe
winupdbc.exe
winupdsdgm.exe
winupdsv.exe
winupdt.exe
winupdtl.exe
winupsvc.exe
winuqw32.dll
winusb32.exe
winuser.exe
winuser32.exe
winusr.exe
winuyw32.dll
winvbie.dll
winvct32.exe
winvercp.exe
winvmm32.exe
winvslmq.exe
winvxd32.exe
winwcd.dll
winwil32.dll
winwim32.dll
winwin.exe
winwly32.dll
winwr32.exe
winxdefender.exe
winxey32.dll
winxip32.dll
winxka32.dll
winxp.exe
winxpinit.exe
winxplogon.sys
winxplt.exe
winxtm32.dll
winxtx32.dll
winxvk32.dll
winxxax.exe
winyim.exe
winystems.exe
winyt32.exe
winyta32.dll
winz32.exe
winzc32.exe
winzdn32.dll
winzip quick pick.exe
winzipp.exe
winzipt.exe
winzlo32.dll
winzod32.exe
winzrs32
winzrs32.exe
winzwr32.dll
wisvccz.exe
wiwshost.exe
wizapi32.dll
wjrrfwx.exe
wkbssb.exe
wkernel.exe
wkknbdx.exe
wkmgylag.exe
wkssr.exe
wkssvc.exe
wkssvr.exe
wksvw32.exe
wl.exe.exe
wlbaloon
wlbaloon.dll
wlblht.exe
wldll.dll
wlncr.exe
wlnlogon.exe
wlzip32[1].exe
wma beep.exe
wmdconf32.dll
wmdrtc32.dll
wmedia.exe
wmedia16.exe
wmiapisrv.dll
wmilib32.exe
wminfo.exe
wmiprsv.exe
wmipruse.exe
wmiprvce.exe
wmiprves.exe
wmiprvs.exe
wmiprvsw.exe
wmism23.exe
wml.exe
wmlprvse.exe
wmmon32.exe
wmndisdrv.sys
wmpcd32.dll
wmpconf.dll
wmpdev.dll
wmpenv.dll
wmphost.dll
wmpl.exe
wmplayer.dll
wmpsw3ss.dll
wmserv.exe
wmsnds32.exe
wmsound.dll
wmsvc.exe
wmtx.exe
wmuwo.exe
wmvconf.exe
wmvds32.dll
wmvmgr32.dll
wmwplayers.exe
wnauserv.dll
wndrivs.exe
wndrivs32.exe
wndrivsd32.exe
wndsystem.dll
wngard.exe
wnipsvr.exe
wnmicf.dll
wnset.exe
wnttech.exe
wnupd.exe
wnword~1.exe
wo.exe
woinst.exe
woinstall.exe
woopie exe
wormexe.exe
woso.exe
wosysdll.dll
wovkspy.exe
wowdbe.exe
wowexe.exe
wpablan.exe
wpap.exe
wpnsvc.exe
wqtpmp.exe
wrdget.dll
wrl_to_x3d.dll
wrmdrv.dll
ws2_64.dll
wsaf.exe
wsasrv.exe
wsass32.exe
wsaupdater.exe
wscan.exe
wscntjy.exe
wscsvc.exe
wsct.exe
wsct2.exe
wsctf.exe
wsdpri.dll
wsecom.exe
wsg.exe
wsn.exe
wsnaweb.dll
wsnctfy.exe
wsntfy.exe
wsockmfc.dll
wsocksrv.exe
wspad.exe
wspmspsv.exe
wspool.exe
wssocksapi.exe
wstart32.exe
wstat32.exe
wstray.exe
wsttrs.exe
wsup.exe
wsusupd.exe
wt.exe
wtcpcom.exe
wtfctf.dll
wtoolsa.exe
wtoolsb.dll
wtoolss.exe
wtssu.exe
wtta.exe
wuactl2.exe
wualcts.exe
wuamclt1.exe
wuamgard.exe
wuamgrd.exe
wuamgrd16.exe
wuamk032.exe
wuamkop32.exe
wuammgr32.exe
wuamngr32.exe
wuampd.exe
wuampkd.exe
wuanserv.dll
wuapi.exe
wuauclt.dll
wuauclt10.exe
wuauclt4.exe
wuauct1.exe
wuauctl32.exe
wuaumqr1.exe
wuauserv.exe
wuausrv.dll
wuclmi.exe
wucmdex.exe
wudb.dll
wudmate.exe
wudupdate.exe
wuf1.exe
wugrds.exe
wuihelp.exe
wulogin.exe
wunauclt.exe
wupdated.exe
wupdater.exe
wupdmgr32.exe
wupdsnff.exe
wupdt32x.exe
wupdt64.exe
wupdtmngr.exe
wupsys64.exe
wupupdate.exe
wurguar.exe
wuuaclt32.exe
wvuurpp.dll
wvuuuuu.dll
wwexec~1.exe
wwfx6.exe
wx2time.dll
wxapi.dll
wxmct.exe
wxpdll32.exe
wxploc(4).dll
wzdmg.exe
wzdsvc.exe
wzinfo.exe
wzip32.exe

Dangerous  DANGEROUS - W
Updated weekly. Last update: February 6 2017

Improve boot up time Run a free scan to diagnose your PC and identify the system boottle necks slowing you down. Start Test

Fix Windows PC's Fast! Automated Software Repairs damaged & slow windows systems in 1 click.


w?auboot.exe
W?auboot.exe is Trojan/Backdoor.
Kill the process w?auboot.exe and remove w?auboot.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

w031319.stub.exe
W031319.STUB.EXE is Trojan.Downloader.
Read more:
http://www.fileresearchcenter.com/W/W130...
Kill the process W031319.STUB.EXE and remove W031319.STUB.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

w046393b.dll
W046393B.DLL is Spyware.Spydoctor.
Read more:
http://fileinfo.prevx.com/adware/qq10db6...
Kill the file W046393B.DLL and remove W046393B.DLL from Windows startup using RegRun Reanimator.
http://www.regrun.com

w1nt45k.exe
W1NT45K.exe is a mass-mailing worm W32.Mytob.BL@mm.
W1NT45K.exe spreads by e-mail and via open network shares.
W1NT45K.exe tries to terminate antiviral programs installed on a user computer.
W1NT45K.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\W1NT45K.exe
C:\funny_pic.scr
C:\my_photo2005.scr
C:\see_this!!.scr
C:\hellmsn.exe
Adds the value:
"WINRUN z" = "W1NT45K.exe"
to the Windows startup registry keys.
More info:
http://securityresponse.symantec.com/avc...
Removal:
Kill W1NT45K.exe process and remove W1NT45K.exe from Windows startup using RegRun Startup Optimizer.

w32_ss.exe
Trojan Haxdor.
Once launched, the program installs itself in the Windows system directory as
w32_ss.exe
It then installs the other program modules to the victim machine:
debugg.dll - main module
sdmapi.sys *
boot32.sys *
c3.dll *
c3.sys *
c4.sys *
The Trojan installs itself in the system registry.

In systems running Windows 9x:

[HKLM\System\CurrentControlSet\Control\MPRServices\TestService]
DllName="debugg.dll"
EntryPoint="MemManager"
StackSize=0

In systems running Windows NT/2000/XP:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\debugg]
DllName="debugg.dll"
Startup="MemManager"
Impersonate=1
Asynchronous=1
MaxWait=1

w32dbg.exe
W32DBG.EXE is Trojan/Backdoor.
Kill the process W32DBG.EXE and remove W32DBG.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

w32dnsl.exe
W32dnsl.exe is a mass-mailing worm W32.Mytob.DO@mm .
W32dnsl.exe opens a back door.
W32dnsl.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\w32dnsl.exe
%System%\taskgmr.exe
C:\american_idols.scr
C:\funny_pics.scr
C:\my_bikini_pics.scr
C:\hellmsn.exe
Adds the value:
"WINTASKS" = "taskgmr.exe"
to the Windows startup registry keys.
More info:
http://securityresponse.symantec.com/avc...
Removal:
Kill w32dnsl.exe process and remove w32dnsl.exe from Windows startup using RegRun Startup Optimizer.

w32dtc.exe
W32dtc.exe is Backdoor.Agobot.ajb.
Kill the process w32dtc.exe and remove w32dtc.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

w32ntupdt.exe
w32NTupdt.exe is a mass-mailing worm W32.Mytob.BM@mm.
w32NTupdt.exe spreads by e-mail and via open network shares.
Related files:
%System%\w32NTupdt.exe
C:\hellmsn.exe
Adds the value:
"A New Windows Updater" = "w32NTupdt.exe"
to the Windows startup registry keys.
More info:
http://securityresponse.symantec.com/avc...
Removal:
Kill w32NTupdt.exe process and remove w32NTupdt.exe from Windows startup using RegRun Startup Optimizer.

w32svc.exe
W32svc.exe is W32.Spybot.ACYR.
Read more:
http://www.symantec.com/enterprise/secur...
Kill the process w32svc.exe and remove w32svc.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

w32tcomr.dll
We suggest you to remove w32tcomr.dll from your computer as soon as possible.
W32tcomr.dll is W32/Stration.RE.
Related files:
vbarccfg.dll
uxthipro.exe
w32tcomr.dll
w32tcomr.exe
setumgmt.dll
w32tcomr.dat
Read more:
http://www.pspl.com/virus_info/worms/str...
Kill the file w32tcomr.dll and remove w32tcomr.dll from Windows startup.

w32tcomr.exe
We suggest you to remove w32tcomr.exe from your computer as soon as possible.
W32tcomr.exe is W32/Stration.RE.
Related files:
vbarccfg.dll
uxthipro.exe
w32tcomr.dll
w32tcomr.exe
setumgmt.dll
w32tcomr.dat
Read more:
http://www.pspl.com/virus_info/worms/str...
Kill the process w32tcomr.exe and remove w32tcomr.exe from Windows startup.

w6378v10.exe
W6378V10.EXE is Trojan/Backdoor.
Read more:
http://fileinfo.prevx.com/adware/qqf2496...
Kill the process W6378V10.EXE and remove W6378V10.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

wa7pcw.exe
wa7pcw.exe is WinAntiVirus Pro 2007.
WinAntiVirus Pro 2007 is a rogue anti-spyware program that displays fake alerts, and downloads other programs onto user's machine without permission.
Read more:
http://research.sunbelt-software.com/thr...
Kill the process wa7pcw.exe and remove wa7pcw.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

waauclt.exe
WAauclt.exe is WORM_RBOT.AHL.
Read more:
http://www.fortiguardcenter.com/VirusEnc...
Kill the process wAauclt.exe and remove wAauclt.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

wabegec.exe
MSctlWin.exe is the Trojan.
Remove MSctlWin.exe from WIndows startup.

wac2.exe
WAC2.EXE is Trojan/Backdoor.
Read more:
http://fileinfo.prevx.com/adware/qqcc866...
Kill the process WAC2.EXE and remove WAC2.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

waclt~1.exe
Waclt~1.exe is Trojan/Backdoor.
Kill the process waclt~1.exe and remove waclt~1.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

wad.exe
Wad.exe is Trojan/Backdoor.
Kill the process wad.exe and remove wad.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

walcult.exe
Walcult.exe is Trojan/Backdoor.
Kill the process walcult.exe and remove walcult.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

wandrv.exe
Wandrv.exe is Troj/Bckdr-QHR.
Related files:
%Windows%\svhst32.exe
%System%\updates.exe
%System%\wandrv.exe
Read more:
http://www.sophos.com/security/analyses/...
Kill the process wandrv.exe and remove wandrv.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

wanman.exe
Wanman.exe is Trojan/Backdoor.
Kill the process wanman.exe and remove wanman.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

wapisvit.exe
Wapisvit.exe is PurityScan.
Read more:
http://www.spywaredata.com/spyware/threa...
Kill the process wapisvit.exe and remove wapisvit.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

wapp.exe
Wapp.exe is Trojan/Backdoor.
Kill the process wapp.exe and remove wapp.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

warebundle.exe
Warebundle.exe is Adware Look2Me.
Read more:
http://research.sunbelt-software.com/thr...
Kill the process warebundle.exe and remove warebundle.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

wareout.exe
Wareout.exe is Trojan/Backdoor.
Kill the process wareout.exe and remove wareout.exe from Windows startup.
Read more:
http://www.easydesksoftware.com/news/new...

warn tool.exe
Warn tool.exe is Trojan/Backdoor.
Kill the process warn tool.exe and remove warn tool.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

warn0900.exe
WARN0900.EXE is a part of Anti-dialer program (Germany).
Read more:
http://www.bleepingcomputer.com/startups...
Kill the process WARN0900.EXE and remove WARN0900.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

was5scan.exe
WAS5Scan.exe is Trojan/Backdoor.
Kill the process WAS5Scan.exe and remove WAS5Scan.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

was6.exe
Was6.exe is WinAntiSpyware.
Related files:
uwas6chk.dll
uwasffNT.exe
was6.exe
WAS6.url
uwasfsd.sys
Read more:
http://securityresponse.symantec.com/avc...
Kill the process was6.exe and remove was6.exe from Windows startup using RegRun.
www.regrun.com

was7.exe
Was7.exe is a part of WINANTISPYWARE.
WinAntiSpyware is a potentially unwanted application.
Kill the process was7.exe and remove was7.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

wasffnt.exe
Wasffnt.exe is WinAntiSpyware 2006 adware.
Read more:
http://www.pestpatrol.com/spywarecenter/...
Kill the process wasffnt.exe and remove wasffnt.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

wats.exe
Wats.exe is Phreaking Tool.
wats.exe is used for hacking the phone system, such as by using a sound card to imitate various audible tones.
Related files:
800.exe
carrier.exe
cm.exe
cna.exe
dtmf_d.exe
esnv3_3.exe
mf-dial.exe
motorola.exe
npafnd.exe
pword.exe
qch.exe
tolhack.exe
wats.exe
Read more:
http://www.pestpatrol.com/spywarecenter/...
Kill the process wats.exe and remove wats.exe from Windows startup using RegRun.
www.regrun.com

wauclt.exe
Wauclt.exe is W32.Gaobot.
Read more:
http://www.hkcert.org/valert/vinfo/lsass...
Kill the process wauclt.exe and remove wauclt.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

waucult.exe
WAUCULT.EXE is Trojan/Backdoor.
Read more:
http://fileinfo.prevx.com/adware/qq15097...
Kill the process WAUCULT.EXE and remove WAUCULT.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

wault.exe
Wault.exe is W32/Tilebot-JQ.
Read more:
http://www.sophos.com/security/analyses/...
Kill the process wault.exe and remove wault.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

waultc.exe
We suggest you to remove waultc.exe from your computer as soon as possible.
Waultc.exe is Trojan/Backdoor.
Kill the process waultc.exe and remove waultc.exe from Windows startup.

wave.exe
PsYber Stream Server

waverevenue.exe
Waverevenue.exe is Trojan/Backdoor.
Kill the process waverevenue.exe and remove waverevenue.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

wavesnet.exe
We suggest you to remove wavesnet.exe from your computer as soon as possible.
Wavesnet.exe is Trojan/Backdoor.
Kill the process wavesnet.exe and remove wavesnet.exe from Windows startup.

wawadisk.exe
WAWADISK.EXE is Trojan/Backdoor.
Read more:
http://fileinfo.prevx.com/adware/qq444c8...
Kill the process WAWADISK.EXE and remove WAWADISK.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

waynet.dll
Waynet.dll is Adware-SearchIt.dr.
Read more:
http://vil.nai.com/vil/content/v_140079....
Kill the file waynet.dll and remove waynet.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

waytray.exe
WayTray.exe is Trojan/Backdoor.
Kill the process WayTray.exe and remove WayTray.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

wbecheck.exe
Spyware trojan Floid.dll.
Integrates with Internet Explorer.
1. Remove from startup.
2. Restart computer.
3. Delete Floid.dll and wbeCheck.exe.

wbemstest.exe
Wbemstest.exe is Trojan/Backdoor.
Kill the process wbemstest.exe and remove wbemstest.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

wbhshare.dll
We suggest you to remove wbhshare.dll from your computer as soon as possible.
Wbhshare.dll is Adware.Webhancer.
Related files:
%Program Files%\webHancer\Programs\license.txt
%Program Files%\webHancer\Programs\readme.txt
%Program Files%\webHancer\Programs\sporder.dll
%Program Files%\webHancer\Programs\wbhshare.dll
%Program Files%\webHancer\Programs\whAgent.exe
%Program Files%\webHancer\Programs\whAgent.ini
%Program Files%\webHancer\Programs\whiehlpr.dll
%Program Files%\webHancer\Programs\whieshm.dll
%WINDOWS%\webhdll.dll
%WINDOWS%\whAgent.inf
%WINDOWS%\whInstaller.exe
%WINDOWS%\whInstaller.ini
Read more:
http://www.bitdefender.com/VIRUS-1000191...
Kill the file wbhshare.dll and remove wbhshare.dll from Windows startup.

wbwedt.exe
Wbwedt.exe is dangerous Trojan.
Remove it from your computer.

wbwedt1.exe
Wbwedt.exe is dangerous Trojan.
Remove it from your computer.

wc.exe
Wc.exe is Trojan.Mdropper.U.
Related files:
%CurrentFolder%\win.exe (a component of the Trojan, which is detected as Infostealer)
%CurrentFolder%\Rapid_Response_11-03.doc (a clean file)
%SystemDrive%\Documents and Settings\All Users\Application Data\Microsoft\UserCertificates\explorex.exe (a copy of win.exe)
Read more:
http://www.symantec.com/enterprise/secur...
Kill the process wc.exe and remove wc.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

wc98pp.dll
Wc98pp.dll is Adware.Roogoo.
Kill the file wc98pp.dll and remove wc98pp.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

wcdrtc32.dll
Wcdrtc32.dll is W32.Sality.V.
Related files:
%System%\wcdrtc32.dl_ - 17,876 bytes, detected as W32.Sality.V
%System%\wcdrtc32.dll - 25,600 bytes, detected as W32.Sality.V
Read more:
http://www.symantec.com/enterprise/secur...
Kill the file wcdrtc32.dll and remove wcdrtc32.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

wce8fdc4.dll,i2 0006c9ec0ce8fdc4
RUNDLL32.EXE wce8fdc4.dll,I2 0006c9ec0ce8fdc4 is Trojan/Backdoor.
Kill the file wce8fdc4.dll and remove RUNDLL32.EXE wce8fdc4.dll,I2 0006c9ec0ce8fdc4 from Windows startup using RegRun.
www.regrun.com

wcheckup.exe
Steals passwords
Win-Bugsfix.exe was the name Onel de Guzman used when we wrote LoveLetter. When the mail had been executed Barock was supposed to be downloaded and run on the vitim´s computer.

wconf32.exe
Wconf32.exe is Trojan/Backdoor.
Kill the process wconf32.exe and remove wconf32.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

wcsntfy.exe
Wcsntfy.exe is WORM_SDBOT.BYD.
Read more:
http://www.trendmicro.com/vinfo/virusenc...
Kill the process wcsntfy.exe and remove wcsntfy.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

wcupdater.exe
Remote Access / Steals passwords
Alters Win.ini (v 2.0).

wdfmgr32.exe
Wdfmgr32.exe is Troj/Dloadr-AOT.
Read more:
http://www.sophos.com/security/analyses/...
Kill the process wdfmgr32.exe and remove wdfmgr32.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

wdfmrg.exe
Wdfmrg.exe is W32/Sdbot-ZN.
Read more:
http://www.sophos.com/virusinfo/analyses...
Kill the process wdfmrg.exe and remove wdfmrg.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

wdigest.exe
Wdigest.exe is Trojan/Backdoor.
Kill the process wdigest.exe and remove wdigest.exe from Windows startup.

wdirpgis.dll
WDIRPGIS.DLL is Trojan/Backdoor.
Kill the file WDIRPGIS.DLL and remove WDIRPGIS.DLL from Windows startup using RegRun Reanimator.
http://www.regrun.com

wdismon.exe
Wdismon.exe is Trojan/Backdoor.
Kill the process wdismon.exe and remove wdismon.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

wdmupd.exe
Wdmupd.exe is a part of Malware group - Covert Sys Exec.
Directory: %SysDir%
Read more:
http://fileinfo.prevx.com/QQ04da19219848...
Kill the process wdmupd.exe and remove wdmupd.exe from Windows startup using RegRun.
www.regrun.com

wdokbye.dll
WDOKBYE.DLL is Trojan-Downloader.Win32.Busky.gen.
Read more:
http://research.sunbelt-software.com/thr...
Kill the file WDOKBYE.DLL and remove WDOKBYE.DLL from Windows startup using RegRun Reanimator.
http://www.regrun.com

wdrun32.exe
Gaobot Trojan.
Spreads in local network via open shares.
Also it uses DCOM RPC vulnerability (135,445 ports) and WebDav vulnerability (port 80).
Allows to control the victim computer by IRC.
Terminates well known antiviral software.
Removal:
install the patches from Microsoft:
http://www.microsoft.com/technet/securit...
http://www.microsoft.com/technet/securit...
http://www.microsoft.com/technet/securit...
http://www.microsoft.com/technet/securit...
http://www.microsoft.com/technet/securit...
http://www.microsoft.com/technet/securit...
http://www.microsoft.com/technet/securit...
Set the strong passwords for network shares.
Use RegRun "Terminate" feature to erase the virus body files.
They are located in Windows\System32 folder.
Cavapsvc.exe
Csrrs.exe
Cvhost.exe
DIIhost.exe (with capital letter 'i')
Dosrun32.exe
Dos32.exe
Lsas.exe
Regloadr.exe
Schost.exe
Scvhost.exe
Service.exe
Servicess.exe
Sochost.exe
Swchost.exe
System.exe
Update.exe
Wdrun32.exe
Winhlpp32.exe
Winreg.exe
Winupdsdgm.exe

Free removal tool:
http://securityresponse.symantec.com/avc...

wdsapi32.dll
Wdsapi32.dll is Spyware.Look2Me.
Read more:
http://www.symantec.com/avcenter/venc/da...
Kill the process wdsapi32.dll and remove wdsapi32.dll from Windows startup using RegRun.
www.regrun.com

we love lien van de kelder.exe
We Love Lien Van de Kelder.exe is a mass-mailing worm W32.Mytob.DG@mm.
We Love Lien Van de Kelder.exe opens a back door on TCP port 4512.
We Love Lien Van de Kelder.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\We Love Lien Van de Kelder.exe
Adds the value:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"
http://www.lienvande[removed].be" = "\We Love Lien Van de Kelder.exe" HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\"Lien Van de Kelder" = "\We Love Lien Van de Kelder.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill We Love Lien Van de Kelder.exe process and remove We Love Lien Van de Kelder.exe from Windows startup using RegRun Startup Optimizer.

web event logger
Trojan Backdoor.Berbew.L
1.Creates the following files:
%System%\[8 random characters].exe
%System%\[8 random characters].dll
2.Creates several randomly named copies of the following file:
%Temp%\[8 random characters].html
3.Adds the value:
"Web Event Logger"="{79FEACFF-FFCE-815E-A900-316290B5B738}"
to the registry entry:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\
ShellServiceObjectDelayLoad
4. Changes the IE security zone settings to low security.
5. Adds the value:
"GlobalUserOffline" = "0"
to the registry entry:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Use RegRun Reanimator to remove Trojan from startup.
Delete its files.

web ex 1.4.exe
Remote Access / FTP Server

web ex[1.2].exe
Remote Access / FTP Server

web ex[1.3].exe
Remote Access / FTP Server

web_torpedo.exe
Web_torpedo.exe is Trojan/Backdoor.
Kill the process web_torpedo.exe and remove web_torpedo.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

web2.exe
Web2.exe is Trojan/Backdoor.
Kill the process web2.exe and remove web2.exe from Windows startup.

web32view.dll
Web32view.dll is Trojan/Backdoor.
Kill the file web32view.dll and remove web32view.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

webassist.dll
WebAssist.dll is Trojan/Backdoor.
Kill the file WebAssist.dll and remove WebAssist.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

webbuying.exe
Webbuying.exe is Adware.WebBuying Assistant installer file.
Read more:
http://www.fileresearchcenter.com/W/WEBB...
Kill the process webbuying.exe and remove webbuying.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

webcheck.exe
Troj/Soromo-A is a browser-hijacking Trojan.
In order to run automatically when Windows starts up the Trojan copies itself to one of the following filenames in the Windows system folder:
update.exe; explorer.exe; winlogon.exe; system.exe; taskman.exe; taskmon.exe; svchost.exe; services.exe; wupdmgr.exe; winspool.exe; webcheck.exe; wininet.exe

Troj/Soromo-A periodically starts up a browser and directs it to a URL chosen randomly from a list of websites configured by the author.

Manual removal:
Locate the HKEY_LOCAL_MACHINE entries:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\System Update
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce\System Update
and delete them if they exist.

webdir.dll
WEBDIR.DLL is Adware.WebDir.
Read more:
http://www.symantec.com/security_respons...
Kill the file WEBDIR.DLL and remove WEBDIR.DLL from Windows startup using RegRun Reanimator.
http://www.regrun.com

webdl.exe
Remote Access / Downloading trojan
The default file downloaded by the trojan is The Infector (they are written by the same person). This could easily be changed to any file anywhere on the Web. The perpetrator just enter the URL where the wanted trojan is, and his ICQ UIN to receive notification when the infected user is online. The sender is able to destroy WebDownloader after it has downloaded it´s trojan file.

webdlg32.dll
Webdlg32.dll is Home page Hijacker.
Webdlg32.dll is BHO object.
Remove webdlg32.dll from Windows BHO list.

webhdll.dll
Webhdll.dll is Trackware.Webhancer.
Related files:
Wbhshare.dll
Whiehlpr.dll
Whieshm.dll
WhAgent.exe
Kill the file webhdll.dll and remove webhdll.dll from Windows startup using RegRun.
www.regrun.com
Read more:
http://www.symantec.com/avcenter/venc/da...

webhelp.drv
Webhelp.drv is Trojan/Backdoor.
Kill the file webhelp.drv and remove webhelp.drv from Windows startup using RegRun Reanimator.
http://www.regrun.com

webhelper.dll
WEBHELPER.DLL is a part of RiverBellePoker - Potentially Unwanted Software.
Read more:
http://www.spy-emergency.com/research/R/...
Kill the file WEBHELPER.DLL and remove WEBHELPER.DLL from Windows startup using RegRun Reanimator.
http://www.regrun.com

webrebates.exe
Webrebates.exe is Adware.W32.WebRebates.
Webrebates.exe is related to an advertising program by Web Rebates.
Kill the process webrebates.exe and remove webrebates.exe from Windows startup using RegRun.
www.regrun.com

webrebates0.exe
Adware.
Displays advertising information on your computer.
Stop the processes:
arupdate.exe
\program files\web_rebates\disp1150.exe
\program files\webrebates\webrebates1.exe
systemroot\2805e.exe
unregister.exe
unstsa3.exe
webrebates0.exe
Remove it from startup if their exist.

Remove BHO items:
adroar.dll
systemroot\3_0_1browserhelper3.dll
systemroot\neti.dll
systemroot\system32\imgconv.dll
systemroot\system32\vic32.dll

Read more:
http://www.pestpatrol.com/PestInfo/t/top...

websearch.exe
Websearch.exe is an adware program Adware.Websearch.
Websearch.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
common.dll
IExploreSkins.exe
PIB.exe
QDow_AS2.dll
setupex.exe
TBPS.exe
toolbar.dll
WSG.exe
WSup.exe
WToolsA.exe
WToolsB.dll
WToolsS.exe
btiein.dll
websearch.exe
More info:
http://securityresponse.symantec.com/avc...
Removal:
Kill websearch.exe process and remove websearch.exe from Windows startup using RegRun Startup Optimizer.

webshow.dll
Webshow.dll is Trojan/Backdoor.
Kill the file webshow.dll and remove webshow.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

webshow.drv
Webshow.drv is Trojan/Backdoor.
Kill the file webshow.drv and remove webshow.drv from Windows startup using RegRun Reanimator.
http://www.regrun.com

webspyshield.dll
We suggest you to remove WebSpyShield.dll from your computer as soon as possible.
WebSpyShield.dll is a part of WebSpyShield.
WebSpyShield is a misleading application that may give exaggerated reports of threats on the computer.
Related files:
%UserProfile%\Local Settings\Temp\[RANDOM NAME].tmp
%UserProfile%\Start Menu\Programs\WebSpyShield\
%UserProfile%\Start Menu\Programs\WebSpyShield\Uninstall.lnk
%UserProfile%\Start Menu\Programs\WebSpyShield\WebSpyShield.lnk
%ProgramFiles%\WebSpyShield\
%ProgramFiles%\WebSpyShield\Uninstall.exe
%ProgramFiles%\WebSpyShield\WebSpyShield.dll
%ProgramFiles%\WebSpyShield\WebSpyShield.exe
%Windir%\system32\netsupp.dll
Read more:
http://www.symantec.com/business/securit...
Kill the file WebSpyShield.dll and remove WebSpyShield.dll from Windows startup.

webspyshield.exe
We suggest you to remove WebSpyShield.exe from your computer as soon as possible.
WebSpyShield.exe is a part of WebSpyShield.
WebSpyShield is a misleading application that may give exaggerated reports of threats on the computer.
Related files:
%UserProfile%\Local Settings\Temp\[RANDOM NAME].tmp
%UserProfile%\Start Menu\Programs\WebSpyShield\
%UserProfile%\Start Menu\Programs\WebSpyShield\Uninstall.lnk
%UserProfile%\Start Menu\Programs\WebSpyShield\WebSpyShield.lnk
%ProgramFiles%\WebSpyShield\
%ProgramFiles%\WebSpyShield\Uninstall.exe
%ProgramFiles%\WebSpyShield\WebSpyShield.dll
%ProgramFiles%\WebSpyShield\WebSpyShield.exe
%Windir%\system32\netsupp.dll
Read more:
http://www.symantec.com/business/securit...
Kill the process WebSpyShield.exe and remove WebSpyShield.exe from Windows startup.

wer8274.dll
Wer8274.dll is Trojan/Backdoor.
Kill the file wer8274.dll and remove wer8274.dll from Windows startup.
http://www.superadblocker.com/definition...

werecv.exe
WeRecv.exe is SystemPoser Trojan.
Read more:
http://fileinfo.prevx.com/adware/qqec6d6...
Kill the process weRecv.exe and remove weRecv.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

werweb.dll
WERWEB.DLL is Trojan/Backdoor.
Kill the file WERWEB.DLL and remove WERWEB.DLL from Windows startup using RegRun Reanimator.
http://www.regrun.com

werweb.exe
Werweb.exe is Trojan/Backdoor.
Kill the process werweb.exe and remove werweb.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

wfdmgr.exe
Wfdmgr.exe is a mass-mailing worm W32.Mytob.V@mm.
Worm wfdmgr.exe spreads by e-mail and via IRC channel.
Wfdmgr.exe spreads by exploiting the Microsoft Windows Local Security Authority Service Remote Buffer Overflow on TCP port 445 (Microsoft Security Bulletin MS04-011) and DCOM RPC vulnerability (Microsoft Security Bulletin MS03-026) using TCP port 135
Related files:
%System%\wfdmgr.exe
Adds the value:
“LSA” = “wfdmgr.exe”
to the Windows startup registry keys.
More info:
http://securityresponse.symantec.com/avc...
Removal: Kill wfdmgr.exe process and remove wfdmgr.exe from Windows startup using RegRun Startup Optimizer.

wfx5.exe
WFX5.EXE is Spyware.
Kill the process WFX5.EXE and remove WFX5.EXE from Windows startup.

wfxqhv.exe
Wfxqhv.exe is SillyDl.ATE downloader.
Read more:
http://www3.ca.com/securityadvisor/pest/...
Kill the process wfxqhv.exe and remove wfxqhv.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

wgareg.exe
Wgareg.exe is Trojan/Backdoor.
Related files:
%CACHE%\CONTENT.IE5\????????\L9Q3WG[1].JPEG
%CACHE%\CONTENT.IE5\????????\L9Q3WG[1].JPG
%WINDIR%\SYSTEM32\.EXE
%WINDIR%\SYSTEM32\2.TMP
%WINDIR%\SYSTEM32\3.TMP
%WINDIR%\SYSTEM32\4.TMP
%WINDIR%\SYSTEM32\47AF.TMP
%WINDIR%\SYSTEM32\649D.TMP
%WINDIR%\SYSTEM32\7B8F.TMP
%WINDIR%\SYSTEM32\BAD.VIR
Read more:
http://fileinfo.prevx.com/adware/qq36b63...
Kill the process wgareg.exe and remove wgareg.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

wgavn.exe
Wgavn.exe is W32.Esbot.E worm.
Related files:
%System%\wgavn.exe
%Windir%\Debug\dcpromo.log
Read more:
http://securityresponse.symantec.com/avc...
Kill the process wgavn.exe and remove wgavn.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

wgs3.exe
Wgs3.exe is Trojan SystemPoser.
Read more:
http://fileinfo.prevx.com/adware/qq9f538...
Kill the process wgs3.exe and remove wgs3.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

wgt.exe
Steals passwords
At first Ring0 came as an attached file to Winsock Version Checker. When it´s active and the computer is connected to the Internet, the trojan searches for proxyservers and tries to send the collected information to an FTP server in Russia.

wgtstarter.exe
Steals passwords
At first Ring0 came as an attached file to Winsock Version Checker. When it´s active and the computer is connected to the Internet, the trojan searches for proxyservers and tries to send the collected information to an FTP server in Russia.

whack.exe
Remote Access / Trojan dropper
Disguised as a game. Installs NetBus server 1.60 or 1.70 while you play a game, trying to shoot at a bear.

whackamole.exe
Remote Access / Trojan dropper
Disguised as a fake game and installs a NetBus Pro server.

whagent.exe
WhAgent.exe is a part of WebHancer software.
WhAgent.exe is used for monitoring your network activity.
Manufacturer: webHancer Corporation
Kill the process whAgent.exe and remove whAgent.exe from Windows startup using RegRun.
www.regrun.com

whagent_update.exe
Whagent_update.exe is Adware.webHancer.
Read more:
http://www.fileresearchcenter.com/W/WHAG...
Kill the process whagent_update.exe and remove whagent_update.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

whakamole170.exe
Remote Access / Trojan dropper
Disguised as a game. Installs NetBus server 1.60 or 1.70 while you play a game, trying to shoot at a bear.

whakmole.exe
Remote Access / Trojan dropper
Disguised as a game. Installs NetBus server 1.60 or 1.70 while you play a game, trying to shoot at a bear.

whatsnewbot.exe
WhatsNewBot.exe is Trojan/Backdoor.
Kill the process WhatsNewBot.exe and remove WhatsNewBot.exe from Windows startup.

whenu.exe
Whenu.exe is WhenU.Save Adware.
Read more:
http://research.sunbelt-software.com/thr...
Kill the process whenu.exe and remove whenu.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

whiehlpr.dll
Whiehlpr.dll is Trackware.Webhancer.
Related files:
Wbhshare.dll
Whiehlpr.dll
Whieshm.dll
WhAgent.exe
Kill the file whiehlpr.dll and remove whiehlpr.dll from Windows startup using RegRun.
www.regrun.com
Read more:
http://www.symantec.com/avcenter/venc/da...

whieshm.dll
We suggest you to remove whieshm.dll from your computer as soon as possible.
Whieshm.dll is Adware.Webhancer.
Related files:
%Program Files%\webHancer\Programs\license.txt
%Program Files%\webHancer\Programs\readme.txt
%Program Files%\webHancer\Programs\sporder.dll
%Program Files%\webHancer\Programs\wbhshare.dll
%Program Files%\webHancer\Programs\whAgent.exe
%Program Files%\webHancer\Programs\whAgent.ini
%Program Files%\webHancer\Programs\whiehlpr.dll
%Program Files%\webHancer\Programs\whieshm.dll
%WINDOWS%\webhdll.dll
%WINDOWS%\whAgent.inf
%WINDOWS%\whInstaller.exe
%WINDOWS%\whInstaller.ini
Read more:
http://www.bitdefender.com/VIRUS-1000191...
Kill the file whieshm.dll and remove whieshm.dll from Windows startup.

whinstaller.exe
Whinstaller.exe is WebHancer.
Related files:
whSurvey.exe
whcc-grokster.exe
whcc-webhancer.exe
whagent.exe
whinstaller.exe
WebP2PInstaller.dll
webhdll.dll
whwsshm.dll
wbhshare.dll
whiehlpr.dll
whieshm.dll
webHancer Survey Companion
webHancer Agent
whCC-GIANT.exe
whagent.ini
Programswhagent.ini
set3d.tmp
set3f.tmp
set41.tmp
set43.tmp
whagent.inf
whinstaller.ini
whagent_update.exe
b129.exe
Read more:
http://www.spywareremove.com/removewhins...
Kill the process whinstaller.exe and remove whinstaller.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

whismng.exe
Whismng.exe is Trojan.Win32.Whiter.a.
Read more:
http://www.viruslist.com/en/viruses/ency...
Kill the process whismng.exe and remove whismng.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

whsurvey.exe
whSurvey.exe is a part of WebHancer software.
whSurvey.exe is used for monitoring your network activity.
Manufacturer: webHancer Corporation
Kill the process whSurvey.exe and remove whSurvey.exe from Windows startup using RegRun.
www.regrun.com

whyw.exe
Whyw.exe is Trojan/Backdoor.
Read more:
http://www.incodesolutions.com/threats/S...
Kill the process whyw.exe and remove whyw.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

wiacs.exe
Wiacs.exe is Trojan/Backdoor.
Kill the process wiacs.exe and remove wiacs.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

wiacss.exe
Wiacss.exe is Trojan/Backdoor.
Kill the process wiacss.exe and remove wiacss.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

wiamp.exe
WIAMP.EXE is Trojan/Backdoor.
Read more:
http://fileinfo.prevx.com/adware/qq37e77...
Kill the process WIAMP.EXE and remove WIAMP.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

wibsvc.exe
WIBSVC.EXE is Trojan/Backdoor.
Kill the process WIBSVC.EXE and remove WIBSVC.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

wichtig.exe
wichtig.exe is a mass-mailing worm W32.Hilder-A.
wichtig.exe tries to terminate antiviral programs installed on a user computer.
Related files:
funny.exe
unbelieveable.exe
C:\wichtig.exe
C:\FUUU.exe
%Windows%\INF3CTED.EXE
%Windows%\NET5KY.EXE
%Windows%\SA55ER.EXE
%Windows%\MYD00M.EXE
More info:
http://www.sophos.com/virusinfo/analyses...
Removal:
Kill the process wichtig.exe and remove wichtig.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

wide02.exe
WIDE02.EXE is Trojan/Backdoor.
Read more:
http://fileinfo.prevx.com/adware/qqd5731...
Kill the process WIDE02.EXE and remove WIDE02.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

wierrcsy.dll
WIERRCSY.DLL is Adware.Look2ME.
Read more:
http://fileinfo.prevx.com/adware/qqf4b76...
Kill the file WIERRCSY.DLL and remove WIERRCSY.DLL from Windows startup using RegRun Reanimator.
http://www.regrun.com

wiit.exe
wiit.exe is a Trojan W32.Rbot-AMS.
wiit.exe opens a back door on IRC channels.
wiit.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
wiit.exe
More info:
http://www.sophos.com/virusinfo/analyses...
Removal:
Kill wiit.exe process and remove wiit.exe from Windows startup using RegRun Startup Optimizer.

wildapp.dll
WildApp.dll is Adware.OverPro.
Kill the file WildApp.dll and remove WildApp.dll from Windows startup.

wilokyl.exe
Remote Access
It kills more than 20 antivirus programs in memory and also four dedicated antitrojan softwares. The trojan can redirect ports and connect to several servers at the same time. It can also be used as a port scanner. Cafeini can also take another program´s place in the Registry. The server will automatically be updated using HTTP.

wimsqaad.exe
Trojan Backdoor.Sdbot.AG
Opens a backdoor on the infected computer by connecting to an IRC server at TCP port 6631.
Spreads to the following network shares using pass dictionary.
Remove it from Windows startup using RegRun Startup Optimizer.

win.exe
Name: Shorm
Worm / Steals passwords / Network trojan
Propagates to all shared discs. Autostarts using Windows Startup directory. Passwords and users names are mailed to two addresses in Russia. The .exe file is compressed using ASPack. It connects to a Web page in Russia, both to receive IP addresses to scan and to update itself.

win_.exe
Win_.exe is Troj/Fodder-A.
Read more:
http://www.sophos.com/security/analyses/...
Kill the process win_.exe and remove win_.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

win1.exe
Win1.exe is Trojan/Backdoor.
Kill the process win1.exe and remove win1.exe from Windows startup.

win16.exe
Win16.exe is Trojan/Backdoor.
Kill the process win16.exe and remove win16.exe from Windows startup.

win19.tmp.exe
WIN19.TMP.EXE is Trojan/Backdoor.
Kill the process WIN19.TMP.EXE and remove WIN19.TMP.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

win2005.exe
Win2005.exe is Trojan/Backdoor.
Kill the process win2005.exe and remove win2005.exe from Windows startup.

win32.exe
Win32.exe is Trojan/Backdoor.
Kill the process Win32.exe and remove Win32.exe from Windows startup.
Related files for W32.HLLW.Nautic:
* NTDLL.exe
* Win32.exe
* Explore.exe
* Kernel32.exe
* krnl286.exe
* Dllhost32.exe
* MSTCP.exe
* CRSS.exe
* Winlogon32.exe
* Winsrvc.exe
* Ntoskrn.exe
* Vmm32.exe
* Sysmon.exe
* System32.exe
* Sys.exe
* Win.exe
* Rundil32.exe
* Msrvcp.exe
* Msgmsr.exe
* Mscde32.exe
* Regsvclib.exe
* Reg32.exe
* Registry32.exe
* Service.exe
* Rpcsrvc.exe
More info:
http://securityresponse.symantec.com/avc...

win3208240613220.exe
Win3208240613220.exe is Trojan/Backdoor.
Kill the process win3208240613220.exe and remove win3208240613220.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

win320859188624462006.exe
WIN320859188624462006.EXE is Trojan Downloader.
Read more:
http://fileinfo.prevx.com/adware/qq3b9f6...
Kill the process WIN320859188624462006.EXE and remove WIN320859188624462006.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

win321.exe
WIN321.EXE is Trojan/Backdoor.
Kill the process WIN321.EXE and remove WIN321.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

win32app.exe
Win32.HLLC.Nan

win32boot.exe
Win32boot.exe is worm and backdoor trojan W32/Tilebot-GF.
Read more:
http://www.sophos.com/security/analyses/...
Kill the process win32boot.exe and remove win32boot.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

win32bootcfg.exe
WIN32BOOTCFG.EXE is Trojan/Backdoor Poser.
Kill the process WIN32BOOTCFG.EXE and remove WIN32BOOTCFG.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

win32cfg.exe
Remote Access / Steals passwords
Alters Win.ini (v 2.0).

win32config.exe
W32.Paps.A@mm is a mass-mailing worm that sends itself as an attachment to the email addresses that it finds on your computer.
The email will have a variable subject and file attachment.
The attachment will have a .exe file extension:
- Pics.JPG.exe
- MailMessage.Msg.exe
- Filesharing_details.DOC.exe
- Trojan_removal_tool.exe
- Report.DOC.exe
- Documents.DOC.exe
- Removal_tool.exe

Creates the following files: %Windir%\Win32config.exe; %Windir%\Win32apps3.txt; %Windir%\Kernel32.dll; %Windir%\Ntbtlog.txt; iphist.dat.
This file is created in the same folder as the original worm file.

Adds the value: "Win32Config" = "%Windir%\win32config.exe"
in the registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Scans the following file types on all the local drives for email addresses: .doc; .txt; .wab; .rtf; .htm; .html; .dbx; .xml; .msg; .php; .cgi; .pst; .nk2

Attempts to access the following Web sites:
http: //www.google.de
http: //www.hausaufgaben.de
http: //www.referate.de
http: //www.eselfilme.com
Attempts to access http: //www.whatismyip.com to get the IP address of the local system.

Automatic removal:
Use RegRun Startup Optimizer to remove this worm.

win32exe.exe
win32exe.exe is a Backdoor W32.Alcra.A.
win32exe.exe spreads via open network shares.
win32exe.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\regedit.com
%System%\taskmgr.exe
%System%\tasklist.com
%System%\taskkill.com
%System%\netstat.com
%System%\tracert.com
%System%\ping.com
%System%\cmd.com
%ProgramFiles%\MSConfigs\MSConfigs.exe
%System%\bt.exe
%System%\z.tmp
%System%\temp.zip
%System%\bszip.dll
%System%\p2pnetwork.exe
winis.exe
win32exe.exe
wini.exe
winlogins.exe
muamgr.exe
Adds the value:
"MsConfigs" = "MsConfigs.exe"
"p2pnetwork" = "p2pnetwork.exe"
to the Windows startup registry keys.
More info:
http://securityresponse.symantec.com/avc...
Removal:
Kill win32exe.exe process and remove win32exe.exe from Windows startup using RegRun Startup Optimizer.

win32exec.exe
W32.Bitter
It is a worm that may be able to propagate through file-share networks.
It is produced by a constructor kit and can inject itself into other processes.
Performs some of the following actions:
- Inject entries into either the Notepad or Microsoft Internet Explorer processes.
- Download and execute a file, it if detects a webcam.
- Notify an attacker of its existence through a Web portal at the domain icq.com.
- Delete the original file that was executed.
- Be configured to only execute on a certain date.

Manual removal:
Navigate to the key: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows
and delete the value: "load" = "%Windir%\win32exec.exe"

win32h.exe
WIN32H.EXE is Trojan/Backdoor.
Read more:
http://fileinfo.prevx.com/adware/qq55715...
Kill the process WIN32H.EXE and remove WIN32H.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

win32hlp.exe
Win32hlp.exe is a variant of Trojan/Backdoor AIMVISION.
Kill the process win32hlp.exe and remove win32hlp.exe from Windows startup using RegRun.
www.regrun.com

win32host.exe
WIN32HOST.EXE is a Trojan.Hiddl-B.
WIN32HOST.EXE downloads and executes files.
Related files:
WIN32HOST.EXE
%System%\SVSHOTC.EXE
%System%\iedld32.dll
More info:
http://www.sophos.com/virusinfo/analyses...
Removal:
Kill WIN32HOST.EXE process and remove WIN32HOST.EXE from Windows startup using RegRun Startup Optimizer.

win32ip.exe
Win32ip.exe is Dropper/IRCBot.731526.
Related files:
system.exe
win32ip.exe
zlip.cpl
zlip.exe
zlip1.cpl
zlip2.cpl
Read more:
http://click2clean.e-games.com.my/v3_inf...
Kill the process win32ip.exe and remove win32ip.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

win32logon.exe
Win32logon.exe is Trojan/Backdoor.
Kill the process win32logon.exe and remove win32logon.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

win32ole.exe
Win32ole.exe is Trojan/Backdoor Wootbot.
Kill the process win32ole.exe and remove win32ole.exe from Windows startup.

win32res.exe
Win32res.exe is Trojan/Backdoor.
Kill the process win32res.exe and remove win32res.exe from Windows startup.

win32sbk.exe
WIN32SBK.EXE is a Troj/Borodldr-H.
WIN32SBK.EXE spreads via open network shares.
Removal:
Kill WIN32SBK.EXE process and remove WIN32SBK.EXE from Windows startup using RegRun Startup Optimizer.

win32service.dll
WIN32SERVICE.DLL is Polymorphic File Exploit.
Directory: %windir%\galaxy\galaxycore\
Read more:
http://fileinfo.prevx.com/adware/qqaa384...
Kill the file WIN32SERVICE.DLL and remove WIN32SERVICE.DLL from Windows startup using RegRun Reanimator.
http://www.regrun.com

win32snd.exe
W32/Rbot-DQ is a worm which attempts to spread to remote network shares with weak passwords and via network security exploits as a result of the backdoor Trojan element receiving the appropriate command from a remote user.

Copies itself to the Windows system folder as WIN32SND.EXE
Creates entries at the following locations in the registry so as to run itself on system startup, trying to reset them every minute:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

W32/Rbot-DQ tries to delete the C$, D$, E$, IPC$ and ADMIN$ network shares on the host computer every 2 minutes.
W32/Rbot-DQ attempts to terminate certain processes related to anti-virus and security programs including REGEDIT.EXE, MSCONFIG.EXE and NETSTAT.EXE.

Manual removal:
Locate the HKEY_LOCAL_MACHINE entries:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
and remove any reference to WIN32SND.EXE.

win32so.exe
Win32so.exe is Trojan/Backdoor.
Kill the process win32so.exe and remove win32so.exe from Windows startup.

win32sprot.exe
Win32sprot.exe is Trojan/Backdoor.
Kill the process win32sprot.exe and remove win32sprot.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

win32sys.exe
Win32sys.exe is Trojan/Backdoor.
Kill the process win32sys.exe and remove win32sys.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

win32udt.exe
Win32udt.exe is Worm.SDBOT.
Kill the process win32udt.exe and remove win32udt.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

win32update.exe
Win32update.exe is network worm W32/Rbot-BAS.
Kill the process win32update.exe and remove win32update.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

Read more:
http://www.sophos.com/virusinfo/analyses...

win32usb.exe
Win32usb.exe is Trojan/Backdoor Forbot.
Kill the process win32usb.exe and remove win32usb.exe from Windows startup.
www.sophos.com/virusinfo/analyses/w32forbotav.html

win32x.exe
Win32x.exe is Trojan/Backdoor W32/Rbot-JP.
Kill the process win32x.exe and remove win32x.exe from Windows startup.
http://www.sophos.com/virusinfo/analyses...

win32xp.dll
Win32xp.dll is Trojan/Backdoor.
Kill the file win32xp.dll and remove win32xp.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

win32xpsys.exe
Win32xpsys.exe is a Backdoor W32.Spybot.NYT.
Win32xpsys.exe spreads via open network shares .
Win32xpsys.exe tries to terminate antiviral programs installed on a user computer.
Win32xpsys.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\win32xpsys.exe
Adds the value:
"Microsoft Xp Systems loaders" = "win32xpsys.exe"
to the Windows startup registry keys.
More info:
http://securityresponse.symantec.com/avc...
Removal:
Kill win32xpsys.exe process and remove win32xpsys.exe from Windows startup using RegRun Startup Optimizer.

win3c2.tmp.exe
WIN3C2.TMP.EXE is Trojan/Backdoor.
Kill the process WIN3C2.TMP.EXE and remove WIN3C2.TMP.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

win3cb.tmp.exe
Win3cb.tmp.exe is Trojan/Backdoor.
Kill the process win3cb.tmp.exe and remove win3cb.tmp.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

win47.tmp.exe
WIN47.TMP.EXE is Trojan/Backdoor.
Kill the process WIN47.TMP.EXE and remove WIN47.TMP.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

win5.exe
Win5.exe is Trojan/Backdoor.
Kill the process win5.exe and remove win5.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

win57046.dll
Win57046.dll is Trojan/Backdoor.
Kill the file win57046.dll and remove win57046.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

win710.exe
Win710.exe is Trojan/Backdoor.
Kill the process win710.exe and remove win710.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

win86.exe
Troj/Small-PB
Aliases: TrojanDownloader.Win32.Small.pb, Downloader-KH trojan, TROJ_SYSGOTEM.A
It is a Trojan that executes the files System87.dll and System86.dll.
If the files do not exist, the Trojan downloads System86.dll from a preconfigured URL and executes it.

In order to run automatically each time Windows is started, the Trojan sets the following registry entry:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinInit = Win86.exe

Please, remove it with RegRun.

win86.tmp.exe
Win86.tmp.exe is Trojan/Backdoor.
Kill the process win86.tmp.exe and remove win86.tmp.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

win98.exe
Win98.exe is Trojan/Backdoor.
Kill the process win98.exe and remove win98.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

win98nuke.exe
Remote Access / ICQ trojan / IRC trojan

win9x.exe
Win9x.exe is Trojan/Backdoor WOOTBOT.I WORM.
Kill the process win9x.exe and remove win9x.exe from Windows startup.

wina2b3.pif
I-Worm.Winevar.
Dangerous virus.
Creates execution file with random name like "WINAB3.pif" in C:\\WINDOWS\\SYSTEM.
Also installs "explorer.pif" to the desktop.
To remove:
stop process "winab3" and remove from startup.
Delete dangerous "pif" files.

winabc3.exe
Winabc3.exe is W32.Safook.
Read more:
http://www.symantec.com/enterprise/secur...
Kill the process winabc3.exe and remove winabc3.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winable.exe
Winable.exe is Trojan/Backdoor.
Kill the process winable.exe and remove winable.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winadctlx.dll
WinAdCtlX.dll is Adware WinUpdates.
Kill the file WinAdCtlX.dll and remove WinAdCtlX.dll from Windows startup.
http://labs.paretologic.com/spyware.aspx...

winadll.exe
Winadll.exe is Trojan/Backdoor.
Kill the process winadll.exe and remove winadll.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winadservx.dll
WinAdServX.dll is Adware.SyncroAd.
Read more:
http://www.symantec.com/security_respons...
Kill the file WinAdServX.dll and remove WinAdServX.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

winadtools.exe
WinAdTools.exe is Adware.
Kill the process WinAdTools.exe and remove WinAdTools.exe from Windows startup.

winadx.dll
WinadX.dll is Trojan/Backdoor WUpd.
Kill the file WinadX.dll and remove WinadX.dll from Windows startup using RegRun.
www.regrun.com

winafd32.dll
WINAFD32.DLL is Trojan/Backdoor.
Kill the file WINAFD32.DLL and remove WINAFD32.DLL from Windows startup using RegRun Reanimator.
http://www.regrun.com

winaff32.dll
Winaff32.dll is Trojan/Backdoor.
Kill the file winaff32.dll and remove winaff32.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

winamp32.exe
Winamp32.exe is Trojan/Backdoor Agobot.
Kill the process winamp32.exe and remove winamp32.exe from Windows startup.
http://www.sophos.com/virusinfo/analyses...

winampb.exe
Winampb.exe is Trojan.Baiso.
Related files:
%Windir%\realupdate.exe - a file used to update itself
%Windir%\winampb.exe
%System%\A4\baisob\avpb.exe
%System%\A4\baisob\dllhostb.dll
%System%\A4\baisob\novel.exe
%System%\A4\baisob\up.dat
%System%\A4\baisob\verx.dat
Read more:
http://www.symantec.com/enterprise/secur...
Kill the process winampb.exe and remove winampb.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winampp.exe
Winampp.exe is Trojan/Backdoor.
Kill the process winampp.exe and remove winampp.exe from Windows startup.

winamps.exe
Winamps.exe is Trojan/Backdoor.
Kill the process winamps.exe and remove winamps.exe from Windows startup.

winang.dll
We suggest you to remove winang.dll from your computer as soon as possible.
Winang.dll is Trojan/Backdoor.
Kill the file winang.dll and remove winang.dll from Windows startup.

winapi23.exe
Winapi23.exe is Trojan/Backdoor.
Kill the process winapi23.exe and remove winapi23.exe from Windows startup.

winapi32.exe
Winapi32.exe is Trojan/Backdoor Rbot.
Kill the process winapi32.exe and remove winapi32.exe from Windows startup.

winapi64.exe
Winapi64.exe is Trojan/Backdoor.
Kill the process winapi64.exe and remove winapi64.exe from Windows startup.

winaqr32.dll
Winaqr32.dll is Trojan/Backdoor.
Kill the file winaqr32.dll and remove winaqr32.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

winaspsnet.exe
WINASPSNET.EXE is Trojan/Backdoor.
Read more:
http://fileinfo.prevx.com/adware/qq6bc31...
Kill the process WINASPSNET.EXE and remove WINASPSNET.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

winavx.exe
WinAvX.exe is Trojan.Virantix.
Trojan.Virantix is a Trojan horse that may download potentially malicious files and lower security settings on the compromised computer.
Read more:
http://www.symantec.com/enterprise/secur...
Kill the process WinAvX.exe and remove WinAvX.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winavxx.exe
Winavxx.exe is Trojan/Backdoor.
Kill the process winavxx.exe and remove winavxx.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winbjt32.dll
Winbjt32.dll is Trojan.Agent.vg.
Kill the file winbjt32.dll and remove winbjt32.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

winbjv32.dll
Winbjv32.dll is Trojan/Backdoor.
Kill the file winbjv32.dll and remove winbjv32.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

winbl8.exe
Winbl8.exe is Trojan/Backdoor.
Kill the process winbl8.exe and remove winbl8.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winbo32.exe
Winbo32.exe is Trojan/Backdoor.
Kill the process winbo32.exe and remove winbo32.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winboot.exe
Vampire 1.2 trojan

winbug32.dll
Winbug32.dll is Trojan/Backdoor.
Kill the file winbug32.dll and remove winbug32.dll from Windows startup using Regrun.
www.regrun.com

win-bugsfix.exe
Worm / IRC Trojan / Mail trojan / Destructive trojan / Steals passwords
The worms spread through mail or IRC. It will also try to destroy all files with the extensions .vbs, .vbe, .js, jse,.css, .wsh, .sct, .hta and jpg, jpeg, mp3 and mp2 files. May be updated from the Internet.

winbxwrn.exe
WINBXWRN.EXE is Trojan/Backdoor.
Read more:
http://fileinfo.prevx.com/adware/qqd5188...
Kill the process WINBXWRN.EXE and remove WINBXWRN.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

wincab.sys
Wincab.sys is Infostealer.Perfwo.B.
Related files:
%Temp%\cs.dll
%System%\wincab.sys
%Temp%\[RANDOM NAME].sys
Read more:
http://www.symantec.com/enterprise/secur...
Kill the file wincab.sys and remove wincab.sys from Windows startup using RegRun Reanimator.
http://www.regrun.com

wincalc.exe
Backdoor.Paproxy is a Backdoor Trojan horse that allows the infected computer to be used as a network proxy.
Opens a backdoor onto the computer.

Copies itself to %System%\Wincalc.exe.
Attempts to connect to http:/ /www.yahoo.com on port 80 using a POST method.
Attempts to connect to smtp.westcowboy.com on port 80.

Manual removal:
Navigate to the keys:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunService
and delete the value: "LogService"="%System%\Wincalc.exe"

Navigate to the key: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
and delete the values:
"ProxyServer" = ";"
"ProxyEnable" = "1"

Navigate to the key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon
and change the value: "Shell"="Explorer.exe %System%\Wincalc.exe"
to "Shell"="Explorer.exe"

winccf32.dll
Winccf32.dll is Trojan.Agent.qt.
Kill the file winccf32.dll and remove winccf32.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

wincfg.exe
FTP server (?) / Remote Access

wincfg32.exe
Worm Ronoper trojan.
Stop this process and remove from startup.

wincfgkop9.exe
WINCFGKOP9.EXE is WORM_RBOT.BVD.
Read more:
http://www.trendmicro.com/vinfo/virusenc...
Kill the process WINCFGKOP9.EXE and remove WINCFGKOP9.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

wincheck.exe
Wincheck.exe is Trojan/Backdoor.
Kill the process wincheck.exe and remove wincheck.exe from Windows startup.
http://www.securitystronghold.com/enc/Wi...

winclean.exe
Winclean.exe is SPYBOT worm.
Read more:
http://securityresponse.symantec.com/avc...
Kill the process winclean.exe and remove winclean.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

wincmp32.exe
Asylium Family (0.1 & 0.11 & 0.12 & 0.13) trojan
Copies to C:\WINDOWS\SYSTEM\wincmp32.exe
[System.ini]
shell=explorer.exe wincmp32.exe
This is the default starting method, note that these are fully customisable including the filename
and registry keynames.

wincntrl.exe
Wincntrl.exe is Trojan/Backdoor Worm.Rbot Variant.
Kill the process wincntrl.exe and remove wincntrl.exe from Windows startup.
www.superadblocker.com/definition/wincntrl/

wincom32.sys
Wincom32.sys is Trojan/Backdoor.
Kill the file wincom32.sys and remove wincom32.sys from Windows startup using RegRun Reanimator.
http://www.regrun.com

wincore.exe
Wincore.exe is Trojan/Backdoor.
Kill the process wincore.exe and remove wincore.exe from Windows startup.

wincore32.exe
Wincore32.exe is Troj/Clicker-EN.
Read more:
http://www.sophos.com/security/analyses/...
Kill the process wincore32.exe and remove wincore32.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

wincrash.exe
Remote Access / Steals passwords
Alters Win.ini (v 2.0).

wincrash-e.exe
Remote Access / Steals passwords
Alters Win.ini (v 2.0).

wincreat.dll
WINCREAT.DLL is Trojan/Backdoor.
Kill the file WINCREAT.DLL and remove WINCREAT.DLL from Windows startup using RegRun Reanimator.
http://www.regrun.com

wincrt.exe
WINCRT.EXE is Troj/Aledo-A.
Read more:
http://www.sophos.com/security/analyses/...
Kill the process WINCRT.EXE and remove WINCRT.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

wincsg32.dll
Wincsg32.dll is Trojan/Backdoor.
Kill the file wincsg32.dll and remove wincsg32.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

winctl.dll
Winctl.dll is Troj/Dloadr-BDA.
Related files:
%Windows%\svchost.exe
%Common Files%\winctl.dll - Detected as Troj/Dloadr-BDA.
%Root%\oops.dll - Detected as Troj/Dloadr-BDA.
%Root%\pagefile.sys - Detected as Troj/Dloadr-BDA.
Read more:
http://www.sophos.com/security/analyses/...
Kill the file winctl.dll and remove winctl.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

winctl32.exe
Winctl32.exe is Trojan/Backdoor.
Kill the process winctl32.exe and remove winctl32.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winctladx.dll
WinCtlAdX.dll is Adware WinUpdates.
Kill the file WinCtlAdX.dll and remove WinCtlAdX.dll from Windows startup.
http://labs.paretologic.com/spyware.aspx...

winctrl16.exe
Winctrl16.exe is Trojan/Backdoor.
Kill the process winctrl16.exe and remove winctrl16.exe from Windows startup.

winctrl32.exe
Winctrl32.exe is Trojan/Backdoor.
Kill the process winctrl32.exe and remove winctrl32.exe from Windows startup.

winctrl64.exe
Winctrl64.exe is Trojan/Backdoor.
Kill the process winctrl64.exe and remove winctrl64.exe from Windows startup.

wind0ws.exe
WIND0WS.EXE is a Spyware.WebSurfWatch.
WIND0WS.EXE monitors user Internet activity.
Related files:
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\WIND0WS.EXE
%ProgramFiles%\SWIS\WSW.exe
%Windir%\RSR2B.EXE
More info:
http://securityresponse.symantec.com/avc...
Removal:
Kill WIND0WS.EXE process and remove WIND0WS.EXE from Windows startup using RegRun Startup Optimizer.

wind32.exe
Wind32.exe is W32/Agobot-BZ.
Read more:
http://www.sophos.com/virusinfo/analyses...
Kill the process wind32.exe and remove wind32.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

windat.exe
Windat.exe is Trojan/Backdoor.
Kill the process windat.exe and remove windat.exe from Windows startup.
http://securityresponse.symantec.com/avc...

windb32.exe
Windb32.exe is Worm/Skipi.C.
Related files:
%SYSDIR%\stwinsdat.exe
%SYSDIR%\odcwinst.exe
%SYSDIR%\windb32.exe
%SYSDIR%\servftc.exe
Read more:
http://www.avira.com/en/threats/section/...
Kill the process windb32.exe and remove windb32.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

windbg48.sys
Windbg48.sys is Trojan.Srizbi.
Trojan.Srizbi is a Trojan horse that sends spam and uses a rootkit to hide itself.
Read more:
http://www.symantec.com/enterprise/secur...
Kill the file windbg48.sys and remove windbg48.sys from Windows startup using RegRun Reanimator.
http://www.regrun.com

windbv3.exe
WINDBV3.EXE is Trojan/Backdoor.
Kill the process WINDBV3.EXE and remove WINDBV3.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

windcmdt.exe
Windcmdt.exe is Trojan/Backdoor.
Kill the process windcmdt.exe and remove windcmdt.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

windexserv.dll
Windexserv.dll is Adware.Cydoor.
Read more:
http://research.sunbelt-software.com/thr...
Kill the file windexserv.dll and remove windexserv.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

windfire.exe
Windfire.exe is W32/Xema.A.
Related files:
%SysDir%\c_10810.nls
%SysDir%\c_19460.nls
%SysDir%\inter32.dll
%SysDir%\msregsv.exe
%SysDir%\serlibk.exe
%SysDir%\shell64.dll
%SysDir%\shlmon.exe
%SysDir%\windfire.exe
Read more:
http://www.pspl.com/virus_info/worms/xem...
Kill the process windfire.exe and remove windfire.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

windg32.exe
Windg32.exe is Trojan/Backdoor.
Kill Windg32.exe process and remove Netts32.exe from Windows startup.
Also related Trojan files:
nettts32.exe
netts32.exe
crgy32.exe

windir.exe
Windir.exe is Trojan/Backdoor.
Related files:
1 :%CACHE%\CONTENT.IE5\????????\DOMAIN[1].EXE
2 :%PROGRAMFILES%%WINDIR%\DMZ.EXE
3 :%PROGRAMFILES%%WINDIR%\WINDIR.EXE
4 :%WINDIR%\CONN.EXE
5 :%WINDIR%\CONNN.EXE
6 :%WINDIR%\CONNZ.EXE
7 :%WINDIR%\DMAIN.EXE
8 :%WINDIR%\DMAN.EXE
9 :%WINDIR%\DMZ.EXE
10:%WINDIR%\DOMAIN.EXE
Read more:
http://fileinfo.prevx.com/QQ4ed317989877...
Kill the process windir.exe and remove windir.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

windir32.exe
Windir32.exe is Trojan/Backdoor Threat: SdBot.BHF.
Kill the process windir32.exe and remove windir32.exe from Windows startup.

windll.dll
Backdoor.BO trojan

windll.exe
Steals passwords

windll32.exe
Remote Access

windll332.exe
Windll332.exe is Trojan/Backdoor.
Kill the process windll332.exe and remove windll332.exe from Windows startup.

windllc.exe
Windllc.exe is Trojan/Backdoor.
Kill the process windllc.exe and remove windllc.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

windmxm32.exe
WINDMXM32.EXE is Trojan/Backdoor.
Kill the process WINDMXM32.EXE and remove WINDMXM32.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

windns.exe
Windns.exe is a virus.
Kill the process windns.exe and remove windns.exe from Windows startup.

windns32.exe
W32.Gaobot.WX is a worm that attempts to spread through network shares that have weak passwords.
It allows attackers to access an infected computer through IRC.

Also Known As: WORM_AGOBOT.WN, Backdoor.Agobot.li, W32/Gaobot.worm.gen.g

Copies itself as %System%\Windns32.exe.
Adds the value: "WinDNS" = "windns32.exe"
to the registry keys:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices

Connects to an IRC server and listens for commands.
Allows an attacker to control an infected computer:
- Download and execute files
- Steal system information
- Steal CD keys for various video games
- Take screenshots
- Terminate processes
- Run a SOCKS server on a compromised system

Uses a list of user names and passwords.
Ends many processes that are associated with the antivirus and firewall software.
Attempts to delete the files and registry values associated with other worms.

Use RegRun Startup Optimizer to remove it from startup.

window.exe
Remote Access
Renamed and modified versions of Sub Serven.

windown.exe
Remote Access / Steals passwords
Also has a function called ""Burn Monitor"". This option constantly resets the Screenresolution.

windows 32-bit pnp driver
Winpnp32.exe is Trojan/Backdoor W32.Wallz.
Winpnp32.exe creates a service:
display name: Windows 32-bit PnP Driver
service name: winpnp32
Executable file: %SysDir%\Winpnp32.exe
Winpnp32 infects other computer in the network by enumerating IP addresses.
http://securityresponse.symantec.com/avc...
Disable the winpnp32 service, delete the service using RegRun.
Delete the winpnp32.exe file

windows explorer.exe
Windows Explorer.exe is W32.Redlofwen.
W32.Redlofwen is a worm that spreads by copying itself to all drives on the compromised computer, including removable and mapped drives.
Related files:
New Folder.exe
Top Pictures.exe
Windows Explorer.exe
Read more:
http://www.symantec.com/enterprise/secur...
Kill the process Windows Explorer.exe and remove Windows Explorer.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

windows.exe
Worm.P2P.Kazmor.a
Kazmor is a P2P (peer to peer) and network worm with backdoor abilities.
This worm is very closely related to another worm - Worm.Win32.Apart.

The backdoor routine allows a remote master to perform the following actions on victim computers:
- send out detailed computer information
- steal cached passwords, MSN account login and password, as well as .NET Messenger information.
Kazmor also performs the following routines, it:
- spreads over local networks and to P2P networks
- receives files or download files from a Web site
- executes a file
- performs DoS attacks on remote computers
- pings a remote computer
- scans ports and IP addresses
- redirects PC ports
- sends spam messages through AOL Instant Messenger and to a mIRC channel

Manual removal:
Find and delete the following key in the system registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Windows = %WindowsDir%\Windows.exe

windows-.exe
WINDOWS-.EXE is Trojan/Backdoor.
Kill the process WINDOWS-.EXE and remove WINDOWS-.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

windows_critical_update.exe
Windows_critical_update.exe is Trojan/Backdoor.
Kill the process Windows_critical_update.exe and remove Windows_critical_update.exe from Windows startup.
http://securityresponse.symantec.com/avc...

windows_e52.exe
Windows_e52.exe is Trojan/Backdoor.
Kill the process windows_e52.exe and remove windows_e52.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

windows16.exe
Windows16.exe is Troj/VB-XU.
Related files:
%Windows%\cursors\windows16.exe
%System%\config\anvshell32.exe
%System%\drivers\wmilib32.exe
%System%\windows32.exe
Read more:
http://www.sophos.com/security/analyses/...
Kill the process windows16.exe and remove windows16.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

windows32.exe
WINDOWS32.exe is Trojan/Backdoor.
Kill the process WINDOWS32.exe and remove WINDOWS32.exe from Windows startup.

windowscfg.exe
This is variation of trojan Backdoor.Sdbot.
Stop this process using Process Manager afetr that remove it from startup by Start Control, delete file.

windowsdll.exe
Windowsdll.exe is Trojan/Backdoor BKDR_GRAYBIRD.
Kill the process windowsdll.exe and remove windowsdll.exe from Windows startup.

windowseditor.exe
WINDOWSEDITOR.EXE is Trojan/Backdoor.
Kill the process WINDOWSEDITOR.EXE and remove WINDOWSEDITOR.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

windowshosts.exe
Windowshosts.exe is Trojan/Backdoor.
Kill the process windowshosts.exe and remove windowshosts.exe from Windows startup.

windowslockdown.exe
Windowslockdown.exe is W32/IRCBot-SP.
Related files:
adware.exe
Read more:
http://www.sophos.com/security/analyses/...
Kill the process windowslockdown.exe and remove windowslockdown.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

windowsmedi.exe
WINDOWSMEDI.EXE is Trojan/Backdoor.
Kill the process WINDOWSMEDI.EXE and remove WINDOWSMEDI.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

windowsnfo.exe
Windowsnfo.exe is Trojan/Backdoor.
Kill the process windowsnfo.exe and remove windowsnfo.exe from Windows startup.

windowsupd1.exe
WindowsUpd1.exe is Adware.VirtuMonde.
Related files:
%Windir%\WindowsUpd1.exe
sysupd.exe
Read more:
http://www.powerquest.com/avcenter/venc/...
Kill the process WindowsUpd1.exe and remove WindowsUpd1.exe from Windows startup using RegRun.
www.regrun.com

windowsupd2.exe
Windowsupd2.exe is Virtumonde adware.
Read more:
http://www3.ca.com/securityadvisor/pest/...
Kill the process windowsupd2.exe and remove windowsupd2.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

windowsupdate.exe
Windowsupdate.exe is Trojan.Bayrob.
Trojan.Bayrob is a Trojan horse that establishes a proxy server and steals sensitive information from the compromised computer.
Related files:
%System%\windowsupdate.exe
%System%\4033ccf\cfg
Read more:
http://www.symantec.com/enterprise/secur...
Kill the process windowsupdate.exe and remove windowsupdate.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

windowsupdaterr.exe
Windowsupdaterr.exe is W32/Spybot.gen3 Malware.
Read more:
http://sandbox.norman.no/live_2.html?log...
Kill the process windowsupdaterr.exe and remove windowsupdaterr.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

windowsupdates.exe
Windowsupdates.exe is WORM_SDBOT.CLU.
Read more:
http://www.trendmicro.com/vinfo/virusenc...
Kill the process windowsupdates.exe and remove windowsupdates.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

windowsxxx.exe
Windowsxxx.exe is Trojan/Backdoor.
Read more:
http://www.incodesolutions.com/threats/S...
Kill the process windowsxxx.exe and remove windowsxxx.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

windowxs.exe
W32/Sdbot-KT
This is an IRC backdoor Trojan and network worm which can run in the background as a service process and allow unauthorised remote access via the IRC channel.
It copies itself to the Windows System folder as WINDOWXS.EXE and creates the following registry entries so that this worm is run automatically on system restart:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\winlog = windowxs.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\winlog = windowxs.exe

W32/Sdbot-KT remains resident listening for commands from the remote hacker.
If the appropriate commands are received the worm will begin scanning the internet for network shares with weak administrator passwords and will attempt to copy itself to these shares.
This worm can also initiate SYNFlood attacks, exploit computers infected with W32/MyDoom and attempt to steal CD keys from several computer games.

Use RegRun Startup Optimizer to remove it from startup.

windowz.exe
W32.Randex.AEV is a network-aware worm that tries to connect to a predetermined IRC server.
If this worm is successful, it will wait for instructions from the attacker.

Copies itself as %System%\Windowz.exe.
Generates a random IP address.
The worm then attempts to log in to the remote computer as Administrator.

Adds the value: "Microsoft Windows GUI"="Windowz.exe"
to the registry keys:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices

Connects to an IRC server and waits for commands from a remote attacker.
The attacker can:
- Perform Distributed Denial of Service (DDOS) attacks.
- Scan for computers to infect.
- Retrieve system information from the infected computer, such as CPU speed, available memory, and Windows version.
- Download and execute files from the Internet.
- Perform IRC functions, such as removing other users from the IRC channel.

Use RegRun Startup Optimizer to remove it from startup.

windr32.exe
Windr32.exe is Toolbar888 Adware.
Related files:
activate.exe
windr32.exe
n.exe
aupdate32.exe
menu5.exe
mytoolbar.dll
Read more:
http://www.securemost.com/articles/rm_to...
Kill the process windr32.exe and remove windr32.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

windriv32.exe
Troj/Small-BA is a proxy Trojan for the Windows platform.
Allows a malicious user to route information through an infected computer.
When executed it copies itself to the Windows system folder as WinDriv32.exe and then runs the copy which attempts to report the infection to a webpage.
Creates the following registry entries:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\WinDriv32 C:\WINDOWS\System32\WinDriv32.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\WinDriv32 C:\WINDOWS\System32\WinDriv32.exe

Remove it from startup with RegRun Startup Optimizer.

windrive32.exe
Windrive32.exe is Trojan/Backdoor.
Kill the process windrive32.exe and remove windrive32.exe from Windows startup.

windriver.exe
W32/Lovgate-AP is a worm which spreads by emailing itself via its own SMTP engine and by copying itself to network shares.
The worm also allows unauthorised remote access to the computer via a network.

W32/Lovgate-AP copies itself to the Windows system folder as windriver.exe and winexe.exe and adds entries to the registry at the following locations to run itself on system restart:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

The worm also modifies the entry in the registry at the following location to run itself before files with an EXE extension:
HKCR\exefile\Shell\open\command

windriver32.exe
Windriver32.exe is Trojan/Backdoor.
Kill the process windriver32.exe and remove windriver32.exe from Windows startup.

windrives.exe
WinDrives.EXE is W32/Agobot-RB.
Read more:
http://www.sophos.com/virusinfo/analyses...
Kill the process WinDrives.EXE and remove WinDrives.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

windrv32.exe
Mydoom.t is an Internet worm that spreads via an email attachment.
This Mydoom variant spreads by connecting directly to potential victim SMTP servers by constructing SMTP server names based on domain names it harvests from the infected machine.
Also contains a downloader function that attempts to download Backdoor.Win32.Surila from the following sites:
http://vugs.geog.uu.nl
http://www.ach.ch
http://www.hiw.kuleuven.ac.be
http://www.llc.unibo.it
http://www.mercyships.de
http://www.planetboredom.net
http://www.surrenderzeeland.nl

Remove it by using RegRun Startup Optimizer.

windrvdl.exe
WINDRVDL.EXE is Trojan/Backdoor Troj/Enviar-H.
Kill the process WINDRVDL.EXE and remove WINDRVDL.EXE from Windows startup.
http://www.sophos.com/virusinfo/analyses...

windservc.exe
WINDSERVC.EXE is Trojan/Backdoor.
Kill the process WINDSERVC.EXE and remove WINDSERVC.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

windumprep32.exe
Windumprep32.exe is Trojan/Backdoor.
Kill the process windumprep32.exe and remove windumprep32.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

windvd98.exe
W32.HLLW.Cult.P@mm is a mass-mailing worm that uses its own SMTP engine to send itself to randomly generated email addresses.
The worm also has IRC Trojan functionality that allows an attacker to control infected computer by using Internet Relay Chat (IRC).
The commands allow the attacker to perform any of the following actions:
Deliver system and network information to the attacker
Download and execute files
Dynamically update the installed worm
Send the worm to other IRC channels to attempt to compromise more computers
Trigger a mass-mailing function
Send email that contains the worm to any email address

Variants: W32.HLLW.Cult.M@mm

The email message has the following characteristics:
Subject: Hello , I sent you a beautiful Love Card ^_*

Body:
To see your Card, Please open the attachment
If you want to send a reply, please visit
http:/ /www.Love-card.com/Love/index.html

Thank You...

Attachment: BeautyLove.pif


Copies itself as %System%\Windvd98.exe.

Adds the value:
"dvd98"="windvd98.exe"
to the registry keys:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
so that the worm runs when you start Windows.

Automatic Removal:
Use RegRun Startup Optimizer to remove it from the system registry.

windwrwsk.exe
WINDWRWSK.EXE is Trojan/Backdoor.
Kill the process WINDWRWSK.EXE and remove WINDWRWSK.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

windws.exe
Windws.exe is Trojan/Backdoor AGOBOT.
Kill the process windws.exe and remove windws.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

windwv32.dll
Windwv32.dll is Trojan/Backdoor.
Kill the file windwv32.dll and remove windwv32.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

windx32.dll
Windx32.dll is TrojanDownloader.Agent.bc.
Read more:
http://www3.ca.com/securityadvisor/pest/...
Kill the file Windx32.dll and remove Windx32.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

windxp.exe
Windxp.exe is W32.Mysamurai.
W32.Mysamurai is a worm that spreads by copying itself to shared drives.
Related files:
%Temp%\[TEMP NAME].tmp
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\AdobeGama.pif
%User Profile%\Start Menu\Programs\Startup\AdobeGama.pif
C:\System Volume Information\_Resto~1\htSystem.cfg
%Windir%\explore.exe
%System%\CommandPrompt.Sysm
%System%\NvMedia.sysm
%System%\Restoration.msd
%System%\Windows 3D.scr
%System%\odbcad32.dll
%System%\shareNet.msd
%System%\Ngsys.exe
%System%\runer.exe
%System%\rvshost.exe
%System%\system31.exe
%System%\userint.exe
%System%\windxp.exe
%System%\winzipt.exe
Read more:
http://www.symantec.com/enterprise/secur...
Kill the process windxp.exe and remove windxp.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winecx32.dll
Winecx32.dll is Trojan/Backdoor.
Kill the file winecx32.dll and remove winecx32.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

winegi32.dll
WINEGI32.DLL is Trojan/Backdoor.
Kill the file WINEGI32.DLL and remove WINEGI32.DLL from Windows startup using RegRun Reanimator.
http://www.regrun.com

wineij32.dll
Wineij32.dll is Trojan/Backdoor.
Kill the file wineij32.dll and remove wineij32.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

wineil32.dll
Wineil32.dll is Trojan/Backdoor.
Kill the file wineil32.dll and remove wineil32.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

winemx32.dll
Winemx32.dll is Trojan-Clicker.Win32.Small.kb.
Kill the file winemx32.dll and remove winemx32.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

winepi32.dll
Winepi32.dll is Trojan/Backdoor.
Kill the file winepi32.dll and remove winepi32.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

winetn32.dll
WINETN32.DLL is Trojan/Backdoor.
Kill the file WINETN32.DLL and remove WINETN32.DLL from Windows startup using RegRun Reanimator.
http://www.regrun.com

winetw32.dll
Winetw32.dll is Trojan/Backdoor.
Kill the file winetw32.dll and remove winetw32.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

wineva32.dll
WINEVA32.DLL is Trojan Vundo.
Kill the file WINEVA32.DLL and remove WINEVA32.DLL from Windows startup using RegRun Reanimator.
http://www.regrun.com

winex.exe
Winex.exe is an adware program Adware.WindowEnhancer.
Winex.exe downloads and displays advertisements.
Related files:
winex.exe
More info:
http://securityresponse.symantec.com/avc...
Removal:
Kill winex.exe process and remove winex.exe from Windows startup using RegRun Startup Optimizer.

winexe.exe
Steals passwords / ICQ trojan / Mail trojan
"Copies itself to your outgoing email as an attachment." (MooSoft)

winexec32.exe
Virus W32.HLLW.Redist.B.
It's spreaded by e-mail or by file sharing network.
Copies its body to the files:
# %Windir%\Winexec32.exe
# %System%\Wininet32.ocx
# %System%\Mscab1_32.cab
# %System%\Mscab2_32.cab
# %System%\Mscab3_32.cab
# %System%\Mscab4_32.cab
# %System%\Mscab5_32.cab
# %System%\Mscab6_32.cab
# %Windir%\.exe
# %Windir%\.pif
# %Windir%\Card_0.pif
# %Windir%\JokeBook.pif
# %Windir%\Hackers.pif
# %Windir%\P2PInstall.exe
# %Windir%\New WinZip File.pif
# %Windir%\New Microsoft Word Document.pif
# %Windir%\New Microsoft Excel Worksheet.pif
# %Windir%\New Microsoft PowerPoint Presentation.pif
# %Windir%\New Text Document.pif
# %Windir%\New Bitmap Image.pif
Where %Windir% is your Windows folder.
Terminates known antivirus programs/
More info:
http://securityresponse.symantec.com/avc...
Remove it from startup by Start Control.

winexplorer.exe
WinExplorer.exe is Trojan/Backdoor.
Kill the process WinExplorer.exe and remove WinExplorer.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winext.exe
Worm / Mail trojan
Alters Win.ini. The worm is encrypted. It propagates to users who earlier has mailed the user of the infected computer.

winexy32.dll
WINEXY32.DLL is Trojan.Agent.qt.
Kill the file WINEXY32.DLL and remove WINEXY32.DLL from Windows startup using RegRun Reanimator.
http://www.regrun.com

winexz32.dll
Winexz32.dll is Malware.
Read more:
http://www.spywaredata.com/spyware/malwa...
Kill the file winexz32.dll and remove winexz32.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

winezn32.dll
Winezn32.dll is Trojan/Backdoor.
Kill the file winezn32.dll and remove winezn32.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

winf49.sys
WINF49.SYS is Trojan/Backdoor.
Kill the file WINF49.SYS and remove WINF49.SYS from Windows startup using RegRun Reanimator.
http://www.regrun.com

winfat32.exe
Worm / IRC Trojan / Mail trojan / Destructive trojan / Steals passwords
The worms spread through mail or IRC. It will also try to destroy all files with the extensions .vbs, .vbe, .js, jse,.css, .wsh, .sct, .hta and jpg, jpeg, mp3 and mp2 files. May be updated from the Internet.

winfbi32.dll
WINFBI32.DLL is Backdoor.Ginwui.F.
Backdoor.Ginwui.F is a Trojan horse that opens a back door and uses rootkit techniques to hide its presence.
Related files:
%Temp%\ excel.exe
%Temp%\[ORIGINAL FILE NAME].pps
%System%\US2.EXE
%System%\kb20060919.log
%System%\WINFBI32.DLL
Read more:
http://www.symantec.com/enterprise/secur...
Kill the file WINFBI32.DLL and remove WINFBI32.DLL from Windows startup using RegRun Reanimator.
http://www.regrun.com

winfire.exe
WINFIRE.EXE is Trojan/Backdoor.
Kill the process WINFIRE.EXE and remove WINFIRE.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

winfirewall.exe
Winfirewall.exe is Trojan/Backdoor Spybot.
Kill the process winfirewall.exe and remove winfirewall.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winfix.exe
Winfix.exe is Trojan/Backdoor Sdbot.
Kill the process winfix.exe and remove winfix.exe from Windows startup.

winfixer.exe
Winfixer.exe is Trojan/Backdoor.
Kill the process winfixer.exe and remove winfixer.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winfont.exe
Destructive trojan
Formats the hard drive.

winform.exe
Winform.exe is WindUpdates.WindowsFormatAd Adware.
Related files:
%program_files%\ windows formatad\ winform.exe
%program_files%\ windows formatad\ winformcomm.dll
%program_files%\ windows formatad\ winformkeep.exe
%WINDOWS%\ downloaded program files\ winformx.dll
winform.exe
winformkeep.exe
Kill the process winform.exe and remove winform.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winforma4.exe
WINFORMA4.EXE is Trojan/Backdoor.
Read more:
http://fileinfo.prevx.com/adware/qq03721...
Kill the process WINFORMA4.EXE and remove WINFORMA4.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

winformkeep.exe
Winformkeep.exe is WindUpdates.WindowsFormatAd Adware.
Related files:
%program_files%\ windows formatad\ winform.exe
%program_files%\ windows formatad\ winformcomm.dll
%program_files%\ windows formatad\ winformkeep.exe
%WINDOWS%\ downloaded program files\ winformx.dll
winform.exe
winformkeep.exe
Kill the process winformkeep.exe and remove winformkeep.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winformx.dll
WINFORMX.DLL is WindUpdates.WindowsFormatAd Adware.
Related files:
%program_files%\ windows formatad\ winform.exe
%program_files%\ windows formatad\ winformcomm.dll
%program_files%\ windows formatad\ winformkeep.exe
%WINDOWS%\ downloaded program files\ winformx.dll
winform.exe
winformkeep.exe
Kill the file WINFORMX.DLL and remove WINFORMX.DLL from Windows startup using RegRun Reanimator.
http://www.regrun.com

winfp.exe
Winfp.exe is W32/IRCBot-XS.
Related files:
%Windows%\winfp.exe
%Windows%\img.zip
Read more:
http://www.sophos.com/security/analyses/...
Kill the process winfp.exe and remove winfp.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winftsap.dll
WINFTSAP.DLL is WORM_STRAT.GG.
Read more:
http://www.trendmicro.com/vinfo/virusenc...
Kill the file WINFTSAP.DLL and remove WINFTSAP.DLL from Windows startup using RegRun Reanimator.
http://www.regrun.com

winfunctions.exe
Remote Access
The trojan is encrypted.

winfw32.exe
WINFW32.EXE is Trojan/Backdoor.
WINFW32. creates in RunOnce reg key the value
Winsock2 driver=WINFW32.EXE
Related files:
ntjw.exe
javaox.exe
mfcnd.exe
crhc32.exe

wingenerics.dll
WinGenerics.dll is a Spyware.Apropos.
WinGenerics.dll is a Browser Helper Object.
WinGenerics.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Windir%\Downloaded Program Files\load.exe
%Windir%\Downloaded Program Files\monpop.exe
%Windir%\Downloaded Program Files\pop225.dll
%Windir%\Downloaded Program Files\pophook4.dll
%Windir%\Downloaded Program Files\PopSrv225.exe
%Temp%\auto_update_loader.exe
%Temp%\install_ct.exe
%Temp%\CXtPls.exe
%Temp%\ProxyStub.dll
%Temp%\WinGenerics.dll
%Temp%\ace.dll
%Temp%\atla.dll
%Temp%\atlw.dll
%Temp%\data.bin
%Temp%\libexpat.dll
%Temp%\ph.exe
%Temp%\pm.exe
%Temp%\setup.inf
%Temp%\uninstaller.exe
%Temp%\atl.dll
%System%\atmon.exe
%System%\intfaxui.exe
Adds the value:
"POP" = "C:\WINDOWS\Downloaded Program Files\PopSrv225.exe"
"AutoLoaderEnvoloAutoUpdater" = "auto_update_loader.exe"
"[random name]" = "intfaxui.exe"
"[random name]" = "atmon.exe"
to the Windows startup registry keys.
More info:
http://securityresponse.symantec.com/avc...
Removal:
Remove WinGenerics.dll from Windows startup using RegRun Startup Optimizer.

wingew32.dll
Wingew32.dll is Trojan/Backdoor.
Kill the file wingew32.dll and remove wingew32.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

winghy32.dll
Winghy32.dll is Trojan/Backdoor.
Kill the file winghy32.dll and remove winghy32.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

wingko32.dll
Wingko32.dll is Downloader.Agent.aej.
Kill the file wingko32.dll and remove wingko32.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

wingoa32.dll
Wingoa32.dll is Trojan/Backdoor.
Kill the file wingoa32.dll and remove wingoa32.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

wingob32.dll
Wingob32.dll is Trojan.Zlob.
Read more:
http://www.symantec.com/security_respons...
Kill the file wingob32.dll and remove wingob32.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

wingsa32.dll
WINGSA32.DLL is Trojan/Backdoor.
Kill the file WINGSA32.DLL and remove WINGSA32.DLL from Windows startup using RegRun Reanimator.
http://www.regrun.com

wingtp.exe
Wingtp.exe is W32/Rbot-VO.
Read more:
http://www.sophos.com/security/analyses/...
Kill the process wingtp.exe and remove wingtp.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

wingua.exe
Wingua.exe is Troj/Multidr-BP.
Related files:
%WINDOWS%\svchost.exe
%SYSTEM%\svchostc.exe
%SYSTEM%\wingua.exe
http://www.sophos.com/virusinfo/analyses...
Kill the process wingua.exe and remove wingua.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winguard.exe
Winguard.exe is W32.SouthPark.Worm.
Kill the process winguard.exe and remove winguard.exe from Windows startup.
http://securityresponse.symantec.com/avc...

winguz32.dll
Winguz32.dll is Trojan/Backdoor.
Kill the file winguz32.dll and remove winguz32.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

wingv32.dll
Wingv32.dll is Adware parasite.
Kill the file wingv32.dll and remove wingv32.dll from Windows startup.

wingzm32.dll
Wingzm32.dll is Trojan/Backdoor.
Kill the file wingzm32.dll and remove wingzm32.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

winhab32.dll
WINHAB32.DLL is Trojan/Backdoor.
Kill the file WINHAB32.DLL and remove WINHAB32.DLL from Windows startup using RegRun Reanimator.
http://www.regrun.com

winhdn32.dll
Winhdn32.dll is Trojan.Agent.qt.
Kill the file winhdn32.dll and remove winhdn32.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

winhe1p.exe
It is a result of the QQPASS.E Virus.

It is a password-stealing Trojan Horse that steals passwords and user information.
The Trojan is a Visual Basic application that requires the presence of Microsoft Visual Basic run-time libraries for it to run.

It copies itself as any or all of the following file names:
C:\Windows\Winhe1p.exe
C:\Program Files\Windows.exe
C:\Winnt\System\Command.exe

Adds these values:
"Winhelp"="C:\Windows\winhe1p.exe"
"Rundll32"="C:\Program Files\Windows.exe"
"COMMAND"="C:\Winnt\system\command.exe"
"Scanreg"="name of file from which the Trojan was originally run"
to these registry keys:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
so that the Trojan runs when you start Windows.

Opens ports 12880, 12881, 12882, and 12888 to send data to an address in China.
If it cannot open these ports, the Trojan then randomly opens ports until data can be sent.
Creates executables in the %Windir%\temp folder named PKGxxxxx.exe, where xxxxx may be any character or number.
(The file names are not always 8 characters long).


To manual removal, please navigate to each of these keys:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
and delete the values:
"Winhelp"="C:\Windows\winhe1p.exe"
"Rundll32"="C:\Program Files\Windows.exe"
"COMMAND"="C:\Winnt\system\command.exe"
"Scanreg"="name of file from which the Trojan was originally run"

Or use RegRun Startup Optimizer to automatic remove it from startup.

winhelp.exe
The W32.HLLW.Lovgate.O@mm worm is a variant of W32.HLLW.Lovgate@mm.
This variant is also a mass-mailing worm that attempts to reply to all the email messages in the Microsoft Outlook Inbox.
The "sender" of the email is spoofed and its subject line and message vary.
The attachment name varies with a .exe, .pif, or .scr file extension.
This worm also attempts to copy itself to all the computers on a local network using the weak passwords to attempt to log in as an Administrator
and to the Kazaa-shared folders.

Copies itself as the following: %Windir%\Systra.exe; %System%\iexplore.exe; %System%\Media32.exe; %System%\RAVMOND.exe; %System%\WinHelp.exe; %System%\Kernel66.dll

Creates a file named AUTORUN.INF in the root folder of all the drives, except the CD-ROM drives, and copies itself as COMMAND.EXE into that folder.
Creates a zip file . in the root folder of all the drives, unless the drive letter is A or B. For example: setup.rar or pass.zip.
Creates the following files: %System%\ODBC16.dll, %System%\msjdbc11.dll, %System%\MSSIGN30.DLL
These files are all the same—they are backdoor components of the worm.

Modifies the (Default) value of the registry key: HKEY_CLASSES_ROOT\exefile\shell\open\command
to: %System%\Media32.exe "%1" %* so that the worm runs when you execute any .exe files.
Terminates all the processes that contains any of the following strings:
KV, KAV, Duba, NAV, kill, RavMon.exe, Rfw.exe, Gate, McAfee, Symantec, SkyNet, rising

Manual removal:
In the key:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
please delete the values:
"Program in Windows"="%system%\iexplore.exe"
"VFW Encoder/Decoder Settings"="RUNDLL32.exe MSSIGN30.DLL ondll_reg"
"Winhelp"="%System%\WinHelp.exe"

Navigate to the key:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices
and delete the value:
"Systemtra"="%Windir%\Systra.exe"

In the key:
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows
delete the value:
"run"="RAVMOND.exe"

And delete the subkey, if exists:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ZMXLIB1

winhid64.dll
Winhid64.dll is Trojan/Backdoor.
Kill the file winhid64.dll and remove winhid64.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

winhld32.dll
WINHLD32.DLL is Trojan/Backdoor.
Kill the file WINHLD32.DLL and remove WINHLD32.DLL from Windows startup using RegRun.
www.regrun.com

winhlp16.exe
Winhlp16.exe is Trojan/Backdoor.
Kill the process winhlp16.exe and remove winhlp16.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winhlpp32.exe
Gaobot Trojan.
Spreads in local network via open shares.
Also it uses DCOM RPC vulnerability (135,445 ports) and WebDav vulnerability (port 80).
Allows to control the victim computer by IRC.
Terminates well known antiviral software.
Removal:
install the patches from Microsoft:
http://www.microsoft.com/technet/securit...
http://www.microsoft.com/technet/securit...
http://www.microsoft.com/technet/securit...
http://www.microsoft.com/technet/securit...
http://www.microsoft.com/technet/securit...
http://www.microsoft.com/technet/securit...
http://www.microsoft.com/technet/securit...
Set the strong passwords for network shares.
Use RegRun "Terminate" feature to erase the virus body files.
They are located in Windows\System32 folder.
Cavapsvc.exe
Csrrs.exe
Cvhost.exe
DIIhost.exe (with capital letter 'i')
Dosrun32.exe
Dos32.exe
Lsas.exe
Regloadr.exe
Schost.exe
Scvhost.exe
Service.exe
Servicess.exe
Sochost.exe
Swchost.exe
System.exe
Update.exe
Wdrun32.exe
Winhlpp32.exe
Winreg.exe
Winupdsdgm.exe

Free removal tool:
http://securityresponse.symantec.com/avc...

winhoo32.dll
Winhoo32.dll is Trojan.Agent.qt.
Kill the file winhoo32.dll and remove winhoo32.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

winhook32.exe
WinHook32.exe is W32.Mydoom.AC@mm.
W32.Mydoom.AC@mm is a mass-mailing worm that launches a Denial of Service (DoS) attack against a remote server. It can also spread through file-sharing networks.
Read more:
http://www.symantec.com/security_respons...
Kill the process WinHook32.exe and remove WinHook32.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winhoq32.dll
Winhoq32.dll is Trojan/Backdoor.
Kill the file winhoq32.dll and remove winhoq32.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

winhost.exe
Worm W32.Bropia.J.
Adds the value:
"win32" = "winhost.exe"
to the Windows startup registry keys.
Creates and execute the file:
C:\cz.exe
Related files
%System%\msnus.exe
C:\sexy.jpg
LOL.scr
Webcam.pif
bedroom-thongs.pif
naked_drunk.pif
LMAO.pif
ROFL.pif
underware.pif
Hot.pif
new_webcam.pif
Remove winhost.exe from Windows startup.

winhost32.exe
Winhost32.exe is Trojan/Backdoor Tequila Bandita 1.3b2.
Kill the process winhost32.exe and remove winhost32.exe from Windows startup.
http://www.megasecurity.org/trojans/t/to...

winhound.exe
WinHound.exe is Trojan/Backdoor.
Kill the process WinHound.exe and remove WinHound.exe from Windows startup.
http://www.google.com/url?sa=t&ct=res&cd...

winhttp.exe
Winhttp.exe is Trojan/Backdoor Downloader.Agent.
Kill the process winhttp.exe and remove winhttp.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winhv.exe
Winhv.exe is Trojan/Backdoor.
Kill the process winhv.exe and remove winhv.exe from Windows startup.

wini.exe
Wini.exe is a Backdoor W32.Picrate.B@mm.
Wini.exe spreads by e-mail and via open network shares.
Related files:
%System%\netstat.com
%System%\ping.com
%System%\tracert.com
%System%\tasklist.com
%System%\taskkill.com
%System%\regedit.com
%System%\cmd.com
%System%\wini.exe
%System%\xtc.tmp
%System%\Download.zip
%System%\bszip.dll
%System%\ANSMTP.DLL
Adds the value:
"IE Runtime" = "wini.exe"
to the Windows startup registry keys.
More info:
http://securityresponse.symantec.com/avc...
Removal:
Kill wini.exe process and remove wini.exe from Windows startup using RegRun Startup Optimizer.

winik.sys
WinIK.sys is component of CommonName - keyword service where you can type a company name instead of the complete URL when you want to view a website.
Kill the file WinIK.sys and remove WinIK.sys from Windows startup using RegRun Reanimator.
http://www.regrun.com

winimsg.exe
Winimsg.exe is a Backdoor W32.Allim.A.
Winimsg.exe spreads through America Online Instant Messenger (AIM).
Winimsg.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\winimsg.exe
Adds the value:
"Windows iMessenger Messenger" = "winimsg.exe"
to the Windows startup registry keys.
More info:
http://securityresponse.symantec.com/avc...
Removal:
Kill winimsg.exe process and remove winimsg.exe from Windows startup using RegRun Startup Optimizer.

wininfo.exe
W32.Kwbot.C.Worm.
When it works you can't see start menu/taskbar at Windows start.
The W32.Kwbot.C.Worm attempts to send itself through the KaZaA and iMesh file-sharing networks.
Also this worm may used by hacker to take control of the computer - trojan capability.

Can be in 3 different registry locations:

HKLM\..\Run: [,main drive Loader] wininfo.exe
HKLM\..\RunServices: [,main drive Loader] wininfo.exe
HKCU\..\Run: [,main drive Loader] wininfo.exe

You must delete all three instance of wininfo.exe.
Greatis Startup Optimizer will help you to do it quickly.

winini.exe
Winini.exe is Trojan/Backdoor RBOT-KV WORM!.
Kill the process winini.exe and remove winini.exe from Windows startup.

wininit32.exe
Wininit32.exe is Trojan/Backdoor.
Kill the process wininit32.exe and remove wininit32.exe from Windows startup.
Read more:
http://securityresponse.symantec.com/avc...

winins.exe
Winins.exe is W32/Agobot-AIX.
Read more:
http://www.sophos.com/security/analyses/...
Kill the process winins.exe and remove winins.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

wininxt.exe
Wininxt.exe is Trojan/Backdoor.
Kill the process wininxt.exe and remove wininxt.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winiogon.exe
WinIogon.exe is Trojan/Backdoor.
Kill the process WinIogon.exe and remove WinIogon.exe from Windows startup.

winipx.exe
Virus / Hacking tool
Opens port 531 for communication. One of very few viruses with hacking capabilities. Notepad.exe is is given the new name Notepadx.exe and the virus take the old name. When installed, the virus notifyes its creator on one of four different IP addresses in New Zealand.

winipxa.exe
Virus / Hacking tool
Opens port 531 for communication. One of very few viruses with hacking capabilities. Notepad.exe is is given the new name Notepadx.exe and the virus take the old name. When installed, the virus notifyes its creator on one of four different IP addresses in New Zealand.

winiqa32.dll
Winiqa32.dll is Trojan/Backdoor.
Kill the file winiqa32.dll and remove winiqa32.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

winis.exe
Winis.exe is Trojan/Backdoor.
Kill Winis.exe process and remove it from Windows startup.

winistitit.exe
Winistitit.exe is Trojan/Backdoor.
Kill the process winistitit.exe and remove winistitit.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winit.exe
Winit.exe is W32.Mugly.A@mm.
W32.Mugly.A@mm is a worm that uses its own SMTP engine to spread by sending itself as an email attachment to the email addresses gathered from the infected computer. It also drops and runs a W32.Spybot.Worm variant, and may attempt to open a backdoor on the infected computer.
Related files:
%System%\attached.zip (zipped copy of worm)
%System%\winit.exe (attributes are set to read_only, hidden, and system. This is a variant of W32.Spybot.Worm.)
%System%\uglym.jpg
%System%\ANSMTP.DLL (valid ActiveX email engine)
%System%\bszip.dll (valid archive engine)
%System%\SVKP.sys (not viral)
Read more:
http://www.sarc.com/avcenter/venc/data/p...
Kill the process winit.exe and remove winit.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winitr32.exe
W32/Forbot-C is a worm which attempts to spread to remote network shares.
The worm also contains backdoor Trojan functionality, allowing unauthorised remote access to the infected computer via IRC channels.
It moves itself to the Windows system folder as winitr32.exe and creates the following registry entries to run itself on system logon:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Win32 Wmls Driver = winitr32.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce\Win32 Wmls Driver = winitr32.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\Win32 Wmls Driver = winitr32.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Win32 Wmls Driver = winitr32.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce\Win32 Wmls Driver = winitr32.exe

Attempts to spread to network machines using various exploits including the LSASS vulnerability.
Also, attempts to terminate several processes related to anti-virus and security related software.

Remove it from startup with RegRun Startup Optimizer.

winjgf32.dll
Winjgf32.dll is Trojan/Backdoor.
Kill the file winjgf32.dll and remove winjgf32.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

winjks32.dll
WINJKS32.DLL is Trojan/Backdoor.
Kill the file WINJKS32.DLL and remove WINJKS32.DLL from Windows startup using RegRun Reanimator.
http://www.regrun.com

winjrp32.dll
WINJRP32.DLL is Trojan/Backdoor.
Kill the file WINJRP32.DLL and remove WINJRP32.DLL from Windows startup using RegRun Reanimator.
http://www.regrun.com

winjrs32.dll
Winjrs32.dll is Trojan/Backdoor.
Kill the file winjrs32.dll and remove winjrs32.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

winjyg32.dll
WINJYG32.DLL is Trojan/Backdoor.
Kill the file WINJYG32.DLL and remove WINJYG32.DLL from Windows startup using RegRun Reanimator.
http://www.regrun.com

winjyp32.dll
Winjyp32.dll is Adware Look2ME.
Related files:
1 :%WINDIR%\SYSTEM32\WINBUE32.DLL
2 :%WINDIR%\SYSTEM32\WINBUG32.DLL
3 :%WINDIR%\SYSTEM32\WINEAK32.DLL
4 :%WINDIR%\SYSTEM32\WINEIJ32.DLL
5 :%WINDIR%\SYSTEM32\WINEIL32.DLL
6 :%WINDIR%\SYSTEM32\WINEPI32.DLL
7 :%WINDIR%\SYSTEM32\WINGSA32.DLL
8 :%WINDIR%\SYSTEM32\WINHAB32.DLL
9 :%WINDIR%\SYSTEM32\WINHDN32.DLL
10:%WINDIR%\SYSTEM32\WINHOO32.DLL
Read more:
http://fileinfo.prevx.com/QQ638117814981...
Kill the file winjyp32.dll and remove winjyp32.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

wink9sk3.exe
WINK9SK3.EXE is Trojan/Backdoor.
Read more:
http://fileinfo.prevx.com/adware/qq78fb6...
Kill the process WINK9SK3.EXE and remove WINK9SK3.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

winkcp.exe
Winkcp.exe is a virus Klez.
Kill the process winkcp.exe and remove winkcp.exe from Windows startup.

winkernel.exe
Remote Access / Destructive trojan / Virus dropper
It copies itself to c:\recycled to avoid detection by some antivirus programs.

winkernel32.exe
Remote Access

winket.exe
Dangerous trojan.
Use Process Manager to kill it in memory, after that remove from startup.

winkif.exe
Klez virus
It adds files with random names: "Wink*"
Remove it.

winkit.exe
Dangerous trojan.
Use Process Manager to kill it in memory, after that remove from startup.

winkld.dll
Winkld.dll is Trojan TROJ_AGENT.BCN.
Directories:
WinkldUP
%ProgramFiles%\Winkld
Related files:
SETUP.EXE – also detected by Trend Micro as TROJ_AGENT.BCN
UPDATE.INI – non-malicious log file
~UP.INI – non-malicious log file
UNINST.EXE
UPDATE.INI - non-malicious log file
WINKLD.DLL - also detected by Trend Micro as TROJ_AGENT.BCN
Read more:
http://www.trendmicro.com/vinfo/virusenc...
Kill the file winkld.dll and remove winkld.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

winkrnl386.exe
Also Known as TrojanProxy.Win32.Zebroxy [KAV]
Backdoor.Zebroxy is a Trojan that opens port 8173 and runs as a proxy server under Windows 2000/XP.

When Backdoor.Zebroxy is run, it does the following:

1. Adds the string value:
"Microsoft Windows Kernel Services"="%System%\winkrnl386.exe"
to the registry keys:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
and:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
so that the Trojan runs when you start Windows.

2. Modifies the string value:
"EnableDCOM"="N"
to the registry key:
HKEY_LOCAL_MACHINE\Software\Microsoft\Ole
to diseble remote connections using DCOM

3. Opens TCP port 8173 and runs as a proxy server.

Following the instructions to remove this trojan:

1. Restart the computer in Safe mode.
2. Open your antiviral application and run a full system scan and delete all the files detected as Backdoor.Zebroxy.
3. Deleting the value from the registry:

a. Select the key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
and delete the value:
"Microsoft Windows Kernel Services"="%System%\winkrnl386.exe"

b. After that navigate to the key:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
and delete the value:
"Microsoft Windows Kernel Services"="%System%\winkrnl386.exe"

c. And go to the key:
HKEY_LOCAL_MACHINE\Software\Microsoft\Ole
set the value for "EnableDCOM" to:
"EnableDCOM"="Y"

winkve32.dll
WINKVE32.DLL is Win32/TrojanDropper.Agent.
Related files: winrnt32.dll
Kill the file WINKVE32.DLL and remove WINKVE32.DLL from Windows startup using RegRun Reanimator.
http://www.regrun.com

winkvh32.dll
WINKVH32.DLL is Trojan.Agent.qt.
Kill the file WINKVH32.DLL and remove WINKVH32.DLL from Windows startup using RegRun Reanimator.
http://www.regrun.com

winl.dll
Winl.dll is a Spyware.IamBigBrother.
Winl.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
cpanel.exe
nl.exe
ctl3d32.dll
winl.dll
dmm.dll
ma.exe
%System%\DOM.dll
%System%\DartFtp.dll
%System%\DartSock.dll
%System%\EncodeX.dll
%System%\MabryObj.dll
%System%\MimeX.dll
%System%\SmtpX.DLL
%Windir%\cp.exe
Adds the value:
"Windows System Tray" = "[PATH TO SECURITY RISK]"
"Windows Service Manager" = "[PATH TO SECURITY RISK]"
to the Windows startup registry keys.
More info:
http://securityresponse.symantec.com/avc...
Removal:
Remove winl.dll from Windows startup using RegRun Startup Optimizer.

winldg32.dll
Winldg32.dll is Trojan/Backdoor.
Kill the file winldg32.dll and remove winldg32.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

winldra.exe
Winldra.exe is a Trojan Backdoor.Nibu.J.
Winldra.exe spreads via open network shares.
Winldra.exe tries to terminate antiviral programs installed on a user computer.
Winldra.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\winldra.exe
%Windir%\dvpd.dll
%Windir%\netdx.dat
%Windir%\socks.dat
%Windir%\prntsvra.dll
%Windir%\TEMP\fa4537ef.tmp
%Windir%\prntk.log
%Windir%\prntc.log
Adds the value:
"load32" = "%System%\winldra.exe"
to the Windows startup registry keys.
More info:
http://securityresponse.symantec.com/avc...
Removal:
Kill winldra.exe process and remove winldra.exe from Windows startup using RegRun Startup Optimizer.

winldra1.exe
Winldra1.exe is Keylogger.winldra.
Related files:
%WINDOWS%\dvpd.dll
%WINDOWS%\netdx.dat
%WINDOWS%\prntsvra.dll
%WINDOWS%\socks.dat
%WINDOWS%\winsms.dll
%SYSTEM%\winldra1.exe
%WINDOWS%\prntc.log
%SYSTEM%\winldra.exe
Read more:
http://www.nuker.com/container/details/k...
Kill the process winldra1.exe and remove winldra1.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winlgcver.exe
We suggest you to remove winlgcver.exe from your computer as soon as possible.
Winlgcver.exe is Worm.Win32.Skipi.a.
Related files:
%System%\wndrivs.exe
%System%\mshtml32.exe
%System%\sdrives32.exe
%System%\winlgcver.exe
Read more:
http://www.viruslist.com/en/viruses/ency...
Kill the process winlgcver.exe and remove winlgcver.exe from Windows startup.

winlgcvers.exe
Winlgcvers.exe is W32/Pykse-C.
Related files:
%System%\mshtmldat32.exe
%System%\sdrivew32.exe
%System%\winlgcvers.exe
%System%\wndrivs32.exe
%Removable Drive%:\game.exe
%Removable Drive%:\zjbs.exe
Read more:
http://www.sophos.com/security/analyses/...
Kill the process winlgcvers.exe and remove winlgcvers.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winlgcverx.exe
Winlgcverx.exe is Win32.HLLW.Crazy.A.
Related files:
wndrivsd32.exe
mshtmlsh32.exe
winlgcverx.exe
sdrivec32.exe
Read more:
http://www.bitdefender.com/VIRUS-1000174...
Kill the process winlgcverx.exe and remove winlgcverx.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winlgon.exe
Winlgon.exe is Troj/Bdoor-BX.
Read more:
http://www.sophos.com/virusinfo/analyses...
Kill the process winlgon.exe and remove winlgon.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winlig32.dll
WINLIG32.DLL is Trojan/Backdoor.
Kill the file WINLIG32.DLL and remove WINLIG32.DLL from Windows startup using RegRun Reanimator.
http://www.regrun.com

winlink32.exe
W32.Gaobot.AAY is a minor variant of W32.Gaobot.SY.
Also known as: W32.HLLW.Gaobot.gen, W32/Gaobot.worm.gen.d, Backdoor.Agobot.kr
This worm attempts to spread through network shares with weak passwords.
It also allows attackers to access an infected computer using a predetermined IRC channel.
Sniffs HTTP, FTP, and IRC traffic.
Disables other worms by deleting their files, associated registry values, and by terminating their processes.
Steals the Windows product ID and CD keys from some video games.
The worm uses multiple vulnerabilities to spread, including:
DCOM RPC, WebDav, Workstation service buffer overrun, etc.

Sending itself to the backdoor ports that the Beagle and Mydoom families of worms open.

Copies itself as:
%System%\winlink32.exe

Adds the string value: "Winlink"="winlink32.exe"
to these registry keys:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices

Terminates a long list of processes, including: irun4.exe; i11r54n4.exe; winsys.exe; bbeagle.exe; taskmon.exe
Make any attempts to connect to some Web sites fail.
Starts an FTP server on a randomly selected TCP port.

Manual removal:
Navigate to each of the following keys:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices
and delete the value: "Winlink"="winlink32.exe"

winload.dll
Winload.dll is Trojan/Backdoor.
Kill the file winload.dll and remove winload.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

winload32.exe
Remote Access / Steals passwords / EXE Binder
May alter Win.ini and/or System.ini. Based on SubSeven. Some of the files are packed with the UPX 1.01. It comes with several different skins and supports plug-ins, so features may change. With Undetected, the hacker is able to write and execute different types of scripts, such as .bat and .vbs files, on the infected machine.

winloader.exe
Remote Access / Steals passwords / EXE Binder
May alter Win.ini and/or System.ini. Based on SubSeven. Some of the files are packed with the UPX 1.01. It comes with several different skins and supports plug-ins, so features may change. With Undetected, the hacker is able to write and execute different types of scripts, such as .bat and .vbs files, on the infected machine.

winloadhh.dll
winloadhh.dll is a Trojan.Dloadr-ABJ.
winloadhh.dll opens a back door on IRC channels.
More info:
http://www.sophos.com/virusinfo/analyses...
Removal:
Remove winloadhh.dll from Windows startup using RegRun Startup Optimizer.

winlog0a.exe
Winlog0a.exe is Trojan/Backdoor.
Kill the process winlog0a.exe and remove winlog0a.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winlog0n.exe
Winlog0n.exe is a mass-mailing worm.
Backdoor Winlog0n.exe spreads by e-mail and via open network shares.
Winlog0n.exe steals account information from a predetermined Chinese bank.
Related files:
%System%\WINLOG0N.EXE.
%System%\wxapi.dll
%System%\svch0st.exe
Adds the value:
"WINLOG0N" = "%System%\WINLOG0N.EXE"
"Systems" = "%System%\svch0st.exe"
to the Windows startup registry keys.
More info:
http://securityresponse.symantec.com/avc...
Removal: Kill Winlog0n.exe process and remove Winlog0n.exe from Windows startup using RegRun Startup Optimizer.

winlogin1.exe
Winlogin1.exe is Trojan/Backdoor.
Kill the process winlogin1.exe and remove winlogin1.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winlogin32.exe
WINLOGIN32.EXE is WORM_SPYBOT.PA.
Read more:
http://www.trendmicro.com/vinfo/virusenc...
Kill the process WINLOGIN32.EXE and remove WINLOGIN32.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

winlogin6.exe
WINLOGIN6.EXE is Trojan/Backdoor.
Kill the process WINLOGIN6.EXE and remove WINLOGIN6.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

winlogins.exe
winlogins.exe is a Backdoor W32.Alcra.A.
winlogins.exe spreads via open network shares.
winlogins.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\regedit.com
%System%\taskmgr.exe
%System%\tasklist.com
%System%\taskkill.com
%System%\netstat.com
%System%\tracert.com
%System%\ping.com
%System%\cmd.com
%ProgramFiles%\MSConfigs\MSConfigs.exe
%System%\bt.exe
%System%\z.tmp
%System%\temp.zip
%System%\bszip.dll
%System%\p2pnetwork.exe
winis.exe
win32exe.exe
wini.exe
winlogins.exe
muamgr.exe
Adds the value:
"MsConfigs" = "MsConfigs.exe"
"p2pnetwork" = "p2pnetwork.exe"
to the Windows startup registry keys.
More info:
http://securityresponse.symantec.com/avc...
Removal:
Kill winlogins.exe process and remove winlogins.exe from Windows startup using RegRun Startup Optimizer.

winlogon.scr
W32.Netsky.AA@mm is a variant of W32.Netsky.Z@mm that scans for email addresses on all non-CD-ROM drives on the infected computer.
It uses its own SMTP engine to send itself to to xdfggra@yahoo.com the email addresses that it finds.
Its Subject, Message, and Attachment vary. The attachment has a .pif extension.

Also Known As: WORM_NETSKY.AA, W32/Netsky.aa@MM, Win32.Netsky.AA, W32/Netsky-AA
Variants: W32.Netsky.X@mm, W32.Netsky.Y@mm, W32.Netsky.Z@mm

Copies itself as %Windir%\Winlogon.scr.
Adds the value: "SkynetRevenge"="%Windir%\winlogon.scr"
to the registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

If the file name does not contain the string "scr", it will display the following message:
Title: Error
Message: Out of system memory

Scans drives (excluding CD-ROM drives) and retrieves email addresses from any files that have predefined extensions.

Use RegRun Startup Optimizer to automatically remove this virus.

winlogon32.bat
BAT.Igador is a batch script worm that spreads using Internet Relay Chat (IRC).
Attempts to end the following processes using the TSKILL utility:
taskmgr; msconfig; ICQ; ICQLite; NISUM; NISSERV; guard; zonealarm; outpost; ad-aware; nmain

Modifies or creates the following files, so that a copy of the worm is sent to other MIRC users:
%ProgramFiles%\mIRC\mirc.ini
%ProgramFiles%\mIRC\eventz.ini

Modifies the %Windir%\Win.ini file so that the worm will run when Windows starts.
Overwrites all .pif files in the %Windir%\System32 folder with a copy of itself.
Deletes all files that have the extension .mp3 in the current folder.

Automatic removal: Use RegRun Startup Optimizer.

winlogon32.exe
Winlogon32.exe is Trojan/Backdoor.
Kill the process Winlogon32.exe and remove Winlogon32.exe from Windows startup.
Related files for W32.HLLW.Nautic:
* NTDLL.exe
* Win32.exe
* Explore.exe
* Kernel32.exe
* krnl286.exe
* Dllhost32.exe
* MSTCP.exe
* CRSS.exe
* Winlogon32.exe
* Winsrvc.exe
* Ntoskrn.exe
* Vmm32.exe
* Sysmon.exe
* System32.exe
* Sys.exe
* Win.exe
* Rundil32.exe
* Msrvcp.exe
* Msgmsr.exe
* Mscde32.exe
* Regsvclib.exe
* Reg32.exe
* Registry32.exe
* Service.exe
* Rpcsrvc.exe
More info:
http://securityresponse.symantec.com/avc...

winlogong.exe
Winlogong.exe is Trojan/Backdoor.
Kill the process winlogong.exe and remove winlogong.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winlogonn.exe
W32.Randex.FC is a network-aware worm that will copy itself as the following files:
\Admin$\system32\GT.exe
\c$\winnt\system32\GT.exe

The worm receives instructions from an IRC channel on a predetermined IRC server. One such command will trigger the aforementioned spreading.
Steals the CD key of some popular games.

It does the following:
Copies itself as %System%\Winlogonn.exe.

Calculates a random IP address for a computer that it will try to infect.
Attempts to authenticate itself to the randomly generated IP addresses.
Copies itself to computers that have weak administrator passwords, at the following locations:
\\\Admin$\system32\GT.exe
\\\c$\winnt\system32\GT.exe

Remotely schedules a task to run the worm on a newly infected computer.

For manual removal, please delete value: "Windows mangement"="winlogonn.exe"
from the registry keys:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce

Removal:
Use RegRun Startup Opimizer.

winlogons.exe
Winlogons.exe is Trojan/Backdoor.
Winlogons.exe may be installed as system service "Windows Logon Events" or with another name.
Kill the file winlogons.exe and remove winlogons.exe from Windows startup.

winlogoservice.exe
Winlogoservice.exe is W32.Spybot.ANOO.
Read more:
http://www.symantec.com/enterprise/secur...
Kill the process winlogoservice.exe and remove winlogoservice.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winlru32 dll
Winlru32 dll is Trojan.Agent.vg.
Kill the file winlru32 dll and remove winlru32 dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

winlxj32.dll
Winlxj32.dll is Trojan/Backdoor.
Kill the file winlxj32.dll and remove winlxj32.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

winlzh32.dll
Winlzh32.dll is Trojan/Backdoor.
Kill the process winlzh32.dll and remove winlzh32.dll from Windows startup using RegRun.
www.regrun.com

winm32.exe
Winm32.exe is Trojan/Backdoor.
Kill the process winm32.exe and remove winm32.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winm32.sys
Winm32.sys is Trojan/Backdoor Haxdoor.
Kill the file winm32.sys and remove winm32.sys from Windows startup using RegRun Reanimator.
http://www.regrun.com
Related files:
%Temp%\temp.exe
%SysDir%\config\ssl
%SysDir%\klo5.sys
%SysDir%\klogini.dll
%SysDir%\p3.ini
%SysDir%\ps.a3d
%SysDir%\qy.sys
%SysDir%\qz.dll
<System>\qz.sys
%SysDir%\vinm32.dll
%SysDir%\vinm32.sys
%SysDir%\vinm64.sys
%SysDir%\winm32.dll
%SysDir%\winm32.sys
%SysDir%\winm64.sys
Read more:
http://www.sophos.com/virusinfo/analyses...

winm64.sys
Winm64.sys is Trojan/Backdoor Haxdoor.
Kill the file winm64.sys and remove winm64.sys from Windows startup using RegRun Reanimator.
http://www.regrun.com
Related files:
%Temp%\temp.exe
%SysDir%\config\ssl
%SysDir%\klo5.sys
%SysDir%\klogini.dll
%SysDir%\p3.ini
%SysDir%\ps.a3d
%SysDir%\qy.sys
%SysDir%\qz.dll
<System>\qz.sys
%SysDir%\vinm32.dll
%SysDir%\vinm32.sys
%SysDir%\vinm64.sys
%SysDir%\winm32.dll
%SysDir%\winm32.sys
%SysDir%\winm64.sys
Read more:
http://www.sophos.com/virusinfo/analyses...

winmain.exe
One of the first of a new breed of malware.
When run it immediately loads MSHTA.EXE from the Windows folder, placing it on "hot standby", ready to accept HTA scripting within a web page and then EXECUTE what is embedded IN the page as a program! In other words, it's possible for a "rogue" website to actually embed trojans, worms and/or viruses directly into a web page. BOClean's HTA Stop offers an easy way to toggle this capabiltity, or rather vulnerability, on and off. I suggest you leave it disabled!

It's now possible for a "rogue" website to actually embed trojans, worms and/or viruses directly into a web page. In the past, pages that offer seemingly attractive downloads which contain such malware required you to click to start any download to your computer. Now it's become automatic, using features in the Windows operating system known as scripting. These scripts can load programs without you knowing, and then they run immediately. All you have to do is visit the site, without doing anything besides viewing the page.

HTAstop acts as a brickwall against these scripts, disabling them so the download doesn't occur. HTAstop protects you against one variety of script, our IEClean covers all twenty seven.

winmap.exe
Remote Access
Compressed using the packer UPX. Is able to start your browser at a specified address that could be changed from time to time.

winmapi.exe
Winmapi.exe is Trojan/Backdoor.
Kill the process winmapi.exe and remove winmapi.exe from Windows startup.

winmbj32.dll
Winmbj32.dll is Trojan/Backdoor.
winmbj32.dll is installed in the Winlogon Notification registry subkey.
Delete file winmbj32.dll and remove winmbj32.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com
Read more:
http://vil.mcafeesecurity.com/vil/conten...

winmdw32.dll
Winmdw32.dll is Trojan/Backdoor.
Kill the file winmdw32.dll and remove winmdw32.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

winme.exe
Winme.exe is W32.Rahiwi.B.
W32.Rahiwi.B is a worm that spreads by copying itself to the root of all drives, including removable and shared drives.
Related files:
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Empty.pif
%Windir%\web\shell.exe
%Windir%\winme.exe
%Windir%Autorun.inf
Read more:
http://www.symantec.com/enterprise/secur...
Kill the process winme.exe and remove winme.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winmedplay.exe
Winmedplay.exe is Trojan/Backdoor.
Kill the process winmedplay.exe and remove winmedplay.exe from Windows startup.

winmem.exe
WinMem.exe is W32.Hocgaly.A@mm.
Related files:
%System%\winMem.exe - a copy of the worm
%System%\WinFlag.vxd
%System%\WinPos.vxd
%System%\WinSrc.vxd
%System%\WinMail.vxd
Read more:
http://www.symantec.com/enterprise/secur...
Kill the process winMem.exe and remove winMem.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winmfu32.dll
Winmfu32.dll is Trojan-Clicker.Win32.Small.kb.
Read more:
http://www.sophos.com/security/analyses/...
Kill the file winmfu32.dll and remove winmfu32.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

winmgm32.exe
I-Worm.Sobig.
Installs backdoor program \windows\DWN.DAT.
Stop the processes: winmgm32 and dwn.
Remove from startup.

winmgmt32.exe
Winmgmt32.exe is Trojan-Spy.Win32.Luzia.ad.
Read more:
http://www.viruslist.com/en/viruses/ency...
Kill the process winmgmt32.exe and remove winmgmt32.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winmgnt.exe
WinMgnt.exe is Trojan/Backdoor.Hale.
1. WinMgnt creates the folder: C:\Winnt\System32\Qossrv.
2. Adds the value
"NTDLM" = "c:\winnt\system32\qossrv\csrss.exe"
to the Windows startup registry keys.
Read more:
http://securityresponse.symantec.com/avc...

winmgr32.exe
I-Worm.Mimail.p
This worm spreads via the Internet as the files attached to infected messages.
Contents of infected messages:
Sender: donotreply@paypal.com
Message header: "GREAT NEW YEAR OFFER FROM PAYPAL.COM!"
Attachment name: pp-app.zip

To send infected messages the worm uses its own SMTP library.
To find email addresses to send messages to, the worm looks for address lines which contain the predefined suffixes:
but does not search for addresses in files with the following extensions: jpg, gif, exe, dll, avi, mpg, mp3, vxd, ocx, psd, tif, zip, rar, pdf, cab, wav, com.
When executed, the worm displays a dialogue box on screen which asks for PayPal credit card details.
Data entered is stored in 'c:\tmpny3.txt' and is then sent on to the author of the worm.
The worm opens port 5555 to listen for commands.
The worm changes the home page in Internet Explorer to a link containing pictures of George Bush:
http://www.anvari.org/db/fun/World_Trade...

Use RegRun Startup Optimizer to remove it from startup.

winmine.exe
Worm / Network trojan / DoS tool / Destructive trojan
Alters Win.ini. The worm propagates using shared drives. After completing an installation it sends a message to the newsgroup ""alt.horror"". Also tries to connect to computers with SubSeven or NetBus installed. Kills ZoneAlarm firewall.

winmmt32.dll
Winmmt32.dll is Trojan/Backdoor.
Read more:
http://www.spywaredata.com/spyware/malwa...
Kill the file winmmt32.dll and remove winmmt32.dll from Windows startup using RegRun.
www.regrun.com

winmon32.exe
Winmon32.exe is Trojan/Backdoor Rbot.
Kill the process winmon32.exe and remove winmon32.exe from Windows startup.
www.sophos.com/virusinfo/analyses/w32rbotoq.html

winmpa.exe
Winmpa.exe is Trojan/Backdoor.
Kill the process winmpa.exe and remove winmpa.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winmplayer.exe
Winmplayer.exe is Trojan/Backdoor Rbot.
Kill the process winmplayer.exe and remove winmplayer.exe from Windows startup.
www.sophos.com/virusinfo/analyses/w32rbotmv.html

winmqx32.dll
Winmqx32.dll is Trojan/Backdoor.
Kill the file winmqx32.dll and remove winmqx32.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

winms.exe
Winms.exe is W32/Rbot-AHK worm.
Read more:
http://www.sophos.com/virusinfo/analyses...
Kill the process winms.exe and remove winms.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winmsfw.exe
Winmsfw.exe is Worm Ircbot Gen.
Related files:
%APPDATA%\SECTASKMAN\WINMSFW.EXE.Q_8044402_Q
%profiles%\holish\KOPIE VON WINMSFW.EXE
%WINDIR%\SYSTEM32\TFTP1444
%WINDIR%\SYSTEM32\TFTP2448
Read more:
http://fileinfo.prevx.com/adware/qq74a72...
Kill the process winmsfw.exe and remove winmsfw.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winmsg.exe
Winmsg.exe is Backdoor W32.Velkbot.A.
Winmsg.exe spreads via MSN Messenger, Yahoo Messenger and AOL Instant Messenger.
Winmsg.exe tries to terminate antiviral programs installed on a user computer.
Winmsg.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\winmsg.exe
Adds the value:
"Windows Messenger Messenger" = "winmsg.exe"
to the Windows startup registry keys.
More info:
http://securityresponse.symantec.com/avc...
Removal:
Kill winmsg.exe process and remove winmsg.exe from Windows startup using RegRun Startup Optimizer.

winmsg32.exe
Remote Access

winmsi.exe
Winmsi.exe is Downloader Drev A.
Directory: %WINDIR%\SYSTEM32\
Related files:
%TEMP%\ERASEME_23383.EXE
%WINDIR%\SYSTEM32\SETUP_01545.EXE
%WINDIR%\SYSTEM32\SETUP_03866.EXE
%WINDIR%\SYSTEM32\SETUP_11421.EXE
%WINDIR%\SYSTEM32\SETUP_12358.EXE
%WINDIR%\SYSTEM32\SETUP_21047.EXE
%WINDIR%\SYSTEM32\SETUP_24282.EXE
%WINDIR%\SYSTEM32\SETUP_28637.EXE
%WINDIR%\SYSTEM32\SETUP_30462.EXE
%WINDIR%\SYSTEM32\SETUP_32644.EXE
Read more:
http://fileinfo.prevx.com/adware/qqc5e02...
Kill the process winmsi.exe and remove winmsi.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winmsrv32.exe
W32.Gaobot.AFJ is a worm that spreads through open network shares, backdoors that the Beagle and Mydoom worms install, and several Windows vulnerabilities.
The worm can also act as a backdoor server program and attack other systems.
Additionally, the worm attempts to stop the process of many antivirus and security programs.

Copies itself as one of the following:
%System%\msiwin84.exe
%System%\Microsoft.exe
%System%\WinMsrv32.exe
%System%\soundcontrl.exe
%System%\msawindows.exe

Adds one of these values:
"Microsoft Update"="msiwin84.exe"
"Microsoft Update"="Microsoft.exe"
"WinMsrv32"="WinMsrv32.exe"
"soundcontrl"="soundcontrl.exe"
"Microsoft Update"="msawindows.exe"
to the registry keys:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices

Copies itself and executes on any remote shares to which it successfully authenticates.

Use RegRun Startup Optimizer to automatically remove this worm.

winmuschi.exe
WINMUSCHI dialler.
When Dialer.Winmuschi runs, it displays a window inviting you to access "my webcam" using a premium rate telephone number.
This dialer program is installed through various Web sites, mainly with pornographic contents.
It copies itself as %Windir%\Winmuschi.exe.
It also creates a link to itself on the Windows desktop and adds itself to the Start menu.
Manual removal:
Delete the link on the Windows desktop and from the Start menu.
Auto remove:
Use RegRun Startup Optimizer to remove it from startup.

winmuse.exe
Winmuse.exe is Adware/Spyware Exec.
Kill the process winmuse.exe and remove winmuse.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winmxw32.dll
Winmxw32.dll is Trojan.Agent.vg.
Kill the file winmxw32.dll and remove winmxw32.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

winn.exe
Winn.exe is W32/Sdbot-DHE.
Read more:
http://www.sophos.com/security/analyses/...
Kill the process winn.exe and remove winn.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winn321.exe
Dangerous trojan. Remove it.

winnb58.dll
WINNB58.DLL is Mirar adware.
Read more:
http://www3.ca.com/securityadvisor/pest/...
Kill the file WINNB58.DLL and remove WINNB58.DLL from Windows startup using RegRun Reanimator.
http://www.regrun.com

winnet32.exe
Winnet32.exe is a mass-mailing worm W32.Mytob.BN@mm.
Winnet32.exe tries to terminate antiviral programs installed on a user computer.
Winnet32.exe spreads by exploiting the Microsoft Windows DCOM RPC Interface Buffer Overrun Vulnerability (Microsoft Security Bulletin MS03-026) and the Microsoft Windows Local Security Authority Service Remote Buffer Overflow (Microsoft Security Bulletin MS04-011).
Related files:
%System%\taskgmr32.exe
%System%\winnet32.exe
C:\funny_pic.scr
C:\see_this!!.scr
C:\my_photo2005.scr
C:\xmsnn.exe
Adds the value:
"WINTASK32" = "taskgmr32.exe"
to the Windows startup registry keys.
More info:
http://securityresponse.symantec.com/avc...
Removal:
Kill winnet32.exe process and remove winnet32.exe from Windows startup using RegRun Startup Optimizer.

winnjj32.dll
Winnjj32.dll is Trojan/Backdoor.
Kill the file winnjj32.dll and remove winnjj32.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

winnl.exe
Winnl.exe is Trojan/Backdoor.
Kill the process winnl.exe and remove winnl.exe from Windows startup.

winnod.exe
Winnod.exe is Trojan/Backdoor.
Kill the process winnod.exe and remove winnod.exe from Windows startup.

winnook.exe
Winnook.exe is Trojan.Fakealert.
Read more:
http://vil.nai.com/vil/content/v_131814....
Kill the process winnook.exe and remove winnook.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winnr.dll
Winnr.dll is TrojanDownloader.Win32.Agent.bq.
Read more:
http://www3.ca.com/securityadvisor/pest/...
Kill the file winnr.dll and remove winnr.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

winnthosts.exe
Winnthosts.exe is Trojan/Backdoor.
Kill the process winnthosts.exe and remove winnthosts.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winntify.exe
Winntify.exe is Trojan/Backdoor.
Kill the process winntify.exe and remove winntify.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winnuke.exe
Trojan dropper
A fake nuker that installs the F0replay server.

winny_patch.exe
Winny_patch.exe is Trojan/Backdoor.
Kill the process winny_patch.exe and remove winny_patch.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winocx.exe
Winocx.exe is Trojan/Backdoor.
Kill the process winocx.exe and remove winocx.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winods.exe
Winods.exe is Trojan/Backdoor.
Kill the process winods.exe and remove winods.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winoldap.exe
Remote Access / Virus dropper / Virus
Virusserver actually binds to other .exe files by infecting them.

winopn32.dll
Winopn32.dll is Trojan-Downloader.Win32.Small.cml.
Read more:
http://www.bleepingcomputer.com/startups...
Kill the file winopn32.dll and remove winopn32.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

winoqy32.dll
WINOQY32.DLL is Trojan/Backdoor.
Kill the file WINOQY32.DLL and remove WINOQY32.DLL from Windows startup using RegRun Reanimator.
http://www.regrun.com

winosz32.dll
WINOSZ32.DLL is Trojan/Backdoor.
Kill the file WINOSZ32.DLL and remove WINOSZ32.DLL from Windows startup using RegRun Reanimator.
http://www.regrun.com

winotify.dll
WINOTIFY.DLL is Trojan/Backdoor.
Kill the file WINOTIFY.DLL and remove WINOTIFY.DLL from Windows startup.

winow.dll
Winow.dll is Trojan/Backdoor.
Kill the file winow.dll and remove winow.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

winow.exe
Winow.exe is Trojan/Backdoor.
Kill the process winow.exe and remove winow.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winp2p.exe
Winp2p.exe is Trojan/Backdoor.
Read more:
http://www.incodesolutions.com/threats/S...
Kill the process winp2p.exe and remove winp2p.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winpack.exe
Winpack.exe is Trojan-Downloader.Win32.Agent.gg.
Actions:
When you start Internet Explorer you see blank window with a URL of "
http:///" (http, colon, three slashes).
If you click on a link, the new page opens for about half a second, then turns blank. Internet Explorer becomes next to unusable.
Remove it from Startup and check RegRun Anti Spyware to complete fixup.
Winpack.exe tries to download other Trojan programs and install it on your computer.

winpad.exe
WINPAD.EXE is Backdoor.CHCP.
Directory: %Temp%
Read more:
http://www.sarc.com/avcenter/venc/data/b...
Kill the process WINPAD.EXE and remove WINPAD.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

winpaz32.dll
WINPAZ32.DLL is Trojan/Backdoor.
Kill the file WINPAZ32.DLL and remove WINPAZ32.DLL from Windows startup using RegRun Reanimator.
http://www.regrun.com

winpdc32.dll
WINPDC32.DLL is Trojan/Backdoor.
Kill the file WINPDC32.DLL and remove WINPDC32.DLL from Windows startup using RegRun Reanimator.
http://www.regrun.com

winpe.exe
WinPE.exe is Trojan/Backdoor W32/Rbot-AJL.
Kill the process winPE.exe and remove winPE.exe from Windows startup.
http://www.sophos.com/virusinfo/analyses...

winpfw32.exe
Winpfw32.exe is Trojan/Backdoor.
Kill the process winpfw32.exe and remove winpfw32.exe from Windows startup.

winpgi.dll
WINPGI.DLL is a part of WinAntiVirus Pro - fake "security software".
Read more:
http://www.ca.com/us/securityadvisor/pes...
Kill the file WINPGI.DLL and remove WINPGI.DLL from Windows startup using RegRun Reanimator.
http://www.regrun.com

winpnp32
Winpnp32.exe is Trojan/Backdoor W32.Wallz.
Winpnp32.exe creates a service:
display name: Windows 32-bit PnP Driver
service name: winpnp32
Executable file: %SysDir%\Winpnp32.exe
Winpnp32 infects other computer in the network by enumerating IP addresses.
http://securityresponse.symantec.com/avc...
Disable the winpnp32 service, delete the service using RegRun.
Delete the winpnp32.exe file

winpnp32.exe
Winpnp32.exe is Trojan/Backdoor W32.Wallz.
Winpnp32.exe creates a service:
display name: Windows 32-bit PnP Driver
service name: winpnp32
Executable file: %SysDir%\Winpnp32.exe
Winpnp32 infects other computer in the network by enumerating IP addresses.
http://securityresponse.symantec.com/avc...
Disable the winpnp32 service, delete the service using RegRun.
Delete the winpnp32.exe file

winpo32.exe
Winpo32.exe is WORM_AGENT.YKR.
Read more:
http://www.trendmicro.com/vinfo/virusenc...
Kill the process winpo32.exe and remove winpo32.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winpol.exe
Winpol.exe is Backdoor.IRC.Bifrut.
Backdoor.IRC.Bifrut is a Trojan horse program that opens a backdoor and allows a remote attacker to control the compromised system through IRC and FTP channels.
Read more:
http://www.sarc.com/avcenter/venc/data/b...
Kill the process winpol.exe and remove winpol.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winpop.exe
Winpop.exe is Trojan/Backdoor.
Kill the process winpop.exe and remove winpop.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winppr32.exe
Worm Sobig.f.
Spreads via e-mail as attached file.
Usually used message subjects:
Re: That movie
Re: Wicked screensaver
Re: Your application
Re: Approved
Re: Re: My details
Re: Details
Your details
Thank you!
Re: Thank you!
Attached file names:
movie0045.pif
wicked_scr.scr
application.pif
document_9446.pif
details.pif
your_details.pif
thank_you.pif
document_all.pif
your_document.pif
Also it spreads via local network using open shares.
Removal:
Kill it using Greatis Startup Optimizer.

winproc32.exe
Winproc32.exe is Trojan/Backdoor StartPage.
Winproc32.exe changes IE home page.
Winproc32.exe adds to Windows registry startup:

"Windows Internet Protocol" = "%System%\winproc32.exe "
"rundll32"="%System%\rundll32.exe"
"SysSearch"="REGEDIT.EXE -s %Windir%\sysreg.reg"
"sp"="rundll32 %Temp%\se.dll,DllInstall"
Also it changes IE search settings
http://securityresponse.symantec.com/avc...

Kill the process winproc32.exe and remove winproc32.exe from Windows startup.

winprot.exe
Remote Access / Destructive trojan
Alters Win.ini.

winprotect.exe
Mass mailing worm.Mugly.
It uses own SMTP engine to send e-mails.
After infecting it copies its body to %System%\xxz.tmp.
Created files:
# %System%\attached.zip
# %System%\ANSMTP.DLL (an SMTP engine)
# %System%\bszip.dll
# %System%\uglym.jpg
# %System%\winprotect.exe (a W32.Spybot.Worm variant)
# %System%\SVKP.sys
# \bt32.exe
Displays the file %System%\uglym.jpg in the browser.
Registers SMTP engine.
Adds to Windows startup.
Remove it from startup using RegRun Startup Optimizer.
Variants:
lexplore.exe
vb6.exe

winprotecte.exe
Steals passwords
Gets the Dial Up Networking passwords via e-mail.

winpsa32.dll
Winpsa32.dll is Trojan Agent.
Kill the file winpsa32.dll and remove winpsa32.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

winpsd.exe
I-Worm.Mydoom.q
Mydoom.q is an Internet worm that spreads via an email attachment.
Email characteristics:
Subject: photos
Body text: LOL!;))))
Attachment name: photos_arc.exe
Scans the infected machine for files with email adresses.
Mydoom.q attempts to download Backdoor.Win32.Surila.g, a Trojan, from a list of infected sites contained in the body of the worm.
It is programmed to stop spreading on August 20 at 21:11:11 (according to the local machine time).
However, Backdoor.Win32.Surila.g does not have an expiration date, meaning that infected machines remain open to remote adminstration unless the Trjoan is removed.

Manual removal:
Please, find the key in the system registry: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
and delete the value: "winpsd"="\winpsd.exe"

winpto32.dll
Winpto32.dll is Trojan/Backdoor.
Kill the file winpto32.dll and remove winpto32.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

winpup32.exe
Hiddenly installed on your computer using IE security hole.
Displays advertising information. A lot of popups may cause freezing of user computer.
Remove it from startup by Start Control.

winpva32.dll
Winpva32.dll is Trojan/Backdoor.
Kill the file winpva32.dll and remove winpva32.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

winqgn32.dll
WINQGN32.DLL is Trojan.Small.
Kill the file WINQGN32.DLL and remove WINQGN32.DLL from Windows startup using RegRun Reanimator.
http://www.regrun.com

winqio32.dll
Winqio32.dll is Trojan/Backdoor.
Kill the file winqio32.dll and remove winqio32.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

winqne32.dll
Winqne32.dll is Trojan/Backdoor.
Kill the file winqne32.dll and remove winqne32.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

winqpq32.dll
WINQPQ32.DLL is Trojan/Backdoor.
Winlogon Notify: winqpq32 - C:\WINDOWS\SYSTEM32\winqpq32.dll
Kill the file WINQPQ32.DLL and remove WINQPQ32.DLL from Windows startup using RegRun Reanimator.
http://www.regrun.com

winra.exe
Winra.exe is Trojan/Backdoor.
Kill the process winra.exe and remove winra.exe from Windows startup.

winred32.dll
Winred32.dll is Trojan/Backdoor.
Kill the file winred32.dll and remove winred32.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

winreg.exe
Gaobot Trojan.
Spreads in local network via open shares.
Also it uses DCOM RPC vulnerability (135,445 ports) and WebDav vulnerability (port 80).
Allows to control the victim computer by IRC.
Terminates well known antiviral software.
Removal:
install the patches from Microsoft:
http://www.microsoft.com/technet/securit...
http://www.microsoft.com/technet/securit...
http://www.microsoft.com/technet/securit...
http://www.microsoft.com/technet/securit...
http://www.microsoft.com/technet/securit...
http://www.microsoft.com/technet/securit...
http://www.microsoft.com/technet/securit...
Set the strong passwords for network shares.
Use RegRun "Terminate" feature to erase the virus body files.
They are located in Windows\System32 folder.
Cavapsvc.exe
Csrrs.exe
Cvhost.exe
DIIhost.exe (with capital letter 'i')
Dosrun32.exe
Dos32.exe
Lsas.exe
Regloadr.exe
Schost.exe
Scvhost.exe
Service.exe
Servicess.exe
Sochost.exe
Swchost.exe
System.exe
Update.exe
Wdrun32.exe
Winhlpp32.exe
Winreg.exe
Winupdsdgm.exe

Free removal tool:
http://securityresponse.symantec.com/avc...

winreg32.exe
Winreg32.exe is WORM_SDBOT.GP.
Read more:
http://www.trendmicro.com/vinfo/virusenc...
Kill the process winreg32.exe and remove winreg32.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winres.dll
Winres.dll is CoolWebSearch parasite variant (or Troj/StartP-BAB).
Read more:
http://cwshredder.net/cwshredder/cwschro...
Kill the file winres.dll and remove winres.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

winrestores.exe
WINRESTORES.EXE is Trojan/Backdoor win32:Agent-QJ .
Kill the process WINRESTORES.EXE and remove WINRESTORES.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

winrge32.dll
Winrge32.dll is Trojan/Backdoor.
winrge32.dll is a Winlogon Notification DLL.
Kill the file winrge32.dll and remove winrge32.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

winrkp32.dll
Winrkp32.dll is Trojan/Backdoor.
Kill the file Winrkp32.dll and remove Winrkp32.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

winrnt32.dll
Winrnt32.dll is Troj/Nebuler-C.
Read more:
http://www.sophos.com/security/analyses/...
Kill the file winrnt32.dll and remove winrnt32.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

winrpc.exe
Lovgate worm (also known as Supnot)
Worm copies have the following names:
rpcsrv.exe, syshelp.exe, winrpc.exe, WinGate.exe, WinRpcsrv.exe
Installs backdoor program to your computer for remote control.
Remove it from startup.

winrpcsrv.exe
Lovgate worm (also known as Supnot)
Worm copies have the following names:
rpcsrv.exe, syshelp.exe, winrpc.exe, WinGate.exe, WinRpcsrv.exe
Installs backdoor program to your computer for remote control.
Remove it from startup.

winrr32.exe
Winrr32.exe is Trojan/Backdoor.
Kill the process winrr32.exe and remove winrr32.exe from Windows startup.

winrt32.exe
Winrt32.exe is Trojan/Backdoor.
Kill the process winrt32.exe and remove winrt32.exe from Windows startup.

winruff.exe
WINRUFF.EXE is Trojan/Backdoor.
Read more:
http://fileinfo.prevx.com/adware/qq90857...
Kill the process WINRUFF.EXE and remove WINRUFF.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

winrun.exe
Remote Access / Virus dropper / Virus
Virusserver actually binds to other .exe files by infecting them.

winrundll32.exe
Winrundll32.exe is Trojan/Backdoor.
Kill the process winrundll32.exe and remove winrundll32.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winrvc.dll
Winrvc.dll is Trojan/Backdoor.
Kill the file winrvc.dll and remove winrvc.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

winrvc.exe
WINRVC.EXE is Worm.Ircbot.Gen.
Read more:
http://fileinfo.prevx.com/adware/qq8d9d6...
Kill the process WINRVC.EXE and remove WINRVC.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

winrvc32.dll
Winrvc32.dll is Trojan/Backdoor.
Kill the file winrvc32.dll and remove winrvc32.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

winrxp32.dll
We suggest you to remove winrxp32.dll from your computer as soon as possible.
Winrxp32.dll is Trojan/Backdoor.
Kill the file winrxp32.dll and remove winrxp32.dll from Windows startup.

winsap32.dll
Winsap32.dll is Trojan/Backdoor.
Kill the file winsap32.dll and remove winsap32.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

winsatan.exe
FTP server / IRC trojan
Described as a security checker for SATAN. Tries to connect to one of nine IRC servers and send information about the infected computer to them.

winsaver.exe
Steals passwords / AOL trojan
Alters Win.ini and System.ini. Steals passwords from AOL accounts and sends them one of several hotmail addresses.

winsc32.dll
WinSC32.dll is Adware.NewWeb.
Read more:
http://www.symantec.com/security_respons...
Kill the file WinSC32.dll and remove WinSC32.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

winsearch.dll
Winsearch.dll is Polymorphic File Exploit.
Read more:
http://fileinfo.prevx.com/adware/qq8f1c2...
Kill the file winsearch.dll and remove winsearch.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

winsecure.exe
Winsecure.exe is an adware program Adware.Affilred.
Winsecure.exe monitors user Internet activity.
Related files:
usbwin32.exe
C:\CriticalUpdate.exe
C:\cab.exe
C:\winsecure.exe
%Windir%\twain_32.exe
%Windir%\mshotfix.exe
%Windir%\msupdate.exe
%System%\security32.exe
%System%\iProtect.exe
%System%\axe.exe
%System%\inetconnect.dll
%System%\comnt32.dll.
Adds the value:
"MSUpdate" = "c:\criticalUpdate.exe"
"Microsoft Security Hot Fix Update" = "%SystemRoot%\mshotfix.exe"
"Microsoft Cab Manager" = "c:\exec.exe"
"Windows Security Manager" = "c:\winsecure.exe"
"Windows Security Update" = "%Windir%\security32.exe"
"Userinit" = "%System%\userinit.exe, %Windir%\iProtect.exe"
to the Windows startup registry keys.
More info:
http://securityresponse.symantec.com/avc...
Removal:
Kill winsecure.exe process and remove winsecure.exe from Windows startup using RegRun Startup Optimizer.

winsecure32.exe
Winsecure32.exe is Worm.AGOBOT-VA.
Kill the process winsecure32.exe and remove winsecure32.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winser.exe
WINSER.EXE is Trojan TR/PSW.Lmir.art.
Read more:
http://www.avira.com/en/threats/section/...
Kill the process WINSER.EXE and remove WINSER.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

winsersec.exe
WINSERSEC.EXE is Trojan/Backdoor.
Kill the process WINSERSEC.EXE and remove WINSERSEC.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

winserv.exe
Remote Access / Keylogger

winservadx.dll
WinServAdX.dll is Adware.
Kill the file WinServAdX.dll and remove WinServAdX.dll from Windows startup using RegRun.
www.regrun.com

winservicces.cab.bak.exe
WinServicces.cab.bak.exe is W32.Amirecivel.F@mm worm.
Read more:
http://securityresponse.symantec.com/avc...
Kill the process WinServicces.cab.bak.exe and remove WinServicces.cab.bak.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winservices.exe
I-Worm.Lentin
Stop this process via RegRun Process Manager and remove from startup.
Check your IE homepage via Control Panel->IE Settings.

winservnt32.exe
WINSERVNT32.EXE is Dropper Payload malware.
Related files:
%CACHE%\CONTENT.IE5\????????\02252_NETAPI[1].EXE
%CACHE%\CONTENT.IE5\????????\10455_NETAPI[1].EXE
%CACHE%\CONTENT.IE5\????????\11011_NETAPI[1].EXE
%CACHE%\CONTENT.IE5\????????\13521_NETAPI[1].EXE
%CACHE%\CONTENT.IE5\????????\26248_NETAPI[1].EXE
%CACHE%\CONTENT.IE5\????????\30114_NETAPI[1].EXE
%CACHE%\CONTENT.IE5\????????\36820_NETAPI[1].EXE
%CACHE%\CONTENT.IE5\????????\37627_NETAPI[1].EXE
%CACHE%\CONTENT.IE5\????????\40441_NETAPI[1].EXE
%CACHE%\CONTENT.IE5\????????\43822_NETAPI[1].EXE
Read more:
http://fileinfo.prevx.com/adware/qqc7213...
Kill the process WINSERVNT32.EXE and remove WINSERVNT32.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

winservs.exe
Advertising Spyware.
1. End process WINSERVS.
2. Remove it from startup.

winshell.exe
Winshell.exe is Trojan/Backdoor.
Kill the process winshell.exe and remove winshell.exe from Windows startup.
http://www.megasecurity.org/trojans/w/wi...

winshock.exe
Winshock.exe is Trojan/Backdoor.
Kill the process Winshock.exe and remove Winshock.exe from Windows startup.
http://www.sophos.com/virusinfo/analyses...

winshost.exe
Winshost.exe is a Trojan Trojan.Tooso.F.
Winshost.exe spreads via open network shares.
Winshost.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\winshost.exe
Adds the value:
"winshost.exe" = "%Windir%\winshost.exe"
to the Windows startup registry keys.
More info:
http://securityresponse.symantec.com/avc...
Removal:
Kill winshost.exe process and remove winshost.exe from Windows startup using RegRun Startup Optimizer.

winshow.exe
We suggest you to remove WINSHOW.EXE from your computer as soon as possible.
WINSHOW.EXE is Trojan/Backdoor.
Kill the process WINSHOW.EXE and remove WINSHOW.EXE from Windows startup.

winshvc.exe
Winshvc.exe is Trojan/Backdoor.
Kill the process winshvc.exe and remove winshvc.exe from Windows startup.

winsi32.exe
Winsi32.exe is Trojan/Backdoor.
Kill the process winsi32.exe and remove winsi32.exe from Windows startup.

winsit.exe
WinSit.exe is W32.Imaut.AS.
W32.Imaut.AS is a worm that spreads by sending messages to Yahoo! Instant Messenger contacts, enticing them to download a copy of the worm.
Related files:
%Windir%\Help\Other.exe
%Windir%\inf\Other.exe
%Windir%\system\Fun.exe
%System%\config\Win.exe
%System%\WinSit.exe
%Windir%\dc.exe
%Windir%\SVIQ.EXE
%System%\NWB.dat
C:\PNga.txt
Read more:
http://www.symantec.com/enterprise/secur...
Kill the process WinSit.exe and remove WinSit.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winsl.exe
We suggest you to remove WinSL.exe from your computer as soon as possible.
WinSL.exe is Spyware.StarLogger.
Spyware.StarLogger is a spyware program that may steal sensitive information from the computer.
Related files:
C:\Documents and Settings\All Users\Start Menu\Programs\StarLogger\Image Viewer.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\StarLogger\StarLogger on the Web.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\StarLogger\StarLogger.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\StarLogger\Uninstall StarLogger.lnk
%Windir%\SL\ImgView.exe
%Windir%\SL\StarLogger.url
%Windir%\SL\unins000.dat
%Windir%\SL\unins000.exe
%Windir%\SL\WinSL.dat
%Windir%\SL\WinSL.exe
%Windir%\SL\WinSLH.dll
%Windir%\SL\WinSLManager.exe
%Windir%\winsl.ini
Read more:
http://www.symantec.com/business/securit...
Kill the process WinSL.exe and remove WinSL.exe from Windows startup.

winslh.dll
We suggest you to remove WinSLH.dll from your computer as soon as possible.
WinSLH.dll is Spyware.StarLogger.
Spyware.StarLogger is a spyware program that may steal sensitive information from the computer.
Related files:
C:\Documents and Settings\All Users\Start Menu\Programs\StarLogger\Image Viewer.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\StarLogger\StarLogger on the Web.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\StarLogger\StarLogger.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\StarLogger\Uninstall StarLogger.lnk
%Windir%\SL\ImgView.exe
%Windir%\SL\StarLogger.url
%Windir%\SL\unins000.dat
%Windir%\SL\unins000.exe
%Windir%\SL\WinSL.dat
%Windir%\SL\WinSL.exe
%Windir%\SL\WinSLH.dll
%Windir%\SL\WinSLManager.exe
%Windir%\winsl.ini
Read more:
http://www.symantec.com/business/securit...
Kill the file WinSLH.dll and remove WinSLH.dll from Windows startup.

winslh32.exe
Winslh32.exe is Trojan/Backdoor.
Kill the process winslh32.exe and remove winslh32.exe from Windows startup.

winslmanager.exe
We suggest you to remove WinSLManager.exe from your computer as soon as possible.
WinSLManager.exe is Spyware.StarLogger.
Spyware.StarLogger is a spyware program that may steal sensitive information from the computer.
Related files:
C:\Documents and Settings\All Users\Start Menu\Programs\StarLogger\Image Viewer.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\StarLogger\StarLogger on the Web.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\StarLogger\StarLogger.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\StarLogger\Uninstall StarLogger.lnk
%Windir%\SL\ImgView.exe
%Windir%\SL\StarLogger.url
%Windir%\SL\unins000.dat
%Windir%\SL\unins000.exe
%Windir%\SL\WinSL.dat
%Windir%\SL\WinSL.exe
%Windir%\SL\WinSLH.dll
%Windir%\SL\WinSLManager.exe
%Windir%\winsl.ini
Read more:
http://www.symantec.com/business/securit...
Kill the process WinSLManager.exe and remove WinSLManager.exe from Windows startup.

winsmd.exe
WINSMD.EXE is Troj/Wlook-B.
Read more:
http://www.sophos.com/security/analyses/...
Kill the process WINSMD.EXE and remove WINSMD.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

winsms.dll
Winsms.dll is Keylogger.winldra.
Related files:
%WINDOWS%\dvpd.dll
%WINDOWS%\netdx.dat
%WINDOWS%\prntsvra.dll
%WINDOWS%\socks.dat
%WINDOWS%\winsms.dll
%SYSTEM%\winldra1.exe
%WINDOWS%\prntc.log
%SYSTEM%\winldra.exe
Read more:
http://www.nuker.com/container/details/k...
Kill the file winsms.dll and remove winsms.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

winsock.exe
Winsock.exe is a mass-mailing worm W32.Mytob.GP@mm.
Winsock.exe opens a back door on TCP port 3344.
Winsock.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\deneme.exe
C:\winsock.exe
Adds the value:
"WINDOWS DENEME" = "deneme.exe"
to the Windows startup registry keys.
More info:
http://securityresponse.symantec.com/avc...
Removal:
Kill winsock.exe process and remove winsock.exe from Windows startup using RegRun Startup Optimizer.

winsock.vbs
I-Worm.DragonBall
This Internet worm spreads via e-mail messages using MS Outlook and IRC, and is written in VBS.
The IRC scripts are needed for spreading via the IRC channel.

Then the worm activates a spread procedure, opening the MS Outlook address book, and for each address, creating the following message:
Subject: Hello ;]
Body: Hi , check out this game that j sent you (funny game from the net:]).
Attach: dragonball.vbs

The worm contains errors, and this procedure can't work correctly. So, the worm can't spreads via e-mail.
In conclusion, the worm displays the following dialogue box:
When a user closes this box, the worm removes keyboard and mouse functions, and the runs MediaPlayer with a file from the Internet:
http://bdball.metropoli2000.net/mmedia/v...
and changes AUTOEXEC.BAT, inserting the strings:
@ECHO ON
ECHO DraGon Ball [Z] by YuP
ECHO Thank you and bye bye dragon world!!

Please, remove it with RegRun.

winsock2.exe
Winsock2.exe is Trojan/Backdoor.
Kill the process winsock2.exe and remove winsock2.exe from Windows startup.
www.sophos.com/virusinfo/analyses/w32spybotac.html

winsound1.exe
Winsound1.exe is Trojan/Backdoor.
Kill the process winsound1.exe and remove winsound1.exe from Windows startup.

winsp2_1_.exe
Winsp2_1_.exe is Trojan/Backdoor.
Kill the process winsp2_1_.exe and remove winsp2_1_.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winsp3.exe
Winsp3.exe is Trojan/Backdoor.
Kill the process winsp3.exe and remove winsp3.exe from Windows startup.

winspc13.exe
Remote Access / ICQ trojan
Version 1.6 autoloads through changes in System.ini and Win.ini. 1.5 uses Registry and System.ini to autoload

winspool.exe
winspool.exe is a Trojan.Dagonit-A.
winspool.exe opens a back door on TCP port.
winspool.exe spreads via open network shares.
Related files:
dalia2.exe
winspool.exe
wpap.exe
More info:
http://www.sophos.com/virusinfo/analyses...
Removal:
Kill winspool.exe process and remove winspool.exe from Windows startup using RegRun Startup Optimizer.

winspooll.exe
Winspooll.exe is Trojan/Backdoor.
Kill the process winspooll.exe and remove winspooll.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winspoolwowexec.exe
WINSPOOLWOWEXEC.EXE is Trojan/Backdoor.
Kill the process WINSPOOLWOWEXEC.EXE and remove WINSPOOLWOWEXEC.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

winsprm.exe
Winsprm.exe is Trojan/Backdoor.
Kill the process winsprm.exe and remove winsprm.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winspsrv.exe
Winspsrv.exe is Browser Hijacker.Useful-Soft application.
Read more:
http://www.superadblocker.com/definition...
Kill the process winspsrv.exe and remove winspsrv.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winspy.exe
Steals passwords

winspydemo.exe
WinSpyDemo.exe is WinSpy software.
WinSpy is a misleading application that may give exaggerated reports about potential risks on the computer.
Related files:
%Windir%\Installer\[RANDOM NAME].msi
%UserProfile%\Application Data\AntiSpywareDAT\BlockedCookies.dat
%UserProfile%\Application Data\AntiSpywareDAT\date.dat
%UserProfile%\Application Data\AntiSpywareDAT\DirectoryDefinition.dat
%UserProfile%\Application Data\AntiSpywareDAT\ENoSignature.dat
%UserProfile%\Application Data\AntiSpywareDAT\ExeDefinition.dat
%UserProfile%\Application Data\AntiSpywareDAT\FileDefinition.dat
%UserProfile%\Application Data\AntiSpywareDAT\RegistryDefinition.dat
%UserProfile%\Application Data\AntiSpywareDAT\Safety.dat
%UserProfile%\Desktop\WinSpy Demo.lnk
%UserProfile%\Start Menu\Programs\WinSpy Software\WinSpy Demo\Readme-Help.lnk
%UserProfile%\Start Menu\Programs\WinSpy Software\WinSpy Demo\WinSpy Demo.lnk
%UserProfile%\Start Menu\Programs\WinSpy Software\WinSpy Demo\WinSpy.com.url
%ProgramFiles%\WinSpy Demo\WinSpyDemo.exe
%ProgramFiles%\WinSpy Demo\help.chm
%ProgramFiles%\WinSpy Demo\Localization.xml
%ProgramFiles%\WinSpy Demo\riched32.dll
%ProgramFiles%\WinSpy Demo\WinSpy.com.url
Read more:
http://www.symantec.com/enterprise/secur...
Kill the process WinSpyDemo.exe and remove WinSpyDemo.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winsrcv.exe
Winsrcv.exe is Trojan/Backdoor.
Read more:
http://fileinfo.prevx.com/adware/qq24774...
Kill the process winsrcv.exe and remove winsrcv.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winsrvc.exe
Destructive trojan
Rasmin uses up all the memory and the infected computer crashes regularly.

winssc32.exe
Winssc32.exe is a mass-mailing worm W32.Kedebe@mm.
Winssc32.exe tries to terminate antiviral programs installed on a user computer.
Winssc32.exe spreads by e-mail and via open network shares.
Related files:
%System%\winssc32.exe
%System%\mscppdmg.exe
%System%\kernel32hlp.exe
%System%\NAVctrl.exe
%System%\dwrdgr32.exe
%System%\gcasctrl.exe
%System%\AVmon.exe
%System%\winxplt.exe
%System%\gcasAV32.exe
%System%\LUCOMS~2.EXE
%System%\zlbclient.exe
%system%\win32infchkr.exe
Adds the value:
"Windows Console Monitor" = "%System%\[path to the worm]"
"load" = "%Userprofile%\LOCALS~1\Applic~1\MICROS~1\Windows\[path to the worm]"
to the Windows startup registry keys.
More info:
http://securityresponse.symantec.com/avc...
Removal:
Kill winssc32.exe process and remove winssc32.exe from Windows startup using RegRun Startup Optimizer.

winssi.exe
WinSSi.exe is a Backdoor Trojan.Riler.B.
WinSSi.exe spreads via open network shares.
Related files:
%System%\srchost.exe
%System%\sporder.dll
%System%\winmedl.dll
%System%\WinSSi.exe
%System%\comsrm.dll
More info:
http://securityresponse.symantec.com/avc...
Removal:
Kill WinSSi.exe process and remove WinSSi.exe from Windows startup using RegRun Startup Optimizer.

winssk32.exe
This is SOBIG worm.
Read full information at:
http://www.lurhq.com/sobig-e.html
Remove it from startup by RegRun Startup Optimizer.

winssv.exe
Winssv.exe is FORBOT-BH worm.
Kill the process winssv.exe and remove winssv.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com
Read more: http://www.sophos.com/virusinfo/analyses...

winstall.exe
Winstall.exe is Trojan/Backdoor.
Kill the process winstall.exe and remove winstall.exe from Windows startup.

winstart.exe
Winstart.exe is W32/Agobot-QH.
Read more:
http://www.sophos.com/security/analyses/...
Kill the process winstart.exe and remove winstart.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winstat.exe
Steals passwords / ICQ trojan
Also known as: Backdoor.Kodorian, Win32/Kodorian, Troj/Kodoria
Displays a Firework and simultanlously starts in the backround. Sends the passwords encrypted via e-mail.
Kill the processes:
winstat.exe
kodorjan.exe
server.exe
Remove Files:
c:\manasi.yok
c:\winstat.exe
kodorjan.exe
okursan?yiedersinokumazsan?yibokyersin.txt
server.exe

If you are not sure, use Ask Computer Guys service:
http://www.greatis.com/security/askguys....

winstatkeep.exe
Steals passwords / ICQ trojan
Also known as: Backdoor.Kodorian, Win32/Kodorian, Troj/Kodoria
Displays a Firework and simultanlously starts in the backround. Sends the passwords encrypted via e-mail.
Kill the processes:
winstat.exe
kodorjan.exe
server.exe
Remove Files:
c:\manasi.yok
c:\winstat.exe
kodorjan.exe
okursan?yiedersinokumazsan?yibokyersin.txt
server.exe

If you are not sure, use Ask Computer Guys service:
http://www.greatis.com/security/askguys....

winstop32.exe
Remote Access
Alters Win.ini and System.ini. A servereditor makes it possible for an intruder to change the port used and the UIN to notify upon a new succesful installation.

winststkeep.exe
Steals passwords / ICQ trojan
Also known as: Backdoor.Kodorian, Win32/Kodorian, Troj/Kodoria
Displays a Firework and simultanlously starts in the backround. Sends the passwords encrypted via e-mail.
Kill the processes:
winstat.exe
kodorjan.exe
server.exe
Remove Files:
c:\manasi.yok
c:\winstat.exe
kodorjan.exe
okursan?yiedersinokumazsan?yibokyersin.txt
server.exe

If you are not sure, use Ask Computer Guys service:
http://www.greatis.com/security/askguys....

winsupdater.exe
Winsupdater.exe is Trojan/Backdoor.
Kill the process winsupdater.exe and remove winsupdater.exe from Windows startup.

winsvcc.exe
Winsvcc.exe is Trojan/Backdoor Spy.Win32.Agent.
Kill the process winsvcc.exe and remove winsvcc.exe from Windows startup.

winsvcmgr.exe
Winsvcmgr.exe is Trojan/Backdoor.
Kill the process winsvcmgr.exe and remove winsvcmgr.exe from Windows startup.

winsvcmon.exe
Winsvcmon.exe is Trojan/Backdoor.
Kill the process winsvcmon.exe and remove winsvcmon.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winsvcup.exe
Winsvcup.exe (WindowsFirewallSvc) is W32/Sdbot.worm.
Read more:
http://vil.nai.com/vil/content/v_100454....
Kill the process winsvcup.exe and remove winsvcup.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winsvr.exe
Winsvr.exe is Trojan/Backdoor.
Kill the process winsvr.exe and remove winsvr.exe from Windows startup.

winsvrc.exe
Worm / Mail trojan / Destructive trojan
When executed, Navidad displays an Error box with the text "UI". After the user has pushed OK, a blue eyes icon is placed in the Taskbar. Due to a misstake from the author´s side, when it writes to Hkey_Classes_Root, the system may crasch and become unusable. Suppresses the running of any .exe files. Reads incomming mails and sends itself back in return.

winsyncupx.exe
Winsyncupx.exe is Trojan/Backdoor.
Read more:
http://www.incodesolutions.com/threats/S...
Kill the process winsyncupx.exe and remove winsyncupx.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winsys.exe
Remote Access / Steals passwords / ICQ trojan
Alters System.ini.

winsys_32.exe
WINSYS_32.EXE is Trojan/Backdoor.
Read more:
http://fileinfo.prevx.com/fileinfo.asp?P...
Kill the process WINSYS_32.EXE and remove WINSYS_32.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

winsys2.exe
Winsys2.exe is Trojan/Backdoor.
Kill the process winsys2.exe and remove winsys2.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winsys2f.dll
Winsys2f.dll is W32/Xorpix.AR!tr.
Read more:
http://www.fortinet.com/VirusEncyclopedi...
Kill the file winsys2f.dll and remove winsys2f.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

winsys32.exe
Winsys32.exe is Trojan/Backdoor Loony-O Trojan.
Kill the process winsys32.exe and remove winsys32.exe from Windows startup.

winsys32_070109.dll
WINSYS32_070109.DLL is Trojan/Backdoor.
Read more:
http://fileinfo.prevx.com/adware/qq90ba6...
Kill the file WINSYS32_070109.DLL and remove WINSYS32_070109.DLL from Windows startup using RegRun Reanimator.
http://www.regrun.com

winsys32_070206.dll
WINSYS32_070206.DLL is Rootkit.DialCall.
Read more:
http://fileinfo.prevx.com/adware/qqb3b97...
Kill the file WINSYS32_070206.DLL and remove WINSYS32_070206.DLL from Windows startup using RegRun Reanimator.
http://www.regrun.com

winsys32dll.vbs
I-Worm.Horillka
This malicious worm spreads via the Internet in the form of a file attached to infected messages.

It copies itself to the Windows system directory under the name WinSys32dll.vbs, and registers this file in the system registry autorun key.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\WinSys32dll.
The virus mass mails all addresses found in the Microsoft Outlook address book.

Characteristics of infected messages:
Message header:
Âíèìàíèå!
Message body:
Âûïóùåíî íîâîå vbs îáíîâëåíèå äëÿ ïîèñêà âèðóñîâ â ïàìÿòè ÎÑ Windows!
Îíî ïîìîãàåò áîðîòüñÿ ñ âèðóñàìè, ðàññûëàþùèìèñÿ ïî ïî÷òå.
Àíòèâèðóñíûé ìîäóëü íàïèñàí íà ñêðèïò-ÿçûêå, ÷òî ïîìîãàåò ïåðåõâàòûâàòü
vb è js âèðóñû, ïðåæäå ÷åì îíè íà÷íóò äåñòðóêòèâíóþ äåÿòåëüíîñòü.
Äîñòàòî÷íî îòêðûòü ôàéë è ïðîãðàììà ïî óñòðàíåíèþ âèðóñîâ ïðîâåäåò ïîèñê
âðåäîíîñíûõ ïðîãðàìì â ïàìÿòè êîìïüþòåðà.
Attachment:
WinSys32.dll.vbs

Once messages have been sent, the virus sends its author a message which includes all .pwl (password) files found in the Windows directory.
The virus copies itself to all disks and all directories under the name of Folderdll.vbs and marks these files as hidden.
It searches the Windows folder for files with the following extensions: .vbs; .jpg; .jpeg; .gif; .bmp; .htm; .html; .avc; .txt; .doc; .mp3; .wav; .dbf

- Horilka overwrites .vbs files with its own code.
- It replaces .jpg, .jpeg, .gif and .bmp files with a GIF format graphic contained in the body of the virus.
- It adds the following code to .htm and.html files:
object id='test' data='#' width='100%' height='100%' type='text/x-scriptlet' VIEWASTEXT
- .avc files are overwritten with the phrase:
Vyatka was here
.txt and .doc files are overwritten with the following text:
Óâàæàåìûå ãîñïîäà! Âàñ õàêíóë âèðóñ èç Âÿòêè - çàäíèöû Ðîññèè.
Dear friends! You was hacked by virus from Vyatka (situated in deep ass of Russia)
..:: Xpi1oT ::..
- .mp3 and .wav files are replaced by sound files contained in the body of the worm
- If the worm finds any files with a .dbf extension, it deletes them

The virus displays the announcement: COOOOOOOOL
on 11th December every year, and overwrites the autoexec.bat file with the commands to format your hard disks.

Use RegRun Startup Optimizer to automatically remove this registry item.

winsys64.sys
WINSYS64.SYS is Trojan/Backdoor.
Kill the file WINSYS64.SYS and remove WINSYS64.SYS from Windows startup using RegRun Reanimator.
http://www.regrun.com

winsysban1.exe
Winsysban1.exe is Trojan/Backdoor Freeprod.
Kill the process winsysban1.exe and remove winsysban1.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winsysban10.exe
Winsysban10.exe is Trojan/Backdoor.
Kill the process winsysban10.exe and remove winsysban10.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winsysban11.exe
Winsysban11.exe is Trojan/Backdoor.
Kill the process winsysban11.exe and remove winsysban11.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winsysban12.exe
Winsysban12.exe is Trojan/Backdoor Freeprod.
Kill the process winsysban12.exe and remove winsysban12.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winsysban2.exe
Winsysban2.exe is Trojan/Backdoor Freeprod.
Kill the process winsysban2.exe and remove winsysban2.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winsysban3.exe
Winsysban3.exe is Trojan/Backdoor Freeprod.
Kill the process winsysban3.exe and remove winsysban3.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winsysban4.exe
Winsysban4.exe is Trojan/Backdoor Freeprod.
Kill the process winsysban4.exe and remove winsysban4.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winsysban5.exe
Winsysban5.exe is Trojan/Backdoor Freeprod.
Kill the process winsysban5.exe and remove winsysban5.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winsysban6.exe
Winsysban6.exe is Trojan/Backdoor Freeprod.
Kill the process winsysban6.exe and remove winsysban6.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winsysban7.exe
Winsysban7.exe is Trojan/Backdoor Toolbar888.
Kill the process winsysban7.exe and remove winsysban7.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winsysban8.exe
Winsysban8.exe is Trojan/Backdoor Freeprod.
Kill the process winsysban8.exe and remove winsysban8.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winsysban9.exe
Winsysban9.exe is Trojan/Backdoor.
Kill the process winsysban9.exe and remove winsysban9.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winsyscfg.exe
Winsyscfg.exe is a Mytob mass-mailing worm and IRC backdoor variant.
Kill the process winsyscfg.exe and remove winsyscfg.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winsysengine.exe
Winsysengine.exe is Trojan/Backdoor.
Kill the process winsysengine.exe and remove winsysengine.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winsyshp.exe
Winsyshp.exe is W32/Delf-EXT.
Read more:
http://www.sophos.com/security/analyses/...
Kill the process winsyshp.exe and remove winsyshp.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winsysi.exe
Winsysi.exe is Trojan/Backdoor Sdbot.
Kill the process winsysi.exe and remove winsysi.exe from Windows startup.

winsyslog.exe
WINSYSLOG.EXE is RapidBlaster parasite.
Read more:
http://www.wilderssecurity.net/specialin...
Kill the process WINSYSLOG.EXE and remove WINSYSLOG.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

winsysmngr32.exe
Winsysmngr32.exe is PC Tattletale Spyware.
Read more:
http://research.sunbelt-software.com/thr...
Kill the process winsysmngr32.exe and remove winsysmngr32.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winsysmp.exe
WINSYSMP.EXE is Worm.Mytob.
Read more:
http://www.fileresearchcenter.com/W/WINS...
Kill the process WINSYSMP.EXE and remove WINSYSMP.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

winsyst.exe
W32/Rbot-DL is a network worm and backdoor Trojan for the Windows platform.
Allows a malicious user remote access to an infected computer.
W32/Rbot-DL spreads using a variety of techniques including exploiting weak passwords on computers and SQL servers, exploiting operating system vulnerabilities (including DCOM-RPC, LSASS, WebDAV and UPNP) and using backdoors opened by other worms or Trojans.
W32/Rbot-DL can be controlled by a remote attacker over IRC channels.

Manual removal:
Go to the HKEY_LOCAL_MACHINE entries:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
and delete the value:
Microsoft Update = winsyst.exe

winsystem.exe
Winsystem.exe is Trojan/Backdoor W32/Whitebait.gen@MM.
Kill the process winsystem.exe and remove winsystem.exe from Windows startup.
Related files:
%WinDir%\BDN.COM
%WinDir%\MSSECU.EXE
%WinDir%\WINSYSTEM.EXE
http://vil.nai.com/vil/content/v_99336.h...

winsystem16.exe
Winsystem16.exe is Trojan/Backdoor.
Kill the process winsystem16.exe and remove winsystem16.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winsystem32.exe
Winsystem32.exe is Trojan/Backdoor Sdbot.
Kill the process winsystem32.exe and remove winsystem32.exe from Windows startup.

winsystem32xp.exe
Winsystem32xp.exe is a worm W32.Kelvir.W.
winsystem32xp.exe spreads by MSN Messenger and via open network shares .
winsystem32xp.exe tries to terminate antiviral programs installed on a user computer.
winsystem32xp.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%ProgramFiles%\ACS-Style\rxBot.exe
%ProgramFiles%\ACS-Style\acs.exe
%system%\winsystem32xp.exe
More info:
http://securityresponse.symantec.com/avc...
Removal:
Kill winsystem32xp.exe process and remove winsystem32xp.exe from Windows startup using RegRun Startup Optimizer.

winsysupd1.exe
Winsysupd1.exe is Trojan/Backdoor Freeprod.
Kill the process winsysupd1.exe and remove winsysupd1.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winsysupd10.exe
Winsysupd10.exe is Trojan/Backdoor Freeprod.
Kill the process winsysupd10.exe and remove winsysupd10.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winsysupd11.exe
Winsysupd11.exe is Trojan/Backdoor.
Kill the process winsysupd11.exe and remove winsysupd11.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winsysupd12.exe
Winsysupd12.exe is Trojan/Backdoor Freeprod.
Kill the process winsysupd12.exe and remove winsysupd12.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winsysupd2.exe
Winsysupd2.exe is Trojan/Backdoor Freeprod.
Kill the process winsysupd2.exe and remove winsysupd2.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winsysupd3.exe
Winsysupd3.exe is Trojan/Backdoor Freeprod.
Kill the process winsysupd3.exe and remove winsysupd3.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winsysupd4.exe
Winsysupd4.exe is Trojan/Backdoor Freeprod.
Kill the process winsysupd4.exe and remove winsysupd4.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winsysupd5.exe
Winsysupd5.exe is Trojan/Backdoor Freeprod.
Kill the process winsysupd5.exe and remove winsysupd5.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winsysupd6.exe
Winsysupd6.exe is Trojan/Backdoor Freeprod.
Kill the process winsysupd6.exe and remove winsysupd6.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winsysupd7.exe
Winsysupd7.exe is Trojan/Backdoor Toolbar888.
Kill the process winsysupd7.exe and remove winsysupd7.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winsysupd8.exe
Winsysupd8.exe is Trojan/Backdoor Freeprod.
Kill the process winsysupd8.exe and remove winsysupd8.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winsysupd9.exe
Winsysupd9.exe is Trojan/Backdoor.
Kill the process winsysupd9.exe and remove winsysupd9.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winsysupds.exe
Winsysupds.exe is Trojan/Backdoor.
Kill the process winsysupds.exe and remove winsysupds.exe from Windows startup.

wintask.exe
Worm / Mail trojan / Destructive trojan
When executed, Navidad displays an Error box with the text "UI". After the user has pushed OK, a blue eyes icon is placed in the Taskbar. Due to a misstake from the author´s side, when it writes to Hkey_Classes_Root, the system may crasch and become unusable. Suppresses the running of any .exe files. Reads incomming mails and sends itself back in return.

wintaskadx.dll
WinTaskAdX.dll is Spyware.Winad.
Kill the file WinTaskAdX.dll and remove WinTaskAdX.dll from Windows startup using RegRun.
www.regrun.com

wintasks32.exe
Wintasks32.exe is W32/Rbot-FPD.
Read more:
http://www.sophos.com/security/analyses/...
Kill the process wintasks32.exe and remove wintasks32.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

wintcp.exe
Wintcp.exe is Trojan/Backdoor.
Kill the process wintcp.exe and remove wintcp.exe from Windows startup.

winte32.exe
Winte32.exe is Trojan/Backdoor.
Kill the process winte32.exe and remove winte32.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

wintec.sys
Wintec.sys is Trojan-Spy.Win32.VB.f.
Read more:
http://www.viruslist.com/en/viruses/ency...
Kill the file wintec.sys and remove wintec.sys from Windows startup using RegRun Reanimator.
http://www.regrun.com

wintems.exe
Wintems.exe is Trojan/Rootkit Bagle.GF.
Kill the process wintems.exe and remove wintems.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com
Read more:
http://www.f-secure.com/v-descs/bagle_gf...

wintfj32.dll
WINTFJ32.DLL is Trojan/Backdoor.
Kill the file WINTFJ32.DLL and remove WINTFJ32.DLL from Windows startup using RegRun Reanimator.
http://www.regrun.com

wintftp.exe
W32/Sdbot-KE is a network worm and backdoor for the Windows platform.
The backdoor component allows a malicious user remote access to an infected computer via IRC.
The worm spreads by exploiting network shares with weak passwords.
W32/Sdbot-KE copies itself to wintftp.exe in the system folder on remote computers and runs the copy.

Manual removal:
Locate the HKEY_LOCAL_MACHINE entries:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
and delete the value:
Win FTP = wintftp.exe

winthg32.dll
WINTHG32.DLL is Trojan/Backdoor.
Kill the file WINTHG32.DLL and remove WINTHG32.DLL from Windows startup using RegRun Reanimator.
http://www.regrun.com

wintjv32.dll
Wintjv32.dll is Trojan/Backdoor.
Kill the file wintjv32.dll and remove wintjv32.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com
Read more:
http://www.sophos.com/virusinfo/analyses...

wintlb.exe
ServeMe
FTP server

wintli32.dll
WINTLI32.DLL is Trojan/Backdoor.
Kill the file WINTLI32.DLL and remove WINTLI32.DLL from Windows startup using RegRun Reanimator.
http://www.regrun.com

wintn32.dll
Wintn32.dll is Trojan/Backdoor.
Kill the file wintn32.dll and remove wintn32.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

wintn32.exe
Wintn32.exe is Trojan/Backdoor.
Kill the process wintn32.exe and remove wintn32.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

wintouch.exe
Wintouch.exe is Trojan-Downloader.Matcash.
Related files:
%PROGRAM_FILES%\ wintouch\ wintouch.exe
%SYSTEM%\ svchosts.exe
%windows%\ downloaded program files\ speedtest2.dll
%WINDOWS%\ iraiomt.exe
%WINDOWS%\ retadpu1000106.exe
%WINDOWS%\ retadpu27.exe
amst5.exe
amwr.exe
b122.exe
b138.exe
cogyaga58441.exe
download48de.exe
hodhtyva.exe
install.exe
nsrandom.dll
rau001978.exe
retadpu.exe
retadpu1000272.exe
retadpu27.exe
t5qasq1083.exe
updater.exe
wintouchinstaller.exe
wr613.exe
Read more:
http://research.sunbelt-software.com/thr...
Kill the process wintouch.exe and remove wintouch.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

wintouchinstaller.exe
Wintouchinstaller.exe is Trojan-Downloader.Matcash.
Related files:
%PROGRAM_FILES%\ wintouch\ wintouch.exe
%SYSTEM%\ svchosts.exe
%windows%\ downloaded program files\ speedtest2.dll
%WINDOWS%\ iraiomt.exe
%WINDOWS%\ retadpu1000106.exe
%WINDOWS%\ retadpu27.exe
amst5.exe
amwr.exe
b122.exe
b138.exe
cogyaga58441.exe
download48de.exe
hodhtyva.exe
install.exe
nsrandom.dll
rau001978.exe
retadpu.exe
retadpu1000272.exe
retadpu27.exe
t5qasq1083.exe
updater.exe
wintouchinstaller.exe
wr613.exe
Read more:
http://research.sunbelt-software.com/thr...
Kill the process wintouchinstaller.exe and remove wintouchinstaller.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

wintour.exe
Remote Access
Modified Acid Shiver Server.

wintrust.exe
Wintrust.exe is CoolWebSearch.
Read more:
http://www.spywaredata.com/spyware/malwa...
Kill the process wintrust.exe and remove wintrust.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

wintrust32.exe
Wintrust32.exe is Trojan/Backdoor.
Kill the process wintrust32.exe and remove wintrust32.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

wintst.dll
WINTST.DLL is Trojan/Backdoor.
Kill the file WINTST.DLL and remove WINTST.DLL from Windows startup using RegRun Reanimator.
http://www.regrun.com

winttr.exe
Winttr.exe is MediaTickets CDT Adware.
Read more:
http://research.sunbelt-software.com/thr...
Kill the process winttr.exe and remove winttr.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

wintuh32.dll
WINTUH32.DLL is Trojan.Agent.qt.
Kill the file WINTUH32.DLL and remove WINTUH32.DLL from Windows startup using RegRun Reanimator.
http://www.regrun.com

wintwt32.dll
Wintwt32.dll is Adware.SuperSpider.
Kill the file wintwt32.dll and remove wintwt32.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

winu32.exe
Winu32.exe is Trojan/Backdoor.
Kill the process winu32.exe and remove winu32.exe from Windows startup.

winub32.exe
Winub32.exe is Trojan/Backdoor.
Kill the process winub32.exe and remove winub32.exe from Windows startup.

winubg32.dll
Winubg32.dll is Trojan-Downloader.Win32.ConHook.gen.
Read more:
http://research.sunbelt-software.com/thr...
Kill the file winubg32.dll and remove winubg32.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

winug32.exe
Winug32.exe is Trojan/Backdoor Downloader Agent.
Kill the process winug32.exe and remove winug32.exe from Windows startup.

winuj32.exe
Winuj32.exe is Trojan/Backdoor.
Kill the process winuj32.exe and remove winuj32.exe from Windows startup.

winuns.dll
We suggest you to remove winuns.dll from your computer as soon as possible.
Winuns.dll is Trojan/Backdoor.
Kill the file winuns.dll and remove winuns.dll from Windows startup.

winuns32.dll
Winuns32.dll is Trojan/Backdoor.
Kill the file winuns32.dll and remove winuns32.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

winup.exe
W32/Sdbot-LS is a member of the W32/Sdbot family of worms with backdoor component.
When active the worm attempts to connect to a remote IRC server and allows a malicious user remote access to the infected computer.
In order to run automatically when Windows starts up the worm copies itself to the file winup.exe in the Windows system folder and adds the some registry entries.
These entries can be easily removed with RegRun.

winupcd.exe
Winupcd.exe is Worm.RBot.
Read more:
http://www.fileresearchcenter.com/W/WINU...
Kill the process winupcd.exe and remove winupcd.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winupd.exe
Status: This is a trojan.
Read more:
http://www.dark-e.com/archive/trojans/en...

Recommendation: Stop its running and delete winupd.exe.

winupd32.exe
Winupd32.exe is a mass-mailing worm W32.Mytob.CE@mm.
Winupd32.exe tries to terminate antiviral programs installed on a user computer.
Winupd32.exe opens a back door on a random TCP port.
Related files:
%System%\winupd32.exe
Adds the value:
"Windows Updates" = "winupd32.exe"
to the Windows startup registry keys.
More info:
http://securityresponse.symantec.com/avc...
Removal:
Kill winupd32.exe process and remove winupd32.exe from Windows startup using RegRun Startup Optimizer.

winupdate.exe
W32.Spybot.EAS is a worm that may be remotely controlled via IRC channels.
It includes distributed denial of service (DDoS) and back door capabilities.
The worm also attempts to steal confidential information from the infected computer.

Adds the value: "con.exe"
to the following registry key: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services
Deletes the following local network shares: $ipc; $admin; $c; $d

Attempts to open a backdoor by connecting to an IRC channel on latina.a.la using TCP port 6667.
The worm will listen for commands that allow the attacker to perform the following actions:
- Download and execute files.
- Scan the network for servers running backdoor Trojans.
- List, stop, and start processes.
- Launch Denial of Service (DoS) attacks.
- Steal system information and send it to the attacker.
- Perform port redirection.
- Start a socks4/5 proxy.

Remove it from startup by RegRun Startup Optimizer.

winupdate32.exe
Winupdate32.exe is a Trojan Backdoor.Sdbot.
Winupdate32.exe spreads via Internet Relay Chat (IRC).
Winupdate32.exe tries to terminate antiviral programs installed on a user computer.
Winupdate32.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\Cnfgldr.exe
%System%\cthelp.exe
%System%\Sysmon16.exe
%System%\Sys3f2.exe
%System%\Syscfg32.exe
%System%\Mssql.exe
%System%\Aim95.exe
%System%\Svchosts.exe
%System%\FB_PNU.EXE
%System%\Cmd32.exe
%System%\Sys32.exe
%System%\Explorer.exe
%System%\IEXPL0RE.EXE
%System%\iexplore.exe
%System%\sock32.exe
%System%\MSTasks.exe
%System%\service.exe
%System%\Regrun.exe
%System%\ipcl32.exe
%System%\syswin32.exe
%System%\CMagesta.exe
%System%\YahooMsgr.exe
%System%\vcvw.exe
%System%\spooler.exe
%System%\MSsrvs32.exe
%System%\svhost.exe
%System%\winupdate32.exe
%System%\quicktimeprom.exe
More info:
http://securityresponse.symantec.com/avc...
Removal:
Kill winupdate32.exe process and remove winupdate32.exe from Windows startup using RegRun Startup Optimizer.

winupdatez.exe
Winupdatez.exe is Indexing The System Files (Indexing Service).
Kill the process winupdatez.exe and remove winupdatez.exe from Windows startup using RegRun.
www.regrun.com

winupdbc.exe
Winupdbc.exe is Troj/Bancban-QA.
Related files:
%Startup%\winupdbc.exe
%System%\winupdbc.exe
%Root%\start.bat
%Windows%\reg_88448888.txt
Read more:
http://www.sophos.com/security/analyses/...
Kill the process winupdbc.exe and remove winupdbc.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winupdsdgm.exe
Gaobot Trojan.
Spreads in local network via open shares.
Also it uses DCOM RPC vulnerability (135,445 ports) and WebDav vulnerability (port 80).
Allows to control the victim computer by IRC.
Terminates well known antiviral software.
Removal:
install the patches from Microsoft:
http://www.microsoft.com/technet/securit...
http://www.microsoft.com/technet/securit...
http://www.microsoft.com/technet/securit...
http://www.microsoft.com/technet/securit...
http://www.microsoft.com/technet/securit...
http://www.microsoft.com/technet/securit...
http://www.microsoft.com/technet/securit...
Set the strong passwords for network shares.
Use RegRun "Terminate" feature to erase the virus body files.
They are located in Windows\System32 folder.
Cavapsvc.exe
Csrrs.exe
Cvhost.exe
DIIhost.exe (with capital letter 'i')
Dosrun32.exe
Dos32.exe
Lsas.exe
Regloadr.exe
Schost.exe
Scvhost.exe
Service.exe
Servicess.exe
Sochost.exe
Swchost.exe
System.exe
Update.exe
Wdrun32.exe
Winhlpp32.exe
Winreg.exe
Winupdsdgm.exe

Free removal tool:
http://securityresponse.symantec.com/avc...

winupdsv.exe
winupdsv.exe is a macro virus XM97.Netsnak-B.
winupdsv.exe deletes files off the computer.
More info:
http://www.sophos.com/virusinfo/analyses...
Removal:
Kill winupdsv.exe process and remove winupdsv.exe from Windows startup using RegRun Startup Optimizer.

winupdt.exe
W32/Rbot-FP is a worm that also has backdoor Trojan functionality, allowing unauthorised remote access to the infected computer via IRC channels.
Spreads to network shares with weak passwords and via network security exploits as a result of the backdoor Trojan element receiving the appropriate commands from a remote user.

Also set the registry entries below:
HKLM\SOFTWARE\Microsoft\Ole\EnableDCOM="N"
HKLM\SYSTEM\ControlSet001\Control\Lsa\restrictanonymous=dword:00000001
HKLM\SYSTEM\CurrentControlSet\Control\Lsa\restrictanonymous=dword:00000001

It will try to delete network shares on the infected system and will terminate running processes related to anti-virus, computer security and system administration that could potentially be used to remove W32/Rbot-FP from the infected system.

Remove it by using RegRun Startup Optimizer.

winupdtl.exe
Winupdtl.exe is Adware.
Winupdtl.exe collects private information and sends to advertising server, displays popups.
Kill the process winupdtl.exe and remove winupdtl.exe from Windows startup.

winupsvc.exe
Winupsvc.exe is Trojan/Backdoor.
Kill the process winupsvc.exe and remove winupsvc.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winuqw32.dll
Winuqw32.dll is Trojan-Clicker.Win32.Small.kb.
Read more:
http://www.sophos.com/security/analyses/...
Kill the file winuqw32.dll and remove winuqw32.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

winusb32.exe
Winusb32.exe is Trojan/Backdoor.
Kill the process winusb32.exe and remove winusb32.exe from Windows startup.

winuser.exe
Winuser.exe is Trojan.Bakloma.
Related files:
%Windir%\Winuser.exe
%Windir%\Winuser.ini
Read more:
http://www.symantec.com/enterprise/secur...
Kill the process Winuser.exe and remove Winuser.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winuser32.exe
W32/Sdbot-KF
Aliases: Backdoor.Spyboter.gen, W32/Spybot.worm.gen.a, Win32/Spyboter.M
It is a worm which attempts to spread to remote network shares.
It also contains backdoor Trojan functionality, allowing unauthorised remote access to the infected computer via IRC channels.
Copies itself to the Windows system folder as WINUSER32.EXE

Creates entries in the registry at the following locations so as to run itself on system startup:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

Attempts to terminate some processes relating to antivirus and security programs including REGEDIT.EXE, PING.EXE and NETSTAT.EXE.
Attempts to set the following registry entry to prevent access to some registry tools:
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\ DisableRegistryTools = 1

Spreads to network shares with weak passwords and via network security exploits as a result of the backdoor Trojan element receiving the appropriate command from a remote user, copying itself to NTLORD.EXE on the local computer at the same time.

W32/Sdbot-KF may log user keystrokes to a file called KEYLOG.TXT and network information to a file called SCANZ.TXT.

You can automatical remove it from startup with RegRun Startup Optimizer.

winusr.exe
WinUsr.exe is a worm W32.Clunk.A.
WinUsr.exe tries to terminate antiviral programs installed on a user computer.
WinUsr.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
WinUsr.exe spreads by e-mail and via open network shares.
Related files:
%Windir%\sistem32.dll
%Windir%\WinUsr.exe
C:\Documents and Settings\All Users\Start Menu\Programs\Desktop Manager.lnk

Adds the value:
"WinUsr" = "%Windir%\WinUsr.exe K1S2"
to the Windows startup registry keys.

More info:
http://securityresponse.symantec.com/avc...
Removal:
Kill WinUsr.exe process and remove WinUsr.exe from Windows startup using RegRun Startup Optimizer

winuyw32.dll
WINUYW32.dll is Trojan/Backdoor.
Kill the file WINUYW32.dll and remove WINUYW32.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

winvbie.dll
WINVBIE.DLL is Adware COMMANDERNET.
Read more:
http://vil.mcafeesecurity.com/vil/conten...
Kill the file WINVBIE.DLL and remove WINVBIE.DLL from Windows startup using RegRun.
www.regrun.com

winvct32.exe
WINVCT32.EXE is Trojan/Backdoor.
Read more:
http://fileinfo.prevx.com/adware/qq25e16...
Kill the process WINVCT32.EXE and remove WINVCT32.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

winvercp.exe
Winvercp.exe is Trojan/Backdoor.
Related files:
1 :%DESKTOP%\WINTRUST32.EXE
2 :%WINDIR%\SYSTEM32\__DELETE_ON_REBOOT__WINVERCP.EXE
3 :%WINDIR%\SYSTEM32\ACTSRV.EXE
4 :%WINDIR%\SYSTEM32\DXCOMBIN.EXE
5 :%WINDIR%\SYSTEM32\DXCOMBIN2.EXE
6 :%WINDIR%\SYSTEM32\IWINAPP.EXE
7 :%WINDIR%\SYSTEM32\NETID.EXE
8 :%WINDIR%\SYSTEM32\NETIDBAD.EXE
9 :%WINDIR%\SYSTEM32\NETMSG.EXE
10:%WINDIR%\SYSTEM32\ODBC.EXE
Read more:
http://fileinfo.prevx.com/adware/qq99ca4...
Kill the process winvercp.exe and remove winvercp.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winvmm32.exe
Remote Access / Steals passwords
The VB6 files kan be tricked on a victim when he/she runs the game Father Jack Simulator (JackSim.exe).

winvslmq.exe
We suggest you to remove winvslmq.exe from your computer as soon as possible.
Winvslmq.exe is Trojan/Backdoor.
Kill the process winvslmq.exe and remove winvslmq.exe from Windows startup.

winvxd32.exe
Winvxd32.exe is a Backdoor W32.Gabloliz.A.
Winvxd32.exe spreads via open network shares.
Winvxd32.exe tries to terminate antiviral programs installed on a user computer.
Winvxd32.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\winvxd32.exe
Adds the value:
"winvxd32" = "%System%\winvxd32.exe"
to the Windows startup registry keys.
More info:
http://securityresponse.symantec.com/avc...
Removal:
Kill winvxd32.exe process and remove winvxd32.exe from Windows startup using RegRun Startup Optimizer.

winwcd.dll
Winwcd.dll is EliteMedia Adware.
Read more:
http://www.ca.com/us/securityadvisor/pes...
Kill the file Winwcd.dll and remove Winwcd.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

winwil32.dll
WINWIL32.DLL is Trojan/Backdoor.
Kill the file WINWIL32.DLL and remove WINWIL32.DLL from Windows startup using RegRun Reanimator.
http://www.regrun.com

winwim32.dll
WINWIM32.DLL is Trojan/Backdoor.
Kill the file WINWIM32.DLL and remove WINWIM32.DLL from Windows startup using RegRun Reanimator.
http://www.regrun.com

winwin.exe
Winwin.exe is Trojan/Backdoor.
Kill the process winwin.exe and remove winwin.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winwly32.dll
Winwly32.dll is Spyware.
Kill the file winwly32.dll and remove winwly32.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

winwr32.exe
Winwr32.exe is Trojan/Backdoor.
Kill the process winwr32.exe and remove winwr32.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winxdefender.exe
WINXDEFENDER.EXE is a rogue anti-spyware program WinX Defender.
Kill the process WINXDEFENDER.EXE and remove WINXDEFENDER.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

winxey32.dll
Winxey32.dll is Trojan/Backdoor.
Kill the file winxey32.dll and remove winxey32.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

winxip32.dll
Winxip32.dll is Trojan/Backdoor.
Kill the file winxip32.dll and remove winxip32.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

winxka32.dll
Winxka32.dll is Trojan/Backdoor.
Kill the file winxka32.dll and remove winxka32.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

winxp.exe
I-Worm.Bagle.ai
Spreads via the Internet as an attachment to infected messages and also via P2P networks.
Searches disks for files with some extensions and sends itself to all addresses harvested from these files.
The worm can send itself as a password protected ZIP archive. If it does this, the password will be shown in the message body. The password may be in text or graphical format.
Opens port 1080 and another port chosen at random. It then tracks port activity.
It is programmed to cease activity and self-destruct after 5th May 2006.
It tracks the execution of most well-known antivirus products and firewalls and terminates these processes.
The worm's body contains a list of URLs. It attempts to download from these sites. (At the moment of writing, none of the sites are functioning.)

Manual removal:
Navigate to the key:
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
and delete the value: "key"="%system%\winxp.exe"
Also delete the following files in the Windows system directory:
winxp.exeopen
winxp.exeopenopen
winxp.exeopenopenopen
winxp.exeopenopenopenopen

winxpinit.exe
Winxpinit.exe is Trojan/Backdoor.
Kill the process winxpinit.exe and remove winxpinit.exe from Windows startup.

winxplogon.sys
Winxplogon.sys is a part of OSBodyGuard software.
OSBodyGuard is a misleading application, which gives exaggerated reports of threats on a computer. The program then prompts the user to purchase a registered version of the software in order to remove the reported risks.
Related files:
%ProgramFiles%\OSBodyguard\dbinfo
%ProgramFiles%\OSBodyguard\dll\def2.base
%ProgramFiles%\OSBodyguard\dll\defrules.rul
%ProgramFiles%\OSBodyguard\dll\immunization.pl
%ProgramFiles%\OSBodyguard\dll\license
%ProgramFiles%\OSBodyguard\dll\malware1.lib
%ProgramFiles%\OSBodyguard\dll\malware2.lib
%ProgramFiles%\OSBodyguard\dll\malware3.lib
%ProgramFiles%\OSBodyguard\dll\sigrules.rul
%ProgramFiles%\OSBodyguard\dll\update.scr
%ProgramFiles%\OSBodyguard\osbodyguard.exe
%ProgramFiles%\OSBodyguard\OSBodyguard.url
%ProgramFiles%\OSBodyguard\unins000.dat
%ProgramFiles%\OSBodyguard\unins000.exe
C:\Documents and Settings\All Users\Start Menu\Programs\OSBodyguard\OSBodyguard on the Web.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\OSBodyguard\OSBodyguard.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\OSBodyguard\Uninstall OSBodyguard.lnk
%UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\OSBodyguard.lnk
%UserProfile%\Desktop\OSBodyguard.lnk
%SystemDrive%\winxplogon.sys
Read more:
http://www.symantec.com/enterprise/secur...
Kill the file winxplogon.sys and remove winxplogon.sys from Windows startup using RegRun Reanimator.
http://www.regrun.com

winxplt.exe
Winxplt.exe is a mass-mailing worm W32.Kedebe@mm.
Winxplt.exe tries to terminate antiviral programs installed on a user computer.
Winxplt.exe spreads by e-mail and via open network shares.
Related files:
%System%\winssc32.exe
%System%\mscppdmg.exe
%System%\kernel32hlp.exe
%System%\NAVctrl.exe
%System%\dwrdgr32.exe
%System%\gcasctrl.exe
%System%\AVmon.exe
%System%\winxplt.exe
%System%\gcasAV32.exe
%System%\LUCOMS~2.EXE
%System%\zlbclient.exe
%system%\win32infchkr.exe
Adds the value:
"Windows Console Monitor" = "%System%\[path to the worm]"
"load" = "%Userprofile%\LOCALS~1\Applic~1\MICROS~1\Windows\[path to the worm]"
to the Windows startup registry keys.
More info:
http://securityresponse.symantec.com/avc...
Removal:
Kill winxplt.exe process and remove winxplt.exe from Windows startup using RegRun Startup Optimizer.

winxtm32.dll
WINXTM32.DLL is Trojan/Backdoor.
Kill the file WINXTM32.DLL and remove WINXTM32.DLL from Windows startup using RegRun Reanimator.
http://www.regrun.com

winxtx32.dll
WINXTX32.DLL is Sopyware Beware.
Kill the file WINXTX32.DLL and remove WINXTX32.DLL from Windows startup using RegRun Reanimator.
http://www.regrun.com

winxvk32.dll
Winxvk32.dll is Trojan/Backdoor.
Kill the file winxvk32.dll and remove winxvk32.dll from Windows startup using RegRun.
www.regrun.com

winxxax.exe
Winxxax.exe is Trojan/Backdoor.
Related files:
1 :%temp%\16\WINYVVGC.EXE
2 :%temp%\18\WINFXUQMD.EXE
3 :%TEMP%\WINABMX.EXE
4 :%TEMP%\WINAEUTP.EXE
5 :%TEMP%\WINALEFIR.EXE
6 :%TEMP%\WINBEJX.EXE
7 :%TEMP%\WINBHCUJN.EXE
8 :%TEMP%\WINCRQJL.EXE
9 :%TEMP%\WINDDTSM.EXE
10:%TEMP%\WINFQYEA.EXE
11:%TEMP%\WINGOODX.EXE
12:%TEMP%\WINHHSLY.EXE
13:%TEMP%\WINJFBAUI.EXE
14:%TEMP%\WINPQELAA.EXE
15:%TEMP%\WINSNBI.EXE
Read more:
http://spywarefiles.prevx.com/RRHDII2804...
Kill the process winxxax.exe and remove winxxax.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winyim.exe
Winyim.exe is YahooSpyMon.
YahooSpyMon is a spyware program that records Yahoo! Instant Messenger information on the computer and saves it to a log file.
Related files:
%UserProfile%\Local Settings\Temp\DRDld\yimspymonitor.exe
%CommonProgramFiles%\Download Manager\Yahoo! Messenger Spy Monitor\LMDOWNLOADINFO.xml
%ProgramFiles%\YIMCS\data\dpnsvry.exe
%ProgramFiles%\YIMCS\data\emxfile003.dat
%ProgramFiles%\YIMCS\data\ps_demo_report.html
%ProgramFiles%\YIMCS\data\testftpok.html
%ProgramFiles%\YIMCS\data\vssvcy.exe
%ProgramFiles%\YIMCS\data\yimusr.ini
%ProgramFiles%\YIMCS\help.chm
%ProgramFiles%\YIMCS\License.txt
%ProgramFiles%\YIMCS\readme.txt
%ProgramFiles%\YIMCS\unins000.dat
%ProgramFiles%\YIMCS\unins000.exe
%ProgramFiles%\YIMCS\winyim.exe
%System%\adsnwy.exe
%System%\mxpvct22.dat
%System%\mxpvct25.dat
%System%\yimappini.ini
Read more:
http://www.symantec.com/enterprise/secur...
Kill the process winyim.exe and remove winyim.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winystems.exe
Winystems.exe is Trojan.Sdbot.
Kill the process winystems.exe and remove winystems.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winyt32.exe
Winyt32.exe is Trojan/Backdoor.
Kill the process winyt32.exe and remove winyt32.exe from Windows startup.

winyta32.dll
WINYTA32.DLL is Trojan/Backdoor.
Kill the file WINYTA32.DLL and remove WINYTA32.DLL from Windows startup using RegRun Reanimator.
http://www.regrun.com

winz32.exe
Added as a result of the SDBOT.Q virus.

Is a Backdoor Trojan Horse that can be controlled through an IRC server.

When Backdoor.SDBot.Q is executed, it attempts to perform the following actions:
Creates a copy of itself as %SYSTEM%\winz32.exe.

And adds the value:
"INTERNET_SERVISES" = "winz32.exe"
to the registry key:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

Connects to the IRC server, greenz.dyn.nu, joins a predefined channel, and waits for commands from the hacker.

The commands include, but are not limited to, the following:
- Manage the backdoor.
- Control the IRC client on an infected computer.
- Open and close the CD-ROM drive.
- Add files to the KaZaA, Grokster, and Bearshare shared folders. This Backdoor contains a large list of file names, which it attempts to use.
- Download and execute files.
- Start or Terminate processes.
And others.

Manual removal:
Navigate to the key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
In the right pane, delete the value:
"INTERNET_SERVISES"="winz32.exe"

Automatic removal:
Use RegRun Startup Optimizer to remove it from startup.

winzc32.exe
Winzc32.exe is Trojan/Backdoor.
Kill the process winzc32.exe and remove winzc32.exe from Windows startup.

winzdn32.dll
WINZDN32.DLL is Trojan/Backdoor.
Kill the file WINZDN32.DLL and remove WINZDN32.DLL from Windows startup using RegRun Reanimator.
http://www.regrun.com

winzip quick pick.exe
WinZip Quick Pick.exe is Email-Worm.Win32.Nyxem.e.
Related files:
%System%\New WinZip File.exe
%System%\scanregw.exe
%System%\Update.exe
%System%\Winzip.exe
%System%\WINZIP_TMP.EXE
%User Profile%\Start Menu\Programs\Startup\WinZip Quick Pick.exe
%Windir%\rundll16.exe
Kill the process WinZip Quick Pick.exe and remove WinZip Quick Pick.exe from Windows startup using RegRun.
www.regrun.com

winzipp.exe
Shadow Phyre
Remote Access / IRC trojan

winzipt.exe
Winzipt.exe is W32.Mysamurai.
W32.Mysamurai is a worm that spreads by copying itself to shared drives.
Related files:
%Temp%\[TEMP NAME].tmp
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\AdobeGama.pif
%User Profile%\Start Menu\Programs\Startup\AdobeGama.pif
C:\System Volume Information\_Resto~1\htSystem.cfg
%Windir%\explore.exe
%System%\CommandPrompt.Sysm
%System%\NvMedia.sysm
%System%\Restoration.msd
%System%\Windows 3D.scr
%System%\odbcad32.dll
%System%\shareNet.msd
%System%\Ngsys.exe
%System%\runer.exe
%System%\rvshost.exe
%System%\system31.exe
%System%\userint.exe
%System%\windxp.exe
%System%\winzipt.exe
Read more:
http://www.symantec.com/enterprise/secur...
Kill the process winzipt.exe and remove winzipt.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

winzlo32.dll
WINZLO32.DLL is Trojan/Backdoor.
Kill the file WINZLO32.DLL and remove WINZLO32.DLL from Windows startup using RegRun Reanimator.
http://www.regrun.com

winzod32.exe
WinZod32.exe is Trojan/Backdoor.
Kill the process WinZod32.exe and remove WinZod32.exe from Windows startup.

winzrs32
Winzrs32 is Trojan/Backdoor.
Kill the file winzrs32 and remove winzrs32 from Windows startup using RegRun Reanimator.
http://www.regrun.com

winzrs32.exe
WINZRS32.EXE is Trojan/Backdoor.
Read more:
http://www.fileresearchcenter.com/W/WINZ...
Kill the process WINZRS32.EXE and remove WINZRS32.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

winzwr32.dll
WINZWR32.DLL is Adware Look2ME.
Related files:
1 :%WINDIR%\SYSTEM32\WINBJT32.DLL
2 :%WINDIR%\SYSTEM32\WINBUE32.DLL
3 :%WINDIR%\SYSTEM32\WINCQT32.DLL
4 :%WINDIR%\SYSTEM32\WINEIJ32.DLL
5 :%WINDIR%\SYSTEM32\WINEIL32.DLL
6 :%WINDIR%\SYSTEM32\WINETN32.DLL
7 :%WINDIR%\SYSTEM32\WINEXY32.DLL
8 :%WINDIR%\SYSTEM32\WINEXZ32.DLL
9 :%WINDIR%\SYSTEM32\WINGDM32.DLL
10:%WINDIR%\SYSTEM32\WINGSA32.DLL
Read more:
http://fileinfo.prevx.com/adware/qqccd52...
Kill the file WINZWR32.DLL and remove WINZWR32.DLL from Windows startup using RegRun Reanimator.
http://www.regrun.com

wisvccz.exe
Wisvccz.exe is a Backdoor Trojan.Abwiz
Wisvccz.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site
Related files:
%System%\wisvccz.exe
%System%\zlbw.dll
Adds the value:
"wupdate" = "%System%\wisvccz.exe"
to the Windows startup registry keys.
More info:
http://securityresponse.symantec.com/avc...
Removal:
Kill wisvccz.exe process and remove wisvccz.exe from Windows startup using RegRun Startup Optimizer.

wiwshost.exe
Wiwshost.exe is a Trojan.Tooso.I
wiwshost.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\winshost.exe
%System%\wiwshost.exe
Adds the value:
"winshost.exe" = "%System%\winshost.exe"
to the Windows startup registry keys.
More info:
http://securityresponse.symantec.com/avc...
Removal:
Kill wiwshost.exe process and remove wiwshost.exe from Windows startup using RegRun Startup Optimizer.

wizapi32.dll
WIZAPI32.DLL is Trojan/Backdoor.
Read more:
http://fileinfo.prevx.com/adware/qq931e6...
Kill the file WIZAPI32.DLL and remove WIZAPI32.DLL from Windows startup using RegRun Reanimator.
http://www.regrun.com

wjrrfwx.exe
WJRRFWX.EXE is Polymorphic File Exploit.
Read more:
http://fileinfo.prevx.com/adware/qq8a234...
Kill the process WJRRFWX.EXE and remove WJRRFWX.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

wkbssb.exe
Wkbssb.exe is Trojan/Backdoor.
Kill the process wkbssb.exe and remove wkbssb.exe from Windows startup.

wkernel.exe
Distributed DoS tool
Storm´s client is able to controll five "zombies" (infected machines).

wkknbdx.exe
Wkknbdx.exe is Trojan/Backdoor.
Kill the process Wkknbdx.exe and remove Wkknbdx.exe from Windows startup.

wkmgylag.exe
WKMGYLAG.EXE is Trojan/Backdoor.
Read more:
http://fileinfo.prevx.com/adware/qqf37f6...
Kill the process WKMGYLAG.EXE and remove WKMGYLAG.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

wkssr.exe
Wkssr.exe is Trojan/Backdoor.
Kill the process wkssr.exe and remove wkssr.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

wkssvc.exe
Wkssvc.exe is Trojan/Backdoor Sdbot.
Kill the process wkssvc.exe and remove wkssvc.exe from Windows startup.

wkssvr.exe
Wkssvr.exe is W32.Randex.GEL.
Related files:
%System%\javanet.exe
%System%\msjava.exe
%System%\xpjavams.exe
%System%\wunosjava.exe
%System%\creative.exe
%System%\netapi.exe
%System%\msguard.exe
%System%\javaapplets.exe
%System%\jconsole.exe
%System%\winservnt32.exe
%System%\wkssvr.exe
Read more:
http://www.symantec.com/security_respons...
Kill the process wkssvr.exe and remove wkssvr.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

wksvw32.exe
WKSVW32.EXE is Trojan/Backdoor.
Kill the process WKSVW32.EXE and remove WKSVW32.EXE from Windows startup.

wl.exe.exe
WL.EXE.EXE is Trojan/Backdoor.
Read more:
http://fileinfo.prevx.com/fileinfo.asp?P...
Kill the process WL.EXE.EXE and remove WL.EXE.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

wlbaloon
Wlbaloon is Trojan/Backdoor.
Remove Wlbaloon using RegRun "Scan for Viruses" feature.
http://www.regrun.com

wlbaloon.dll
Wlbaloon is Trojan/Backdoor.
Remove Wlbaloon using RegRun "Scan for Viruses" feature.
http://www.regrun.com

wlblht.exe
Wlblht.exe is Trojan/Rootkit Afx2005
Kill the hidden process wlblht.exe using UnHackMe and remove wlblht.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

wldll.dll
Wldll.dll is Trojan/Backdoor.
Read more:
http://www.spywaredata.com/spyware/malwa...
Kill the file wldll.dll and remove wldll.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

wlncr.exe
Wlncr.exe is Trojan/Backdoor.
Kill the process wlncr.exe and remove wlncr.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

wlnlogon.exe
WLNLOGON.EXE is Trojan/Backdoor.
Kill the process WLNLOGON.EXE and remove WLNLOGON.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

wlzip32[1].exe
WLZIP32[1].EXE is Trojan/Backdoor.
related files:
1 :%CACHE%\CONTENT.IE5\????????\WLZIP32[2].EXE
2 :%profiles%\ryan\rhino's d...nts\downloads\programs\WLZIP32.EXE
3 :%TEMP%\WIN10.TMP.EXE
4 :%TEMP%\WIN11E.TMP.EXE
5 :%TEMP%\WIN192.TMP.EXE
6 :%TEMP%\WIN255.TMP.EXE
7 :%TEMP%\WIN27.TMP.EXE
8 :%TEMP%\WIN29.TMP.EXE
9 :%TEMP%\WIN33.TMP.EXE
10:%TEMP%\WIN3E.TMP.EXE
Read more:
http://spywarefiles.prevx.com/spywarefil...
Kill the process WLZIP32[1].EXE and remove WLZIP32[1].EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

wma beep.exe
Wma beep.exe is Trojan/Backdoor.
Kill the process wma beep.exe and remove wma beep.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

wmdconf32.dll
Wmdconf32.dll is Trojan/Backdoor.
Kill the file wmdconf32.dll and remove wmdconf32.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

wmdrtc32.dll
Wmdrtc32.dll is W32.Sality.X.
Related files:
%System%\wmdrtc32.dll (Detected as W32.HLLP.Sality)
%System%\drivers\luurii.sys (Detected as Hacktool.Rootkit)
Read more:
http://www.symantec.com/enterprise/secur...
Kill the file wmdrtc32.dll and remove wmdrtc32.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

wmedia.exe
Wmedia.exe is Trojan/Backdoor Sdbot.
Kill the process wmedia.exe and remove wmedia.exe from Windows startup.

wmedia16.exe
Wmedia16.exe is rootkit Gurong.A.
Wmedia16.exe hides the registry keys, processes and files.
Kill the process wmedia16.exe and remove wmedia16.exe from Windows startup using UnHackMe.
http://www.unhackme.com
More info:
http://www.f-secure.com/v-descs/gurong_a...

wmiapisrv.dll
WMIAPISRV.DLL is Trojan/Backdoor.
Kill the file WMIAPISRV.DLL and remove WMIAPISRV.DLL from Windows startup using RegRun Reanimator.
http://www.regrun.com

wmilib32.exe
Wmilib32.exe is Troj/VB-XU.
Related files:
%Windows%\cursors\windows16.exe
%System%\config\anvshell32.exe
%System%\drivers\wmilib32.exe
%System%\windows32.exe
Read more:
http://www.sophos.com/virusinfo/analyses...
Kill the process wmilib32.exe and remove wmilib32.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

wminfo.exe
Wminfo.exe is Trojan.Gema.
Read more:
http://www.symantec.com/security_respons...
Kill the process wminfo.exe and remove wminfo.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

wmiprsv.exe
WMIPRSV.EXE is Trojan/Backdoor.
Read more:
http://fileinfo.prevx.com/adware/qq979c7...
Kill the process WMIPRSV.EXE and remove WMIPRSV.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

wmipruse.exe
We suggest you to remove wmipruse.exe from your computer as soon as possible.
Wmipruse.exe is Trojan/Backdoor.
Kill the process wmipruse.exe and remove wmipruse.exe from Windows startup.

wmiprvce.exe
Wmiprvce.exe is WORM_AGOBOT.ZW.
Read more:
http://www.trendmicro.com/vinfo/virusenc...
Kill the process wmiprvce.exe and remove wmiprvce.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

wmiprves.exe
WMIPRVES.EXE is Trojan/Backdoor.
Kill the process WMIPRVES.EXE and remove WMIPRVES.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

wmiprvs.exe
Wmiprvs.exe is worm W32.Gaobot family.
Kill the process wmiprvs.exe and remove wmiprvs.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

wmiprvsw.exe
W32.Gaobot.AFC is a worm that spreads through open network shares and several Windows vulnerabilities including:
- The DCOM RPC vulnerability (described in Microsoft Security Bulletin MS03-026) using TCP port 135.
- The WebDav vulnerability (described in Microsoft Security Bulletin MS03-007) using TCP port 80.
- Exploits the Microsoft Windows Local Security Authority Service Remote Buffer Overflow (described in Microsoft Securiy Bulletin MS04-011).

The worm also spreads through backdoors that the Beagle and Mydoom worms and the Optix family of backdoors install.
The worm can also act as a backdoor server program and attack other systems.
Additionally, the worm attempts to stop the process of many antivirus and security programs.

Copies itself as %System%\wmiprvsw.exe.

Adds the value: "System Updater Service=wmiprvsw.exe
to the registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Adds the value: "System Updater Service=wmiprvsw.exe"
to the registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices

Automatic removal:
Use RegRun Startup Optimizer.

wmism23.exe
Wmism23.exe is W32/Rbot-GSU.
Read more:
http://www.sophos.com/security/analyses/...
Kill the process wmism23.exe and remove wmism23.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

wml.exe
Wml.exe is Malware.
Kill the process wml.exe and remove wml.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

wmlprvse.exe
Wmlprvse.exe is Trojan/Backdoor.
Kill the process wmlprvse.exe and remove wmlprvse.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

wmmon32.exe
W32/Agobot-KQ is an IRC backdoor Trojan and network worm.
It is capable of spreading to computers on the local network protected by weak passwords.
When first run it copies itself to the Windows system folder as wmmon32.exe and creates the following registry entries to run itself on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WSSAConfiguration = wmmon32.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\WSSAConfiguration = wmmon32.exe

Each time W32/Agobot-KQ is run it attempts to connect to a remote IRC server and join a specific channel.
Runs continuously in the background, allowing a remote intruder to access and control the computer via IRC channels.
Attempts to terminate and disable various anti-virus and security-related programs.

You can automatical remove it from startup with RegRun Startup Optimizer.

wmndisdrv.sys
Wmndisdrv.sys is Trojan/Backdoor.
Kill the file wmndisdrv.sys and remove wmndisdrv.sys from Windows startup using RegRun Reanimator.
http://www.regrun.com

wmpcd32.dll
Wmpcd32.dll is Adware.Roogoo.
Kill the file wmpcd32.dll and remove wmpcd32.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

wmpconf.dll
Wmpconf.dll is Trojan/Backdoor.
Kill the file wmpconf.dll and remove wmpconf.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

wmpdev.dll
Wmpdev.dll is Trojan/Backdoor.
Kill the file wmpdev.dll and remove wmpdev.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

wmpenv.dll
Wmpenv.dll is Trojan/Backdoor.
Kill the file wmpenv.dll and remove wmpenv.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

wmphost.dll
Wmphost.dll is Trojan/Backdoor.
Kill the file wmphost.dll and remove wmphost.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

wmpl.exe
wmpl.exe is a Trojan.Agent-IF.
wmpl.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
wmpl.exe
%System%\gtrack.dll
%System%\kaboom.dll
More info:
http://www.sophos.com/virusinfo/analyses...
Removal:
Kill wmpl.exe process and remove wmpl.exe from Windows startup using RegRun Startup Optimizer.

wmplayer.dll
Wmplayer.dll is Trojan/Backdoor.
Kill the file wmplayer.dll and remove wmplayer.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

wmpsw3ss.dll
Wmpsw3ss.dll is WORM_STRAT.CG.
Related files:
%Windows%\SERV.DLL – also detected as WORM_STRAT.CG
%Windows%\SERV.EXE - copy of itself
%Windows%\SERV.WAX - non-malicious file
%Windows%\SERV.S - non-malicious file
%SysDir%\cmprvsxm.exe
%SysDir%\e1.dll
%SysDir%\diaccnvf.dll
%SysDir%\wmpsw3ss.dll
Read more:
http://de.trendmicro-europe.com/consumer...
Kill the file wmpsw3ss.dll and remove wmpsw3ss.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

wmserv.exe
Wmserv.exe is W32.Mytob.QU@mm.
Related files:
%System%\wmserv.exe
%System%\explore.exe
Read more:
http://www.symantec.com/enterprise/secur...
Kill the process wmserv.exe and remove wmserv.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

wmsnds32.exe
Wmsnds32.exe is Trojan/Backdoor.
Kill the process wmsnds32.exe and remove wmsnds32.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

wmsound.dll
Wmsound.dll is Trojan/Backdoor.
Kill the file wmsound.dll and remove wmsound.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

wmsvc.exe
Wmsvc.exe is Trojan/Backdoor.
Kill the process wmsvc.exe and remove wmsvc.exe from Windows startup.
http://www.sophos.com/virusinfo/analyses...

wmtx.exe
WMTX.exe is Trojan/Backdoor.
WMTX.exe is executed as Microsoft Layer Service.
Kill the process WMTX.exe and remove WMTX.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

wmuwo.exe
WMUWO.EXE is Trojan/Backdoor.
Read more:
http://fileinfo.prevx.com/adware/qqd9b36...
Kill the process WMUWO.EXE and remove WMUWO.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

wmvconf.exe
WMVCONF.EXE is Trojan/Backdoor.
Read more:
http://fileinfo.prevx.com/adware/qqc1087...
Kill the process WMVCONF.EXE and remove WMVCONF.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

wmvds32.dll
Wmvds32.dll is Troj/Dwara-A.
Related files:
%Windows%\system32\msbind32.exe
%Windows%\system32\wmvds32.dll
Read more:
http://www.sophos.com/security/analyses/...
Kill the file wmvds32.dll and remove wmvds32.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

wmvmgr32.dll
Wmvmgr32.dll is Trojan/Backdoor.
Kill the file wmvmgr32.dll and remove wmvmgr32.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

wmwplayers.exe
WMWPLAYERS.EXE is Trojan/Backdoor.
Read more:
http://fileinfo.prevx.com/adware/qqf9537...
Kill the process WMWPLAYERS.EXE and remove WMWPLAYERS.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

wnauserv.dll
Wnauserv.dll is Spyware.Look2Me.
Related files:
%Temp%nsdtmp09.dll
%Program Files%\Recommended Hotfix - 421701D\v15\RH.DLL
%Program Files%\Recommended Hotfix - 421701D\v15\RH.exe
%Program Files%\SED\SE.exe
%Program Files%\SED\SED.exe
%Windir%\Digital Signature [8 digit number].htm
%Windir%\system\UpdInstall.exe
%System%\InetFuel.exe
%System%\[random file name].dll
Read more:
http://www.symantec.com/security_respons...
Kill the file wnauserv.dll and remove wnauserv.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

wndrivs.exe
We suggest you to remove wndrivs.exe from your computer as soon as possible.
Wndrivs.exe is Worm.Win32.Skipi.a.
Related files:
%System%\wndrivs.exe
%System%\mshtml32.exe
%System%\sdrives32.exe
%System%\winlgcver.exe
Read more:
http://www.viruslist.com/en/viruses/ency...
Kill the process wndrivs.exe and remove wndrivs.exe from Windows startup.

wndrivs32.exe
Wndrivs32.exe is W32/Pykse-C.
Related files:
%System%\mshtmldat32.exe
%System%\sdrivew32.exe
%System%\winlgcvers.exe
%System%\wndrivs32.exe
%Removable Drive%:\game.exe
%Removable Drive%:\zjbs.exe
Read more:
http://www.sophos.com/security/analyses/...
Kill the process wndrivs32.exe and remove wndrivs32.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

wndrivsd32.exe
Wndrivsd32.exe is Win32.HLLW.Crazy.A.
Related files:
wndrivsd32.exe
mshtmlsh32.exe
winlgcverx.exe
sdrivec32.exe
Read more:
http://www.bitdefender.com/VIRUS-1000174...
Kill the process wndrivsd32.exe and remove wndrivsd32.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

wndsystem.dll
We suggest you to remove WndSystem.dll from your computer as soon as possible.
WndSystem.dll is a part of AntiVirusPro software.
AntiVirusPro is a misleading application that may give exaggerated reports about potential risks on the computer.
Related files:
%UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\Anti Virus Pro spyware remover.lnk
%UserProfile%\Desktop\\Anti Virus Pro spyware remover.lnk
C:\Documents and Settings\All Users\Start Menu\Programs \Anti Virus Pro spyware remover\Register Anti Virus Pro spyware remover.lnk
C:\Documents and Settings\All Users\Start Menu\Programs \Anti Virus Pro spyware remover\Start Anti Virus Pro spyware remover.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\Anti Virus Pro spyware remover\Uninstall.lnk
%ProgramFiles%\AntiVirusPro\AntiVirusPro.exe
%ProgramFiles%\AntiVirusPro\AntiVirusPro.exe.local
%ProgramFiles%\AntiVirusPro\Core.dll
%ProgramFiles%\AntiVirusPro\database.pkg
%ProgramFiles%\AntiVirusPro\Localization.dll
%ProgramFiles%\AntiVirusPro\msvcp71.dll
%ProgramFiles%\AntiVirusPro\msvcr71.dll
%ProgramFiles%\AntiVirusPro\Uninstall.exe
%ProgramFiles%\AntiVirusPro\WndSystem.dll
%UserProfile%\Application Data\Anti-virus-Pro.com
Read more:
http://www.symantec.com/business/securit...
Kill the file WndSystem.dll and remove WndSystem.dll from Windows startup.

wngard.exe
Wngard.exe is Trojan/Backdoor RBOT.
Kill the process wngard.exe and remove wngard.exe from Windows startup.

wnipsvr.exe
Wnipsvr.exe is W32.Bratsters.
W32.Bratsters is a worm that copies itself to all drives and downloads potentially malicious files on to the compromised computer.
Related files:
%System%\wnipsvr.exe
%System%\perefic.ini
[DRIVE LETTER]:\hide.exe
[DRIVE LETTER]:\autorun.inf
%ProgramFiles%\100.exe
%ProgramFiles%\101.exe
%ProgramFiles%\102.exe
%ProgramFiles%\103.exe
%ProgramFiles%\104.exe
%ProgramFiles%\105.exe
%ProgramFiles%\106.exe
%ProgramFiles%\107.exe
%ProgramFiles%\108.exe
%ProgramFiles%\109.exe
%ProgramFiles%\110.exe
%ProgramFiles%\111.exe
%ProgramFiles%\112.exe
%ProgramFiles%\113.exe
%ProgramFiles%\114.exe
%ProgramFiles%\115.exe
%ProgramFiles%\116.exe
%ProgramFiles%\117.exe
%ProgramFiles%\118.exe
%ProgramFiles%\119.exe
%ProgramFiles%\120.exe
Read more:
http://www.symantec.com/enterprise/secur...
Kill the process wnipsvr.exe and remove wnipsvr.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

wnmicf.dll
Wnmicf.dll is Trojan/Backdoor.
Kill the file wnmicf.dll and remove wnmicf.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

wnset.exe
WNSET.EXE is Trojan Nudos.
Read more:
http://fileinfo.prevx.com/fileinfo.asp?P...
Kill the process WNSET.EXE and remove WNSET.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

wnttech.exe
Wnttech.exe is Trojan/Backdoor.
Kill the process wnttech.exe and remove wnttech.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

wnupd.exe
Wnupd.exe is Trojan/Backdoor.
Kill the process wnupd.exe and remove wnupd.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

wnword~1.exe
WNWORD~1.EXE is Trojan/Backdoor.
Kill the process WNWORD~1.EXE and remove WNWORD~1.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

wo.exe
Wo.exe is Trojan/Backdoor.
Kill the process wo.exe and remove wo.exe from Windows startup.

woinst.exe
Woinst.exe is a part of WareOut.
WareOut is a potentially unwanted software program that is masquerading as a spyware and dialer remover.
Read more:
http://vil.nai.com/vil/content/v_131783....
Kill the process woinst.exe and remove woinst.exe from Windows startup using RegRun.
www.regrun.com

woinstall.exe
Woinstall.exe is Trojan/Backdoor.
Kill the process woinstall.exe and remove woinstall.exe from Windows startup.

woopie exe
Woopie exe is W32/WootBot.ED-net.
Read more:
http://www.fortinet.com/VirusEncyclopedi...
Kill the file woopie exe and remove woopie exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

wormexe.exe
Wormexe.exe is a part of WareOut.
Read more:
http://research.sunbelt-software.com/thr...
Kill the process wormexe.exe and remove wormexe.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

woso.exe
Woso.exe is Trojan/Backdoor.
Kill the process woso.exe and remove woso.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

wosysdll.dll
Wareout.exe is Trojan/Backdoor.
Kill the process wareout.exe and remove wareout.exe from Windows startup.
Read more:
http://www.easydesksoftware.com/news/new...

wovkspy.exe
Wovkspy.exe is Trojan/Backdoor.
Kill the process wovkspy.exe and remove wovkspy.exe from Windows startup.

wowdbe.exe
Wowdbe.exe is Trojan/Backdoor StartPAge-DU..
Kill the process wowdbe.exe and remove wowdbe.exe from Windows startup.

wowexe.exe
Wowexe.exe is Trojan/Backdoor.
Kill the process wowexe.exe and remove wowexe.exe from Windows startup.

wpablan.exe
WPABLAN.EXE is Trojan/Backdoor.
Kill the process WPABLAN.EXE and remove WPABLAN.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

wpap.exe
wpap.exe is a Trojan.Dagonit-A.
wpap.exe opens a back door on TCP port.
wpap.exe spreads via open network shares.
Related files:
dalia2.exe
winspool.exe
wpap.exe
More info:
http://www.sophos.com/virusinfo/analyses...
Removal:
Kill wpap.exe process and remove wpap.exe from Windows startup using RegRun Startup Optimizer.

wpnsvc.exe
Wpnsvc.exe is Trojan/Backdoor.
Kill the process wpnsvc.exe and remove wpnsvc.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

wqtpmp.exe
WQTPMP.EXE is Adware.BestOffersNetwork.
Read more:
http://fileinfo.prevx.com/adware/qq59459...
Kill the process WQTPMP.EXE and remove WQTPMP.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

wrdget.dll
Wrdget.dll is a Adware.MediaInject.
Wrdget.dll displays advertisements.
Wrdget.dll monitors user Internet activity.
Related files:
Micore.exe
Runc.exe
Expin.dll
Wrdget.dll
Adds the value:
"micore"= "%ProgramFiles%\micore\runc.exe"
to the Windows startup registry keys.
More info:
http://securityresponse.symantec.com/avc...
Removal:
Remove Wrdget.dll from Windows startup using RegRun Startup Optimizer.

wrl_to_x3d.dll
WRL_TO_X3D.DLL is Trojan/Backdoor.
read more:
http://fileinfo.prevx.com/fileinfo.asp?P...
Kill the file WRL_TO_X3D.DLL and remove WRL_TO_X3D.DLL from Windows startup using RegRun Reanimator.
http://www.regrun.com

wrmdrv.dll
Wrmdrv.dll is Trojan/Backdoor.
Related files:
1 :%TEMP%\BLRPSEUO.DLL
2 :%TEMP%\CHOWISI.DLL
3 :%TEMP%\OKMPAHO.DLL
4 :%TEMP%\SMFCAQ.DLL
5 :%WINDIR%\SYSTEM32\QGHUMEAY.DLL
6 :%WINDIR%\SYSTEM32\WRMDRV.DLL
Read more:
http://spywaredlls.prevx.com/RRHCHI23366...
Kill the file wrmdrv.dll and remove wrmdrv.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

ws2_64.dll
Ws2_64.dll is a Trojan/Backdoor.
Ws2_64 steals user private information and passwords.
Related files:
1. %SysDir%\ws2_64.dll (detected as PWSteal.Trojan).
2. %SysDir%\taskmon64.exe (detected as Trojan.KillAV terminates some antivirus programs).
Creates the directories:
C:\Programes\qlwg42
C:\Program Files\Common Files\qlwg42
Creates the links on the desktop:
C:\Program Files\Common Files\qlwg42\Artmoney.exe
C:\Program Files\Common Files\qlwg42\PMLoad42.exe

Ws2_64.dll infects Winsock2 key.
Manual deletion from Winsock2 is not allowed. You need use Regun Winsock recovery feature.

wsaf.exe
WSAF.EXE is Trojan/Backdoor.
Kill the process WSAF.EXE and remove WSAF.EXE from Windows startup.

wsasrv.exe
Remote Access / ICQ trojan
Version 1.6 autoloads through changes in System.ini and Win.ini. 1.5 uses Registry and System.ini to autoload.

wsass32.exe
Wsass32.exe is Trojan-Downloader.Win32.Dadobra.ll.
Related files:
%SYSTEM%\wsass32.exe
orkuteiros.exe
piada.exe
voxcards.exe
Read more:
http://research.sunbelt-software.com/thr...
Kill the process wsass32.exe and remove wsass32.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

wsaupdater.exe
Wsaupdater.exe is Adware/BlazeFind.
Kill the process wsaupdater.exe and remove wsaupdater.exe from Windows startup.
http://www3.ca.com/securityadvisor/pest/...

wscan.exe
Attack Ftp trojan

wscntjy.exe
Wscntjy.exe is Trojan/Backdoor.
Kill the process wscntjy.exe and remove wscntjy.exe from Windows startup.

wscsvc.exe
Wscsvc.exe is PWS-Banker.k.gen.
Read more:
http://vil.nai.com/vil/content/v_132052....
Kill the process wscsvc.exe and remove wscsvc.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

wsct.exe
Remote Access / HTTP server
Basically the trojan converts the infected computer into a Web server, which in turn is controlled by the intruders browser.

wsct2.exe
Remote Access / HTTP server
Basically the trojan converts the infected computer into a Web server, which in turn is controlled by the intruders browser.

wsctf.exe
Wsctf.exe is Trojan/Backdoor.
Kill the process wsctf.exe and remove wsctf.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

wsdpri.dll
Wsdpri.dll is Trojan/Backdoor.
Kill the file wsdpri.dll and remove wsdpri.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

wsecom.exe
WSECOM.EXE is Trojan/Backdoor.
Read more:
http://virusinfo.prevx.com/pxparall.asp?...
Kill the process WSECOM.EXE and remove WSECOM.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

wsg.exe
WSG.exe is an adware program Adware.Websearch.
WSG.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
common.dll
IExploreSkins.exe
PIB.exe
QDow_AS2.dll
setupex.exe
TBPS.exe
toolbar.dll
WSG.exe
WSup.exe
WToolsA.exe
WToolsB.dll
WToolsS.exe
btiein.dll
websearch.exe
More info:
http://securityresponse.symantec.com/avc...
Removal:
Kill WSG.exe process and remove WSG.exe from Windows startup using RegRun Startup Optimizer.

wsn.exe
Wsn.exe is SaveNow Trojan/Backdoor.
Kill the process wsn.exe and remove wsn.exe from Windows startup.
Related files:
savenow.db
Savenowinst.exe
%programfilesdir%\Save\save.exe
VSN.cfg
%tempdir%\VVSN.exe
%tempdir%\WSN.exe
vvsn.cfg
wsn.cfg
WUS6E.tmp
%tempdir%\WUS6E.bat
WUSV-WHSE_searchbar.min.googleInst.exe
%tempdir%\SaveForm.exe

wsnaweb.dll
WSNAWEB.DLL is Trojan/Backdoor.
Read more:
http://fileinfo.prevx.com/adware/qq69dd6...
Kill the file WSNAWEB.DLL and remove WSNAWEB.DLL from Windows startup using RegRun Reanimator.
http://www.regrun.com

wsnctfy.exe
Wsnctfy.exe is Trojan/Backdoor.
Kill the process wsnctfy.exe and remove wsnctfy.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

wsntfy.exe
Wsntfy.exe is Trojan/Backdoor.
Kill the process wsntfy.exe and remove wsntfy.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

wsockmfc.dll
WSOCKMFC.DLL is Trojan/Backdoor.
Read more:
http://fileinfo.prevx.com/adware/qqfe347...
Kill the file WSOCKMFC.DLL and remove WSOCKMFC.DLL from Windows startup using RegRun Reanimator.
http://www.regrun.com

wsocksrv.exe
Wsocksrv.exe is Trojan/Backdoor.
Kill the process wsocksrv.exe and remove wsocksrv.exe from Windows startup.
http://www3.ca.com/securityadvisor/pest/...

wspad.exe
Wspad.exe is Trojan/Backdoor.
Wspad.exe is executed from registry Run keys.
Value:"MSN PLUS XP".
Kill the process wspad.exe and remove wspad.exe from Windows startup.

wspmspsv.exe
Wspmspsv.exe is Trojan/Backdoor.
Kill the process wspmspsv.exe and remove wspmspsv.exe from Windows startup.

wspool.exe
Destructive trojan
Rasmin uses up all the memory and the infected computer crashes regularly.

wssocksapi.exe
Wssocksapi.exe is Trojan/Backdoor.
Kill the process wssocksapi.exe and remove wssocksapi.exe from Windows startup.

wstart32.exe
W32.HLLW.Gaobot.CA is a minor variant of W32.HLLW.Gaobot.AO.
It attempts to spread to network shares that have weak passwords and allows hackers to access an infected computer through an IRC channel.

The worm uses multiple vulnerabilities to spread, including:
The DCOM RPC vulnerability (described in Microsoft Security Bulletin MS03-026) using TCP port 135
The RPC locator vulnerability (described in Microsoft Security Bulletin MS03-001) using TCP port 445
The WebDav vulnerability (described in Microsoft Security Bulletin MS03-007) using TCP port 80
Steals CD keys of Computer games.
Allows unauthorized execution of remote commands. Terminates security software programs.
Listens on randomly calculated ports, ranging from 1000 to 3000 and one from above 10000, and waits for other computers to download the worm.
Copies itself to administrative shares on machines with weak passwords as %System%\wstart32.exe.

And adds the value:
"Windows Loader"="wstart32.exe"
to the registry keys:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
and
"Configuration Loader" = "%System%\wstart32.exe" -service
to
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\nm

Use RegRun Startup Optimizer to automatically remove it from startup.

wstat32.exe
BAckdoor.IRC.Loonbot is a Trojan horse that has backdoor capabilities.
It can allow an attacker to remotely control your computer using Internet Relay Chat (IRC).
This Trojan can also download and execute files.

Copies itself as %System%\Wstat32.exe and executes that copy.

May display a fake error Message Box titled, "Error-384," with the text:
A valid data link was not found, deleting file
Waits for an Internet connection, and when one is opened, it connects to a remote IRC server, notifies the attacker, and then waits for commands.

This Trojan can perform the following actions:
Remove and uninstall itself
Delete files
Restart the computer
Run specified commands
Rename files
Create or delete folders
List and end processes
Perform an ICMP attack on a specified host

Manual removal:
Navigate to the key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
and delete the value:
"Wstat32 driver"="%System%\Wstat32.exe"

Use RegRun Startup Optimizer to remove it from startup.

wstray.exe
WStray.exe is Comtry MP3 Downloader spyware.
Kill the process WStray.exe and remove WStray.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

wsttrs.exe
Wsttrs.exe is Trojan/Backdoor.
Read more:
http://www.incodesolutions.com/threats/W...
Kill the process wsttrs.exe and remove wsttrs.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

wsup.exe
WSup.exe is spyware component.
WSup.exe changes IE home page.
Removal:
kill WSup.exe and remove it from Windows startup.

wsusupd.exe
Wsusupd.exe is Troj/Enclag-A.
Read more:
http://www.sophos.com/security/analyses/...
Kill the process wsusupd.exe and remove wsusupd.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

wt.exe
Wt.exe is Trojan-Downloader.Win32.Small.chq.
Read more:
http://www.viruslist.com/en/viruses/ency...
Kill the process wt.exe and remove wt.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

wtcpcom.exe
Wtcpcom.exe is Trojan/Backdoor.
Installed as Windows TCP Communication service.
Kill the file wtcpcom.exe and remove wtcpcom.exe from Windows startup.

wtfctf.dll
WTFCTF.dll is Trojan/Backdoor.
Remove WTFCTF.dll from Windows startup using RegRun.
www.regrun.com

wtoolsa.exe
WToolsA.exe is a Trojan Trojan.LowZones.
WToolsA.exe lowers Internet Explorer security settings.
Related files:
%Temp%\auto_update_install.exe
%Temp%\setup.inf
%Temp%\auf0.exe
%Temp%\cxtpls_loader.exe
%Temp%\iinstall.exe
%Temp%\sidefind.exe
%Temp%\WToolsA.exe
%Temp%\WToolsB.dll
%Temp%\AutoUpdaterInstaller[1].exe
%Temp%\nem220[1].dll
%Temp%\salm.exe
%Temp%\istbar.dll
%System%\auto_update_uninstall.exe
%Windir%\lohmvql.exe
%Windir%\nem220.dll
%Windir%\qoqek.exe
%Windir%\zeta.exe
More info:
http://securityresponse.symantec.com/avc...
Removal:
Kill WToolsA.exe process and remove WToolsA.exe from Windows startup using RegRun Startup Optimizer.

wtoolsb.dll
WToolsB.dll is a Trojan Trojan.LowZones.
WToolsB.dll lowers Internet Explorer security settings.
Related files:
%Temp%\auto_update_install.exe
%Temp%\setup.inf
%Temp%\auf0.exe
%Temp%\cxtpls_loader.exe
%Temp%\iinstall.exe
%Temp%\sidefind.exe
%Temp%\WToolsA.exe
%Temp%\WToolsB.dll
%Temp%\AutoUpdaterInstaller[1].exe
%Temp%\nem220[1].dll
%Temp%\salm.exe
%Temp%\istbar.dll
%System%\auto_update_uninstall.exe
%Windir%\lohmvql.exe
%Windir%\nem220.dll
%Windir%\qoqek.exe
%Windir%\zeta.exe
More info:
http://securityresponse.symantec.com/avc...
Removal:
Remove WToolsB.dll from Windows startup using RegRun Startup Optimizer.

wtoolss.exe
WToolsS.exe is an adware program Adware.Websearch.
WToolsS.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
common.dll
IExploreSkins.exe
PIB.exe
QDow_AS2.dll
setupex.exe
TBPS.exe
toolbar.dll
WSG.exe
WSup.exe
WToolsA.exe
WToolsB.dll
WToolsS.exe
btiein.dll
websearch.exe
More info:
http://securityresponse.symantec.com/avc...
Removal:
Kill WToolsS.exe process and remove WToolsS.exe from Windows startup using RegRun Startup Optimizer.

wtssu.exe
Wtssu.exe is Mediatickets Spyware.
Read more:
http://ca.com/us/securityadvisor/pest/pe...
Kill the process wtssu.exe and remove wtssu.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

wtta.exe
Wtta.exe is Trojan/Backdoor.
Kill the process wtta.exe and remove wtta.exe from Windows startup.

wuactl2.exe
Wuactl2.exe is Trojan/Backdoor Perf.
Kill the process wuactl2.exe and remove wuactl2.exe from Windows startup.

wualcts.exe
Wualcts.exe is Trojan/Backdoor RBOT.
Kill the process wualcts.exe and remove wualcts.exe from Windows startup.

wuamclt1.exe
WUAMCLT1.EXE is Trojan/Backdoor.
Read more:
http://fileinfo.prevx.com/adware/qqbb666...
Kill the process WUAMCLT1.EXE and remove WUAMCLT1.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

wuamgard.exe
Wuamgard.exe is Trojan/Backdoor RBOT.
Kill the process wuamgard.exe and remove wuamgard.exe from Windows startup.

wuamgrd.exe
Worm SDBOT.
Adds the value:
"Microsoft Update"=wuamgrd.exe
to Windows startup.
Remove wuamgrd.exe from Windows startup.

wuamgrd16.exe
W32.Gaobot.AQS is a worm that spreads through open network shares and several Windows vulnerabilities.
It can act as a backdoor server program and attack other systems.
It attempts to stop the processes of many antivirus and security programs.
Attempts to end some virus processes.
Attempts to steal the product ID for Windows, and the CD keys of some computer games.

Copies itself to %System%\Wuamgrd16.exe.
Adds the value: "Microsoft Update"="wuamgrd16.exe"
to the registry keys:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Connects to a remote IRC server and awaits commands from the remote attacker.
Attempts to copy itself to other computers through the following remote administrative SMB shares: c$; d$; e$; print$; admin$
Upon successful authentication it copies itself to the remote system.
Schedules a Network job to run the worm on the remote system.

Use RegRun Startup Optimizer to automatically remove this worm.

wuamk032.exe
Wuamk032.exe is Trojan/Backdoor.
Kill the process wuamk032.exe and remove wuamk032.exe from Windows startup.

wuamkop32.exe
Wuamkop32.exe is Trojan/Backdoor Rbot.
Kill the process wuamkop32.exe and remove wuamkop32.exe from Windows startup.

wuammgr32.exe
Wuammgr32.exe is Trojan/Backdoor.
Kill the process wuammgr32.exe and remove wuammgr32.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

wuamngr32.exe
Wuamngr32.exe is Trojan/Backdoor.
Kill the process wuamngr32.exe and remove wuamngr32.exe from Windows startup.

wuampd.exe
Wuampd.exe is W32/Rbot-UT.
Read more:
http://www.sophos.com/security/analyses/...
Kill the process wuampd.exe and remove wuampd.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

wuampkd.exe
Wuampkd.exe is Trojan/Backdoor.
Kill the process wuampkd.exe and remove wuampkd.exe from Windows startup.

wuanserv.dll
Wuanserv.dll is Trojan.Mdropper.Y.
Related files:
%Temp%\top10.exe
%System%\wuanserv.dll
Read more:
http://www.symantec.com/enterprise/secur...
Kill the file wuanserv.dll and remove wuanserv.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

wuapi.exe
Wuapi.exe is Trojan/Backdoor Worm.Codbot-AC.Process.
Kill the process wuapi.exe and remove wuapi.exe from Windows startup.
http://www.superadblocker.com/definition...

wuauclt.dll
Wuauclt.dll is Backdoor.Wualess.
Read more:
http://www.symantec.com/enterprise/secur...
Kill the file wuauclt.dll and remove wuauclt.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

wuauclt10.exe
Wuauclt10.exe is Trojan/Backdoor.
Kill the process wuauclt10.exe and remove wuauclt10.exe from Windows startup.

wuauclt4.exe
WUAUCLT4.EXE is Trojan/Backdoor.
Read more:
http://fileinfo.prevx.com/adware/qq59437...
Kill the process WUAUCLT4.EXE and remove WUAUCLT4.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

wuauct1.exe
Wuauct1.exe is Trojan/Backdoor.
Kill the process wuauct1.exe and remove wuauct1.exe from Windows startup.

wuauctl32.exe
Wuauctl32.exe is Trojan/Backdoor.
Kill the process wuauctl32.exe and remove wuauctl32.exe from Windows startup.

wuaumqr1.exe
Wuaumqr1.exe is Trojan/Backdoor.
Read more:
http://fileinfo.prevx.com/adware/qq9e6a3...
Kill the process wuaumqr1.exe and remove wuaumqr1.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

wuauserv.exe
Wuauserv.exe is Troj/VB-ZD.
Read more:
http://www.sophos.com/virusinfo/analyses...
Kill the process wuauserv.exe and remove wuauserv.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

wuausrv.dll
Wuausrv.dll is Trojan.Lazdropper.
Trojan.Lazdropper is a specially crafted .tgz file(TAR file compressed by gzip) that drops malicious files by exploiting the Lhaz Unspecified Remote Code Execution Vulnerability (BID 25351).
Related files:
%UserProfile%\Local Setting\Temp\sav.exe (Backdoor.Trojan)
%System%\wuausrv.dll (Backdoor.Trojan)
%UserProfile%\Local Setting\Temp\~Thumbbs.TMP
Read more:
http://www.symantec.com/enterprise/secur...
Kill the file wuausrv.dll and remove wuausrv.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

wuclmi.exe
Wuclmi.exe is W32.Arpiframe.
W32.Arpiframe is a worm that injects malicious HTML code into local HTTP traffic.
Related files:
%System%\wuclmi.exe (a hacktool)
%System%\sevices.exe (a copy of wuclmi.exe)
%System%\wincfg.exe (WinPCap libraries installer)
%System%\capinstall.exe (a copy of wincfg.exe)
Read more:
http://www.symantec.com/enterprise/secur...
Kill the process wuclmi.exe and remove wuclmi.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

wucmdex.exe
W32/Rbot-DO
Aliases: Backdoor.Rbot.gen, BackDoor-CGS trojan
It is a worm which attempts to spread to remote network shares.
It also contains backdoor Trojan functionality.
Spreads to network shares with weak passwords as a result of the backdoor Trojan element receiving the appropriate command from a remote user.
Moves itself to the Windows system folder as WUCMDEX.EXE
and creates entries in the registry at the following locations to run on system startup:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\[x]
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\[x]
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\[x]

Automatical remove:
Use RegRun Startup Optimizer.

wudb.dll
WUDB.DLL is Trojan/Backdoor.
Kill the file WUDB.DLL and remove WUDB.DLL from Windows startup using RegRun Reanimator.
http://www.regrun.com

wudmate.exe
Wudmate.exe is Trojan/Backdoor Rbot.
Kill the process wudmate.exe and remove wudmate.exe from Windows startup.

wudupdate.exe
Wudupdate.exe is Trojan/Backdoor.
Kill the process wudupdate.exe and remove wudupdate.exe from Windows startup.

wuf1.exe
WUF1.EXE is Trojan/Backdoor.
Read more:
http://fileinfo.prevx.com/adware/qq33de5...
Kill the process WUF1.EXE and remove WUF1.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

wugrds.exe
Wugrds.exe is Trojan/Backdoor RBOT.
Kill the process wugrds.exe and remove wugrds.exe from Windows startup.

wuihelp.exe
Wuihelp.exe is Trojan/Backdoor.
Kill the process wuihelp.exe and remove wuihelp.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

wulogin.exe
Wulogin.exe is Trojan/Backdoor.
Read more:
http://virusinfo.prevx.com/pxparall.asp?...
Kill the process wulogin.exe and remove wulogin.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

wunauclt.exe
Wunauclt.exe is Trojan/Backdoor.
Kill the process wunauclt.exe and remove wunauclt.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

wupdated.exe
This is the MOEGA VIRUS!
The W32.HLLW.Moega executable may appear as the following file: wupdated.exe

When it is executed, it does following:
Copies itself as %System%\Wupdated.exe or %System%\Mplupdate.exe.
%System% = C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

Adds the value:
"Configuration Loaded" = "wupdated.exe"
or:
"Windows Update" = "mplupdate.exe"
to the registry keys:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices

Then attempts to connect to any computers on the same subnet.
For example, if the infected computer's IP address is A.B.C.D, it will try to connect to all the systems on the local area network, A.B.C.0 ... A.B.C.255.

The worm try to log on to computers on the local area network using the following strings:
Usernames: wwwadmin, user, system, sqlagent, sql, root, owner, guest, database, administrator, admin.
Passwords: 654321, 123456, 1234, 123, 111, 1, wwwadmin, user, system, sqlagent, sql, server, secret, root, password, password123, pass, pass123, owner, hidden, guest,
database, asdfgh, asdf, administrator, admin.

If successful, the worm will copy itself to the remote computer, opens ports 139 and 445 and steals the CD key of the following games:
Red Alert 2
IGI 2
Command & Conquer Generals
FIFA 2003
Need For Speed Hot Pursuit 2
The Gladiators
Soldier of Fortune II
Rainbow Six III RavenShield
Battlefield 1942 Road To Rome
Battlefield 1942
Counter-Strike
Unreal Tournament 2003
Half-Life

Also collects system information about the computer: type of the operating system, amount of memory, and the type of hardware installed.
Connects to an IRC server and can download the files of the hacker's choosing.
Can be used in a Denial of Service (DoS) attack on a Web site of the hacker's choosing.

Steps to remove this virus:

1. Disable System Restore (Windows Me/XP).
2. Restart the computer in Safe mode or VGA mode.
3. Run a full system scan and delete all the files detected as W32.HLLW.Moega.
4. Run Greatis RegRun Startup Manager to delete following registry keys:

a. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
with value: "Configuration Loaded" = "wupdated.exe" or: "Windows Update" = "mplupdate.exe"
b. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
with value: "Configuration Loaded" = "wupdated.exe" or: "Windows Update" = "mplupdate.exe"

wupdater.exe
Wupdater.exe is a spyware program that may have installed with n-CASE, iGetNet,
and KeenValue.exe. This programs were created by eUniverse.
In general, these programs generate popup ads and may hijack web searches.
Wupdater.exe seems to be a background update task.
You'll probably find it in C:\Program Files\Common files\updater\wupdater.exe.
Read more:
http://www.doxdesk.com/parasite/KeenValu...
Removal:
Use RegRun Start Control.

wupdmgr32.exe
It is a result of the DOS.AUTOCAT VIRUS!

DoS.Autocat is a Denial of Service (DoS) hacktool. The DoS is accomplished by ICMP packet flooding.

To remove this virus, please delete register key in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
with value "Microsoft Windows Update Service"="%winsys%\wupdmgr32.exe"
You can do it with Greatis Startup Optimizer.

Also you must start your antivirus program, run full system scan and delete all the files detected as DoS.Autocat.

http://www.symantec.com/avcenter/venc/da...

wupdsnff.exe
Wupdsnff.exe is Adware BetterInternet.Transponder.
Kill the process wupdsnff.exe and remove wupdsnff.exe from Windows startup.

wupdt32x.exe
Wupdt32x.exe is Trojan/Backdoor.
Kill the process wupdt32x.exe and remove wupdt32x.exe from Windows startup.

wupdt64.exe
Wupdt64.exe is Trojan/Backdoor.
Kill the process wupdt64.exe and remove wupdt64.exe from Windows startup.

wupdtmngr.exe
Wupdtmngr.exe is Trojan/Backdoor.
Kill the process wupdtmngr.exe and remove wupdtmngr.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

wupsys64.exe
Wupsys64.exe is Trojan/Backdoor.
Kill the process wupsys64.exe and remove wupsys64.exe from Windows startup.

wupupdate.exe
Wupupdate.exe is Trojan/Backdoor.
Kill the process wupupdate.exe and remove wupupdate.exe from Windows startup.

wurguar.exe
Wurguar.exe is Trojan/Backdoor.
Kill the process wurguar.exe and remove wurguar.exe from Windows startup.

wuuaclt32.exe
Wuuaclt32.exe is Trojan/Backdoor.
Kill the process wuuaclt32.exe and remove wuuaclt32.exe from Windows startup.

wvuurpp.dll
Wvuurpp.dll is Trojan/Backdoor.
Kill the file wvuurpp.dll and remove wvuurpp.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

wvuuuuu.dll
Wvuuuuu.dll is Trojan/Backdoor.
Kill the file wvuuuuu.dll and remove wvuuuuu.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

wwexec~1.exe
WWEXEC~1.EXE is Adware.ClickSpring.
Related files:
WOWEXEC.EXE
WWEXEC~1.EXE
Read more:
http://www.fileresearchcenter.com/W/WWEX...
Kill the process WWEXEC~1.EXE and remove WWEXEC~1.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

wwfx6.exe
Wwfx6.exe is WinFixer 2006 adware.
Read more:
http://www3.ca.com/securityadvisor/pest/...
Kill the process wwfx6.exe and remove wwfx6.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

wx2time.dll
WX2time.dll is Trojan/Backdoor.
WX2time.dll is installed as Winlogon Notification module.
Kill the file wX2time.dll and remove wX2time.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

wxapi.dll
Wxapi.dll is a mass-mailing worm.
Backdoor wxapi.dll spreads by e-mail and via open network shares.
Wxapi.dll steals account information from a predetermined Chinese bank.
Related files:
%System%\WINLOG0N.EXE.
%System%\wxapi.dll
%System%\svch0st.exe

Adds the value:
"WINLOG0N" = "%System%\WINLOG0N.EXE"
"Systems" = "%System%\svch0st.exe"
to the Windows startup registry keys.
More info:
http://securityresponse.symantec.com/avc...
Removal: Remove wxapi.dll from Windows startup using RegRun Startup Optimizer.

wxmct.exe
Wxmct.exe is Trojan/Backdoor.
Kill the process wxmct.exe and remove wxmct.exe from Windows startup.

wxpdll32.exe
Wxpdll32.exe is Backdoor.Win32.Sdbot.aad.
Kill the process wxpdll32.exe and remove wxpdll32.exe from Windows using RegRun.
www.regrun.com

wxploc(4).dll
WXPLOC(4).DLL is Adware.Look2ME.
Read more:
http://fileinfo.prevx.com/fileinfo.asp?P...
Kill the file WXPLOC(4).DLL and remove WXPLOC(4).DLL from Windows startup using RegRun Reanimator.
http://www.regrun.com

wzdmg.exe
Wzdmg.exe is Trojan/Backdoor.
Kill the process wzdmg.exe and remove wzdmg.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

wzdsvc.exe
Wzdsvc.exe is Trojan/Backdoor.
Kill the process wzdsvc.exe and remove wzdsvc.exe from Windows startup.

wzinfo.exe
WZINFO.exe is Trojan.Usbsteal.
Trojan.Usbsteal is a Trojan horse that steals sensitive information from the compromised computer.
Related files:
%System%\WZINFO.exe
%System%\USBDLL.dll
%System%\TempName.tmp
Read more:
http://www.symantec.com/enterprise/secur...
Kill the process WZINFO.exe and remove WZINFO.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

wzip32.exe
Wzip32.exe is Trojan Infostealer.Orcu.
Read more:
http://securityresponse.symantec.com/avc...
Kill the process wzip32.exe and remove wzip32.exe from Windows startup using RegRun.
www.regrun.com


Quick Links
What's new?
RSS Feed
Add to AppDatabase
Ask Experts
Join forum
Links

Articles
Virus or not? SPTD####.sys
What is mc21.tmp, mc22.tmp, mc23.tmp?

Select
Necessary
Useless
At your option
Dangerous

Copyright © 1998-2010 Greatis Software