Application Database

Worm W32.Linkbot.
It uses LSASS Buffer Overrun Vulnerability.
http://www.microsoft.com/technet/securit...
Adds value
"Windows DLL Loader" = "%system%\defragfatz.exe"
to the Windows startup registry key.
Opens an Ident Daemon listening on TCP port 113.
Allows the remote control of the infected computer.

%sysdir%\defragment.exe

defragment.exe is a Trojan.Flood-EV.
defragment.exe opens a back door.
Related files:
%System%\temp\bat32.installed
%System%\temp\bootconfig.exe
%System%\temp\defragment.exe
%System%\temp\mirc.ini
%System%\temp\moo.dll
%System%\temp\registry.bat
%System%\temp\scripts\download.ini
%System%\temp\scripts\main.ini
%System%\temp\scripts\mescript.ini
%System%\temp\scripts\proxy.ini
%System%\temp\scripts\quakenet.ini
%System%\temp\scripts\regread.ini
%System%\temp\settings\aliases.ini
%System%\temp\settings\channels.txt
%System%\temp\settings\names.txt
%System%\temp\settings\pm.txt
%System%\temp\settings\remote.ini
%System%\temp\settings\servers.ini
%System%\temp\sleep.exe
%System%\temp\svchost.exe
%System%\temp\update.exe
%System%\temp\winsrv.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill defragment.exe process and remove defragment.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\deneme.exe

Deneme.exe is a mass-mailing worm W32.Mytob.GP@mm.
Deneme.exe opens a back door on TCP port 3344.
Deneme.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\deneme.exe
C:\winsock.exe
Adds the value:
"WINDOWS DENEME" = "deneme.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill deneme.exe process and remove deneme.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\desktop.exe

Mass mailing worm W32.Kobot.
It spreads through open network shares, telnet, dameware, realserv, VNC, and niprint. This worm also uses three remotely exploitable Windows vulnerabilities to propagate.
Adds the value:
"desktop" = "%System%\desktop.exe"
to Windows startup registry keys.
Disables proxy settings and change some security parameters to enforce system protection.

%sysdir%\devcode.exe

devcode.exe is a Trojan W32.Rbot-AWL.
devcode.exe opens a back door on IRC channels.
devcode.exe spreads via open network shares.
devcode.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\devcode.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill devcode.exe process and remove devcode.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\devcode32.exe

devcode32.exe is a Trojan W32.Rbot-BBT.
devcode32.exe opens a back door.
devcode32.exe spreads via open network shares.
devcode32.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\devcode32.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill devcode32.exe process and remove devcode32.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\dflnl.exe

%SysDir%\dflnl.exe is Trojan/Backdoor.
Kill the process %SysDir%\dflnl.exe and remove %SysDir%\dflnl.exe from Windows startup using RegRun.
www.regrun.com

%sysdir%\dfrgsrv.exe

dfrgsrv.exe is rootkit Trojan.Madtol-A.
dfrgsrv.exe is used to hide files, processes and registry.
dfrgsrv.exe is a user mode rootkit.
Rootkit injects itself into winlogon.exe process.
Adds the value:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\run
wininet.dll
dfrgsrv.exe
to the Windows startup registry keys.
More info: http://www.sophos.com/security/analyses/...

%sysdir%\dgfgql.exe

%SysDir%\dgfgql.exe is Trojan/Backdoor.
Kill the process %SysDir%\dgfgql.exe and remove %SysDir%\dgfgql.exe from Windows startup using RegRun.
www.regrun.com
Read more: http://research.sunbelt-software.com/thr...

%sysdir%\dhcp.exe

%SysDir%\dhcp.exe is WORM_RBOT.AKW.
Read more: http://www.trendmicro.com/vinfo/virusenc...
Kill the process %SysDir%\dhcp.exe and remove %SysDir%\dhcp.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\dhcpclient.exe

Dhcpclient.exe is a worm W32.Toxbot.C.
Dhcpclient.exe opens a back door on IRC channel.
Dhcpclient.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\dhcpclient.exe
Adds the value:
"(Default)" = "Service"
"Start" = "2"
"ImagePath" = "%System%\dhcpclient.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill dhcpclient.exe process and remove dhcpclient.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\diagent.exe

diagent.exe is a Trojan W32.Agobot-CW.
diagent.exe opens a back door on IRC channels.
diagent.exe spreads via open network shares.
Related files:
%System%\winpn32.exe
%System%\diagent.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill diagent.exe process and remove diagent.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\dialer423.exe

%SysDir%\dialer423.exe is a part of Wareout, malware masquerading as a spyware and dialer remover.
Kill the process %SysDir%\dialer423.exe and remove %SysDir%\dialer423.exe from Windows startup using RegRun.
www.regrun.com

%sysdir%\dijpg.dll

Dijpg.dll is a Spyware.CMK.
Dijpg.dll tries to terminate antiviral programs installed on a user computer.
Dijpg.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%ProgramFiles%\YKPMD\EventScheduler.mdb
%ProgramFiles%\YKPMD\Help.rtf
%ProgramFiles%\YKPMD\riched32.dll
%ProgramFiles%\YKPMD\YKPND.exe
%Windir%\Installer\cf1272.msi
%System%\actskn43.ocx
%System%\dijpg.dll
%System%\richtx32.ocx
%System%\skinboxer43.dll
Adds the value:
"C:\Program Files\YKPMD\" = "YKPND.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove dijpg.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\dioxin.exe

Dioxin.exe is a worm W32.Attech-D.
Dioxin.exe downloads code from the internet.
Dioxin.exe modifies data on the computer.
Related files:
%System%\Dioxin.exe
%System%\WinDio778.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill Dioxin.exe process and remove Dioxin.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\directout.sys

directout.sys is rootkit Trojan.Haxdoor-BR.
directout.sys is used to hide files, processes and registry.
directout.sys is a kernel mode rootkit.
Rootkit contacts remote hacker server using HTTP session.
directout.sys tries to terminate antiviral programs installed on a user computer.
Related files:
%SysDir%\directout.sys
%SysDir%\directut.dll
Adds the value:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\directut
DllName
directut.dll

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\directut
Startup
directut

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\directut
Impersonate
1
to the Windows startup registry keys.
More info: http://www.sophos.com/security/analyses/...

%sysdir%\directprt.sys

directprt.sys is rootkit Trojan.Haxdoor-AX.
directprt.sys is used to hide files, processes and registry.
directprt.sys is a kernel mode rootkit.
directprt.sys opens a back door on IRC channels.
Related files:
%SysDir\directprt.sys
%SysDir%\directpt.dll
Adds the value:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\directpt
DllName
directpt.dll

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\directpt
Startup
directpt

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\directpt
Impersonate
1
to the Windows startup registry keys.
More info: http://www.sophos.com/virusinfo/analyses...

%sysdir%\directpt.dll

directpt.dll is a Trojan.Haxdoor-AX.
directpt.dll opens a back door on IRC channels.
directpt.dll spreads via open network shares.
Related files:
%System%\directprt.sys
%System%\directpt.dll
More info: www.sophos.com/virusinfo/analyses/trojhaxdoorax.html
Removal:
Remove DLLHOOK.DLL using RegRun "Scan for Viruses" feature.
http://www.regrun.com

%sysdir%\directut.dll

%SysDir%\directut.dll is Trojan/Backdoor.
Kill the file directut.dll and remove directut.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\directxsvi.dll

directxsvi.dll is a Trojan.Dloader-QL.
directxsvi.dll downloads code from the internet.
Related files:
%System%\nettemp.dll
%System%\directxsvi.dll
%System%\sporder.dll
%System%\sysconfig32.ax
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove directxsvi.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\dl.exe

dl.exe is a mass-mailing worm W32.Bagz@mm.
dl.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\dl.exe
%System%\syslogin.exe
%System%\jobdb.dll
%System%\ipdb.dll
%System%\wdate.dll
Adds the value:
"syslogin.exe" = "syslogin.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill dl.exe process and remove dl.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\dlhost.exe

Dlhost.exe is a mass-mailing worm W32.Kedebe.D@mm.
Dlhost.exe tries to terminate antiviral programs installed on a user computer.
Dlhost.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\nbtstat.exe
%System%\usrinit.exe
%System%\user.exe
%System%\winhlp32.exe
%System%\telnet.exe
%System%\locator.exe
%System%\recover.exe
%System%\logman.exe
%System%\dlhost.exe
%System%\logonui.exe
%System%\winspol.exe
%System%\services.exe
%System%\svchost.exe
%System%\lsas.exe
%System%\rundl32.exe
%System%\regedt32.exe
%System%\winlogon.exe
%System%\wuauclt.exe
Adds the value:
"Run" = "[PATH TO %System%\[FILE NAME]]"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill dlhost.exe process and remove dlhost.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\dllcache\cybershots.exe

%SysDir%\dllcache\cybershots.exe is W32.Mytob.RD@mm.
Read more: http://www.symantec.com/enterprise/secur...
Kill the process %SysDir%\dllcache\cybershots.exe and remove %SysDir%\dllcache\cybershots.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\dllcache\mslogon.exe

%SysDir%\dllcache\mslogon.exe is W32.Woredbot.C.
Read more: http://www.symantec.com/enterprise/secur...
Kill the process %SysDir%\dllcache\mslogon.exe and remove %SysDir%\dllcache\mslogon.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\dllcache\msupdprx.dll

Msupdprx.dll is a Trojan.Wayphisher.B.
Msupdprx.dll monitors user Internet activity and bank information.
It sends stolen data to a hacker site.
Related files:
%System%\dllcache\msupdprx.dll
%System%\dllcache\msxml32.dll
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove msupdprx.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\dllcache\msxml32.dll

Msxml32.dll is a Trojan.Wayphisher.B.
Msxml32.dll monitors user Internet activity and bank information.
It sends stolen data to a hacker site.
Related files:
%System%\dllcache\msupdprx.dll
%System%\dllcache\msxml32.dll
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove msxml32.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\dllcache\mutex.exe

%SysDir%\dllcache\mutex.exe is W32.Lokkest.A@mm.
Read more: http://www.symantec.com/enterprise/secur...
Kill the process %SysDir%\dllcache\mutex.exe and remove %SysDir%\dllcache\mutex.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\dllcache\qxchost.exe

%SysDir%\dllcache\qxchost.exe is W32/Sdbot-CWP worm and IRC backdoor.
Read more: http://www.sophos.com/security/analyses/...
Kill the process %SysDir%\dllcache\qxchost.exe and remove %SysDir%\dllcache\qxchost.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\dllcache\tcpip.sys

%SysDir%\dllcache\tcpip.sys is Trojan.Peacomm.B.
Related files:
%System%\dllcache\tcpip.sys
%System%\drivers\tcpip.sys
Read more: http://www.symantec.com/enterprise/secur...
Kill the file %SysDir%\dllcache\tcpip.sys and remove %SysDir%\dllcache\tcpip.sys from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\dllcache\win32\csrss.exe

%SysDir%\dllcache\win32\csrss.exe is Trojan/Backdoor.
Kill the process %SysDir%\dllcache\win32\csrss.exe and remove %SysDir%\dllcache\win32\csrss.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\dllcache\winsony.exe

%SysDir%\dllcache\winsony.exe is W32/Spybot-NS.
Read more: http://www.sophos.com/security/analyses/...
Kill the process %SysDir%\dllcache\winsony.exe and remove %SysDir%\dllcache\winsony.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\dllcachev2.exe

Trojan Lateda
Registers in Windows startup registry keys.
Connects to an IRC server on the domain s3.hanged.tk through TCP port 6667, and joins the channel ##stwo#.
Opens a backdoor on TCP port 9999, and waits for commands.
Allows the attacker make any actions on your computer.
Remove it from startup using RegRun Startup Optimizer.

%sysdir%\dllcboxz.dll

dllcboxz.dll is a Trojan.Brogger-D.
dllcboxz.dll monitors user Internet activity and bank information.
It sends stolen data to a hacker site.
Related files:
%System%\dllcboxz.dll
%System%\msndrvsys.dll
%System%\msndrvsys.exe
%System%\xrosario.sdf
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove dllcboxz.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\dllcnfg.exe

Dllcnfg.exe is a Trojan Backdoor.Samkams.
Dllcnfg.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\dllcnfg.exe
%System%\dmgrd.exe
Adds the value:
"Userinit" = "C:\WINDOWS\system32\userinit.exe,%System%\dllcnfg.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill dllcnfg.exe process and remove dllcnfg.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\dllconfig\cache\dllcache.exe

%SysDir%\dllconfig\cache\dllcache.exe is W32.Vispat.A@mm.
W32.Vispat.A@mm is a mass-mailing worm that gathers email addresses from the compromised computer. It also changes the Start Page for Internet Explorer and lowers Internet security settings.
Read more: http://www.symantec.com/enterprise/secur...
Kill the process %SysDir%\dllconfig\cache\dllcache.exe and remove %SysDir%\dllconfig\cache\dllcache.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\dllhook.dll

DLLHOOK.DLL is Trojan/Backdoor.
Remove DLLHOOK.DLL using RegRun "Scan for Viruses" feature.
http://www.regrun.com

%sysdir%\dllonet.dll

dllonet.dll is a Trojan.Brogger-C.
dllonet.dll monitors user Internet activity and bank information.
It sends stolen data to a hacker site.
Related files:
%System%\dllonet.dll
%System%\lycky.sdf
%System%\qwerwqr234
%System%\winskype.dll
%System%\winskype.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove dllonet.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\dllscan.exe

%SysDir%\dllscan.exe is Downloader.Trojan
Kill the process dllscan.exe and remove dllscan.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\dllsys.dll

Dllsys.dll is a password-stealing Trojan PWSteal.Bancos.Y.
Dllsys.dll monitors user Internet activity and bank information.
It sends stolen data to a hacker site.
Related files:
%System%\svcsys.dll
%System%\dllsys.dll
Adds the value:
"SvcSys" = "{FCF39D40-4CAB-49B4-B6F4-955EC73FD3B3}"
"(Default)" = "svcsys.dll"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove dllsys.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\dllvnet.dll

dllvnet.dll is a Trojan.Brogger-B.
dllvnet.dll monitors user Internet activity and bank information.
It sends stolen data to a hacker site.
Related files:
%System%\3124564789154
%System%\dllvnet.dll
%System%\drvnetw.dll
%System%\drvnetw.exe
%System%\nasario.sdf
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove dllvnet.dll Windows startup using RegRun Startup Optimizer.

%sysdir%\dlsp2mx.exe

dlsp2mx.exe is a Trojan Dial/MPB-B.
dlsp2mx.exe opens a back door.
Related files:
%System%\dlsp2mx.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill dlsp2mx.exe process and remove dlsp2mx.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\dlyinf.exe

dlyinf.exe is a Backdoor Troj/TheMouse-A.
dlyinf.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%/dlyinf.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill dlyinf.exe process and remove dlyinf.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\dma.exe

dma.exe is a Trojan W32.Rbot-AVO.
dma.exe opens a back door on IRC channels.
dma.exe spreads via open network shares.
Related files:
%System%\dma.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill dma.exe process and remove dma.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\dmcoj.exe

dmcoj.exe is a Trojan.RuinDl-K.
dmcoj.exe downloads code from the internet.
Related files:
%System%\dmcoj.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill dmcoj.exe process and remove dmcoj.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\dmcpyt.dll

dmcpyt.dll is a Trojan.Hanmon.
dmcpyt.dll opens a back door.
Related files:
%System%\tstdmc.dll
%System%\dmcpyt.dll
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove dmcpyt.dll Windows startup using RegRun Startup Optimizer.

%sysdir%\dmgrd.exe

Dmgrd.exe is a Trojan Backdoor.Samkams.
Dmgrd.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\dllcnfg.exe
%System%\dmgrd.exe
Adds the value:
"Userinit" = "C:\WINDOWS\system32\userinit.exe,%System%\dllcnfg.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill dmgrd.exe process and remove dmgrd.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\dmonwv.dll

%SysDir%\dmonwv.dll is Trojan/Backdoor.
Remove dmonwv.dll using RegRun "Scan for Viruses" feature.

%sysdir%\dmsrv.dll

Dmsrv.dll is a Trojan Backdoor.Fuwudoor.
Dmsrv.dll spreads via open network shares.
Related files:
%System%\ipsec.dll
%System%\appmgmt.dll
%System%\browsvr.dll
%System%\trkw.dll
%System%\trks.dll
%System%\kdc.dll
%System%\dmsrv.dll
%System%\mesg.dll
%System%\netlogin.dll
%System%\protstrg.dll
%System%\lmhosts.dll
%System%\w32t.dll
%System%\ntms.dll
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove dmsrv.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\dnsclt.exe

%SysDir%\DNSCLT.EXE is Trojan/Backdoor FTP.Serv.
Kill the process %SysDir%\DNSCLT.EXE and remove %SysDir%\DNSCLT.EXE from Windows startup.

%sysdir%\dnsresolver.exe

dnsresolver.exe is a worm W32.Kiman.A.
dnsresolver.exe opens a back door on IRC channels.
dnsresolver.exe spreads via open network shares.
Related files:
%System%\dnsresolver.exe
Adds the value:
"Domain Name Resolve Service" = "dnsresolver.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill the process dnsresolver.exe and remove dnsresolver.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\dnssvc.exe

dnssvc.exe is a Trojan.Dloader-U.
dnssvc.exe spreads via open network shares.
Related files:
%System%\dnssvc.exe
More info:
Removal:
Kill dnssvc.exe process and remove dnssvc.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\doc.exe

doc.exe is a mass-mailing worm W32.Beagle.C@mm.
doc.exe opens a back door on TCP port 2745.
doc.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\onde.exe
%System%\doc.exe
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill doc.exe process and remove doc.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\dom.dll

DOM.dll is a Spyware.IamBigBrother.
DOM.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
cpanel.exe
nl.exe
ctl3d32.dll
winl.dll
dmm.dll
ma.exe
%System%\DOM.dll
%System%\DartFtp.dll
%System%\DartSock.dll
%System%\EncodeX.dll
%System%\MabryObj.dll
%System%\MimeX.dll
%System%\SmtpX.DLL
%Windir%\cp.exe
Adds the value:
"Windows System Tray" = "[PATH TO SECURITY RISK]"
"Windows Service Manager" = "[PATH TO SECURITY RISK]"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove DOM.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\doser.exe

doser.exe is a Trojan.Agent-ZD.
doser.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\doser.exe
%System%\ssldr32.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill doser.exe process and remove doser.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\dosw.exe

dosw.exe is network worm W32.Salay-A.
dosw.exe spreads via open network shares.
Related files:
%System%\dosw.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill dosw.exe process and remove dosw.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\down.exe

%SysDir%\down.exe is W32.Tanexor.A.
Read more: http://www.symantec.com/enterprise/secur...
Kill the process %SysDir%\down.exe and remove %SysDir%\down.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\downloaddll.dll

%SysDir%\DownLoadDLL.dll is Trojan/Backdoor.
Remove DownLoadDLL.dll using RegRun "Scan for Viruses" feature.
http://www.regrun.com

%sysdir%\dpnet.exe

%SysDir%\dpnet.exe is Trojan/Backdoor.
Kill the process %SysDir%\dpnet.exe and remove %SysDir%\dpnet.exe from Windows startup.

%sysdir%\dpnetmsg.exe

dpnetmsg.exe is a Trojan.PPdoor-Q.
dpnetmsg.exe opens a back door.
dpnetmsg.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\dpnetmsg.exe
%System%\iueninet.dll
%System%\fsmgntfs.dll
%System%\ntmapast.dll
%System%\ir50psrv.exe
%System%\kbd1uery.dll
%System%\lfyockaa.dll
%System%\a15svcs.exe
%System%\dpnmdlib.exe
%System%\c_28usic.dll
%System%\atiysnpn.dll
%System%\treemqoa.dll
%System%\arptutdn.dll
%System%\eulapart.dll
%System%\smlo8thk.exe
%System%\odbcfwci.ime
%System%\hgakheg.dll
%System%\jkwbhew.dll
%System%\testtest.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill dpnetmsg.exe process and remove dpnetmsg.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\dpnmdlib.exe

dpnmdlib.exe is a Trojan.PPdoor-Q.
dpnmdlib.exe opens a back door.
dpnmdlib.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\dpnetmsg.exe
%System%\iueninet.dll
%System%\fsmgntfs.dll
%System%\ntmapast.dll
%System%\ir50psrv.exe
%System%\kbd1uery.dll
%System%\lfyockaa.dll
%System%\a15svcs.exe
%System%\dpnmdlib.exe
%System%\c_28usic.dll
%System%\atiysnpn.dll
%System%\treemqoa.dll
%System%\arptutdn.dll
%System%\eulapart.dll
%System%\smlo8thk.exe
%System%\odbcfwci.ime
%System%\hgakheg.dll
%System%\jkwbhew.dll
%System%\testtest.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill dpnmdlib.exe process and remove dpnmdlib.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\draw32.dll

Draw32.dll is a Trojan Backdoor.Haxdoor.C.
Draw32.dll tries to terminate antiviral programs installed on a user computer.
Draw32.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\vdt_16.exe
%System%\i.a3d
%System%\draw32.dll
%System%\vm.dll
%System%\vdnt32.sys
%System%\hm.sys
%System%\memlow.sys
%System%\wd.sys
%System%\p2.ini
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove draw32.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\driver\ntsrv.exe

%SysDir%\DRIVER\ntsrv.exe /name:"NTLOAD" /start:"%SysDir%\driver\csrss.exe" is Trojan.Runas.
Read more:
http://info.prevx.com/pxparall.asp?PX5=0...
Kill the processes %SysDir%\DRIVER\ntsrv.exe and %SysDir%\driver\csrss.exe", remove %SysDir%\DRIVER\ntsrv.exe and %SysDir%\driver\csrss.exe from Windows startup using RegRun.
www.regrun.com

%sysdir%\drivers\abhcop.sys

abhcop.sys is rootkit Adware.PigSearch.
abhcop.sys is used to hide files, processes and registry.
abhcop.sys is a kernel mode rootkit.
Rootkit creates new system service.
Related files:
%System%\drivers\abhcop.sys
%System%\drivers\hcalway.sys
%ProgramFiles%\wsearch\allverx.dat
%ProgramFiles%\HuaCi\Mouse.dll
%ProgramFiles%\wsearch\mUninstall.exe
%ProgramFiles%\HuaCi\mupdate.exe
%ProgramFiles%\wsearch\Search.exe
%ProgramFiles%\HuaCi\SearchM.dll
%ProgramFiles%\wsearch\sysupdate.ini
%ProgramFiles%\HuaCi\_uninstall
%UserProfile%\Start Menu\Programs\Startup\��??????.lnk
%UserProfile%\Start Menu\Programs\��??????.lnk
Adds the value:
"MoveSearch" = "[PATH TO ADWARE]"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
to the Windows startup registry keys.
Added to registry:
HKEY_CLASSES_ROOT\CLSID\{594BE7B2-23B0-4FAE-A2B9-0C21CC1417CE}
HKEY_CLASSES_ROOT\Interface\{4E1ACE40-F681-4CC4-A7C0-AD1E6C9AD86F}
HKEY_CLASSES_ROOT\Interface\{A07E6B9B-BB30-4381-A9D8-FABB0648BCEF}
HKEY_CLASSES_ROOT\TypeLib\{FD536575-73F7-42A3-9E9F-11688F1A006A}
HKEY_CLASSES_ROOT\TypeLib\{C5CE084B-31E0-4B34-A33A-82B4EA913CF8}
HKEY_CLASSES_ROOT\SearchM.Com
HKEY_CLASSES_ROOT\SearchM.Com.1
HKEY_CLASSES_ROOT\SearchM.Search
HKEY_CLASSES_ROOT\SearchM.Search.1
HKEY_CURRENT_USER\Software\Pig Move Search
HKEY_CURRENT_USER\Software\MSWord\Search
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\CDSearch
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\abhcop
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\hcalway
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\abhcop
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\hcalway

More info: http://www.symantec.com/security_respons...

%sysdir%\drivers\bdguard.sys

BDGUARD.SYS is Trojan/Backdoor.
Kill the file BDGUARD.SYS and remove BDGUARD.SYS from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\drivers\bridges.sys

bridges.sys is rootkit Trojan.Oscor-J.
bridges.sys is used to hide files, processes and registry.
bridges.sys is a kernel mode rootkit.
Rootkit contacts remote hacker server using HTTP session.
Rootkit creates new system drivers.
bridges.sys monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%SysDir%\lodcst.exe
%SysDir%\d874.cpl
%SysDir%\d897.cpl
%SysDir%\localsp.dll
%SysDir%\rljd.dat
%SysDir%\wsnmpkey32.dll
%SysDir%\drivers\bridges.sys
Adds the value:
HKLM\SYSTEM\CurrentControlSet\Services\srservice
Start
4
to the Windows startup registry keys.
More info: http://www.sophos.com/security/analyses/...

%sysdir%\drivers\bzr.exe

bzr.exe is a Trojan.Bancos-EC.
bzr.exe monitors user Internet activity and bank information.
It sends stolen data to a hacker site.
Related files:
%System%\drivers\copy38.exe
%System%\drivers\bzr.exe
%System%\drivers\lsassig.exe
%System%\drivers\rze.exe
%System%\drivers\sza.exe
%System%\drivers\uzn.exe
%System%\drivers\nze.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill bzr.exe process and remove bzr.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\drivers\copy38.exe

copy38.exe is a Trojan.Bancos-EC.
copy38.exe monitors user Internet activity and bank information.
It sends stolen data to a hacker site.
Related files:
%System%\drivers\copy38.exe
%System%\drivers\bzr.exe
%System%\drivers\lsassig.exe
%System%\drivers\rze.exe
%System%\drivers\sza.exe
%System%\drivers\uzn.exe
%System%\drivers\nze.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill copy38.exe process and remove copy38.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\drivers\core.sys

%SysDir%\drivers\core.sys is Rootkit.
Kill the file %SysDir%\drivers\core.sys and remove %SysDir%\drivers\core.sys from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\drivers\csrss.exe

%SysDir%\drivers\csrss.exe is AdRotator/IconAds Adware.
Related files:
%local_settings%\ temp\ 11-9df8e247b1ab6e4ea9303b15294a3428.exe
%local_settings%\ temp\ s11k..exe
%PROGRAM_FILES%\ COMMON FILES\ SLMSS\ slmss.exe
%SYSTEM%\ adrot-uninst.exe
%SYSTEM%\ adrotate.dll
%SYSTEM%\ adrotate1.dll
%system%\ adspipe.dll
%SYSTEM%\ brrotate.dll
%system%\ cpmrotate.dll
%SYSTEM%\ drivers\ csrss.exe
%system%\ mwsvm.exe
%system%\ mwsvm.ocx
%SYSTEM%\ nodeipproc.dll
%SYSTEM%\ uninsticn.exe
Read more: http://research.sunbelt-software.com/thr...
Kill the process %SysDir%\drivers\csrss.exe and remove %SysDir%\drivers\csrss.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\drivers\detport.sys

%Sysdir%\drivers\DetPort.sys is rootkit BackDoor-CKB!cfaae1e6.
Kill the file %Sysdir%\drivers\DetPort.sys and remove %Sysdir%\drivers\DetPort.sys from Windows startup using RegRun Reanimator.
http://www.regrun.com
Read more:
http://vil.mcafeesecurity.com/vil/conten...

%sysdir%\drivers\elpow_spy.sys

elpow_spy.sys is rootkit Spyware.ElpowKeylogger.
elpow_spy.sys is used to hide files, processes and registry.
elpow_spy.sys is a kernel mode rootkit.
Rootkit logs keystrokes, mouse clicks, passwords, web-activity, e-mail activity and screen shots.
Rootkit creates new system drivers.
Related files:
%SysDir%\drivers\elpow_spy.sys
%Windir%\Keyloggerelow_spy\elpow_log.exe
%Windir%\Keyloggerelow_spy\elpow_log.init
%Windir%\Keyloggerelow_spy\pk_manual.chm
%Windir%\Keyloggerelow_spy\unins000.exe
%Windir%\Keyloggerelow_spy\unins000.dat
%Windir%\Keyloggerelow_spy\web.flt
%Windir%\elpow_spyBLOB
%Windir%\elpow_spyCLICKING
%Windir%\elpow_spyIDLELOG
%Windir%\elpow_spyINDEX
%Windir%\elpow_spyKEYLOG
%Windir%\elpow_spyMAILLOG
%Windir%\elpow_spyOPTIONS
%Windir%\elpow_spyPASLOG
%Windir%\elpow_spySCREEN
%Windir%\elpow_spyWEBLOG
Adds the value:
"ImagePath" = "\??\%SysDir%\drivers\elpow_spy.sys"
"Type" = "1"
"Start" = "1"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\elpow_spy
to the Windows startup registry keys.
Added to registry:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\elpow_spy
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Enum\Root\LEGACY_ELPOW_SPY
More info: http://www.symantec.com/security_respons...

%sysdir%\drivers\etc\jesse.exe

%SysDir%\drivers\etc\jesse.exe is Trojan/Backdoor.
Kill the process jesse.exe and remove jesse.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\drivers\ispubdrv.sys

%Sysdir%\drivers\IsPubDRV.sys is Trojan/Backdoor BackDoor-CKB!cfaae1e6.
Kill the file %Sysdir%\drivers\IsPubDRV.sys and remove %Sysdir%\drivers\IsPubDRV.sys from Windows startup using RegRun Reanimator.
http://www.regrun.com
Read more:
http://vil.mcafeesecurity.com/vil/conten...

%sysdir%\drivers\lsass.exe

%SysDir%\drivers\lsass.exe is W32.Pagipef.
Related files:
%UserProfile%\Start Menu\Programs\Startup\cmd.pif
%System%\drivers\lsass.exe
Read more: http://www.symantec.com/enterprise/secur...
Kill the process %SysDir%\drivers\lsass.exe and remove %SysDir%\drivers\lsass.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\drivers\lsassig.exe

lsassig.exe is a Trojan.Bancos-EC.
lsassig.exe monitors user Internet activity and bank information.
It sends stolen data to a hacker site.
Related files:
%System%\drivers\copy38.exe
%System%\drivers\bzr.exe
%System%\drivers\lsassig.exe
%System%\drivers\rze.exe
%System%\drivers\sza.exe
%System%\drivers\uzn.exe
%System%\drivers\nze.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill lsassig.exe process and remove lsassig.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\drivers\mdojtgmr.sys

%SysDir%\drivers\mdojtgmr.sys is Trojan/Backdoor.
Kill the file mdojtgmr.sys and remove mdojtgmr.sys from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\drivers\mnsystem.dll

MNSYSTEM.dll is a Trojan PWSteal.Tarno.N.
MNSYSTEM.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\drivers\Data\vmmlog64.TXT
%System%\drivers\Data\vmmlog64II.TXT
%System%\drivers\SPOOLSYS.exe
%System%\drivers\MNSYSTEM.dll
Adds the value:
"MicrosoftSys" = "%System%\drivers\SPOOLSYS.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove MNSYSTEM.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\drivers\msksvrtss.exe

%SysDir%\drivers\MSKSVRTSS.EXE is W32.Spybot.APEO.
W32.Spybot.APEO is a worm that opens a back door and connects to an IRC server, allowing an attacker to execute commands on the compromised computer.
Read more: http://www.symantec.com/enterprise/secur...
Kill the process %SysDir%\drivers\MSKSVRTSS.EXE and remove %SysDir%\drivers\MSKSVRTSS.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\drivers\ncscv32.exe

%SysDir%\drivers\ncscv32.exe is W32/Fujacks-AL.
Read more: http://www.sophos.com/security/analyses/...
Kill the process %SysDir%\drivers\ncscv32.exe and remove %SysDir%\drivers\ncscv32.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\drivers\netsvcs.sys

netsvcs.sys is rootkit Trojan.HacDef-AM.
netsvcs.sys is used to hide files, processes and registry.
netsvcs.sys is a kernel mode rootkit.
Rootkit contacts remote hacker server using HTTP session.
Rootkit creates new system service.
Related files:
%SysDir%\drivers\netsvcs.sys
Added to registry:
HKLM\SYSTEM\CurrentControlSet\Services\NetSTrSvc

HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NETSTRSVC

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\NetSTrSvc

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\NetSTrSvc
More info: http://www.sophos.com/virusinfo/analyses...

%sysdir%\drivers\ntndis.exe

%SysDir%\drivers\ntndis.exe is Trojan/Backdoor.
Kill the process ntndis.exe and remove ntndis.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\drivers\ntndis.sys

ntndis.sys is rootkit W32/Forbot-GI.
ntndis.sys is used to hide files, processes and registry.
ntndis.sys is a kernel mode rootkit.
Rootkit contacts remote hacker server using HTTP session.
Related files:
%SysDir%\drivers\ntndis.exe
%SysDir%\drivers\ntndis.sys

ntndis.sys is created new system drivers:
service name: "ntndis"
display name: "ntndis"
Added to registry:
HKLM\SYSTEM\CurrentControlSet\Services\ntndis\
Adds the value:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Shell
Explorer.exe %SysDir%\drivers\ntndis.exe
to the Windows startup registry keys.
More info: http://www.sophos.com/virusinfo/analyses...

%sysdir%\drivers\nze.exe

nze.exe is a Trojan.Bancos-EC.
nze.exe monitors user Internet activity and bank information.
It sends stolen data to a hacker site.
Related files:
%System%\drivers\copy38.exe
%System%\drivers\bzr.exe
%System%\drivers\lsassig.exe
%System%\drivers\rze.exe
%System%\drivers\sza.exe
%System%\drivers\uzn.exe
%System%\drivers\nze.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill nze.exe process and remove nze.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\drivers\removejk.exe

removeJK.exe is Trojan/Backdoor.
Kill the process removeJK.exe and remove removeJK.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\drivers\rvdport.sys

%Sysdir%\drivers\RVdPort.sys is Trojan/Backdoor BackDoor-CKB!cfaae1e6.
Kill the file %Sysdir%\drivers\RVdPort.sys and remove %Sysdir%\drivers\RVdPort.sys from Windows startup using RegRun Reanimator.
http://www.regrun.com
Read more:
http://vil.mcafeesecurity.com/vil/conten...

%sysdir%\drivers\rze.exe

rze.exe is a Trojan.Bancos-EC.
rze.exe monitors user Internet activity and bank information.
It sends stolen data to a hacker site.
Related files:
%System%\drivers\copy38.exe
%System%\drivers\bzr.exe
%System%\drivers\lsassig.exe
%System%\drivers\rze.exe
%System%\drivers\sza.exe
%System%\drivers\uzn.exe
%System%\drivers\nze.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill rze.exe process and remove rze.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\drivers\sdqgvqcm.sys

%SysDir%\drivers\sdqgvqcm.sys is Trojan/Backdoor.
Kill the file sdqgvqcm.sys and remove sdqgvqcm.sys from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\drivers\spoolsys.exe

SPOOLSYS.exe is a Trojan PWSteal.Tarno.N.
SPOOLSYS.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\drivers\Data\vmmlog64.TXT
%System%\drivers\Data\vmmlog64II.TXT
%System%\drivers\SPOOLSYS.exe
%System%\drivers\MNSYSTEM.dll
Adds the value:
"MicrosoftSys" = "%System%\drivers\SPOOLSYS.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill SPOOLSYS.exe process and remove SPOOLSYS.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\drivers\sysbus32.sys

sysbus32.sys is rootkit Trojan.SysBDr-G.
sysbus32.sys is used to hide files, processes and registry.
sysbus32.sys is a kernel mode rootkit.
sysbus32.sys monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%SysDir%\drivers\sysbus32.sys
More info: http://www.sophos.com/virusinfo/analyses...

%sysdir%\drivers\syswav.sys

syswav.sys is rootkit Trojan_KILLAV.GG.
syswav.sys is used to hide files, processes and registry.
syswav.sys is a kernel mode rootkit.
Rootkit contacts remote hacker server using HTTP session.
Rootkit injects itself into other process.
Rootkit creates new system drivers:
Related files:
%SysDir%\drivers\syswav.sys
Adds the value:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\syswav
ImagePath = "%SysDir%\drivers\syswav.sys"
to the Windows startup registry keys.
More info: http://www.trendmicro.com/vinfo/virusenc...

%sysdir%\drivers\sza.exe

sza.exe is a Trojan.Bancos-EC.
sza.exe monitors user Internet activity and bank information.
It sends stolen data to a hacker site.
Related files:
%System%\drivers\copy38.exe
%System%\drivers\bzr.exe
%System%\drivers\lsassig.exe
%System%\drivers\rze.exe
%System%\drivers\sza.exe
%System%\drivers\uzn.exe
%System%\drivers\nze.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill sza.exe process and remove sza.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\drivers\taskmgr.exe

%SysDir%\drivers\taskmgr.exe is Trojan.Daum.
Related files:
%System%\drivers\taskmgr.exe
%Windir%\apacka.exe
%Windir%\ahelpa.dll
Read more: http://www.symantec.com/enterprise/secur...
Kill the process %SysDir%\drivers\taskmgr.exe and remove %SysDir%\drivers\taskmgr.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\drivers\uninstall.exe

%SysDir%\drivers\Uninstall.exe is W32.Reploret.
Related files:
[DRIVE_LETTER]:\more.exe (for drive C)
[DRIVE_LETTER]:\Hay.exe (for drives D to P)
Read more: http://www.symantec.com/enterprise/secur...
Kill the process %SysDir%\drivers\Uninstall.exe and remove %SysDir%\drivers\Uninstall.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\drivers\uzn.exe

uzn.exe is a Trojan.Bancos-EC.
uzn.exe monitors user Internet activity and bank information.
It sends stolen data to a hacker site.
Related files:
%System%\drivers\copy38.exe
%System%\drivers\bzr.exe
%System%\drivers\lsassig.exe
%System%\drivers\rze.exe
%System%\drivers\sza.exe
%System%\drivers\uzn.exe
%System%\drivers\nze.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill uzn.exe process and remove uzn.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\drivers\videoati0.sys

VideoAti0.sys is rootkit Trojan.Nailuj-A.
VideoAti0.sys is used to hide files, processes and registry.
VideoAti0.sys is a kernel mode rootkit.
Rootkit contacts remote hacker server using HTTP session.
Related files:
%WinDir%\lib
%WinDir%\stdie.dll
%SysDir%\VideoAti0.dll
%SysDir%\VideoAti0.exe
%SysDir%\comctl3.srg
%SysDir%\delself.batd
%SysDir%\drivers\VideoAti0.sys
Added to registry:
HKCR\CLSID\(A3803141-3CF5-4D66-B7EA-8D2674FE152C)
HKCR\Interface\(13D90754-C6BC-4C7E-9E9E-399C211136EF)
HKCR\TypeLib\(9FD6C9E2-54F8-48A9-BEF6-964F9C221AE4)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\(A3803141-3CF5-4D66-B7EA-8D2674FE152C)

HKCR\Gogo.IEhlprObj.1\CLSID
(default)
(A3803141-3CF5-4D66-B7EA-8D2674FE152C)

HKCR\Gogo.IEhlprObj\CLSID
(default)
(A3803141-3CF5-4D66-B7EA-8D2674FE152C)

HKCR\Gogo.IEhlprObj

More info: http://www.sophos.com/security/analyses/...

%sysdir%\drivers\winlogon.exe

%SysDir%\DRIVERS\WINLOGON.EXE is W32/SillyFDC-AM.
Read more: http://www.sophos.com/security/analyses/...
Kill the process %SysDir%\DRIVERS\WINLOGON.EXE and remove %SysDir%\DRIVERS\WINLOGON.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\drivers\winmon.sys

winmon.sys is rootkit W32/Rbot-ALA.
winmon.sys is used to hide files, processes and registry.
winmon.sys is a kernel mode rootkit.
Rootkit contacts remote hacker server using HTTP session.
winmon.sys spreads via open network shares.
winmon.sys opens a back door on IRC channels.
winmon.sys tries to terminate antiviral programs installed on a user computer.
winmon.sys monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Rootkit created new system drivers.
Related files:
%SysDir%\drivers\winmon.sys
More info: http://www.sophos.com/virusinfo/analyses...

%sysdir%\drivers\zxbnredm.sys

Zxbnredm.sys is Trojan/Backdoor.
Kill the file Zxbnredm.sys and remove Zxbnredm.sys from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\drivxp.exe

Drivxp.exe is a Trojan W32.Sdbot-AIP.
Drivxp.exe opens a back door on IRC channels.
Drivxp.exe spreads via open network shares.
Related files:
%System%\Drivxp.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill Drivxp.exe process and remove Drivxp.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\drvnetw.dll

drvnetw.dll is a Trojan.Brogger-B.
drvnetw.dll monitors user Internet activity and bank information.
It sends stolen data to a hacker site.
Related files:
%System%\3124564789154
%System%\dllvnet.dll
%System%\drvnetw.dll
%System%\drvnetw.exe
%System%\nasario.sdf
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove drvnetw.dll Windows startup using RegRun Startup Optimizer.

%sysdir%\drvnetw.exe

drvnetw.exe is a Trojan.Brogger-B.
drvnetw.exe monitors user Internet activity and bank information.
It sends stolen data to a hacker site.
Related files:
%System%\3124564789154
%System%\dllvnet.dll
%System%\drvnetw.dll
%System%\drvnetw.exe
%System%\nasario.sdf
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill drvnetw.exe process and remove drvnetw.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\drvwtsn32.dll

DrvWtsn32.dll is a Trojan.Dremn-G.
DrvWtsn32.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\syscache\DrWatson32.exe
%System%\syscache\DrvWtsn32.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove DrvWtsn32.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\drwtsn64.exe

%SysDir%\drwtsn64.exe is Trojan/Backdoor.
Kill the process %SysDir%\drwtsn64.exe and remove %SysDir%\drwtsn64.exe from Windows startup using RegRun.
www.regrun.com

%sysdir%\dskchk.dll

Dskchk.dll is a mass-mailing worm W32.Aprilcone.A@mm.
Dskchk.dll spreads by e-mail.
Related files:
%System%\syscon.exe
%System%\mschk.dll
%System%\Watcher.dll
%System%\sysMon.dll
%System%\syslog.dll
%System%\atchk.dll
%System%\sysmsg.dll
%System%\chkrun.dll
%System%\dskchk.dll
%System%\msevent.dll
%System%\ipchk.dll
%System%\client.dll
%System%\servr.dll
%System%\netchk.dll
%System%\mssys.dll
Adds the value:
"syscon" = "%System%\syscon.exe"
"AppInit_DLLs" = "%System%\Watcher.dll"
to the Windows startup registry keys.

More info: http://securityresponse.symantec.com/avc...
Removal:
Remove dskchk.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\dskmon32.exe

dskmon32.exe is a Trojan W32.Rbot-BCL.
dskmon32.exe opens a back door on IRC channels.
dskmon32.exe spreads via open network shares.
Related files:
%System%\dskmon32.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill dskmon32.exe process and remove dskmon32.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\dsktrf.dll

dsktrf.dll is an adware program Adware.Begin2search.
dsktrf.dll monitors user Internet activity.
dsktrf.dll displays advertising information.
Related files:
%System%\reg6523.exe
%System%\winb2s32.dll
%System%\winbbb.dat
%System%\dsktrf.dll
%System%\ns.dll
%System%\trgen.dll
%System%\rtneg.dll
%Windir%\Downloaded Program Files\winb2s32.inf
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove dsktrf.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\duck.exe

duck.exe is a Trojan W32.Agobot-TH.
duck.exe opens a back door on IRC channels.
duck.exe spreads via open network shares.
duck.exe tries to terminate antiviral programs installed on a user computer.
duck.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\duck.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill duck.exe process and remove duck.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\duel_v2.exe

Duel_v2.exe is a mass-mailing worm W32.Dref-L.
Duel_v2.exe opens a back door on IRC channels.
Duel_v2.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\Duel_v2.exe
%Windows%\Duel.log
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill the process Duel_v2.exe and remove Duel_v2.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\dvb03a.dll

%SysDir%\dvb03a.dll is Trojan/Backdoor.
Remove dvb03a.dll using RegRun "Scan for Viruses" feature.
http://www.regrun.com

%sysdir%\dvd4free.dll

dvd4free.dll is rootkit Trojan.Haxdoor-BC.
dvd4free.dll is used to hide files, processes and registry.
dvd4free.dll is a kernel mode rootkit.
Rootkit contacts remote hacker server using HTTP session.
Related files:
%SysDir%\dvd4free.dll
%SysDir%\dvdkernl.sys

dvdkernl.sys is created new system drivers:
service name: "dvdkernl"
display name: "UDP checksum correction"
Added to registry:
HKLM\SYSTEM\CurrentControlSet\Services\dvdkernl\

Adds the value:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dvd4free
DllName
dvd4free.dll

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dvd4free
Startup
dvd4free

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dvd4free
Impersonate
1
to the Windows startup registry keys.
More info: http://www.sophos.com/virusinfo/analyses...

%sysdir%\dvdkernl.sys

dvdkernl.sys is a Trojan.Haxdoor-BC.
dvdkernl.sys monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\dvd4free.dll
%System%\dvdkernl.sys
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill the process dvdkernl.sys and remove dvdkernl.sys from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\dvdrealm.sys

%sysdir%\dvdsdtl.dll

dvdsdtl.dll is a Trojan.Heoms.
dvdsdtl.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\heomstool.exe
%System%\dvdsdtl.dll
%System%\vddsdls.dat
%System%\vddsdls.inf
%System%\otdal.ico
%System%\vddsdls\dvdsdtl.dll
%System%\vddsdls\vddsdls.dat
Adds the value:
"heomstool" = "C:\Windows\System32\heomstool.exe COPY"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove dvdsdtl.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\dx32cxlp.exe

Trojan Nemog.
To autostart uses the Registry Run keys and the services keys:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dx32cxel
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_DX32CXEL
Creates the system service called "dx32cxel".
Hides its service and files by hooking several APIs and returning null results for any API calls.
Creates backdoor using ports 4661, 4242, 8080, 4646, 6565, and 3306.
Receives commands from a remote attacker through a backdoor to perform the following actions:
1) Uninstall itself
2) Update itself
3) Download a file

Overwrites the %System%\DRIVERS\ETC\HOSTS file with the text, which prevents access to certain security-related Web sites.
Removal:
Go to
HKLM\SOFTWARE\Microsoft\Internet Explorer
Delete the values:
"mutexname" = "mSRMHED"
"vers" = "0x10050"

Delete the keys:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dx32cxel
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_DX32CXEL

Restore "hosts" file.
Restart your computer.

%sysdir%\dxdiags.exe

dxdiags.exe is a Trojan.Certif-G.
dxdiags.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\dxdiags.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill dxdiags.exe process and remove dxdiags.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\dy9mw.dll

dy9mw.dll is rootkit Trojan.Vanti-F.
dy9mw.dll is used to hide files, processes and registry.
dy9mw.dll is a kernel mode rootkit.
Related files:
%Temp%\dy9mw.dll

More info: http://www.sophos.com/virusinfo/analyses...

%sysdir%\ebay.exe

Worm and Trojan W32.Gaobot.BUU.
It can be controlled using IRC channels.
Adds to Windows startup:
"Windows Update" = "ebay.exe"
Modifies the hosts file to block access to antiviral sites.
Kills the antiviral programs.
Remove it using RegRun Startup Optimizer.

%sysdir%\ebmqbx.exe

ebmqbx.exe is a Trojan W32.Ixbot-E.
ebmqbx.exe opens a back door on IRC channels.
Related files:
%System%\ebmqbx.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill ebmqbx.exe process and remove ebmqbx.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\edlm2.exe

%SysDir%\edlm2.exe is Trojan/Backdoor.
Kill the process edlm2.exe and remove edlm2.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\eetvpn.sys

eetvpn.sys is rootkit BKDR_HAXDOOR.KG.
eetvpn.sys opens a back door on random TCP port.
eetvpn.sys is used to hide files, processes and registry.
eetvpn.sys is a kernel mode rootkit.
Rootkit injects itself into the winlogon.exe process.
Rootkit injects itself into the explorer.exe process.
Rootkit contacts remote hacker server using HTTP session.
Related files:
%SysDir%\eetvpn.dll
%SysDir%\eetvpn.sys
%SysDir%\eexvpn.sys
%SysDir%\qo.dll
%SysDir%\qo.sys
%SysDir%\KGCTINI.DAT
%SysDir%\LPS.DAT

eexvpn.sys is created new system drivers:
service name: " eexvpn"
display name: " "MCRT accelerator"

Adds the value:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\eexvpn

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\eetvpn

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon\Notify\eetvpn

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Minimal\eexvpn.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Network\eexvpn.sys
to the Windows startup registry keys.

Added to registry:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\
SharedAccess\Parameters\FirewallPolicy\StandardProfile\
AuthorizedApplications\List
%Windows%\Explorer.exe = "%Windows%\Explorer.exe:*:Enabled:explorer"

HKEY_CURRENT_USER\Software\RIT\The Bat!

More info: http://www.trendmicro.com/vinfo/virusenc...

%sysdir%\efsdfgxg.exe

efsdfgxg.exe is a Trojan.StartP-ADY.
efsdfgxg.exe opens a back door.
Related files:
%System%\efsdfgxg.exe
%System%\search.html
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill efsdfgxg.exe process and remove efsdfgxg.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\elite.exe

Elite.exe is a mass-mailing worm W32.Mytob.EG@mm.
Elite.exe opens a back door on IRC channel.
Elite.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\elite.exe
Adds the value:
"Windows Fixes Systems" = "elite.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill elite.exe process and remove elite.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\eliteflf32.exe

eliteflf32.exe is Trojan/Backdoor.
Related files:
%SysDir%\eliteflf32.exe
Removal:
Kill eliteflf32.exe process and remove eliteflf32.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\elitelsj32.exe

elitelsj32.exe is a TrojanMultidr-ER.
elitelsj32.exe opens a back door.
Related files:
%Windows%\EliteToolBar\EliteToolBar version 60.dll
%System%\elitelsj32.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill elitelsj32.exe process and remove elitelsj32.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\emconv.exe

Emconv.exe is a Spyware.BeyondKeylog.
Emconv.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%ProgramFiles%\Supremtec\csrss.exe
%System%\emconv.exe
%System%\rgtcvc32.dll
%System%\msrep32.dll
%System%\mstrc32.dll
More info:
Removal:
Kill emconv.exe process and remove emconv.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\emgfx.exe

emgfx.exe is a Trojan.Fusion-B.
emgfx.exe opens a back door.
emgfx.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Windows%\nwisse.exe
%Windows%\winspols.scr
%System%\emgfx.exe
%System%\svch0st.com
%System%\svchost.klg
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill emgfx.exe process and remove emgfx.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\encodex.dll

EncodeX.dll is a Spyware.IamBigBrother.
EncodeX.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
cpanel.exe
nl.exe
ctl3d32.dll
winl.dll
dmm.dll
ma.exe
%System%\DOM.dll
%System%\DartFtp.dll
%System%\DartSock.dll
%System%\EncodeX.dll
%System%\MabryObj.dll
%System%\MimeX.dll
%System%\SmtpX.DLL
%Windir%\cp.exe
Adds the value:
"Windows System Tray" = "[PATH TO SECURITY RISK]"
"Windows Service Manager" = "[PATH TO SECURITY RISK]"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove EncodeX.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\enzxp.exe

enzxp.exe is a worm W32.Rbot-BAJ.
enzxp.exe opens a back door on IRC channels.
enzxp.exe spreads via open network shares.
Related files:
%System%\enzxp.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill enzxp.exe process and remove enzxp.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\ersvc.exe

ERSvc.exe is a mass-mailing worm W32.Renama.A@mm.
ERSvc.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%Windir%\system\svchost.exe
%System%\ERSvc.exe
%Windir%\mmsg\mcAfee.Update.exe.exe
%Windir%\mmsg\mmsg.exe.exe
%Windir%\Config\Easy.Windows.Monitoring.exe.exe
%Windir%\Config\system.update.exe.exe
%Windir%\notepad.exe.exe
Adds the value:
"notepad" = "%Windir%\notepad.exe.exe"
"mmsg" = "%Windir%\mmsg\mmsg.exe.exe"
"system.update" = "%Windir%\Config\system.update.exe.exe"
"mcAfee.Instan.Update" = "%Windir%\mmsg\mcAfee.Update.exe.exe"
"Easy.Windows.Monitor" = "%Windir%\Config\Easy.Windows.Monitoring.exe.exe"
"ImagePath" = "%System%\ERSvc.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill the process ERSvc.exe and remove ERSvc.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\esmtp.exe

esmtp.exe is a mass-mailing worm W32.Mytob-GQ.
esmtp.exe opens a back door on IRC channels.
Related files:
%System%\esmtp.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill esmtp.exe process and remove esmtp.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\espynow-v2.0\esnowun.dll

ESNOWUN.dll is a Spyware.eSpyNow.
ESNOWUN.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%UserProfile%\Desktop\espynow.exe
%System%\eSpyNow-v2.0\ESNOWUN.dll
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove ESNOWUN.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\eulapart.dll

eulapart.dll is a Trojan.PPdoor-Q.
eulapart.dll opens a back door.
eulapart.dll tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\dpnetmsg.exe
%System%\iueninet.dll
%System%\fsmgntfs.dll
%System%\ntmapast.dll
%System%\ir50psrv.exe
%System%\kbd1uery.dll
%System%\lfyockaa.dll
%System%\a15svcs.exe
%System%\dpnmdlib.exe
%System%\c_28usic.dll
%System%\atiysnpn.dll
%System%\treemqoa.dll
%System%\arptutdn.dll
%System%\eulapart.dll
%System%\smlo8thk.exe
%System%\odbcfwci.ime
%System%\hgakheg.dll
%System%\jkwbhew.dll
%System%\testtest.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove eulapart.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\eulsass.dll

EULSASS.DLL is a Trojan.Sharp-F.
EULSASS.DLL opens a back door.
Related files:
%System%\IMMS16.DLL
%System%\MCIOLES16.DLL
%System%\COMAPI.DLL
%System%\EULSASS.DLL
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove EULSASS.DLL from Windows startup using RegRun Startup Optimizer.

%sysdir%\eventwvr.exe

%SysDir%\eventwvr.exe is Spyware.
Related files:
BMIQP.EXE
Kill the process %SysDir%\eventwvr.exe and remove %SysDir%\eventwvr.exe from Windows startup using RegRun.
www.regrun.com

%sysdir%\exdl0.exe

Exdl0.exe is an adware program Adware.BargainBuddy.
Exdl0.exe downloads and displays advertisements.
Related files:
Apuc.dll;
Autoheal.exe
%System%\angelex.exe
%System%\instsrv.exe
%System%\msexreg.exe
%System%\bbchk.exe
%System%\exclean.exe
%System%\exdl.exe
%System%\exdl0.exe
%System%\exdl1.exe
%System%\exul.exe
%System%\msbe.dll
%System%\msxct.exe
%ProgramFiles%\BullsEye Network\bin\adv.exe
%ProgramFiles%\BullsEye Network\bin\adx.exe
%ProgramFiles%\BullsEye Network\bin\bargains.exe
%ProgramFiles%\BullsEye Network\Uninstall.exe
%Windows%\bbchk.exe
%Windows%\exclean.exe
%Windows%\exdl.exe
%Windows%\exul.exe
%Windows%\msbe.dll
%Windows%\msxct.exe
%Windows%\zeta.exe
Adds the value:
"[File name of adware]" = "[File path to adware]"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill exdl0.exe process and remove exdl0.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\exdl1.exe

Exdl1.exe is an adware program Adware.BargainBuddy.
Exdl1.exe downloads and displays advertisements.
Related files:
Apuc.dll;
Autoheal.exe
%System%\angelex.exe
%System%\instsrv.exe
%System%\msexreg.exe
%System%\bbchk.exe
%System%\exclean.exe
%System%\exdl.exe
%System%\exdl0.exe
%System%\exdl1.exe
%System%\exul.exe
%System%\msbe.dll
%System%\msxct.exe
%ProgramFiles%\BullsEye Network\bin\adv.exe
%ProgramFiles%\BullsEye Network\bin\adx.exe
%ProgramFiles%\BullsEye Network\bin\bargains.exe
%ProgramFiles%\BullsEye Network\Uninstall.exe
%Windows%\bbchk.exe
%Windows%\exclean.exe
%Windows%\exdl.exe
%Windows%\exul.exe
%Windows%\msbe.dll
%Windows%\msxct.exe
%Windows%\zeta.exe
Adds the value:
"[File name of adware]" = "[File path to adware]"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill exdl1.exe process and remove exdl1.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\exeha2.exe

exeha2.exe is a Trojan.Delf-PB.
exeha2.exe opens a back door.
Related files:
%System%\birdihuy.dll
%System%\birdihuy32.dll
%System%\exeha2.exe
%System%\exeha3.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill exeha2.exe process and remove exeha2.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\exeha3.exe

exeha3.exe is a Trojan.Delf-PB.
exeha3.exe opens a back door.
Related files:
%System%\birdihuy.dll
%System%\birdihuy32.dll
%System%\exeha2.exe
%System%\exeha3.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill exeha3.exe process and remove exeha3.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\exelib.dll

Wininet.exe is worm W32.Wotron.Worm.
Wininet.exe is added to the Windows startip registry keys.
Also in the registry key
HKEY_LOCAL_MACHINE\Software\Classes\exefile\shell\open\command
worm changes the (Default) value to
%System%\wininet.exe"%1" %*
This causes the wininet.exe to run when you attempt to run an .exe file.
Related files:
-%SysDir%\Sysd.dll
-%SysDir%\Exelib.dll
Restore default file extensions using RegRun Start Control.
After thatkill the process %SysDir%\wininet.exe and remove wininet.exe from Windows startup.

%sysdir%\exp.exe

Exp.exe is Trojan/Backdoor.
Kill the process exp.exe and remove exp.exe from Windows startup.

%sysdir%\expi0rer.exe

expI0rer.exe is a mass-mailing worm W32.Mytob-FI.
expI0rer.exe opens a back door on IRC channels.
expI0rer.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\expI0rer.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill expI0rer.exe process and remove expI0rer.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\explore32.exe

explore32.exe is a Trojan.Bdoor-MT.
explore32.exe opens a back door.
Related files:
%System%\explore32.exe
%System%\plugin1.dat
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill explore32.exe process and remove explore32.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\exploreff.exe

exploreff.exe is a Trojan.Finfanse.
exploreff.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\exploreff.exe
%System%\systemlff.dll
Adds the value:
"exploreff.exe" = "%System%\exploreff.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill exploreff.exe process and remove exploreff.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\explorer.exe

Trojan Kility.
Adds the value:
"(Default)" = "%System%\EXPLORER.exe" "%1"
to the registry keys:
HKEY_CLASSES_ROOT\txtfile\shell\open\command
HKEY_LOCAL_MACHINE\software\classes\txtfile\shell\open\command
Adds to Windows startup.

%sysdir%\explorer32\autoupdate.dll

AutoUpdate.dll is a Spyware.PCTattletale.
AutoUpdate.dll logs keystrokes.
AutoUpdate.dll monitors user Internet activity.
Related files:
%ProgramFiles%\Common Files\InstallShield\Driver\7\Intel 32\IDriver.exe
%ProgramFiles%\Common Files\InstallShield\Driver\7\Intel 32\IScript7.dll
%ProgramFiles%\Common Files\InstallShield\Driver\7\Intel 32\ISRT.dll
%ProgramFiles%\Common Files\InstallShield\Driver\7\Intel 32\IUser7.dll
%ProgramFiles%\Common Files\InstallShield\Driver\7\Intel 32\objps7.dll
%ProgramFiles%\Common Files\InstallShield\Driver\7\Intel 32\_ISRES1033.dll
%System%\explorer32\AutoUpdate.dll
%System%\explorer32\AutoUpdateClient.exe
%System%\explorer32\chattext.dll
%System%\explorer32\msn6mngr.exe
%System%\explorer32\Netlogon.exe
%System%\explorer32\Wincmd.exe
%System%\explorer32\WinSysMngr.exe
%System%\MSN32.dll
%System%\PCTT.exe
%System%\UninstallPCTT.exe
%System%\Unzip32.dll
%System%\WinLoad.exe
%System%\zip32.dll
Adds the value:
"(default)" = ""
"WinLoad" = "%System%\Winload.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove AutoUpdate.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\explorer32\autoupdateclient.exe

AutoUpdateClient.exe is a Spyware.PCTattletale.
AutoUpdateClient.exe logs keystrokes.
AutoUpdateClient.exe monitors user Internet activity.
Related files:
%ProgramFiles%\Common Files\InstallShield\Driver\7\Intel 32\IDriver.exe
%ProgramFiles%\Common Files\InstallShield\Driver\7\Intel 32\IScript7.dll
%ProgramFiles%\Common Files\InstallShield\Driver\7\Intel 32\ISRT.dll
%ProgramFiles%\Common Files\InstallShield\Driver\7\Intel 32\IUser7.dll
%ProgramFiles%\Common Files\InstallShield\Driver\7\Intel 32\objps7.dll
%ProgramFiles%\Common Files\InstallShield\Driver\7\Intel 32\_ISRES1033.dll
%System%\explorer32\AutoUpdate.dll
%System%\explorer32\AutoUpdateClient.exe
%System%\explorer32\chattext.dll
%System%\explorer32\msn6mngr.exe
%System%\explorer32\Netlogon.exe
%System%\explorer32\Wincmd.exe
%System%\explorer32\WinSysMngr.exe
%System%\MSN32.dll
%System%\PCTT.exe
%System%\UninstallPCTT.exe
%System%\Unzip32.dll
%System%\WinLoad.exe
%System%\zip32.dll
Adds the value:
"(default)" = ""
"WinLoad" = "%System%\Winload.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill AutoUpdateClient.exe process and remove AutoUpdateClient.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\explorer32\chattext.dll

chattext.dll is a Spyware.PCTattletale.
chattext.dll logs keystrokes.
chattext.dll monitors user Internet activity.
Related files:
%ProgramFiles%\Common Files\InstallShield\Driver\7\Intel 32\IDriver.exe
%ProgramFiles%\Common Files\InstallShield\Driver\7\Intel 32\IScript7.dll
%ProgramFiles%\Common Files\InstallShield\Driver\7\Intel 32\ISRT.dll
%ProgramFiles%\Common Files\InstallShield\Driver\7\Intel 32\IUser7.dll
%ProgramFiles%\Common Files\InstallShield\Driver\7\Intel 32\objps7.dll
%ProgramFiles%\Common Files\InstallShield\Driver\7\Intel 32\_ISRES1033.dll
%System%\explorer32\AutoUpdate.dll
%System%\explorer32\AutoUpdateClient.exe
%System%\explorer32\chattext.dll
%System%\explorer32\msn6mngr.exe
%System%\explorer32\Netlogon.exe
%System%\explorer32\Wincmd.exe
%System%\explorer32\WinSysMngr.exe
%System%\MSN32.dll
%System%\PCTT.exe
%System%\UninstallPCTT.exe
%System%\Unzip32.dll
%System%\WinLoad.exe
%System%\zip32.dll
Adds the value:
"(default)" = ""
"WinLoad" = "%System%\Winload.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove chattext.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\explorer32\msn6mngr.exe

msn6mngr.exe is a Spyware.PCTattletale.
msn6mngr.exe logs keystrokes.
msn6mngr.exe monitors user Internet activity.
Related files:
%ProgramFiles%\Common Files\InstallShield\Driver\7\Intel 32\IDriver.exe
%ProgramFiles%\Common Files\InstallShield\Driver\7\Intel 32\IScript7.dll
%ProgramFiles%\Common Files\InstallShield\Driver\7\Intel 32\ISRT.dll
%ProgramFiles%\Common Files\InstallShield\Driver\7\Intel 32\IUser7.dll
%ProgramFiles%\Common Files\InstallShield\Driver\7\Intel 32\objps7.dll
%ProgramFiles%\Common Files\InstallShield\Driver\7\Intel 32\_ISRES1033.dll
%System%\explorer32\AutoUpdate.dll
%System%\explorer32\AutoUpdateClient.exe
%System%\explorer32\chattext.dll
%System%\explorer32\msn6mngr.exe
%System%\explorer32\Netlogon.exe
%System%\explorer32\Wincmd.exe
%System%\explorer32\WinSysMngr.exe
%System%\MSN32.dll
%System%\PCTT.exe
%System%\UninstallPCTT.exe
%System%\Unzip32.dll
%System%\WinLoad.exe
%System%\zip32.dll
Adds the value:
"(default)" = ""
"WinLoad" = "%System%\Winload.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill msn6mngr.exe process and remove msn6mngr.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\explorer32\netlogon.exe

Netlogon.exe is a Spyware.PCTattletale.
Netlogon.exe logs keystrokes.
Netlogon.exe monitors user Internet activity.
Related files:
%ProgramFiles%\Common Files\InstallShield\Driver\7\Intel 32\IDriver.exe
%ProgramFiles%\Common Files\InstallShield\Driver\7\Intel 32\IScript7.dll
%ProgramFiles%\Common Files\InstallShield\Driver\7\Intel 32\ISRT.dll
%ProgramFiles%\Common Files\InstallShield\Driver\7\Intel 32\IUser7.dll
%ProgramFiles%\Common Files\InstallShield\Driver\7\Intel 32\objps7.dll
%ProgramFiles%\Common Files\InstallShield\Driver\7\Intel 32\_ISRES1033.dll
%System%\explorer32\AutoUpdate.dll
%System%\explorer32\AutoUpdateClient.exe
%System%\explorer32\chattext.dll
%System%\explorer32\msn6mngr.exe
%System%\explorer32\Netlogon.exe
%System%\explorer32\Wincmd.exe
%System%\explorer32\WinSysMngr.exe
%System%\MSN32.dll
%System%\PCTT.exe
%System%\UninstallPCTT.exe
%System%\Unzip32.dll
%System%\WinLoad.exe
%System%\zip32.dll
Adds the value:
"(default)" = ""
"WinLoad" = "%System%\Winload.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill Netlogon.exe process and remove Netlogon.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\explorer32\winsysmngr.exe

WinSysMngr.exe is a Spyware.PCTattletale.
WinSysMngr.exe logs keystrokes.
WinSysMngr.exe monitors user Internet activity.
Related files:
%ProgramFiles%\Common Files\InstallShield\Driver\7\Intel 32\IDriver.exe
%ProgramFiles%\Common Files\InstallShield\Driver\7\Intel 32\IScript7.dll
%ProgramFiles%\Common Files\InstallShield\Driver\7\Intel 32\ISRT.dll
%ProgramFiles%\Common Files\InstallShield\Driver\7\Intel 32\IUser7.dll
%ProgramFiles%\Common Files\InstallShield\Driver\7\Intel 32\objps7.dll
%ProgramFiles%\Common Files\InstallShield\Driver\7\Intel 32\_ISRES1033.dll
%System%\explorer32\AutoUpdate.dll
%System%\explorer32\AutoUpdateClient.exe
%System%\explorer32\chattext.dll
%System%\explorer32\msn6mngr.exe
%System%\explorer32\Netlogon.exe
%System%\explorer32\Wincmd.exe
%System%\explorer32\WinSysMngr.exe
%System%\MSN32.dll
%System%\PCTT.exe
%System%\UninstallPCTT.exe
%System%\Unzip32.dll
%System%\WinLoad.exe
%System%\zip32.dll
Adds the value:
"(default)" = ""
"WinLoad" = "%System%\Winload.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill WinSysMngr.exe process and remove WinSysMngr.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\explorerl.exe

explorerl.exe is a worm W32.Sdbot-ADI.
explorerl.exe opens a back door on IRC channels.
explorerl.exe spreads via open network shares.
Related files:
%System%\explorerl.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill explorerl.exe process and remove explorerl.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\explores.exe

explores.exe is Trojan.Homey-A.
explores.exe opens a back door on IRC channels.
Related files:
%System%\explores.exe
%System%\1000ys.txt.
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill explores.exe process and remove explores.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\express.exe

express.exe is a Trojan W32.Rbot-ATJ.
express.exe opens a back door on IRC channels.
express.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\express.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill express.exe process and remove express.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\external.exe

External.exe is a mass-mailing worm W32.Mytob.EV@mm.
External.exe tries to terminate antiviral programs installed on a user computer.
External.exe opens a back door on TCP Port 8900.
Related files:
%System%\External.exe
Adds the value:
"External Dependencies" = "%System%\External.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill External.exe process and remove External.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\fatpammy.exe

fatpammy.exe is a worm W32.Bropia-U.
fatpammy.exe spreads via file sharing on P2P networks.
Related files:
%Windows%\cgiagent.exe
%System%\cgiagent.exe
%System%\ngen\bot editor.exe
%System%\ngen\brute force.exe
%System%\ngen\brutus.exe
%System%\ngen\cc generator.exe
%System%\ngen\character editor.exe
%System%\ngen\credit card.exe
%System%\ngen\game editor.exe
%System%\ngen\icon editor.exe
%System%\ngen\intro.exe
%System%\ngen\microsoft keygen.exe
%System%\ngen\sub7 editor.exe
%System%\fatpammy.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill fatpammy.exe process and remove fatpammy.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\fciara.exe

fciara.exe is a Trojan.Sdranck-Y.
fciara.exe spreads via open network shares.
Related files:
%System%\ciaraf.exe
%System%\fciara.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill fciara.exe process and remove fciara.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\fdd.exe

Fdd.exe is a mass-mailing worm W32.Mytob-FO.
Fdd.exe opens a back door.
Fdd.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\Fdd.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill Fdd.exe process and remove Fdd.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\ffisearch.exe

%sysdir%\ffservice.exe

ffservice.exe is a Trojan.Dloader-XM.
ffservice.exe downloads code from the internet.
Related files:
%System%\ffservice.exe
%System%\lservice.exe
%System%\wservice.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill ffservice.exe process and remove ffservice.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\filesaver32.exe

%SysDir%\filesaver32.exe is Trojan/Backdoor.
Kill the process %SysDir%\filesaver32.exe and remove %SysDir%\filesaver32.exe from Windows startup.

%sysdir%\fingen.exe

fingen.exe is a Trojan.Sharp-I.
fingen.exe opens a back door.
fingen.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\boot.exe
%System%\fingen.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill fingen.exe process and remove fingen.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\firefox.exe

firefox.exe is a Trojan W32.Rbot-ATP.
firefox.exe opens a back door on IRC channels.
firefox.exe spreads via open network shares.
Related files:
%System%\firefox.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill firefox.exe process and remove firefox.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\firewall.bat

Firewall.bat is a mass-mailing worm VBS.Yspan.G@mm.
Firewall.bat spreads via open network shares.
Firewall.bat tries to terminate antiviral programs installed on a user computer.
Related files:
C:\windows\system\system32.dll
C:\windows\system\sys32.dll
C:\WINDOWS\System32\Taskmgr.bat
C:\WINDOWS\System32\Firewall.bat
Adds the value:
"WINLOGON" = "wscript.exe C:\Windows\System32\WINLOGON.vbs %"
"Tasmgr" = "C:\WINDOWS\System32\Taskmgr.bat"
"Firewall" = "C:\WINDOWS\System32\Firewall.bat"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill Firewall.bat process and remove Firewall.bat from Windows startup using RegRun Startup Optimizer.

%sysdir%\firewall.exe

%SysDir%\Firewall.exe is a worm W32.Linkbot.M.
Related files:
%System%\lssas.exe
%System%\Isass.exe
%System%\csrs.exe
%System%\logon.exe
%System%\winIogon.exe
%System%\explorer.exe
%System%\winamp.exe
%System%\firewall.exe
%System%\spoolsvc.exe
%System%\spooIsv.exe
%System%\algs.exe
%System%\iexplore.exe
Read more: http://www.symantec.com/avcenter/venc/da...
Kill the process %SysDir%\Firewall.exe and remove %SysDir%\Firewall.exe from Windows startup using RegRun.
www.regrun.com

%sysdir%\firewallingv10.exe

FirewallingV10.exe is a Ttojan W32.Rbot-BKF.
FirewallingV10.exe opens a back door on IRC channels.
FirewallingV10.exe spreads via open network shares.
FirewallingV10.exe tries to terminate antiviral programs installed on a user computer.
FirewallingV10.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\FirewallingV10.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill FirewallingV10.exe process and remove FirewallingV10.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\firewall-updatev9.exe

Firewall-UpdateV9.exe is a worm W32.Rbot-BJR.
Firewall-UpdateV9.exe opens a back door on IRC channels.
Firewall-UpdateV9.exe spreads via open network shares.
Firewall-UpdateV9.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\Firewall-UpdateV9.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill Firewall-UpdateV9.exe process and remove Firewall-UpdateV9.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\firewire.exe

firewire.exe is a Trojan W32.Sdbot-AFC.
firewire.exe opens a back door on IRC channels.
firewire.exe spreads via open network shares.
Related files:
%System%\firewire.exe
%System%\keylog.txt
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill firewire.exe process and remove firewire.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\fixapi.exe

fixapi.exe is a Trojan.Keylog-AU.
fixapi.exe records keystrokes.
Related files:
%System%\fixapi.exe
%System%\rsn.exe
%System%\hotkey.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill fixapi.exe process and remove fixapi.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\fixupdattr.exe

Fixupdattr.exe is a mass-mailing worm W32.Mytob.GU@mm.
Fixupdattr.exe opens a back door on TCP port 8080.
Fixupdattr.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\fixupdattr.exe
Adds the value:
"ARCHIVE CONTROL" = "fixupdattr.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill fixupdattr.exe process and remove fixupdattr.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\flashmovie.exe

%Startup%\ShockWave.exe (or FlasMovie) is W32.HLLW.Dormin.A@mm mass mailing worm.
When ShockWave.exe worm runs, it displays the fake error message, "MacroMedia Shockwave Flash is not installed!"
Copies itself as the following files:
* %Startup%\ShockWave.exe
* %System%\FlashMovie.exe
* %System%\Jdbgmgr.exe
* %mIRC%\FlashMovie.ex_
* %Pirch32%\FlashMovie.ex_
* %KaZaA%\Virtual Sex Simulator.exe
* %KaZaA%\Shockwave Flash.exe
* %KaZaA%\SWF_Movie.exe
* %KaZaA%\FlashMovie.exe
* %KaZaA%\XXX video.exe
* %KaZaA%\Cat attacks child.exe
* %KaZaA%\SWF.exe
* %KaZaA%\Comedy video.exe
* %KaZaA%\Simpsons Episode (#[Number calculated from current time]).exe
* %KaZaA%\Tutorial Video on Hacking.exe
* %KaZaA%\MacroMedia Flash 6.0.exe
* %KaZaA%\[SWF] - The Fast and the Furious.exe
* %KaZaA%\[SWF] - Swordfish.exe
* %KaZaA%\[SWF] - Harry Potter and the philosophers stone.exe
* %KaZaA%\[SWF] - Jurassic Park 3.exe
Adds the registry values:
Nimrod_Keyboard Rundll32.exe Keyboard,Disable
Nimrod_Mouse Rundll32.exe Mouse,Disable
to teh key:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\
RunServices
to disable the mouse and keyboard when you start Windows.
It works with Windows 9X/Me only.
ShockWave sends e-mails with attachment FlashMovie.exe.

%sysdir%\flcss.exe

%SysDir%\flcss.exe is Trojan/Backdoor.
Kill the process flcss.exe and remove flcss.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\fldrsys.dll

fldrsys.dll is a Trojan.Agent-QY.
fldrsys.dll opens a back door.
Related files:
%System%\fldrsys.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove fldrsys.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\flsmngr.dll

%SysDir%\flsmngr.dll is a Malware.
Remove %SysDir%\flsmngr.dll from Windows startup using RegRun.
www.regrun.com

%sysdir%\flxper.exe

flxper.exe is a network worm W32.Sdbot-AGZ.
flxper.exe opens a back door on IRC channels.
flxper.exe spreads via open network shares.
flxper.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\flxper.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill flxper.exe process and remove flxper.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\fmwabe.exe

%SysDir%\fmwabe.exe is Trojan/Backdoor.
Kill the process fmwabe.exe and remove fmwabe.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\fonr.exe

%SysDir%\fonr.exe is Trojan/Backdoor.
Kill the process %SysDir%\fonr.exe and remove %SysDir%\fonr.exe from Windows startup.

%sysdir%\foro.exe

foro.exe is a Trojan.BagleDl-AM.
foro.exe opens a back door.
foro.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\wintems.exe
%System%\foro.exe
%System%\noat.exe
%Windows%\german.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill foro.exe process and remove foro.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\foxdhend.exe

Foxdhend.exe is a Trojan PWSteal.Menghuan.
Foxdhend.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\foxdhend.exe
Adds the value:
"foxdh" = "%System%\foxdhend.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill foxdhend.exe process and remove foxdhend.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\foxdhsend.exe

%SysDir%\foxdhsend.exe is Spyware.FOLIN.AP.
Kill the process foxdhsend.exe and remove foxdhsend.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\foxrxjh.exe

foxrxjh.exe is a Trojan.GWGhost-S.
foxrxjh.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\foxrxjh.exe
%System%\cac1s.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill foxrxjh.exe process and remove foxrxjh.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\fpdrnznx.dll

FPDRNZNX.DLL is Trojan/Backdoor.
Kill the file FPDRNZNX.DLL and remove FPDRNZNX.DLL from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\freeimagex.dll

FreeImageX.dll is a Spyware.PCWatch.
FreeImageX.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\FreeImageX.dll
%System%\VB5DB.dll
%System%\VB5StKit.dll
%Windir%\ST5UNST.EXE
C:\Store\pcwatch.exe
Adds the value:
"PCWatch" = "c:\store\pcwatch.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove FreeImageX.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\frundlll.exe

FRundlll.exe is a Trojan.GrayBrd-A.
FRundlll.exe opens a back door.
Related files:
%System%\FRundlll.exe
%System%\Deleteme.bat
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill FRundlll.exe process and remove FRundlll.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\frxhser.exe

%SysDir%\frxhser.exe is Trojan/Backdoor StartPage.
Kill the process %SysDir%\frxhser.exe and remove %SysDir%\frxhser.exe from Windows startup.

%sysdir%\fservice.exe

fservice.exe is a Trojan.Prorat-R.
fservice.exe opens a back door.
Related files:
%Windows%\services.exe
%System%\sservice.exe
%System%\fservice.exe
%Windows%\ktd32.atm
%System%\wininv.dll
%System%\winkey.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill fservice.exe process and remove fservice.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\fsmgntfs.dll

fsmgntfs.dll is a Trojan.PPdoor-Q.
fsmgntfs.dll opens a back door.
fsmgntfs.dll tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\dpnetmsg.exe
%System%\iueninet.dll
%System%\fsmgntfs.dll
%System%\ntmapast.dll
%System%\ir50psrv.exe
%System%\kbd1uery.dll
%System%\lfyockaa.dll
%System%\a15svcs.exe
%System%\dpnmdlib.exe
%System%\c_28usic.dll
%System%\atiysnpn.dll
%System%\treemqoa.dll
%System%\arptutdn.dll
%System%\eulapart.dll
%System%\smlo8thk.exe
%System%\odbcfwci.ime
%System%\hgakheg.dll
%System%\jkwbhew.dll
%System%\testtest.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove fsmgntfs.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\fswan.exe

fswan.exe is a Trojan Trojan.QQPass-AF.
fswan.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\fswan.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill fswan.exe process and remove fswan.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\fswanqq.exe

fswanQQ.exe is a TrojanQQSend-A.
fswanQQ.exe monitors user Internet activity and bank information.
It sends stolen data to a hacker site.
Related files:
%System%\fswanQQ.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill fswanQQ.exe process and remove fswanQQ.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\fuck.exe

Fuck.exe is a mass-mailing worm W32.Zotob.J@mm.
Fuck.exe opens a back door on TCP port 445.
Fuck.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\fuck.exe
Adds the value:
"WINDOWS FUCK BY CLASIC" = "fuck.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill fuck.exe process and remove fuck.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\fumeta.exe

fumeta.exe is Trojan W32.Rbot-AUG.
fumeta.exe opens a back door on IRC channels.
fumeta.exe spreads via open network shares.
Related files:
%System%\fumeta.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill fumeta.exe process and remove fumeta.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\fwms32.exe

FWMs32.exe is a Trojan.Proxy-AA.
FWMs32.exe opens a back door.
Related files:
%System%\FWMs32.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill FWMs32.exe process and remove FWMs32.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\gcassav32.exe

gcasSav32.exe is a mass-mailing worm W32.Kedebe.B@mm.
gcasSav32.exe tries to terminate antiviral programs installed on a user computer.
gcasSav32.exe opens a back door on a random TCP port.
Related files:
%System%\winssc32.exe
%System%\mscppmgr.exe
%System%\kerne132.exe
%System%\NAVMON.EXE
%System%\drwmgr32.exe
%System%\DLLH0ST.EXE
%System%\gcasctrl.exe
%System%\msscan.exe
%System%\cuApp.exe
%System%\LSSAS.EXE
%System%\AVmon.exe
%System%\SERVlCES.EXE
%System%\gcasSav32.exe
%System%\LUC0MS~1.EXE
%System%\zlbclient.exe
%System%\mantispam.exe
%System%\NETM0N.EXE
%System%\srvchost.exe
%System%\USRMGRINIT.JFX
Admin Password Cracker.exe
DVD ripper keygen.exe
Messenger 7.0 Installer.exe
Microsoft AntiSpyware Patch.com
Mydoom removal tool.exe
Naked teen-Actions.com
Norton Personal Firewall 2005 Patch.exe
Spyware remover.exe
Win Server 2003 Remote Exploit.cmd
ZoneAlarm Security Suite 2005 Crack.com
Adds the value:
"Windows [worm filename without extension] Monitor" = "[file name of the worm]"
"Run" = "[file name of the worm]"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill gcasSav32.exe process and remove gcasSav32.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\gdien32.exe

%SysDir%\gdien32.exe is Trojan/Backdoor.
Kill the process gdien32.exe and remove gdien32.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\gdsys\dxtlist.dll

dXTList.dll is a Spyware.GuardMon.
dXTList.dll monitors user Internet activity.
Related files:
%System%\gsp.dll
%System%\GDSys\GDMgr.exe
%System%\GDSys\GDH.dll
%System%\GDSys\GDAdmin.exe
%System%\GDSys\dXTList.dll
%System%\GDSys\ExCalendar.dll
%System%\GDSys\eztoolslib.dll
%System%\GDSys\instlsp.exe
%System%\GDSys\strace.dll
%System%\GDSys\vbalFlBr6.dll
Adds the value:
"GDMgr.exe" = "%System%\GDSys\gdmgr.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove dXTList.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\gdsys\excalendar.dll

ExCalendar.dll is a Spyware.GuardMon.
ExCalendar.dll monitors user Internet activity.
Related files:
%System%\gsp.dll
%System%\GDSys\GDMgr.exe
%System%\GDSys\GDH.dll
%System%\GDSys\GDAdmin.exe
%System%\GDSys\dXTList.dll
%System%\GDSys\ExCalendar.dll
%System%\GDSys\eztoolslib.dll
%System%\GDSys\instlsp.exe
%System%\GDSys\strace.dll
%System%\GDSys\vbalFlBr6.dll
Adds the value:
"GDMgr.exe" = "%System%\GDSys\gdmgr.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove ExCalendar.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\gdsys\eztoolslib.dll

eztoolslib.dll is a Spyware.GuardMon.
eztoolslib.dll monitors user Internet activity.
Related files:
%System%\gsp.dll
%System%\GDSys\GDMgr.exe
%System%\GDSys\GDH.dll
%System%\GDSys\GDAdmin.exe
%System%\GDSys\dXTList.dll
%System%\GDSys\ExCalendar.dll
%System%\GDSys\eztoolslib.dll
%System%\GDSys\instlsp.exe
%System%\GDSys\strace.dll
%System%\GDSys\vbalFlBr6.dll
Adds the value:
"GDMgr.exe" = "%System%\GDSys\gdmgr.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove eztoolslib.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\gdsys\gdadmin.exe

GDAdmin.exe is a Spyware.GuardMon.
GDAdmin.exe monitors user Internet activity.
Related files:
%System%\gsp.dll
%System%\GDSys\GDMgr.exe
%System%\GDSys\GDH.dll
%System%\GDSys\GDAdmin.exe
%System%\GDSys\dXTList.dll
%System%\GDSys\ExCalendar.dll
%System%\GDSys\eztoolslib.dll
%System%\GDSys\instlsp.exe
%System%\GDSys\strace.dll
%System%\GDSys\vbalFlBr6.dll
Adds the value:
"GDMgr.exe" = "%System%\GDSys\gdmgr.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill GDAdmin.exe process and remove GDAdmin.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\gdsys\gdh.dll

GDH.dll is a Spyware.GuardMon.
GDH.dll monitors user Internet activity.
Related files:
%System%\gsp.dll
%System%\GDSys\GDMgr.exe
%System%\GDSys\GDH.dll
%System%\GDSys\GDAdmin.exe
%System%\GDSys\dXTList.dll
%System%\GDSys\ExCalendar.dll
%System%\GDSys\eztoolslib.dll
%System%\GDSys\instlsp.exe
%System%\GDSys\strace.dll
%System%\GDSys\vbalFlBr6.dll
Adds the value:
"GDMgr.exe" = "%System%\GDSys\gdmgr.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove GDH.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\gdsys\gdmgr.exe

GDMgr.exe is a Spyware.GuardMon.
GDMgr.exe monitors user Internet activity.
Related files:
%System%\gsp.dll
%System%\GDSys\GDMgr.exe
%System%\GDSys\GDH.dll
%System%\GDSys\GDAdmin.exe
%System%\GDSys\dXTList.dll
%System%\GDSys\ExCalendar.dll
%System%\GDSys\eztoolslib.dll
%System%\GDSys\instlsp.exe
%System%\GDSys\strace.dll
%System%\GDSys\vbalFlBr6.dll
Adds the value:
"GDMgr.exe" = "%System%\GDSys\gdmgr.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill GDMgr.exe process and remove GDMgr.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\gdsys\instlsp.exe

instlsp.exe is a Spyware.GuardMon.
instlsp.exe monitors user Internet activity.
Related files:
%System%\gsp.dll
%System%\GDSys\GDMgr.exe
%System%\GDSys\GDH.dll
%System%\GDSys\GDAdmin.exe
%System%\GDSys\dXTList.dll
%System%\GDSys\ExCalendar.dll
%System%\GDSys\eztoolslib.dll
%System%\GDSys\instlsp.exe
%System%\GDSys\strace.dll
%System%\GDSys\vbalFlBr6.dll
Adds the value:
"GDMgr.exe" = "%System%\GDSys\gdmgr.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill instlsp.exe process and remove instlsp.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\gdsys\strace.dll

Strace.dll is a Spyware.GuardMon.
Strace.dll monitors user Internet activity.
Related files:
%System%\gsp.dll
%System%\GDSys\GDMgr.exe
%System%\GDSys\GDH.dll
%System%\GDSys\GDAdmin.exe
%System%\GDSys\dXTList.dll
%System%\GDSys\ExCalendar.dll
%System%\GDSys\eztoolslib.dll
%System%\GDSys\instlsp.exe
%System%\GDSys\strace.dll
%System%\GDSys\vbalFlBr6.dll
Adds the value:
"GDMgr.exe" = "%System%\GDSys\gdmgr.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove strace.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\gdsys\vbalflbr6.dll

vbalFlBr6.dll is a Spyware.GuardMon.
vbalFlBr6.dll monitors user Internet activity.
Related files:
%System%\gsp.dll
%System%\GDSys\GDMgr.exe
%System%\GDSys\GDH.dll
%System%\GDSys\GDAdmin.exe
%System%\GDSys\dXTList.dll
%System%\GDSys\ExCalendar.dll
%System%\GDSys\eztoolslib.dll
%System%\GDSys\instlsp.exe
%System%\GDSys\strace.dll
%System%\GDSys\vbalFlBr6.dll
Adds the value:
"GDMgr.exe" = "%System%\GDSys\gdmgr.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove vbalFlBr6.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\geeby.dll

%SysDir%\geeby.dll is Trojan/Backdoor.
Remove %SysDir%\geeby.dll from Windows startup using RegRun.
www.regrun.com

%sysdir%\gld.dll

gld.dll is a Backdoor.Zagaban.
gld.dll spreads via open network shares.
Related files:
%System%\gld.exe
%System%\gld.dll
%System%\hosts.dll
%System%\socks.dll
Adds the value:
"Shell" = "explorer.exe %System%\gld.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove gld.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\gld.exe

gld.exe is a Backdoor.Zagaban.
gld.exe spreads via open network shares.
Related files:
%System%\gld.exe
%System%\gld.dll
%System%\hosts.dll
%System%\socks.dll
Adds the value:
"Shell" = "explorer.exe %System%\gld.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill gld.exe process and remove gld.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\globalc.dll

globalc.dll is a Trojan.NtRootK-J.
globalc.dll opens a back door.
globalc.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\RtKit\rtkit.exe
%System%\RtKit\globalc.dll
%System%\RtKit\npf.sys
%System%\RtKit\rtkit.log
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove globalc.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\goidr.exe

Goidr.exe is a Spyware.Goidr.
Goidr.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Sysem%\goidr.exe
Adds the value:
"goidr"="%Sysem%\goidr.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill goidr.exe process and remove goidr.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\gomex.exe

gomex.exe is a worm W32.Sdranck-X.
gomex.exe opens a back door.
gomex.exe spreads via open network shares.
Related files:
%System%\gomex.exe
%System%\nexom.exe
%System%\secarik.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill gomex.exe process and remove gomex.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\google.exe

google.exe is a Trojan W32.Rbot-AMW.
google.exe opens a back door.
google.exe spreads via open network shares.
Related files:
%System%\google.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill google.exe process and remove google.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\googlebar.dll

%SysDir%\googlebar.dll is Trojan.Caiijing.
Related files:
%UserProfile%\Local Settings\Temp\[RANDOM]\s1.exe
%Windir%\Help\windowapi.cnt
%System%\googlebar.dll
%System%\drivers\tdac.sys
Read more: http://www.symantec.com/enterprise/secur...
Kill the file %SysDir%\googlebar.dll and remove %SysDir%\googlebar.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\goot.exe

goot.exe is a Trojan.Bifrose-C.
goot.exe opens a back door.
Related files:
%System%\goot.exe
%System%\god.sys
%System%\ranx.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill goot.exe process and remove goot.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\gorsys32.dll

gorsys32.dll is a Trojan.Gorgs-B.
gorsys32.dll records keystrokes.
Related files:
%System%\gorsys32.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove gorsys32.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\grplscd.exe

grplscd.exe is a Trojan W32.Rbot-AXV.
grplscd.exe opens a back door on IRC channels.
grplscd.exe spreads via open network shares.
Related files:
%System%\grplscd.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill grplscd.exe process and remove grplscd.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\gsp.dll

gsp.dll is a Spyware.GuardMon.
gsp.dll monitors user Internet activity.
Related files:
%System%\gsp.dll
%System%\GDSys\GDMgr.exe
%System%\GDSys\GDH.dll
%System%\GDSys\GDAdmin.exe
%System%\GDSys\dXTList.dll
%System%\GDSys\ExCalendar.dll
%System%\GDSys\eztoolslib.dll
%System%\GDSys\instlsp.exe
%System%\GDSys\strace.dll
%System%\GDSys\vbalFlBr6.dll
Adds the value:
"GDMgr.exe" = "%System%\GDSys\gdmgr.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove gsp.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\gtrack.dll

gtrack.dll is a Trojan.Agent-IG.
gtrack.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\gtrack.dll
%System%\kaboom.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove gtrack.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\guisetup.exe

guisetup.exe is a Trojan PWSteal.Tarno.U.
guisetup.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\guisetup.exe
%Windir%\suhoy112.exe
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill the process guisetup.exe and remove guisetup.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\gunist.exe

%sysdir%\gvjpeg32.dll

GVJPEG32.DLL is a Spyware.WebPI.
GVJPEG32.DLL logs keystrokes and captures screenshots.
Related files:
%System%\GVJPEG32.DLL
%System%\sftmouse.dll
%Windir%\wssys\ks.exe
%Windir%\wssys\mc.exe
%Windir%\wssys\WPIUnst.exe
%Windir%\wssys\wssys.exe
Adds the value:
"wssys" = "%Windir%\wssys\wssys.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove GVJPEG32.DLL from Windows startup using RegRun Startup Optimizer.

%sysdir%\h3.exe

h3.exe is a mass-mailing worm W32.Mytob.EQ@mm.
h3.exe tries to terminate antiviral programs installed on a user computer.
h3.exe opens a back door on TCP port 3030.
Related files:
%System%\h3.exe
Adds the value:
"WINDOWS SYSTEM Cleaner" = "h3.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill h3.exe process and remove h3.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\hachimitsu-lemon.exe

Hachimitsu-lemon.exe is a Trojan.Hachilem.
Hachimitsu-lemon.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\hachimitsu-lemon.exe
Adds the value:
"hachimitsu-lemon" = "hachimitsu-lemon.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill hachimitsu-lemon.exe process and remove hachimitsu-lemon.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\hacker.exe

Hacker.exe is a Trojan.PcClient-V.
Hacker.exe opens a back door.
Related files:
%System%\Hacker.exe
%System%\Hacker.asf
%System%\Hacker.dfg
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill Hacker.exe process and remove Hacker.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\hbguard.exe

HbGuard.exe is an adware program Adware.Hotbar.
HbGuard.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Windir%\Downloaded Program Files\HbInstIE.dll
%System%\HbGuard.exe
hotbar.exe
HBCORESRV.DLL
HBINST.EXE
HbToolbar.dll
HBHOSTOE.DLL
HBHOSTOL.DLL
HBHOSTIE.DLL
HBSRV.EXE
ShprRprt.exe
ShprRpt.dll.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill HbGuard.exe process and remove HbGuard.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\hbmail.exe

hbmail.exe is a mass-mailing worm W32.Mytob.FW@mm.
hbmail.exe opens a back door on TCP port 6667.
hbmail.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\hbmail.exe
Adds the value:
"WINDOWS SYSTEM DNSPOOL" = "hbmail.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill hbmail.exe process and remove hbmail.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\hd32.dll

hd32.dll is rootkit Trojan.Hidd-A.
hd32.dll is used to hide files, processes and registry.
hd32.dll is a user mode rootkit.
Related files:
%SysDir%\hd32.dll
Adds the value:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
path to Trojan
to the Windows startup registry keys.
Added to registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Hd
More info: http://www.sophos.com/virusinfo/analyses...

%sysdir%\hdcontroller.exe

hdcontroller.exe is a worm W32.Kiman.B.
hdcontroller.exe opens a back door.
hdcontroller.exe spreads via open network shares.
hdcontroller.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\hdcontroller.exe
Adds the value:
"Hard drive Controller" = "hdcontroller.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill the process hdcontroller.exe and remove hdcontroller.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\hdi.exe

Hdi.exe is Trojan/Backdoor.
Kill the process hdi.exe and remove hdi.exe from Windows startup.

%sysdir%\hdkp5b.exe

hdkp5b.exe is a Trojan.ExeBund-C.
hdkp5b.exe opens a back door.
Related files:
%System%\bundle.ini
%System%\empty
%System%\I-Worm.Badtrans.pif
%System%\I-Worm.BadtransII.pif
%System%\hdkp5b.exe
%System%\msblast.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill hdkp5b.exe process and remove hdkp5b.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\help.exe

help.exe is a Trojan.Startpage.Q.
help.exe changes the Internet Explorer home page.
Related files:
%Windir%\SonudMan.exe
%System%\help.exe
Adds the value:
"SonudMan" = "Windir%\SonudMan.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill help.exe process and remove help.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\helpersvchostss.exe

helpersvchostss.exe is a Trojan.Agent-HZ.
helpersvchostss.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\svchostss.exe
%System%\helpersvchostss.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill helpersvchostss.exe process and remove helpersvchostss.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\heomstool.exe

heomstool.exe is a Trojan.Heoms.
heomstool.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\heomstool.exe
%System%\dvdsdtl.dll
%System%\vddsdls.dat
%System%\vddsdls.inf
%System%\otdal.ico
%System%\vddsdls\dvdsdtl.dll
%System%\vddsdls\vddsdls.dat
Adds the value:
"heomstool" = "C:\Windows\System32\heomstool.exe COPY"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill heomstool.exe process and remove heomstool.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\hg1dll.dll

hg1dll.dll is a Trojan.Hangame-H.
hg1dll.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\hg1dll.dll
%System%\spoo1sv.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove hg1dll.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\hgakheg.dll

hgakheg.dll is a Trojan.PPdoor-Q.
hgakheg.dll opens a back door.
hgakheg.dll tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\dpnetmsg.exe
%System%\iueninet.dll
%System%\fsmgntfs.dll
%System%\ntmapast.dll
%System%\ir50psrv.exe
%System%\kbd1uery.dll
%System%\lfyockaa.dll
%System%\a15svcs.exe
%System%\dpnmdlib.exe
%System%\c_28usic.dll
%System%\atiysnpn.dll
%System%\treemqoa.dll
%System%\arptutdn.dll
%System%\eulapart.dll
%System%\smlo8thk.exe
%System%\odbcfwci.ime
%System%\hgakheg.dll
%System%\jkwbhew.dll
%System%\testtest.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove hgakheg.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\hgqhp.exe

hgqhp.exe is a Trojan.DNSChan-K.
hgqhp.exe opens a back door.
Related files:
%System%\hgqhp.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill hgqhp.exe process and remove hgqhp.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\hhn11n1g.exe

HHN11N1G.EXE is Trojan/Backdoor.
Kill the process HHN11N1G.EXE and remove HHN11N1G.EXE from Windows startup.

%sysdir%\hicom.exe

Hicom.exe is a Trojan.Chimo.A.
Hicom.exe relay spam.
Hicom.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\hicom.exe
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill hicom.exe process and remove hicom.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\hid.exe

Hid.exe is a Trojan Backdoor.IRC.Ratsou.B.
Hid.exe spreads via open network shares.
Related files:
C:\Note.exe
%System%\Hid.exe
%System%\Explorer.dll
%System%\Iexplore.dll
%Windir%\Aim.dll
%Windir%\Boot.exe
%Windir%\C.dll
%Windir%\Crazy.exe
%Windir%\Dr.exe
%Windir%\Empavms.exe
%Windir%\Ipservers.dll
%Windir%\Java.dll
%Windir%\LibParse.exe
%Windir%\Lsass.exe
%Windir%\Miconfig.exe
%Windir%\Moo.dll
%Windir%\Msccl.dll
%Windir%\Msconig.exe
%Windir%\Nhtml.dll
%Windir%\Ratsou.exe
%Windir%\Regedit.dll
%Windir%\Restart.exe
%Windir%\Screen.dll
%Windir%\Sysboot.dll
%Windir%\Syste32.dll
%Windir%\Users.dll
%Windir%\Wind.dll
Adds the value:
"HID.EXE"="%System%\HID.EXE"
"lsass"="%Windir%\Debug\UserMode\lsass.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill Hid.exe process and remove Hid.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\hkernel32.exe

HKernel32.exe is a mass-mailing worm W32.Fourseman.B@mm.
HKernel32.exe spreads by e-mail, mIRC and via open network shares.
Related files:
%Windir%\Explorer.exe.
%System%\MythKernel32.exe
%System%\HKernel32.exe
Adds the value:
"HKernel32" = "%System%\HKernel32.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill HKernel32.exe process and remove HKernel32.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\hldrrr.exe

%SysDir%\hldrrr.exe is Trojan.Tooso.R.
The Trojan arrives as a spammed email attachment with the following name:
16-06-2006.exe
Read more: http://securityresponse.symantec.com/avc...
Kill the process %SysDir%\hldrrr.exe and remove %SysDir%\hldrrr.exe from Windows startup using RegRun.
www.regrun.com

%sysdir%\hleader_dll.dll

hleader_dll.dll is a Trojan.Lodear.
hleader_dll.dll attempts to download remote files.
Related files:
%System%\hloader_exe.exe
%System%\hleader_dll.dll
Adds the value:
"auto__hloader__key" = "%System%\hloader_exe.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove hleader_dll.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\hloader_exe.exe

hloader_exe.exe is a Trojan.Lodear.
hloader_exe.exe attempts to download remote files.
Related files:
%System%\hloader_exe.exe
%System%\hleader_dll.dll
Adds the value:
"auto__hloader__key" = "%System%\hloader_exe.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill hloader_exe.exe process and remove hloader_exe.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\holewatch.exe

holewatch.exe is worm W32.Sdranck-S.
holewatch.exe spreads via open network shares.
Related files:
%SYSTEM32%\watchole.exe
%SYSTEM32%\holewatch.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill holewatch.exe process and remove holewatch.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\hookdump.exe

Hookdump.exe is an adware program Adware.Topantispyware.
Hookdump.exe displays advertisements.
Related files:
%System%\hookdump.exe
%System%\runsrv32.exe
%System%\srpcsrv32.dll
%System%\runsrv32.dll
%System%\txfdb32.dll
%System%\r.exe
Adds the value:
"Srv32 spool service" = "%Windir%\System32\runsrv32.exe"
"Intel system tool" = "%System%\hookdump.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill hookdump.exe process and remove hookdump.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\hookreg.dll

hookreg.dll is a Trojan.Horst-C.
hookreg.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\hookreg.dll
%System%\ks.dll
%System%\wsock32.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove hookreg.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\hosts.dll

hosts.dll is a Backdoor.Zagaban.
hosts.dll spreads via open network shares.
Related files:
%System%\gld.exe
%System%\gld.dll
%System%\hosts.dll
%System%\socks.dll
Adds the value:
"Shell" = "explorer.exe %System%\gld.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove hosts.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\hostsvc.exe

HostSVC.exe is a worm W32.Rbot-ANZ.
HostSVC.exe spreads via open network shares.
HostSVC.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\HostSVC.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill HostSVC.exe process and remove HostSVC.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\howiper.exe

%SysDir%\howiper.exe is Trojan.Qhost.df.
Kill the process %SysDir%\howiper.exe and remove %SysDir%\howiper.exe from Windows startup using RegRun.

%sysdir%\hp91ae.tmp

%SysDir%\HP91AE.TMP is Trojan/Backdoor.
Kill the file HP91AE.TMP and remove HP91AE.TMP from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\hpdll.exe

%sysdir%\hpdriver.sys

hpdriver.sys is rootkit W32/Tilebot-FC.
hpdriver.sys opens a back door on IRC channels.
hpdriver.sys is used to hide files, processes and registry.
hpdriver.sys is a kernel mode rootkit.
Rootkit contacts remote hacker server using HTTP session.
Related files:
%WinDir%\cpanelx.exe
%SysDir%\hpdriver.sys
cpanelx.exe is created new system driver:
service name: "Microsoft Control Panel"
display name: "cpanelx"
Adds the value:
HKLM\SYSTEM\CurrentControlSet\Services\Microsoft Control Panel\
to the Windows startup registry keys.

hpdriver.sys is created new system driver:
service name: " hpdriver"
display name: " hpdriver"
Added to registry:
HKLM\SYSTEM\CurrentControlSet\Services\hpdriver\

HKLM\SYSTEM\CurrentControlSet\Services\Messenger
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\RemoteRegistry
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\TlntSvr
Start
4

HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
DoNotAllowXPSP2
1

HKLM\SOFTWARE\Microsoft\Ole
EnableDCOM
N

HKLM\SYSTEM\CurrentControlSet\Control\Lsa
restrictanonymous
1

HKLM\SOFTWARE\Microsoft\Security Center\
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\

More info: http://www.sophos.com/virusinfo/analyses...

%sysdir%\hpmanager.exe

hpmanager.exe is a mass-mailing worm W32.Mytob.KE@mm.
hpmanager.exe opens a back door on TCP port 27999.
hpmanager.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\hpmanager.exe
Adds the value:
"Hewlett Packard Manager" = "hpmanager.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill hpmanager.exe process and remove hpmanager.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\hpsebc087.exe

hpsebc087.exe is rootkit W32/Sdbot-WA.
hpsebc087.exe is used to hide files, processes and registry.
hpsebc087.exe is a kernel mode rootkit.
Rootkit contacts remote hacker server via the IRC network.
hpsebc087.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%SysDir%\hpsebc087.exe
%SysDir%\msdirectx.sys
Adds the value:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
IPOT USB Service DRIVER
hpsebc087.exe

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\
IPOT USB Service DRIVER
hpsebc087.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\
IPOT USB Service DRIVER
hpsebc087.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices\
IPOT USB Service DRIVER
hpsebc087.exe
to the Windows startup registry keys.
More info: http://www.sophos.com/virusinfo/analyses...

%sysdir%\hpsys.exe

hpsys.exe is a Trojan W32.Codbot-AF .
hpsys.exe opens a back door on IRC channels.
hpsys.exe spreads via open network shares.
Related files:
%System%\hpsys.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill hpsys.exe process and remove hpsys.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\hr6s05j7e.dll

%SysDir%\hr6s05j7e.dll is Trojan/Backdoor.
Kill the file %SysDir%\hr6s05j7e.dll and remove %SysDir%\hr6s05j7e.dll from Windows startup using RegRun.
www.regrun.com

%sysdir%\huy.exe

huy.exe is worm W32.Blaster-L.
huy.exe opens a back door.
huy.exe spreads via open network shares.
Related files:
%System%\huy.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill huy.exe process and remove huy.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\huy2.exe

huy2.exe is worm W32.Blaster-L.
huy2.exe opens a back door.
huy2.exe spreads via open network shares.
Related files:
%System%\huy2.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill huy2.exe process and remove huy2.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\huysosat.exe

huysosat.exe is a Trojan.Mdrop-RG.
huysosat.exe opens a back door.
Related files:
%Windows%\huysosat.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill huysosat.exe process and remove huysosat.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\hwdetect.exe

hwdetect.exe is a Trojan.MancSyn-B.
hwdetect.exe opens a back door.
Related files:
%Startup%\office.exe
%System%\hwdetect.exe
%System%\walib32.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill hwdetect.exe process and remove hwdetect.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\hxdefdrv.sys

hxdefdrv.sys is rootkit Trojan.HacDef-DR.
hxdefdrv.sys is used to hide files, processes and registry.
hxdefdrv.sys is a kernel mode rootkit.
hxdefdrv.sys opens a back door.
Related files:
%SysDir%\hxdefdrv.sys
%SysDir%\r_server.exe

hxdefdrv.sys is created new system drivers:
service name: "winntbaken"
display name: "ROME ROTYUS"
Added to registry:
HKLM\SYSTEM\CurrentControlSet\Services\winntbaken\
Adds the value:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
r_server
%SysDir%\r_server.exe
to the Windows startup registry keys.
More info: http://www.sophos.com/security/analyses/...

%sysdir%\i386p.sys

i386p.sys is rootkit Spam-Mailbot!RootKit.
i386p.sys opens a back door on IRC channels.
i386p.sys spreads by e-mail and via open network shares.
i386p.sys is used to hide files, processes, registry and network connections.
i386p.sys is a kernel mode rootkit.
Rootkit creates new system driver:
service name: "i386p".
Related files:
%SysDir%\drivers\i386p.sys
%SysDir%\drivers\a00xxxxx.sys
Added to registry:
hkey_local_machine\system\currentcontrolset\services\i386p
hkey_local_machine\system\currentcontrolset\services\i386p
\imagepath="%WINDIR% \System32\drivers\i386p.sys"
More info: http://ca.mcafee.com/virusInfo/default.a...

%sysdir%\i75-d2\dkernel.exe

dkernel.exe is a worm W32.Decoy-A.
dkernel.exe opens a back door.
Related files:
%System%\I75-D2\dkernel.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill dkernel.exe process and remove dkernel.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\icntrl.exe

icntrl.exe is Trojan/Backdoor.
Kill the process icntrl.exe and remove icntrl.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\icq2002.exe

icq2002.exe is a Trojan W32.Sdbot-ABL.
icq2002.exe opens a back door on IRC channels.
icq2002.exe spreads via open network shares.
Related files:
%System%\icq2002.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill icq2002.exe process and remove icq2002.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\icqchk.exe

%SysDir%\icqchk.exe is Trojan/Backdoor.
Kill the process %SysDir%\icqchk.exe and remove %SysDir%\icqchk.exe from Windows startup.

%sysdir%\idemlog.exe

idemlog.exe is a Trojan.AdClick-BM.
idemlog.exe opens a back door.
idemlog.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\idemlog.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill idemlog.exe process and remove idemlog.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\ieaccess2.dll

%SysDir%\IEAccess2.dll is Dialer.IEDisco.
Kill the file %SysDir%\IEAccess2.dll and remove %SysDir%\IEAccess2.dll from Windows startup using RegRun.
www.regrun.com
Read more: http://www.symantec.com/avcenter/venc/da...

%sysdir%\iedld32.dll

iedld32.dll is a Trojan.Hiddl-B.
iedld32.dll downloads and executes files.
Related files:
WIN32HOST.EXE
%System%\SVSHOTC.EXE
%System%\iedld32.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove iedld32.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\ieen445f8764.dll

ieen445F8764.dll is rootkit Trojan.Opnis-D.
ieen445F8764.dll is used to hide files, processes and registry.
ieen445F8764.dll is a kernel mode rootkit.
Rootkit contacts remote hacker server using HTTP session.
Rootkit injects itself into other process.
ieen445F8764.dll tries to terminate antiviral programs installed on a user computer.
ieen445F8764.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Temp%/~dr?.tmp
%SysDir%\ieen445F8764.dll
%SysDir%\ntms445F8764.dll
%SysDir%\olea445F8764.exe
%SysDir%\plgwiz32.dll
%SysDir%\usrs445F8764.dll
Added to registry:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\plgwiz32

HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_\

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
AppInit_DLLs
"ieen445F8764.dll usrs445F8764.dll"
More info: http://www.sophos.com/virusinfo/analyses...

%sysdir%\iehelperex.dll

IeHelperEx.dll is Trojan/Backdoor.
Remove IeHelperEx.dll using RegRun "Scan for Viruses" feature.
http://www.regrun.com

%sysdir%\iejava.exe

iejava.exe is a Trojan.Agent-HD.
iejava.exe opens a back door.
Related files:
%System%\iejava.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill iejava.exe process and remove iejava.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\ieredir.exe

%SysDir%\ieredir.exe is Trojan/Backdoor.
Kill the process ieredir.exe and remove ieredir.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\ies4dll.dll

IES4DLL.DLL is a Trojan.Goldun.G.
IES4DLL.DLL monitors user Internet activity and bank information.
It sends stolen data to a hacker site.
Related files:
%System%\IES4SERVICE.SYS
%System%\IES4DLL.DLL
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove IES4DLL.DLL from Windows startup using RegRun Startup Optimizer.

%sysdir%\ies4service.sys

ies4service.sys is rootkit Trojan.Goldax-C.
ies4service.sys is used to hide files, processes and registry.
ies4service.sys is a kernel mode rootkit.
ies4service.sys tries to terminate antiviral programs installed on a user computer.
ies4service.sys monitors user Internet activity and bank information.
It sends stolen data to a hacker site.
Related files:
%SysDir%\ies4dll.dll
%SysDir%\ies4service.sys

ies4service.sys is created new system drivers:
service name: " ies4service"
display name: "LOGON support service"
Added to registry:
HKLM\SYSTEM\CurrentControlSet\Services\ies4service\

Adds the value:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ies4dll
DllName
ies4dll.dll

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ies4dll
Startup
ies4dll

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ies4dll
Impersonate
1
to the Windows startup registry keys.
More info: http://www.sophos.com/security/analyses/...

%sysdir%\iesdl4l.dll

iesdl4l.dll is a Trojan.Haxdoor-AQ.
iesdl4l.dll opens a back door.
Related files:
%System%\iesdl4l.dll
%System%\iesservice4.sys
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove iesdl4l.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\iespr.sys

iespr.sys is rootkit Trojan.Haxdoor-M.
iespr.sys is used to hide files, processes and registry.
iespr.sys is a kernel mode rootkit.
Rootkit contacts remote hacker server using HTTP session.
iespr.sys created new system drivers:
service name: "iespr"
display name: "KeIE"
Related files:
%SysDir%\iespr.sys
More info: http://www.sophos.com/security/analyses/...

%sysdir%\iewatch.exe

iewatch.exe is a Trojan.Agent-FV.
iewatch.exe downloads code from the internet.
Related files:
%System%\iewatch.exe
%System%\kaboom.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill iewatch.exe process and remove iewatch.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\iexplor.dll

iexplor.dll is a mass-mailing worm W32.Netsky.AL@mm.
iexplor.dll tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\lsasrv.exe
%System%\iexplor.dll
%System%\shlapiw.dll
%System%\hserv.sys
Adds the value:
"lsass" = "%System%\lsasrv.exe"
"shell" = "explorer.exe %System%\lsasrv.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove iexplor.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\iexplor.exe

Mass mailing worm W32.Blatic.
Adds the value:
"shell" = "explorer.exe iexplor.exe"
of the registry subkey:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon to start at Windows startup.
Opens a back door through TCP port 6667.

%sysdir%\iexplor2.dll

iexplor2.dll is a mass-mailing worm W32.Tame-C.
iexplor2.dll tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\lsa2srv.exe
%System%\service.exe
%System%\sysmng.exe
%System%\systm.exe
%System%\hserv.sys
%System%\iexplor.dll
%System%\iexplor2.dll
%System%\netdx.dat
%System%\version.ini
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove iexplor2.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\iexplore.dll

Iexplore.dll is a Trojan Backdoor.IRC.Ratsou.B.
Iexplore.dll spreads via open network shares.
Related files:
C:\Note.exe
%System%\Hid.exe
%System%\Explorer.dll
%System%\Iexplore.dll
%Windir%\Aim.dll
%Windir%\Boot.exe
%Windir%\C.dll
%Windir%\Crazy.exe
%Windir%\Dr.exe
%Windir%\Empavms.exe
%Windir%\Ipservers.dll
%Windir%\Java.dll
%Windir%\LibParse.exe
%Windir%\Lsass.exe
%Windir%\Miconfig.exe
%Windir%\Moo.dll
%Windir%\Msccl.dll
%Windir%\Msconig.exe
%Windir%\Nhtml.dll
%Windir%\Ratsou.exe
%Windir%\Regedit.dll
%Windir%\Restart.exe
%Windir%\Screen.dll
%Windir%\Sysboot.dll
%Windir%\Syste32.dll
%Windir%\Users.dll
%Windir%\Wind.dll
Adds the value:
"HID.EXE"="%System%\HID.EXE"
"lsass"="%Windir%\Debug\UserMode\lsass.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove Iexplore.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\iexplore.exe

iexplore.exe is a mass-mailing worm W32.Mytob.ET@mm.
iexplore.exe tries to terminate antiviral programs installed on a user computer.
iexplore.exe opens a back door on TCP port 3030.
Related files:
%System%\iexplore.exe
Adds the value:
"WINDOWS SYSTEM CLEANER" = "\iexplore.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill iexplore.exe process and remove iexplore.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\ign32.pif

ign32.pif is rootkit W32/Rbot-ASB.
ign32.pif is used to hide files, processes and registry.
ign32.pif is a user mode rootkit.
ign32.pif opens a back door via IRC channels.
Related files:
%SysDir%\ign32.pif
Adds the value:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
MS WINS Binary
IGN32.pif

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
MS WINS Binary
IGN32.pif

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
MS WINS Binary
IGN32.pif
to the Windows startup registry keys.
Added to registry:
HKLM\SOFTWARE\Microsoft\Ole
EnableDCOM
N

HKLM\SYSTEM\CurrentControlSet\Control\Lsa
restrictanonymous
1
More info: http://www.sophos.com/virusinfo/analyses...

%sysdir%\ihsvc.exe

%SysDir%\IHSVC.EXE is Trojan/Backdoor Win32.Rbot.DXV .
Kill the process %SysDir%\IHSVC.EXE and remove %SysDir%\IHSVC.EXE from Windows startup.
http://www3.ca.com/securityadvisor/virus...

%sysdir%\iisload.dll

iisload.dll is a Trojan.Danmec-B.
iisload.dll opens a back door.
iisload.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\checkreg.exe
%System%\iisload.dll
%System%\s32l.txt
%System%\ws386l.ini
%System%\wsl22764.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove iisload.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\im_2.exe

im_2.exe is a Trojan.BagleDl-BH.
im_2.exe opens a back door.
Related files:
%System%\im_2.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill im_2.exe process and remove im_2.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\imevtmgr.exe

IMEvtMgr.exe is a Trojan.Keylog-AR.
IMEvtMgr.exe records keystrokes.
Related files:
%System%\IMEvtMgr.exe
%System%\khook.dll
%System%\mhook.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill IMEvtMgr.exe process and remove IMEvtMgr.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\imgcom.dll

imgcom.dll is a Trojan.Agent-FN.
imgcom.dll opens a back door.
Related files:
%System%\ntdsapp.dll
%System%\stivc.exe
%System%\delttsul.exe
%System%\imgcom.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove imgcom.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\imms16.dll

IMMS16.DLL is a Trojan.Sharp-F.
IMMS16.DLL opens a back door.
Related files:
%System%\IMMS16.DLL
%System%\MCIOLES16.DLL
%System%\COMAPI.DLL
%System%\EULSASS.DLL
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove IMMS16.DLL from Windows startup using RegRun Startup Optimizer.

%sysdir%\impai.exe

impai.exe is a Trojan.Lewor-Q.
impai.exe opens a back door.
Related files:
%System%\impai.exe
%System%\wnilogon.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill impai.exe process and remove impai.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\imupdate.exe

imupdate.exe is Trojan/Backdoor.
Kill the process imupdate.exe and remove imupdate.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\inetapi32.dll

inetapi32.dll is a Trojan.GWGhost-BA.
inetapi32.dll opens a back door.
inetapi32.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\msisexec.exe
%System%\inetapi32.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove inetapi32.dll using RegRun "Scan for Viruses" feature.
http://www.regrun.com

%sysdir%\inetconnect.dll

Inetconnect.dll is an adware program Adware.Affilred.
Inetconnect.dll monitors user Internet activity.
Related files:
usbwin32.exe
C:\CriticalUpdate.exe
C:\cab.exe
C:\winsecure.exe
%Windir%\twain_32.exe
%Windir%\mshotfix.exe
%Windir%\msupdate.exe
%System%\security32.exe
%System%\iProtect.exe
%System%\axe.exe
%System%\inetconnect.dll
%System%\comnt32.dll.
Adds the value:
"MSUpdate" = "c:\criticalUpdate.exe"
"Microsoft Security Hot Fix Update" = "%SystemRoot%\mshotfix.exe"
"Microsoft Cab Manager" = "c:\exec.exe"
"Windows Security Manager" = "c:\winsecure.exe"
"Windows Security Update" = "%Windir%\security32.exe"
"Userinit" = "%System%\userinit.exe, %Windir%\iProtect.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove inetconnect.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\inetfuel.exe

InetFuel.exe is a Spyware.Look2Me.
InetFuel.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Temp%nsdtmp09.dll
%Program Files%\Recommended Hotfix - 421701D\v15\RH.DLL
%Program Files%\Recommended Hotfix - 421701D\v15\RH.exe
%Program Files%\SED\SE.exe
%Program Files%\SED\SED.exe
%Windir%\system\UpdInstall.exe
%System%\InetFuel.exe
%System%\[random file name].dll
Adds the value:
"SESync" = "%Program Files%\SED\SED.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill InetFuel.exe process and remove InetFuel.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\inetlog.dll

Inetlog.dll is a Spyware.AllInOne.
Inetlog.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
allinonespy.exe
inject.dll
run.exe
runwin95.exe
%System%\applog.dll
%System%\inetlog.dll
%System%\keylogger.dll
%System%\log.dll
%System%\remotelog.dll
%System%\screenlog.dll
%System%\soundlog.dll
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove inetlog.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\inetsxa.dll

inetsxa.dll is a Trojan.Rumale-D.
inetsxa.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\srvexc.exe
%System%\inetsxa.dll
%System%\reshl32.lib
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove inetsxa.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\informe.exe

Informe.exe is a virus W32.Vig.C.
Related files:
C:\WIN2KP\System32\WinNT.exe
D:\WIN2KP\System32\WinNT.exe
C:\WINDOWS\SYSTEM\WinNT.exe
D:\WINDOWS\SYSTEM\WinNT.exe
C:\WINDOWS\System32\WinNT.exe
D:\WINDOWS\System32\WinNT.exe
C:\WINNTT\System32\Informe.exe
D:\WINNTT\System32\Informe.exe
A:\informe.exe
Adds the value:
"Symantec" = "C:\WINNTT\System32\Informe.exe"
"NVagent" = "D:\WINNTT\System32\Informe.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill Informe.exe process and remove Informe.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\initsvc.exe

initsvc.exe is a Trojan W32.Rbot-BWT.
initsvc.exe opens a back door on IRC channels.
initsvc.exe spreads via open network shares.
Related files:
%System%\initsvc.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill initsvc.exe process and remove initsvc.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\injg.exe

%SysDir%\injg.exe is Trojan/Backdoor.
Kill the process injg.exe and remove injg.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\injobs.exe

injobs.exe is a Trojan.Binjo.
injobs.exe registers porn service without notification.
injobs.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Windir%\injobw.exe
%System%\injobs.exe
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill injobs.exe process and remove injobs.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\inks.exe

%SysDir%\inks.exe is Trojan/Backdoor.
Kill the process %SysDir%\inks.exe and remove %SysDir%\inks.exe from Windows startup.
http://securityresponse.symantec.com/avc...

%sysdir%\inotify.exe

inotify.exe is a Spyware.iProtectYou.
inotify.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\inotify.exe
%System%\iPY.exe
%System%\ipsp.dll
%System%\iprun.exe
Adds the value:
"iprun" = ""%System%\iPY.exe" -h"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill inotify.exe process and remove inotify.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\installer2.exe

installer2.exe is an adware program Adware.BlazeFind.
installer2.exe is a Browser Helper Object.
installer2.exe downloads and displays advertisements.
Related files:
%System%\2_0_1browserhelper2.dll
%System%\UnstSA2.exe
%System%\key2.txt
%System%\installer2.exe
%System%\Omniscienthook.dll
%System%\omniband.dll
%System%\wsaupdater.exe
Adds the value:
"Windows SA" = "[path to the adware program]"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill installer2.exe process and remove installer2.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\installerv3.exe

InstallerV3.exe is a Spyware.SafeSurfing.
InstallerV3.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Windir%\asbltzun.exe
%Windir%\netsync.exe
%Windir%\rsyncmon.dll
%Windir%\ISSM0064.DAT
%System%\COMMCOS2.DLL
%System%\InstallerV3.exe
%System%\regsync.exe
%System%\richedtr.dll
%System%\richup.exe
%System%\redtrsha.dll
%System%\vbrundll.dll
%System%\VBUninstall.exe
%System%\msxml3a.dll
Adds the value:
"RSync" = "%Windir%\netsync.exe"
"regsync" = "C:\WINDOWS\System32\regsync.exe"
"richup" = "C:\WINDOWS\System32\richup.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill InstallerV3.exe process and remove InstallerV3.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\instsrv.exe

Instsrv.exe is an adware program Adware.BargainBuddy.
Instsrv.exe downloads and displays advertisements.
Related files:
Apuc.dll;
Autoheal.exe
%System%\angelex.exe
%System%\instsrv.exe
%System%\msexreg.exe
%System%\bbchk.exe
%System%\exclean.exe
%System%\exdl.exe
%System%\exdl0.exe
%System%\exdl1.exe
%System%\exul.exe
%System%\msbe.dll
%System%\msxct.exe
%ProgramFiles%\BullsEye Network\bin\adv.exe
%ProgramFiles%\BullsEye Network\bin\adx.exe
%ProgramFiles%\BullsEye Network\bin\bargains.exe
%ProgramFiles%\BullsEye Network\Uninstall.exe
%Windows%\bbchk.exe
%Windows%\exclean.exe
%Windows%\exdl.exe
%Windows%\exul.exe
%Windows%\msbe.dll
%Windows%\msxct.exe
%Windows%\zeta.exe
Adds the value:
"[File name of adware]" = "[File path to adware]"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill instsrv.exe process and remove instsrv.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\intell32.exe

Intell32.exe is a Trojan.Desktophijack.C.
Intell32.exe modifies the desktop settings.
Intell32.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\intell32.exe
%System%\oleext.dll
%System%\oleext32.dll
%System%\wppp.html
%Windir%\uninstIU.exe
Adds the value:
"intell32.exe" = "%System%\intell32.exe"
to the Windows startup registry keys.
More info:
Removal:
Kill intell32.exe process and remove intell32.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\intell321.exe

%SysDir%\intell321.exe is Trojan/Backdoor.
Kill the process intell321.exe and remove intell321.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\intenat.exe

Intenat.exe is a Trojan.Nuclear-J.
Intenat.exe opens a back door.
Related files:
%System%\Intenat.exe
%System%\Notepad.txt
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill Intenat.exe process and remove Intenat.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\interserv.exe

Interserv.exe is Trojan/Backdoor.
Kill the process %SysDir%\interserv.exe and remove %SysDir%\interserv.exe from Windows startup.

%sysdir%\intfaxui.exe

intfaxui.exe is a Spyware.Apropos.
intfaxui.exe is a Browser Helper Object.
intfaxui.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Windir%\Downloaded Program Files\load.exe
%Windir%\Downloaded Program Files\monpop.exe
%Windir%\Downloaded Program Files\pop225.dll
%Windir%\Downloaded Program Files\pophook4.dll
%Windir%\Downloaded Program Files\PopSrv225.exe
%Temp%\auto_update_loader.exe
%Temp%\install_ct.exe
%Temp%\CXtPls.exe
%Temp%\ProxyStub.dll
%Temp%\WinGenerics.dll
%Temp%\ace.dll
%Temp%\atla.dll
%Temp%\atlw.dll
%Temp%\data.bin
%Temp%\libexpat.dll
%Temp%\ph.exe
%Temp%\pm.exe
%Temp%\setup.inf
%Temp%\uninstaller.exe
%Temp%\atl.dll
%System%\atmon.exe
%System%\intfaxui.exe
Adds the value:
"POP" = "C:\WINDOWS\Downloaded Program Files\PopSrv225.exe"
"AutoLoaderEnvoloAutoUpdater" = "auto_update_loader.exe"
"[random name]" = "intfaxui.exe"
"[random name]" = "atmon.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill intfaxui.exe process and remove intfaxui.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\intmon.exe

intmon.exe is a Trojan.Puper-BI.
intmon.exe modifies data on the computer.
Related files:
%System%\hhk.dll
%System%\intmon.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill intmon.exe process and remove intmon.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\intnets.exe

Intnets.exe is a adware program Adware.Adtest.
Intnets.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\intnets.exe
%System%\scridows.exe
%System%\sysinfer.exe
%Windir%\msfiles.exe
Adds the value:
"intnets" = "%System%\intnets.exe"
"sysinfer" = "%System%\sysinfer.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill intnets.exe process and remove intnets.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\inzax.exe

Inzax.exe is a worm W32.Anzae-E.
Inzax.exe spreads by e-mail.
Related files:
%System%\Inzax.exe
%System%\sw.exe
%System%\sx.exe
%System%\sz.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill Inzax.exe process and remove Inzax.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\ipchk.dll

Ipchk.dll is a mass-mailing worm W32.Aprilcone.A@mm.
Ipchk.dll spreads by e-mail.
Related files:
%System%\syscon.exe
%System%\mschk.dll
%System%\Watcher.dll
%System%\sysMon.dll
%System%\syslog.dll
%System%\atchk.dll
%System%\sysmsg.dll
%System%\chkrun.dll
%System%\dskchk.dll
%System%\msevent.dll
%System%\ipchk.dll
%System%\client.dll
%System%\servr.dll
%System%\netchk.dll
%System%\mssys.dll
Adds the value:
"syscon" = "%System%\syscon.exe"
"AppInit_DLLs" = "%System%\Watcher.dll"
to the Windows startup registry keys.

More info: http://securityresponse.symantec.com/avc...
Removal:
Remove ipchk.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\ipconfx.exe

ipconfx.exe is a Trojan.Sharp-M.
ipconfx.exe opens a back door.
Related files:
%System%\ipconfx.exe
%System%\tcpic.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill ipconfx.exe process and remove ipconfx.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\ipdb.dll

Ipdb.dll is a mass-mailing worm W32.Bagz@mm.
Ipdb.dll tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\dl.exe
%System%\syslogin.exe
%System%\jobdb.dll
%System%\ipdb.dll
%System%\wdate.dll
Adds the value:
"syslogin.exe" = "syslogin.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove ipdb.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\ipreg.exe

ipreg.exe is a password-stealing Trojan.Zagaban-H.
ipreg.exe monitors user Internet activity and bank information.
It sends stolen data to a hacker site.
Related files:
%System%\ipreg.exe
%System%\spdr.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill ipreg.exe process and remove ipreg.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\iprotect.exe

iProtect.exe is an adware program Adware.Affilred.
iProtect.exe monitors user Internet activity.
Related files:
usbwin32.exe
C:\CriticalUpdate.exe
C:\cab.exe
C:\winsecure.exe
%Windir%\twain_32.exe
%Windir%\mshotfix.exe
%Windir%\msupdate.exe
%System%\security32.exe
%System%\iProtect.exe
%System%\axe.exe
%System%\inetconnect.dll
%System%\comnt32.dll.
Adds the value:
"MSUpdate" = "c:\criticalUpdate.exe"
"Microsoft Security Hot Fix Update" = "%SystemRoot%\mshotfix.exe"
"Microsoft Cab Manager" = "c:\exec.exe"
"Windows Security Manager" = "c:\winsecure.exe"
"Windows Security Update" = "%Windir%\security32.exe"
"Userinit" = "%System%\userinit.exe, %Windir%\iProtect.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill iProtect.exe process and remove iProtect.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\iprun.exe

iprun.exe is a Spyware.iProtectYou.
iprun.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\inotify.exe
%System%\iPY.exe
%System%\ipsp.dll
%System%\iprun.exe
Adds the value:
"iprun" = ""%System%\iPY.exe" -h"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill iprun.exe process and remove iprun.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\ipsec.dll

Ipsec.dll is a Trojan Backdoor.Fuwudoor.
Ipsec.dll spreads via open network shares.
Related files:
%System%\ipsec.dll
%System%\appmgmt.dll
%System%\browsvr.dll
%System%\trkw.dll
%System%\trks.dll
%System%\kdc.dll
%System%\dmsrv.dll
%System%\mesg.dll
%System%\netlogin.dll
%System%\protstrg.dll
%System%\lmhosts.dll
%System%\w32t.dll
%System%\ntms.dll
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove ipsec.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\ipsec6mon.dll

ipsec6mon.dll is a Trojan.Cimuz-Y.
ipsec6mon.dll tries to terminate antiviral programs installed on a user computer.
ipsec6mon.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\ipsec6mon.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove ipsec6mon.dll using RegRun "Scan for Viruses" feature.
http://www.regrun.com

%sysdir%\ipsp.dll

ipsp.dll is a Spyware.iProtectYou.
ipsp.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\inotify.exe
%System%\iPY.exe
%System%\ipsp.dll
%System%\iprun.exe
Adds the value:
"iprun" = ""%System%\iPY.exe" -h"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove ipsp.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\ipv4mons.dll

%SysDir%\ipv4mons.dll is Trojan/Backdoor.
Remove ipv4mons.dll using RegRun "Scan for Viruses" feature.
http://www.regrun.com

%sysdir%\ipv6mons.dll

%SysDir%\ipv6mons.dll is Trojan/Backdoor.
Kill the file ipv6mons.dll and remove ipv6mons.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\ipwf.exe

ipwf.exe is a Trojan.Dloader-YF.
ipwf.exe opens a back door.
Related files:
%System%\ipwf.exe
%System%\drivers\winut.dat
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill ipwf.exe process and remove ipwf.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\ipy.exe

iPY.exe is a Spyware.iProtectYou.
iPY.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\inotify.exe
%System%\iPY.exe
%System%\ipsp.dll
%System%\iprun.exe
Adds the value:
"iprun" = ""%System%\iPY.exe" -h"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill iPY.exe process and remove iPY.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\ir50psrv.exe

ir50psrv.exe is a Trojan.PPdoor-Q.
ir50psrv.exe opens a back door.
ir50psrv.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\dpnetmsg.exe
%System%\iueninet.dll
%System%\fsmgntfs.dll
%System%\ntmapast.dll
%System%\ir50psrv.exe
%System%\kbd1uery.dll
%System%\lfyockaa.dll
%System%\a15svcs.exe
%System%\dpnmdlib.exe
%System%\c_28usic.dll
%System%\atiysnpn.dll
%System%\treemqoa.dll
%System%\arptutdn.dll
%System%\eulapart.dll
%System%\smlo8thk.exe
%System%\odbcfwci.ime
%System%\hgakheg.dll
%System%\jkwbhew.dll
%System%\testtest.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill ir50psrv.exe process and remove ir50psrv.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\ispsupport.exe

ISPSupport.exe is a mass-mailing worm W32.Mytob.PE@mm.
ISPSupport.exe opens a back door on TCP port 6555.
ISPSupport.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\ISPSupport.exe
Adds the value:
"ISPSystem" = "%System%\ISPSupport.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill the process ISPSupport.exe and remove ISPSupport.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\ist2.exe

ist2.exe is a Trojan.Dropper-BV.
ist2.exe opens a back door.
Related files:
%System%\ist2.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill ist2.exe process and remove ist2.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\isystem.exe

isystem.exe is a Trojan.Chorus-B.
isystem.exe changes settings for Microsoft Internet Explorer.
Related files:
%Windows%\htmlsync.exe
%System%\isystem.exe
%System%\ldriver.exe
%Windows%\zlibc.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill isystem.exe process and remove isystem.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\itstore.dll

itstore.dll is a Trojan.Vipgsm-K.
itstore.dll spreads via open network shares.
itstore.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\mstcpmon.exe
%System%\chkdskw.exe
%System%\itstore.dll
%System%\karnal32.dll
%System%\mslogon.dll
%System%\mswshell.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove itstore.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\itune.exe

itune.exe is a Trojan W32.Rbot-AFK.
itune.exe opens a back door.
itune.exe spreads via open network shares.
itune.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\itune.exe
%System%\win-mang.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill itune.exe process and remove itune.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\itunes.exe

itunes.exe is a Trojan W32.Opanki.D.
itunes.exe opens a back door on IRC channel.
itunes.exe spreads via AOL Instant Messenger.
Related files:
%Windir%\itunes.exe
Adds the value:
"Itunes" = "%Windir%\itunes.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill itunes.exe process and remove itunes.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\itunesff.exe

ITUNESFF.EXE is Trojan/Backdoor.
Kill the process ITUNESFF.EXE and remove ITUNESFF.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\iueninet.dll

iueninet.dll is a Trojan.PPdoor-Q.
iueninet.dll opens a back door.
iueninet.dll tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\dpnetmsg.exe
%System%\iueninet.dll
%System%\fsmgntfs.dll
%System%\ntmapast.dll
%System%\ir50psrv.exe
%System%\kbd1uery.dll
%System%\lfyockaa.dll
%System%\a15svcs.exe
%System%\dpnmdlib.exe
%System%\c_28usic.dll
%System%\atiysnpn.dll
%System%\treemqoa.dll
%System%\arptutdn.dll
%System%\eulapart.dll
%System%\smlo8thk.exe
%System%\odbcfwci.ime
%System%\hgakheg.dll
%System%\jkwbhew.dll
%System%\testtest.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove iueninet.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\ivhost.exe

ivhost.exe is a network worm W32.Rbot-BJN.
ivhost.exe opens a back door on IRC channels.
ivhost.exe spreads via the RPC-DCOM (MS04-012) and LSASS (MS04-011) buffer overflow vulnerabilities.
Related files:
%System%\ivhost.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill ivhost.exe process and remove ivhost.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\jaicg.exe

%SysDir%\jaicg.exe is Trojan/Backdoor.
Kill the process jaicg.exe and remove jaicg.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\jarule.exe

jarule.exe is a worm W32/Sdranck-O.
jarule.exe spreads via open network shares.
Related files:
%SysDir%\thefunk.exe
%SysDir%\jarule.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill jarule.exe process and remove jarule.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\javams64.exe

javams64.exe is a worm W32.Sdbot-AFO.
javams64.exe opens a back door.
javams64.exe spreads via open network shares.
Related files:
%System%\javams64.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill javams64.exe process and remove javams64.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\jdbgmgr.exe

%sysdir%\jkkjj.dll

%SysDir%\JKKJJ.DLL is Trojan/Backdoor.
Remove JKKJJ.DLL using RegRun "Scan for Viruses" feature.
http://www.regrun.com

%sysdir%\jkwbhew.dll

jkwbhew.dll is a Trojan.PPdoor-Q.
jkwbhew.dll opens a back door.
jkwbhew.dll tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\dpnetmsg.exe
%System%\iueninet.dll
%System%\fsmgntfs.dll
%System%\ntmapast.dll
%System%\ir50psrv.exe
%System%\kbd1uery.dll
%System%\lfyockaa.dll
%System%\a15svcs.exe
%System%\dpnmdlib.exe
%System%\c_28usic.dll
%System%\atiysnpn.dll
%System%\treemqoa.dll
%System%\arptutdn.dll
%System%\eulapart.dll
%System%\smlo8thk.exe
%System%\odbcfwci.ime
%System%\hgakheg.dll
%System%\jkwbhew.dll
%System%\testtest.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove jkwbhew.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\jobdb.dll

Jobdb.dll is a mass-mailing worm W32.Bagz@mm.
Jobdb.dll tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\dl.exe
%System%\syslogin.exe
%System%\jobdb.dll
%System%\ipdb.dll
%System%\wdate.dll
Adds the value:
"syslogin.exe" = "syslogin.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove jobdb.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\jorgf.exe

jorgf.exe is a Trojan W32.Rbot-AUI.
jorgf.exe opens a back door on IRC channels.
jorgf.exe spreads via open network shares.
Related files:
%System%\jorgf.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill jorgf.exe process and remove jorgf.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\kaboom.dll

kaboom.dll is a Trojan.Agent-FV.
kaboom.dll downloads code from the internet.
Related files:
%System%\iewatch.exe
%System%\kaboom.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove kaboom.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\kane.dll

kane.dll is a Backdoor.Dckane.
kane.dll spreads via open network shares.
Related files:
%Windir%\kane.exe
%System%\kane.dll
Adds the value:
"Shell" = "Explorer.exe kane.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove kane.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\karnal32.dll

karnal32.dll is a Trojan.Vipgsm-K.
karnal32.dll spreads via open network shares.
karnal32.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\mstcpmon.exe
%System%\chkdskw.exe
%System%\itstore.dll
%System%\karnal32.dll
%System%\mslogon.dll
%System%\mswshell.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove karnal32.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\kazaabackupfiles\download_me.exe

download_me.exe is a Trojan W32.Spybot-EG.
download_me.exe opens a back door on IRC channels.
download_me.exe spreads via open network shares.
Related files:
%System%\kazaabackupfiles\download_me.exe
%System%\system32.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill download_me.exe process and remove download_me.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\kb32.exe

kb32.exe is rootkit Trojan.Malche-A.
kb32.exe is used to hide files, processes and registry.
kb32.exe is a kernel mode rootkit.
Rootkit contacts remote hacker server using HTTP session.
kb32.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Rootkit creates new system drivers.
Related files:
%Temp%\MSDIRECTX.SYS
%SysDir%\kb32.exe
Added to registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\MS alchemy\
DisplayName
MS alchemy

HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\MS alchemy\
UninstallString
%SysDir%\kb32.exe -uninstall

HKCU\Software\Microsoft\Internet Explorer\Main\
Start Page

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\DefaultPrefix\

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\Prefixes\
www

HKCU\SOFTWARE\Microsoft\Internet Explorer\Search\
SearchAssistant

HKCU\SOFTWARE\Microsoft\Internet Explorer\Search\
CustomizeSearch
More info: http://www.sophos.com/virusinfo/analyses...

%sysdir%\kbd1uery.dll

kbd1uery.dll is a Trojan.PPdoor-Q.
kbd1uery.dll opens a back door.
kbd1uery.dll tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\dpnetmsg.exe
%System%\iueninet.dll
%System%\fsmgntfs.dll
%System%\ntmapast.dll
%System%\ir50psrv.exe
%System%\kbd1uery.dll
%System%\lfyockaa.dll
%System%\a15svcs.exe
%System%\dpnmdlib.exe
%System%\c_28usic.dll
%System%\atiysnpn.dll
%System%\treemqoa.dll
%System%\arptutdn.dll
%System%\eulapart.dll
%System%\smlo8thk.exe
%System%\odbcfwci.ime
%System%\hgakheg.dll
%System%\jkwbhew.dll
%System%\testtest.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove kbd1uery.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\kbdaemon.exe

KBDaemon.exe is a keylogger.
It may be legitimate if you use it for own needs.
But it is may be used for spying your keyboard.

%sysdir%\kbdusb.dll

kbdusb.dll is a Trojan.Darkmoon.C.
kbdusb.dll opens a back door on TCP port 81, 8080, or 8088..
kbdusb.dll spreads via open network shares.
Related files:
%System%\kbdusb.dll
%System%\kbdyl.dll
%System%\localsp.dll
%System%\lodcst.exe
%System%\sanlib.dll
%System%\acctrse.dll
Adds the value:
lds" = "%System%\lodcst.exe
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove kbdusb.dll using RegRun "Scan for Viruses" feature.
http://www.regrun.com

%sysdir%\kbdyl.dll

kbdyl.dll is a Trojan.Darkmoon.C.
kbdyl.dll opens a back door on TCP port 81, 8080, or 8088..
kbdyl.dll spreads via open network shares.
Related files:
%System%\kbdusb.dll
%System%\kbdyl.dll
%System%\localsp.dll
%System%\lodcst.exe
%System%\sanlib.dll
%System%\acctrse.dll
Adds the value:
lds" = "%System%\lodcst.exe
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove kbdyl.dll using RegRun "Scan for Viruses" feature.
http://www.regrun.com

%sysdir%\kbhook.dll

Kbhook.dll is a Spyware.NetSpy.
Kbhook.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\netspy.exe
%System%\nsys.exe
%System%\nconfig.exe
%System%\nsutil.exe
%System%\Faq.fil
%System%\MSVBVM60.DLL
%System%\kbhook.dll
%System%\CaptureScreen.ocx
%System%\Richtx32.ocx
Adds the value:
"nsys" = "nsys.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove kbhook.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\kdc.dll

Kdc.dll is a Trojan Backdoor.Fuwudoor.
Kdc.dll spreads via open network shares.
Related files:
%System%\ipsec.dll
%System%\appmgmt.dll
%System%\browsvr.dll
%System%\trkw.dll
%System%\trks.dll
%System%\kdc.dll
%System%\dmsrv.dll
%System%\mesg.dll
%System%\netlogin.dll
%System%\protstrg.dll
%System%\lmhosts.dll
%System%\w32t.dll
%System%\ntms.dll
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove kdc.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\kdcmt.exe

kdcmt.exe is rootkit Trojan.Zlob-XU.
kdcmt.exe is used to hide files, processes and registry.
kdcmt.exe is a kernel mode rootkit.
Related files:
%SysDir%\kdcmt.exe
Adds the value:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
System
kdcmt.exe
to the Windows startup registry keys.
More info: http://www.sophos.com/security/analyses/...

%sysdir%\ke7dnl.sys

ke7dnl.sys is rootkit Trojan.Haxdoor-BU.
ke7dnl.sys is used to hide files, processes and registry.
ke7dnl.sys is a kernel mode rootkit.
Rootkit contacts remote hacker server using HTTP session.
Related files:
%Temp%\Dtmp106.exe
%Temp%\Dtmp206.exe
%SysDir%\ke7dnl.sys
ke7dnl.sys is created new system drivers:
service name: "ke7dnl"
display name: "AVXSearch service"
Added to registry:
HKLM\SYSTEM\CurrentControlSet\Services\ke7dnl\
More info: http://www.sophos.com/security/analyses/...

%sysdir%\kernal64.exe

kernal64.exe is a worm W32.Yimp-B.
kernal64.exe spreads via the Yahoo and AOL Instant Messenger clients.
Related files:
%System%\kernal64.exe
%Windows%\y5b\1004270.exe
%Windows%\y5b\YSBAgree.exe
%Windows%\y5b\iS.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill kernal64.exe process and remove kernal64.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\kerne0110.exe

Kerne0110.exe is a Trojan.Lineage-FU.
Kerne0110.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\Kerne0110.exe
%System%\RegistryInfo2.dll
%System%\microsoftie0110.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill Kerne0110.exe process and remove Kerne0110.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\kerne0223.exe

%SysDir%\Kerne0223.exe is Trojan Infostealer.Gamania.
Related files:
%System%\Kerne0223.exe
%System%\Kerne0223.dll
[PATH TO TROJAN]\gg.bat
c:\log.txt
Read more: http://securityresponse.symantec.com/avc...
Kill the process %SysDir%\Kerne0223.exe and remove %SysDir%\Kerne0223.exe from Windows startup using RegRun.
www.regrun.com

%sysdir%\kerne121.exe

Kerne121.exe is a Trojan.Lineage-ON.
Kerne121.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\Kerne121.exe
%System%\microsoftie21.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill Kerne121.exe process and remove Kerne121.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\kerne1211.exe

Kerne1211.exe is a Trojan.Lineage-CA.
Kerne1211.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\Kerne1211.exe
%System%\microsoftie1211.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill Kerne1211.exe process and remove Kerne1211.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\kerne14.exe

Kerne14.exe is a Trojan.Lineage-BA.
Kerne14.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\Kerne14.exe
%System%\microsoftie4.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill Kerne14.exe process and remove Kerne14.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\kerne1412.exe

Kerne1412.exe is a Trojan.Lineage-OJ.
Kerne1412.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\Kerne1412.exe
%System%\microsoftie412.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill Kerne1412.exe process and remove Kerne1412.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\kernel66.dll

Kernel66.dll is a mass-mailing worm Worm.Win32.LovGate.
Kernel66.dll opens a back door on TCP port 6000.
Kernel66.dll spreads via open network shares.
Kernel66.dll tries to terminate antiviral programs installed on a user computer.
Related files:
%windir%\CDPlay.exe
%system%\Update_OB.exe
%system%\TkBellExe.exe
%system%\spollsv.exe
%system%\Kernel66.dll
Adds the value:
"WinHelp"="%system%\TkBellExe.exe"
"Hardware Profile"=""="%system%\hxdef.exe"
"Microsoft Associates, Inc."=" "="%system%\iexplorer.exe"
"SystemTra"=""="%swindir%\CdPlay.exe"
"Shell Extension"=""="%system%\spollsv.exe"
to the Windows startup registry keys.
More info: http://www.viruslist.com/en/viruses/ency...
Removal:
Remove Kernel66.dll using RegRun "Scan for Viruses" feature.
http://www.regrun.com

%sysdir%\kernlx86.exe

%SysDir%\kernlx86.exe is Malware.
Related files:
%WINDIR%\SYSTEM32\01750.EXE
%WINDIR%\SYSTEM32\07725.EXE
%WINDIR%\SYSTEM32\14487.EXE
%WINDIR%\SYSTEM32\22376.EXE
%WINDIR%\SYSTEM32\23423.EXE
%WINDIR%\SYSTEM32\25348.EXE
%WINDIR%\SYSTEM32\26455.EXE
%WINDIR%\SYSTEM32\26870.EXE
%WINDIR%\SYSTEM32\30881.EXE
%WINDIR%\SYSTEM32\31513.EXE
Kill the process %SysDir%\kernlx86.exe and remove %SysDir%\kernlx86.exe from Windows startup using RegRun.
www.regrun.com

%sysdir%\keybhook.dll

keybhook.dll is a Spyware.Sa_PCSpy.
Remove keybhook.dll using RegRun "Scan for Viruses" feature.
http://www.regrun.com

%sysdir%\keyboard.exe

%SysDir%\keyboard.exe is Trojan/Backdoor.
Kill the process keyboard.exe and remove keyboard.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\keyboard10.exe

%SysDir%\keyboard10.exe is Malware.
Kill the process %SysDir%\keyboard10.exe and remove %SysDir%\keyboard10.exe from Windows startup using RegRun.
www.regrun.com

%sysdir%\keygen.exe

keygen.exe is a worm W32.Delf-LY.
keygen.exe spreads via file sharing on P2P networks.
Related files:
%System%\keygen.exe
%System%\svchost.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill keygen.exe process and remove keygen.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\keylogger.dll

Keylogger.dll is a Spyware.AllInOne.
Keylogger.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
allinonespy.exe
inject.dll
run.exe
runwin95.exe
%System%\applog.dll
%System%\inetlog.dll
%System%\keylogger.dll
%System%\log.dll
%System%\remotelog.dll
%System%\screenlog.dll
%System%\soundlog.dll
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove keylogger.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\keylogir.dll

keylogir.dll is a Trojan.Bancban-NJ.
keylogir.dll opens a back door.
keylogir.dll monitors user Internet activity and bank information.
It sends stolen data to a hacker site.
Related files:
%System%\imgst.scr
%System%\keylogir.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove keylogir.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\kiamarsi.exe

Kiamarsi.exe is a Trojan.Detest-A.
Kiamarsi.exe opens a back door.
Related files:
%System%\Kiamarsi.exe
C:\Hadi Kiamarsi.txt
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill Kiamarsi.exe process and remove Kiamarsi.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\kkdrv.dll

Kkdrv.dll is a Spyware.KeyKey.
Kkdrv.dll logs keystrokes and takes screenshots.
Related files:
%ProgramFiles%\KEYKEY\slman.exe
%ProgramFiles%\KEYKEY\slview.exe
%System%\sldrv.dll
%System%\zlib.dll
%System%\loadwin.exe
%ProgramFiles%\KEYKEY\keykey.exe
%ProgramFiles%\KEYKEY\kkmon.exe
%System%\kkdrv.dll
%System%\loadkk.exe
Adds the value:
"SL Loader" = "loadwin.exe"
"KK Loader" = "%System%\loadkk.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove kkdrv.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\klogini.dll

klogini.dll is a Trojan Backdoor.Haxdoor.ED.
klogini.dll tries to terminate antiviral programs installed on a user computer.
klogini.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site. Related files:
%System%\avpu32.dll
%System%\avpu32.sys
%System%\avpu64.sys
%System%\klogini.dll
%System%\p3.ini
%System%\qy.sys
%System%\qz.dll
%System%\qz.sys
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove klogini.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\kpaccess.dll

kpAccess.dll is a Spyware.WinRecon.
kpAccess.dll logs keystrokes and takes screenshots.
Related files:
%ProgramFiles%\WinRecon\codex.exe
%ProgramFiles%\WinRecon\condex.exe
%ProgramFiles%\WinRecon\Dataview.exe
%ProgramFiles%\WinRecon\sp5.exe
%System%\kpAccess.dll
%System%\kpunzip.dll
%System%\kpzip.dll
%System%\MSSTDFMT.DLL
%Windir%\LastGood\System32\OLEAUT32.DLL
%Windir%\LastGood\System32\OLEPRO32.DLL
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove kpAccess.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\kpunzip.dll

kpunzip.dll is a Spyware.WinRecon.
kpunzip.dll logs keystrokes and takes screenshots.
Related files:
%ProgramFiles%\WinRecon\codex.exe
%ProgramFiles%\WinRecon\condex.exe
%ProgramFiles%\WinRecon\Dataview.exe
%ProgramFiles%\WinRecon\sp5.exe
%System%\kpAccess.dll
%System%\kpunzip.dll
%System%\kpzip.dll
%System%\MSSTDFMT.DLL
%Windir%\LastGood\System32\OLEAUT32.DLL
%Windir%\LastGood\System32\OLEPRO32.DLL
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove kpunzip.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\kpzip.dll

kpzip.dll is a Spyware.WinRecon.
kpzip.dll logs keystrokes and takes screenshots.
Related files:
%ProgramFiles%\WinRecon\codex.exe
%ProgramFiles%\WinRecon\condex.exe
%ProgramFiles%\WinRecon\Dataview.exe
%ProgramFiles%\WinRecon\sp5.exe
%System%\kpAccess.dll
%System%\kpunzip.dll
%System%\kpzip.dll
%System%\MSSTDFMT.DLL
%Windir%\LastGood\System32\OLEAUT32.DLL
%Windir%\LastGood\System32\OLEPRO32.DLL
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove kpzip.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\krnlmgr.dll

krnlmgr.dll is a Trojan.Juny-A.
krnlmgr.dll modifies data on the computer.
Related files:
%System%\krnlmgr.exe
%System%\krnlmgr.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove krnlmgr.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\krnlmgr.exe

krnlmgr.exe is a Trojan.Juny-A.
krnlmgr.exe modifies data on the computer.
Related files:
%System%\krnlmgr.exe
%System%\krnlmgr.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill krnlmgr.exe process and remove krnlmgr.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\ksdt1983.sys

ksdt1983.sys is rootkit Trojan.Goldun-EH.
ksdt1983.sys is used to hide files, processes and registry.
ksdt1983.sys is a kernel mode rootkit.

Related files:
%SysDir%\VKTServ.exe
%SysDir%\drivers\ksdt1983.sys
%SysDir%\svchost.bat

ksdt1983.sys creates new system driver:
service name: "KSDT1983"
display name: "KSDT1983"
Added to registry:
HKLM\SYSTEM\CurrentControlSet\Services\KSDT1983\

VKTServ.exe creates new system driver:
service name: "VKTServ"
display name: "VKTServ"
Adds the value:
HKLM\SYSTEM\CurrentControlSet\Services\VKTServ\
to the Windows startup registry keys.
More info: http://www.sophos.com/security/analyses/...

%sysdir%\ksrv32.exe

Ksrv32.exe is a W32/Agobot-PI.
Ksrv32.exe opens a back door.
Ksrv32.exe spreads via open network shares.
Related files:
%System%\Ksrv32.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill Ksrv32.exe process and remove Ksrv32.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\kwatch1.sys

KWatch1.sys is rootkit Trojan.Agent-DZY.
KWatch1.sys is used to hide files, processes and registry.
KWatch1.sys is a kernel mode rootkit.
KWatch1.sys created new system drivers:
service name: " KWatch1.sys"
Added to registry:
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_KWATCH1\
Related files:
%SysDir%\drivers\KWatch1.sys
More info: http://www.sophos.com/virusinfo/analyses...

%sysdir%\kwinkqaf.exe

%SysDir%\kwinkqaf.exe is Trojan/Backdoor.
Kill the process %SysDir%\kwinkqaf.exe and remove %SysDir%\kwinkqaf.exe from Windows startup using RegRun.
www.regrun.com

%sysdir%\kxrnxl32.dll

kxrnxl32.dll is a Trojan.Gina-K.
kxrnxl32.dll tries to terminate antiviral programs installed on a user computer.
kxrnxl32.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\kxrnxl32.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove kxrnxl32.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\l074.exe

l074.exe is a Trojan.Agent-II.
l074.exe opens a back door on IRC channels.
Related files:
%System%\l074.exe
%System%\msdirectx.sys
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill l074.exe process and remove l074.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\laziqn.exe

Laziqn.exe is an adware program Adware.BetterInternet.
Laziqn.exe is a Browser Helper Object.
Laziqn.exe downloads and displays advertisements.
Related files:
%Windir%\Bi.dll
%Windir%\speeryox.dll
%Windir%\Mxtarget.dll
%Windir%\BTGrab.dll
%Windir%\farmmext.exe
%Windir%\dlmax.dll
%Windir%\speer2.dll
%Windir%\VoiceIP.dll
%Windir%\morphacl.dll
%Windir%\Pynix.dll
%Windir%\Biprep.exe
%Windir%\banner.dll
%System%\laziqn.exe
%System%\xxvyaj.exe
%System%\wbtvsffd.exe
%System%\nnmzoq.exe
%Temp%\DrTemp\thnall1b.exe
%Temp%\DrTemp\thnall1p.exe
%Temp%\DrTemp\thnall2r.exe
%Temp%\DrTemp\polall1b.exe
%Temp%\thnall1s.exe
%Temp%\morphrec.exe
Adds the value:
"[File name of adware]" = "[File path to adware]"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill laziqn.exe process and remove laziqn.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\ld1d1e.tmp

%SysDir%\ld1D1E.tmp is related fo Ecodec.
Kill the file %SysDir%\ld1D1E.tmp and remove %SysDir%\ld1D1E.tmp from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\ldr64.dll

Ldr64.dll is W32.Beagle.DV Trojan.
Kill the file ldr64.dll and remove ldr64.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com
Read more: http://www.symantec.com/avcenter/venc/da...

%sysdir%\ldriver.exe

ldriver.exe is a Trojan.Chorus-B.
ldriver.exe changes settings for Microsoft Internet Explorer.
Related files:
%Windows%\htmlsync.exe
%System%\isystem.exe
%System%\ldriver.exe
%Windows%\zlibc.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill ldriver.exe process and remove ldriver.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\ldrmsvbvm06.dll

ldrmsvbvm06.dll is a Trojan.OptixP-O.
ldrmsvbvm06.dll opens a back door.
Related files:
%System%\msiexec16.exe
%Windows%\198.125
%Windows%\686.368
%System%\ldrmsvbvm06.dll
%System%\msvbvm06.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove ldrmsvbvm06.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\leeman.exe

leeman.exe is a Trojan.Cosiam-D.
leeman.exe opens a back door.
Related files:
%System%\leeman.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill leeman.exe process and remove leeman.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\lf66prc.exe

lf66prc.exe is a mass-mailing worm W32.Mytob.GC@mm.
lf66prc.exe opens a back door on TCP port 7000.
lf66prc.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\lf66prc.exe
Adds the value:
"WINDOWS SYSTEM" = "lf66prc.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill lf66prc.exe process and remove lf66prc.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\lfyockaa.dll

lfyockaa.dll is a Trojan.PPdoor-Q.
lfyockaa.dll opens a back door.
lfyockaa.dll tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\dpnetmsg.exe
%System%\iueninet.dll
%System%\fsmgntfs.dll
%System%\ntmapast.dll
%System%\ir50psrv.exe
%System%\kbd1uery.dll
%System%\lfyockaa.dll
%System%\a15svcs.exe
%System%\dpnmdlib.exe
%System%\c_28usic.dll
%System%\atiysnpn.dll
%System%\treemqoa.dll
%System%\arptutdn.dll
%System%\eulapart.dll
%System%\smlo8thk.exe
%System%\odbcfwci.ime
%System%\hgakheg.dll
%System%\jkwbhew.dll
%System%\testtest.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove lfyockaa.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\lien vande kelder.exe

Lien Vande Kelder.exe is a mass-mailing worm W32.Mytob.GN@mm.
Lien Vande Kelder.exe opens a back door on TCP port 12000.
Lien Vande Kelder.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\Lien Vande Kelder.exe
Adds the value:
"[http://]www.lienvandekelder.be/[REMOVED]... = "\Lien Vande Kelder.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill Lien Vande Kelder.exe process and remove Lien Vande Kelder.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\lien.exe

Lien.exe is a mass-mailing worm W32.Mytob.CY@mm.
Lien.exe tries to terminate antiviral programs installed on a user computer.
Lien.exe opens a back door on TCP port 4512.
Related files:
%System%\Lien.exe
Adds the value:
"[http://]www.lienvandekelder[REMOVED].be" = "Lien.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill Lien.exe process and remove Lien.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\lifefuxor.exe

lifefuxor.exe is a worm W32.Attech-B.
lifefuxor.exe spreads via open network shares and by AOL Instant Messenger.
lifefuxor.exe downloads code from the internet.
Related files:
%System%\lifefuxor.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill lifefuxor.exe process and remove lifefuxor.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\list32.exe

list32.exe is a Trojan W32.Rbot-AVG.
list32.exe opens a back door on IRC channels.
list32.exe spreads via open network shares.
Related files:
%System%\list32.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill list32.exe process and remove list32.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\live.exe

%SysDir%\live.exe is Trojan/Backdoor.
Kill the process live.exe and remove live.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\livetest_bar.dll

%SysDir%\livetest_bar.dll is Trojan/Backdoor.
Kill the file %SysDir%\livetest_bar.dll and remove %SysDir%\livetest_bar.dll from Windows startup using RegRun.
www.regrun.com

%sysdir%\llsass.exe

Llsass.exe is a Trojan.Proxy-GG.
Llsass.exe opens a back door.
Llsass.exe spreads via open network shares.
Related files:
%System%\llsass.exe
%System%\lsmss.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill llsass.exe process and remove llsass.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\lmamanager.exe

lmamanager.exe is Trojan W32.Tilebot-AD.
lmamanager.exe opens a back door on IRC channels.
lmamanager.exe spreads via open network shares.
lmamanager.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\lmamanager.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill lmamanager.exe process and remove lmamanager.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\lmhosts.dll

Lmhosts.dll is a Trojan Backdoor.Fuwudoor.
Lmhosts.dll spreads via open network shares.
Related files:
%System%\ipsec.dll
%System%\appmgmt.dll
%System%\browsvr.dll
%System%\trkw.dll
%System%\trks.dll
%System%\kdc.dll
%System%\dmsrv.dll
%System%\mesg.dll
%System%\netlogin.dll
%System%\protstrg.dll
%System%\lmhosts.dll
%System%\w32t.dll
%System%\ntms.dll
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove lmhosts.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\lmmib20.dll

Lmmib20.dll is a mass-mailing worm W32.Lovgate.
Lmmib20.dll opens a back door.
Lmmib20.dll tries to terminate antiviral programs installed on a user computer.
Related files:
%system%\Kernel66.dll
%system%\RAVMOND.exe
%windir%\SYSTRA.exe
%SysDir%\msjdbc11.dll
%SysDir%\MSSIGN30.DLL
%SysDir%\ODBC16.dll
%SysDir%\Lmmib20.dll
More info: http://www.viruslist.com/en/viruses/ency...
Removal:
Remove Lmmib20.dll using RegRun "Scan for Viruses" feature.

%sysdir%\lmovie.exe

lmovie.exe is a mass-mailing worm W32.Beagle.DS@mm.
lmovie.exe opens a back door.
lmovie.exe spreads by e-mail and via open network shares.
lmovie.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%Windir%\vcualts32.exe
%System%\lmovie.exe
%System%\lmovie.exeopen
%System%\lmovie.exeopenopen
Adds the value:
"MovieM" = "%System%\lmovie.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill the process lmovie.exe and remove lmovie.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\lmrtend.dll

lmrtend.dll is Trojan/Backdoor.
Remove lmrtend.dll using RegRun "Scan for Viruses" feature.
http://www.regrun.com

%sysdir%\lo71.exe

lo71.exe is a Trojan W32.Sdbot-AGT.
lo71.exe opens a back door on IRC channels.
lo71.exe spreads via open network shares.
Related files:
%System%\lo71.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill lo71.exe process and remove lo71.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\loadadv64

%SysDir%\loadadv64 is Trojan/Backdoor.
Kill the process %SysDir%\loadadv64 and remove %SysDir%\loadadv64 from Windows startup using RegRun.
www.regrun.com

%sysdir%\loadadv710.exe

loadadv710.exe is Trojan/Backdoor.
Kill the process loadadv710.exe and remove loadadv710.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\loadadv711.exe

loadadv711.exe is Trojan/Backdoor.
Kill the process loadadv711.exe and remove loadadv711.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\loadadv712.exe

loadadv712.exe is Trojan/Backdoor.
Kill the process loadadv712.exe and remove loadadv712.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\loadadv713.exe

loadadv713.exe is Trojan/Backdoor.
Kill the process loadadv713.exe and remove loadadv713.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\loadhw.exe

%SysDir%\loadhw.exe is an information stealing Trojan.Wlook-A.
Kill the process loadhw.exe and remove loadhw.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\loadkk.exe

Loadkk.exe is a Spyware.KeyKey.
Loadkk.exe logs keystrokes and takes screenshots.
Related files:
%ProgramFiles%\KEYKEY\slman.exe
%ProgramFiles%\KEYKEY\slview.exe
%System%\sldrv.dll
%System%\zlib.dll
%System%\loadwin.exe
%ProgramFiles%\KEYKEY\keykey.exe
%ProgramFiles%\KEYKEY\kkmon.exe
%System%\kkdrv.dll
%System%\loadkk.exe
Adds the value:
"SL Loader" = "loadwin.exe"
"KK Loader" = "%System%\loadkk.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill loadkk.exe process and remove loadkk.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\loadwin.exe

Loadwin.exe is a Spyware.KeyKey.
Loadwin.exe logs keystrokes and takes screenshots.
Related files:
%ProgramFiles%\KEYKEY\slman.exe
%ProgramFiles%\KEYKEY\slview.exe
%System%\sldrv.dll
%System%\zlib.dll
%System%\loadwin.exe
%ProgramFiles%\KEYKEY\keykey.exe
%ProgramFiles%\KEYKEY\kkmon.exe
%System%\kkdrv.dll
%System%\loadkk.exe
Adds the value:
"SL Loader" = "loadwin.exe"
"KK Loader" = "%System%\loadkk.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill loadwin.exe process and remove loadwin.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\loc1.exe

loc1.exe is a Trojan W32.Rbot-AZU.
loc1.exe opens a back door on IRC channels.
loc1.exe spreads via open network shares.
Related files:
%System%\loc1.exe
%System%\msdirectx.sys
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill loc1.exe process and remove loc1.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\localsp.dll

localsp.dll is a Trojan.Darkmoon.C.
localsp.dll opens a back door on TCP port 81, 8080, or 8088..
localsp.dll spreads via open network shares.
Related files:
%System%\kbdusb.dll
%System%\kbdyl.dll
%System%\localsp.dll
%System%\lodcst.exe
%System%\sanlib.dll
%System%\acctrse.dll
Adds the value:
lds" = "%System%\lodcst.exe
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove localsp.dll using RegRun "Scan for Viruses" feature.
http://www.regrun.com

%sysdir%\lockbr.exe

lockbr.exe is a worm W32.Loxbot.F.
lockbr.exe opens a back door on IRC channels.
lockbr.exe spreads using AOL, MSN and Yahoo Instant Messenger..
lockbr.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\lockbr.exe
Adds the value:
"freexstyle" = "lockbr.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill the process lockbr.exe and remove lockbr.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\lockx.exe

lockx.exe is rootkit W32/Opanki-K.
lockx.exe is used to hide files, processes and registry.
lockx.exe is a kernel mode rootkit.
lockx.exe opens a back door on IRC channels.
Related files:
%SysDir\lockx.exe
%CurrentFolder%\msdirectx.sys
Adds the value:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
stratas
lockx.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
stratas
lockx.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
stratas
lockx.exe
to the Windows startup registry keys.
Added to registry:
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\

HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\

HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile
EnableFirewall
0
More info: http://www.sophos.com/virusinfo/analyses...

%sysdir%\lodcst.exe

lodcst.exe is a Trojan.Darkmoon.C.
lodcst.exe opens a back door on TCP port 81, 8080, or 8088..
lodcst.exe spreads via open network shares.
Related files:
%System%\kbdusb.dll
%System%\kbdyl.dll
%System%\localsp.dll
%System%\lodcst.exe
%System%\sanlib.dll
%System%\acctrse.dll
Adds the value:
lds" = "%System%\lodcst.exe
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill the process lodcst.exe and remove lodcst.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\logic.exe

Logic.exe is a mass-mailing wormW32.Mytob.IC@mm.
Logic.exe opens a back door on TCP port 6667.
Logic.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\logic.exe
Adds the value:
"WINDOWS SYSTEM" = "logic.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill logic.exe process and remove logic.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\logo_1.exe

%SysDir%\logo_1.exe is W32.Mumawow.A.
W32.Mumawow.A is a virus that infects .exe files in the %ProgramFiles% folder, may download files from a remote location and may spread through network drives.
Related file:
%Temp%\32546.dll
Read more: http://www.symantec.com/enterprise/secur...
Kill the process %SysDir%\logo_1.exe and remove %SysDir%\logo_1.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\logon.exe

Logon.exe is a worm W32.Linkbot.M.
Logon.exe opens a back door through IRC.
Logon.exe spreads by exploiting the Microsoft Windows LSASS Buffer Overrun Vulnerability (Microsoft Security Bulletin MS04-011).
Logon.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\lssas.exe
%System%\Isass.exe
%System%\csrs.exe
%System%\logon.exe
%System%\winlogon.exe
%System%\explorer.exe
%System%\winamp.exe
%System%\firewall.exe
%System%\spoolsvc.exe
%System%\spoolsv.exe
%System%\algs.exe
%System%\iexplore.exe
Adds the value:
"Local Security Authority Service" = "%System%\lssas.exe"
"Local Security Authority Service" = "%System%\Isass.exe"
"Client Server Runtime Process" = "%System%\csrs.exe"
"Windows Logon Application" = "%System%\logon.exe"
"Windows Logon Application" = "%System%\winIogon.exe"
"Windows Explorer" = "%System%\explorer.exe"
"Winamp Agent" = "%System%\winamp.exe"
"Windows Network Firewall" = "%System%\firewall.exe"
"Spooler SubSystem App" = "%System%\spoolsvc.exe"
"Spooler SubSystem App" = "%System%\spooIsv.exe"
"Application Layer Gateway Service" = "%System%\algs.exe"
"Microsoft Internet Explorer" = "%System%\iexplore.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill logon.exe process and remove logon.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\logonnui.exe

logonnui.exe is a Trojan W32.Rbot-BCC.
logonnui.exe opens a back door on IRC channels.
logonnui.exe spreads via open network shares.
Related files:
%System%\logonnui.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill logonnui.exe process and remove logonnui.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\love.exe

love.exe is a Trojan.VB-ZQ.
love.exe opens a back door.
Related files:
%System%\love.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill love.exe process and remove love.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\lsa.exe

%SysDir%\lsa.exe is Win32/Rbot Family worm.
Kill the process %SysDir%\lsa.exe and remove %SysDir%\lsa.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com
Read more: http://www3.ca.com/securityadvisor/virus...

%sysdir%\lsa2srv.exe

lsa2srv.exe is a mass-mailing worm W32.Tame-C.
lsa2srv.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\lsa2srv.exe
%System%\service.exe
%System%\sysmng.exe
%System%\systm.exe
%System%\hserv.sys
%System%\iexplor.dll
%System%\iexplor2.dll
%System%\netdx.dat
%System%\version.ini
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill lsa2srv.exe process and remove svthx.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\lsadst.exe

lsadst.exe is a Trojan Backdoor.Naninf.C.
lsadst.exe tries to terminate antiviral programs installed on a user computer.
lsadst.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\lsadst.exe
Adds the value:
"WindowsProtocolLog" = "lsadst.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill the process lsadst.exe and remove lsadst.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\lsamgr.exe

lsamgr.exe is a mass-mailing worm W32.Beagle.DR@mm.
lsamgr.exe opens a back door on TCP port 6777.
lsamgr.exe spreads via open network shares.
lsamgr.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%Windir%\Wimanager.exe
%System%\lsamgr.exe
%System%\lsamgr.exeopen
%System%\lsamgr.exeopenopen
%Temp%\winkgcbmt.exe
Adds the value:
"LsaManager" = ""%System%\lsamgr.exe"\lsamgr.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill the process lsamgr.exe and remove lsamgr.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\lsas32.exe

Lsas32.exe is a worm W32.Qdens.E.
Lsas32.exe spreads via QQ Messenger and Tencent Messenger.
Lsas32.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\lsas32.exe
Adds the value:
"678" = "%System%\lsas32.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill lsas32.exe process and remove lsas32.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\lsasa.exe

Lsasa.exe is a Trojan.Joex.
Lsasa.exe changes the Internet Explorer home page.
Lsasa.exe disables the Windows Task Manager.
Related files:
%Windir%\SVOHOST.EXE
%System%\commamd.exe
%System%\lsasa.exe
Adds the value:
"ctfnom.exe" = "%Windir%\SVOHOST.exe"
"Shell" = "Explorer.exe commamd.exe"
"command" = "%System%\lsasa.exe "%1""
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill lsasa.exe process and remove lsasa.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\lsasrv.exe

W32.Mydoom.AG@mm is a mass-mailing worm.
It uses its SMTP engine to send emails.
1. Creates the following copies of itself:
%System%\lsasrv.exe
%System%\version.ini
[path of execution]\hserv.sys
2. Adds to auto start using Shell value:
"Shell" = "explorer.exe %System%\lsasrv.exe"
3. Infects the HOSTS file.
Blocks access to antiviral sites and to Microsoft update.
4. Sends e-mails.

Removal:
Remove it from startup using RegRun Startup Optimizer.
Restore the HOSTS file using RegRun Anti-Spyware.
Stop the service and set it to disabled state.
Remove files.

%sysdir%\lsasser.exe

lsasser.exe is a worm W32.Rbot-ATS.
lsasser.exe opens a back door.
lsasser.exe spreads via open network shares.
Related files:
%System%\lsasser.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill lsasser.exe process and remove lsasser.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\lserv.exe

lserv.exe is a Trojan W32.Rbot-ATM.
lserv.exe opens a back door on IRC channels.
lserv.exe spreads via open network shares.
Related files:
%System%\lserv.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill lserv.exe process and remove lserv.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\lservice.exe

lservice.exe is a Trojan.Dloader-XM.
lservice.exe downloads code from the internet.
Related files:
%System%\ffservice.exe
%System%\lservice.exe
%System%\wservice.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill lservice.exe process and remove lservice.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\lsmss.exe

Lsmss.exe is a Trojan.Proxy-GG.
Lsmss.exe opens a back door.
Lsmss.exe spreads via open network shares.
Related files:
%System%\llsass.exe
%System%\lsmss.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill lsmss.exe process and remove lsmss.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\lssass.exe

lssass.exe is a worm W32.Amirecivel.B.
lssass.exe spreads via open network shares.
lssass.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\AVG.exe
%System%\servise64.exe
%System%\winlogon64.exe
%System%\lssass.exe
%System%\civil.exe
Adds the value:
"amircivil" = "%System%[FILE NAME].exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill the process lssass.exe and remove lssass.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\lssrv.exe

LSSRV.EXE is a worm W32.Rbot-LT.
LSSRV.EXE opens a back door on IRC channels.
LSSRV.EXE spreads via open network shares.
Related files:
%System%\LSSRV.EXE
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill LSSRV.EXE process and remove LSSRV.EXE from Windows startup using RegRun Startup Optimizer.

%sysdir%\lup.exe

lup.exe is Trojan/Backdoor.
Kill the process lup.exe and remove lup.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\lvsrev.exe

Lvsrev.exe is a Trojan PWSteal.Flecsip.B.
Lvsrev.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\lvsrev.exe
%System%\userid.dll
%System%\apigrab.dll
Adds the value:
"msserv" = "%System%\lvsrev.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill lvsrev.exe process and remove lvsrev.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\m0use.exe

M0USE.exe is a mass-mailing worm W32.Mytob.HG@mm.
M0USE.exe opens a back door on TCP port 7745.
M0USE.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\M0USE.exe
Adds the value:
"Userinterface Report3r" = "M0USE.exe"
"Shell" = "Explorer.exe M0USE.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill M0USE.exe process and remove M0USE.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\mabryobj.dll

MabryObj.dll is a Spyware.IamBigBrother.
MabryObj.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
cpanel.exe
nl.exe
ctl3d32.dll
winl.dll
dmm.dll
ma.exe
%System%\DOM.dll
%System%\DartFtp.dll
%System%\DartSock.dll
%System%\EncodeX.dll
%System%\MabryObj.dll
%System%\MimeX.dll
%System%\SmtpX.DLL
%Windir%\cp.exe
Adds the value:
"Windows System Tray" = "[PATH TO SECURITY RISK]"
"Windows Service Manager" = "[PATH TO SECURITY RISK]"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove MabryObj.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\mac.dll

We suggest you to remove %SysDir%\mac.dll from your computer as soon as possible.
%SysDir%\mac.dll is Troj/Banker-EEJ.
Related files:
%System%\helper.xml
%System%\mac.dll
Read more: http://www.sophos.com/security/analyses/...
Kill the file %SysDir%\mac.dll and remove %SysDir%\mac.dll from Windows startup.

%sysdir%\main.sys

%SysDir%\main.sys is Trojan Win32/Cutwail Family.
Read more: http://ca.com/us/securityadvisor/virusin...
Kill the file %SysDir%\main.sys and remove %SysDir%\main.sys from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\mainsv.exe

mainsv.exe is a Trojan.Tompai-B.
mainsv.exe opens a back door.
mainsv.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%Windows%\mapserver.exe
%System%\mainsv.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill mainsv.exe process and remove mainsv.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\mame.exe

mame.exe is a Trojan W32.Rbot-APH.
mame.exe opens a back door on IRC channels.
mame.exe spreads via open network shares.
Related files:
%System%\mame.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill mame.exe process and remove mame.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\marya.exe

marya.exe is a Trojan W32.Rbot-AXY.
marya.exe opens a back door on IRC channels.
marya.exe spreads via open network shares.
Related files:
%System%\marya.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill marya.exe process and remove marya.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\mastoer32.dll

mastoer32.dll is a worm W32.Katomik-A.
mastoer32.dll spreads via open network shares.
Related files:
%Windows%\AtomicpartC.exe
%Windows%\K-set.bmp
%System%\Atomic-x27.exe
%System%\mastoer32.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove mastoer32.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\maxd.exe

maxd.exe is a Trojan.Dloader-PE.
maxd.exe downloads code from the internet.
Related files:
%System%\maxd.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill maxd.exe process and remove maxd.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\mbprot.dll

%sysdir%\mcafe.exe

mcafe.exe is a Trojan W32.Rbot-BAV.
mcafe.exe opens a back door on IRC channels.
mcafe.exe spreads via open network shares.
Related files:
%System%\mcafe.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill mcafe.exe process and remove mcafe.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\mcafee.exe

Mcafee.exe is a mass-mailing worm W32.Reatle.I@mm.
Mcafee.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%Windir%\bagle.exe
%System%\mcafee.exe
%Windir%\scan.exe
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill mcafee.exe process and remove mcafee.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\mcafeeav32.exe

mcafeeav32.exe is a Trojan W32.Spybot-EH.
mcafeeav32.exe opens a back door on IRC channels.
mcafeeav32.exe spreads via open network shares.
mcafeeav32.exe tries to terminate antiviral programs installed on a user computer.
mcafeeav32.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\mcafeeav32.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill mcafeeav32.exe process and remove mcafeeav32.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\mccm.exe

mccm.exe is a Trojan.IRCBot-AT.
mccm.exe opens a back door on IRC channels.
Related files:
%System%\fedisk.com
%System%\mccm.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill mccm.exe process and remove mccm.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\mcconfig.dll

%SysDir%\MCCONFIG.DLL is Trojan/Backdoor.
Kill the file %SysDir%\MCCONFIG.DLL and remove %SysDir%\MCCONFIG.DLL from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\mcfcc4.dll

mcfCC4.dll is a worm W32.Starimp.
mcfCC4.dll spreads via open network shares.
mcfCC4.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\mcfCC4.dll
%System%\mcfdrv.sys
Adds the value:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\mcfdrv
HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\ENUM\ROOT\LEGACY_MCFDRV
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\mcfCC4
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove mcfCC4.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\mciole.dll

Mciole.dll is a Spyware.EliteKeylogger.
Mciole.dll logs key strokes.
Related files:
%UserProfile%\Desktop\ek_setup.exe
%System%\drivers\tdiip.sys
%System%\drivers\usbkbd.sys
%System%\mciole.dll
%System%\windump.exe
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove mciole.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\mcioles16.dll

MCIOLES16.DLL is a Trojan.Sharp-F.
MCIOLES16.DLL opens a back door.
Related files:
%System%\IMMS16.DLL
%System%\MCIOLES16.DLL
%System%\COMAPI.DLL
%System%\EULSASS.DLL
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove MCIOLES16.DLL from Windows startup using RegRun Startup Optimizer.

%sysdir%\mcsmss.exe

Mcsmss.exe is a Backdoor Trojan.Repsamo.
Mcsmss.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\mcsmss.exe
Adds the value:
"cmssSystemProcess" = "%System%\mcsmss.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill mcsmss.exe process and remove mcsmss.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\mdm.exe

We suggest you to remove %SysDir%\mdm.exe from your computer as soon as possible.
%SysDir%\mdm.exe is W32/Bckdr-QJR.
Read more: http://www.sophos.com/security/analyses/...
Kill the process %SysDir%\mdm.exe and remove %SysDir%\mdm.exe from Windows startup.

%sysdir%\mdmmirrxxx.dll

mdmmirrxxx.dll is a Trojan.Dloadr-ACS.
mdmmirrxxx.dll downloads code from the internet.
Related files:
%Windows%\inf\mdmmirrxxx.dll
%Windows%\inf\usermail.hlp
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove mdmmirrxxx.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\mdms.exe

mdms.exe is a Trojan.Cimuz-C.
mdms.exe opens a back door.
mdms.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\mdms.exe
%System%\winacpi.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill mdms.exe process and remove mdms.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\mdojtgmr.dll

%SysDir%\mdojtgmr.dll is Trojan/Backdoor.
Kill the file mdojtgmr.dll and remove mdojtgmr.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\mdsdev.exe

%SysDir%\mdsdev.exe is Trojan/Backdoor.
Kill the process %SysDir%\mdsdev.exe and remove %SysDir%\mdsdev.exe from Windows startup.

%sysdir%\memloader.exe

memloader.exe is a Trojan W32.Mytob-EC.
memloader.exe opens a back door on IRC channel.
memloader.exe spreads by e-mail.
memloader.exe tries to terminate antiviral programs installed on a user computer.
memloader.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\memloader.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill memloader.exe process and remove memloader.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\memlow.sys

memlow.sys is rootkit Trojan.Haxdoor-AA.
memlow.sys is used to hide files, processes and registry.
memlow.sys is a kernel mode rootkit.
Rootkit contacts remote hacker server using HTTP session.
memlow.sys tries to terminate antiviral programs installed on a user computer.

memlow.sys created new system drivers:
service name: "memlow"
display name: "LMMngr"
Adds the value:
HKLM\SYSTEM\CurrentControlSet\Services\memlow\
to the Windows startup registry keys.

vdnt32.sys created new system drivers:
service name: " vdnt32"
display name: "MemDRV"
Added to registry:
HKLM\SYSTEM\CurrentControlSet\Services\vdnt32\

Related files:
%SysDir%\cm.dll
%SysDir%\draw32.dll
%SysDir%\hm.sys
%SysDir%\memlow.sys
%SysDir%\p2.ini
%SysDir%\vdnt32.sys
%SysDir%\wd.sys

Adds the value:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\draw32
DllName
draw32.dll

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\draw32
Startup
NetMaxager

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\draw32
Impersonate
1
to the Windows startup registry keys.

More info: http://www.sophos.com/virusinfo/analyses...

%sysdir%\memreader.exe

memreader.exe is a Trojan W32.Agobot-TY.
memreader.exe opens a back door on IRC channels.
memreader.exe spreads via open network shares.
memreader.exe tries to terminate antiviral programs installed on a user computer.
memreader.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\memreader.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill memreader.exe process and remove memreader.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\mesg.dll

Mesg.dll is a Trojan Backdoor.Fuwudoor.
Mesg.dll spreads via open network shares.
Related files:
%System%\ipsec.dll
%System%\appmgmt.dll
%System%\browsvr.dll
%System%\trkw.dll
%System%\trks.dll
%System%\kdc.dll
%System%\dmsrv.dll
%System%\mesg.dll
%System%\netlogin.dll
%System%\protstrg.dll
%System%\lmhosts.dll
%System%\w32t.dll
%System%\ntms.dll
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove mesg.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\messengers.exe

Messengers.exe is a mass-mailing worm W32.Mytob.EI@mm.
Messengers.exe opens a back door on TCP port 7000.
Messengers.exe to terminate antiviral programs installed on a user computer.
Messengers.exe spreads by exploiting the Microsoft Windows Local Security Authority Service Remote Buffer Overflow (Microsoft Security Bulletin MS04-011) and the Microsoft Windows DCOM RPC Interface Buffer Overrun Vulnerability (Microsoft Security Bulletin MS03-026).
Related files:
%System%\messengers.exe
%System%\bingoo.exe
C:\funny_pic.scr
C:\see_this!!.scr
C:\my_photo2005.scr
C:\hellmsn.exe
Adds the value:
"Windows messenger" = "messengers.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill messengers.exe process and remove messengers.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\mfcmse.exe

%SysDir%\mfcmse.exe is Trojan/Backdoor.
Kill the process %SysDir%\mfcmse.exe and remove %SysDir%\mfcmse.exe from Windows startup using RegRun.
www.regrun.com

%sysdir%\mfs.exe

mfs.exe is a Trojan W32.Rbot-ANF.
mfs.exe opens a back door on IRC channels.
mfs.exe spreads via open network shares.
Related files:
%System%\mfs.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill mfs.exe process and remove mfs.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\mgeekremove.exe

MGeekRemove.exe is a Adware.Expand.
MGeekRemove.exe is a Browser Helper Object.
MGeekRemove.exe displays advertisements.
Related files:
%System%\BarBHO.dll
%System%\MGeekRemove.exe
%System%\MyGeek.dll
%System%\reg2.exe
More info:
Removal:
Kill MGeekRemove.exe process and remove MGeekRemove.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\mgrshell.exe

mgrShell.exe is a W32.Stando-A.
mgrShell.exe opens a back door.
mgrShell.exe spreads via open network shares.
Related files:
%System%\mgrShell.exe
%System%\scApp.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill mgrShell.exe process and remove mgrShell.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\mgs_32.dll

Mgs_32.dll is a Spyware.CWSMil.
Mgs_32.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\mgs_32.dll
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove mgs_32.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\microsoft\fixcomdos.exe

fixcomdos.exe is a Trojan.Clunky-B.
fixcomdos.exe opens a back door.
Related files:
%System%\Microsoft\fixcomdos.exe
%System%\Microsoft\iexplore.exe
%System%\wincontxt.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill fixcomdos.exe process and remove fixcomdos.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\microsoftie0110.dll

microsoftie0110.dll is a Trojan.Lineage-FU.
microsoftie0110.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\Kerne0110.exe
%System%\RegistryInfo2.dll
%System%\microsoftie0110.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove microsoftie0110.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\microsoftie1211.dll

microsoftie1211.dll is a Trojan.Lineage-CA.
microsoftie1211.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\Kerne1211.exe
%System%\microsoftie1211.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove microsoftie1211.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\microsoftie21.dll

microsoftie21.dll is a Trojan.Lineage-ON.
microsoftie21.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\Kerne121.exe
%System%\microsoftie21.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove microsoftie21.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\microsoftie4.dll

microsoftie4.dll is a Trojan.Lineage-BA.
microsoftie4.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\Kerne14.exe
%System%\microsoftie4.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove microsoftie4.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\microsoftie412.dll

microsoftie412.dll is a Trojan.Lineage-OJ.
microsoftie412.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\Kerne1412.exe
%System%\microsoftie412.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove microsoftie412.dll Windows startup using RegRun Startup Optimizer.

%sysdir%\mididef32.exe

MidiDef32.exe is a Trojan.Piebot-A.
MidiDef32.exe opens a back door on IRC channels.
MidiDef32.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\MidiDef32.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill MidiDef32.exe process and remove MidiDef32.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\mimex.dll

MimeX.dll is a Spyware.IamBigBrother.
MimeX.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
cpanel.exe
nl.exe
ctl3d32.dll
winl.dll
dmm.dll
ma.exe
%System%\DOM.dll
%System%\DartFtp.dll
%System%\DartSock.dll
%System%\EncodeX.dll
%System%\MabryObj.dll
%System%\MimeX.dll
%System%\SmtpX.DLL
%Windir%\cp.exe
Adds the value:
"Windows System Tray" = "[PATH TO SECURITY RISK]"
"Windows Service Manager" = "[PATH TO SECURITY RISK]"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove MimeX.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\ming.exe

ming.exe is a Trojan W32.Rbot-AWS.
ming.exe opens a back door on IRC channels.
ming.exe spreads via open network shares.
ming.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\ming.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill ming.exe process and remove ming.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\miq.dll

%SysDir%\miq.dll is Adware Virtumundo.
Kill the file %SysDir%\miq.dll and remove %SysDir%\miq.dll from Windows startup.

%sysdir%\mljjj.dll

%SysDir%\mljjj.dll is Adware Virtumundo.
Kill the file %SysDir%\mljjj.dll and remove %SysDir%\mljjj.dll from Windows startup.

%sysdir%\mljkk.dll

MLJKK.DLL is Trojan/Backdoor.
Related files:
%SYSTEM%\MLJKK.DLL
Remove MLJKK.DLL from Windows startup using RegRun Startup Optimizer.

%sysdir%\mmc.exe

%SysDir%\mmc.exe is W32.Dizan.
Read more: http://www.symantec.com/enterprise/secur...
Kill the process %SysDir%\mmc.exe and remove %SysDir%\mmc.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\mmsvc32.exe

Mmsvc32.exe is a network-aware worm W32.Kassbot.B.
Mmsvc32.exe spreads by exploiting the Microsoft Windows DCOM RPC Interface Buffer Overrun Vulnerability (Microsoft Security Bulletin MS03-026).
Related files:
%System%\mmsvc32.exe
Adds the value:
"Microsoft Network Services Controller" = "%System%\mmsvc32.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill mmsvc32.exe process and remove mmsvc32.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\mmtask.exe

%SysDir%\mmtask.exe is Trojan/Backdoor.
Kill the process mmtask.exe and remove %SysDir%\mmtask.exe from Windows using RegRun.
www.regrun.com
Read more: http://www.symantec.com/avcenter/venc/da...

%sysdir%\mmx19g.sys

mmx19g.sys is rootkit Trojan.Haxdoor-DM.
mmx19g.sys is used to hide files, processes and registry.
mmx19g.sys is a kernel mode rootkit.
Rootkit contacts remote hacker server using HTTP session.
mmx19g.sys tries to terminate antiviral programs installed on a user computer.
Related files:
%SysDir%\aszzxewaqo.vb
%SysDir%\mmx19g.sys
%SysDir%\qz.dll
%SysDir%\qz.sys
%SysDir%\wa114.ini
%SysDir%\xmm13g.dll

mmx19g.sys is created new system drivers:
service name: " mmx19g"
display name: "MMX virtualization service"

service name: "mmx13g"
display name: "MMX2 virtualization service"
Added to registry:
HKLM\SYSTEM\CurrentControlSet\Services\mmx19g
HKLM\SYSTEM\CurrentControlSet\Services\xmm13g

Adds the value:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\xmm13g
DllName
xmm13g.dll

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\xmm13g
Startup
DsWinlogon

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\xmm13g
Impersonate
1
to the Windows startup registry keys.
More info: http://www.sophos.com/security/analyses/...

%sysdir%\mmxf32.dll

mmxF32.dll is rootkit Trojan.Haxdoor-BO.
mmxF32.dll is used to hide files, processes and registry.
mmxF32.dll is a kernel mode rootkit.
Rootkit contacts remote hacker server using HTTP session.
mmxF32.dll tries to terminate antiviral programs installed on a user computer.
Related files:
%SysDir%\klgcptini.dat
%SysDir%\mmxF32.dll
%SysDir%\mmxF64.sys
%SysDir%\qz.dll
%SysDir%\qz.sys
%SysDir%\stt82.ini

mmxF64.sys is created new system drivers:
service name: "mmxF32"
display name: "MMX2 virtualization service"
Added to registry:
HKLM\SYSTEM\CurrentControlSet\Services\mmxF32\

Adds the value:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\mmxF32
DllName
mmxF32.dll

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\mmxF32
Startup
KeLoadData

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\mmxF32
Impersonate
1
to the Windows startup registry keys.
More info: http://www.sophos.com/security/analyses/...

%sysdir%\mneck.exe

MNeck.exe is a Trojan.Clicker-AG.
MNeck.exe opens a back door.
Related files:
C:\log.log
%System%\MNeck.exe
%System%\noctrn.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill MNeck.exe process and remove MNeck.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\mnswinsx.exe

mnswinsx.exe is a Trojan W32.Rbot-AWH.
mnswinsx.exe opens a back door on IRC channels.
mnswinsx.exe spreads via open network shares.
mnswinsx.exe tries to terminate antiviral programs installed on a user computer.
mnswinsx.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\mnswinsx.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill mnswinsx.exe process and remove mnswinsx.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\mnsys.exe

mnsys.exe is a Trojan W32.Sdbot-AFQ.
mnsys.exe opens a back door on IRC channels.
mnsys.exe spreads via open network shares.
Related files:
%System%\mnsys.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill mnsys.exe process and remove mnsys.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\moode.exe

Moode.exe is Trojan/Backdoor.Win32.Wootbot.

%sysdir%\mousebm.exe

mousebm.exe is a worm W32.Esbot.A.
mousebm.exe opens a back door.
mousebm.exe spreads via open network shares.
Related files:
%System%\mousebm.exe
%System%\mousemm.exe
%System%\mousesync.exe
More info: http://sarc.com/avcenter/venc/data/w32.e...
Removal:
Kill the process mousebm.exe and remove mousebm.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\mousecrm.exe

Mousecrm.exe is a Trojan Backdoor.Mousey.
Mousecrm.exe spreads via IRC channels.
Related files:
%System%\mousecrm.exe
Adds the value:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\mousecrm
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill mousecrm.exe process and remove mousecrm.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\mousedrv.exe

%SysDir%\MouseDrv.exe is TROJ_CRYPTER.A.
Read more: http://www.trendmicro.com/vinfo/virusenc...
Kill the process %SysDir%\MouseDrv.exe and remove %SysDir%\MouseDrv.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\mousemm.exe

mousemm.exe is a worm W32.Esbot.A.
mousemm.exe opens a back door.
mousemm.exe spreads via open network shares.
Related files:
%System%\mousebm.exe
%System%\mousemm.exe
%System%\mousesync.exe
More info: http://sarc.com/avcenter/venc/data/w32.e...
Removal:
Kill the process mousemm.exe and remove mousemm.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\mousepad10.exe

%SysDir%\mousepad10.exe is Malware.
Kill the process %SysDir%\mousepad10.exe and remove %SysDir%\mousepad10.exe from Windows startup using RegRun.
www.regrun.com

%sysdir%\mousesync.exe

mousesync.exe is a worm W32.Esbot.A.
mousesync.exe opens a back door.
mousesync.exe spreads via open network shares.
Related files:
%System%\mousebm.exe
%System%\mousemm.exe
%System%\mousesync.exe
More info: http://sarc.com/avcenter/venc/data/w32.e...
Removal:
Kill the process mousesync.exe and remove mousesync.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\mouseutils.exe

mouseutils.exe is a Trojan W32.Rbot-ABU.
mouseutils.exe opens a back door on IRC channels.
mouseutils.exe spreads via open network shares.
mouseutils.exe tries to terminate antiviral programs installed on a user computer.
mouseutils.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\mouseutils.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill mouseutils.exe process and remove mouseutils.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\mpcsvc.exe

%SysDir%\MPCSVC.EXE is Trojan/Ciadoor-AA.
Kill the process %SysDir%\MPCSVC.EXE and remove %SysDir%\MPCSVC.EXE from Windows startup using RegRun.
www.regrun.com

%sysdir%\mpr16.dll

mpr16.dll is a Trojan.LorSpy-A.
mpr16.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\PowerProf.exe
%System%\mpr16.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove mpr16.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\mqadonfg.dll

mqadonfg.dll is a worm W32.PPdoor-R.
mqadonfg.dll opens a back door.
mqadonfg.dll spreads via open network shares.
Related files:
%System%\arpo412.exe
%System%\mqadonfg.dll
%System%\winrpmsg.dll
%System%\wndfxyfi.dll
%System%\hgakheg.dll
%System%\vjoytl32.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove mqadonfg.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\mqssl;.exe

mqSSl;.exe is a mass-mailing worm W32.Mytob-GF.
mqSSl;.exe spreads via open network shares.
mqSSl;.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\mqSSl;.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill mqSSl;.exe process and remove mqSSl;.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\mrno4236.exe

MrNo4236.exe is a Trojan W32.Rbot-AQY.
MrNo4236.exe opens a back door on IRC channels.
MrNo4236.exe spreads via open network shares.
Related files:
%System%\MrNo4236.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill MrNo4236.exe process and remove MrNo4236.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\ms06365874237.exe

%SysDir%\ms06365874237.exe is Trojan/Backdoor.
Kill the process %SysDir%\ms06365874237.exe and remove %SysDir%\ms06365874237.exe from Windows startup.

%sysdir%\ms32.exe

Ms32.exe is Trojan/Backdoor SDBOT.BWH.
Kill the process ms32.exe and remove ms32.exe from Windows startup.

%sysdir%\msaol.dll

msaol.dll is a Trojan.Goldun.H.
msaol.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\msaol.dll
%Temp%\check.bmp
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove msaol.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\msaol32dll.exe

MSAOL32dll.exe is a Trojan W32.Rbot-ATA.
MSAOL32dll.exe opens a back door on IRC channels.
MSAOL32dll.exe spreads via open network shares.
Related files:
%System%\MSAOL32dll.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill MSAOL32dll.exe process and remove MSAOL32dll.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\msaol32drv.exe

MSAOL32drv.exe is a Trojan.Dropper-BL.
MSAOL32drv.exe opens a back door.
Related files:
%System%\MSAOL32drv.exe
%System%\MSAOL32dll.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill MSAOL32drv.exe process and remove MSAOL32drv.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\msaoldrv.exe

MSAOLdrv.exe is a Trojan W32.Rbot-ASP.
MSAOLdrv.exe opens a back door on IRC channels.
MSAOLdrv.exe spreads via open network shares.
Related files:
%System%\MSAOLdrv.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill MSAOLdrv.exe process and remove MSAOLdrv.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\msapplg.exe

Msapplg.exe is a Trojan.Delf-KS.
Msapplg.exe downloads code from the internet.
Related files:
%Windows%\services.exe
%System%\msapplg.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill msapplg.exe process and remove msapplg.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\msaq.exe

msaq.exe is Trojan/Backdoor.
Kill the process msaq.exe and remove msaq.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\msautou.exe

msautou.exe is a Trojan W32/Rbot-AOB.
msautou.exe opens a back door on IRC channel.
msautou.exe spreads via open network shares.
Related files:
%System%\msautou.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill msautou.exe process and remove msautou.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\msbcs.exe

msbcs.exe is a Trojan.Dadobra-K.
msbcs.exe downloads code from the internet.
Related files:
%System%\msbcs.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill msbcs.exe process and remove msbcs.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\msbd32.dll

%SysDir%\msbd32.dll is Trojan/Backdoor.
Remove msbd32.dll using RegRun "Scan for Viruses" feature.
http://www.regrun.com

%sysdir%\msbitsec.exe

msbitsec.exe is a Trojan W32.Sdbot-AJS.
msbitsec.exe opens a back door on IRC channels.
Related files:
%System%\msbitsec.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill msbitsec.exe process and remove msbitsec.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\msbnc.exe

msbnc.exe is a Trojan.Agent-PL.
msbnc.exe opens a back door.
Related files:
%System%\msbnc.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill msbnc.exe process and remove msbnc.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\msbnk.dll

msbnk.dll is a Trojan.Bankhof-B.
msbnk.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\msbnk.dll
%System%\rdrlib.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove msbnk.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\mschk.dll

Mschk.dll is a mass-mailing worm W32.Aprilcone.A@mm.
Mschk.dll spreads by e-mail.
Related files:
%System%\syscon.exe
%System%\mschk.dll
%System%\Watcher.dll
%System%\sysMon.dll
%System%\syslog.dll
%System%\atchk.dll
%System%\sysmsg.dll
%System%\chkrun.dll
%System%\dskchk.dll
%System%\msevent.dll
%System%\ipchk.dll
%System%\client.dll
%System%\servr.dll
%System%\netchk.dll
%System%\mssys.dll
Adds the value:
"syscon" = "%System%\syscon.exe"
"AppInit_DLLs" = "%System%\Watcher.dll"
to the Windows startup registry keys.

More info: http://securityresponse.symantec.com/avc...
Removal:
Remove mschk.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\mscom32.dll

%SysDir%\MSCOM32.DLL is Troj/Agent-KZ.
Kill the file %SysDir%\MSCOM32.DLL and remove %SysDir%\MSCOM32.DLL from Windows using RegRun.
www.regrun.com

%sysdir%\msconfgh.exe

msconfgh.exe is a mass-mailing worm W32.Mytob-FZ.
msconfgh.exe opens a back door on IRC channels.
msconfgh.exe spreads via open network shares and by e-mail.
Related files:
%System%\msconfgh.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill msconfgh.exe process and remove msconfgh.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\msconfig.exe

%SysDir%\msconfig.exe is W32.Amend.A@mm.
W32.Amend.A@mm is a mass-mailing worm that also copies itself to removable drives.
Related files:
%System%\msconfig.exe
%System%\regedit.exe
%System%\regedit32.com
%Windir%\Temp\internat.exe
%Windir%\Web\kav.exe
%Windir%\log.ini
Read more: http://www.symantec.com/enterprise/secur...
Kill the process %SysDir%\msconfig.exe and remove %SysDir%\msconfig.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\mscos.dll

mscos.dll is a Trojan.Goldun-AC.
mscos.dll monitors user Internet activity and bank information.
It sends stolen data to a hacker site.
Related files:
%System%\mscos.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove mscos.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\mscrt32.exe

MsCrt32.exe is a mass-mailing worm W32.AJM.Worm.
MsCrt32.exe spreads by e-mail and via open network shares.
Related files:
%System%\User32Rem.exe
%System%\UserGDL.exe
%System%\BihUpdate.exe
%System%\SysRtw32.exe
%System%\Win32Dll.exe
%System%\MsCrt32.exe
%System%\Temp32.exe
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill MsCrt32.exe process and remove MsCrt32.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\mscsclient.exe

Mscsclient.exe is an adware program Adware.CashSaver.
Mscsclient.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
csinstall.exe
%System%\mscsclient.exe
%System%\cashsaverbho.dll
%System%\csuninstall.exe
%System%\56171D04\E5C5BDB4.exe
%System%\csupdate.info
%System%\mscsclient.ekw
Adds the value:
"00D34A52" = "%System%\56171D04\E5C5BDB4.exe"
"MSCSCLIENT" = "%System%\mscsclient.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill mscsclient.exe process and remove mscsclient.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\msctl32.dll

MSCTL32.DLL is rootkit Backdoor.Rustock.
MSCTL32.DLL opens a back door on random TCP port.
MSCTL32.DLL is used to hide files, processes and registry.
MSCTL32.DLL is a kernel mode rootkit.
Rootkit injects itself into the winlogon.exe process.
Rootkit contacts remote hacker server using HTTP session.
Related files:
%SysDir%\drivers\I386P.SYS
%SysDir%\MSCTL32.DLL

I386P.SYS is created new system drivers:
service name: " wincom32"

Adds the value:
"Asynchronous" = "1"
"DllName" = "[NAME_OF_TROJAN_DLL].DLL"
"Impersonate" = "0"
"Startup" = "Startup"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Winlogon\Notify\msctl32.dll
to the Windows startup registry keys.
More info: http://www.symantec.com/security_respons...

%sysdir%\msctr.dll

msctr.dll is a Trojan.Bankhof-E.
msctr.dll monitors user Internet activity and bank information.
It sends stolen data to a hacker site.
Related files:
%System%\rdrlib.dll
%System%\msctr.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove msctr.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\mscunt32.exe

mscunt32.exe is a Trojan W32.Rbot-BLE.
mscunt32.exe opens a back door on IRC channels.
mscunt32.exe spreads via open network shares.
Related files:
%System%\mscunt32.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill mscunt32.exe process and remove mscunt32.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\msdconfig.exe

msdconfig.exe is a worm W32.Rbot-CZH.
msdconfig.exe opens a back door on IRC channels.
msdconfig.exe spreads via open network shares.
msdconfig.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\msdconfig.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill the process msdconfig.exe and remove msdconfig.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\msdef.exe

msdef.exe is a worm W32.Secefa.A.
msdef.exe opens a back door.
msdef.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\msdef.exe
%System%\services.exe
%System%\ws3lib.exe
%Windir%\dodrrr.exe
%System%\qwe.bat
%System%\ftp.scr
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill msdef.exe process and remove msdef.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\msdef3.exe

%SysDir%\msdef3.exe is Trojan/Backdoor.
Kill the process msdef3.exe and remove msdef3.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\msdev32.exe

Msdev32.exe is a mass-mailing worm W32.Mytob.EH@mm.
Msdev32.exe opens a back door on IRC channal.
Msdev32.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\msdev32.exe
Adds the value:
"WINDOWS SYSTEM" = "msdev32.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill msdev32.exe process and remove msdev32.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\msdf.exe

%SysDir%\msdf.exe is Trojan/Backdoor.
Kill the process msdf.exe and remove msdf.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\msdhcps.exe

%SysDir%\MSDHCPS.EXE is Trojan/Backdoor.
Kill the process MSDHCPS.EXE and remove MSDHCPS.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\msdirect.exe

msdirect.exe is a Trojan.Certif-L.
msdirect.exe monitors user Internet activity and bank information.
It sends stolen data to a hacker site.
Related files:
%System%\msdirect.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill msdirect.exe process and remove msdirect.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\msdirect.sys

Msdirect.sys is Trojan.NTRootKit.
Kill the file msdirect.sys and remove msdirect.sys from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\msdl32.exe

%SysDir%\MSDL32.EXE is Trojan/Backdoor.
Kill the process %SysDir%\MSDL32.EXE and remove %SysDir%\MSDL32.EXE from Windows using RegRun.
www.regrun.com

%sysdir%\msdll.dll

Msdll.dll is a Trojan PWSteal.Wowcraft.
Msdll.dll tries to terminate antiviral programs installed on a user computer.
Msdll.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%ProgramFiles%\svhost32.exe
%ProgramFiles%\rundll32.exe
%ProgramFiles%\Internat.exe
%System%\msdll.dll
Adds the value:
"load" = "[Path of the dropped file from step 1]"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove msdll.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\msdos.dll

msdos.dll is a Trojan.Goldun-AF.
msdos.dll monitors user Internet activity and bank information.
It sends stolen data to a hacker site.
Related files:
%Temp%\WithLove.jpg
%System%\msdos.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove msdos.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\msdtsc.exe

msdtsc.exe is a Trojan.Keylog-BM.
msdtsc.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\msdtsc.exe
%System%\msdatl.ocx
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill msdtsc.exe process and remove msdtsc.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\msdupd.exe

msdupd.exe is worm W32.Rbot-BCE.
msdupd.exe opens a back door.
msdupd.exe spreads via open network shares.
msdupd.exe tries to terminate antiviral programs installed on a user computer.
msdupd.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\msdupd.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill msdupd.exe process and remove msdupd.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\msed32.exe

msed32.exe is a Trojan W32.Rbot-AWR.
msed32.exe opens a back door on IRC channels.
msed32.exe spreads via open network shares.
Related files:
%System%\msed32.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill msed32.exe process and remove msed32.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\msek.exe

%SysDir%\msek.exe is Trojan/Backdoor Feebs.
Kill the process %SysDir%\msek.exe and remove %SysDir%\msek.exe from Windows startup using RegRun Reanimator.
http://www.greatis.com/security/Removal_...

%sysdir%\msem.exe

%SysDir%\msem.exe is Trojan/Backdoor Feebs.
Kill the process %SysDir%\msem.exe and remove %SysDir%\msem.exe from Windows startup using RegRun Reanimator.
http://www.greatis.com/security/Removal_...

%sysdir%\msevent.dll

Msevent.dll is a mass-mailing worm W32.Aprilcone.A@mm.
Msevent.dll spreads by e-mail.
Related files:
%System%\syscon.exe
%System%\mschk.dll
%System%\Watcher.dll
%System%\sysMon.dll
%System%\syslog.dll
%System%\atchk.dll
%System%\sysmsg.dll
%System%\chkrun.dll
%System%\dskchk.dll
%System%\msevent.dll
%System%\ipchk.dll
%System%\client.dll
%System%\servr.dll
%System%\netchk.dll
%System%\mssys.dll
Adds the value:
"syscon" = "%System%\syscon.exe"
"AppInit_DLLs" = "%System%\Watcher.dll"
to the Windows startup registry keys.

More info: http://securityresponse.symantec.com/avc...
Removal:
Remove msevent.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\msexreg.exe

Msexreg.exe is an adware program Adware.BargainBuddy.
Msexreg.exe downloads and displays advertisements.
Related files:
Apuc.dll;
Autoheal.exe
%System%\angelex.exe
%System%\instsrv.exe
%System%\msexreg.exe
%System%\bbchk.exe
%System%\exclean.exe
%System%\exdl.exe
%System%\exdl0.exe
%System%\exdl1.exe
%System%\exul.exe
%System%\msbe.dll
%System%\msxct.exe
%ProgramFiles%\BullsEye Network\bin\adv.exe
%ProgramFiles%\BullsEye Network\bin\adx.exe
%ProgramFiles%\BullsEye Network\bin\bargains.exe
%ProgramFiles%\BullsEye Network\Uninstall.exe
%Windows%\bbchk.exe
%Windows%\exclean.exe
%Windows%\exdl.exe
%Windows%\exul.exe
%Windows%\msbe.dll
%Windows%\msxct.exe
%Windows%\zeta.exe
Adds the value:
"[File name of adware]" = "[File path to adware]"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill msexreg.exe process and remove msexreg.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\msfiles.exe

Msfiles.exe is an adware program Adware.Adtest.
Msfiles.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\intnets.exe
%System%\scridows.exe
%System%\sysinfer.exe
%Windir%\msfiles.exe
Adds the value:
"intnets" = "%System%\intnets.exe"
"sysinfer" = "%System%\sysinfer.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill msfiles.exe process and remove msfiles.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\msfsr.sys

msfsr.sys is rootkit W32/Piggi-A.
msfsr.sys is used to hide files, processes and registry.
msfsr.sy sis a kernel mode rootkit.
msfsr.sys spreads by e-mail and via open network shares.
msfsr.sys tries to terminate antiviral programs installed on a user computer.
Related files:
%WinDir\lsass.exe
%Program Files%\Internet Explorer\iexplore.exe
%SysDir%\dllcache\svchost.exe
%WinDir%\svchost.exe
%System%\drivers\.sys
%System%\msfsr.sys
\zyxwvuts.log

msfsr.sys is created new system drivers:
service name: " msfsr"
display name: " msfsr"
Added to registry:
HKLM\SYSTEM\CurrentControlSet\Services\msfsr

Adds the value:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Shell
explorer.exe %WindDir%\lsass.exe

HKLM\SYSTEM\CurrentControlSet\Services\wuauserv
Start
3
to the Windows startup registry keys.
Added to registry:
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\
Parameters\FirewallPolicy
StandardProfile\AuthorizedApplications\List

\:*:enabled:@xpsp2res.dll,-22019

More info: http://www.sophos.com/security/analyses/...

%sysdir%\msftcpip.sys

msftcpip.sys is rootkit Trojan.Haxdoor-AI.
msftcpip.sys is used to hide files, processes and registry.
msftcpip.sys is a kernel mode rootkit.
Rootkit contacts remote hacker server using HTTP session.
msftcpip.sys tries to terminate antiviral programs installed on a user computer.
msftcpip.sys created new system drivers:
service name: "msftcpip"
display name: "TCPservice"
Added to registry:
HKLM\SYSTEM\CurrentControlSet\Services\msftcpip\

Related files:
%SysDir%\msftcpip.sys
%SysDir%\tcpGDC.dll
Adds the value:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\tcpGDC
DllName
tcpGDC.dll

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\tcpGDC
Startup
tcpGDC

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\tcpGDC
Impersonate
1
to the Windows startup registry keys.

More info: http://www.sophos.com/virusinfo/analyses...

%sysdir%\msg117.dll

msg117.dll is an adware program Adware.ZestyFind.
msg117.dll downloads and display advertisements.
msg117.dll monitors user Internet activity.
Related files:
%System%\msg117.dll
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove msg117.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\msgfix32.exe

msgfix32.exe is a Trojan W32.Sdbot-AGH.
msgfix32.exe opens a back door on IRC channels.
msgfix32.exe spreads via open network shares.
Related files:
%System%\msgfix32.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill msgfix32.exe process and remove msgfix32.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\msgina32.exe

msgina32.exe is a Trojan.Vipgsm-AB.
msgina32.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\msgina32.exe
%System%\itstore.dll
%System%\msshell.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill msgina32.exe process and remove msgina32.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\msgms.exe

%SysDir%\MSGMS.EXE is Trojan/Backdoor.
Kill the process MSGMS.EXE and remove MSGMS.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\msgs.exe

%SysDir%\msgs.exe is Trojan/Backdoor W32.Feebs.A.
Kill the file %SysDir%\msgs.exe and remove %SysDir%\msgs.exe from Windows startup.
http://securityresponse.symantec.com/avc...

%sysdir%\msgsm32.exe

msgsm32.exe is a Trojan W32.Rbot-ASG.
msgsm32.exe opens a back door on IRC channels.
msgsm32.exe spreads via open network shares.
Related files:
%System%\msgsm32.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill msgsm32.exe process and remove msgsm32.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\msguid32.dll

msguid32.dll is a Trojan W32.Francette-X.
msguid32.dll opens a back door on IRC channels.
msguid32.dll spreads via open network shares.
msguid32.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\msguid32.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove msguid32.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\msgupdat32.exe

MSGUPDAT32.EXE is a Trojan W32.Rbot-BBB.
MSGUPDAT32.EXE opens a back door on IRC channels.
MSGUPDAT32.EXE spreads via open network shares.
Related files:
%System%\MSGUPDAT32.EXE
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill MSGUPDAT32.EXE process and remove MSGUPDAT32.EXE from Windows startup using RegRun Startup Optimizer.

%sysdir%\msgupdated.exe

MSGUPDATED.EXE is a Trojan W32.Rbot-APZ.
MSGUPDATED.EXE opens a back door on IRC channels.
MSGUPDATED.EXE spreads via open network shares.
MSGUPDATED.EXE tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\MSGUPDATED.EXE.
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill MSGUPDATED.EXE process and remove MSGUPDATED.EXE from Windows startup using RegRun Startup Optimizer.

%sysdir%\mshatma.exe

%SysDir%\mshatma.exe is Trojan/Backdoor.
Kill the process %SysDir%\mshatma.exe and remove %SysDir%\mshatma.exe from Windows startup.

%sysdir%\mshelp32.exe

mshelp32.exe is a worm W32.Kelvir-BF.
mshelp32.exe spreads via AOL Instant Messenger.
Related files:
%System%\mshelp32.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill mshelp32.exe process and remove mshelp32.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\mshms.exe

mshms.exe is a Trojan.Wollf-A.
mshms.exe opens a back door.
mshms.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\mshms.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill mshms.exe process and remove mshms.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\mshost.exe

mshost.exe is a Trojan W32.Rbot-AND.
mshost.exe opens a back door.
mshost.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\mshost.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill mshost.exe process and remove mshost.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\mshost32.exe

mshost32.exe is a internet banking Trojan.IBank-F.
More info: http://www.sophos.com/virusinfo/analyses...
Kill the process mshost32.exe and remove mshost32.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\mshotmon.exe

mshotmon.exe is a mass-mailing worm W32.Mytob-FL.
mshotmon.exe opens a back door on IRC channels.
mshotmon.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\mshotmon.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill mshotmon.exe process and remove mshotmon.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\msiecfg.exe

msiecfg.exe is a Trojan.Bdoor-JU.
msiecfg.exe opens a back door.
Related files:
%System%\msiecfg.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill msiecfg.exe process and remove msiecfg.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\msiehelp.exe

msiehelp.exe is a Trojan.Iyus-P.
msiehelp.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\msiehelp.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill msiehelp.exe process and remove msiehelp.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\msiesetup.exe

%SysDir%\msiesetup.exe is Trojan/Backdoor.
Kill the process msiesetup.exe and remove msiesetup.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\msiexec.dll

%SysDir%\msiexec.dll is Zango Adware.
Kill the file %SysDir%\msiexec.dll and remove %SysDir%\msiexec.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\msiisdrv.exe

Msiisdrv.exe is rootkit Backdoor.Isen.Rootkit.
Msiisdrv.exe is used to hide files, processes and registry.
Msiisdrv.exe is a kernel mode rootkit.
Rootkit injects itself into other process.
Msiisdrv.exe created new system service:
"Microsoft Internet Information Services kernel mode driver".
Msiishlp.exe created new system service:
"Microsoft IIS helper"
Related files:
%SysDir%\Msiisdrv.exe
%SysDir%\Msiishlp.exe
More info: http://www.symantec.com/security_respons...

%sysdir%\msime.exe

%SysDir%\msime.exe is Trojan/Backdoor.
Kill the process msime.exe and remove msime.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\msinet.exe

Msinet.exe is a Trojan W32.Rbot-AOA.
Msinet.exe opens a back door on IRC channel.
Msinet.exe tries to terminate antiviral programs installed on a user computer.
Msinet.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\Msinet.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill Msinet.exe process and remove Msinet.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\msinfmgr.exe

%SysDir%\msinfmgr.exe is Trojan/Backdoor.
Kill the process msinfmgr.exe and remove msinfmgr.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\msisexec.exe

msisexec.exe is a Trojan.GWGhost-BA.
msisexec.exe opens a back door.
msisexec.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\msisexec.exe
%System%\inetapi32.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill the process msisexec.exe and remove msisexec.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\msitinit.dll

%SysDir%\msitinit.dll is an information stealing Trojan.Wlook-A.
Remove msitinit.dll using RegRun "Scan for Viruses" feature.
http://www.regrun.com

%sysdir%\msits.exe

msits.exe is Trojan/Backdoor.
Kill the process msits.exe and remove msits.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\msiz.exe

%SysDir%\msiz.exe is Trojan/Backdoor Feebs.
Kill the process %SysDir%\msiz.exe and remove %SysDir%\msiz.exe from Windows startup using RegRun Reanimator.
http://www.greatis.com/security/Removal_...

%sysdir%\msjcf.exe

msjcf.exe is a Trojan.Raker-B.
msjcf.exe opens a back door.
Related files:
%System%\msjcf.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill msjcf.exe process and remove msjcf.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\msjdbc11.dll

msjdbc11.dll is a mass-mailing worm W32.Lovgate.
msjdbc11.dll opens a back door.
msjdbc11.dll tries to terminate antiviral programs installed on a user computer.
Related files:
%system%\Kernel66.dll
%system%\RAVMOND.exe
%windir%\SYSTRA.exe
%SysDir%\msjdbc11.dll
%SysDir%\MSSIGN30.DLL
%SysDir%\ODBC16.dll
%SysDir%\Lmmib20.dll
More info: http://www.viruslist.com/en/viruses/ency...
Removal:
Remove msjdbc11.dll using RegRun "Scan for Viruses" feature.

%sysdir%\msjet62.dll

msjet62.dll is rootkit W32/Dbit-B.
msjet62.dll is used to hide files, processes and registry.
msjet62.dll is a kernel mode rootkit.
msjet62.dll opens a back door.
msjet62.dll tries to terminate antiviral programs installed on a user computer.
msjet62.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.

Related files:
%SysDir%\msjet62.dll

msjet62.dll is created new system drivers:
service name: "Irmon"
display name: "Portable Media Serial Number Service"
Adds the value:
HKLM\SYSTEM\CurrentControlSet\Services\Irmon\
to the Windows startup registry keys.
More info: http://www.sophos.com/virusinfo/analyses...

%sysdir%\msjp32.exe

msjp32.exe is a Trojan.Ranck-DE.
msjp32.exe opens a back door.
Related files:
%System%\msjp32.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill msjp32.exe process and remove msjp32.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\msjt32.exe

%SysDir%\msjt32.exe is Trojan/Backdoor.
Kill the process %SysDir%\msjt32.exe and remove %SysDir%\msjt32.exe from Windows startup using RegRun.
www.regrun.com

%sysdir%\mskg.exe

%SysDir%\mskg.exe is Trojan/Backdoor.
Kill the process %SysDir%\mskg.exe and remove %SysDir%\mskg.exe from Windows startup using RegRun Reanimator.
http://www.greatis.com/security/Removal_...

%sysdir%\mskik32c.exe

mskik32c.exe is a Trojan W32.Rbot-BBR.
mskik32c.exe opens a back door on IRC channels.
mskik32c.exe spreads via open network shares.
Related files:
%System%\mskik32c.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill mskik32c.exe process and remove mskik32c.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\mskiks.exe

mskiks.exe is a mass-mailing worm W32.Skenkly.A@mm.
mskiks.exe opens a back door on IRC channels.
mskiks.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\mskiks.exe
%System%\winzipk.zip
%System%\kikrun.kik
Adds the value:
"Microsoft WinXP Spooler SubSystem" = "%System%\mskiks.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill the process mskiks.exe and remove mskiks.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\mskl.exe

mskl.exe is a W32.Feebs!rootkit.
mskl.exe is a user mode rootkit.
mskl.exe hide files containing the string "_new!_full+crack.zip".
mskl.exe is used to hide registry keys containing the string "{22235B37-92F6-915C-DE5B-3B3D4DBC5730}".
Hooking the following Windows APIs:
FindFirstFile
FindNextFile
RegEnumEx
RegEnumKey
RegEnumValue
mskl.exe spreads by e-mail and via open network shares.

Related files:
%SysDir%\mskl32.dll
%SysDir%\mskl.exe

Added to registry:
HKEY_CLASSES_ROOT\CLSID\{22235B37-92F6-915C-DE5B-3B3D4DBC5730}\InprocServer32
HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{22235B37-92F6-915C-DE5B-3B3D4DBC5730}
@="%Windir%\%SYSDIR%\mskl32.dll"

Adds the value:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad
"mskl32.dll" = "{22235B37-92F6-915C-DE5B-3B3D4DBC5730}"
to the Windows startup registry keys.
More info: http://ca.mcafee.com/virusInfo/default.a...

%sysdir%\msld.dll

Msld.dll is a Trojan Trojan.Spbot.B.
Msld.dll spreads by e-mail and via open network shares.
Msld.dll sends spam.
Related files:
%System%\msld.dll
%System%\divxenc.exe
Adds the value:
"divx" = "%System%\divxenc.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove msld.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\mslogon.dll

mslogon.dll is a Trojan.Vipgsm-K.
mslogon.dll spreads via open network shares.
mslogon.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\mstcpmon.exe
%System%\chkdskw.exe
%System%\itstore.dll
%System%\karnal32.dll
%System%\mslogon.dll
%System%\mswshell.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove itstore.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\mslti32.exe

MSlti32.exe is a Trojan W32.Rbot-BAR.
MSlti32.exe opens a back door.
MSlti32.exe spreads via open network shares.
MSlti32.exe tries to terminate antiviral programs installed on a user computer.
MSlti32.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\MSlti32.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill MSlti32.exe process and remove MSlti32.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\msmail.exe

%SysDir%\msmail.exe is Rootki&Virus, clone of HackerDefender.
Kill the process %SysDir%\msmail.exe and remove %SysDir%\msmail.exe from Windows startup.
Use UnHackMe to fully remove hidden services and drivers.
www.unhackme.com
Related files:
- mssave.exe
- msinit.exe
- msmail.exe
- mstsk.exe
- lsnr32w.exe
- lsnr32w.dll
- memdrv.sys
- msclean.exe
- msinit.exe
- mslsnre.exe
- pack.exe
- shide32w.exe
- shide32w.ini
- smss.all
- tiinject.exe
- tinject.dll
- tinject.exe
http://webserver1.furman.edu/computing/c...

%sysdir%\msmgs.exe

msmgs.exe is a Trojan.Mkmoose-B.
msmgs.exe opens a back door.
Related files:
%System%\msmgs.exe
%System%\mtask.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill msmgs.exe process and remove msmgs.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\msmnart32.exe

msmnart32.exe is a Trojan W32.Rbot-CJV.
msmnart32.exe opens a back door.
msmnart32.exe deletes files off the computer.
msmnart32.exe tries to terminate antiviral programs installed on a user computer.
msmnart32.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\msmnart32.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill msmnart32.exe process and remove msmnart32.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\msmntgnt.exe

msmntgnt.exe is a Trojan.Banker-IE.
msmntgnt.exe monitors user Internet activity and bank information.
It sends stolen data to a hacker site.
Related files:
%System%\msmntgnt.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill msmntgnt.exe process and remove msmntgnt.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\msmntjbe.exe

msmntjbe.exe is a Trojan.Bancos-EF.
msmntjbe.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\msmntjbe.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill msmntjbe.exe process and remove msmntjbe.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\msmntush.exe

msmntush.exe is a Trojan.Banker-IC.
msmntush.exe monitors user Internet activity and bank information.
It sends stolen data to a hacker site.
Related files:
%System%\msmntush.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill msmntush.exe process and remove msmntush.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\msmnwin.exe

Msmnwin.exe is a worm W32.Kelvir.FK.
Msmnwin.exe spreads through MSN Messenger.
Related files:
%System%\msmnwin.exe
%System%\msnmesgr.exe
C:\mswindrvr.exe
Adds the value:
"MSN Registry loader" = "msmnwin.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill msmnwin.exe process and remove msmnwin.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\msmsg.exe

%SysDir%\Msmsg.exe is Trojan/Backdoor Backdoor.Simali.
Kill the process %SysDir%\Msmsg.exe and remove %SysDir%\Msmsg.exe from Windows startup.
Copies itself to the %System% folder as some of the following:
* Loader.exe
* Main.exe
* Lass.exe
* Msmsg.exe
http://securityresponse.symantec.com/avc...

%sysdir%\msmsgr.exe

Msmsgr.exe is a worm W32.Kelvir.HI.
Msmsgr.exe spreads through MSN Messenger.
Related files:
%System%\msmsgr.exe
Adds the value:
"MSN Messenger User Controls" = "msmsgr.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill msmsgr.exe process and remove msmsgr.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\msmsgs.exe

Msmsgs.exe is a back door Trojan.Zlob.B.
Msmsgs.exe spreads via open network shares.
Related files:
%System%\msmsgs.exe
Adds the value:
"RegSvr32" = "%System%\msmsgs.exe"
"Shell" = "Explorer.exe, msmsgs.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill msmsgs.exe process and remove msmsgs.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\msmsngr.exe

msmsngr.exe is a Trojan W32.Dopbot-B.
msmsngr.exe opens a back door on IRC channel.
msmsngr.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\msmsngr.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill msmsngr.exe process and remove msmsngr.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\msn32.dll

MSN32.dll is a Spyware.PCTattletale.
MSN32.dll logs keystrokes.
MSN32.dll monitors user Internet activity.
Related files:
%ProgramFiles%\Common Files\InstallShield\Driver\7\Intel 32\IDriver.exe
%ProgramFiles%\Common Files\InstallShield\Driver\7\Intel 32\IScript7.dll
%ProgramFiles%\Common Files\InstallShield\Driver\7\Intel 32\ISRT.dll
%ProgramFiles%\Common Files\InstallShield\Driver\7\Intel 32\IUser7.dll
%ProgramFiles%\Common Files\InstallShield\Driver\7\Intel 32\objps7.dll
%ProgramFiles%\Common Files\InstallShield\Driver\7\Intel 32\_ISRES1033.dll
%System%\explorer32\AutoUpdate.dll
%System%\explorer32\AutoUpdateClient.exe
%System%\explorer32\chattext.dll
%System%\explorer32\msn6mngr.exe
%System%\explorer32\Netlogon.exe
%System%\explorer32\Wincmd.exe
%System%\explorer32\WinSysMngr.exe
%System%\MSN32.dll
%System%\PCTT.exe
%System%\UninstallPCTT.exe
%System%\Unzip32.dll
%System%\WinLoad.exe
%System%\zip32.dll
Adds the value:
"(default)" = ""
"WinLoad" = "%System%\Winload.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove MSN32.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\msn32.exe

msn32.exe is a mass-mailing worm W32.Mytob-FX.
msn32.exe opens a back door on IRC channels.
msn32.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\msn32.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill msn32.exe process and remove msn32.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\msn5.exe

msn5.exe is a Trojan W32.Agobot-TW.
msn5.exe opens a back door.
msn5.exe spreads via open network shares.
Related files:
%System%\msn5.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill msn5.exe process and remove msn5.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\msnadp32.exe

msnadp32.exe is rootkit W32/Bropia-W.
msnadp32.exe is used to hide files, processes and registry.
msnadp32.exe is a kernel mode rootkit.
msnadp32.exe spreads by e-mail and via MSN Messenger.
Related files:
%SysDir%\msnadp32.exe
%Tmp%\ImSexy.exe
Adds the value:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
MSN Administration For Windows
msnadp32.exe
to the Windows startup registry keys.
More info: http://www.sophos.com/virusinfo/analyses...

%sysdir%\msnchecker.exe

msnchecker.exe is a Trojan W32.Sdbot-AGB.
msnchecker.exe opens a back door on IRC channels.
msnchecker.exe spreads via AOL Instant Messenger.
Related files:
%System%\msnchecker.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill msnchecker.exe process and remove msnchecker.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\msnd32.exe

MSND32.EXE is a worm W32.Rbot-AAL.
MSND32.EXE opens a back door on IRC channels.
MSND32.EXE spreads via open network shares.
Related files:
%System%\MSND32.EXE
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill MSND32.EXE process and remove MSND32.EXE from Windows startup using RegRun Startup Optimizer.

%sysdir%\msndrvsys.dll

msndrvsys.dll is a Trojan.Brogger-D.
msndrvsys.dll monitors user Internet activity and bank information.
It sends stolen data to a hacker site.
Related files:
%System%\dllcboxz.dll
%System%\msndrvsys.dll
%System%\msndrvsys.exe
%System%\xrosario.sdf
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove msndrvsys.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\msndrvsys.exe

msndrvsys.exe is a Trojan.Brogger-D.
msndrvsys.exe monitors user Internet activity and bank information.
It sends stolen data to a hacker site.
Related files:
%System%\dllcboxz.dll
%System%\msndrvsys.dll
%System%\msndrvsys.exe
%System%\xrosario.sdf
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill msndrvsys.exe process and remove msndrvsys.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\msnethlp32.dll

msnethlp32.dll is a Trojan.Mitglie-DQ.
msnethlp32.dll opens a back door.
Related files:
%System%\msnethlp32.exe
%System%\msnethlp32.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill msnethlp32.exe process and remove msnethlp32.exe from Windows startup using RegRun Startup Optimizer.
Remove msnethlp32.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\msnethlp32.exe

msnethlp32.exe is a Trojan.Mitglie-DQ.
msnethlp32.exe opens a back door.
Related files:
%System%\msnethlp32.exe
%System%\msnethlp32.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill msnethlp32.exe process and remove msnethlp32.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\msnfilen.exe

msnfilen.exe is a Trojan W32.Rbot-AUY.
msnfilen.exe opens a back door on IRC channels.
msnfilen.exe spreads via open network shares.
Related files:
%System%\msnfilen.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill msnfilen.exe process and remove msnfilen.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\msnimsgr.exe

msnimsgr.exe is a Trojan W32.Rbot-BFM.
msnimsgr.exe opens a back door on IRC channels.
msnimsgr.exe spreads via open network shares.
msnimsgr.exe tries to terminate antiviral programs installed on a user computer.
msnimsgr.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\msnimsgr.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill msnimsgr.exe process and remove msnimsgr.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\msniu.exe

msniu.exe is a Trojan W32.Rbot-AWB.
msniu.exe opens a back door.
msniu.exe spreads via open network shares.
msniu.exe deletes files off the computer.
msniu.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\msniu.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill msniu.exe process and remove msniu.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\msniu3.exe

msniu3.exe is a Trojan W32.Rbot-AXB.
msniu3.exe opens a back door on IRC channels.
msniu3.exe spreads via open network shares.
msniu3.exe tries to terminate antiviral programs installed on a user computer.
msniu3.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\msniu3.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill msniu3.exe process and remove msniu3.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\msnl.exe

Msnl.exe is a mass-mailing worm W32.Mytob.IK@mm.
Msnl.exe opens a back door on TCP port 8881.
Msnl.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\msnl.exe
Adds the value:
"WINDOWS SYSTEM" = "msnl.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill msnl.exe process and remove msnl.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\msnmesgr.exe

Msnmesgr.exe is a worm W32.Kelvir.FK.
Msnmesgr.exe spreads through MSN Messenger.
Related files:
%System%\msmnwin.exe
%System%\msnmesgr.exe
C:\mswindrvr.exe
Adds the value:
"MSN Registry loader" = "msmnwin.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill msnmesgr.exe process and remove msnmesgr.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\msnmessenger.exe

Sdbot.AJ is a network-aware worm and Trojan.
Spreads in the local network using open shares.
Adds the value:
"Microsoft Windows Update" = "msnmessenger.exe"
to the Windows startup registry keys.
Opens a back door on the compromised system by connecting to an IRC server through TCP port 59 on the domain moskemongo.biz.
Attempts to spread to the following network shares:
* C$
* IPC$
* ADMIN$

%sysdir%\msnmsgr.exe

W32/Rbot-FQ is a worm which attempts to spread to remote network shares.
It also contains backdoor Trojan functionality, allowing unauthorised remote access to the infected computer via IRC channels while running in the background as a service process.

Copies itself to the file MSNMSGR.EXE in the Windows system folder and creates entries at the following locations in the registry so as to run itself on system startup, resetting them every minute:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

It sets the following registry entries every 2 minutes:
HKLM\SOFTWARE\Microsoft\Ole\EnableDCOM = "N"
HKLM\SYSTEM\CurrentControlSet\Control\Lsa\restrictanonymous = "1"

Attempts to delete network shares on the host computer every 2 minutes.
Attempts to terminate processes relating to some files.

Automatic Removal: Use RegRun Startup Optimizer to remove it from startup.

%sysdir%\msnmsgr16.exe

msnmsgr16.exe is a network worm W32.Rbot-RZ.
msnmsgr16.exe opens a back door on IRC channels.
msnmsgr16.exe tries to terminate antiviral programs installed on a user computer.
msnmsgr16.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\msnmsgr16.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill msnmsgr16.exe process and remove msnmsgr16.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\msnmsr.exe

%SysDir%\MsnMsr.exe is Trojan/Backdoor.
Kill the process MsnMsr.exe and remove MsnMsr.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\msnn.exe

msnn.exe is a Trojan W32.Rbot-AXT.
msnn.exe opens a back door on IRC channels.
msnn.exe spreads via open network shares.
Related files:
%System%\msnn.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill msnn.exe process and remove msnn.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\msnnm.exe

Msnnm.exe is a Trojan PWSteal.Revcuss.C.
Msnnm.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\msnnm.exe
%Windir%\msndr.exe
Adds the value:
"WinUpdate Loader" = "%System%\msnnm.exe"
"run" = "%Windir%\msndr.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill msnnm.exe process and remove msnnm.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\msnq3insller.exe

msnq3insller.exe is a Trojan W32.Rbot-ATL.
msnq3insller.exe opens a back door on IRC channels.
msnq3insller.exe spreads via open network shares.
msnq3insller.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\msnq3insller.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill msnq3insller.exe process and remove msnq3insller.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\msnscps.dll

msnscps.dll is a Trojan.Brospy-K.
msnscps.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\msnscps.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove msnscps.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\msnscr.exe

msnscr.exe is a Trojan.Certif-P.
msnscr.exe opens a back door.
msnscr.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\msnscr.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill msnscr.exe process and remove msnscr.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\msnserve.exe

msnserve.exe is a network-aware worm W32.Spybot.YQW.
msnserve.exe opens a back door on TCP port 7043.
msnserve.exe spreads via open network shares.
msnserve.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\msnserve.exe
Adds the value:
"Service Monitor" = "msnserve.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill msnserve.exe process and remove msnserve.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\msnsmgs.exe

msnsmgs.exe is a Trojan W32.Rbot-AVZ.
msnsmgs.exe opens a back door on IRC channels.
msnsmgs.exe spreads via open network shares.
msnsmgs.exe tries to terminate antiviral programs installed on a user computer.
msnsmgs.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\msnsmgs.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill msnsmgs.exe process and remove msnsmgs.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\msnsrcdv.exe

msnsrcdv.exe is Trojan/Backdoor.
Kill the process msnsrcdv.exe and remove msnsrcdv.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\msnsupdate.exe

msnsupdate.exe is a Trojan W32.Rbot-AXS.
msnsupdate.exe opens a back door on IRC channels.
msnsupdate.exe spreads via open network shares.
Related files:
%System%\msnsupdate.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill msnsupdate.exe process and remove msnsupdate.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\msnsyst32win.exe

msnsyst32win.exe is a Trojan.OptixP-M.
msnsyst32win.exe opens a back door.
Related files:
%System%\msnsyst32win.exe
%System%\qwinsyst32.exe
%System%\g78zghwin.exe
%System%\m87r8syst32.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill msnsyst32win.exe process and remove msnsyst32win.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\msnt.exe

Msnt.exe is Trojan/Backdoor.
Also it extracts and install msdirectx.sys driver.
Remove msdirectx.sys.
Kill the process msnt.exe and remove %SysDir%\msnt.exe from Windows startup.

%sysdir%\msnvl.exe

msnvl.exe is a Trojan.DownLdr-FI.
msnvl.exe opens a back door.
Related files:
%Windows%\csrss.exe
%System%\msnvl.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill msnvl.exe process and remove msnvl.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\msnwindows.exe

msnwindows.exe is a worm W32.Spybot.YCL.
msnwindows.exe opens a back door on TCP port 7043.
msnwindows.exe spreads via open network shares.
msnwindows.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\msnwindows.exe
Adds the value:
"System Service" = "msnwindows.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill msnwindows.exe process and remove msnwindows.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\msnxpexe.exe

msnxpexe.exe is a Trojan W32.Rbot-AUA.
msnxpexe.exe opens a back door on IRC channels.
msnxpexe.exe spreads via open network shares.
msnxpexe.exe tries to terminate antiviral programs installed on a user computer.
msnxpexe.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\msnxpexe.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill msnxpexe.exe process and remove msnxpexe.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\msnxpsp.exe

msnxpsp.exe is a Trojan W32.Rbot-ASK .
msnxpsp.exe opens a back door on IRC channels.
msnxpsp.exe spreads via open network shares.
Related files:
%System%\msnxpsp.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill msnxpsp.exe process and remove msnxpsp.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\msof.exe

%SysDir%\msof.exe is Trojan/Backdoor Feebs.
Kill the process %SysDir%\msof.exe and remove %SysDir%\msof.exe from Windows startup using RegRun Reanimator.
http://www.greatis.com/security/Removal_...

%sysdir%\msoff.exe

msoff.exe is rootkit Trojan.Raker-G.
msoff.exe is used to hide files, processes and registry.
msoff.exe is a user mode rootkit.
Rootkit injects itself into Explorer.
Rootkit contacts remote hacker server using HTTP session.
Related files:
%SysDir%\msoff.exe
%User%\Documents\Settings\desktop.ini
%User%\Documents\Settings\rvnkey_a.dat
%User%\Documents\Settings\rvnkey_b.dat
%User%\Documents\Settings\rvnkey_f.dat
%User%\Documents\Settings\rvnkey_v.dat
%User%\Documents\Settings\1.txt
Adds the value:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Microsoft Office
%SysDir%\msoff.exe
to the Windows startup registry keys.
More info: http://www.sophos.com/security/analyses/...

%sysdir%\msoffwz.exe

msoffwz.exe is a Trojan.Bancban-HQ.
msoffwz.exe opens a back door.
msoffwz.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\msoffwz.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill msoffwz.exe process and remove msoffwz.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\msoy.exe

%SysDir%\msoy.exe is Trojan/Backdoor Feebs.
Kill the process %SysDir%\msoy.exe and remove %SysDir%\msoy.exe from Windows startup using RegRun Reanimator.
http://www.greatis.com/security/Removal_...

%sysdir%\mspatch32.exe

mspatch32.exe is a worm W32/Rbot-AWF.
mspatch32.exe opens a back door on IRC channels.
mspatch32.exe spreads via open network shares.
Related files:
%System%\mspatch32.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill mspatch32.exe process and remove mspatch32.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\mspdnx.dll

%sysdir%\msping.exe

Msping.exe is a Trojan.Floodblack.
Msping.exe opens a back door.
Related files:
%System%\msping.exe
Adds the value:
"msping" = "%System%\msping.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill msping.exe process and remove msping.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\mspostsp.exe

mspostsp.exe is a Trojan.Jupdrop-B.
mspostsp.exe opens a back door.
Related files:
%System%\mspostsp.exe
%System%\msupdate32.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill mspostsp.exe process and remove mspostsp.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\msproto3.dll

msproto3.dll is a Trojan.Iefeat-AN.
msproto3.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%SysDir%\msproto3.dll
%SysDir%\msxmlpp.dll
%SysDir%\msvsres.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove msproto3.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\msqn32.dll

%SysDir%\msqn32.dll is Trojan/Backdoor.
Remove msqn32.dll using RegRun "Scan for Viruses" feature.
http://www.regrun.com

%sysdir%\msrdr2.sys

msrdr2.sys is rootkit Trojan.Haxdoor-AJ.
msrdr2.sys is used to hide files, processes and registry.
msrdr2.sys is a kernel mode rootkit.
Rootkit contacts remote hacker server using HTTP session.
msrdr2.sys created new system drivers:
service name: "msrdr2"
display name: "IP correction service"
Added to registry:
HKLM\SYSTEM\CurrentControlSet\Services\msrdr2\

Related files:
%SysDir%\msrdr2.sys
%SysDir%\rdrVR2.dll
Adds the value:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\rdrVR2
DllName
rdrVR2.dll

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\rdrVR2
Startup
rdrVR2

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\rdrVR2
Impersonate
1
to the Windows startup registry keys.

More info: http://www.sophos.com/virusinfo/analyses...

%sysdir%\msrep32.dll

msrep32.dll is a Spyware.BeyondKeylog.
msrep32.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%ProgramFiles%\Supremtec\csrss.exe
%System%\emconv.exe
%System%\rgtcvc32.dll
%System%\msrep32.dll
%System%\mstrc32.dll
More info:
Removal:
Remove msrep32.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\msriv1.sys

%sysdir%\msrll.exe

msrll.exe is a Trojan.Jtram-E.
msrll.exe opens a back door.
Related files:
%System%\mfm\msrll.exe
%System%\mfm\jtram.conf
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill msrll.exe process and remove msrll.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\msrsvp.exe

%SysDir%\msrsvp.exe is Trojan/Backdoor.
Msrsvp.exe modifies the value:
"ImagePath" = "%SYSTEM%\msrsvp.exe"
in the registry key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RSVP
Restore the ImagePath value:
%SystemRoot%\System32\rsvp.exe
Kill the process %SysDir%\msrsvp.exe and delete %SysDir%\msrsvp.exe.

%sysdir%\mssck.exe

Mssck.exe is a mass-mailing worm W32.Mytob.IE@mm .
Mssck.exe opens a back door on TCP port 1863.
Mssck.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\mssck.exe
Adds the value:
"Mircosoft Sockets SP2" = "mssck.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill mssck.exe process and remove mssck.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\msscript.exe

msscript.exe is a TrojanStartPa-HC.
msscript.exe changes browser settings for Microsoft Internet Explorer.
Related files:
%System%\gedit.exe
%System%\msscript.exe
%System%\systemr.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill msscript.exe process and remove msscript.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\mssearchnet.exe

mssearchnet.exe is a Trojan.Zlob.D.
mssearchnet.exe downloads and executes remote files.
Related files:
%System%\mssearchnet.exe
Adds the value:
"kernel32.dll" = "[TROJAN FILE NAME]"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill mssearchnet.exe process and remove mssearchnet.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\mssetupconf.exe

mssetupconf.exe is a Trojan W32.Rbot-BJA.
mssetupconf.exe opens a back door on IRC channels.
mssetupconf.exe spreads via open network shares.
Related files:
%System%\mssetupconf.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill mssetupconf.exe process and remove mssetupconf.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\msshed32.exe

msshed32.exe is a Trojan.Dloade-AAH.
msshed32.exe downloads code from the internet.
Related files:
%System%\atiupdate.exe
%System%\msshed32.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill msshed32.exe process and remove msshed32.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\msshell.dll

msshell.dll is a Trojan.Vipgsm-AB.
msshell.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\msgina32.exe
%System%\itstore.dll
%System%\msshell.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove msshell.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\mssign30.dll

MSSIGN30.DLL is a mass-mailing worm W32.Lovgate.
MSSIGN30.DLL opens a back door.
MSSIGN30.DLL tries to terminate antiviral programs installed on a user computer.
Related files:
%system%\Kernel66.dll
%system%\RAVMOND.exe
%windir%\SYSTRA.exe
%SysDir%\msjdbc11.dll
%SysDir%\MSSIGN30.DLL
%SysDir%\ODBC16.dll
%SysDir%\Lmmib20.dll
More info: http://www.viruslist.com/en/viruses/ency...
Removal:
Remove MSSIGN30.DLL using RegRun "Scan for Viruses" feature.

%sysdir%\mssnt.exe

mssnt.exe is a Trojan W32.Sdbot-AGJ.
mssnt.exe opens a back door.
mssnt.exe spreads via open network shares.
mssnt.exe tries to terminate antiviral programs installed on a user computer.
mssnt.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\mssnt.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill mssnt.exe process and remove mssnt.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\mssql.dll

%SysDir%\MSSQL.DLL is Trojan/Backdoor.
Kill the file %SysDir%\MSSQL.DLL and remove %SysDir%\MSSQL.DLL from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\msstill.exe

msstill.exe is a worm W32.Sdranck-V.
msstill.exe opens a back door.
msstill.exe spreads via open network shares.
Related files:
%System%\msstill.exe
%System%\rapking.exe
%System%\richword.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill msstill.exe process and remove msstill.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\mssvc32.exe

mssvc32.exe is a Trojan.Bancban-IO.
mssvc32.exe monitors user Internet activity and bank information.
It sends stolen data to a hacker site.
Related files:
%System%\mssvc32.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill mssvc32.exe process and remove mssvc32.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\mssvcc.exe

mssvcc.exe is a worm W32.Rbot-BJV.
mssvcc.exe opens a back door on IRC channels.
mssvcc.exe spreads via open network shares.
Related files:
%System%\mssvcc.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill mssvcc.exe process and remove mssvcc.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\msswebcheck32.dll

msswebcheck32.dll is a Trojan.IRCBot-CE.
msswebcheck32.dll opens a back door on IRC channels.
Related files:
%System%\msswebcheck32.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove msswebcheck32.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\mssyncr.exe

Trojan Anits.

Copy his body to files:
%System%\mssyncr.exe
%Windir%\services.exe

Uses Active Setup key to autostartup.
"StubPath = %system%\mssyncr.exe"
Key:
HKM\SOFTWARE\Microsoft\Active Setup\Installed Components\{44AC6201-B203-10CC-1f32-A0BC12E2014D}

Adds the value:
"LoginSessionDisable" = "1"
to the registry key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RAS Autodial\Control
to prevent the Trojan from causing the system to dial to an ISP.

- Downloads a web page from the domain, microsoft.com, to verify that it is connected to the Internet.
Next, the Trojan attempts to download and execute files from the following domains:
geocities.com
cruel-intentionz.net

Remove it from startup,
go to the
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RAS Autodial\Control\"LoginSessionDisable".
Set default value to "".

%sysdir%\mssys.dll

Mssys.dll is a mass-mailing worm W32.Aprilcone.A@mm.
Mssys.dll spreads by e-mail.
Related files:
%System%\syscon.exe
%System%\mschk.dll
%System%\Watcher.dll
%System%\sysMon.dll
%System%\syslog.dll
%System%\atchk.dll
%System%\sysmsg.dll
%System%\chkrun.dll
%System%\dskchk.dll
%System%\msevent.dll
%System%\ipchk.dll
%System%\client.dll
%System%\servr.dll
%System%\netchk.dll
%System%\mssys.dll
Adds the value:
"syscon" = "%System%\syscon.exe"
"AppInit_DLLs" = "%System%\Watcher.dll"
to the Windows startup registry keys.

More info: http://securityresponse.symantec.com/avc...
Removal:
Remove mssys.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\mssysstems.exe

mssysstems.exe is a Trojan W32.Rbot-ATU.
mssysstems.exe opens a back door on IRC channels.
mssysstems.exe spreads via open network shares.
Related files:
%System%\mssysstems.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill mssysstems.exe process and remove mssysstems.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\mst32init.exe

mst32init.exe is a Trojan.Hazif-A.
mst32init.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\mst32init.exe
%Windows%\netiu1.dll
%System%\netiu1.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill mst32init.exe process and remove mst32init.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\mstc.exe

mstc.exe is a mass-mailing worm W32.Nugache.A@mm.
mstc.exe opens a back door on TCP port 8.
Related files:
%System%\mstc.exe
Adds the value:
"Microsoft Domain Controller" = "%System%\mstc.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill the process mstc.exe and remove mstc.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\mstcpmon.exe

mstcpmon.exe is a Trojan.Vipgsm-K.
mstcpmon.exe spreads via open network shares.
mstcpmon.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\mstcpmon.exe
%System%\chkdskw.exe
%System%\itstore.dll
%System%\karnal32.dll
%System%\mslogon.dll
%System%\mswshell.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill mstcpmon.exe process and remove mstcpmon.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\mstf.exe

mstf.exe is a Trojan W32.Sdbot-AJV .
mstf.exe opens a back door on IRC channels.
mstf.exe spreads via open network shares.
Related files:
%System%\mstf.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill mstf.exe process and remove mstf.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\mstrc32.dll

Mstrc32.dll is a Spyware.BeyondKeylog.
Mstrc32.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%ProgramFiles%\Supremtec\csrss.exe
%System%\emconv.exe
%System%\rgtcvc32.dll
%System%\msrep32.dll
%System%\mstrc32.dll
More info:
Removal:
Remove mstrc32.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\msudp4.sys

msudp4.sys is rootkit Trojan.Haxdoor-AG.
msudp4.sys is used to hide files, processes and registry.
msudp4.sys is a kernel mode rootkit.
Rootkit contacts remote hacker server using HTTP session.
msudp4.sys created new system drivers:
service name: "msudp4"
display name: "UDPservice"
Added to registry:
HKLM\SYSTEM\CurrentControlSet\Services\msudp4\

Related files:
%SysDir%\msudp4.sys
%SysDir%\tcpG4T.dll
Adds the value:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\tcpG4T
DllName
tcpG4T.dll

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\tcpG4T
Startup
tcpG4T

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\tcpG4T
Impersonate
1
to the Windows startup registry keys.

More info: http://www.sophos.com/virusinfo/analyses...

%sysdir%\msupdate.dll

msupdate.dll is a Trojan PWSteal.Tarno.O.
msupdate.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\msupdate.dll
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove msupdate.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\msupdte32.exe

msupdte32.exe is a Trojan W32.Sdbot-AEF.
msupdte32.exe opens a back door on IRC channels.
msupdte32.exe spreads via open network shares.
Related files:
%System%\msupdte32.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill msupdte32.exe process and remove msupdte32.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\msusvc.exe

msusvc.exe is a Trojan W32.Rbot-ANS.
msusvc.exe opens a back door on IRC channel.
msusvc.exe spreads via open network shares.
msusvc.exe tries to terminate antiviral programs installed on a user computer.
msusvc.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%/msusvc.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill msusvc.exe process and remove msusvc.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\msutil.exe

%SysDir%\msutil.exe is Trojan/Backdoor.
Kill the process %SysDir%\msutil.exe and remove %SysDir%\msutil.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\msvbvm06.dll

msvbvm06.dll is a Trojan.OptixP-O.
msvbvm06.dll opens a back door.
Related files:
%System%\msiexec16.exe
%Windows%\198.125
%Windows%\686.368
%System%\ldrmsvbvm06.dll
%System%\msvbvm06.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove msvbvm06.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\msvcp.exe

msvcp.exe is a Trojan.Agent-HY.
msvcp.exe opens a back door.
Related files:
%System%\msvcp.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill msvcp.exe process and remove msvcp.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\msvcrl.dll

Msvcrl.dll is a mass-mailing worm W32.Looksky.A@mm.
Msvcrl.dll opens a back door on TCP port 321.
Msvcrl.dll tries to terminate antiviral programs installed on a user computer.
Related files:
%Windir%\sachostx.exe
%System%\msvcrl.dll
%System%\sachostb.exe
%System%\sachostc.exe
%System%\sachostp.exe
%System%\sachosts.exe
%System%\sachostw.exe
%System%\sachostm.exe
Adds the value:
"HostSrv" = "%Windir%\sachostx.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove msvcrl.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\msvgr.exe

msvgr.exe is a mass-mailing worm W32.Mytob.LE@mm.
msvgr.exe opens a back door.
msvgr.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\msvgr.exe
Adds the value:
"MsWinVgr" = "msvgr.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill msvgr.exe process and remove msvgr.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\msviral.exe

msviral.exe is a worm W32.Sdbot-CLH.
msviral.exe opens a back door on IRC channels.
Related files:
%System%\msviral.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill msviral.exe process and remove msviral.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\msvnc.sys

%sysdir%\msvsres.dll

msvsres.dll is a Trojan.Iefeat-AN.
msvsres.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%SysDir%\msproto3.dll
%SysDir%\msxmlpp.dll
%SysDir%\msvsres.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove msvsres.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\msw54.exe

MsW54.exe is a Spyware.InTheKnow.
MsW54.exe detects keystrokes.
Related files:
%System%\WnDl.exe
%System%\MsW54.exe
Hooks32.exe
ITKDLL.dll
ITK.exe
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill MsW54.exe process and remove MsW54.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\mswapi.dll

mswapi.dll is a Trojan.Iespy-A.
mswapi.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\mswapi.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove mswapi.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\mswfp.dll

mswfp.dll is a Trojan.LdPinch-DH.
mswfp.dll opens a back door.
mswfp.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\sox.exe
%System%\mswfp.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove mswfp.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\mswinme.exe

MSWINME.EXE is a mass-mailing worm WORM_MYTOB.OV.
MSWINME.EXE tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\MSWINME.EXE
More info: http://www.trendmicro.com/vinfo/virusenc...
Removal:
Kill the process MSWINME.EXE and remove MSWINME.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\mswinscks.exe

mswinscks.exe is a Trojan W32.Rbot-BAE.
mswinscks.exe opens a back door on IRC channels.
mswinscks.exe spreads via open network shares.
Related files:
%System%\mswinscks.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill mswinscks.exe process and remove mswinscks.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\mswinsdq.exe

mswinsdq.exe is a Trojan W32.Rbot-ARY.
mswinsdq.exe opens a back door on IRC channels.
mswinsdq.exe spreads via open network shares.
mswinsdq.exe tries to terminate antiviral programs installed on a user computer.
mswinsdq.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\mswinsdq.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill mswinsdq.exe process and remove mswinsdq.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\mswpi32.exe

mswpi32.exe is a Trojan W32.Rbot-ASQ.
mswpi32.exe opens a back door on IRC channels.
mswpi32.exe spreads via open network shares.
Related files:
%System%\mswpi32.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill mswpi32.exe process and remove mswpi32.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\msws2_32.exe

msws2_32.exe is a Trojan.Akbot-A.
msws2_32.exe opens a back door.
Related files:
%System%\msws2_32.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill msws2_32.exe process and remove msws2_32.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\mswsa32.exe

mswsa32.exe is a Trojan W32.Rbot-BFN.
mswsa32.exe opens a back door on IRC channels.
mswsa32.exe spreads via open network shares.
Related files:
%System%\mswsa32.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill mswsa32.exe process and remove mswsa32.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\mswsck2.dll

mswsck2.dll is a Trojan.Cimuz-O.
mswsck2.dll opens a back door.
mswsck2.dll tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\mdms.exe
%System%\sporder.dll
%System%\mswsck2.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove mswsck2.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\mswshell.dll

mswshell.dll is a Trojan.Vipgsm-K.
mswshell.dll spreads via open network shares.
mswshell.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\mstcpmon.exe
%System%\chkdskw.exe
%System%\itstore.dll
%System%\karnal32.dll
%System%\mslogon.dll
%System%\mswshell.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove mswshell.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\mswu.exe

%SysDir%\mswu.exe is Trojan/Backdoor Feebs.
Kill the process %SysDir%\mswu.exe and remove %SysDir%\mswu.exe from Windows startup using RegRun Reanimator.
http://www.greatis.com/security/Removal_...

%sysdir%\msx.dll

%SysDir%\msx.dll is Trojan/Backdoor ICQCHK.
Kill the file %SysDir%\msx.dll and remove %SysDir%\msx.dll from Windows startup.
Related files in the %SysDir% folder (usually c:\ Windows\System32):
kaboom.dll
iewatch.exe
A0003016.exe
VideoCodec3_05b.exe
sysmon.exe
msx.dll
gtrack.dll
ietool1.exe
ietool2.exe
ietool3.exe

%sysdir%\msxbde40.exe

%SysDir%\msxbde40.exe is Trojan/Backdoor.
Kill the process %SysDir%\msxbde40.exe and remove %SysDir%\msxbde40.exe from Windows startup using RegRun.

%sysdir%\msxml3a.dll

Msxml3a.dll is a Spyware.SafeSurfing.
Msxml3a.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Windir%\asbltzun.exe
%Windir%\netsync.exe
%Windir%\rsyncmon.dll
%Windir%\ISSM0064.DAT
%System%\COMMCOS2.DLL
%System%\InstallerV3.exe
%System%\regsync.exe
%System%\richedtr.dll
%System%\richup.exe
%System%\redtrsha.dll
%System%\vbrundll.dll
%System%\VBUninstall.exe
%System%\msxml3a.dll
Adds the value:
"RSync" = "%Windir%\netsync.exe"
"regsync" = "C:\WINDOWS\System32\regsync.exe"
"richup" = "C:\WINDOWS\System32\richup.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove msxml3a.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\msxml3a.exe

Msxml3a.exe is the Trojan/Backdoor.
Kill the process Msxml3a.exe and other suspicious processes.
Remove Msxml3a.exe from Windows startup.
Also, check the files:
%SysDir\Unvise32qt.exe
C:\Documents and Settings\Owner\Application Data\eber.exe
%SysDir%\sysex.exe
%WinDir%\\javacz32.dll
Check the system services:
__NS_Service
__NS_Service_2
__NS_Service_3
Disable these services.

%sysdir%\msxmlpp.dll

msxmlpp.dll is a Trojan.Iefeat-AN.
msxmlpp.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%SysDir%\msproto3.dll
%SysDir%\msxmlpp.dll
%SysDir%\msvsres.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove msxmlpp.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\msyk32.dll

msyk32.dll is Trojan/Backdoor.
Remove msyk32.dll using RegRun "Scan for Viruses" feature.
http://www.regrun.com

%sysdir%\mszsrn32.dll

mszsrn32.dll is rootkit W32/Zasran-B.
mszsrn32.dll is used to hide files, processes and registry.
mszsrn32.dll is a user mode rootkit.
Rootkit injects itself into winlogon.exe process.
Rootkit contacts remote hacker server using HTTP session.
mszsrn32.dll spreads by e-mail.
Related files:
%SysDir%\mszsrn32.dll
More info: http://www.sophos.com/virusinfo/analyses...

%sysdir%\mszv.exe

%SysDir%\mszv.exe is Trojan/Backdoor Feebs.
Kill the process %SysDir%\mszv.exe and remove %SysDir%\mszv.exe from Windows startup using RegRun Reanimator.
http://www.greatis.com/security/Removal_...

%sysdir%\mtask.exe

mtask.exe is a Trojan.Mkmoose-B.
mtask.exe opens a back door.
Related files:
%System%\msmgs.exe
%System%\mtask.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill mtask.exe process and remove mtask.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\mtrnqs.exe

Mtrnqs.exe is a mass-mailing worm W32.Mytob.IG@mm.
Mtrnqs.exe opens a back door on TCP port 6667.
Mtrnqs.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\mtrnqs.exe
Adds the value:
"WINDOWS SYSTEM" = "mtrnqs.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill mtrnqs.exe process and remove mtrnqs.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\muff.exe

muff.exe is a W32/Sdranck-T.
muff.exe spreads via open network shares.
muff.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%SYSTEM32%\muff.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill muff.exe process and remove muff.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\muie.exe

muie.exe is a Trojan W32.Rbot-BHR.
muie.exe opens a back door on IRC channels.
muie.exe spreads via open network shares.
muie.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\muie.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill muie.exe process and remove muie.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\multiran.exe

multiran.exe is a Trojan.Cosiam-E.
multiran.exe opens a back door.
Related files:
%System%\multiran.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill multiran.exe process and remove multiran.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\mvr4l99q1.dll

%SysDir%\mvr4l99q1.dll is Trojan/Backdoor.
Kill the process %SysDir%\mvr4l99q1.dll and remove %SysDir%\mvr4l99q1.dll from Windows startup.

%sysdir%\mvsql.exe

mvsql.exe is a Trojan W32.Tilebot-AN.
mvsql.exe opens a back door on IRC channels.
mvsql.exe spreads via open network shares.
mvsql.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\mvsql.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill mvsql.exe process and remove mvsql.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\mxdll.dl

%SysDir%\mxdll.dl is Infostealer.Uprungam.
Related files:
%ProgramFiles%\Internet Explorer\svhost32.exe
%System%\mxdll.dll, which is loaded into every process
Read more: http://www.symantec.com/enterprise/secur...
Kill the file %SysDir%\mxdll.dl and remove %SysDir%\mxdll.dl from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\mygame.exe

MyGame.exe is a worm W32.LameYear-A.
MyGame.exe modifies data on the computer.
Related files:
A:\GameOfTheYear.exe
C:\GameOfTheYear.exe
%System%\MyGame.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill MyGame.exe process and remove MyGame.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\mygeek.dll

MyGeek.dll is a Adware.Expand.
MyGeek.dll is a Browser Helper Object.
MyGeek.dll displays advertisements.
Related files:
%System%\BarBHO.dll
%System%\MGeekRemove.exe
%System%\MyGeek.dll
%System%\reg2.exe
More info:
Removal:
Remove MyGeek.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\mysql.exe

mysql.exe s is rootkit Trojan.Bifrose-KP.
mysql.exe s is used to hide files, processes and registry.
mysql.exe s is a user mode rootkit.
Rootrkit injects itself into iexplore.exe.
Rootkit contacts remote hacker server using HTTP session.
Related files:
%SysDir%\mysql.exe s (legitimate file)
%SysDir%\drivers\oreans32.sys (legitimate file)
%SysDir%\plugin1.dat (legitimate file)
%SysDir%\SysPr.prx (legitimate file)

oreans32.sys is created new system driver:
service name: "oreans32"
display name: "oreans32"

Added to registry:
HKLM\SYSTEM\CurrentControlSet\Services\oreans32\

HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\(9B71D88C-C598-4935-C5D1-43AA4DB90836)\stubpath
%SysDir%\mysql.exe s

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mysql
%SysDir%\mysql.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\mysql
%SysDir%\mysql.exe

HKCU\Software\Wget\klg

HKCU\Software\Wget\plg1

HKLM\SOFTWARE\Wget\nck

More info: http://www.sophos.com/security/analyses/...

%sysdir%\mythkernel32.exe

MythKernel32.exe is a mass-mailing worm W32.Fourseman.B@mm.
MythKernel32.exe spreads by e-mail, mIRC and via open network shares.
Related files:
%Windir%\Explorer.exe.
%System%\MythKernel32.exe
%System%\HKernel32.exe
Adds the value:
"HKernel32" = "%System%\HKernel32.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill MythKernel32.exe process and remove MythKernel32.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\n.dll

n.dll is an adware program Adware.AFAEnhance.
n.dll is a Browser Helper Object.
n.dll monitors user Internet activity.
Related files:
%Windir%\system\QB.exe
%Windir%\system\QBTool.exe
%Windir%\system\QBUninstaller.exe
%Windir%\VCMNet11.exe
%System%\n.dll
Adds the value:
"[File path]" = "%Windir%\[File path]"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove n.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\n0tepad.exe

N0TEPAD.EXE is a Trojan.StartPage.P.
N0TEPAD.EXE modifies the Internet Explorer home page.
Related files:
%Windir%\system\CTFM0N.exe
%Windir%\system\N0TEPAD.EXE
%Windir%\system32\N0TEPAD.EXE
%Windir%\N0TEPAD.EXE
%Windir%\system\windll.dll
%Windir%\system\win.dll
Adds the value:
"CTFM0N.exe" = "%Windir%\system\CTFM0N.exe"
"(Default)" = "N0TEPAD.EXE %1"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill N0TEPAD.EXE process and remove N0TEPAD.EXE from Windows startup using RegRun Startup Optimizer.

%sysdir%\navapsvc.exe

%SysDir%\Navapsvc.exe is Infostealer.Proxysteal.
Infostealer.Proxysteal is a Trojan horse that opens a proxy, downloads other files, and attempts to steal passwords from the compromised computer.
Related files:
%System%\Navapsvc.exe
%System%\temp[FIVE RANDOM DIGITS].dat
%UserProfile%\Administrator\Local Settings\Temp\C36YKXNz.dat
%UserProfile%\Administrator\Local Settings\Temp\tmp[FIVE RANDOM DIGITS].dat
Read more: http://www.symantec.com/enterprise/secur...
Kill the process %SysDir%\Navapsvc.exe and remove %SysDir%\Navapsvc.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\navihelper.dll

NaviHelper.dll is an adware program Adware.Navihelper.
NaviHelper.dll is a Browser Helper Object.
NaviHelper.dll downloads and displays advertisements.
Related files:
%System%\NaviHelper.dll
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove NaviHelper.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\navupdt.exe

navupdt.exe is a Trojan.Banload-AI.
navupdt.exe opens a back door.
Related files:
%System%\service\navupdt.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill navupdt.exe process and remove navupdt.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\nawdll32.exe

nawdll32.exe is a Trojan W32.Sdbot-ZM.
nawdll32.exe opens a back door.
nawdll32.exe spreads via open network shares.
nawdll32.exe tries to terminate antiviral programs installed on a user computer.
nawdll32.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\nawdll32.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill nawdll32.exe process and remove nawdll32.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\nbthlp.exe

nbthlp.exe is a Trojan W32.Codbot-AH.
nbthlp.exe opens a back door on IRC channels.
nbthlp.exe spreads via open network shares.
Related files:
%System%\nbthlp.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill nbthlp.exe process and remove nbthlp.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\nconfig.exe

Nconfig.exe is a Spyware.NetSpy.
Nconfig.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\netspy.exe
%System%\nsys.exe
%System%\nconfig.exe
%System%\nsutil.exe
%System%\Faq.fil
%System%\MSVBVM60.DLL
%System%\kbhook.dll
%System%\CaptureScreen.ocx
%System%\Richtx32.ocx
Adds the value:
"nsys" = "nsys.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill nconfig.exe process and remove nconfig.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\ndisfilter.sys

ndisfilter.sys is rootkit Proxy-ProxList.sys.
ndisfilter.sys is a kernel mode rootkit.
ndisfilter.sys is used to hide the existence of the pfplg*.dll file.
Rootkit hooks into the kernel's System Service Descriptor Table (SSDT).
Rootkit affects the addresses corresponding to the function "NTQueryDirectoryFile".
Rootkit contacts remote hacker server using HTTP session.
Related files:
%SysDir%\drivers\ndisfilter.sys
%SysDir%\pfplgflt.dll
%SysDir%\pfplgnfo.dll
%SysDir%\pfplgprx.dll
%SysDir%\pfplgscn.dll
Added to registry:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\NdisFilter
Type: 0x00000001
Start: 0x00000002
ErrorControl: 0x00000000
ImagePath: "\??\%SYSTEMDIR%\drivers\ndisfilter.sys"
DisplayName: "NdisFilter"
Group: "Base"
More info: http://ca.mcafee.com/virusInfo/default.a...

%sysdir%\ndsdavsrv.sys

ndsdavsrv.sys is a Trojan.Checkraise.
ndsdavsrv.sys opens a back door.
ndsdavsrv.sys monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
RBCalc.exe
%System%\utlsrv.exe
%System%\comclg32.dll
%System%\d3dclsrv.dll
%System%\ndsdavsrv.sys
Adds the value:
"Comclg32" = "%System%\utlsrv.exe /Comclg32.dll"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill the process ndsdavsrv.sys and remove ndsdavsrv.sys from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\netchk.dll

Netchk.dll is a mass-mailing worm W32.Aprilcone.A@mm.
Netchk.dll spreads by e-mail.
Related files:
%System%\syscon.exe
%System%\mschk.dll
%System%\Watcher.dll
%System%\sysMon.dll
%System%\syslog.dll
%System%\atchk.dll
%System%\sysmsg.dll
%System%\chkrun.dll
%System%\dskchk.dll
%System%\msevent.dll
%System%\ipchk.dll
%System%\client.dll
%System%\servr.dll
%System%\netchk.dll
%System%\mssys.dll
Adds the value:
"syscon" = "%System%\syscon.exe"
"AppInit_DLLs" = "%System%\Watcher.dll"
to the Windows startup registry keys.

More info: http://securityresponse.symantec.com/avc...
Removal:
Remove netchk.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\netcog.exe

Netcog.exe is a mass-mailing worm W32.Mytob.IA@mm.
Netcog.exe opens a back door on IRC channel.
Netcog.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\netcog.exe
Adds the value:
"Windows Networks" = "netcog.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill netcog.exe process and remove netcog.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\netddesrv.exe

netddesrv.exe is a Trojan W32.Codbot-Y.
netddesrv.exe opens a back door.
netddesrv.exe spreads via open network shares.
netddesrv.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\netddesrv.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill netddesrv.exe process and remove netddesrv.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\netdrvr.exe

netdrvr.exe is a Trojan W32.Tilebot-CO.
netdrvr.exe opens a back door on IRC channels.
netdrvr.exe spreads via open network shares.
Related files:
%System%\netdrvr.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill netdrvr.exe process and remove netdrvr.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\netf.dll

netf.dll is a Trojan.IRCBot-FP.
netf.dll opens a back door on IRC channels.
netf.dll tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\smss.exe
%System%\netf.dll
%System%\nvsvcd.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove netf.dll using RegRun "Scan for Viruses" feature.
http://www.regrun.com

%sysdir%\nethelper.dll

nethelper.dll is a Trojan.BankSnif-E.
nethelper.dll monitors user Internet activity and bank information.
It sends stolen data to a hacker site.
Related files:
%System%\nethelper.dll
%System%\nethelper.xml
%System%\updater.exe
%System%\log.txt
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove nethelper.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\netkey.exe

netkey.exe is a Trojan.IRCBot-AJ.
netkey.exe opens a back door on IRC channels.
Related files:
%System%\netkey.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill netkey.exe process and remove netkey.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\netkk.exe

netkk.exe is Trojan/Backdoor.
Kill the process netkk.exe and remove netkk.exe from Windows startup.

%sysdir%\netlogin.dll

Netlogin.dll is a Trojan Backdoor.Fuwudoor.
Netlogin.dll spreads via open network shares.
Related files:
%System%\ipsec.dll
%System%\appmgmt.dll
%System%\browsvr.dll
%System%\trkw.dll
%System%\trks.dll
%System%\kdc.dll
%System%\dmsrv.dll
%System%\mesg.dll
%System%\netlogin.dll
%System%\protstrg.dll
%System%\lmhosts.dll
%System%\w32t.dll
%System%\ntms.dll
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove netlogin.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\netmeeting.exe

%SysDir%\netmeeting.exe is Win32.Lovgate.AM.
Read more: http://www.incodesolutions.com/threats/S...
Kill the process %SysDir%\netmeeting.exe and remove %SysDir%\netmeeting.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\netpt.sys

netpt.sys is a Trojan.Mutech-C.
netpt.sys downloads code from the internet.
Related files:
%System%\perfont.exe
%System%\drivers\netpt.sys
%System%\wbem\wmiprvi.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill the process netpt.sys and remove netpt.sys from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\netsync.exe

%SysDir%\netsync.exe is Trojan/Backdoor.
Kill the process %SysDir%\netsync.exe and remove %SysDir%\netsync.exe from Windows startup.
Also related:
desktop.exe
ffisearch.exe

%sysdir%\nettemp.dll

nettemp.dll is a Trojan.Dloader-QL.
nettemp.dll downloads code from the internet.
Related files:
%System%\nettemp.dll
%System%\directxsvi.dll
%System%\sporder.dll
%System%\sysconfig32.ax
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove nettemp.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\netwrap.dll

netwrap.dll is a Trojan.Zlob-CK.
netwrap.dll opens a back door.
Related files:
%System%\netwrap.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove netwrap.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\new winzip file.exe

New WinZip File.exe is a mass-mailing worm W32/Nyxem-D.
New WinZip File.exe deletes files off the computer.
New WinZip File.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%Windows%\Rundll16.exe
%System%\scanregw.exe /scan
%System%\Winzip.exe
%System%\Update.exe
%System%\WinZip_Tmp.exe
%System%\New WinZip File.exe
%System%\movies.exe
%System%\Zipped Files.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill the process New WinZip File.exe and remove New WinZip File.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\newdial.exe

newdial.exe is a Start Page Trojan Paymite-B.
newdial.exe changes settings for Microsoft Internet Explorer.
Related files:
%System%\paytime.exe
%Windows%\tool2.exe
%System%\paydial.exe
%System%\newdial.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill newdial.exe process and remove newdial.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\newdll2.exe

newdll2.exe is a Trojan W32.Sdbot-ABD.
newdll2.exe opens a back door on IRC channels.
newdll2.exe spreads via open network shares.
newdll2.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\newdll2.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill newdll2.exe process and remove newdll2.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\newname10.exe

%SysDir%\newname10.exe is Malware.
Kill the process %SysDir%\newname10.exe and remove %SysDir%\newname10.exe from Windows startup using RegRun.
www.regrun.com

%sysdir%\nexom.exe

nexom.exe is a worm W32.Sdranck-X.
nexom.exe opens a back door.
nexom.exe spreads via open network shares.
Related files:
%System%\gomex.exe
%System%\nexom.exe
%System%\secarik.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill nexom.exe process and remove nexom.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\ngpw36.exe

Ngpw36.exe is an adware program Adware.AdBlaster.
Ngpw36.exe downloads and displays advertisements.
Related files:
%System%\adprot.exe
%System%\ngpw36.exe
%System%\ngpw36.exe.exe
%System%\ngsh33.dll
%System%\MSWINSCK.OCX
%Windir%\Sngpw36.exe
%Windir%\Sngsh33.dll
%Windir%\morpheus_internet_accelerator2.exe
IEExplorer.exe
Adds the value:
"ngpw36" = "%System%\ngpw36.exe"
"adprot" = "%System%\adprot.exe"
"Aapp" = "%System%\adprot"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill ngpw36.exe process and remove ngpw36.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\ngpw36.exe.exe

Ngpw36.exe.exe is an adware program Adware.AdBlaster.
Ngpw36.exe.exe downloads and displays advertisements.
Related files:
%System%\adprot.exe
%System%\ngpw36.exe
%System%\ngpw36.exe.exe
%System%\ngsh33.dll
%System%\MSWINSCK.OCX
%Windir%\Sngpw36.exe
%Windir%\Sngsh33.dll
%Windir%\morpheus_internet_accelerator2.exe
IEExplorer.exe
Adds the value:
"ngpw36" = "%System%\ngpw36.exe"
"adprot" = "%System%\adprot.exe"
"Aapp" = "%System%\adprot"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill ngpw36.exe.exe process and remove ngpw36.exe.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\ngsh33.dll

Ngsh33.dll is an adware program Adware.AdBlaster.
Ngsh33.dll downloads and displays advertisements.
Related files:
%System%\adprot.exe
%System%\ngpw36.exe
%System%\ngpw36.exe.exe
%System%\ngsh33.dll
%System%\MSWINSCK.OCX
%Windir%\Sngpw36.exe
%Windir%\Sngsh33.dll
%Windir%\morpheus_internet_accelerator2.exe
IEExplorer.exe
Adds the value:
"ngpw36" = "%System%\ngpw36.exe"
"adprot" = "%System%\adprot.exe"
"Aapp" = "%System%\adprot"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove ngsh33.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\nibie.exe

nibie.exe is a mass-mailing worm W32.Mytob.FO@mm.
nibie.exe opens a back door on TCP port 2094 or TCP port 6543.
nibie.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\nibie.exe
%System%\skybotx.exe
Adds the value:
"Windows System" = "nibie.exe"
"Windows System" = "skybotx.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill nibie.exe process and remove nibie.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\ninfoie.exe

Ninfoie.exe is a mass-mailing worm W32.Mytob.EE@mm.
Ninfoie.exe opens a back door on TCP port 9832.
Ninfoie.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\ninfoie.exe
Adds the value:
"WINDOWS SYSTEM" = "ninfoie.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill ninfoie.exe process and remove ninfoie.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\nixfver.exe

nixfver.exe is Trojan/Backdoor.
Kill the process nixfver.exe and remove nixfver.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\nkgfs.sys

nkgfs.sys is a Trojan Backdoor.Haxdoor.K.
nkgfs.sys tries to terminate antiviral programs installed on a user computer.
nkgfs.sys monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\nkgfs.sys
%System%\nkunpack.dll
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill the process nkgfs.sys and remove nkgfs.sys from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\nkn.exe

nkn.exe is a worm W32.Kelvir-BC.
nkn.exe spreads via MSN Messenger.
Related files:
%System%\nkn.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill nkn.exe process and remove nkn.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\nkunpack.dll

nkunpack.dll is a Trojan Backdoor.Haxdoor.K.
nkunpack.dll tries to terminate antiviral programs installed on a user computer.
nkunpack.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\nkgfs.sys
%System%\nkunpack.dll
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove nkunpack.dll using RegRun "Scan for Viruses" feature.
http://www.regrun.com

%sysdir%\nlsmon.exe

nlsmon.exe is a Trojan W32/Rbot-AXJ.
nlsmon.exe opens a back door on IRC channels.
nlsmon.exe spreads via open network shares.
nlsmon.exe tries to terminate antiviral programs installed on a user computer.
nlsmon.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\nlsmon.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill nlsmon.exe process and remove nlsmon.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\nlsrv.dll

NLSrv.DLL is a Trojan.Feutel-BE.
NLSrv.DLL opens a back door.
Related files:
%System%\NLSrv.exe
%System%\NLSrv.DLL
%System%\NLSrv_HOOk.DLL
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove NLSrv.DLL from Windows startup using RegRun Startup Optimizer.

%sysdir%\nlsrv.exe

NLSrv.exe is a Trojan.Feutel-BE.
NLSrv.exe opens a back door.
Related files:
%System%\NLSrv.exe
%System%\NLSrv.DLL
%System%\NLSrv_HOOk.DLL
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill NLSrv.exe process and remove NLSrv.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\nlsrv_hook.dll

NLSrv_HOOk.DLL is a Trojan.Feutel-BE.
NLSrv_HOOk.DLL opens a back door.
Related files:
%System%\NLSrv.exe
%System%\NLSrv.DLL
%System%\NLSrv_HOOk.DLL
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove NLSrv_HOOk.DLL from Windows startup using RegRun Startup Optimizer.

%sysdir%\nnmzoq.exe

Nnmzoq.exe is an adware program Adware.BetterInternet.
Nnmzoq.exe is a Browser Helper Object.
Nnmzoq.exe downloads and displays advertisements.
Related files:
%Windir%\Bi.dll
%Windir%\speeryox.dll
%Windir%\Mxtarget.dll
%Windir%\BTGrab.dll
%Windir%\farmmext.exe
%Windir%\dlmax.dll
%Windir%\speer2.dll
%Windir%\VoiceIP.dll
%Windir%\morphacl.dll
%Windir%\Pynix.dll
%Windir%\Biprep.exe
%Windir%\banner.dll
%System%\laziqn.exe
%System%\xxvyaj.exe
%System%\wbtvsffd.exe
%System%\nnmzoq.exe
%Temp%\DrTemp\thnall1b.exe
%Temp%\DrTemp\thnall1p.exe
%Temp%\DrTemp\thnall2r.exe
%Temp%\DrTemp\polall1b.exe
%Temp%\thnall1s.exe
%Temp%\morphrec.exe
Adds the value:
"[File name of adware]" = "[File path to adware]"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill nnmzoq.exe process and remove nnmzoq.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\noat.exe

Noat.exe is a Backdoor Trojan.Mitglieder.Q.
Noat.exe tries to terminate antiviral programs installed on a user computer.
Noat.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\wintems.exe
%System%\for?exe
%System%\noat.exe
%System%\ban_list.txt
Adds the value:
"ssgrate.exe" = "%System%\wintems.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill noat.exe process and remove noat.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\noctrn.dll

noctrn.dll is a Trojan.Clicker-AG.
noctrn.dll opens a back door.
Related files:
C:\log.log
%System%\MNeck.exe
%System%\noctrn.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove noctrn.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\nodantivir.sys

nodantivir.sys is rootkit Trojan.Haxdoor-AK.
nodantivir.sys is used to hide files, processes and registry.
nodantivir.sys is a kernel mode rootkit.
Rootkit contacts remote hacker server using HTTP session.
nodantivir.sys created new system drivers:
service name: "nodantivir"
display name: "NOD AV service"
Added to registry:
HKLM\SYSTEM\CurrentControlSet\Services\nodantivir\

Related files:
%SysDir%\nodantivir.sys
%SysDir%\mcfG7A.dll
Adds the value:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\mcfG7A
DllName
mcfG7A.dll

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\mcfG7A
Startup
mcfG7A

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\mcfG7A
Impersonate
1
to the Windows startup registry keys.

More info: http://www.sophos.com/virusinfo/analyses...

%sysdir%\norton update.exe

W32.Erkez.D@mm -mass-mailing worm/Trojan.
1. Creates the following files:
* %System%\Norton Update.exe
* C:\s.cm (A log file.)
2. Attempts to create the following files in folders with the string "shar", "upload", or "music" in their name that it finds in the fixed drives C through H:
* winamp 5.7 new!.exe
* ICQ 2005a new!.exe
3. Adds the value:
"Wxp4" = "%System%\Norton Update.exe"
to the registry subkey:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
so that the worm executes every time Windows starts.
4. Opens a back door on TCP port 8181 and listens for commands from a remote attacker.

%sysdir%\nortonav.exe

nortonav.exe is a Trojan W32.Rbot-AYL.
nortonav.exe opens a back door on IRC channels.
nortonav.exe spreads via open network shares.
nortonav.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\nortonav.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill nortonav.exe process and remove nortonav.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\nortonguard.exe

Nortonguard.exe is a mass-mailing worm W32.Mytob-DZ.
Nortonguard.exe opens a back door.
Nortonguard.exe tries to terminate antiviral programs installed on a user computer.
Nortonguard.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\nortonguard.exe
Removal:
Kill nortonguard.exe process and remove nortonguard.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\notkelvir.exe

NotKelvir.exe is a worm W32.Kelvir-BD.
NotKelvir.exe spreads via MSN Messenger.
Related files:
%System%\winproc.exe
%System%\NotKelvir.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill NotKelvir.exe process and remove NotKelvir.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\npfmontr.exe

npfmontr.exe is a Trojan W32.Rbot-AWD.
npfmontr.exe opens a back door on IRC channels.
npfmontr.exe spreads via open network shares.
npfmontr.exe tries to terminate antiviral programs installed on a user computer.
npfmontr.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\npfmontr.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill npfmontr.exe process and remove npfmontr.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\npfmontr32.exe

NPFMONTR32.exe is a Trojan W32.Rbot-BBC.
NPFMONTR32.exe opens a back door on IRC channels.
NPFMONTR32.exe spreads via open network shares.
Related files:
%System%\NPFMONTR32.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill NPFMONTR32.exe process and remove NPFMONTR32.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\npmsys.exe

npmsys.exe is a Trojan W32.Rbot-ALO.
npmsys.exe opens a back door on IRC channels.
npmsys.exe spreads via open network shares.
npmsys.exe tries to terminate antiviral programs installed on a user computer.
npmsys.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\npmsys.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill npmsys.exe process and remove npmsys.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\ns.dll

ns.dll is an adware program Adware.Begin2search.
ns.dll monitors user Internet activity.
ns.dll displays advertising information.
Related files:
%System%\reg6523.exe
%System%\winb2s32.dll
%System%\winbbb.dat
%System%\dsktrf.dll
%System%\ns.dll
%System%\trgen.dll
%System%\rtneg.dll
%Windir%\Downloaded Program Files\winb2s32.inf
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove ns.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\nsmscrs.exe

nsmscrs.exe is a Trojan W32.Rbot-BPT.
nsmscrs.exe opens a back door on IRC channels.
nsmscrs.exe spreads via open network shares.
Related files:
%System%\nsmscrs.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill nsmscrs.exe process and remove nsmscrs.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\nsutil.exe

Nsutil.exe is a Spyware.NetSpy.
Nsutil.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\netspy.exe
%System%\nsys.exe
%System%\nconfig.exe
%System%\nsutil.exe
%System%\Faq.fil
%System%\MSVBVM60.DLL
%System%\kbhook.dll
%System%\CaptureScreen.ocx
%System%\Richtx32.ocx
Adds the value:
"nsys" = "nsys.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill nsutil.exe process and remove nsutil.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\nsys.exe

Nsys.exe is a Spyware.NetSpy.
Nsys.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\netspy.exe
%System%\nsys.exe
%System%\nconfig.exe
%System%\nsutil.exe
%System%\Faq.fil
%System%\MSVBVM60.DLL
%System%\kbhook.dll
%System%\CaptureScreen.ocx
%System%\Richtx32.ocx
Adds the value:
"nsys" = "nsys.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill nsys.exe process and remove nsys.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\ntctl.exe

%SysDir%\NTCTL.EXE is Trojan/Backdoor.
Kill the process NTCTL.EXE and remove NTCTL.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\ntdat32.exe

ntdat32.exe is a Trojan W32.Sdbot-CNW.
ntdat32.exe opens a back door on IRC channels.
ntdat32.exe spreads via open network shares.
ntdat32.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\ntdat32.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill ntdat32.exe process and remove ntdat32.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\ntdhcp.exe

NTdhcp.exe is a Trojan.QQRob-K.
NTdhcp.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\NTdhcp.exe
%Windows%\Deleteme.bat.
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill NTdhcp.exe process and remove NTdhcp.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\ntdll32.dll

ntdll32.dll is a Trojan.Multidr-EU.
ntdll32.dll opens a back door.
Related files:
%System%\ntdll32.dll
%System%\ranx.dll
%System%\god.sys
%System%\svch0st.exe
%Windows%\suniu.exe
%System%\mmdat.dat
%System%\wdata32.dll
%Windows%\123.jpg
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove ntdll32.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\ntdsapp.dll

ntdsapp.dll is a Trojan.Agent-FN.
ntdsapp.dll opens a back door.
Related files:
%System%\ntdsapp.dll
%System%\stivc.exe
%System%\delttsul.exe
%System%\imgcom.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove ntdsapp.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\ntdvrlib.dll

ntdvrlib.dll is rootkit Trojan. Agent-BRK.
ntdvrlib.dll opens a back door.
ntdvrlib.dll is used to hide files, processes and registry.
ntdvrlib.dll is a kernel mode rootkit.

Related files:
%SysDir%\SCSrv.dll
%SysDir%\ntdvrlib.dll

SCSrv.dll is created new system drivers:
service name: "SCService"
Added to registry:
HKLM\SYSTEM\CurrentControlSet\Services\ufgrbe
More info: http://www.sophos.com/security/analyses/...

%sysdir%\ntinvisible.dll

Ntinvisible.dll is a Spyware.SpyAgent.B.
Ntinvisible.dll is a commercial keylogger/system-monitoring program.
Related files:
%System%\ntinvisible.dll
%Windir%\libimg.dll
%Windir%\sbrowse.exe
%Windir%\snmpapi.dll
%Windir%\yahoodll.dll
%ProgramFiles%\Spytech Software\Spytech SpyAgent\sagent.exe
%ProgramFiles%\Spytech Software\Spytech SpyAgent\deploy.exe
%ProgramFiles%\Spytech Software\Spytech SpyAgent\nostealth.exe
%ProgramFiles%\Spytech Software\Spytech SpyAgent\sysdiag.exe
Adds the value:
"System32"="%ProgramFiles%\Spytech Software\Spytech SpyAgent\sysdiag.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove ntinvisible.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\ntkernell32.exe

ntkernell32.exe is Trojan W32.Rbot-ATY.
ntkernell32.exe opens a back door on IRC channels.
ntkernell32.exe spreads via open network shares.
ntkernell32.exe tries to terminate antiviral programs installed on a user computer.
ntkernell32.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\ntkernell32.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill ntkernell32.exe process and remove ntkernell32.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\ntmapast.dll

ntmapast.dll is a Trojan.PPdoor-Q.
ntmapast.dll opens a back door.
ntmapast.dll tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\dpnetmsg.exe
%System%\iueninet.dll
%System%\fsmgntfs.dll
%System%\ntmapast.dll
%System%\ir50psrv.exe
%System%\kbd1uery.dll
%System%\lfyockaa.dll
%System%\a15svcs.exe
%System%\dpnmdlib.exe
%System%\c_28usic.dll
%System%\atiysnpn.dll
%System%\treemqoa.dll
%System%\arptutdn.dll
%System%\eulapart.dll
%System%\smlo8thk.exe
%System%\odbcfwci.ime
%System%\hgakheg.dll
%System%\jkwbhew.dll
%System%\testtest.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove ntmapast.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\ntms.dll

Ntms.dll is a Trojan Backdoor.Fuwudoor.
Ntms.dll spreads via open network shares.
Related files:
%System%\ipsec.dll
%System%\appmgmt.dll
%System%\browsvr.dll
%System%\trkw.dll
%System%\trks.dll
%System%\kdc.dll
%System%\dmsrv.dll
%System%\mesg.dll
%System%\netlogin.dll
%System%\protstrg.dll
%System%\lmhosts.dll
%System%\w32t.dll
%System%\ntms.dll
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove ntms.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\ntoskrnl.dll

%SysDir%\ntoskrnl.dll is rootkit/Trojan NTSYSTEM.
Remove %SysDir%\ntsystem.exe from Windows startup using RegRun Reanimator.
Removal NTSYSTEM:
http://www.greatis.com/security/Removal_...

%sysdir%\ntqb.exe

NTQB.exe is Trojan/Backdoor.
Kill the process NTQB.exe and remove NTQB.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\ntrshp.dll

ntrshp.dll is a Trojan.PPdoor-A.
ntrshp.dll opens a back door.
ntrshp.dll tries to terminate antiviral programs installed on a user computer.
Related files:
%System%/ntrshp.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove ntrshp.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\ntsys.exe

%SysDir%\ntsys.exe is Trojan/Backdoor.
Kill the process ntsys.exe and remove ntsys.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\ntsystem.exe

%SysDir%\ntsystem.exe is a rootkit/Trojan NTSYSTEM.
Remove %SysDir%\ntsystem.exe from Windows startup using RegRun Reanimator.
Removal NTSYSTEM:
http://www.greatis.com/security/Removal_...

%sysdir%\ntsysv.exe

ntsysv.exe is a Trojan.Mifeng-E.
ntsysv.exe modifies data on the computer.
Related files:
%System%\ntsysv.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill ntsysv.exe process and remove ntsysv.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\ntxp2.exe

%SysDir%\ntxp2.exe is Trojan/Backdoor.
Kill the process ntxp2.exe and remove ntxp2.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\nub-san.exe

nub-san.exe is a Trojan.Podrop-C.
nub-san.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%Program Files%\Media Access\Info.txt
%Program Files%\Media Access\MediaAccC.dll
%Program Files%\Media Access\MediaAccK.exe
%Program Files%\Media Access\MediaAccess.exe
%Windows%\win.exe
%System%\nub-san.exe
%System%\xpjava.exe
%System%\msdirectx.sys
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill nub-san.exe process and remove nub-san.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\nvcpl.exe

Worm W32.Yanz.B@mm
It is a mass-mailing worm that uses its own SMTP engine for spreading.
1. Adds to Windows startup.
It masks to NVIDIA control panel application NvCpl.exe.
2. Creates the files
%System%\Dong_Shi.exe
%System%\NvCpl.EXE
C:\Yanzi.htm
%Windir%\Sun_YanZI.zip (a zip file that contains a file Sun_Yan_Zi-Shen_Q1.mp3.pif - it is a copy of the worm)
%System%\Huai_Tian_Q1.sys ( an MIME-encoded zip file that contains a file Sun_Yan_Zi-Shen_Q1.mp3.pif - it is a copy of the worm)
%System%\I_am_Sun_Yanzi.sys. (an MIME-encoded worm)
YanZi.vbs. (this file is created in the current folder and it creates the file sun.exe)
When the file sun.exe runs, it creates three .jpg files under %Temp% folder. The file names have "SuN" as prefix.
One of these files is a Trojan that exploits the Microsoft GDI+ Library JPEG Segment Length Integer Underflow vulnerability (described in the Microsoft Security Bulletin MS04-028) to download and execute a file named m00.exe, from the domain sunyanzi.fastmail.cn. This file is also a Trojan.

%sysdir%\nvhost.exe

Nvhost.exe is a mass-mailing worm W32.Mytob.HM@mm.
Nvhost.exe opens a back door on TCP port 6663.
Nvhost.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\nvhost.exe
Adds the value:
"Messenger Service" = "nvhost.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill nvhost.exe process and remove nvhost.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\nvidiadrvers.exe

nVidiaDrvers.exe is a Trojan W32.Sdbot-AFX.
nVidiaDrvers.exe opens a back door on IRC channels.
nVidiaDrvers.exe spreads via open network shares.
nVidiaDrvers.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\nVidiaDrvers.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill nVidiaDrvers.exe process and remove nVidiaDrvers.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\nvrsnl.exe

%SysDir%\nvrsnl.exe is TrojanDownloader.Win32.Small.
Kill the process %SysDir%\nvrsnl.exe and remove %SysDir%\nvrsnl.exe from Windows startup using RegRun Reanimator.
www.regrun.com

%sysdir%\nvsvcd.exe

nvsvcd.exe is a Trojan.IRCBot-FP.
nvsvcd.exe opens a back door on IRC channels.
nvsvcd.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\smss.exe
%System%\netf.dll
%System%\nvsvcd.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill the process nvsvcd.exe and remove nvsvcd.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\o8660ijse8o60.dll

O8660IJSE8O60.DLL is Trojan/Backdoor.
Kill the file O8660IJSE8O60.DLL and remove O8660IJSE8O60.DLL from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\obepro32.dll

OBEPRO32.DLL is Adware/Spyware.
Kill the process OBEPRO32.DLL and remove OBEPRO32.DLL from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\odbc16.dll

ODBC16.dll is a mass-mailing worm W32.Lovgate.
ODBC16.dll opens a back door.
ODBC16.dll tries to terminate antiviral programs installed on a user computer.
Related files:
%system%\Kernel66.dll
%system%\RAVMOND.exe
%windir%\SYSTRA.exe
%SysDir%\msjdbc11.dll
%SysDir%\MSSIGN30.DLL
%SysDir%\ODBC16.dll
%SysDir%\Lmmib20.dll
More info: http://www.viruslist.com/en/viruses/ency...
Removal:
Remove ODBC16.dll using RegRun "Scan for Viruses" feature.

%sysdir%\office.exe

office.exe is a Trojan.MancSyn-B.
office.exe opens a back door.
Related files:
%Startup%\office.exe
%System%\hwdetect.exe
%System%\walib32.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill office.exe process and remove office.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\oleadm.dll

oleadm.dll is a virus W32.Desktophijack.
oleadm.dll modifies the desktop settings.
oleadm.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Windir%\uninstIU.exe
%System%\oleadm.dll
%System%\wp.bmp
%System%\wininet.dll
%System%\oleadm32.dll
Adds the value:
"WindowsFZ" = "[PATH TO EXECUTABLE FILE]"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove oleadm.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\oleadm32.dll

Oleadm32.dll is a virus W32.Desktophijack.
Oleadm32.dll modifies the desktop settings.
Oleadm32.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Windir%\uninstIU.exe
%System%\oleadm.dll
%System%\wp.bmp
%System%\wininet.dll
%System%\oleadm32.dll
Adds the value:
"WindowsFZ" = "[PATH TO EXECUTABLE FILE]"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove oleadm32.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\oleext.dll

Oleext.dll is a Trojan.Desktophijack.C.
Oleext.dll modifies the desktop settings.
Oleext.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\intell32.exe
%System%\oleext.dll
%System%\oleext32.dll
%System%\wppp.html
%Windir%\uninstIU.exe
Adds the value:
"intell32.exe" = "%System%\intell32.exe"
to the Windows startup registry keys.
More info:
Removal:
Remove oleext.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\oleext32.dll

Oleext32.dll is a Trojan.Desktophijack.C.
Oleext32.dll modifies the desktop settings.
Oleext32.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\intell32.exe
%System%\oleext.dll
%System%\oleext32.dll
%System%\wppp.html
%Windir%\uninstIU.exe
Adds the value:
"intell32.exe" = "%System%\intell32.exe"
to the Windows startup registry keys.
More info:
Removal:
Remove oleext32.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\oleupdate.exe

oleupdate.exe is a Trojan.Agent-UY.
oleupdate.exe opens a back door.
Related files:
%System%\oleupdate.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill oleupdate.exe process and remove oleupdate.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\om4r.exe

om4r.exe is a Trojan W32/Rbot-AQP.
om4r.exe opens a back door on IRC channels.
om4r.exe spreads via open network shares.
om4r.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\om4r.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill om4r.exe process and remove om4r.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\omniband.dll

Omniband.dll is an adware program Adware.BlazeFind.
Omniband.dll is a Browser Helper Object.
Omniband.dll downloads and displays advertisements.
Related files:
%System%\2_0_1browserhelper2.dll
%System%\UnstSA2.exe
%System%\key2.txt
%System%\installer2.exe
%System%\Omniscienthook.dll
%System%\omniband.dll
%System%\wsaupdater.exe
Adds the value:
"Windows SA" = "[path to the adware program]"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove omniband.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\omniscienthook.dll

Omniscienthook.dll is an adware program Adware.BlazeFind.
Omniscienthook.dll is a Browser Helper Object.
Omniscienthook.dll downloads and displays advertisements.
Related files:
%System%\2_0_1browserhelper2.dll
%System%\UnstSA2.exe
%System%\key2.txt
%System%\installer2.exe
%System%\Omniscienthook.dll
%System%\omniband.dll
%System%\wsaupdater.exe
Adds the value:
"Windows SA" = "[path to the adware program]"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove Omniscienthook.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\onde.exe

Onde.exe is a mass-mailing worm W32.Beagle.C@mm.
Onde.exe opens a back door on TCP port 2745.
Onde.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\onde.exe
%System%\doc.exe
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill onde.exe process and remove onde.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\oobe\isperror\shell.exe

We suggest you to remove %SysDir%\oobe\isperror\shell.exe from your computer as soon as possible.
%SysDir%\oobe\isperror\shell.exe is W32/Brontok-CV.
Related files:
%Windows%\fonts\smss.exe
%System%\oobe\isperror\shell.exe
%System%\IExplorer.exe
%Windows%\System32.exe
%Startup%\Empty.pif
Open.exe
Music.exe
Read more: http://www.sophos.com/security/analyses/...
Kill the process %SysDir%\oobe\isperror\shell.exe and remove %SysDir%\oobe\isperror\shell.exe from Windows startup.

%sysdir%\oobe\setup\corpstats.exe

%SysDir%\oobe\setup\corpstats.exe is Trojan/Backdoor.
Kill the process corpstats.exe and remove corpstats.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\opls.dll

%SysDir%\opls.dll is Malware.
Kill the file %SysDir%\opls.dll and remove %SysDir%\opls.dll from Windows startup using RegRun.
www.regrun.com

%sysdir%\order.exe

order.exe is worm W32.Hilin-B.
order.exe spreads via open network shares.
Related files:
%System%\order.exe
%System%\regedit.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill order.exe process and remove order.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\osalogbe.exe

%SysDir%\osalogbe.exe is Trojan/Backdoor.
Kill the process osalogbe.exe and remove osalogbe.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\osethk32.dll

%SysDir%\osethk32.dll is Trojan/Backdoor.
Kill the file %SysDir%\osethk32.dll and remove %SysDir%\osethk32.dll from Windows startup using RegRun.
www.regrun.com

%sysdir%\outlookexpressupdate.exe

%sysdir%\owmngr.exe

OWMngr.exe is a Trojan.Download.Chekin.
OWMngr.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
Ttps.exe
Sifxinst.exe
Sbsrch_v22.dll
%System%\Sysreg.exe
%System%\OWMngr.exe
Adds the value:
"Sysreg"="%System%\Sysreg.exe"
"OWMngr"="%System%\OWMngr.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill OWMngr.exe process and remove OWMngr.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\pal\css\atl71.dll

atl71.dll is a Spyware.ComSurveilSys.
atl71.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\PAL\CSS\atl71.dll
%System%\PAL\CSS\cpu.exe
%System%\PAL\CSS\explorer.exe
%System%\PAL\CSS\IEGuard.dll
%System%\PAL\CSS\ijl15.dll
%System%\PAL\CSS\klpf.exe
%System%\PAL\CSS\MFC71.dll
%System%\PAL\CSS\MkShort.exe
%System%\PAL\CSS\msvcp71.dll
%System%\PAL\CSS\msvcr71.dll
%System%\PAL\CSS\regsvr32.exe
%System%\PAL\CSS\run32dll.exe
%System%\PAL\CSS\svchost.exe
%System%\PAL\CSS\TheHook.dll
%System%\PAL\CSS\TheHookXP.dll
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove atl71.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\pal\css\cpu.exe

Cpu.exe is a Spyware.ComSurveilSys.
Cpu.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\PAL\CSS\atl71.dll
%System%\PAL\CSS\cpu.exe
%System%\PAL\CSS\explorer.exe
%System%\PAL\CSS\IEGuard.dll
%System%\PAL\CSS\ijl15.dll
%System%\PAL\CSS\klpf.exe
%System%\PAL\CSS\MFC71.dll
%System%\PAL\CSS\MkShort.exe
%System%\PAL\CSS\msvcp71.dll
%System%\PAL\CSS\msvcr71.dll
%System%\PAL\CSS\regsvr32.exe
%System%\PAL\CSS\run32dll.exe
%System%\PAL\CSS\svchost.exe
%System%\PAL\CSS\TheHook.dll
%System%\PAL\CSS\TheHookXP.dll
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill cpu.exe process and remove cpu.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\pal\css\ijl15.dll

ijl15.dll is a Spyware.ComSurveilSys.
ijl15.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\PAL\CSS\atl71.dll
%System%\PAL\CSS\cpu.exe
%System%\PAL\CSS\explorer.exe
%System%\PAL\CSS\IEGuard.dll
%System%\PAL\CSS\ijl15.dll
%System%\PAL\CSS\klpf.exe
%System%\PAL\CSS\MFC71.dll
%System%\PAL\CSS\MkShort.exe
%System%\PAL\CSS\msvcp71.dll
%System%\PAL\CSS\msvcr71.dll
%System%\PAL\CSS\regsvr32.exe
%System%\PAL\CSS\run32dll.exe
%System%\PAL\CSS\svchost.exe
%System%\PAL\CSS\TheHook.dll
%System%\PAL\CSS\TheHookXP.dll
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove ijl15.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\pal\css\klpf.exe

Klpf.exe is a Spyware.ComSurveilSys.
Klpf.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\PAL\CSS\atl71.dll
%System%\PAL\CSS\cpu.exe
%System%\PAL\CSS\explorer.exe
%System%\PAL\CSS\IEGuard.dll
%System%\PAL\CSS\ijl15.dll
%System%\PAL\CSS\klpf.exe
%System%\PAL\CSS\MFC71.dll
%System%\PAL\CSS\MkShort.exe
%System%\PAL\CSS\msvcp71.dll
%System%\PAL\CSS\msvcr71.dll
%System%\PAL\CSS\regsvr32.exe
%System%\PAL\CSS\run32dll.exe
%System%\PAL\CSS\svchost.exe
%System%\PAL\CSS\TheHook.dll
%System%\PAL\CSS\TheHookXP.dll
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill klpf.exe process and remove klpf.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\pal\css\mfc71.dll

MFC71.dll is a Spyware.ComSurveilSys.
MFC71.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\PAL\CSS\atl71.dll
%System%\PAL\CSS\cpu.exe
%System%\PAL\CSS\explorer.exe
%System%\PAL\CSS\IEGuard.dll
%System%\PAL\CSS\ijl15.dll
%System%\PAL\CSS\klpf.exe
%System%\PAL\CSS\MFC71.dll
%System%\PAL\CSS\MkShort.exe
%System%\PAL\CSS\msvcp71.dll
%System%\PAL\CSS\msvcr71.dll
%System%\PAL\CSS\regsvr32.exe
%System%\PAL\CSS\run32dll.exe
%System%\PAL\CSS\svchost.exe
%System%\PAL\CSS\TheHook.dll
%System%\PAL\CSS\TheHookXP.dll
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove MFC71.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\pal\css\mkshort.exe

MkShort.exe is a Spyware.ComSurveilSys.
MkShort.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\PAL\CSS\atl71.dll
%System%\PAL\CSS\cpu.exe
%System%\PAL\CSS\explorer.exe
%System%\PAL\CSS\IEGuard.dll
%System%\PAL\CSS\ijl15.dll
%System%\PAL\CSS\klpf.exe
%System%\PAL\CSS\MFC71.dll
%System%\PAL\CSS\MkShort.exe
%System%\PAL\CSS\msvcp71.dll
%System%\PAL\CSS\msvcr71.dll
%System%\PAL\CSS\regsvr32.exe
%System%\PAL\CSS\run32dll.exe
%System%\PAL\CSS\svchost.exe
%System%\PAL\CSS\TheHook.dll
%System%\PAL\CSS\TheHookXP.dll
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill MkShort.exe process and remove MkShort.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\pal\css\msvcp71.dll

msvcp71.dll is a Spyware.ComSurveilSys.
msvcp71.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\PAL\CSS\atl71.dll
%System%\PAL\CSS\cpu.exe
%System%\PAL\CSS\explorer.exe
%System%\PAL\CSS\IEGuard.dll
%System%\PAL\CSS\ijl15.dll
%System%\PAL\CSS\klpf.exe
%System%\PAL\CSS\MFC71.dll
%System%\PAL\CSS\MkShort.exe
%System%\PAL\CSS\msvcp71.dll
%System%\PAL\CSS\msvcr71.dll
%System%\PAL\CSS\regsvr32.exe
%System%\PAL\CSS\run32dll.exe
%System%\PAL\CSS\svchost.exe
%System%\PAL\CSS\TheHook.dll
%System%\PAL\CSS\TheHookXP.dll
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove atl71.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\pal\css\msvcr71.dll

msvcr71.dll is a Spyware.ComSurveilSys.
msvcr71.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\PAL\CSS\atl71.dll
%System%\PAL\CSS\cpu.exe
%System%\PAL\CSS\explorer.exe
%System%\PAL\CSS\IEGuard.dll
%System%\PAL\CSS\ijl15.dll
%System%\PAL\CSS\klpf.exe
%System%\PAL\CSS\MFC71.dll
%System%\PAL\CSS\MkShort.exe
%System%\PAL\CSS\msvcp71.dll
%System%\PAL\CSS\msvcr71.dll
%System%\PAL\CSS\regsvr32.exe
%System%\PAL\CSS\run32dll.exe
%System%\PAL\CSS\svchost.exe
%System%\PAL\CSS\TheHook.dll
%System%\PAL\CSS\TheHookXP.dll
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove msvcr71.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\pal\css\run32dll.exe

run32dll.exe is a Spyware.ComSurveilSys.
run32dll.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\PAL\CSS\atl71.dll
%System%\PAL\CSS\cpu.exe
%System%\PAL\CSS\explorer.exe
%System%\PAL\CSS\IEGuard.dll
%System%\PAL\CSS\ijl15.dll
%System%\PAL\CSS\klpf.exe
%System%\PAL\CSS\MFC71.dll
%System%\PAL\CSS\MkShort.exe
%System%\PAL\CSS\msvcp71.dll
%System%\PAL\CSS\msvcr71.dll
%System%\PAL\CSS\regsvr32.exe
%System%\PAL\CSS\run32dll.exe
%System%\PAL\CSS\svchost.exe
%System%\PAL\CSS\TheHook.dll
%System%\PAL\CSS\TheHookXP.dll
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill run32dll.exe process and remove cpu.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\pal\css\thehook.dll

TheHook.dll is a Spyware.ComSurveilSys.
TheHook.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\PAL\CSS\atl71.dll
%System%\PAL\CSS\cpu.exe
%System%\PAL\CSS\explorer.exe
%System%\PAL\CSS\IEGuard.dll
%System%\PAL\CSS\ijl15.dll
%System%\PAL\CSS\klpf.exe
%System%\PAL\CSS\MFC71.dll
%System%\PAL\CSS\MkShort.exe
%System%\PAL\CSS\msvcp71.dll
%System%\PAL\CSS\msvcr71.dll
%System%\PAL\CSS\regsvr32.exe
%System%\PAL\CSS\run32dll.exe
%System%\PAL\CSS\svchost.exe
%System%\PAL\CSS\TheHook.dll
%System%\PAL\CSS\TheHookXP.dll
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove TheHook.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\pal\css\thehookxp.dll

TheHookXP.dll is a Spyware.ComSurveilSys.
TheHookXP.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\PAL\CSS\atl71.dll
%System%\PAL\CSS\cpu.exe
%System%\PAL\CSS\explorer.exe
%System%\PAL\CSS\IEGuard.dll
%System%\PAL\CSS\ijl15.dll
%System%\PAL\CSS\klpf.exe
%System%\PAL\CSS\MFC71.dll
%System%\PAL\CSS\MkShort.exe
%System%\PAL\CSS\msvcp71.dll
%System%\PAL\CSS\msvcr71.dll
%System%\PAL\CSS\regsvr32.exe
%System%\PAL\CSS\run32dll.exe
%System%\PAL\CSS\svchost.exe
%System%\PAL\CSS\TheHook.dll
%System%\PAL\CSS\TheHookXP.dll
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove TheHookXP.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\param32.dll

%sysdir%\parvulus.exe

%SysDir%\PARVULUS.EXE is Trojan/Backdoor.
Kill the process PARVULUS.EXE and remove PARVULUS.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\patch32.dll

We suggest you to remove %SysDir%\patch32.dll from your computer as soon as possible.
%SysDir%\patch32.dll is W32.Snaban.
W32.Snaban is a worm that spreads by copying itself to removable drives and network drives on the compromised computer. It also steals confidential information by logging keystrokes.
Related files:
%System%\WinRAR.exe
%System%\NetODBC.exe
%System%\real.exe
%System%\Explore.exe
%System%\patch32.dll
%System%\CheckWeb.dll
Read more: http://www.symantec.com/business/securit...
Kill the file %SysDir%\patch32.dll and remove %SysDir%\patch32.dll from Windows startup.

%sysdir%\pattonat.dll

Pattonat.dll is a Backdoor Trojan.Riler.C.
Pattonat.dll spreads via open network shares.
Related files:
%System%\layerpop.ini
%System%\Pattonat.dll
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove Pattonat.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\paydial.exe

paydial.exe is a Start Page Trojan Paymite-B.
paydial.exe changes settings for Microsoft Internet Explorer.
Related files:
%System%\paytime.exe
%Windows%\tool2.exe
%System%\paydial.exe
%System%\newdial.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill paydial.exe process and remove paydial.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\paytime.exe

paytime.exe is a Trojan.Paymite-B.
paytime.exe changes settings for Microsoft Internet Explorer.
Related files:
%System%\paytime.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill paytime.exe process and remove paytime.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\pbukv2.dll

%SysDir%\pbukv2.dll is a CoolWebSearch.
MAnufacturer: Visicom Media
Kill the file %SysDir%\pbukv2.dll and remove %SysDir%\pbukv2.dll from Windows startup using RegRun.
www.regrun.com

%sysdir%\pctt.exe

PCTT.exe is a Spyware.PCTattletale.
PCTT.exe logs keystrokes.
PCTT.exe monitors user Internet activity.
Related files:
%ProgramFiles%\Common Files\InstallShield\Driver\7\Intel 32\IDriver.exe
%ProgramFiles%\Common Files\InstallShield\Driver\7\Intel 32\IScript7.dll
%ProgramFiles%\Common Files\InstallShield\Driver\7\Intel 32\ISRT.dll
%ProgramFiles%\Common Files\InstallShield\Driver\7\Intel 32\IUser7.dll
%ProgramFiles%\Common Files\InstallShield\Driver\7\Intel 32\objps7.dll
%ProgramFiles%\Common Files\InstallShield\Driver\7\Intel 32\_ISRES1033.dll
%System%\explorer32\AutoUpdate.dll
%System%\explorer32\AutoUpdateClient.exe
%System%\explorer32\chattext.dll
%System%\explorer32\msn6mngr.exe
%System%\explorer32\Netlogon.exe
%System%\explorer32\Wincmd.exe
%System%\explorer32\WinSysMngr.exe
%System%\MSN32.dll
%System%\PCTT.exe
%System%\UninstallPCTT.exe
%System%\Unzip32.dll
%System%\WinLoad.exe
%System%\zip32.dll
Adds the value:
"(default)" = ""
"WinLoad" = "%System%\Winload.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill PCTT.exe process and remove PCTT.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\per.exe

%SysDir%\per.exe is Troj/DwnLdr-FDP.
Related files:
%CurrentFolder>\sdff1f
%CurrentFolder>\sdfff
%System%\t1t.exe
%System%\tt.exe
Read more: http://www.sophos.com/security/analyses/...
Kill the process %SysDir%\per.exe and remove %SysDir%\per.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\perfhmon.exe

Perfhmon.exe is a Trojan.Banklis-A.
Perfhmon.exe monitors user Internet activity and bank information.
It sends stolen data to a hacker site.
Related files:
%System%\Perfhmon.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill Perfhmon.exe process and remove Perfhmon.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\perfmnt.exe

perfmnt.exe is a Trojan.Agent-EY.
perfmnt.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\perfmnt.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill perfmnt.exe process and remove perfmnt.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\perfont.exe

perfont.exe is a Trojan.Mutech-A.
perfont.exe opens a back door.
Related files:
%System%\perfont.exe
%System%\drivers\netpt.sys
%System%\wbem\wmiprv.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill perfont.exe process and remove perfont.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\performent202.dll

performent202.dll is a Troj/Dloader-ZQ.
performent202.dll downloads code from the internet.
Related files:
%System%\performent217.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove performent202.dll Windows startup using RegRun Startup Optimizer.

%sysdir%\performent217.dll

performent217.dll is a Troj/Dloader-ZU.
performent217.dll downloads code from the internet.
Related files:
%System%\performent217.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove performent217.dll Windows startup using RegRun Startup Optimizer.

%sysdir%\phde32.sys

phde32.sys is rootkit Trojan.Mlsuc-C.
phde32.sys is used to hide files, processes and registry.
phde32.sys is a kernel mode rootkit.
phde32.sys tries to terminate antiviral programs installed on a user computer.
Rootkit contacts remote hacker server using HTTP session.
phde32.sys is created new system driver.
Related files:
%SysDir%\delself.bat
%SysDir%\res.dat
%SysDir%\res.tmp
%SysDir%\phde32.sys
More info: http://www.sophos.com/virusinfo/analyses...

%sysdir%\photes.exe

photes.exe is a Trojan.PPdoor-P.
photes.exe modifies data on the computer
photes.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\photes.exe
%System%\swbkbtaa.dll
%System%\vnetbsh.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill photes.exe process and remove photes.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\photoandarticle.exe

PhotoandArticle.exe is a Trojan Backdoor.IRC.Litebot.
PhotoandArticle.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\Photo and Article.exe
%System%\PhotoandArticle.exe
Adds the value:
support-reverse-smileys" = "%System%\Photo and Article.exe"
support-reverse-smileys" = "%System%\PhotoandArticle.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill PhotoandArticle.exe process and remove PhotoandArticle.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\picx.exe

picx.exe is a mass-mailing worm W32.Mytob.KP@mm.
picx.exe opens a back door on TCP port 3385.
picx.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\picx.exe
Adds the value:
"PIC SYSTEM" = "picx.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill picx.exe process and remove picx.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\pilif.exe

Worm W32.Fili@mm.
Disables Task Manager by adding "DisableTaskMgr" = "00000001"
to the registry key:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
Policies\System
Attempts to disable antiviral software.
Attempts to shut down and restart the infected computer by presenting the user with the shutdown menu.

%sysdir%\pimp.exe

PIMP.EXE is a WORM_RBOT.CD.
PIMP.EXE opens a back door on IRC channels.
PIMP.EXE spreads via open network shares.
PIMP.EXE tries to terminate antiviral programs installed on a user computer.
PIMP.EXE monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\PIMP.EXE
More info: http://dk.trendmicro-europe.com/enterpri...
Removal:
Kill the process PIMP.EXE and remove PIMP.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\pio12.dll

pio12.dll is Trojan/Backdoor.
Remove pio12.dll using RegRun "Scan for Viruses" feature.
http://www.regrun.com

%sysdir%\pipe.exe

pipe.exe is a mass-mailing worm W32.Mytob-FF.
pipe.exe opens a back door on IRC channels.
pipe.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\pipe.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill pipe.exe process and remove pipe.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\pkerme12.dll

pKerme12.dll is a Trojan.Ermeto-A.
pKerme12.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\pKerme12.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove pKerme12.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\pkguard32.exe

pkguard32.exe is a worm W32.Guapim.
pkguard32.exe spreads through Instant Messenger programs and via open network shares.
pkguard32.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\pkguard32.exe
Adds the value:
"PK Guard" = "%System%\pkguard32.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill pkguard32.exe process and remove pkguard32.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\pl.dll

pl.dll is a Spyware.CMKeyLogger.
pl.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%ProgramFiles%\WINLOGON.exe
%System%\pl.dll
%System%\WinSystems.exe
%System%\WSCpmSet.dll
%System%\WSCpmWCl.dll
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove pl.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\playboy1.exe

playboy1.exe is a worm W32.Rbot-BMO.
playboy1.exe opens a back door on IRC channels.
playboy1.exe spreads via open network shares.
Related files:
%System%\playboy1.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill playboy1.exe process and remove playboy1.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\plou.exe

plou.exe is a Trojan W32.Sdbot-ACZ.
plou.exe opens a back door.
plou.exe spreads via open network shares.
Related files:
%System%\plou.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill plou.exe process and remove plou.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\plscx.exe

plscx.exe is a worm W32.Rbot-AYO.
plscx.exe opens a back door.
plscx.exe spreads via open network shares.
Related files:
%System%\plscx.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill plscx.exe process and remove plscx.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\pluginenlog.dll

PluginENLOG.DLL is a Trojan.Keylog-AT.
PluginENLOG.DLL monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\PluginENLOG.DLL
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove PluginENLOG.DLL from Windows startup using RegRun Startup Optimizer.

%sysdir%\pmkhf.dll

%SysDir%\pmkhf.dll is Generic Downloader.ab
Kill the file %SysDir%\pmkhf.dll and remove %SysDir%\pmkhf.dll from Windows startup using RegRun.
www.regrun.com

%sysdir%\pnezhftx.dll

pnezhftx.dll is a Trojan.PcClien-AH.
pnezhftx.dll opens a back door.
Related files:
%System%\pnezhftx.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove pnezhftx.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\pnpsrv.exe

Pnpsrv.exe is a worm W32.Spybot.UBH.
Pnpsrv.exe opens a back door on TCP port 5232.
Pnpsrv.exe spreads by using the vulnerability in Microsoft Windows Plug and Play Service (Microsoft Security Bulletin MS05-039).
Related files:
%System%\pnpsrv.exe
%System%\SVKP.sys
Adds the value:
"Windows PNP Server" = "pnpsrv.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill pnpsrv.exe process and remove pnpsrv.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\pob2res.exe

%SysDir%\pob2res.exe is Trojan/Backdoor.
Kill the process pob2res.exe and remove pob2res.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\poker.exe

poker.exe is a Tojan W32.Sdbot-ZY.
poker.exe opens a back door on IRC channels.
poker.exe spreads via open network shares.
poker.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\poker.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill poker.exe process and remove poker.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\poker3.exe

poker3.exe is a Trojan W32.Sdbot-AFB.
poker3.exe opens a back door on IRC channels.
poker3.exe spreads via open network shares.
Related files:
%System%\poker3.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill poker3.exe process and remove poker3.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\polarcrypto.dll

Polarcrypto.dll is a Spyware.MessageSpy.
Polarcrypto.dll records online chat conversations.
Related files:
%ProgramFiles%\msaolim\msaolim.exe
%ProgramFiles%\msaolim\unins.exe
%ProgramFiles%\msaolim\unins000.dat
%ProgramFiles%\msaolim\unins000.exe
%System%\polarcrypto.dll
%System%\polarziplight.dll
%System%\Richtx32.ocx
Adds the value:
"msaim" = "C:\Program Files\msaolim\msaolim.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove polarcrypto.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\polo.exe

polo.exe is a Trojan.Agent-PE.
polo.exe opens a back door.
Related files:
%System%\polo.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill polo.exe process and remove polo.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\pop_up.dll

%SysDir%\ pop_up.dll is Trojan/Backdoor.
Kill the process %SysDir%\ pop_up.dll and remove %SysDir%\ pop_up.dll from Windows startup.

%sysdir%\postcard.gif.exe

postcard.gif.exe is a Trojan.Zapchas-AC.
postcard.gif.exe opens a back door on IRC channels.
Related files:
%System%\aliases.ini
%System%\control.ini
%System%\explorer.exe
%System%\mirc.ico
%System%\mirc.ini
%System%\nicks.txt
%System%\postcard.gif.exe
%System%\remote.ini
%System%\script.ini
%System%\servers.ini
%System%\sup.bat
%System%\sup.reg
%System%\users.ini
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill postcard.gif.exe process and remove postcard.gif.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\powerprof.exe

PowerProf.exe is a Trojan.LorSpy-A.
PowerProf.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\PowerProf.exe
%System%\mpr16.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill PowerProf.exe process and remove PowerProf.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\ppl.exe

%SysDir%\ppl.exe is W32.Mixor.Q@mm.
Related files:
%System%\ppl.exe
%System%\alsys.exe
%System%\taskdir.exe
%System%\adir.dll
%System%\adirss.exe
Read more: http://www.symantec.com/enterprise/secur...
Kill the process %SysDir%\ppl.exe and remove %SysDir%\ppl.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\pptp24.sys

pptp24.sys is rootkit Trojan.Haxdoor-HM.
pptp24.sys is used to hide files, processes and registry.
pptp24.sys is a kernel mode rootkit.
Rootkit contacts remote hacker server using HTTP session.
pptp24.sys tries to terminate antiviral programs installed on a user computer.
Related files:
%SysDir%\klgcptini.dat
%SysDir%\ms87.dat
%SysDir%\pptp16.dll
%SysDir%\pptp24.sys
%SysDir%\qz.dll
%SysDir%\qz.sys
pptp24.sys is created new system drivers:
service name: "pptp16"
display name: "MMX2 virtualization service"

service name: "pptp24"
display name: "MMX virtualization service"
Added to registry:
HKLM\SYSTEM\CurrentControlSet\Services\pptp16\
HKLM\SYSTEM\CurrentControlSet\Services\pptp24\
Adds the value:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\pptp16
DllName
pptp16.dll

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\pptp16
Startup
KeImageDBG

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\pptp16
Impersonate
1
to the Windows startup registry keys.
More info: http://www.sophos.com/security/analyses/...

%sysdir%\pptp32.dll

%SysDir%\pptp32.dll is a Trojan.Haxdoor.
Kill the file pptp32.dll and remove pptp32.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\pptp64.sys

%SysDir%\pptp64.sys is a Trojan.Haxdoor.
Kill the file pptp64.sys and remove pptp64.sys from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\pramery.exe

pramery.exe is a Trojan.Samsa-A.
pramery.exe opens a back door.
Related files:
%System%\intranet.exe
%System%\pramery.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill pramery.exe process and remove pramery.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\printer32.dll

printer32.dll is an adware program Adware.WhileUSurf.
printer32.dll downloads and displays advertisements.
Related files:
%System%\wys.dll
%System%\wys5.dll
%System%\wys.exe
%System%\printer32.dll
Adds the value:
"Spool" = "%CurrentFolder%\wys.exe /startup"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove printer32.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\printers.exe

%SysDir%\printers.exe is W32/Kik-A.
Related files:
%SysDir%\notiffy.dll
%SysDir%\printers.exe
Read more: http://www.sophos.com/security/analyses/...
Kill the process %SysDir%\printers.exe and remove %SysDir%\printers.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\printpnp.dll

PRINTPNP.DLL is rootkit Trojan.Goldun.I.
PRINTPNP.DLL is used to hide files, processes and registry.
PRINTPNP.DLL is a kernel mode rootkit.
PRINTPNP.DLL monitors user Internet activity and bank information.
It sends stolen data to a hacker site.
Related files:
%SysDir%\EPSONSYS.SYS
%SysDir%\PRINTPNP.DLL

EPSONSYS.SYS is created new system service:
display name: "EPS Printer Driver"

Adds the value:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion
\Winlogon\Notify\printpnp
to the Windows startup registry keys.
More info: http://www.symantec.com/security_respons...

%sysdir%\procman.exe

Procman.exe is Trojan/Backdoor.
Directory: %WINDIR%\SYSTEM32\
Read more: http://fileinfo.prevx.com/QQ5d4220193887...
Kill the process procman.exe and remove procman.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\procmsg.exe

Procmsg.exe is a Backdoor W32.Allim.B.
Procmsg.exe spreads through America Online Instant Messenger (AIM).
Procmsg.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%ProgramFiles%\aolx\as.exe
%ProgramFiles%\aolx\proto.exe
%System%\procmsg.exe
Adds the value:
"Windows Generic Proc" = "procmsg.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill procmsg.exe process and remove procmsg.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\produto.exe

%SysDir%\produto.exe is Trojan/Backdoor.
Kill the process produto.exe and remove produto.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\prognam.exe

prognam.exe is a worm W32.Stavron.A.
prognam.exe spreads via open network shares.
Related files:
%System\atmsvc.dll
%System%\prognam.exe
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill the process prognam.exe and remove prognam.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\programs\keylogger5\krnlmod.exe

Krnlmod.exe is a Spyware.WindowsKey.
Krnlmod.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%SystemDrive%\Programs\Keylogger5\Krnlmod.exe
%SystemDrive%\Programs\Keylogger5\Ntpsapi.dll
%SystemDrive%\Programs\Keylogger5\Watchdll.dll
Adds the value:
"Krnlmod" = "%SystemDrive%\Programs\Keylogger5\Krnlmod.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill Krnlmod.exe process and remove Krnlmod.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\programs\keylogger5\ntpsapi.dll

Ntpsapi.dll is a Spyware.WindowsKey.
Ntpsapi.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%SystemDrive%\Programs\Keylogger5\Krnlmod.exe
%SystemDrive%\Programs\Keylogger5\Ntpsapi.dll
%SystemDrive%\Programs\Keylogger5\Watchdll.dll
Adds the value:
"Krnlmod" = "%SystemDrive%\Programs\Keylogger5\Krnlmod.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove Ntpsapi.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\programs\keylogger5\watchdll.dll

Watchdll.dll is a Spyware.WindowsKey.
Watchdll.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%SystemDrive%\Programs\Keylogger5\Krnlmod.exe
%SystemDrive%\Programs\Keylogger5\Ntpsapi.dll
%SystemDrive%\Programs\Keylogger5\Watchdll.dll
Adds the value:
"Krnlmod" = "%SystemDrive%\Programs\Keylogger5\Krnlmod.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove Watchdll.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\protstrg.dll

Protstrg.dll is a Trojan Backdoor.Fuwudoor.
Protstrg.dll spreads via open network shares.
Related files:
%System%\ipsec.dll
%System%\appmgmt.dll
%System%\browsvr.dll
%System%\trkw.dll
%System%\trks.dll
%System%\kdc.dll
%System%\dmsrv.dll
%System%\mesg.dll
%System%\netlogin.dll
%System%\protstrg.dll
%System%\lmhosts.dll
%System%\w32t.dll
%System%\ntms.dll
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove protstrg.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\prt47sys.sys

prt47sys.sys is rootkit Trojan.Haxdoor-DC.
prt47sys.sys is used to hide files, processes and registry.
rdriv.sys is a kernel mode rootkit.
prt47sys.sys tries to terminate antiviral programs installed on a user computer.
Rootkit contacts remote hacker server using HTTP session.
Related files:
%SysDir%\prt47sys.sys
%SysDir%\sysprint.dll

prt47sys.sys is created new system driver:
service name: "prt47sys"
display name: "PRT4701 Printer driver"
Added to registry:
HKLM\SYSTEM\CurrentControlSet\Services\prt47sys\

The following registry entries are set, affecting internet security:

HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\

HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\

HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\

HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\

HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List

:*:Enabled:explorer

Adds the value:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sysprint
DllName
sysprint.dll

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sysprint
Startup
sysprint

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sysprint
Impersonate
1
to the Windows startup registry keys.
More info: http://www.sophos.com/virusinfo/analyses...

%sysdir%\prutpct.exe

Prutpct.exe is a Spyware.e2give.
Prutpct.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%ProgramFiles%\E2g\iebhos.dll
%Windir%\pi1.exe
%System%\pruttct.exe
%System%\skytown.exe
%System%\prutpct.exe
%System%\ptech.exe
%System%\prutsct.exe
%System%\askearth17.exe
%UserProfile%\Desktop\filgmo.exe
%UserProfile%\Local Settings\Temp\ei.exe
Adds the value:
"pruttct" = "[path to Adware]"
"filgmo" = "C:\Documents and Settings\symantec\Desktop\filgmo.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill prutpct.exe process and remove prutpct.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\prutsct.exe

Prutsct.exe is a Spyware.e2give.
Prutsct.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%ProgramFiles%\E2g\iebhos.dll
%Windir%\pi1.exe
%System%\pruttct.exe
%System%\skytown.exe
%System%\prutpct.exe
%System%\ptech.exe
%System%\prutsct.exe
%System%\askearth17.exe
%UserProfile%\Desktop\filgmo.exe
%UserProfile%\Local Settings\Temp\ei.exe
Adds the value:
"pruttct" = "[path to Adware]"
"filgmo" = "C:\Documents and Settings\symantec\Desktop\filgmo.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill prutsct.exe process and remove prutsct.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\pruttct.exe

Pruttct.exe is a Spyware.e2give.
Pruttct.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%ProgramFiles%\E2g\iebhos.dll
%Windir%\pi1.exe
%System%\pruttct.exe
%System%\skytown.exe
%System%\prutpct.exe
%System%\ptech.exe
%System%\prutsct.exe
%System%\askearth17.exe
%UserProfile%\Desktop\filgmo.exe
%UserProfile%\Local Settings\Temp\ei.exe
Adds the value:
"pruttct" = "[path to Adware]"
"filgmo" = "C:\Documents and Settings\symantec\Desktop\filgmo.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill pruttct.exe process and remove pruttct.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\psaload32.exe

Psaload32.exe is a Trojan W32.Rbot-ANW.
Psaload32.exe opens a back door on IRC channel.
Psaload32.exe spreads via open network shares.
Psaload32.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\psaload32.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill psaload32.exe process and remove psaload32.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\psecure.exe

psecure.exe is a Trojan W32.Rbot-ASS.
psecure.exe opens a back door on IRC channels.
psecure.exe spreads via open network shares.
Related files:
%System%\psecure.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill psecure.exe process and remove psecure.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\pshwr.exe

%SysDir%\pshwr.exe is a SafeSurfing adware variant.
Related files:
%Windir%\asbltzun.exe
%Windir%\netsync.exe
%Windir%\rsyncmon.dll
%Windir%\ISSM0064.DAT
%System%\COMMCOS2.DLL
%System%\InstallerV3.exe
%System%\regsync.exe
%System%\richedtr.dll
%System%\richup.exe
%System%\redtrsha.dll
%System%\vbrundll.dll
%System%\VBUninstall.exe
%System%\wirelanb.dll
%System%\lanbrup.exe
%System%\lanbruns.exe
%System%\[RANDOM CHARACTERS].dll
%Temp%\labpengs.tmp
%Temp%\ExtractDLL.dll
Kill the process %SysDir%\pshwr.exe and remove %SysDir%\pshwr.exe from Windows startup using RegRun.
www.regrun.com
Read more: http://securityresponse.symantec.com/avc...

%sysdir%\ptech.exe

Ptech.exe is a Spyware.e2give.
Ptech.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%ProgramFiles%\E2g\iebhos.dll
%Windir%\pi1.exe
%System%\pruttct.exe
%System%\skytown.exe
%System%\prutpct.exe
%System%\ptech.exe
%System%\prutsct.exe
%System%\askearth17.exe
%UserProfile%\Desktop\filgmo.exe
%UserProfile%\Local Settings\Temp\ei.exe
Adds the value:
"pruttct" = "[path to Adware]"
"filgmo" = "C:\Documents and Settings\symantec\Desktop\filgmo.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill ptech.exe process and remove ptech.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\ptool32.exe

ptool32.exe is a Trojan.LegMir-BN.
ptool32.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\ptool32.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill ptool32.exe process and remove ptool32.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\pup.exe

pup.exe is an adware program Adware.Winpup.
pup.exe downloads and displays advertisements.
Related files:
%System%\pup.exe
%System%\Winpup.exe
%System%\Winpup32.exe
Adds the value:
"[File name]"="%System%\[File name].exe
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill pup.exe process and remove pup.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\pwinqrag.exe

PWINQRAG.EXE is an Adware Covert.Sys.Exec.
PWINQRAG.EXE spreads by e-mail.
PWINQRAG.EXE tries to terminate antiviral programs installed on a user computer.
PWINQRAG.EXE monitors user Internet activity and private information.
It sends stolen data to a hacker site.
More info: http://virusinfo.prevx.com/viruscenter.a...
Removal:
Kill the process PWINQRAG.EXE and remove PWINQRAG.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\q_sys.dll

q_sys.dll is a Trojan.LdPinch-DY.
q_sys.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\q_sys.dll
%Windows%\klg.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove q_sys.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\qabar.dll

QaBar.dll is an adware program Adware.AdultLinks.
QaBar.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%windir%\system32\QaBar.dll
%windir%\system32\QcBar.dll
Adds the value:
"ForceShow" = "rundll32.exe ,ForceShowBar"
"ForceShow" = "res:///ForceShow.HTML"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove QaBar.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\qb.exe

QB.exe is an adware program Adware.AFAEnhance.
QB.exe is a Browser Helper Object.
QB.exe monitors user Internet activity.
Related files:
%Windir%\system\QB.exe
%Windir%\system\QBTool.exe
%Windir%\system\QBUninstaller.exe
%Windir%\VCMNet11.exe
%System%\n.dll
Adds the value:
"[File path]" = "%Windir%\[File path]"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill QB.exe process and remove QB.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\qbtool.exe

QBTool.exe is an adware program Adware.AFAEnhance.
QBTool.exe is a Browser Helper Object.
QBTool.exe monitors user Internet activity.
Related files:
%Windir%\system\QB.exe
%Windir%\system\QBTool.exe
%Windir%\system\QBUninstaller.exe
%Windir%\VCMNet11.exe
%System%\n.dll
Adds the value:
"[File path]" = "%Windir%\[File path]"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill QBTool.exe process and remove QBTool.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\qbuninstaller.exe

QBUninstaller.exe is an adware program Adware.AFAEnhance.
QBUninstaller.exe is a Browser Helper Object.
QBUninstaller.exe monitors user Internet activity.
Related files:
%Windir%\system\QB.exe
%Windir%\system\QBTool.exe
%Windir%\system\QBUninstaller.exe
%Windir%\VCMNet11.exe
%System%\n.dll
Adds the value:
"[File path]" = "%Windir%\[File path]"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill QBUninstaller.exe process and remove QBUninstaller.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\qcbar.dll

QcBar.dll is an adware program Adware.AdultLinks.
QcBar.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%windir%\system32\QaBar.dll
%windir%\system32\QcBar.dll
Adds the value:
"ForceShow" = "rundll32.exe ,ForceShowBar"
"ForceShow" = "res:///ForceShow.HTML"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove QcBar.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\qossrv\csrss.ex

Qossrv\Csrss.exe is Trojan/Backdoor.Hale.
Please, do no mix up with Csrss.exe in the Windows\System32 folder.
%SysDir%\csrss.exe - good Microsoft file.
1. WinMgnt creates the folder: C:\Winnt\System32\Qossrv.
2. Adds the value
"NTDLM" = "c:\winnt\system32\qossrv\csrss.exe"
to the Windows startup registry keys.
Read more:
http://securityresponse.symantec.com/avc...

%sysdir%\qqgame.exe

QQGame.exe is a Trojan.QQPass-AC.
QQGame.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\QQGame.exe
%System%\QQHook.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill QQGame.exe process and remove QQGame.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\qqhook.dll

QQHook.dll is a Trojan.QQPass-AC.
QQHook.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\QQGame.exe
%System%\QQHook.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove QQHook.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\qsecue.exe

Qsecue.exe is a Backdoor W32.Spybot.UOL.
Qsecue.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\qsecue.exe
Adds the value:
"Quantifier Security" = "qsecue.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill qsecue.exe process and remove qsecue.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\qtask.exe

We suggest you to remove %SysDir%\qtask.exe from your computer as soon as possible.
%SysDir%\qtask.exe is W32/Rbot-AKU.
Read more: http://www.sophos.com/security/analyses/...
Kill the process %SysDir%\qtask.exe and remove %SysDir%\qtask.exe from Windows startup.

%sysdir%\quq.dll

quq.dll is a Trojan.Small-GN.
quq.dll opens a back door.
Related files:
%System%\quq.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove quq.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\qwinsyst32.exe

qwinsyst32.exe is a Trojan.OptixP-M.
qwinsyst32.exe opens a back door.
Related files:
%System%\msnsyst32win.exe
%System%\qwinsyst32.exe
%System%\g78zghwin.exe
%System%\m87r8syst32.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill qwinsyst32.exe process and remove qwinsyst32.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\qz.dll

qz.dll is a Trojan Backdoor.Haxdoor.E.
qz.dll tries to terminate antiviral programs installed on a user computer.
qz.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\avpx32.dll
%System%\qz.dll
Adds the value:
"DllName" = "avpx32.dll"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove qz.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\r.exe

r.exe is an adware program Adware.Topantispyware.
r.exe displays advertisements.
Related files:
%System%\hookdump.exe
%System%\runsrv32.exe
%System%\srpcsrv32.dll
%System%\runsrv32.dll
%System%\txfdb32.dll
%System%\r.exe
Adds the value:
"Srv32 spool service" = "%Windir%\System32\runsrv32.exe"
"Intel system tool" = "%System%\hookdump.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill r.exe process and remove r.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\ranx.dll

ranx.dll is a Trojan.Multidr-EU.
ranx.dll opens a back door.
Related files:
%System%\ntdll32.dll
%System%\ranx.dll
%System%\god.sys
%System%\svch0st.exe
%Windows%\suniu.exe
%System%\mmdat.dat
%System%\wdata32.dll
%Windows%\123.jpg
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove ranx.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\rapcklo.dll

rapcklo.dll is a Trojan.Hupigon-CG.
rapcklo.dll opens a back door.
Related files:
%Windows%\Scerver.DLL
%Windows%\ScerverKey.DLL
%Windows%\Scerver_Hook.DLL
%System%\rapcklo.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove rapcklo.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\rapking.exe

rapking.exe is a worm W32.Sdranck-V.
rapking.exe opens a back door.
rapking.exe spreads via open network shares.
Related files:
%System%\msstill.exe
%System%\rapking.exe
%System%\richword.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill rapking.exe process and remove rapking.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\rastapi.exe

%SysDir%\rastapi.exe is Trojan/Backdoor.
Kill the process %SysDir%\rastapi.exe and remove %SysDir%\rastapi.exe from Windows startup.

%sysdir%\rastnlio.dll

rastnlio.dll is a Trojan.QQPass-AK.
rastnlio.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\agetlke.exe
%System%\rastnlio.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove rastnlio.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\rastuefs.dll

rastuefs.dll is a Trojan.QQPass-AL.
rastuefs.dll tries to terminate antiviral programs installed on a user computer.
rastuefs.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\agetltfs.exe
%System%\rastuefs.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove rastuefs.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\rauth.exe

Rauth.exe is a Trojan.Dloader-UL.
Rauth.exe downloads code from the internet.
Related files:
%System%\Rauth.exe
%System%\MAPI.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill Rauth.exe process and remove Rauth.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\ravmond.exe

RAVMOND.exe is a mass-mailing worm W32.Lovgate.
RAVMOND.exe opens a back door.
RAVMOND.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%system%\Kernel66.dll
%system%\RAVMOND.exe
%windir%\SYSTRA.exe
%SysDir%\msjdbc11.dll
%SysDir%\MSSIGN30.DLL
%SysDir%\ODBC16.dll
%SysDir%\Lmmib20.dll
More info: http://www.viruslist.com/en/viruses/ency...
Removal:
Kill the process RAVMOND.exe and remove RAVMOND.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\ravseteyi.exe

ravseteyi.exe is a Trojan.QQPass-AO.
ravseteyi.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\ravseteyi.exe
%System%\temp.jpg
%System%\winsyei.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill ravseteyi.exe process and remove ravseteyi.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\rbwinx1.dll

Rbwinx1.dll is a Spyware.ActMon.
Rbwinx1.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\drivers\wskrnlc.sys
%System%\acm-manual.chm
%System%\acmcc.exe
%System%\rbwinx1.dll
%System%\wskrnl.exe
%System%\wskrnlb.dll
%System%\wskrnlb.exe
%System%\wskrnlc.dll
%System%\wskrnlc.vxd
%System%\wskrnld.dll
%System%\wskrnle.dll
Adds the value:
"srvprc" = ""%System%\srvprc.exe" -at"
"wskrnl" = ""%System%\wskrnl.exe" -at"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove rbwinx1.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\rcf.exe

%SysDir%\rcf.exe is a worm W32.Randex.BLD.
Kill the process %SysDir%\rcf.exe and remove %SysDir%\rcf.exe from Windows startup using RegRun.
www.regrun.com
Read more: http://www.sarc.com/avcenter/venc/data/w...

%sysdir%\rdrlib.dll

rdrlib.dll is a Trojan.Bankhof-D.
rdrlib.dll monitors user Internet activity and bank information.
It sends stolen data to a hacker site.
Related files:
%System%\rdrlib.dll
%System%\vbn.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove rdrlib.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\reaiplayer.exe

reaIplayer.exe is a Trojan W32.WarPigs-E .
reaIplayer.exe opens a back door on IRC channels.
reaIplayer.exe spreads via open network shares.
Related files:
%System%\reaIplayer.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill reaIplayer.exe process and remove reaIplayer.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\realsched.exe

%SysDir%\realsched.exe is Email-Worm.Win32.LovGate.ad.
Related files:
C:\COMMAND.EXE
%System%\hxdef.exe
%System%\IEXPLORE.EXE
%System%\kernel66.dll
%System%\RAVMOND.exe
%System%\realsched.exe
%System%\vptray.exe
%Windir%\SYSTRA.EXE
%System%\LMMIB20.DLL
%System%\msjdbc11.dll
%System%\MSSIGN30.DLL
%System%\ODBC16.dll
AUTORUN.INF
%System%\NetMeeting.exe
%System%\spollsv.exe
%Windir%\suchost.exe
Read more: http://www.viruslist.com/en/viruses/ency...
Kill the process %SysDir%\realsched.exe and remove %SysDir%\realsched.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\realupd32.exe

realupd32.exe is a Trojan.Mitglie-B.
realupd32.exe opens a back door.
realupd32.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\realupd32.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill realupd32.exe process and remove realupd32.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\reboot.exe

Reboot.exe is Trojan/Backdoor.
Kill the process Reboot.exe and remove Reboot.exe from Windows startup.

%sysdir%\recyclecl.exe

recyclecl.exe is a Trojan W32.Rbot-BCD.
recyclecl.exe opens a back door on IRC channels.
recyclecl.exe spreads via open network shares.
recyclecl.exe tries to terminate antiviral programs installed on a user computer.
recyclecl.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\recyclecl.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill recyclecl.exe process and remove recyclecl.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\redtrsha.dll

Redtrsha.dll is a Spyware.SafeSurfing.
Redtrsha.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Windir%\asbltzun.exe
%Windir%\netsync.exe
%Windir%\rsyncmon.dll
%Windir%\ISSM0064.DAT
%System%\COMMCOS2.DLL
%System%\InstallerV3.exe
%System%\regsync.exe
%System%\richedtr.dll
%System%\richup.exe
%System%\redtrsha.dll
%System%\vbrundll.dll
%System%\VBUninstall.exe
%System%\msxml3a.dll
Adds the value:
"RSync" = "%Windir%\netsync.exe"
"regsync" = "C:\WINDOWS\System32\regsync.exe"
"richup" = "C:\WINDOWS\System32\richup.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove redtrsha.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\reg.sys

%SysDir%\reg.sys is Win32/Cutwail.C.
Read more: http://ca.com/ro/securityadvisor/virusin...
Kill the file %SysDir%\reg.sys and remove %SysDir%\reg.sys from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\reg_ssh32.exe

REG_SSH32.EXE is a Spyware.2Spy.
REG_SSH32.EXE records information in a log file.
Related files:
%SysDir%\REG_SSH32.EXE
%SysDir%\SSH32.EXE
%SysDir%\VIEW2SP.EXE
%SysDir%\SSH32.log
Adds the value:
"SSh32" = "\SSh32.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill REG_SSH32.EXE process and remove REG_SSH32.EXE from Windows startup using RegRun Startup Optimizer.

%sysdir%\reg2.exe

reg2.exe is a Adware.Expand.
reg2.exe is a Browser Helper Object.
reg2.exe displays advertisements.
Related files:
%System%\BarBHO.dll
%System%\MGeekRemove.exe
%System%\MyGeek.dll
%System%\reg2.exe
More info:
Removal:
Kill reg2.exe process and remove reg2.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\reg6523.exe

Reg6523.exe is an adware program Adware.Begin2search.
Reg6523.exe monitors user Internet activity.
Reg6523.exe displays advertising information.
Related files:
%System%\reg6523.exe
%System%\winb2s32.dll
%System%\winbbb.dat
%System%\dsktrf.dll
%System%\ns.dll
%System%\trgen.dll
%System%\rtneg.dll
%Windir%\Downloaded Program Files\winb2s32.inf
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill reg6523.exe process and remove reg6523.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\regc64.dll

regc64.dll is a Trojan.BluEye-D.
regc64.dll opens a back door.
regc64.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\msvchost.exe
%System%\ssvchost.com
%System%\regc64.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove regc64.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\regisp32.exe

regisp32.exe is a mass-mailing worm W32.Beagle.DN@mm.
regisp32.exe opens a back door on on TCP port 6777.
regisp32.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\windspl.exe
%System%\windspl.exeopen
%System%\windspl.exeopenopen
%Windir%\regisp32.exe
Adds the value:
"DsplObjects" = "%System%\windspl.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill the process regisp32.exe and remove regisp32.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\registryinfo2.dll

RegistryInfo2.dll is a Trojan.Lineage-FU.
RegistryInfo2.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\Kerne0110.exe
%System%\RegistryInfo2.dll
%System%\microsoftie0110.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove RegistryInfo2.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\regkey32.dll

Regkey32.Dll is a Spyware.SaveKeys.
Regkey32.Dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%PROGRAM FILES%\SK51\Sk51.exe
%PROGRAM FILES%\SK51\Sk51config.exe
%PROGRAM FILES%\SK62\sku62.exe
%PROGRAM FILES%\SK60\sk60.exe
%SysDir%\Regkey32.Dll
Adds the value:
"SK51"="C:\PROGRAM FILES\SK51\SK51.EXE"
"SK60"="C:\PROGRAM FILES\SK60\SK60.EXE"
"(default)"="C:\PROGRAM FILES\SKU62\SKU62.EXE"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove Regkey32.Dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\regmaping.exe

regmaping.exe is a mass-mailing worm W32.Beagle.DO@mm.
regmaping.exe opens a back door.
regmaping.exe spreads by e-mail and via open network shares.
regmaping.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\regmaping.exe
%System%\regmaping.exeopen
%System%\regmaping.exeopenopen
%Windir%\winresw.exe
Adds the value:
"Regmonitor" = "%System%\regmaping.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill the process regmaping.exe and remove regmaping.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\regperf.exe

%SysDir%\REGPERF.EXE is Trojan/Backdoor.
Kill the process REGPERF.EXE and remove REGPERF.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\regptmens.exe

REGPTMENS.EXE is a Trojan.Bancos-ED.
REGPTMENS.EXE monitors user Internet activity and bank information.
It sends stolen data to a hacker site.
Related files:
%Windows%\Ptmens.exe
%System%\REGPTMENS.EXE
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill REGPTMENS.EXE process and remove REGPTMENS.EXE from Windows startup using RegRun Startup Optimizer.

%sysdir%\regsv.exe

REGSV.EXE is Trojan/Backdoor.
Kill the process REGSV.EXE and remove REGSV.EXE from Windows startup.

%sysdir%\regsync.exe

Regsync.exe is a Spyware.SafeSurfing.
Regsync.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Windir%\asbltzun.exe
%Windir%\netsync.exe
%Windir%\rsyncmon.dll
%Windir%\ISSM0064.DAT
%System%\COMMCOS2.DLL
%System%\InstallerV3.exe
%System%\regsync.exe
%System%\richedtr.dll
%System%\richup.exe
%System%\redtrsha.dll
%System%\vbrundll.dll
%System%\VBUninstall.exe
%System%\msxml3a.dll
Adds the value:
"RSync" = "%Windir%\netsync.exe"
"regsync" = "C:\WINDOWS\System32\regsync.exe"
"richup" = "C:\WINDOWS\System32\richup.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill regsync.exe process and remove regsync.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\rejoice.dll

rejoice.dll is a Trojan.Prosti-Q.
rejoice.dll opens a back door.
rejoice.dll tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\rejoice.exe
%System%\rejoice.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove rejoice.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\rejoice.exe

rejoice.exe is a Trojan.Prosti-Q.
rejoice.exe opens a back door.
rejoice.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\rejoice.exe
%System%\rejoice.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill rejoice.exe process and remove rejoice.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\remotelog.dll

Remotelog.dll is a Spyware.AllInOne.
Remotelog.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
allinonespy.exe
inject.dll
run.exe
runwin95.exe
%System%\applog.dll
%System%\inetlog.dll
%System%\keylogger.dll
%System%\log.dll
%System%\remotelog.dll
%System%\screenlog.dll
%System%\soundlog.dll
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove remotelog.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\repairs303169572.dll

%SysDir%\repairs303169572.dll is a Malware.
Kill the file %SysDir%\repairs303169572.dll and remove %SysDir%\repairs303169572.dll from Windows startup using RegRun.
www.regrun.com

%sysdir%\requester.11.exe

requester.11.exe is a Trojan.Muquest.
requester.11.exe opens a back door.
Related files:
%System%\requester.11.exe
%System%\system.req.11
Adds the value:
"Requester" = "%System%\requester.11.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill requester.11.exe process and remove requester.11.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\rfa2.dll

rfa2.dll is a Trojan.Bankash-L.
rfa2.dll tries to terminate antiviral programs installed on a user computer.
rfa2.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\rfa2.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove rfa2.dll Windows startup using RegRun Startup Optimizer.

%sysdir%\rftqbym.exe

%SysDir%\rftqbym.exe is Trojan/Backdoor.
Kill the process %SysDir%\rftqbym.exe and remove %SysDir%\rftqbym.exe from Windows startup.

%sysdir%\rftqbyma.exe

RftqbymA.exe is Trojan/Backdoor.
Kill the process rftqbymA.exe and remove rftqbymA.exe from Windows startup.

%sysdir%\rgtcvc32.dll

rgtcvc32.dll is a Spyware.BeyondKeylog.
rgtcvc32.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%ProgramFiles%\Supremtec\csrss.exe
%System%\emconv.exe
%System%\rgtcvc32.dll
%System%\msrep32.dll
%System%\mstrc32.dll
More info:
Removal:
Remove rgtcvc32.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\richedtr.dll

Richedtr.dll is a Spyware.SafeSurfing.
Richedtr.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Windir%\asbltzun.exe
%Windir%\netsync.exe
%Windir%\rsyncmon.dll
%Windir%\ISSM0064.DAT
%System%\COMMCOS2.DLL
%System%\InstallerV3.exe
%System%\regsync.exe
%System%\richedtr.dll
%System%\richup.exe
%System%\redtrsha.dll
%System%\vbrundll.dll
%System%\VBUninstall.exe
%System%\msxml3a.dll
Adds the value:
"RSync" = "%Windir%\netsync.exe"
"regsync" = "C:\WINDOWS\System32\regsync.exe"
"richup" = "C:\WINDOWS\System32\richup.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove richedtr.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\richup.exe

Richup.exe is a Spyware.SafeSurfing.
Richup.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Windir%\asbltzun.exe
%Windir%\netsync.exe
%Windir%\rsyncmon.dll
%Windir%\ISSM0064.DAT
%System%\COMMCOS2.DLL
%System%\InstallerV3.exe
%System%\regsync.exe
%System%\richedtr.dll
%System%\richup.exe
%System%\redtrsha.dll
%System%\vbrundll.dll
%System%\VBUninstall.exe
%System%\msxml3a.dll
Adds the value:
"RSync" = "%Windir%\netsync.exe"
"regsync" = "C:\WINDOWS\System32\regsync.exe"
"richup" = "C:\WINDOWS\System32\richup.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill richup.exe process and remove richup.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\richword.exe

richword.exe is a worm W32.Sdranck-V.
richword.exe opens a back door.
richword.exe spreads via open network shares.
Related files:
%System%\msstill.exe
%System%\rapking.exe
%System%\richword.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill richword.exe process and remove richword.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\rmdsregm.exe

%SysDir%\rmdsregm.exe is Adware.ZenoSearch.
Kill the process %SysDir%\rmdsregm.exe and remove %SysDir%\rmdsregm.exe from Windows startup using RegRun.
www.regrun.com
Read more: http://www.symantec.com/avcenter/venc/da...

%sysdir%\rmtct.exe

rmtct.exe is a Trojan.Dloadr-GW.
rmtct.exe downloads code from the internet.
Related files:
%System%\services.exe
%System%\rmtct.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill rmtct.exe process and remove rmtct.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\rnll32.exe

rnll32.exe is a Trojan.QQPass-AG.
rnll32.exe tries to terminate antiviral programs installed on a user computer.
rnll32.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\rnll32.exe
%System%\runt32.exe
%System%\rull32.dll
%System%\rnull32.dll
%System%\temp1.jpg
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill rnll32.exe process and remove rnll32.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\rnull32.dll

rnull32.dll is a Trojan.QQPass-AG.
rnull32.dll tries to terminate antiviral programs installed on a user computer.
rnull32.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\rnll32.exe
%System%\runt32.exe
%System%\rull32.dll
%System%\rnull32.dll
%System%\temp1.jpg
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove rnull32.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\rodll.dll

rodll.dll is a Trojan.Ragrok-A.
rodll.dll tries to terminate antiviral programs installed on a user computer.
rodll.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Windows%\rundll132.exe
%System%\rodll.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove winkey.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\rpc32.dll

rpc32.dll is a Trojan.Usblog-A.
rpc32.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\rpc32.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove rpc32.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\rpc32.exe

W32.Bagz.E@mm is a spam worm.
It uses its SMTP engine to send emails.
1. Creates the following copies of itself:
* %System%\rpc32.exe
* %System%\run32.exe
* %system%\sysboot.doc (many spaces) .exe
2. Infects the HOSTS file.
Blocks access to antiviral sites and to Microsoft update.
3. Sends e-mails.

Removal:
Remove it from startup using RegRun Startup Optimizer.
Restore the HOSTS file using RegRun Anti-Spyware.
Stop the service and set it to disabled state.
Remove files.

%sysdir%\rpccenter.exe

RpcCenter.exe is a Trojan W32.Sdbot-AQH.
RpcCenter.exe opens a back door on IRC channels.
RpcCenter.exe spreads via open network shares.
Related files:
%System%\RpcCenter.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill RpcCenter.exe process and remove RpcCenter.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\rpclocator.exe

rpclocator.exe is a worm W32.Codbot-Q.
rpclocator.exe opens a back door.
rpclocator.exe spreads via open network shares.
rpclocator.exe tries to terminate antiviral programs installed on a user computer.
rpclocator.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\rpclocator.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill rpclocator.exe process and remove rpclocator.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\rpe.sys

rpe.sys is rootkit Backdoor.Ryejet.
rpe.sys is used to hide files, processes and registry.
rpe.sys is a kernel mode rootkit.
Rootkit contacts remote hacker server using HTTP session.
rpe.sys created new system drivers:
service name: "MdeRy"
Related files:
%SysDir%\asr_sdm.exe
%SysDir%\asr_sdmr.exe
%SysDir%\asr_ssmr
%SysDir%\sal.mdb
%SysDir%\rpe.sys
%WinDir%\svchost.exe
Adds the value:
"Userinit" = "%System%\userinit.exe,[Random number of spaces],,%Windir%\svchost.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
to the Windows startup registry keys.
Added to registry:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\MdeRy
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Enum\Root\LEGACY_MDERY
HKEY_CURRENT_USER\Software\Microsoft\PCHealth
More info: http://www.symantec.com/security_respons...

%sysdir%\rsasec.dll

rsasec.dll is a Trojan.Stawin-I.
rsasec.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\ntsvc.exe
%System%\wmiprvse.exe
%Windows%\userlogon.exe
%System%\rsasec.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove rsasec.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\rservers.exe

Rservers.exe is a Trojan W32.Forbot-FM.
Rservers.exe opens a back door.
Rservers.exe spreads via open network shares.
Related files:
%System%\rservers.exe
Removal:
Kill rservers.exe process and remove rservers.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\rsn.exe

rsn.exe is a Trojan.Keylog-AU.
rsn.exe records keystrokes.
Related files:
%System%\fixapi.exe
%System%\rsn.exe
%System%\hotkey.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill rsn.exe process and remove rsn.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\rtkit.exe

rtkit.exe is a Trojan.NtRootK-J.
rtkit.exe opens a back door.
rtkit.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\RtKit\rtkit.exe
%System%\RtKit\globalc.dll
%System%\RtKit\npf.sys
%System%\RtKit\rtkit.log
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill rtkit.exe process and remove rtkit.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\rtkit\npf.sys

npf.sys is rootkit Trojan.NtRootK-H.
npf.sys is used to hide files, processes and registry.
npf.sys is a kernel mode rootkit.
Rootkit creates new system drivers.
npf.sys opens a back door on on TCP port 445.
npf.sys monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%SysDir%\RtKit\rtkit.exe
%SysDir%\RtKit\globalc.dll
%SysDir%\RtKit\npf.sys
%SysDir%\RtKit\rtkit.log
Adds the value:
HKLM\SYSTEM\CurrentControlSet\Services\NPF
HKLM\SOFTWARE\rtkit\
to the Windows startup registry keys.
More info: http://www.sophos.com/virusinfo/analyses...

%sysdir%\rtneg.dll

rtneg.dll is an adware program Adware.Begin2search.
rtneg.dll monitors user Internet activity.
rtneg.dll displays advertising information.
Related files:
%System%\reg6523.exe
%System%\winb2s32.dll
%System%\winbbb.dat
%System%\dsktrf.dll
%System%\ns.dll
%System%\trgen32.dll
%System%\rtneg32.dll
%Windir%\Downloaded Program Files\winb2s32.inf
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove rtneg.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\rull32.dll

rull32.dll is a Trojan.QQPass-AG.
rull32.dll tries to terminate antiviral programs installed on a user computer.
rull32.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\rnll32.exe
%System%\runt32.exe
%System%\rull32.dll
%System%\rnull32.dll
%System%\temp1.jpg
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove rull32.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\run.exe

Run.exe is a Backdoor W32.Gaobot.DEY.
Run.exe spreads via open network shares.
Run.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%system%\run.exe
Adds the value:
"Windows" = "run.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill run.exe process and remove run.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\run_dll.exe

run_dll.exe is an adware program Adware.Yuupsearch.
run_dll.exe installs an Internet Explorer toolbar.
Related files:
yoop.exe
IE_agent.exe
%System%\run_dll.exe
Adds the value:
"MSTask" = "%System%\run_dll.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill run_dll.exe process and remove run_dll.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\rund013.exe

Rund013.exe is a Trojan.StartPa-HX.
Rund013.exe downloads code from the internet.
Rund013.exe modifies data on the computer.
Related files:
%Windows%\n0tepad.exe
%System%\Rund013.exe
%System%\n0tepad.exe
%System%\windll.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill Rund013.exe process and remove Rund013.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\rund1132.exe

rund1132.exe is a worm W32.Dopbot.
rund1132.exe opens a back door.
Svthx.exe spreads by exploiting the Microsoft Windows DCOM RPC Interface Buffer Overrun Vulnerability (Microsoft Security Bulletin MS03-026).
Related files:
%System%\rund1132.exe
Adds the value:
"rund1132.exe" = "%System%\rund1132.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill rund1132.exe process and remove rund1132.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\rundll32.dll

%SysDir%\rundll32.dll is Zango Adware.
Kill the file %SysDir%\rundll32.dll and remove %SysDir%\rundll32.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\rundll32.exe setupapi,installhinfsection marketplacelinkinstall 896 %systemroot%\inf\ie.inf

Adds link to windowsmarketplace.com site to the IE Links.
Installed with XP SP2.
Not required.

%sysdir%\rundll32.exe windhcp.ocx,start

%SysDir%\rundll32.exe windhcp.ocx,start is Trojan.Win32.Agent.abf.
Read more: http://research.sunbelt-software.com/thr...
Kill the file %SysDir%\rundll32.exe windhcp.ocx,start and remove %SysDir%\rundll32.exe windhcp.ocx,start from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\rundll64.dll

rundll64.dll is a Trojan.LegMir-BD.
rundll64.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\rundll32.dll
%System%\rundll64.dll
%System%\rundll64.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove rundll64.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\runlli32.exe

runlli32.exe is a Trojan.QQPass-U.
runlli32.exe tries to terminate antiviral programs installed on a user computer.
runlli32.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\runlli32.exe
%System%\winnnn.dll
Removal:
Kill runlli32.exe process and remove runlli32.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\runsrv32.dll

Runsrv32.dll is an adware program Adware.Topantispyware.
Runsrv32.dll displays advertisements.
Related files:
%System%\hookdump.exe
%System%\runsrv32.exe
%System%\srpcsrv32.dll
%System%\runsrv32.dll
%System%\txfdb32.dll
%System%\r.exe
Adds the value:
"Srv32 spool service" = "%Windir%\System32\runsrv32.exe"
"Intel system tool" = "%System%\hookdump.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove runsrv32.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\runsrv32.exe

Runsrv32.exe is an adware program Adware.Topantispyware.
Runsrv32.exe displays advertisements.
Related files:
%System%\hookdump.exe
%System%\runsrv32.exe
%System%\srpcsrv32.dll
%System%\runsrv32.dll
%System%\txfdb32.dll
%System%\r.exe
Adds the value:
"Srv32 spool service" = "%Windir%\System32\runsrv32.exe"
"Intel system tool" = "%System%\hookdump.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill runsrv32.exe process and remove runsrv32.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\runt32.exe

runt32.exe is a Trojan.QQPass-AG.
runt32.exe tries to terminate antiviral programs installed on a user computer.
runt32.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\rnll32.exe
%System%\runt32.exe
%System%\rull32.dll
%System%\rnull32.dll
%System%\temp1.jpg
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill runt32.exe process and remove runt32.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\rx.exe

rx.exe is a Spyware.XpcSpy.
rx.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%ProgramFiles%\XSoftware\Working\XPCSpyPro.exe
%ProgramFiles%\XSoftware\XPCSpyPro\AppSpy.dll
%ProgramFiles%\XSoftware\XPCSpyPro\IESpy.dll
%ProgramFiles%\XSoftware\XPCSpyPro\KeySpy.dll
%ProgramFiles%\XSoftware\Working\AppMon.dll
%ProgramFiles%\XSoftware\Working\IEMon.dll
%ProgramFiles%\XSoftware\Working\KeyMon.dll
%System%\systemout.exe
%System%\SysDll32.dll
%System%\rx.exe
%System%\wintft.dll
Adds the value:
"System Check" = "Rundll32.exe SysDll32.dll,SystemCheck"
"ImagePath" = "%System%\systemout.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill rx.exe process and remove rx.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\rxdll.dll

rxdll.dll is a Trojan.Gamec-G.
rxdll.dll tries to terminate antiviral programs installed on a user computer.
rxdll.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Windows%\rundll32.exe
%System%\rxdll.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove rxdll.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\ryzo32.exe

ryzo32.exe is a Trojan W32.Spybot-EJ.
ryzo32.exe opens a back door on IRC channels.
ryzo32.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\ryzo32.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill ryzo32.exe process and remove ryzo32.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\sachostb.exe

sachostb.exe is a mass-mailing worm W32.Looksky.A@mm.
sachostb.exe opens a back door on TCP port 321.
sachostb.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%Windir%\sachostx.exe
%System%\msvcrl.dll
%System%\sachostb.exe
%System%\sachostc.exe
%System%\sachostp.exe
%System%\sachosts.exe
%System%\sachostw.exe
%System%\sachostm.exe
Adds the value:
"HostSrv" = "%Windir%\sachostx.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill sachostb.exe process and remove sachostb.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\sachostc.exe

sachostc.exe is a mass-mailing worm W32.Looksky.A@mm.
sachostc.exe opens a back door on TCP port 321.
sachostc.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%Windir%\sachostx.exe
%System%\msvcrl.dll
%System%\sachostb.exe
%System%\sachostc.exe
%System%\sachostp.exe
%System%\sachosts.exe
%System%\sachostw.exe
%System%\sachostm.exe
Adds the value:
"HostSrv" = "%Windir%\sachostx.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill sachostc.exe process and remove sachostc.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\sachostm.exe

sachostm.exe is a mass-mailing worm W32.Looksky.A@mm.
sachostm.exe opens a back door on TCP port 321.
sachostm.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%Windir%\sachostx.exe
%System%\msvcrl.dll
%System%\sachostb.exe
%System%\sachostc.exe
%System%\sachostp.exe
%System%\sachosts.exe
%System%\sachostw.exe
%System%\sachostm.exe
Adds the value:
"HostSrv" = "%Windir%\sachostx.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill sachostm.exe process and remove sachostm.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\sachostp.exe

sachostp.exe is a mass-mailing worm W32.Looksky.A@mm.
sachostp.exe opens a back door on TCP port 321.
sachostp.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%Windir%\sachostx.exe
%System%\msvcrl.dll
%System%\sachostb.exe
%System%\sachostc.exe
%System%\sachostp.exe
%System%\sachosts.exe
%System%\sachostw.exe
%System%\sachostm.exe
Adds the value:
"HostSrv" = "%Windir%\sachostx.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill sachostp.exe process and remove sachostp.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\sachosts.exe

sachosts.exe is a mass-mailing worm W32.Looksky.A@mm.
sachosts.exe opens a back door on TCP port 321.
sachosts.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%Windir%\sachostx.exe
%System%\msvcrl.dll
%System%\sachostb.exe
%System%\sachostc.exe
%System%\sachostp.exe
%System%\sachosts.exe
%System%\sachostw.exe
%System%\sachostm.exe
Adds the value:
"HostSrv" = "%Windir%\sachostx.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill sachosts.exe process and remove sachosts.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\sachostw.exe

sachostw.exe is a mass-mailing worm W32.Looksky.A@mm.
sachostw.exe opens a back door on TCP port 321.
sachostw.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%Windir%\sachostx.exe
%System%\msvcrl.dll
%System%\sachostb.exe
%System%\sachostc.exe
%System%\sachostp.exe
%System%\sachosts.exe
%System%\sachostw.exe
%System%\sachostm.exe
Adds the value:
"HostSrv" = "%Windir%\sachostx.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill sachostw.exe process and remove sachostw.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\samx.exe

Backdoor.Sdbot.AE
Trojan horse program that spreads via network shares.
1. Copies itself as %System%\samx.exe.
2. Adds to registry Run keys.
3. Creates a service named "FireWire Driver," which points to:
"%System%\samx.exe" -netsvcs
Programs allows attcker to execute any commands on the target computer.
Removal:
Use RegRun Start Control to stop theservice and change it to disabled state.
Remove the file.
Remove from startup.

%sysdir%\sanlib.dll

sanlib.dll is a Trojan.Darkmoon.C.
sanlib.dll opens a back door on TCP port 81, 8080, or 8088..
sanlib.dll spreads via open network shares.
Related files:
%System%\kbdusb.dll
%System%\kbdyl.dll
%System%\localsp.dll
%System%\lodcst.exe
%System%\sanlib.dll
%System%\acctrse.dll
Adds the value:
lds" = "%System%\lodcst.exe
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove sanlib.dll using RegRun "Scan for Viruses" feature.
http://www.regrun.com

%sysdir%\satdll.dll

satdll.dll is a Trojan.Haxdoor-AS.
satdll.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\satdll.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove satdll.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\savservices.exe

savservices.exe is a Trojan W32.Rbot-ANU.
savservices.exe opens a back door.
savservices.exe to terminate antiviral programs installed on a user computer.
savservices.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\savservices.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill savservices.exe process and remove savservices.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\scalpe91.exe

%SysDir%\scalpe91.exe is Trojan/Backdoor.
Kill the process scalpe91.exe and remove scalpe91.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\scanregw.exe

%SysDir%\scanregw.exe is worm Nyxem.
Kill the process %SysDir%\scanregw.exe and remove %SysDir%\scanregw.exe from Windows startup.
Related files:
- %Windows%\rundll16.exe
- %System%\scanregw.exe
- %System%\Update.exe
- %System%\Winzip.exe
http://www.f-secure.com/v-descs/nyxem_e....

%sysdir%\scapp.exe

scApp.exe is a W32.Stando-A.
scApp.exe opens a back door.
scApp.exe spreads via open network shares.
Related files:
%System%\mgrShell.exe
%System%\scApp.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill scApp.exe process and remove scApp.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\scardclnt.exe

SCardClnt.exe is a worm W32.Codbot-K.
SCardClnt.exe opens a back door on IRC channels.
SCardClnt.exe spreads via open network shares.
Related files:
%System%\SCardClnt.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill SCardClnt.exe process and remove SCardClnt.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\scardsvr32.dll

SCARDSVR32.DLL is a WORM_MOFEI.B.
SCARDSVR32.DLL opens a back door.
SCARDSVR32.DLL spreads via open network shares.
SCARDSVR32.DLL monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\SCARDSVR32.EXE
%System%\SCARDSVR32.DLL
%System%\MOFEI.CFG
More info: http://www.trendmicro.com/vinfo/virusenc...
Removal:
Remove SCARDSVR32.DLL using RegRun "Scan for Viruses" feature.
http://www.regrun.com

%sysdir%\scardsvr32.exe

SCARDSVR32.EXE is a WORM_MOFEI.B.
SCARDSVR32.EXE opens a back door.
SCARDSVR32.EXE spreads via open network shares.
SCARDSVR32.EXE monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\SCARDSVR32.EXE
%System%\SCARDSVR32.DLL
%System%\MOFEI.CFG
More info: http://www.trendmicro.com/vinfo/virusenc...
Removal:
Kill the process SCARDSVR32.EXE and remove SCARDSVR32.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\scchostc.exe

scchostc.exe is a Trojan.Tofdrop-B.
scchostc.exe opens a back door.
Related files:
%System%\scchost.exe
%System%\scchostc.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill scchostc.exe process and remove scchostc.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\schedsvc32.exe

schedsvc32.exe is a Trojan W32/Rbot-ASJ.
schedsvc32.exe opens a back door on IRC channels.
schedsvc32.exe spreads via open network shares.
Related files:
%System%\schedsvc32.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill schedsvc32.exe process and remove schedsvc32.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\scheduler.exe

W32/Agobot-LQ is an IRC backdoor Trojan and network worm which establishes an IRC channel to a remote server.
May attempt to terminate anti-virus and other security-related processes.
May search for shared folders on the internet with weak passwords and copy itself into them.
A text file named HOSTS in C:\\drivers\etc\ may be created or overwritten with a list of anti-virus and other security-related websites, each bound to the IP loopback address of 127.0.0.1 which would effectively prevent access to these sites.

You can remove it with RegRun Startup Optimizer.

%sysdir%\scpr32b.exe

Scpr32b.exe is a Backdoor Trojan.Webus.G .
scpr32b.exe spreads by e-mail and via open network shares.
scpr32b.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\scpr32b.exe
%Windir%\System\CSRSS.EXE
C:\netlog.exe
Adds the value:
".svchost" = "%Windir%\System\CSRSS.EXE"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill scpr32b.exe process and remove scpr32b.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\screenlog.dll

Screenlog.dll is a Spyware.AllInOne.
Screenlog.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
allinonespy.exe
inject.dll
run.exe
runwin95.exe
%System%\applog.dll
%System%\inetlog.dll
%System%\keylogger.dll
%System%\log.dll
%System%\remotelog.dll
%System%\screenlog.dll
%System%\soundlog.dll
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove screenlog.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\screenrx\scrspy21.exe

scrspy21.exe is a Spyware.Screenspy.
scrspy21.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\ScreenRX\comdlg32.ocx
%System%\ScreenRX\IJL11.DLL
%System%\ScreenRX\mscomct2.ocx
%System%\ScreenRX\MSCOMCTL.OCX
%System%\ScreenRX\readme.rtf
%System%\ScreenRX\SYSINFO.OCX
%System%\ScreenRX\scrspy21.exe
%System%\ScreenRX\unins000.exe
%System%\ScreenRX\win16dll.exe
Adds the value:
"win16.dll" = "%System%\ScreenRX\win16dll.exe"
"srv32win" = "%System%\ScreenRX\win16dll.exe"
"[Default]" = "%System%\ScreenRX\[file name]"
to the Windows startup registry keys.
More info http://securityresponse.symantec.com/avc...
Removal:
Kill scrspy21.exe process and remove scrspy21.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\screenrx\win16dll.exe

win16dll.exe is a Spyware.Screenspy.
win16dll.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\ScreenRX\comdlg32.ocx
%System%\ScreenRX\IJL11.DLL
%System%\ScreenRX\mscomct2.ocx
%System%\ScreenRX\MSCOMCTL.OCX
%System%\ScreenRX\readme.rtf
%System%\ScreenRX\SYSINFO.OCX
%System%\ScreenRX\scrspy21.exe
%System%\ScreenRX\unins000.exe
%System%\ScreenRX\win16dll.exe
Adds the value:
"win16.dll" = "%System%\ScreenRX\win16dll.exe"
"srv32win" = "%System%\ScreenRX\win16dll.exe"
"[Default]" = "%System%\ScreenRX\[file name]"
to the Windows startup registry keys.
More info http://securityresponse.symantec.com/avc...
Removal:
Kill win16dll.exe process and remove win16dll.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\scridows.exe

Scridows.exe is an adware program Adware.Adtest.
Scridows.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\intnets.exe
%System%\scridows.exe
%System%\sysinfer.exe
%Windir%\msfiles.exe
Adds the value:
"intnets" = "%System%\intnets.exe"
"sysinfer" = "%System%\sysinfer.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill scridows.exe process and remove scridows.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\scrigz.exe

scrigz.exe is a mass-mailing worm W32.Mytob-ER.
scrigz.exe opens a back door on IRC channels.
scrigz.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\scrigz.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill scrigz.exe process and remove scrigz.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\scrss.exe

scrss.exe is rootkit Trojan.HacDef-R.
scrss.exe is used to hide files, processes and registry.
scrss.exe is a kernel mode rootkit.
Rootkit contacts remote hacker server using HTTP session.
Related files:
%SysDir%\scrss.exe
Adds the value:
HKLM\SYSTEM\CurrentControlSet\Services\scrss
ImagePath
%SysDir%\scrss.exe
to the Windows startup registry keys.
Added to registry:
HKLM\SOFTWARE\Network Associates\TVD
More info: http://www.sophos.com/virusinfo/analyses...

%sysdir%\scvhost2.exe

scvhost2.exe is a worm W32/Rbot-BAH.
scvhost2.exe opens a back door on IRC channels.
scvhost2.exe spreads via open network shares.
Related files:
%System%\scvhost2.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill scvhost2.exe process and remove scvhost2.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\sdqgvqcm.sys

sdqgvqcm.sys is rootkit Trojan.Agent-BSL.
sdqgvqcm.sys is used to hide files, processes and registry.
sdqgvqcm.sys is a kernel mode rootkit.
Rootkit contacts remote hacker server using HTTP session.
sdqgvqcm.dll is created new system driver:
service name: "SENS"
display name: "SENS"
Related files:
%SysDir%\drivers\sdqgvqcm.sys
%SysDir%\sdqgvqcm.dll
%SysDir%\sdqgvqcm.drv
%Temp%\abs.exe
More info: http://www.sophos.com/security/analyses/...

%sysdir%\sdsys.exe

sdsys.exe is a Trojan W32.Forbot-JG.
sdsys.exe opens a back door on IRC channels.
sdsys.exe spreads via open network shares.
sdsys.exe tries to terminate antiviral programs installed on a user computer.
sdsys.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\sdsys.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill sdsys.exe process and remove sdsys.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\searchdll.dll

%sysdir%\sec5dec.exe

sec5dec.exe is a mass-mailing worm W32.Atak.G@mm.
sec5dec.exe spreads by e-mail.
Related files:
%System%\sec5dec.exe
Adds the value:
"run" = "%System%\sec5dec.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill sec5dec.exe process and remove sec5dec.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\secarik.exe

secarik.exe is a worm W32.Sdranck-X.
secarik.exe opens a back door.
secarik.exe spreads via open network shares.
Related files:
%System%\gomex.exe
%System%\nexom.exe
%System%\secarik.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill secarik.exe process and remove secarik.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\securenetbios.exe

SecureNetbios.exe is a Trojan.Delsha.B.
SecureNetbios.exe deletes network shared folders.
Related files:
%System%\SecureNetbios.exe
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill SecureNetbios.exe process and remove SecureNetbios.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\securewinload32x.exe

securewinload32x.exe is a Trojan.OptixP-N.
securewinload32x.exe opens a back door.
Related files:
%System%\securewinload32x.exe
%System%\system32dir2a.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill securewinload32x.exe process and remove securewinload32x.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\security\bin\bugslayerutil.dll

Bugslayerutil.dll is a Trojan Backdoor.Sumtax.
Bugslayerutil.dll tries to terminate antiviral programs installed on a user computer.
Bugslayerutil.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%SysDir%\Security\Bin\Bugslayerutil.dll
%SysDir%\Security\Bin\Die.exe
%SysDir%\Security\Bin\Jasfv.dll
%SysDir%\Security\Bin\Psexec.exe
%SysDir%\Security\Bin\Secure.exe
%SysDir%\Security\Bin\Tzolibr.dll
%SysDir%\Security\Bin\Xscan.exe
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove Bugslayerutil.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\security\bin\die.exe

Die.exe is a Trojan Backdoor.Sumtax.
Die.exe tries to terminate antiviral programs installed on a user computer.
Die.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%SysDir%\Security\Bin\Bugslayerutil.dll
%SysDir%\Security\Bin\Die.exe
%SysDir%\Security\Bin\Jasfv.dll
%SysDir%\Security\Bin\Psexec.exe
%SysDir%\Security\Bin\Secure.exe
%SysDir%\Security\Bin\Tzolibr.dll
%SysDir%\Security\Bin\Xscan.exe
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill Die.exe process and remove Die.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\security\bin\jasfv.dll

Jasfv.dll is a Trojan Backdoor.Sumtax.
Jasfv.dll tries to terminate antiviral programs installed on a user computer.
Jasfv.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%SysDir%\Security\Bin\Bugslayerutil.dll
%SysDir%\Security\Bin\Die.exe
%SysDir%\Security\Bin\Jasfv.dll
%SysDir%\Security\Bin\Psexec.exe
%SysDir%\Security\Bin\Secure.exe
%SysDir%\Security\Bin\Tzolibr.dll
%SysDir%\Security\Bin\Xscan.exe
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove Jasfv.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\security\bin\psexec.exe

Psexec.exe is a Trojan Backdoor.Sumtax.
Psexec.exe tries to terminate antiviral programs installed on a user computer.
Psexec.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%SysDir%\Security\Bin\Bugslayerutil.dll
%SysDir%\Security\Bin\Die.exe
%SysDir%\Security\Bin\Jasfv.dll
%SysDir%\Security\Bin\Psexec.exe
%SysDir%\Security\Bin\Secure.exe
%SysDir%\Security\Bin\Tzolibr.dll
%SysDir%\Security\Bin\Xscan.exe
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill Psexec.exe process and remove Psexec.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\security\bin\secure.exe

Secure.exe is a Trojan Backdoor.Sumtax.
Secure.exe tries to terminate antiviral programs installed on a user computer.
Secure.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%SysDir%\Security\Bin\Bugslayerutil.dll
%SysDir%\Security\Bin\Die.exe
%SysDir%\Security\Bin\Jasfv.dll
%SysDir%\Security\Bin\Psexec.exe
%SysDir%\Security\Bin\Secure.exe
%SysDir%\Security\Bin\Tzolibr.dll
%SysDir%\Security\Bin\Xscan.exe
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill Secure.exe process and remove Secure.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\security\bin\tzolibr.dll

Tzolibr.dll is a Trojan Backdoor.Sumtax.
Tzolibr.dll tries to terminate antiviral programs installed on a user computer.
Tzolibr.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%SysDir%\Security\Bin\Bugslayerutil.dll
%SysDir%\Security\Bin\Die.exe
%SysDir%\Security\Bin\Jasfv.dll
%SysDir%\Security\Bin\Psexec.exe
%SysDir%\Security\Bin\Secure.exe
%SysDir%\Security\Bin\Tzolibr.dll
%SysDir%\Security\Bin\Xscan.exe
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove Tzolibr.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\security\bin\xscan.exe

Xscan.exe is a Trojan Backdoor.Sumtax.
Xscan.exe tries to terminate antiviral programs installed on a user computer.
Xscan.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%SysDir%\Security\Bin\Bugslayerutil.dll
%SysDir%\Security\Bin\Die.exe
%SysDir%\Security\Bin\Jasfv.dll
%SysDir%\Security\Bin\Psexec.exe
%SysDir%\Security\Bin\Secure.exe
%SysDir%\Security\Bin\Tzolibr.dll
%SysDir%\Security\Bin\Xscan.exe
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill Xscan.exe process and remove Xscan.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\security32.exe

Security32.exe is an adware program Adware.Affilred.
Security32.exe monitors user Internet activity.
Related files:
usbwin32.exe
C:\CriticalUpdate.exe
C:\cab.exe
C:\winsecure.exe
%Windir%\twain_32.exe
%Windir%\mshotfix.exe
%Windir%\msupdate.exe
%System%\security32.exe
%System%\iProtect.exe
%System%\axe.exe
%System%\inetconnect.dll
%System%\comnt32.dll.
Adds the value:
"MSUpdate" = "c:\criticalUpdate.exe"
"Microsoft Security Hot Fix Update" = "%SystemRoot%\mshotfix.exe"
"Microsoft Cab Manager" = "c:\exec.exe"
"Windows Security Manager" = "c:\winsecure.exe"
"Windows Security Update" = "%Windir%\security32.exe"
"Userinit" = "%System%\userinit.exe, %Windir%\iProtect.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill security32.exe process and remove security32.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\semd32.dll

%SysDir%\semd32.dll is Trojan/Backdoor.
Remove semd32.dll using RegRun "Scan for Viruses" feature.
http://www.regrun.com

%sysdir%\semd64.sys

%SysDir%\semd64.sys is Trojan/Backdoor.
Kill the file semd64.sys and remove semd64.sys from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\sendmsg.dll

sendmsg.dll is a Trojan.Disgu-A.
sendmsg.dll opens a back door.
sendmsg.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\IEXPLORER.EXE
%System%\sendmsg.dll
%System%\Kernel.dll
%System%\systemlr.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove sendmsg.dll from Windows startup using RegRun Startup Optimize.

%sysdir%\serv3manager.exe

serv3manager.exe is a Trojan W32.Sdbot-AGO.
serv3manager.exe opens a back door on IRC channels.
Related files:
%System%\serv3manager.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill serv3manager.exe process and remove serv3manager.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\servce.exe

Servce.exe is a mass-mailing worm W32/Mytob-EI.
Servce.exe opens a back door.
Servce.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\servce.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill servce.exe process and remove servce.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\server.exe

server.exe is rootkit Trojan.Bifrose-JG.
server.exe is used to hide files, processes and registry.
server.exe is a user mode rootkit.
Rootkit injects itself into running process.
Related files:
%SysDir%\server.exe
%SysDir%\plugin1.dat
%SysDir%\SysPr.prx
Adds the value:
HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{9B71D88C-C598-4935-C5D1-43AA4DB90836}
stubpath
%SysDir%\server.exe s

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
IEUpdate
%SysDir%\server.exe
to the Windows startup registry keys.
Added to registry:
HKCU\Software\Wget\
More info: http://www.sophos.com/security/analyses/...

%sysdir%\serverx.exe

%SysDir%\Serverx.exe is Trojan/Backdoor.
Kill the process Serverx.exe and remove Serverx.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\service.exe

%SysDir%\service.exe is Trojan/Backdoor Troj/Multidr-CP.
service.exe is installed as the system service "R_SERVER".
Remore administration server.
Remove this service using RegRun Start Control.
http://www.sophos.com/virusinfo/analyses...

%sysdir%\service.exe

%sysdir%\service\explorer.exe

%SysDir%\service\explorer.exe is Trojan/Backdoor.
Kill the process %SysDir%\service\explorer.exe and remove %SysDir%\service\explorer.exe from Windows startup.

%sysdir%\servicemgrz.exe

servicemgrz.exe is a Trojan W32.Rbot-ASN.
servicemgrz.exe opens a back door.
servicemgrz.exe spreads via open network shares.
servicemgrz.exe tries to terminate antiviral programs installed on a user computer.
servicemgrz.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\servicemgrz.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill servicemgrz.exe process and remove servicemgrz.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\servicer.exe

%SysDir%\servicer.exe is Trojan/Backdoor.
Kill the process %SysDir%\servicer.exe and remove %SysDir%\servicer.exe from Windows startup.

%sysdir%\services.dll

Services.dll is a mass-mailing worm W32.Crowt.A@mm.
Services.dll opens a back door on TCP port 80.
Services.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\services.dll
%CommonProgramFiles%\services.exe
%Startup%\services.exe
%Templates%\services.exe
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove services.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\servicos..exe

servicos..exe is a Trojan.Dadobra-I.
servicos..exe downloads code from the internet.
Related files:
%System%\servicos..exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill servicos..exe process and remove servicos..exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\servics.bat

Dangerous virus.
Remove it from startup.

%sysdir%\servise64.exe

servise64.exe is a worm W32.Amirecivel.B.
servise64.exe spreads via open network shares.
servise64.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\AVG.exe
%System%\servise64.exe
%System%\winlogon64.exe
%System%\lssass.exe
%System%\civil.exe
Adds the value:
"amircivil" = "%System%[FILE NAME].exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill the process servise64.exe and remove servise64.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\servms.dll

Servms.dll is a Trojan PWSteal.Flecsip.
Servms.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\msserv.exe
%System%\servms.dll
Adds the value:
"msserv" = "%System%\msserv.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove servms.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\servr.dll

Servr.dll is a mass-mailing worm W32.Aprilcone.A@mm.
Servr.dll spreads by e-mail.
Related files:
%System%\syscon.exe
%System%\mschk.dll
%System%\Watcher.dll
%System%\sysMon.dll
%System%\syslog.dll
%System%\atchk.dll
%System%\sysmsg.dll
%System%\chkrun.dll
%System%\dskchk.dll
%System%\msevent.dll
%System%\ipchk.dll
%System%\client.dll
%System%\servr.dll
%System%\netchk.dll
%System%\mssys.dll
Adds the value:
"syscon" = "%System%\syscon.exe"
"AppInit_DLLs" = "%System%\Watcher.dll"
to the Windows startup registry keys.

More info: http://securityresponse.symantec.com/avc...
Removal:
Remove servr.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\servza.exe

servza.exe is Trojan/Backdoor.
Kill the process servza.exe and remove servza.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\setupex.exe

Setupex.exe is an adware program Adware.Websearch.
Setupex.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
common.dll
IExploreSkins.exe
PIB.exe
QDow_AS2.dll
setupex.exe
TBPS.exe
toolbar.dll
WSG.exe
WSup.exe
WToolsA.exe
WToolsB.dll
WToolsS.exe
btiein.dll
websearch.exe
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill setupex.exe process and remove setupex.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\sfc32.exe

sfc32.exe is a mass-mailing worm W32.Monikey@mm.
sfc32.exe tries to terminate antiviral programs installed on a user computer.
sfc32.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\mstcpmon.exe
%System%mswshell.dll
%System%\chkdskw.exe
%System%\itstore.dll
%System%\karnal32.dll
%System%\mslogon.dll
%System%\sfc32.exe
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill sfc32.exe process and remove sfc32.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\sfool.exe

Sfool.exe is a network-aware worm W32.Randex.EUS.
Sfool.exe opens a back door through IRC channels.
Sfool.exe spreads via open network shares.
Sfool.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\sfool.exe
Adds the value:
"mssfos" = "sfool.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill sfool.exe process and remove sfool.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\sfrcdlg32.exe

sfrcdlg32.exe is a worm W32.Rbot-AVY.
sfrcdlg32.exe opens a back door.
sfrcdlg32.exe spreads via open network shares.
sfrcdlg32.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\sfrcdlg32.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill sfrcdlg32.exe process and remove sfrcdlg32.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\sftmouse.dll

Sftmouse.dll is a Spyware.WebPI.
Sftmouse.dll logs keystrokes and captures screenshots.
Related files:
%System%\GVJPEG32.DLL
%System%\sftmouse.dll
%Windir%\wssys\ks.exe
%Windir%\wssys\mc.exe
%Windir%\wssys\WPIUnst.exe
%Windir%\wssys\wssys.exe
Adds the value:
"wssys" = "%Windir%\wssys\wssys.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove sftmouse.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\sgmf__mc.exe

SGMF__MC.EXE exe is Trojan/Backdoor.
Kill the process SGMF__MC.EXE and remove SGMF__MC.EXE from Windows startup.

%sysdir%\shdll.dll

shdll.dll is Trojan/Backdoor.
Remove shdll.dll using RegRun "Scan for Viruses" feature.
http://www.regrun.com

%sysdir%\she11.dll

she11.dll is a worm W32.Lewor-M.
she11.dll spreads via instant messenger.
she11.dll tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\qw.exe
%Windows%\wnilogon.exe
%System%\she11.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove she11.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\shell64.dll

%SysDir%\shell64.dll is Trojan/Backdoor.
Kill the file %SysDir%\shell64.dll and remove %SysDir%\shell64.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\shellexec.exe

shellexec.exe is a Trojan W32.Rbot-ANC.
shellexec.exe opens a back door.
shellexec.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\shellexec.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill shellexec.exe process and remove shellexec.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\shellexpl.exe

Shellexpl.exe is a Trojan Backdoor.Sheldor.
Shellexpl.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\Shellexpl.exe
%System%\Hndldt.ini
%System%\Winhndl.ini
Adds the value:
"Explorer"="%Sysdir%\Shellexpl.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill Shellexpl.exe process and remove Shellexpl.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\shellext\svchs0t.exe

svchs0t.exe is a Trojan.GwGhost-W.
svchs0t.exe opens a back door.
Related files:
%System%\ShellExt\svchs0t.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill svchs0t.exe process and remove svchs0t.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\shellext\syscntr.exe

%SysDir%\ShellExt\SYSCNTR.EXE is Porno Dialer.
Kill the process %SysDir%\ShellExt\SYSCNTR.EXE and remove %SysDir%\ShellExt\SYSCNTR.EXE from Windows startup.
http://securityresponse.symantec.com/avc...

%sysdir%\shellload.dll

ShellLoad.dll is a Trojan.IRCBot-AI.
ShellLoad.dll deletes files.
Related files:
%SysDir%\ShellLoad.exe
%SysDir%\ShellLoad.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove ShellLoad.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\shellload.exe

ShellLoad.exe is a Trojan.IRCBot-AI.
ShellLoad.exe deletes files.
Related files:
%SysDir%\ShellLoad.exe
%SysDir%\ShellLoad.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill ShellLoad.exe process and remove ShellLoad.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\shimgapi.dll

W32.Novarg.A@mm is a mass-mailing worm that arrives as an attachment with the file extension .bat, .cmd, .exe, .pif, .scr, or .zip.

When a computer is infected, the worm will set up a backdoor into the system by opening TCP ports 3127 through 3198, which can potentially allow an attacker to connect to the computer and use it as a proxy to gain access to its network resources.
In addition, the backdoor can download and execute arbitrary files.

The worm will perform a Denial of Service (DoS) starting on February 1, 2004. It also has a trigger date to stop spreading on February 12, 2004. These two events will only occur if the worm is run between or after those dates. While the worm will stop spreading on February 12, 2004, the backdoor component will continue to function after this date.

Searches for the email addresses in the files with same extensions.
Attempts to send email messages using its own SMTP engine.
The worm looks up the mail server that the recipient uses before sending the email. If it is unsuccessful, it will use the local mail server instead.
Removal:
Open RegRun Start Control, go to the Shell DLL's tab.
Remove the "shimgapi.dll" item.
Use RegRun Terminate feature to kill taskmon.exe.
Warning!
Please, do not touch "taskmon.exe" located in the Windows folder.
The Taskmon is legitimate application for Windows 98/Me.
The worm is located in the Windows\System or in Windows\System32 folder.

%sysdir%\shlapiw.dll

shlapiw.dll is a mass-mailing worm W32.Netsky.AL@mm.
shlapiw.dll tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\lsasrv.exe
%System%\iexplor.dll
%System%\shlapiw.dll
%System%\hserv.sys
Adds the value:
"lsass" = "%System%\lsasrv.exe"
"shell" = "explorer.exe %System%\lsasrv.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove shlapiw.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\shlapiw32.dll

%SysDir%\shlapiw32.dll is Trojan/Backdoor.
Remove shlapiw32.dllusing RegRun "Scan for Viruses" feature.
http://www.regrun.com

%sysdir%\showff.exe

ShowFF.exe is a Adware.FFToolBar.
ShowFF.exe display advertisements.
Related files:
%ProgramFiles%\FastFinder\fftoolbar.dll
%System%\ShowFF.exe
%Windir%\CJet.exe
%Windir%\nnmgr.exe
%Windir%\omi.dll
Adds the value:
"ShowFF" = "C:\Windows\System32\ShowFF.exe"
"nnmgr" = "C:\Windows\nnmgr.exe"
"CJET" = "C:\Windows\CJet.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill ShowFF.exe process and remove ShowFF.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\skinboxer43.dll

Skinboxer43.dll is a Spyware.CMK.
Skinboxer43.dll tries to terminate antiviral programs installed on a user computer.
Skinboxer43.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%ProgramFiles%\YKPMD\EventScheduler.mdb
%ProgramFiles%\YKPMD\Help.rtf
%ProgramFiles%\YKPMD\riched32.dll
%ProgramFiles%\YKPMD\YKPND.exe
%Windir%\Installer\cf1272.msi
%System%\actskn43.ocx
%System%\dijpg.dll
%System%\richtx32.ocx
%System%\skinboxer43.dll
Adds the value:
"C:\Program Files\YKPMD\" = "YKPND.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove skinboxer43.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\sks2drvr.sys

sks2drvr.sys is rootkit Trojan.Haxdoor-AN.
sks2drvr.sys is used to hide files, processes and registry.
sks2drvr.sys is a kernel mode rootkit.
Rootkit contacts remote hacker server using HTTP session.
sks2drvr.sys tries to terminate antiviral programs installed on a user computer.
sks2drvr.sys created new system drivers:
service name: " sks2drvr"
display name: "USB sks2drvr"
Added to registry:
HKLM\SYSTEM\CurrentControlSet\Services\sks2drvr\

Related files:
%SysDir%\sks2drvr.sys
%SysDir%\sksdll.dll

Adds the value:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sksdll
DllName
sksdll.dll

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sksdll
Startup
sksdll

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sksdll
Impersonate
1

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sksdll
Asynchronous
1

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sksdll
MaxWaut
1

HKLM\System\CurrentControlSet\Control\MPRServices\TestService
DllName
sksdll.dll

HKLM\System\CurrentControlSet\Control\MPRServices\TestService
EntryPoint
sksdll

HKLM\System\CurrentControlSet\Control\MPRServices\TestService
StackSize
0
to the Windows startup registry keys.

Added to registry:
HKLM\SYSTEM\CurrentControlSet\Services

HKLM\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\List\

More info: http://www.sophos.com/virusinfo/analyses...

%sysdir%\sksdll.dll

sksdll.dll is a Trojan Backdoor.Haxdoor.F.
sksdll.dll spreads via open network shares.
sksdll.dll tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\sksdll.dll
%System%\sksdrvr2.sys
Adds the value:
HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\ENUM\ROOT\LEGACY_SKSDRVR2
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\sksdrvr2
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Winlogon\Notify\sksdll
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove sksdll.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\sksdrvr2.sys

sksdrvr2.sys is rootkit Trojan.Haxdoor-AL.
sksdrvr2.sys is used to hide files, processes and registry.
sksdrvr2.sys is a kernel mode rootkit.
Rootkit contacts remote hacker server using HTTP session.
sksdrvr2.sys created new system drivers:
service name: "sksdrvr2"
display name: "USB sksDRVR2"
Added to registry:
HKLM\SYSTEM\CurrentControlSet\Services\sksdrvr2\

Related files:
%SysDir%\sksdll.dll
%SysDir%\sksdrvr2.sys
Adds the value:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sksdll
DllName
sksdll.dll

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sksdll
Startup
sksdll

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sksdll
Impersonate
1
to the Windows startup registry keys.

More info: http://www.sophos.com/virusinfo/analyses...

%sysdir%\skull.exe

%SysDir%\skull.exe is Trojan/Backdoor.
Kill the process %SysDir%\skull.exe and remove %SysDir%\skull.exe from Windows startup.

%sysdir%\skunk.exe

Skunk.exe is a worm W32.Sunk-A.
Skunk.exe spreads via chat programs.
Related files:
%SysDir%\Skunk.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill Skunk.exe process and remove Skunk.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\skybot.exe

Skybot.exe is a mass-mailing worm W32.Mytob.EB@mm .
Skybot.exe opens a back door on TCP port 6667.
Skybot.exe spreads via open network shares.
Skybot.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\skybot.exe
Adds the value:
"WINDOWS SYSTEM" = "skybot.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill skybot.exe process and remove skybot.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\skybotx.exe

skybotx.exe is a mass-mailing worm W32.Mytob.FO@mm.
skybotx.exe opens a back door on TCP port 2094 or TCP port 6543.
skybotx.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\nibie.exe
%System%\skybotx.exe
Adds the value:
"Windows System" = "nibie.exe"
"Windows System" = "skybotx.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill skybotx.exe process and remove skybotx.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\skype.exe

%SysDir%\Skype.exe is W32.Pykspa.A.
W32.Pykspa.A is a worm that spreads through Skype Instant Messenger.
Related files:
%Temp%\[ORIGINAL FILE NAME EXECUTABLE].jpg
%Temp%\[RANDOM CHARACTERS].exe
%System%\Invisible002.dll
%System%\Skype.exe
Read more: http://www.symantec.com/enterprise/secur...
Kill the process %SysDir%\Skype.exe and remove %SysDir%\Skype.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\skytown.exe

Skytown.exe is a Spyware.e2give.
Skytown.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%ProgramFiles%\E2g\iebhos.dll
%Windir%\pi1.exe
%System%\pruttct.exe
%System%\skytown.exe
%System%\prutpct.exe
%System%\ptech.exe
%System%\prutsct.exe
%System%\askearth17.exe
%UserProfile%\Desktop\filgmo.exe
%UserProfile%\Local Settings\Temp\ei.exe
Adds the value:
"pruttct" = "[path to Adware]"
"filgmo" = "C:\Documents and Settings\symantec\Desktop\filgmo.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill skytown.exe process and remove skytown.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\slay7383.exe

slay7383.exe is a Trojan.SikBot-A.
slay7383.exe opens a back door on IRC channels.
slay7383.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\slay7383.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill slay7383.exe process and remove slay7383.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\sldrv.dll

Sldrv.dll is a Spyware.KeyKey.
Sldrv.dll logs keystrokes and takes screenshots.
Related files:
%ProgramFiles%\KEYKEY\slman.exe
%ProgramFiles%\KEYKEY\slview.exe
%System%\sldrv.dll
%System%\zlib.dll
%System%\loadwin.exe
%ProgramFiles%\KEYKEY\keykey.exe
%ProgramFiles%\KEYKEY\kkmon.exe
%System%\kkdrv.dll
%System%\loadkk.exe
Adds the value:
"SL Loader" = "loadwin.exe"
"KK Loader" = "%System%\loadkk.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove sldrv.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\slinder.exe

Slinder.exe is a worm W32.Rbot-BFQ.
Slinder.exe opens a back door on IRC channels.
Slinder.exe spreads via open network shares.
Slinder.exe tries to terminate antiviral programs installed on a user computer.
Slinder.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\Slinder.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill Slinder.exe process and remove Slinder.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\slm32.sys

slm32.sys is rootkit W32/Tilebot-BT.
slm32.sys is used to hide files, processes and registry.
slm32.sys is a kernel mode rootkit.
Rootkit contacts remote hacker server using HTTP session.
slm32.sys spreads via open network shares.
slm32.sys opens a back door on IRC channels.
alg.exe created new system drivers:
service name: "Windows System Service Framework (WSSF)"
display name: "Windows System Service Framework (WSSF)"
Adds the value:
HKLM\SYSTEM\CurrentControlSet\Services\Windows System Service Framework (WSSF)\
to the Windows startup registry keys.

slm32.sys created new system drivers:
service name: "SLMDriver"
display name: "SLMDriver"
Added to registry:
HKLM\SYSTEM\CurrentControlSet\Services\SLMDriver\

Related files:
%WinDir%\alg.exe
%SysDir%\slm32.sys
Adds the value:
HKLM\SYSTEM\CurrentControlSet\Services\Messenger
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\RemoteRegistry
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\TlntSvr
Start
4
to the Windows startup registry keys.
Added to registry:
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
DoNotAllowXPSP2
1

HKLM\SOFTWARE\Microsoft\Ole
EnableDCOM
N

HKLM\SYSTEM\CurrentControlSet\Control\Lsa
restrictanonymous
1

HKLM\SOFTWARE\Microsoft\Security Center\
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\
More info: http://www.sophos.com/virusinfo/analyses...

%sysdir%\slserver.exe

%SysDir%\slserver.exe is Trojan/Backdoor.
Kill the process %SysDir%\slserver.exe and remove %SysDir%\slserver.exe from Windows startup.

%sysdir%\slssystem.exe

slssystem.exe is a Trojan W32.Rbot-ASV.
slssystem.exe opens a back door on IRC channels.
slssystem.exe spreads via open network shares.
slssystem.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\slssystem.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill slssystem.exe process and remove slssystem.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\smartmenuxp.dll

SmartMenuXP.dll is a Spyware.AceScreenSpy.
SmartMenuXP.dll is a commercial screen logger program.
Related files:
%System%\SmartMenuXP.dll
%ProgramFiles%\ScreenSpy\winacsr.exe
Adds the value:
"Winacsr"="%ProgramFiles%\ScreenSpy\Winacsr.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove SmartMenuXP.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\smart-ps.exe

Smart-PS.exe is a Trojan.SmymKit-B.
Smart-PS.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Windows%\system.exe
%System%\Agentsvr32.exe
%System%\Smart-PS.exe
%System%\hInstance.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill Smart-PS.exe process and remove Smart-PS.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\smcfg32.exe

smcfg32.exe is a Trojan.Banload-F.
smcfg32.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\smcfg32.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill smcfg32.exe process and remove smcfg32.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\smlo8thk.exe

smlo8thk.exe is a Trojan.PPdoor-Q.
smlo8thk.exe opens a back door.
smlo8thk.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\dpnetmsg.exe
%System%\iueninet.dll
%System%\fsmgntfs.dll
%System%\ntmapast.dll
%System%\ir50psrv.exe
%System%\kbd1uery.dll
%System%\lfyockaa.dll
%System%\a15svcs.exe
%System%\dpnmdlib.exe
%System%\c_28usic.dll
%System%\atiysnpn.dll
%System%\treemqoa.dll
%System%\arptutdn.dll
%System%\eulapart.dll
%System%\smlo8thk.exe
%System%\odbcfwci.ime
%System%\hgakheg.dll
%System%\jkwbhew.dll
%System%\testtest.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill smlo8thk.exe process and remove smlo8thk.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\smoc.exe

smoc.exe is a mass-mailing worm W32.Mytob.FU@mm.
smoc.exe opens a back door on TCP port 6667.
smoc.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\smoc.exe
Adds the value:
"WINDOWS SYSTEM" = "smoc.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill smoc.exe process and remove smoc.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\smres.exe

smres.exe is a Trojan W32.Agobot-UA.
smres.exe opens a back door on IRC channels.
smres.exe spreads via open network shares.
smres.exe tries to terminate antiviral programs installed on a user computer.
smres.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\smres.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill smres.exe process and remove smres.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\smrrs.exe

smrrs.exe is a worm W32.Rbot-AAK.
smrrs.exe opens a back door on IRC channels.
smrrs.exe spreads via open network shares.
smrrs.exe tries to terminate antiviral programs installed on a user computer.
smrrs.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\smrrs.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill smrrs.exe process and remove smrrs.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\smschk.exe

smschk.exe is a Trojan.IRCBot-AO.
smschk.exe opens a back door on IRC channels.
smschk.exe spreads via open network shares.
smschk.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\smschk.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill smschk.exe process and remove smschk.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\smsogx32.exe

smsogx32.exe is a Trojan.Stinx-K.
smsogx32.exe opens a back door.
Related files:
%System%\smsogx32.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill smsogx32.exe process and remove smsogx32.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\smsonx32.exe

smsonx32.exe is a Trojan.Stinx-I.
smsonx32.exe opens a back door on IRC channels.
Related files:
%System%\smsonx32.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill smsonx32.exe process and remove smsonx32.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\smss32.exe

smss32.exe is a Trojan.Flood-ET.
smss32.exe opens a back door on IRC channels.
Related files:
%System%\smss32.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill smss32.exe process and remove smss32.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\smss64.exe

smss64.exe is a Trojan.Flood-ES.
smss64.exe opens a back door on IRC channels.
Related files:
%System%\smss64.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill smss64.exe process and remove smss64.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\smsxir32.exe

smsxir32.exe is a Trojan.Stinx-L.
smsxir32.exe opens a back door.
Related files:
%System%\smsxir32.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill smsxir32.exe process and remove smsxir32.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\smszac32.exe

smszac32.exe is a Trojan.Stinx-H.
smszac32.exe opens a back door.
smszac32.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\smszac32.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill smszac32.exe process and remove smszac32.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\smtpx.dll

SmtpX.DLL is a Spyware.IamBigBrother.
SmtpX.DLL monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
cpanel.exe
nl.exe
ctl3d32.dll
winl.dll
dmm.dll
ma.exe
%System%\DOM.dll
%System%\DartFtp.dll
%System%\DartSock.dll
%System%\EncodeX.dll
%System%\MabryObj.dll
%System%\MimeX.dll
%System%\SmtpX.DLL
%Windir%\cp.exe
Adds the value:
"Windows System Tray" = "[PATH TO SECURITY RISK]"
"Windows Service Manager" = "[PATH TO SECURITY RISK]"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove SmtpX.DLL from Windows startup using RegRun Startup Optimizer.

%sysdir%\sndctl32.dll

sndctl32.dll is a Trojan.Dloadr-ACM.
sndctl32.dll downloads code from the internet.
Related files:
%System%\snddrv32.dll
%System%\sndctl32.dll
%System%\svcclient.exe
%System%\svcctl32.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove sndctl32.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\snddrv.exe

snddrv.exe is a worm W32.Rbot-BSC.
snddrv.exe opens a back door on IRC channels.
snddrv.exe spreads via open network shares.
Related files:
%System%\snddrv.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill snddrv.exe process and remove snddrv.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\snddrv32.dll

snddrv32.dll is a Trojan.Dloadr-ACM.
snddrv32.dll downloads code from the internet.
Related files:
%System%\snddrv32.dll
%System%\sndctl32.dll
%System%\svcclient.exe
%System%\svcctl32.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove snddrv32.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\sndmixex.dll

%SysDir%\sndmixex.dll is Trojan/Backdoor.
Kill the file sndmixex.dll and remove sndmixex.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\sndsrvice.exe

%SysDir%\SNDSRVICE.EXE is Trojan/Backdoor.
Kill the process %SysDir%\SNDSRVICE.EXE and remove %SysDir%\SNDSRVICE.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\snim.dll

snim.dll is a Trojan.StartPage.I.
snim.dll modifies Internet Explorer settings.
Related files:
%System%\snim.dll
Adds the value:
"Systems Restart" = "Rundll32.exe snim.dll,DllRegisterServer"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove snim.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\socks.dll

socks.dll is a Backdoor.Zagaban.
socks.dll spreads via open network shares.
Related files:
%System%\gld.exe
%System%\gld.dll
%System%\hosts.dll
%System%\socks.dll
Adds the value:
"Shell" = "explorer.exe %System%\gld.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove socks.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\soemuav.dll

soemuav.dll is rootkit Trojan.Dloadr-ASQ.
soemuav.dll is used to hide files, processes and registry.
soemuav.dll is a kernel mode rootkit.
Rootkit contacts remote hacker server using HTTP session.
Related files:
%SysDir%\20061223.exe
%SysDir%\soemuav.dll
Added to registry:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\msupdate
DllName
soemuav.dll
More info: http://www.sophos.com/security/analyses/...

%sysdir%\soft.exe

Trojan Admincash.
Disables Widnows security settings.
Download additional adware components.
Adds "run" = "%System%\soft.exe" to Windows startup registry keys.
Adds the value:
"Web Service" = "%System%\[random file name].exe"
to Active Setup registry keys.
Adds the value:
"DisableSR" = "0x00000001"
to the registry subkeys:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
SystemRestore
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
SystemRestore
to disable System Restore.
Adds the value:
"EnableFirewall" = "0x00000001"
to the registry subkeys:
HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\WindowsFirewall\
DomainProfile
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\
DomainProfile
HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\WindowsFirewall\
StandardProfile
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\
StandardProfile
to disable Windows security features.

"NoAutoUpdate" = "0x00000001"
"AUOptions" = "0x00000001"
to the registry subkeys:
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\
WindowsUpdate\AU
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\
WindowsUpdate\AU
to disable Windows Auto Update.

Adds the values:
"FirewallDisableNotify" = "0x00000001"
"UpdatesDisableNotify" = "0x00000001"
"AntiVirusDisableNotify" = "0x00000001"
to the registry subkeys:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Security Center
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
to disable notification of disabled firewall.
Creates the following files:
* %Windir%\explorer.new
* %Windir%\wininit.ini
Infects Explorer.exe at next reboot.
Download adware and dialer programs
Removal:
Restore explorer.exe using System File Checker in the Safe mode.
Remove Trojan from Windows startup.

%sysdir%\softok.exe

softok.exe is a Trojan.QQPass-Z.
softok.exe records keystrokes.
Related files:
%System%\softok.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill softok.exe process and remove softok.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\soundlog.dll

Soundlog.dll is a Spyware.AllInOne.
Soundlog.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
allinonespy.exe
inject.dll
run.exe
runwin95.exe
%System%\applog.dll
%System%\inetlog.dll
%System%\keylogger.dll
%System%\log.dll
%System%\remotelog.dll
%System%\screenlog.dll
%System%\soundlog.dll
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove soundlog.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\spdr.dll

spdr.dll is a password-stealing Trojan.Zagaban-H.
spdr.dll monitors user Internet activity and bank information.
It sends stolen data to a hacker site.
Related files:
%System%\ipreg.exe
%System%\spdr.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove spdr.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\spdr.exe

spdr.exe is a password-stealing Trojan.Zagaban-E.
spdr.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\spdr.exe
%System%\spdr.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill the process spdr.exe and remove spdr.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\spollsv.exe

spollsv.exe is a mass-mailing worm Worm.Win32.LovGate.
spollsv.exe opens a back door on TCP port 6000.
spollsv.exe spreads via open network shares.
spollsv.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%windir%\CDPlay.exe
%system%\Update_OB.exe
%system%\TkBellExe.exe
%system%\spollsv.exe
%system%\Kernel66.dll
Adds the value:
"WinHelp"="%system%\TkBellExe.exe"
"Hardware Profile"=""="%system%\hxdef.exe"
"Microsoft Associates, Inc."=" "="%system%\iexplorer.exe"
"SystemTra"=""="%swindir%\CdPlay.exe"
"Shell Extension"=""="%system%\spollsv.exe"
to the Windows startup registry keys.
More info: http://www.viruslist.com/en/viruses/ency...
Removal:
Kill the process spollsv.exe and remove spollsv.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\spool\prtprocs\update.exe

Update.exe is rootkit Trojan.Furoot-A.
Update.exe is used to hide processes.
Update.exe is a user mode rootkit.
Related files:
%SysDir%\spool\prtprocs\Update.exe
Adds the value:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
AV UpDate
%SysDir%\spool\prtprocs\Update.exe
to the Windows startup registry keys.
More info: http://www.sophos.com/security/analyses/...

%sysdir%\spool_dll.dll

spool_dll.dll is a Trojan.BankDl-X.
spool_dll.dll downloads code from the internet.
Related files:
%System%\spool_dll.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove spool_dll.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\spooler.exe

spooler.exe is a Trojan Backdoor.Sdbot.
spooler.exe spreads via Internet Relay Chat (IRC).
spooler.exe tries to terminate antiviral programs installed on a user computer.
spooler.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\Cnfgldr.exe
%System%\cthelp.exe
%System%\Sysmon16.exe
%System%\Sys3f2.exe
%System%\Syscfg32.exe
%System%\Mssql.exe
%System%\Aim95.exe
%System%\Svchosts.exe
%System%\FB_PNU.EXE
%System%\Cmd32.exe
%System%\Sys32.exe
%System%\Explorer.exe
%System%\IEXPL0RE.EXE
%System%\iexplore.exe
%System%\sock32.exe
%System%\MSTasks.exe
%System%\service.exe
%System%\Regrun.exe
%System%\ipcl32.exe
%System%\syswin32.exe
%System%\CMagesta.exe
%System%\YahooMsgr.exe
%System%\vcvw.exe
%System%\spooler.exe
%System%\MSsrvs32.exe
%System%\svhost.exe
%System%\winupdate32.exe
%System%\quicktimeprom.exe
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill spooler.exe process and remove spooler.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\spoolsac.exe

spoolsac.exe is a Trojan W32.Rbot-BBX.
spoolsac.exe opens a back door on IRC channels.
spoolsac.exe spreads via open network shares.
Related files:
%System%\spoolsac.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill spoolsac.exe process and remove spoolsac.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\spoolsub.exe

%SysDir%\spoolsub.exe is Trojan/Backdoor W32/Sdbot-ABG.
Kill the process %SysDir%\spoolsub.exe and remove %SysDir%\spoolsub.exe from Windows startup.
http://www.sophos.com/virusinfo/analyses...

%sysdir%\spoolsurf.exe

spoolsurf.exe is a Trojan W32.Sdbot-ZZ.
spoolsurf.exe opens a back door on IRC channels.
spoolsurf.exe spreads via open network shares.
Related files:
%System%\spoolsurf.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill spoolsurf.exe process and remove spoolsurf.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\spoolvs.exe

spoolvs.exe is a Trojan W32.Rbot-BBQ.
spoolvs.exe opens a back door.
spoolvs.exe spreads via open network shares.
Related files:
%System%\spoolvs.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill spoolvs.exe process and remove spoolvs.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\sporder.dll

Sporder.dll is a Backdoor Trojan.Riler.B.
Sporder.dll spreads via open network shares.
Related files:
%System%\srchost.exe
%System%\sporder.dll
%System%\winmedl.dll
%System%\WinSSi.exe
%System%\comsrm.dll
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove sporder.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\spsys.exe

spsys.exe is a Trojan W32.Codbot-AV.
spsys.exe opens a back door on IRC channels.
spsys.exe spreads via open network shares.
Related files:
%System%\spsys.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill spsys.exe process and remove spsys.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\spview.exe

Spview.exe is Trojan/Backdoor.
Kill the process spview.exe and remove %SysDir%\spview.exe from Windows startup.

%sysdir%\spvspool.exe

spvspool.exe is a mass-mailing worm W32.Combra-U.
spvspool.exe monitors user Internet activity and bank information.
It sends stolen data to a hacker site.
Related files:
%System%\spvspool.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill spvspool.exe process and remove spvspool.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\sqlexp.exe

SqlExp.exe is a Trojan.Agent-FB.
SqlExp.exe opens a back door.
Related files:
%System%\remote.exe
%System%\SqlExp.exe
%System%\SqlScan.exe
%System%\Sqlnc.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill SqlExp.exe process and remove SqlExp.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\sqlexp1.exe

SqlExp1.exe is a worm W32.Dasher-C.
SqlExp1.exe opens a back door.
SqlExp1.exe spreads via open network shares.
SqlExp1.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\wins\SqlExp.exe
%System%\wins\SqlExp1.exe
%System%\wins\SqlExp2.exe
%System%\wins\SqlExp3.exe
%System%\wins\SqlScan.exe
%System%\wins\Sqltob.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill SqlExp1.exe process and remove SqlExp1.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\sqlexp2.exe

SqlExp2.exe is a worm W32.Dasher-C.
SqlExp2.exe opens a back door.
SqlExp2.exe spreads via open network shares.
SqlExp2.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\wins\SqlExp.exe
%System%\wins\SqlExp1.exe
%System%\wins\SqlExp2.exe
%System%\wins\SqlExp3.exe
%System%\wins\SqlScan.exe
%System%\wins\Sqltob.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill SqlExp2.exe process and remove SqlExp2.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\sqlexp3.exe

SqlExp3.exe is a worm W32.Dasher-C.
SqlExp3.exe opens a back door.
SqlExp3.exe spreads via open network shares.
SqlExp3.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\wins\SqlExp.exe
%System%\wins\SqlExp1.exe
%System%\wins\SqlExp2.exe
%System%\wins\SqlExp3.exe
%System%\wins\SqlScan.exe
%System%\wins\Sqltob.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill SqlExp3.exe process and remove SqlExp3.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\sqlnc.exe

Sqlnc.exe is a Trojan.Agent-FB.
Sqlnc.exe opens a back door.
Related files:
%System%\remote.exe
%System%\SqlExp.exe
%System%\SqlScan.exe
%System%\Sqlnc.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill Sqlnc.exe process and remove Sqlnc.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\sqlssl.doc .exe

W32.Bagz.H@mm - e-mail worm.
1. Creates the following copies of itself:
%System%\SQLSSL.DOC.EXE
%System%\SYSINFO32.EXE
%System%\TRACE32.EXE
2. Creates a service:
Display Name: Windows Secure SSL
Image Path: %System%\TRACE32.EXE
Description: This service implements the secure HyperText Transfer Protocol (HTTPS) for the HTTP service.
3. Changes the HOSTS file to block antiviral sites and Windows update.
4. Sends itseld by e-mail using adress book.
Use RegRun Startup Optimizer and AntiSpyware to remove infection.

%sysdir%\srcss.exe

srcss.exe is rootkit Trojan.HacDef-AA.
srcss.exe is used to hide files, processes and registry.
srcss.exe is a kernel mode rootkit.
Rootkit contacts remote hacker server using HTTP session.
Related files:
%SysDir%\srcss.exe
%SysDir%\ntmps.exe
%SysDir%\igmpagr.dll
%SysDir%\lmtpq.vxd
%SysDir%\agt0960.hlp
%SysDir%\sysboot.sys
%SysDir%\carun.dll
%SysDir%\carun.ocx

More info: http://www.sophos.com/virusinfo/analyses...

%sysdir%\srpcsrv32.dll

Srpcsrv32.dll is an adware program Adware.Topantispyware.
Srpcsrv32.dll displays advertisements.
Related files:
%System%\hookdump.exe
%System%\runsrv32.exe
%System%\srpcsrv32.dll
%System%\runsrv32.dll
%System%\txfdb32.dll
%System%\r.exe
Adds the value:
"Srv32 spool service" = "%Windir%\System32\runsrv32.exe"
"Intel system tool" = "%System%\hookdump.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove srpcsrv32.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\srshostu.exe

srshostu.exe is a Trojan.Dropper-BP.
srshostu.exe opens a back door.
Related files:
%System%\srshost.exe
%System%\srshostu.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill srshostu.exe process and remove srshostu.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\srvexc.exe

srvexc.exe is a Trojan.Rumale-D.
srvexc.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\srvexc.exe
%System%\inetsxa.dll
%System%\reshl32.lib
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill srvexc.exe rocess and remove srvexc.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\srwhost.exe

srwhost.exe is a Trojan W32.Rbot-AWU.
srwhost.exe opens a back door on IRC channels.
srwhost.exe spreads via open network shares.
srwhost.exe tries to terminate antiviral programs installed on a user computer.
srwhost.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\srwhost.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill srwhost.exe process and remove srwhost.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\ssdpcl.dll

ssdpcl.dll is a Trojan.ServU-BF.
ssdpcl.dll is a modified version of a commercial FTP application.
Related files:
%System%\ssdpcl.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill ssdpcl.dll process and remove ssdpcl.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\sservice.exe

sservice.exe is a Trojan.Prorat-R.
sservice.exe opens a back door.
Related files:
%Windows%\services.exe
%System%\sservice.exe
%System%\fservice.exe
%Windows%\ktd32.atm
%System%\wininv.dll
%System%\winkey.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill sservice.exe process and remove sservice.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\ssh32.exe

SSH32.EXE is a Spyware.2Spy.
SSH32.EXE records information in a log file.
Related files:
%SysDir%\REG_SSH32.EXE
%SysDir%\SSH32.EXE
%SysDir%\VIEW2SP.EXE
%SysDir%\SSH32.log
Adds the value:
"SSh32" = "\SSh32.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill SSH32.EXE process and remove SSH32.EXE from Windows startup using RegRun Startup Optimizer.

%sysdir%\ssl.exe

Ssl.exe is a worm W32.Esbot.C.
Ssl.exe spreads by exploiting the Microsoft Windows Plug and Play Buffer Overflow Vulnerability (Microsoft Security Bulletin MS05-039).
Related files:
%System%\ssl.exe
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill ssl.exe process and remove ssl.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\ssldr32.dll

ssldr32.dll is a Trojan.Agent-ZD.
ssldr32.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\doser.exe
%System%\ssldr32.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove ssldr32.dll Windows startup using RegRun Startup Optimizer.

%sysdir%\ssms.exe

%SysDir%\ssms.exe is WORM_GISMOR.A.
Read more: http://www.trendmicro.com/vinfo/virusenc...
Kill the process %SysDir%\ssms.exe and remove %SysDir%\ssms.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\ssmss.exe

Ssmss.exe is a Backdoor W32.Gaobot.DXO.
Ssmss.exe spreads via open network shares.
Ssmss.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\ssmss.exe
Adds the value:
"IE6" = "ssmss.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill ssmss.exe process and remove ssmss.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\ssp2.exe

ssp2.exe is a Trojan W32.Rbot-BBK.
ssp2.exe opens a back door on IRC channels.
ssp2.exe spreads via open network shares.
Related files:
%System%\ssp2.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill ssp2.exe process and remove ssp2.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\sspe.exe

sspe.exe is Trojan/Backdoor.
Kill the process %SysDir%\sspe.exe and remove %SysDir%\sspe.exe from Windows startup.

%sysdir%\sspng.dll

SSPng.dll is a Spyware.ExploitChildWD.
SSPng.dll logs keystrokes.
SSPng.dll monitors user Internet activity.
Related files:
%ProgramFiles%\eitcwd\eitcwd.exe
%ProgramFiles%\eitcwd\eitwmon.exe
%System%\SSPng.dll
%System%\SSubTmr6.dll
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove SSPng.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\ssqrp.dll

%SysDir%\ssqrp.dll is Trojan AWAX.
Related files:
gebcd.dll
ssqpn.dll
ssqpp.dll
ssqpq.dll
ssqrp.dll
ssqrq.dll
sstqo.dll
sstqq.dll
sstqr.dll
ssttq.dll
sstts.dll
ssttu.dll
Kill the file %SysDir%\ssqrp.dll and remove %SysDir%\ssqrp.dll from Windows startup using RegRun.
www.regrun.com

%sysdir%\ssrms.exe

ssrms.exe is a Trojan.Bdoor-ML.
ssrms.exe opens a back door on IRC channels.
ssrms.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\ssrms.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill ssrms.exe process and remove ssrms.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\ssttu.dll

SSTTU.DLL is Trojan/Backdoor.
Related files:
%SYSTEM%\SSTTU.DLL
Remove SSTTU.DLL from Windows startup using RegRun Startup Optimizer.

%sysdir%\standalone.exe

standalone.exe is a Trojan W32.Agobot-ADS.
standalone.exe opens a back door.
standalone.exe spreads via open network shares.
standalone.exe tries to terminate antiviral programs installed on a user computer.
standalone.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\standalone.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill standalone.exe process and remove standalone.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\statslist.exe

statslist.exe is a worm W32.Opanki-S.
statslist.exe opens a back door.
statslist.exe spreads by AOL Instant Messenger and via open network shares.
Related files:
%System%\statslist.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill statslist.exe process and remove statslist.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\stisvc32.exe

stisvc32.exe is a Trojan W32.Agobot-TX.
stisvc32.exe opens a back door on IRC channels.
stisvc32.exe spreads via open network shares.
Related files:
%System%\stisvc32.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill stisvc32.exe process and remove stisvc32.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\stney.exe

Stney.exe is a worm W32.Agobot-VI.
Stney.exe opens a back door on IRC channels.
Stney.exe spreads via open network shares.
Related files:
%System%\Stney.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill Stney.exe process and remove Stney.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\suchost.exe

suchost.exe is a Trojan.Daemoni-R.
suchost.exe opens a back door.
Related files:
%System%\suchost.exe
%System%\suchostp.exe
%System%\suchosts.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill suchost.exe process and remove suchost.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\suchostp.exe

suchostp.exe is a Trojan.Daemoni-R.
suchostp.exe opens a back door.
Related files:
%System%\suchost.exe
%System%\suchostp.exe
%System%\suchosts.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill suchostp.exe process and remove suchostp.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\suchosts.exe

suchosts.exe is a Trojan.Daemoni-R.
suchosts.exe opens a back door.
Related files:
%System%\suchost.exe
%System%\suchostp.exe
%System%\suchosts.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill suchosts.exe process and remove suchosts.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\supdate2.dll

supdate2.dll is Trojan/Backdoor.
Remove supdate2.dll using RegRun "Scan for Viruses" feature.
http://www.regrun.com

%sysdir%\susp.exe

%SysDir%\susp.exe is Trojan/Backdoor.
Kill the process %SysDir%\susp.exe and remove %SysDir%\susp.exe from Windows startup.

%sysdir%\svc.exe

Svc.exe is a mass-mailing worm W32.Beagle.BO@mm.
Svc.exe spreads by e-mail.
Svc.exe opens a back door on TCP port 80.
Svc.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\svc.exe
%System%\re_file.exe
%Windir%\eml.exe
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill svc.exe process and remove svc.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\svc\svchost.exe

We suggest you to remove %SysDir%\svc\svchost.exe from your computer as soon as possible.
%SysDir%\svc\svchost.exe is Spyware.InfineKeylog.
Spyware.InfineKeylog is a program that logs keystrokes on the computer. It may also record start time, user name, and the window title.
Related files:
%System%\svc\svchost.cfg
%System%\svc\svchost.exe
%System%\svc\svchost.log
%System%\svc\unins000.dat
%System%\svc\unins000.exe
Read more: http://www.symantec.com/business/securit...
Kill the process %SysDir%\svc\svchost.exe and remove %SysDir%\svc\svchost.exe from Windows startup.

%sysdir%\svc0host.exe

svc0host.exe is a Trojan W32.Sdbot-AEN.
svc0host.exe opens a back door on IRC channels.
svc0host.exe spreads via open network shares.
Related files:
%System%\svc0host.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill svc0host.exe process and remove svc0host.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\svc23.exe

Svc23.exe is a mass-mailing worm W32.Beagle.CE@mm.
Svc23.exe opens a back door on TCP port 80.
Related files:
%System%\svc23.exe
%System%\re_file.exe
%Windir%\eml.exe
Adds the value:
"erthgdr2" = "%System%\svc23.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill svc23.exe process and remove svc23.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\svcc.exe

Svcc.exe is an adware program Adware.WorldSearch.
Svcc.exe modifies Internet Explorer settings.
Related files:
%System\Svcc.exe
Adds the value:
"ControlPanel" = "%System%\svcc.exe internat.dll LoadKeyboardProfile"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill Svcc.exe process and remove Svcc.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\svcclient.exe

svcclient.exe is a Trojan.Dloadr-ACM.
svcclient.exe downloads code from the internet.
Related files:
%System%\snddrv32.dll
%System%\sndctl32.dll
%System%\svcclient.exe
%System%\svcctl32.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill svcclient.exe process and remove svcclient.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\svcctl32.exe

svcctl32.exe is a Trojan.Dloadr-ACM.
svcctl32.exe downloads code from the internet.
Related files:
%System%\snddrv32.dll
%System%\sndctl32.dll
%System%\svcclient.exe
%System%\svcctl32.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill svcctl32.exe process and remove svcctl32.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\svcdata.exe

svcdata.exe is a W32.Spybot.ZIF.
svcdata.exe opens a back door on TCP port 6667.
svcdata.exe tries to terminate antiviral programs installed on a user computer.
svcdata.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\svcdata.exe
Adds the value:
"svcdata.exe" = "svcdata.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill svcdata.exe process and remove svcdata.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\svced.exe

svced.exe is a Trojan.Lemerul-C.
svced.exe opens a back door.
Related files:
%System%\svced.exe
%System%\Settings.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill svced.exe process and remove svced.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\svchcst.exe

svchcst.exe is a Trojan.GrayBrd-K.
svchcst.exe opens a back door.
Related files:
%System%\svchcst.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill svchcst.exe process and remove svchcst.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\svchoes.exe

svchoes.exe is a Trojan W32.Rbot-ASF.
svchoes.exe opens a back door on IRC channels.
svchoes.exe spreads via open network shares.
svchoes.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\svchoes.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill svchoes.exe process and remove svchoes.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\svchop.exe

svchop.exe is a Trojan.StartPa-IQ.
svchop.exe modifies data on the computer.
Related files:
%System%\paytime.exe
%System%\svchop.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill svchop.exe process and remove svchop.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\svchorsst.exe

svchorsst.exe is a worm W32.Spybot-EE.
svchorsst.exe spreads via open network shares.
svchorsst.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\kazaabackupfiles\download_me.exe
%System%\svchorsst.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill svchorsst.exe process and remove svchorsst.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\svchose.exe

svchose.exe is a Trojan W32.Rbot-ASL.
svchose.exe opens a back door on IRC channels.
svchose.exe spreads via open network shares.
svchose.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\svchose.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill svchose.exe process and remove svchose.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\svchosl.pif

Worm W32.Inzae.A@mm
It is a mass-mailing worm that uses its own SMTP engine for spreading.
1. Adds to Windows startup.
2. Creates the following files:
System%\inzax.exe
%System%\sw.exe
%System%\sx.exe
%System%\sz.exe
%System%\m.zip
3. Deletes files with extensions:
.asm .asp .bdsproj .bmp .c .cpp .cs .csproj .css .doc .dpr .frm .gif .h .htm .html .iso .jpeg .jpg .mdb .mp3 .nfm .nrg .pas .pcx .pdf .php .ppt .rar .rc .rc2 .reg .resx .rpt .sln .txt .vb .vbp .vbproj .wav .xls
4. Download its updates if computer is connected to Internet.
5. Sends its body by e-mails.
Remove it from startup using RegRun Startup Optimizer.

%sysdir%\svchost.dll

svchost.dll is rootkit Backdoor.Shellbot.
svchost.dll is used to hide files, processes and registry.
svchost.dll is a kernel mode rootkit.
Rootkit contacts remote hacker server using HTTP session.
Rootkit injects itself into the Explorer.exe process.
svchost.dll tries to terminate antiviral programs installed on a user computer.
Related files:
%SysDir%\svchost.exe
%SysDir%\svchost.dll
%SysDir%\svchosthook.dll
Adds the value:
"WindowsUpdate" = "%Windir%\system\svchost.exe /s"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
to the Windows startup registry keys.
Added to registry:
"AntivirusDisableNotify" = "1"
"FirewallDisableNotify" = "1"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center

"EnableFirewall" = "0"
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters
\FirewallPolicy\StandardProfile

More info: http://www.symantec.com/security_respons...

%sysdir%\svchost1.exe

SVCHOST1.EXE is a Trojan.Tspace-A.
SVCHOST1.EXE opens a back door.
Related files:
%System%\SVCHOST1.EXE
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill SVCHOST1.EXE process and remove SVCHOST1.EXE from Windows startup using RegRun Startup Optimizer.

%sysdir%\svchost32.dll

Svchost32.dll is a Trojan.LegMir-CA.
Svchost32.dll opens a back door.
Svchost32.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\Svchost32.dll
%System%\ccsys_control.dll
%System%\wincontrol.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove Svchost32.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\svchostl.exe

svchostl.exe is a worm W32.Blaster-M.
svchostl.exe opens a back door.
Related files:
%System%\svchostl.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill svchostl.exe process and remove svchostl.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\svchosts.dll

svchosts.dll is Trojan.Spywad-K.
svchosts.dll opens a back door.
Related files:
%System%\svchosts.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove svchosts.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\svchosts.exe -e mc-110-12-0000627

%SysDir%\svchosts.exe -e mc-110-12-0000627 is Matcash F Downloader.
Read more: http://www.ca.com/us/securityadvisor/pes...
Kill the file %SysDir%\svchosts.exe -e mc-110-12-0000627 and remove %SysDir%\svchosts.exe -e mc-110-12-0000627 from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\svchostss.exe

svchostss.exe is a Trojan.Agent-HZ.
svchostss.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\svchostss.exe
%System%\helpersvchostss.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill svchostss.exe process and remove svchostss.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\svchoxt.exe

svchoxt.exe is a Trojan.QQPass-FC.
svchoxt.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\svchoxt.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill svchoxt.exe process and remove svchoxt.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\svchsot.exe

svchsot.exe is a Trojan.QQRob-AE.
svchsot.exe opens a back door.
Related files:
%System%\svchsot.exe
%System%\check.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill svchsot.exe process and remove svchsot.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\svchst.exe

svchst.exe is a Trojan.StartPa-HH.
svchst.exe spreads via open network shares.
Related files:
%System%\svchst.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill svchst.exe process and remove svchst.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\svcnost.exe

svcnost.exe is a Trojan W32.Dref-I.
svcnost.exe opens a back door.
svcnost.exe spreads by e-mail.
Related files:
%System%\svcnost.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill svcnost.exe process and remove svcnost.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\svcohos1at.exe

Svcohos1at.exe is a Backdoor/Trojan.
Related files:
%SysDir%\svcohos1at.exe
Removal:
Kill svcohos1at.exe process and remove svcohos1at.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\svcroot.dll

svcroot.dll is a Trojan.Heles-B.
svcroot.dll spreads by e-mail.
svcroot.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\svcroot.exe
%System%\svcroot.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove svcroot.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\svcroot.exe

svcroot.exe is a Trojan.Heles-B.
svcroot.exe spreads by e-mail.
svcroot.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\svcroot.exe
%System%\svcroot.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill svcroot.exe process and remove svcroot.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\svcsshost32.exe

svcsshost32.exe is a worm W32.Forbot-GD.
svcsshost32.exe opens a back door.
Related files:
%System%\svcsshost32.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill svcsshost32.exe process and remove svcsshost32.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\svcsvh32.exe

svcsvh32.exe is a Trojan Backdoor.Naninf.D.
svcsvh32.exe opens a back door on TCP port 8080.
svcsvh32.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\svcsvh32.exe
Adds the value:
"WindowsDiskEvt" = "svcsvh32.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill the process svcsvh32.exe and remove svcsvh32.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\svcsys.dll

Svcsys.dll is a password-stealing Trojan PWSteal.Bancos.Y.
Svcsys.dll monitors user Internet activity and bank information.
It sends stolen data to a hacker site.
Related files:
%System%\svcsys.dll
%System%\dllsys.dll
Adds the value:
"SvcSys" = "{FCF39D40-4CAB-49B4-B6F4-955EC73FD3B3}"
"(Default)" = "svcsys.dll"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove svcsys.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\svids.dll

svids.dll is a Trojan.ParDrop-A.
svids.dll spreads via open network shares.
Related files:
%System%\explore.exe
%System%\inetinfo.exe
%System%\svids.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove svids.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\svkvpn.sys

svkvpn.sys is rootkit Trojan.Haxdoor-DH.
svkvpn.sys is used to hide files, processes and registry.
svkvpn.sys is a kernel mode rootkit.
svkvpn.sys spreads by e-mail.
Related files:
%SysDir%\kgctini.dat
%SysDir%\lps.dat
%SysDir%\qo.dll
%SysDir%\qo.sys
%SysDir%\svjvpn.sys
%SysDir%\svkvpn.dll
%SysDir%\svkvpn.sys
Rootkit creates new system driver:
service name: "svjvpn"
display name: "MCRT accelerator"
Added to registry:
HKLM\SYSTEM\CurrentControlSet\Services\svjvpn\

Adds the value:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\svkvpn
DllName
svkvpn.dll

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\svkvpn
Startup
ER03Sb5fex

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\svkvpn
Impersonate
1
to the Windows startup registry keys.
More info: http://www.sophos.com/security/analyses/...

%sysdir%\svlmngr.exe

svlmngr.exe is a Trojan W32.Rbot-BLW.
svlmngr.exe opens a back door on IRC channels.
svlmngr.exe spreads via open network shares.
svlmngr.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\svlmngr.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill svlmngr.exe process and remove svlmngr.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\svshost.dll

%SysDir%\svshost.dll is Troj/Small-CPO.
Read more: http://www.sophos.com/security/analyses/...
Kill the file %SysDir%\svshost.dll and remove %SysDir%\svshost.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\svshotc.exe

SVSHOTC.EXE is a Trojan.Hiddl-B.
SVSHOTC.EXE downloads and executes files.
Related files:
WIN32HOST.EXE
%System%\SVSHOTC.EXE
%System%\iedld32.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill SVSHOTC.EXE process and remove SVSHOTC.EXE from Windows startup using RegRun Startup Optimizer.

%sysdir%\svwhost.dll

svwhost.dll is a Trojan.Shellot-B.
svwhost.dll opens a back door.
Related files:
%System%\svwhost.exe
%System%\svwhost.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove svwhost.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\svwhost.exe

svwhost.exe is a Trojan.Shellot-B.
svwhost.exe opens a back door.
Related files:
%System%\svwhost.exe
%System%\svwhost.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill svwhost.exe process and remove svwhost.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\svzhost.exe

svzhost.exe is a Trojan W32.Forbot-EV.
svzhost.exe opens a back door on IRC channels.
svzhost.exe spreads via open network shares.
svzhost.exe deletes files off the computer.
svzhost.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\svzhost.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill svzhost.exe process and remove svzhost.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\swhost.exe

Swhost.exe is a Trojan.Bdoor-MP.
Swhost.exe opens a back door.
Related files:
%System%\Swhost.exe
%System%\Svhost.dat
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill Swhost.exe process and remove Swhost.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\swords.exe

Swords.exe is a mass-mailing worm W32.Kidala-B.
Swords.exe opens a back door on IRC channels.
Swords.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\Swords.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill the process Swords.exe and remove Swords.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\sxlntr.exe

sxlntr.exe is rootkit Trojan.RKDepo-A.
sxlntr.exe is used to hide files, processes and registry.
sxlntr.exe is a kernel mode rootkit.
Rootkit contacts remote hacker server using HTTP session.
Related files:
%SysDir\sxlntr.exe
%Temp%\dgkmldgmdfgdf.tjh
Added to registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer
WINID

Adds the value:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
hdloker

HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
hdloker

HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows
load

HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows
run

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
hdloker

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
hdloker

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
load

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
run

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Shell
explorer.exe
to the Windows startup registry keys.

More info: http://www.sophos.com/virusinfo/analyses...

%sysdir%\sygate.exe

Sygate.exe is a Trojan W32.Rbot-ASO.
Sygate.exe opens a back door on IRC channels.
Sygate.exe spreads via open network shares.
Sygate.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\Sygate.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill Sygate.exe process and remove Sygate.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\sym.exe

%SysDir%\sym.exe is Trojan/Backdoor.
Sym.exe is registered as 'Windows ASN Services'.
Kill the process %SysDir%\sym.exe and remove %SysDir%\sym.exe from Windows startup.

%sysdir%\symantecav2.exe

symantecav2.exe is a Trojan W32.Spybot-DY.
symantecav2.exe opens a back door on IRC channels.
symantecav2.exe spreads via open network shares.
symantecav2.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\symantecav2.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill symantecav2.exe process and remove symantecav2.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\symcsvc.exe

Symcsvc.exe is a Trojan.Abwiz.C.
Symcsvc.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\symcsvc.exe
%System%\zlbw.dll
Adds the value:
"wupd" = "%System%\symcsvc.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill symcsvc.exe process and remove symcsvc.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\symlcs.exe

symlcs.exe is a TrojanYaSpy-A.
symlcs.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\symlcs.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill symlcs.exe process and remove symlcs.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\sys02423736587.exe

%SysDir%\sys02423736587.exe is Trojan/Backdoor.
Kill the process %SysDir%\sys02423736587.exe and remove %SysDir%\sys02423736587.exe from Windows startup.

%sysdir%\sys22.exe

Sys22.exe is a mass-mailing worm W32.Rants.C@mm.
Sys22.exe tries to terminate antiviral programs installed on a user computer.
Sys22.exe spreads via Collaboration Data Objects (CDO) and the America Online user interface.
Related files:
%System%\update32.exe
%System%\sys22.exe
Adds the value:
"sysX3" = "%System%\sys22.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill sys22.exe process and remove sys22.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\sys32.dll

sys32.dll is a mass-mailing worm VBS.Yspan.G@mm.
sys32.dll spreads via open network shares.
sys32.dll tries to terminate antiviral programs installed on a user computer.
Related files:
C:\windows\system\system32.dll
C:\windows\system\sys32.dll
C:\WINDOWS\System32\Taskmgr.bat
C:\WINDOWS\System32\Firewall.bat
Adds the value:
"WINLOGON" = "wscript.exe C:\Windows\System32\WINLOGON.vbs %"
"Tasmgr" = "C:\WINDOWS\System32\Taskmgr.bat"
"Firewall" = "C:\WINDOWS\System32\Firewall.bat"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove sys32.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\sys32conf.exe

SYS32CONF.EXE is a network worm W32.Rbot-ABT.
SYS32CONF.EXE opens a back door on IRC channels.
SYS32CONF.EXE spreads via open network shares.
SYS32CONF.EXE tries to terminate antiviral programs installed on a user computer.
SYS32CONF.EXE monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\SYS32CONF.EXE
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill SYS32CONF.EXE process and remove SYS32CONF.EXE from Windows startup using RegRun Startup Optimizer.

%sysdir%\sysc.exe

sysc.exe is a Trojan.Loosky-R.
sysc.exe opens a back door.
Related files:
%Windows%\batserv2.exe
%System%\sysc.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill sysc.exe process and remove sysc.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\syscache\drwatson32.exe

DrWatson32.exe is Trojan Dremn.
Adds to the Windows startup:
"Default value"="%System%\syscache\DrWatson32.exe"
DrWatson32.exe process crates the file Docs_2.tmp, and executes it.
DrWatson32.exe process collects personal information and stores it in the .dll file.
Sends stolen information to the www.e-mn.com domain.
Kill it in memory and remove from Windows startup.

%sysdir%\syscom.exe

syscom.exe is a worm W32.Spybot-EP.
syscom.exe opens a back door on IRC channels.
syscom.exe spreads via open network shares.
Related files:
%System%\syscom.exe
%System%\syslogon.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill syscom.exe process and remove syscom.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\syscom32.exe

syscom32.exe is a Trojan W32.Spybot-EM.
syscom32.exe opens a back door.
syscom32.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\syscom32.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill syscom32.exe process and remove syscom32.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\syscom832.exe

syscom832.exe is a Trojan W32.Spybot-EN.
syscom832.exe opens a back door.
Related files:
%System%\syscom832.exe
%System%\serfer.ini
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill syscom832.exe process and remove syscom832.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\sysctl32.dll

sysctl32.dll is a Trojan.Totmau.
sysctl32.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\sysctl32.dll
Adds the value:
"(Default)" = "%System%\sysctl32.dll"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove sysctl32.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\sysd.dll

%sysdir%\sysdll32.dll

SysDll32.dll is a Spyware.XpcSpy.
SysDll32.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%ProgramFiles%\XSoftware\Working\XPCSpyPro.exe
%ProgramFiles%\XSoftware\XPCSpyPro\AppSpy.dll
%ProgramFiles%\XSoftware\XPCSpyPro\IESpy.dll
%ProgramFiles%\XSoftware\XPCSpyPro\KeySpy.dll
%ProgramFiles%\XSoftware\Working\AppMon.dll
%ProgramFiles%\XSoftware\Working\IEMon.dll
%ProgramFiles%\XSoftware\Working\KeyMon.dll
%System%\systemout.exe
%System%\SysDll32.dll
%System%\rx.exe
%System%\wintft.dll
Adds the value:
"System Check" = "Rundll32.exe SysDll32.dll,SystemCheck"
"ImagePath" = "%System%\systemout.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove SysDll32.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\sysdrc.dll

%SysDir%\sysdrc.dll is Trojan/Backdoor.
Kill the file %SysDir%\sysdrc.dll and remove %SysDir%\sysdrc.dll from Windows startup using RegRun.
www.regrun.com

%sysdir%\sysdre.exe

SysDre.exe is a mass-mailing worm W32.Dref-H.
SysDre.exe opens a back door on IRC channels.
Related files:
%System%\SysDre.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill SysDre.exe process and remove SysDre.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\syser.exe

syser.exe is a Trojan W32.Rbot-AYS.
syser.exe opens a back door on IRC channels.
syser.exe spreads via open network shares.
Related files:
%System%\syser.exe
%System%\boler.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill syser.exe process and remove syser.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\sysex.exe

Sysex.exe is Trojan/Backdoor.
Kill the process Sysex.exe and other suspicious processes.
Remove Sysex.exe from Windows startup.
Also, check the files:
%SysDir\Unvise32qt.exe
C:\Documents and Settings\Owner\Application Data\eber.exe
%SysDir%\msxml3a.exe
%WinDir%\\javacz32.dll
Check the system services:
__NS_Service
__NS_Service_2
__NS_Service_3
Disable these services.

%sysdir%\sysformat.exe

Sysformat.exe is a mass-mailing worm Beagle.AY@mm.
Sysformat.exe spreads by e-mail andvia open network shares.
Sysformat.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\sysformat.exe
%System%\sysformat.exeopen
%System%\sysformat.exeopenopen
Adds the value:
"Sysformat" = "%System%\sysformat.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill sysformat.exe process and remove sysformat.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\syshid.exe

syshid.exe is a Trojan.RaHack-B.
syshid.exe spreads via open network shares.
Related files:
%System%\server.dll
%System%\syshid.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill syshid.exe process and remove syshid.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\syshosts.exe

W32.MyDoom.Y worm.
Adds the value:
"MS Updates"="%System%\syshosts.exe"
to the registry key:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
Remove it from Windows startup using RegRun Startup Optimizer.

%sysdir%\sysinfer.exe

Sysinfer.exe is an adware program Adware.Adtest.
Sysinfer.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\intnets.exe
%System%\scridows.exe
%System%\sysinfer.exe
%Windir%\msfiles.exe
Adds the value:
"intnets" = "%System%\intnets.exe"
"sysinfer" = "%System%\sysinfer.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill sysinfer.exe process and remove sysinfer.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\sysinfo.dll

%SysDir%\sysinfo.dll is Spyware.MyLittleSpy.
Related files:
%System%\unins000.dat: Uninstall information.
%System%\unins000.exe: Generic uninstaller.
%System%\Monitor.exe: Main logger and configurator. Detected as Spyware.MyLittleSpy.
%System%\style.css: Used by help file
%System%\monhelp.html: Help file
%System%\Helper.exe: Detected as Spyware.MyLittleSpy
%System%\sysinfo.dll: Keystroke Log file
%System%\mscs.dll: Clipboard Log file
Read more: http://securityresponse.symantec.com/avc...
Kill the file %SysDir%\sysinfo.dll and remove %SysDir%\sysinfo.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\sysinfo32.exe

%sysdir%\sysinit.exe

Worm W32.Beagle.AX@mm
Spreads through file-sharing networks and by e-mail.
1. Adds to Windows startup.
"Syskey" = "%System%\sysinit.exe"
2.Creates the following files:
%System%\sysinit.exe
%System%\sysinit.exeopen
%System%\sysinit.exeopenopen
%System%\sysinit.exeopenopenopen
%System%\sysinit.exeopenopenopenopen
3. Kills antiviruses.
4.Opens a backdoor on TCP port 2002.
5.Sends an HTTP GET request via TCP port 80 to the domain, webnomey.net, where it attempts to contact a .php script.
6.Attempts to download a file from the domain sash.cc and save it as 1.exe. This file is then executed.
Remove it from startup using RegRun Startup Optimizer.

%sysdir%\sysldr.dll

sysldr.dll is a Trojan.Sickbt-A.
sysldr.dll opens a back door.
Related files:
%System%\sysldr.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove sysldr.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\syslog.dll

Syslog.dll is a mass-mailing worm W32.Aprilcone.A@mm.
Syslog.dll spreads by e-mail.
Related files:
%System%\syscon.exe
%System%\mschk.dll
%System%\Watcher.dll
%System%\sysMon.dll
%System%\syslog.dll
%System%\atchk.dll
%System%\sysmsg.dll
%System%\chkrun.dll
%System%\dskchk.dll
%System%\msevent.dll
%System%\ipchk.dll
%System%\client.dll
%System%\servr.dll
%System%\netchk.dll
%System%\mssys.dll
Adds the value:
"syscon" = "%System%\syscon.exe"
"AppInit_DLLs" = "%System%\Watcher.dll"
to the Windows startup registry keys.

More info: http://securityresponse.symantec.com/avc...
Removal:
Remove syslog.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\syslogin.exe

Syslogin.exe is a mass-mailing worm W32.Bagz@mm.
Syslogin.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\dl.exe
%System%\syslogin.exe
%System%\jobdb.dll
%System%\ipdb.dll
%System%\wdate.dll
Adds the value:
"syslogin.exe" = "syslogin.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill syslogin.exe process and remove syslogin.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\syslogon.exe

syslogon.exe is a worm W32.Spybot-EP.
syslogon.exe opens a back door on IRC channels.
syslogon.exe spreads via open network shares.
Related files:
%System%\syscom.exe
%System%\syslogon.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill syslogon.exe process and remove syslogon.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\sysmng.exe

sysmng.exe is a mass-mailing worm W32.Tame-C.
sysmng.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\lsa2srv.exe
%System%\service.exe
%System%\sysmng.exe
%System%\systm.exe
%System%\hserv.sys
%System%\iexplor.dll
%System%\iexplor2.dll
%System%\netdx.dat
%System%\version.ini
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill sysmng.exe process and remove sysmng.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\sysmntrc.exe

sysmntrc.exe is a Trojan.Bancos-FX.
sysmntrc.exe opens a back door.
Related files:
%System%\sysmntrc.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill sysmntrc.exe process and remove sysmntrc.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\sysmon.dll

sysMon.dll is a mass-mailing worm W32.Aprilcone.A@mm.
sysMon.dll spreads by e-mail.
Related files:
%System%\syscon.exe
%System%\mschk.dll
%System%\Watcher.dll
%System%\sysMon.dll
%System%\syslog.dll
%System%\atchk.dll
%System%\sysmsg.dll
%System%\chkrun.dll
%System%\dskchk.dll
%System%\msevent.dll
%System%\ipchk.dll
%System%\client.dll
%System%\servr.dll
%System%\netchk.dll
%System%\mssys.dll
Adds the value:
"syscon" = "%System%\syscon.exe"
"AppInit_DLLs" = "%System%\Watcher.dll"
to the Windows startup registry keys.

More info: http://securityresponse.symantec.com/avc...
Removal:
Remove sysMon.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\sysmon.exe

%SysDir%\SYSMON.EXE is Troj/Vixup-BI.
Read more: http://www.sophos.com/virusinfo/analyses...
Kill the process %SysDir%\SYSMON.EXE and remove %SysDir%\SYSMON.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\sysmon32.exe

Virus.
W32.Aidid overwrites all files in the A drive with a copy of itself.
Remove it from startup using RegRun Startup Optimizer.

%sysdir%\sysmonnt.exe

%sysdir%\sysmsg.dll

Sysmsg.dll is a mass-mailing worm W32.Aprilcone.A@mm.
Sysmsg.dll spreads by e-mail.
Related files:
%System%\syscon.exe
%System%\mschk.dll
%System%\Watcher.dll
%System%\sysMon.dll
%System%\syslog.dll
%System%\atchk.dll
%System%\sysmsg.dll
%System%\chkrun.dll
%System%\dskchk.dll
%System%\msevent.dll
%System%\ipchk.dll
%System%\client.dll
%System%\servr.dll
%System%\netchk.dll
%System%\mssys.dll
Adds the value:
"syscon" = "%System%\syscon.exe"
"AppInit_DLLs" = "%System%\Watcher.dll"
to the Windows startup registry keys.

More info: http://securityresponse.symantec.com/avc...
Removal:
Remove sysmsg.dll from Windows startup using RegRun Startup Optimizer.

Type: Dangerous
Part of operation system: No
Microsoft product: No
File Name: chkrun.dll
Short Description: W32.Aprilcone.A@mm
Actions:
Chkrun.dll is a mass-mailing worm W32.Aprilcone.A@mm.
Chkrun.dll spreads by e-mail.
Related files:
%System%\syscon.exe
%System%\mschk.dll
%System%\Watcher.dll
%System%\sysMon.dll
%System%\syslog.dll
%System%\atchk.dll
%System%\sysmsg.dll
%System%\chkrun.dll
%System%\dskchk.dll
%System%\msevent.dll
%System%\ipchk.dll
%System%\client.dll
%System%\servr.dll
%System%\netchk.dll
%System%\mssys.dll
Adds the value:
"syscon" = "%System%\syscon.exe"
"AppInit_DLLs" = "%System%\Watcher.dll"
to the Windows startup registry keys.

More info: http://securityresponse.symantec.com/avc...
Removal:
Remove chkrun.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\sysmsn.exe

sysmsn.exe is a mass-mailing worm W32.Rbot-BGH.
sysmsn.exe opens a back door on IRC channels.
sysmsn.exe spreads via open network shares.
Related files:
%System%\sysmsn.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill sysmsn.exe process and remove sysmsn.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\sysnd.exe

sysnd.exe is a Trojan W32.Rbot-AAW.
sysnd.exe opens a back door on IRC channels.
sysnd.exe spreads via open network shares.
sysnd.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\sysnd.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill sysnd.exe process and remove sysnd.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\sysop.exe

%SysDir%\sysop.exe is Trojan/Backdoor.
Kill the process %SysDir%\sysop.exe and remove %SysDir%\sysop.exe from Windows startup.

%sysdir%\syspol.exe

syspol.exe is a Trojan.Dremn-B.
syspol.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\Policy\policy.dll
%System%\Policy\syspol.exe
%System%\_msopen.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill syspol.exe process and remove syspol.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\sysreg.exe

Sysreg.exe is a Trojan.Download.Chekin.
Sysreg.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
Ttps.exe
Sifxinst.exe
Sbsrch_v22.dll
%System%\Sysreg.exe
%System%\OWMngr.exe
Adds the value:
"Sysreg"="%System%\Sysreg.exe"
"OWMngr"="%System%\OWMngr.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill Sysreg.exe process and remove Sysreg.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\syssql.exe

syssql.exe is a Trojan W32.Rbot-AUH.
syssql.exe opens a back door on IRC channels.
syssql.exe spreads via open network shares.
Related files:
%System%\syssql.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill syssql.exe process and remove syssql.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\systanten.exe

systanten.exe is a Trojan.Nithsys.
systanten.exe opens a back door.
Related files:
%System%\wbem\wmiadapt.exe
%System%\systanten.exe
%System%\systhin.dll
Adds the value:
"shell" = "Explorer.exe %System%\wbem\wmiadapt.exe"
"[RANDOM NAME]" ="[PATH TO FILE]"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill the process systanten.exe and remove systanten.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\systcom32.exe

systcom32.exe is a worm W32.Spybot-ED.
systcom32.exe opens a back door on IRC channels.
systcom32.exe spreads via open network shares.
systcom32.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\systcom32.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill systcom32.exe process and remove systcom32.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\systdl.exe

systdl.exe is a Trojan.Agent-APB.
systdl.exe downloads code from the internet.
Related files:
%System%\systdl.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill the process systdl.exe and remove systdl.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\system08.exe

system08.exe is a Trojan W32.Rbot-BAM.
system08.exe opens a back door on IRC channels.
system08.exe spreads via open network shares.
system08.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\system08.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill system08.exe process and remove system08.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\system23.exe

System23.exe is a mass-mailing worm W32.Reatle.D@mm.
System23.exe opens a back door on TCP ports 3351 and 8190.
System23.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\SYSTEM23.EXE
%System%\xface.tmp
Adds the value:
"System" = "%System%\system23.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill system23.exe process and remove system23.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\system32.dll

system32.dll is a mass-mailing worm VBS.Yspan.G@mm.
system32.dll spreads via open network shares.
system32.dll tries to terminate antiviral programs installed on a user computer.
Related files:
C:\windows\system\system32.dll
C:\windows\system\sys32.dll
C:\WINDOWS\System32\Taskmgr.bat
C:\WINDOWS\System32\Firewall.bat
Adds the value:
"WINLOGON" = "wscript.exe C:\Windows\System32\WINLOGON.vbs %"
"Tasmgr" = "C:\WINDOWS\System32\Taskmgr.bat"
"Firewall" = "C:\WINDOWS\System32\Firewall.bat"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove system32.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\system32.vbs

Virus VBS.Swerun.
It overwrites all VBS files on the hard drive with its body.
Adds the value:
"Win32" = "C:\windows\system32.vbs"
to Windows startup registry keys.
Remove it from startup.
Check teh files on the disk.

%sysdir%\system32dir2a.exe

system32dir2a.exe is a Trojan.OptixP-N.
system32dir2a.exe opens a back door.
Related files:
%System%\securewinload32x.exe
%System%\system32dir2a.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill system32dir2a.exe process and remove system32dir2a.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\system32x.exe

system32x.exe is a Trojan.Bancban-NY.
system32x.exe monitors user Internet activity and bank information.
It sends stolen data to a hacker site.
Related files:
%System%\system32x.exe
%System%\Netaps.txt
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill system32x.exe process and remove system32x.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\systemdev.exe

Systemdev.exe is a Backdoor W32/Sdbot-PW.
Systemdev.exe spreads via open network shares.
Systemdev.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%SysDir%\systemdev.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill systemdev.exe process and remove systemdev.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\systemdll.exe

SystemDll.exe is a Backdoor W32.Rbot-AJR.
SystemDll.exe tries to terminate antiviral programs installed on a user computer.
SystemDll.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\SystemDll.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill SystemDll.exe process and remove SystemDll.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\systemlff.dll

systemlff.dll is a Trojan.Finfanse.
systemlff.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\exploreff.exe
%System%\systemlff.dll
Adds the value:
"exploreff.exe" = "%System%\exploreff.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove systemlff.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\systemloader.exe

SystemLoader.exe is a Trojan.Adbot-A.
SystemLoader.exe opens a back door.
SystemLoader.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\SystemLoader.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill SystemLoader.exe process and remove SystemLoader.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\systemlr.dll

systemlr.dll is a Trojan.Disgu-A.
systemlr.dll opens a back door.
systemlr.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\IEXPLORER.EXE
%System%\sendmsg.dll
%System%\Kernel.dll
%System%\systemlr.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove systemlr.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\systemmonitor.exe

%SysDir%\SystemMonitor.exe is W32.Nujama.
Related files:
%System%\SystemMonitor.exe
%System%\ptsnoop.exe
%System%\InfoVersion.exe
%System%\cmmpu.exe
%System%\call of duty[68 SPACES].exe
Read more: http://www.symantec.com/enterprise/secur...
Kill the process %SysDir%\SystemMonitor.exe and remove %SysDir%\SystemMonitor.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\systemnt.exe

SystemNT.exe is a Trojan.PWSVB-EG.
SystemNT.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\SystemNT.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill SystemNT.exe process and remove SystemNT.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\systemout.exe

Systemout.exe is a Spyware.XpcSpy.
Systemout.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%ProgramFiles%\XSoftware\Working\XPCSpyPro.exe
%ProgramFiles%\XSoftware\XPCSpyPro\AppSpy.dll
%ProgramFiles%\XSoftware\XPCSpyPro\IESpy.dll
%ProgramFiles%\XSoftware\XPCSpyPro\KeySpy.dll
%ProgramFiles%\XSoftware\Working\AppMon.dll
%ProgramFiles%\XSoftware\Working\IEMon.dll
%ProgramFiles%\XSoftware\Working\KeyMon.dll
%System%\systemout.exe
%System%\SysDll32.dll
%System%\rx.exe
%System%\wintft.dll
Adds the value:
"System Check" = "Rundll32.exe SysDll32.dll,SystemCheck"
"ImagePath" = "%System%\systemout.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill systemout.exe process and remove systemout.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\systemupd.exe

Systemupd.exe is Trojan/Backdoor Trojan-Downloader.Win32.Agent.
Kill the process %SysDir%\systemupd.exe and remove %SysDir%\systemupd.exe from Windows startup.

%sysdir%\systen.dll

Systen.dll is a Trojan.DBdoor-A .
Systen.dll opens a back door on.
Systen.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Windows%\inf\3EQ2_w.inf
%System%\drivers\d6iXjEe.sys
%System%\libeay32.dll
System%\ssleay32.dll
%System%\Systen.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove Systen.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\systhin.dll

systhin.dll is a Trojan.Nithsys.
systhin.dll opens a back door.
Related files:
%System%\wbem\wmiadapt.exe
%System%\systanten.exe
%System%\systhin.dll
Adds the value:
"shell" = "Explorer.exe %System%\wbem\wmiadapt.exe"
"[RANDOM NAME]" ="[PATH TO FILE]"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove systhin.dll using RegRun "Scan for Viruses" feature.
http://www.regrun.com

%sysdir%\systm.exe

systm.exe is a mass-mailing worm W32.Tame-C.
systm.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\lsa2srv.exe
%System%\service.exe
%System%\sysmng.exe
%System%\systm.exe
%System%\hserv.sys
%System%\iexplor.dll
%System%\iexplor2.dll
%System%\netdx.dat
%System%\version.ini
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill systm.exe process and remove systm.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\sysupdates.dll

sysupdates.dll is a Trojan.QQRob-AD.
sysupdates.dll opens a back door.
sysupdates.dll tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\ccsys_control.dll
%System%\sysupdates.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove sysupdates.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\sysvcs.exe

sysvcs.exe is a Trojan.Orse-K.
sysvcs.exe opens a back door.
Related files:
%System%\sysvcs.exe
%System%\zlbw.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill sysvcs.exe process and remove sysvcs.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\sysword.exe

sysword.exe is a Trojan W32.Sdbot-ALY.
sysword.exe opens a back door on IRC channels.
sysword.exe spreads via open network shares.
Related files:
%System%\sysword.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill sysword.exe process and remove sysword.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\sywsvcs.exe

sywsvcs.exe is a Trojan.Orse-M.
sywsvcs.exe downloads code from the internet.
Related files:
%System%\sywsvcs.exe
%System%\zlbw.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill sywsvcs.exe process and remove sywsvcs.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\szwi.exe

szwi.exe is a Trojan W32.Rbot-AXE.
szwi.exe opens a back door on IRC channels.
szwi.exe spreads via open network shares.
Related files:
%System%\szwi.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill szwi.exe process and remove szwi.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\t1dll.dll

T1dll.dll is a Trojan.Lineage-BH.
T1dll.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Windows%\svhost32.exe
%System%\T1dll.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove T1dll.dll Windows startup using RegRun Startup Optimizer.

%sysdir%\tage32.sys

tage32.sys is rootkit Trojan.Haxdoor-R.
tage32.sys is used to hide files, processes and registry.
tage32.sys is a kernel mode rootkit.
Rootkit contacts remote hacker server using HTTP session.
tage32.sys tries to terminate antiviral programs installed on a user computer.
tage32.sys monitors user Internet activity and private information.
It sends stolen data to a hacker site.
tage32.sys created new system drivers:
service name: "tage32"
display name: "NGate service"
Related files:
%SysDir%\snowx.ini
%SysDir%\status.dll
%SysDir%\tage32.sys
%SysDir%\klog.sys
Adds the value:
Software\Microsoft\Windows NT\CurrentVersion\WinLogon\Notify
DllName
status.dll

Software\Microsoft\Windows NT\CurrentVersion\WinLogon\Notify
EntryPoint
CorpseProc
to the Windows startup registry keys.
More info: http://www.sophos.com/security/analyses/...

%sysdir%\tapiras.exe

%SysDir%\tapiras.exe is Trojan-PSW.Win32.Tapiras.a.
Read more: http://www.viruslist.com/en/viruses/ency...
Kill the process %SysDir%\tapiras.exe and remove %SysDir%\tapiras.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\taskdir.dll

taskdir.dll is rootkit Trojan.DwnLdr-AKR.
taskdir.dll is used to hide files, processes and registry.
taskdir.dll is a kernel mode rootkit.
Rootkit contacts remote hacker server using HTTP session.
Related files:
%SysDir%\taskdir.exe
%SysDir%\taskdir.dll
%SysDir%\zlbw.dll
Adds the value:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
taskdir
%SysDir%\taskdir.exe
to the Windows startup registry keys.
More info: http://www.sophos.com/virusinfo/analyses...

%sysdir%\taskdir.exe

taskdir.exe is a Trojan.Abwiz.F with rootkit functions.
taskdir.exe opens a back door.
taskdir.exe relays spam emails.
taskdir.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\taskdir.exe
%System%\taskdir.dll
Adds the value:
"taskdir" = "%System%\taskdir.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill the process taskdir.exe and remove taskdir.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\taskdrv32.exe

taskdrv32.exe is a Trojan W32.Sdbot-DIC.
taskdrv32.exe opens a back door on IRC channels.
taskdrv32.exe tries to terminate antiviral programs installed on a user computer.
taskdrv32.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\taskdrv32.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill taskdrv32.exe process and remove taskdrv32.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\taskfile.exe

Taskfile.exe is a mass-mailing worm W32.Mytob.EF@mm .
Taskfile.exe opens a back door on TCP port 10086 and 6667.
Taskfile.exe tries to terminate antiviral programs installed on a user computer.
Taskfile.exe spreads by exploiting the Microsoft Windows LSASS Buffer Overrun Vulnerability (Microsoft Security Bulletin MS04-011) and the Microsoft Windows DCOM RPC Interface Buffer Overrun Vulnerability (Microsoft Security Bulletin MS03-026).
Related files:
%System%\taskfile.exe
%System%\bingoo.exe
C:\funny_pic.scr
C:\see_this!!.scr
C:\my_photo2005.scr
C:\hellmsn.exe
Adds the value:
"WINTASK" = "taskfile.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill taskfile.exe process and remove taskfile.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\taskgr.exe

%SysDir%\taskgr.exe is Trojan/Backdoor.
Kill the process taskgr.exe and remove taskgr.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\taskimg.exe

taskimg.exe is a Trojan.Banload-BC.
taskimg.exe downloads code from the internet.
Related files:
%System%\taskimg.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill taskimg.exe process and remove taskimg.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\taskimgr.exe

taskimgr.exe is a Trojan.Banker-HJ.
taskimgr.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\taskimgr.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill taskimgr.exe process and remove taskimgr.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\tasklist32.exe

tasklist32.exe is Trojan.Bancos-FG.
tasklist32.exe monitors user Internet activity and bank information.
It sends stolen data to a hacker site.
Related files:
%System%\tasklist32.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill tasklist32.exe process and remove tasklist32.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\taskmam.exe

taskmam.exe is a Trojan.Bancban-OJ.
taskmam.exe monitors user Internet activity and bank information.
It sends stolen data to a hacker site.
Related files:
%System%\taskmam.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill the process taskmam.exe and remove taskmam.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\taskmamngr.exe

taskmamngr.exe is a Trojan W32.Rbot-BPQ.
taskmamngr.exe opens a back door on IRC channels.
taskmamngr.exe spreads via open network shares.
taskmamngr.exe tries to terminate antiviral programs installed on a user computer.
taskmamngr.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\taskmamngr.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill taskmamngr.exe process and remove taskmamngr.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\taskmegr.exe

taskmegr.exe is a Trojan W32.Rbot-AWY.
taskmegr.exe opens a back door on IRC channels.
taskmegr.exe spreads via open network shares.
taskmegr.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\taskmegr.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill taskmegr.exe process and remove taskmegr.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\taskmgn.exe

taskmgn.exe is a Trojan.Small-LG.
taskmgn.exe opens a back door.
Related files:
%System%\taskmgn.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill taskmgn.exe process and remove taskmgn.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\taskmgr.bat

Taskmgr.bat is a mass-mailing worm VBS.Yspan.G@mm.
Taskmgr.bat spreads via open network shares.
Taskmgr.bat tries to terminate antiviral programs installed on a user computer.
Related files:
C:\windows\system\system32.dll
C:\windows\system\sys32.dll
C:\WINDOWS\System32\Taskmgr.bat
C:\WINDOWS\System32\Firewall.bat
Adds the value:
"WINLOGON" = "wscript.exe C:\Windows\System32\WINLOGON.vbs %"
"Tasmgr" = "C:\WINDOWS\System32\Taskmgr.bat"
"Firewall" = "C:\WINDOWS\System32\Firewall.bat"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill Taskmgr.bat process and remove Taskmgr.bat from Windows startup using RegRun Startup Optimizer.

%sysdir%\taskmn.exe

taskmn.exe is a Trojan W32.Rbot-BJZ.
taskmn.exe opens a back door on IRC channels.
taskmn.exe spreads via open network shares.
taskmn.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\taskmn.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill taskmn.exe process and remove taskmn.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\taskmnegr.exe

taskmnegr.exe is a Trojan W32.Rbot-AUM.
taskmnegr.exe opens a back door on IRC channels.
taskmnegr.exe spreads via open network shares.
Related files:
%System%\taskmnegr.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill taskmnegr.exe process and remove taskmnegr.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\taskmng.exe

taskmng.exe is a Trojan W32.Rbot-AXZ.
taskmng.exe opens a back door on IRC channels.
taskmng.exe spreads via open network shares.
taskmng.exe tries to terminate antiviral programs installed on a user computer.
taskmng.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\taskmng.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill taskmng.exe process and remove taskmng.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\taskmngr.exe

taskmngr.exe is a worm W32.Rbot-AYZ.
taskmngr.exe opens a back door.
taskmngr.exe spreads via open network shares.
Related files:
%System%\taskmngr.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill taskmngr.exe process and remove taskmngr.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\task-mngr.exe

task-mngr.exe is a Trojan W32.Rbot-AWP.
task-mngr.exe opens a back door on IRC channels.
task-mngr.exe spreads via open network shares.
Related files:
%System%\task-mngr.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill task-mngr.exe process and remove task-mngr.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\taskmngrs.exe

taskmngrs.exe is Trojan W32.Rbot-AUZ.
taskmngrs.exe opens a back door on IRC channels.
taskmngrs.exe spreads via open network shares.
taskmngrs.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\taskmngrs.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill taskmngrs.exe process and remove taskmngrs.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\taskmone.exe

taskmone.exe is Trojan/Backdoor.
Kill the process taskmone.exe and remove taskmone.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\taskmrg.exe

taskmrg.exe is a password-stealing Trojan.Bancban-FT.
taskmrg.exe monitors user Internet activity and bank information.
It sends stolen data to a hacker site.
Related files:
%System%\taskmrg.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill taskmrg.exe process and remove taskmrg.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\tasksmanagers.exe

Tasksmanagers.exe is a mass-mailing worm W32.Mytob.ER@mm.
Tasksmanagers.exe tries to terminate antiviral programs installed on a user computer.
Tasksmanagers.exe opens a back door on TCP port 7000.
Related files:
%System%\tasksmanagers.exe
Adds the value:
"Windows Registry Manager" = "tasksmanagers.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill tasksmanagers.exe process and remove tasksmanagers.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\tasksys.exe

tasksys.exe is a mass-mailing worm W32.Dref-G.
tasksys.exe opens a back door on IRC channels.
Related files:
%System%\tasksys.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill tasksys.exe process and remove tasksys.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\tasta.exe

tasta.exe is a Trojan W32.Sdranck-W.
tasta.exe spreads via open network shares.
Related files:
%System%\ataste.exe
%System%\tasta.exe
%System%\vanhoutt.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill tasta.exe process and remove tasta.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\tbsvc32.exe

tbsvc32.exe is a Trojan W32.Rbot-ANV.
tbsvc32.exe opens a back door on IRC channel.
tbsvc32.exe spreads via open network shares.
Related files:
%System%\tbsvc32.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill tbsvc32.exe process and remove tbsvc32.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\tcpic.exe

tcpic.exe is a Trojan.Sharp-M.
tcpic.exe opens a back door.
Related files:
%System%\ipconfx.exe
%System%\tcpic.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill tcpic.exe process and remove tcpic.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\telcoms.exe

%SysDir%\telcoms.exe is Worm.Ircbot.Gen.
Kill the process telcoms.exe and remove %SysDir%\telcoms.exe from Windows startup using RegRun.
www.regrun.com

%sysdir%\tellcoma.exe

tellcoma.exe is a Trojan W32.Rbot-AWX.
tellcoma.exe opens a back door on IRC channels.
tellcoma.exe spreads via open network shares.
Related files:
%System%\tellcoma.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill tellcoma.exe process and remove tellcoma.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\temp32.exe

Temp32.exe is a mass-mailing worm W32.AJM.Worm.
Temp32.exe spreads by e-mail and via open network shares.
Related files:
%System%\User32Rem.exe
%System%\UserGDL.exe
%System%\BihUpdate.exe
%System%\SysRtw32.exe
%System%\Win32Dll.exe
%System%\MsCrt32.exe
%System%\Temp32.exe
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill Temp32.exe process and remove Temp32.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\templatedongle.exe

%SysDir%\templatedongle.exe is Trojan/Backdoor.
Kill the process templatedongle.exe and remove templatedongle.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\teskmangr.exe

teskmangr.exe is a Trojan W32.Rbot-AUV.
teskmangr.exe opens a back door on IRC channels.
teskmangr.exe spreads via open network shares.
teskmangr.exe tries to terminate antiviral programs installed on a user computer.
teskmangr.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\teskmangr.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill teskmangr.exe process and remove teskmangr.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\test.exe

Test.exe is a mass-mailing worm W32.Stubbot.A@mm.
Test.exe opens a back door on TCP port 6677.
Test.exe spreads via open network shares.
Test.exe tries to terminate antiviral programs installed on a user computer.
Test.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\svthx.exe
%System%\Test
%System%\Test.exe
%System%\Test.pif
%System%\haha.pif
%System%\Details.pif
%System%\Decrypted_mail.pif
%System%\Instructions-howtofix.txt.pif
%System%\Protected.Storage.Encrypted.XOR.34h.pif
Adds the value:
"Windows Update Center" = "%System%\svthx.exe"
"Shell" = "Explorer.exe svthx.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill Test.exe process and remove Test.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\test2.exe

Test2.exe is a mass-mailing worm W32.Mytob.DJ@mm .
Test2.exe opens a back door on TCP port 7000.
Test2.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\test.exe
%System%\test2.exe
Adds the value:
"WINDOWS SYSTEM" = "test.exe"
"WINDOWS SYSTEM" = "test2.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill test2.exe process and remove test2.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\test3.exe

Test3.exe is a mass-mailing worm W32.Mytob.DV@mm.
test3.exe opens a back door on TCP port 6667.
test3.exe spreads via open network shares.
test3.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\test3.exe
Adds the value:
"WINDOWS SYSTEM" = "test3.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill test3.exe process and remove test3.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\testtest.exe

testtest.exe is a Trojan.PPdoor-Q.
testtest.exe opens a back door.
testtest.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\dpnetmsg.exe
%System%\iueninet.dll
%System%\fsmgntfs.dll
%System%\ntmapast.dll
%System%\ir50psrv.exe
%System%\kbd1uery.dll
%System%\lfyockaa.dll
%System%\a15svcs.exe
%System%\dpnmdlib.exe
%System%\c_28usic.dll
%System%\atiysnpn.dll
%System%\treemqoa.dll
%System%\arptutdn.dll
%System%\eulapart.dll
%System%\smlo8thk.exe
%System%\odbcfwci.ime
%System%\hgakheg.dll
%System%\jkwbhew.dll
%System%\testtest.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill testtest.exe process and remove testtest.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\tetriz3.exe

%SysDir%\tetriz3.exe is Trojan/Backdoor.
Kill the process tetriz3.exe and remove tetriz3.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\thefunk.exe

Thefunk.exe is a worm W32/Sdranck-O.
Thefunk.exe spreads via open network shares.
Related files:
%SysDir%\thefunk.exe
%SysDir%\jarule.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill thefunk.exe process and remove thefunk.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\thematrixhasyou.exe

%SysDir%\TheMatrixHasYou.exe is Trojan/Backdoor.
Kill the process TheMatrixHasYou.exe and remove TheMatrixHasYou.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\thun.dll

Thun.dll is a Trojan Backdoor.Fivsec.
Thun.dll opens a back door on random TCP port.
Svthx.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%Temp%\pi.sys
%System%\thun.dll
%System%\thun32.dll
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove thun.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\thun32.dll

Thun32.dll is a Trojan Backdoor.Fivsec.
Thun32.dll opens a back door on random TCP port.
Svthx.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%Temp%\pi.sys
%System%\thun.dll
%System%\thun32.dll
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove thun32.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\tibs.exe

Tibs.exe is a Start Page Trojan.
Tibs.exe changes settings for Microsoft Internet Explorer.
Related files:
%SysDir%\tibs.exe
Removal:
Kill tibs.exe process and remove tibs.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\timemanager.exe

TimeManager.exe is a mass-mailing worm W32.Mytob.IH@mm.
TimeManager.exe opens a back door.
TimeManager.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\TimeManager.exe
Adds the value:
"Time Manager" = "TimeManager.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill TimeManager.exe process and remove TimeManager.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\tkbellexe.exe

TkBellExe.exe is a mass-mailing worm Worm.Win32.LovGate.
TkBellExe.exe opens a back door on TCP port 6000.
TkBellExe.exe spreads via open network shares.
TkBellExe.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%windir%\CDPlay.exe
%system%\Update_OB.exe
%system%\TkBellExe.exe
%system%\spollsv.exe
%system%\Kernel66.dll
Adds the value:
"WinHelp"="%system%\TkBellExe.exe"
"Hardware Profile"=""="%system%\hxdef.exe"
"Microsoft Associates, Inc."=" "="%system%\iexplorer.exe"
"SystemTra"=""="%swindir%\CdPlay.exe"
"Shell Extension"=""="%system%\spollsv.exe"
to the Windows startup registry keys.
More info: http://www.viruslist.com/en/viruses/ency...
Removal:
Kill the process TkBellExe.exe and remove TkBellExe.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\tmhk.dll

tmhk.dll is a Trojan.QQRob-AO.
tmhk.dll records keystrokes.
tmhk.dll downloads code from the internet.
Related files:
%System%\tmhk.dll
%System%\wnilogon.exe
%System%\winsook.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove tmhk.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\tmlib.dll

TMLib.dll is an adware program Spyware.AdvancedKey.
TMLib.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Windir%\IDDE\kmonitor.exe
%Windir%\IDDE\trace.exe
%Windir%\system\svchost.exe:
%System%\TMLib.dll
%System%\TMUtils.dll
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove TMLib.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\tmutils.dll

TMUtils.dll is an adware program Spyware.AdvancedKey.
TMUtils.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Windir%\IDDE\kmonitor.exe
%Windir%\IDDE\trace.exe
%Windir%\system\svchost.exe:
%System%\TMLib.dll
%System%\TMUtils.dll
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove TMUtils.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\tntsetp.exe

TNTSETP.exe is a Trojan W32.Rbot-BEC.
TNTSETP.exe opens a back door on IRC channels.
TNTSETP.exe spreads via open network shares.
Related files:
%System%\TNTSETP.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill TNTSETP.exe process and remove TNTSETP.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\tools\restart.exe

%SysDir%\Tools\Restart.exe is a Potentially unwanted tool.
Kill the process %SysDir%\Tools\Restart.exe and remove %SysDir%\Tools\Restart.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\toxikx.exe

toxikx.exe is a Trojan W32.Sdbot-ADL.
toxikx.exe opens a back door on IRC channels.
toxikx.exe spreads via open network shares.
Related files:
%System%\toxikx.exe
%System%\keylog.txt
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill toxikx.exe process and remove toxikx.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\trace32.exe

%sysdir%\treemqoa.dll

treemqoa.dll is a Trojan.PPdoor-Q.
treemqoa.dll opens a back door.
treemqoa.dll tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\dpnetmsg.exe
%System%\iueninet.dll
%System%\fsmgntfs.dll
%System%\ntmapast.dll
%System%\ir50psrv.exe
%System%\kbd1uery.dll
%System%\lfyockaa.dll
%System%\a15svcs.exe
%System%\dpnmdlib.exe
%System%\c_28usic.dll
%System%\atiysnpn.dll
%System%\treemqoa.dll
%System%\arptutdn.dll
%System%\eulapart.dll
%System%\smlo8thk.exe
%System%\odbcfwci.ime
%System%\hgakheg.dll
%System%\jkwbhew.dll
%System%\testtest.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove treemqoa.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\trgen.dll

trgen.dll is an adware program Adware.Begin2search.
trgen.dll monitors user Internet activity.
trgen.dll displays advertising information.
Related files:
%System%\reg6523.exe
%System%\winb2s32.dll
%System%\winbbb.dat
%System%\dsktrf.dll
%System%\ns.dll
%System%\trgen.dll
%System%\rtneg.dll
%Windir%\Downloaded Program Files\winb2s32.inf
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove trgen.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\trks.dll

Trks.dll is a Trojan Backdoor.Fuwudoor.
Trks.dll spreads via open network shares.
Related files:
%System%\ipsec.dll
%System%\appmgmt.dll
%System%\browsvr.dll
%System%\trkw.dll
%System%\trks.dll
%System%\kdc.dll
%System%\dmsrv.dll
%System%\mesg.dll
%System%\netlogin.dll
%System%\protstrg.dll
%System%\lmhosts.dll
%System%\w32t.dll
%System%\ntms.dll
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove trks.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\trkw.dll

Trkw.dll is a Trojan Backdoor.Fuwudoor.
Trkw.dll spreads via open network shares.
Related files:
%System%\ipsec.dll
%System%\appmgmt.dll
%System%\browsvr.dll
%System%\trkw.dll
%System%\trks.dll
%System%\kdc.dll
%System%\dmsrv.dll
%System%\mesg.dll
%System%\netlogin.dll
%System%\protstrg.dll
%System%\lmhosts.dll
%System%\w32t.dll
%System%\ntms.dll
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove trkw.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\tsasi.exe

tsasi.exe is a Trojan W32.Spybot-EF.
tsasi.exe opens a back door on IRC channels.
Related files:
%System%\kazaabackupfiles\crack.exe
%System%\tsasi.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill tsasi.exe process and remove tsasi.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\tskmgr32.vbs

VBS.Sorpe.A@mm - mass-mailing worm

1. Uninstalls any process that contains the strings "Script" and "Block" in its name.
2.Drops and executes %System%\Tskmgr32.vbs to terminate any process named Taskmgr.exe.
3.Drops and executes the following files:
* %System%\User32.reg
* %System%\SysReg.reg
4. Creates the following copies of itself:
* %System%\MsNews.vbs
* %Windir% \SysLogs\Syslog32.vbs
* %ProgramFiles%\WindowsUpdate\Wupdmgr.tmp\Wupdscn.vbs
5. Adds the value:
"Spore" = "%System%\MsNews.vbs"
to Windows startup registry keys.
6. Adds the value:
"DisallowRun" = "1"
to the registry key:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
Adds the values:
"1" = "regedit.exe"
"2" = "notepad.exe"
"3" = "wordpad.exe"
"4" = "write.exe"
"5" = "wuauclt.exe"
to the registry key:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun
to block execution of this files.
Remove it using Startup Optimizer.

%sysdir%\tstdmc.dll

tstdmc.dll is a Trojan.Hanmon.
tstdmc.dll opens a back door.
Related files:
%System%\tstdmc.dll
%System%\dmcpyt.dll
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove tstdmc.dll Windows startup using RegRun Startup Optimizer.

%sysdir%\twain_16.dll

Twain_16.dll is an adware program Adware.7000n.
Twain_16.dll is a Browser Helper Object (BHO).
Twain_16.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\twain_16.dll
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove twain_16.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\twunk_18.exe

twunk_18.exe is a Trojan.GrayBrd-AT.
twunk_18.exe opens a back door.
Related files:
%System%\twunk_18.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill twunk_18.exe process and remove twunk_18.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\txfdb32.dll

Txfdb32.dll is an adware program Adware.Topantispyware.
Txfdb32.dll displays advertisements.
Related files:
%System%\hookdump.exe
%System%\runsrv32.exe
%System%\srpcsrv32.dll
%System%\runsrv32.dll
%System%\txfdb32.dll
%System%\r.exe
Adds the value:
"Srv32 spool service" = "%Windir%\System32\runsrv32.exe"
"Intel system tool" = "%System%\hookdump.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove txfdb32.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\udagent.exe

UD Agent Client v1.1 for Win98/Me/NT/2000 - Client for United Devices
Cancer Research Project.

%sysdir%\uhtcnvzk.exe

UHTCNVZK.EXE is Trojan/Backdoor.
Kill the process UHTCNVZK.EXE and remove UHTCNVZK.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\uninstallpctt.exe

UninstallPCTT.exe is a Spyware.PCTattletale.
UninstallPCTT.exe logs keystrokes.
UninstallPCTT.exe monitors user Internet activity.
Related files:
%ProgramFiles%\Common Files\InstallShield\Driver\7\Intel 32\IDriver.exe
%ProgramFiles%\Common Files\InstallShield\Driver\7\Intel 32\IScript7.dll
%ProgramFiles%\Common Files\InstallShield\Driver\7\Intel 32\ISRT.dll
%ProgramFiles%\Common Files\InstallShield\Driver\7\Intel 32\IUser7.dll
%ProgramFiles%\Common Files\InstallShield\Driver\7\Intel 32\objps7.dll
%ProgramFiles%\Common Files\InstallShield\Driver\7\Intel 32\_ISRES1033.dll
%System%\explorer32\AutoUpdate.dll
%System%\explorer32\AutoUpdateClient.exe
%System%\explorer32\chattext.dll
%System%\explorer32\msn6mngr.exe
%System%\explorer32\Netlogon.exe
%System%\explorer32\Wincmd.exe
%System%\explorer32\WinSysMngr.exe
%System%\MSN32.dll
%System%\PCTT.exe
%System%\UninstallPCTT.exe
%System%\Unzip32.dll
%System%\WinLoad.exe
%System%\zip32.dll
Adds the value:
"(default)" = ""
"WinLoad" = "%System%\Winload.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill UninstallPCTT.exe process and remove UninstallPCTT.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\unstsa2.exe

UnstSA2.exe is an adware program Adware.BlazeFind.
UnstSA2.exe is a Browser Helper Object.
UnstSA2.exe downloads and displays advertisements.
Related files:
%System%\2_0_1browserhelper2.dll
%System%\UnstSA2.exe
%System%\key2.txt
%System%\installer2.exe
%System%\Omniscienthook.dll
%System%\omniband.dll
%System%\wsaupdater.exe
Adds the value:
"Windows SA" = "[path to the adware program]"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill UnstSA2.exe process and remove UnstSA2.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\unve.exe

unve.exe is a worm W32.Rbot-AWG.
unve.exe opens a back door on IRC channels.
unve.exe spreads by open network shares and via Instant Messenger programs.
Related files:
%System%\unve.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill unve.exe process and remove unve.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\updat.exe

updat.exe is a Trojan W32.Rbot-AZZ.
updat.exe opens a back door on IRC channels.
updat.exe spreads via open network shares.
Related files:
%System%\updat.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill updat.exe process and remove updat.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\updata32.dll

updata32.dll is a Trojan.Maocal.
updata32.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\updata32.exe
%System%\updata32.dll
%System%\update.ini
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove updata32.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\updata32.exe

updata32.exe is a Trojan.Maocal.
updata32.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\updata32.exe
%System%\updata32.dll
%System%\update.ini
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill updata32.exe process and remove updata32.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\update.exe

%SysDir%\Update.exe is Trojan/Backdoor Nyxem.
Kill the process %SysDir%\Update.exe and remove %SysDir%\Update.exe from Windows startup.
Related files:
- %Windows%\rundll16.exe
- %System%\scanregw.exe
- %System%\Update.exe
- %System%\Winzip.exe
http://www.f-secure.com/v-descs/nyxem_e....

%sysdir%\update_ob.exe

Update_OB.exe is a mass-mailing worm Worm.Win32.LovGate.
Update_OB.exe opens a back door on TCP port 6000.
Update_OB.exe spreads via open network shares.
Update_OB.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%windir%\CDPlay.exe
%system%\Update_OB.exe
%system%\TkBellExe.exe
%system%\spollsv.exe
%system%\Kernel66.dll
Adds the value:
"WinHelp"="%system%\TkBellExe.exe"
"Hardware Profile"=""="%system%\hxdef.exe"
"Microsoft Associates, Inc."=" "="%system%\iexplorer.exe"
"SystemTra"=""="%swindir%\CdPlay.exe"
"Shell Extension"=""="%system%\spollsv.exe"
to the Windows startup registry keys.
More info: http://www.viruslist.com/en/viruses/ency...
Removal:
Kill the process Update_OB.exe and remove Update_OB.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\update32.exe

Update32.exe is a mass-mailing worm W32.Rants.C@mm.
Update32.exe tries to terminate antiviral programs installed on a user computer.
Update32.exe spreads via Collaboration Data Objects (CDO) and the America Online user interface.
Related files:
%System%\update32.exe
%System%\sys22.exe
Adds the value:
"sysX3" = "%System%\sys22.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill update32.exe process and remove update32.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\updatecfg.exe

updatecfg.exe is a Trojan W32.Rbot-AXU.
updatecfg.exe opens a back door on IRC channels.
updatecfg.exe spreads via open network shares.
Related files:
%System%\updatecfg.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill updatecfg.exe process and remove updatecfg.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\updatem.exe

%SysDir%\updatem.exe is Trojan/Backdoor.
Kill the process updatem.exe and remove updatem.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\updater32.exe

Updater32.exe is a mass-mailing worm W32.Rants.A@mm.
Updater32.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\updater32.exe
Adds the value:
"SVCHOST" = "%System%\updater32.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill updater32.exe process and remove updater32.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\updaterui.exe

UpdaterUI.exe is a Trojan.Agent-TM.
UpdaterUI.exe opens a back door.
Related files:
%System%\UpdaterUI.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill UpdaterUI.exe process and remove UpdaterUI.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\updates.exe

%SysDir%\updates.exe is Troj/Bckdr-QHR.
Related files:
%Windows%\svhst32.exe
%System%\updates.exe
%System%\wandrv.exe
Read more: http://www.sophos.com/security/analyses/...
Kill the process %SysDir%\updates.exe and remove %SysDir%\updates.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\updatex.exe

%SysDir%\Updatex.exe is Trojan/Backdoor.
Kill the process Updatex.exe and remove Updatex.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\updatexp.exe

updatexp.exe is a Trojan.Dadobra-H.
updatexp.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\updatexp.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill updatexp.exe process and remove updatexp.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\updatexp64.exe

updatexp64.exe is a Trojan W32.Sdbot-AIM.
updatexp64.exe opens a back door on IRC channels.
updatexp64.exe spreads via open network shares.
Related files:
%System%\updatexp64.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill updatexp64.exe process and remove updatexp64.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\updatr.exe

updatr.exe is a Trojan W32.Rbot-AYB.
updatr.exe opens a back door on IRC channels.
updatr.exe spreads via open network shares.
Related files:
%System%\updatr.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill updatr.exe process and remove updatr.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\updinstall.exe

UpdInstall.exe is a Spyware.Look2Me.
UpdInstall.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Temp%nsdtmp09.dll
%Program Files%\Recommended Hotfix - 421701D\v15\RH.DLL
%Program Files%\Recommended Hotfix - 421701D\v15\RH.exe
%Program Files%\SED\SE.exe
%Program Files%\SED\SED.exe
%Windir%\system\UpdInstall.exe
%System%\InetFuel.exe
%System%\[random file name].dll
Adds the value:
"SESync" = "%Program Files%\SED\SED.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill UpdInstall.exe process and remove UpdInstall.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\updjsjas.dll

updjsjas.dll is rootkit Trojan.PcClien-ID.
updjsjas.dll is used to hide files, processes.
updjsjas.dll is a kernel mode rootkit.
Rootkit creates a new service with the name "SENS".
Rootkit contacts remote hacker server using HTTP session.
Related files:
%Temp%\@BEde.exe
%WinDir%\offitems.log
%SysDir%\drivers\updjsjas.sys
%SysDir%\updjsjas.dll
%SysDir%\updjsjas.drv
%SysDir%\updjsjas.log
Added to registry:
HKLM\SYSTEM\CurrentControlSet\Services\SENS\
to the Windows startup registry keys.
More info: http://www.sophos.com/security/analyses/...

%sysdir%\updtscheduler.exe

updtscheduler.exe is a mass-mailing worm W32.Kedebe.I@mm.
updtscheduler.exe deletes files.
updtscheduler.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\updtscheduler.exe
Adds the value:
"Run" = "%System%\updtscheduler.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill the process updtscheduler.exe and remove updtscheduler.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\uprootkit.exe

uprootkit.exe is rootkit Backdoor.Uprootkit.
uprootkit.exe is used to hide files, processes and registry.
uprootkit.exe is a user mode rootkit.
Rootkit contacts remote hacker server using HTTP session.
uprootkit.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%SysDir%\uprootkit.exe
Adds the value:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\UpRootKit
to the Windows startup registry keys.
More info: http://www.symantec.com/security_respons...

%sysdir%\ups32.dll

UPS32.exe is a worm W32.Femot.O.
UPS32.exe opens a back door.
UPS32.exe spreads via open network shares.
Related files:
%System%\UPS32.exe
%System%\UPS32.dll
%System%\UPS32.dat
Adds the value:
"UPS" = "%SYSTEM%\UPS32.exe -v"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill UPS32.exe process and remove UPS32.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\ups32.exe

%sysdir%\usaplug.exe

%SysDir%\usaplug.exe is Trojan/Backdoor.
Kill the process usaplug.exe and remove usaplug.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\usb2chk.exe

usb2chk.exe is a Trojan.Lazar-A.
usb2chk.exe opens a back door.
Related files:
%Program Files%\APC_Power\Pwrchute.exe
%Common Files%\clockwise.exe
%Program Files%\US Robotics\3capplnk.exe
%System%\dit.exe
%System%\usb2chk.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill usb2chk.exe process and remove usb2chk.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\usbadpt32.dll

usbadpt32.dll is a Trojan.Dloadr-EO.
usbadpt32.dll opens a back door.
Related files:
%System%\usbadpt32.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove usbadpt32.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\usbcontrol.exe

usbcontrol.exe is a Trojan W32.Rbot-BJH.
usbcontrol.exe opens a back door on IRC channels.
usbcontrol.exe spreads via open network shares.
Related files:
%System%\usbcontrol.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill usbcontrol.exe process and remove usbcontrol.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\usbdrv.exe

usbdrv.exe is a Trojan.PcClient-X.
usbdrv.exe opens a back door.
Related files:
%System%\usbdrv.exe
%System%\usbdrvw.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill usbdrv.exe process and remove usbdrv.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\usbdrvw.dll

usbdrvw.dll is a Trojan.PcClient-X.
usbdrvw.dll opens a back door.
Related files:
%System%\usbdrv.exe
%System%\usbdrvw.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove usbdrvw.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\usbhub.exe

usbhub.exe is a worm W32.Rbot-BJX.
usbhub.exe opens a back door.
usbhub.exe spreads via open network shares.
usbhub.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\usbhub.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill usbhub.exe process and remove usbhub.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\usbservice.exe

usbservice.exe is a Trojan W32.Rbot-BLF.
usbservice.exe opens a back door on IRC channels.
usbservice.exe spreads via open network shares.
Related files:
%System%\usbservice.exe
%Windows%\SoftWareProtector\Skonk_out.pr
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill usbservice.exe process and remove usbservice.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\usbtest.sys

USBTest.sys is rootkit Trojan.Lecna-F.
USBTest.sys is used to hide files, processes and registry.
USBTest.sys is a kernel mode rootkit.
Rootkit contacts remote hacker server using HTTP session.
Rootkit creates new system driver:
service name: "USBTest"
display name: "USBTest"

Related files:
%SysDir%\winword.exe
%SysDir%\drivers\USBTest.sys

Added to registry:
HKLM\SYSTEM\CurrentControlSet\Services\USBTest\

HKLM\SOFTWARE\Microsoft\CurrentNetInf\

More info: http://www.sophos.com/security/analyses/...

%sysdir%\usbtskmgr.exe

usbtskmgr.exe is a worm W32.Rbot-BKG.
usbtskmgr.exe opens a back door on IRC channels.
usbtskmgr.exe spreads via open network shares.
usbtskmgr.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\usbtskmgr.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill usbtskmgr.exe process and remove usbtskmgr.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\user32rem.exe

User32Rem.exe is a mass-mailing worm W32.AJM.Worm.
User32Rem.exe spreads by e-mail and via open network shares.
Related files:
%System%\User32Rem.exe
%System%\UserGDL.exe
%System%\BihUpdate.exe
%System%\SysRtw32.exe
%System%\Win32Dll.exe
%System%\MsCrt32.exe
%System%\Temp32.exe
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill User32Rem.exe process and remove User32Rem.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\usergdl.exe

UserGDL.exe is a mass-mailing worm W32.AJM.Worm.
UserGDL.exe spreads by e-mail and via open network shares.
Related files:
%System%\User32Rem.exe
%System%\UserGDL.exe
%System%\BihUpdate.exe
%System%\SysRtw32.exe
%System%\Win32Dll.exe
%System%\MsCrt32.exe
%System%\Temp32.exe
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill UserGDL.exe process and remove UserGDL.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\userid.dll

Userid.dll is a Trojan PWSteal.Flecsip.B.
Userid.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\lvsrev.exe
%System%\userid.dll
%System%\apigrab.dll
Adds the value:
"msserv" = "%System%\lvsrev.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove userid.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\userinit32.exe

%SysDir%\userinit32.exe is Trojan/Backdoor.
Kill the process %SysDir%\userinit32.exe and remove %SysDir%\userinit32.exe from Windows startup.

%sysdir%\userx.exe

Userx.exe is a mass-mailing worm W32.Mytob.JF@mm.
Userx.exe opens a back door on TCP port 6677.
Userx.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\userx.exe
Adds the value:
"Msn Update Service" = "userx.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill userx.exe process and remove userx.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\usrnt\windrg32.exe

Windrg32.exe is a Backdoor W32.Zotob.G.
Windrg32.exe spreads by using the vulnerability in Microsoft Windows Plug and Play Service (Microsoft Security Bulletin MS05-039).
Related files:
%System%\usrnt\windrg32.exe
Adds the value:
"WinDrg32" = "%System%\usernt\windrg32.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill windrg32.exe process and remove windrg32.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\utgrbe.dll

utgrbe.dll is rootkit Trojan.Haxdoor-DJ.
utgrbe.dll is used to hide files, processes and registry.
utgrbe.dll is a kernel mode rootkit.
Rootkit contacts remote hacker server using HTTP session.
utgrbe.dll tries to terminate antiviral programs installed on a user computer.
Related files:
%SysDir%\kgctini.dat
%SysDir%\nmk4.dat
%SysDir%\qo.dll
%SysDir%\qo.sys
%SysDir%\ufgrbe.sys
%SysDir%\utgrbe.dll
%SysDir%\utgrbe.sys

ufgrbe.sys is created new system drivers:
service name: "ufgrbe"
display name: "IPSTK driver"
Added to registry:
HKLM\SYSTEM\CurrentControlSet\Services\ufgrbe

Adds the value:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\utgrbe
DllName
utgrbe.dll

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\utgrbe
Startup
XFJS0af2ex

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\utgrbe
Impersonate
1
to the Windows startup registry keys.
More info: http://www.sophos.com/security/analyses/...

%sysdir%\utlsrv.exe

utlsrv.exe is a Trojan.Checkraise.
utlsrv.exe opens a back door.
utlsrv.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
RBCalc.exe
%System%\utlsrv.exe
%System%\comclg32.dll
%System%\d3dclsrv.dll
%System%\ndsdavsrv.sys
Adds the value:
"Comclg32" = "%System%\utlsrv.exe /Comclg32.dll"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill the process utlsrv.exe and remove utlsrv.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\uupgqem.exe

%SysDir%\uupgqem.exe is Trojan/Backdoor.
Kill the process uupgqem.exe and remove uupgqem.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\uwyrl.exe

%sysdir%\vanhoutt.exe

vanhoutt.exe is a Trojan W32.Sdranck-W.
vanhoutt.exe spreads via open network shares.
Related files:
%System%\ataste.exe
%System%\tasta.exe
%System%\vanhoutt.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill vanhoutt.exe process and remove vanhoutt.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\vb6stkit.dll

VB6STKIT.DLL is a Spyware.Wintective.
VB6STKIT.DLL logs keystrokes.
VB6STKIT.DLL monitors user Internet activity.
Related files:
%ProgramFiles%\wintective\wintective.exe
%System%\VB6STKIT.DLL
%System%\wintective.dll
%Windir%\ST6UNST.EXE
Adds the value:
"wintective" = "%ProgramFiles%\wintective\wintective.exe"
"UninstallString" = "C:\WINDOWS\st6unst.exe -n "C:\Program Files\wintective\ST6UNST.LOG" "
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove VB6STKIT.DLL from Windows startup using RegRun Startup Optimizer.

%sysdir%\vbn.dll

vbn.dll is a Trojan.Bankhof-D.
vbn.dll monitors user Internet activity and bank information.
It sends stolen data to a hacker site.
Related files:
%System%\rdrlib.dll
%System%\vbn.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove vbn.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\vbuninstall.exe

VBUninstall.exe is a Spyware.SafeSurfing.
VBUninstall.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Windir%\asbltzun.exe
%Windir%\netsync.exe
%Windir%\rsyncmon.dll
%Windir%\ISSM0064.DAT
%System%\COMMCOS2.DLL
%System%\InstallerV3.exe
%System%\regsync.exe
%System%\richedtr.dll
%System%\richup.exe
%System%\redtrsha.dll
%System%\vbrundll.dll
%System%\VBUninstall.exe
%System%\msxml3a.dll
Adds the value:
"RSync" = "%Windir%\netsync.exe"
"regsync" = "C:\WINDOWS\System32\regsync.exe"
"richup" = "C:\WINDOWS\System32\richup.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill VBUninstall.exe process and remove VBUninstall.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\vcsystem.exe

Vcsystem.exe is Trojan/Backdoor.
Kill the process vcsystem.exe and remove %SysDir%\vcsystem.exe from Windows startup.

%sysdir%\vdt_16.exe

vdt_16.exe is a Trojan Backdoor.Haxdoor.C.
vdt_16.exe tries to terminate antiviral programs installed on a user computer.
vdt_16.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\vdt_16.exe
%System%\i.a3d
%System%\draw32.dll
%System%\vm.dll
%System%\vdnt32.sys
%System%\hm.sys
%System%\memlow.sys
%System%\wd.sys
%System%\p2.ini
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill vdt_16.exe process and remove Xscan.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\version.exe

version.exe is a Trojan W32.Rbot-BAT.
version.exe opens a back door on IRC channels.
version.exe spreads via open network shares.
Related files:
%System%\version.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill version.exe process and remove version.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\vesdtm32.dll

%SysDir%\vesdtm32.dll is Trojan/Backdoor.
Remove vesdtm32.dll using RegRun "Scan for Viruses" feature.
http://www.regrun.com

%sysdir%\vgatune.exe

VGATune.exe is a Trojan W32.Rbot-AWM.
VGATune.exe opens a back door on IRC channels.
VGATune.exe spreads via open network shares.
VGATune.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\VGATune.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill VGATune.exe process and remove VGATune.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\via.exe

%SysDir%\via.exe is Trojan/Backdoor.
Kill the process %SysDir%\via.exe and remove %SysDir%\via.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\view2sp.exe

VIEW2SP.EXE is a Spyware.2Spy.
VIEW2SP.EXE records information in a log file.
Related files:
%SysDir%\REG_SSH32.EXE
%SysDir%\SSH32.EXE
%SysDir%\VIEW2SP.EXE
%SysDir%\SSH32.log
Adds the value:
"SSh32" = "\SSh32.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill VIEW2SP.EXE process and remove VIEW2SP.EXE from Windows startup using RegRun Startup Optimizer.

%sysdir%\vinm32.dll

%SysDir%\vinm32.dll is Trojan/Backdoor Haxdoor.
Kill the file %SysDir%\vinm32.dll and remove %SysDir%\vinm32.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com
Related files:
%Temp%\temp.exe
%SysDir%\config\ssl
%SysDir%\klo5.sys
%SysDir%\klogini.dll
%SysDir%\p3.ini
%SysDir%\ps.a3d
%SysDir%\qy.sys
%SysDir%\qz.dll
<System>\qz.sys
%SysDir%\vinm32.dll
%SysDir%\vinm32.sys
%SysDir%\vinm64.sys
%SysDir%\winm32.dll
%SysDir%\winm32.sys
%SysDir%\winm64.sys
Read more:
http://www.sophos.com/virusinfo/analyses...

%sysdir%\virdr.sys

virdr.sys is rootkit W32/Rbot-DBU.
virdr.sys is used to hide files, processes and registry.
virdr.sys is a kernel mode rootkit.
Rootkit contacts remote hacker server using HTTP session.
virdr.sys opens a back door on IRC channels.
virdr.sys spreads via open network shares.
Related files:
%WinDir%\system32.exe
%SysDir%\virdr.sys

system32.exe is created new system drivers:
service name: "Windows netdde"
display name: "Windows netdde"
Adds the value:
HKLM\SYSTEM\CurrentControlSet\Services\Windows netdde\
to the Windows startup registry keys.

virdr.sys is created new system drivers:
service name: " virdr"
display name: " virdr"
Added to registry:
HKLM\SYSTEM\CurrentControlSet\Services\virdr\

More info: http://www.sophos.com/virusinfo/analyses...

%sysdir%\viri-check.exe

viri-check.exe is a Trojan W32.Rbot-BBS.
viri-check.exe opens a back door on IRC channels.
viri-check.exe spreads via open network shares.
Related files:
%System%\viri-check.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill viri-check.exe process and remove viri-check.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\vistax.dll

vistax.dll is rootkit Trojan.Haxdoor-CA.
vistax.dll is used to hide files, processes and registry.
vistax.dll is a kernel mode rootkit.
Rootkit contacts remote hacker server using HTTP session.
vistax.dll tries to terminate antiviral programs installed on a user computer.
Related files:
%SysDir%\klgcptini.dat
%SysDir%\qz.dll
%SysDir%\qz.sys
%SysDir%\stt82.ini
%SysDir%\vistaj.sys
%SysDir%\vistax.dll

vistaj.sys is created new system drivers:
service name: "vistaj"
display name: "SE 3.0 memory driver"

service name: "vistax"
display name: "SE 3.2 memory driver"
Added to registry:
HKLM\SYSTEM\CurrentControlSet\Services\vistaj\
HKLM\SYSTEM\CurrentControlSet\Services\vistax\

Adds the value:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\vistax
DllName
vistax.dll

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\vistax
Startup
CxaEqsData

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\vistax
Impersonate
1
to the Windows startup registry keys.
More info: http://www.sophos.com/security/analyses/...

%sysdir%\visty.exe

visty.exe is a Trojan.Dloadr-ACZ.
visty.exe opens a back door.
Related files:
%System%\visty.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill visty.exe process and remove visty.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\vistys.exe

vistys.exe is a Trojan.Banload-IS.
vistys.exe opens a back door.
vistys.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\vistys.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill vistys.exe process and remove vistys.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\vjoytl32.dll

vjoytl32.dll is a worm W32.PPdoor-R.
vjoytl32.dll opens a back door.
vjoytl32.dll spreads via open network shares.
Related files:
%System%\arpo412.exe
%System%\mqadonfg.dll
%System%\winrpmsg.dll
%System%\wndfxyfi.dll
%System%\hgakheg.dll
%System%\vjoytl32.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove vjoytl32.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\vlbft.exe

%SysDir%\VLBFT.EXE is Trojan/Backdoor.
Kill the process VLBFT.EXE and remove VLBFT.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\vld5750.dll

vld5750.dll is a Trojan.Agent-GG.
vld5750.dll opens a back door.
Related files:
%System%\vld5750.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove vld5750.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\vm.dll

vm.dll is a Trojan Backdoor.Haxdoor.C.
vm.dll tries to terminate antiviral programs installed on a user computer.
vm.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\vdt_16.exe
%System%\i.a3d
%System%\draw32.dll
%System%\vm.dll
%System%\vdnt32.sys
%System%\hm.sys
%System%\memlow.sys
%System%\wd.sys
%System%\p2.ini
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove vm.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\vm2.dll

vm2.dll is Trojan.KillProc-I.
vm2.dll downloads code from the internet.
Related files:
%System%\vm2.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove vm2.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\vmlib.exe

vmlib.exe is a Trojan.LowZone-AQ.
vmlib.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\vmlib.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill vmlib.exe process and remove vmlib.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\vmmon32.exe

%SysDir%\vmmon32.exe is Trojan/Backdoor.
Kill the process vmmon32.exe and remove vmmon32.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\vnetbsh.dll

vnetbsh.dll is rootkit Trojan.PPdoor-J.
vnetbsh.dll is used to hide files, processes and registry.
vnetbsh.dll is a user mode rootkit.
Rootkit injects itself into other process.
vnetbsh.dll tries to terminate antiviral programs installed on a user computer.
Related files:
%SysDir%\ovdcmaaa.dll
%SysDir%\vnetbsh.dll
Adds the value:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Client Agent

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ ShellServiceObjectDelayLoad
Internet Agent
(11F1576E-3AB4-439A-A5C9-4D77B4087863)
to the Windows startup registry keys.
Added to registry:
HKCR\CLSID\11F1576E-3AB4-439A-A5C9- 4D77B4087863
InProcServer32
\shel1_qc.dll
More info: http://www.sophos.com/virusinfo/analyses...

%sysdir%\vook.sys

vook.sys is rootkit Trojan.Agent-BMT.
vook.sys is used to hide files, processes and registry.
vook.sys is a kernel mode rootkit.
Related files:
%WinDir%\qkjyt7dx.dll
%SysDir%\vook.sys

vook.sys is created new system drivers:
service name: "squell"
display name: "squell"
Added to registry:
HKLM\SYSTEM\CurrentControlSet\Services\squell\
More info: http://www.sophos.com/virusinfo/analyses...

%sysdir%\voot.sys

voot.sys is Trojan/Backdoor.
Kill the file voot.sys and remove voot.sys from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\vport1.1.exe

VPort1.1.exe is a Trojan.GrayBir-AJ.
VPort1.1.exe opens a back door.
Related files:
%System%\VPort1.1.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill VPort1.1.exe process and remove VPort1.1.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\vschosts.exe

vschosts.exe is a Trojan.Vipsy-A.
vschosts.exe opens a back door.
vschosts.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\vschosts.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill vschosts.exe process and remove vschosts.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\vshell.exe

vShell.exe is a mass-mailing worm W32.Israz@mm.
vShell.exe spreads via open network shares.
Related files:
%System%\vShell.exe
%System%\OSSMTP.dll
%Temp%\Fun.exe
%Temp%\FAQ.exe
%Temp%\Support.exe
%Temp%\Q322593.exe
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill vShell.exe process and remove vShell.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\vssmon.exe

VSSMON.exe is a Trojan W32.Rbot-AWW.
VSSMON.exe opens a back door on IRC channels.
VSSMON.exe spreads via open network shares.
VSSMON.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\VSSMON.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill VSSMON.exe process and remove VSSMON.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\vtd_16.exe

vtd_16.exe is rootkit Trojan.Haxdoor-AE.
vtd_16.exe is used to hide files, processes and registry.
vtd_16.exe is a kernel mode rootkit.
Rootkit contacts remote hacker server using HTTP session.

draw32.dll created new system drivers:
service name: "draw32.dll"
display name: "MedManager"

memlow.sys created new system drivers:
service name: "memlow"
display name: "LMMngr"

vdnt32.sys created new system drivers:
service name: " vdnt32"
display name: "MemDRV"
Related files:
%SysDir%\vtd_16.exe
%SysDir%\cm.dll
%SysDir%\draw32.dll
%SysDir%\hm.sys
%SysDir%\memlow.sys
%SysDir%\p2.ini
%SysDir%\vdnt32.sys
%SysDir%\wd.sys
%SysDir%\i.a3d
%SysDir%\klogini.dll

Added to registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
More info: http://www.sophos.com/virusinfo/analyses...

%sysdir%\vtstr.dll

%SysDir%\vtstr.dll is Trojan.Vundo.
Read more: http://www.symantec.com.br/avcenter/venc...
Kill the file %SysDir%\vtstr.dll and remove %SysDir%\vtstr.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\vtstt.dll

%SysDir%\vtstt.dll is a Spyware (Winfixer 2005 / Winfixer 2006).
Remove %SysDir%\vtstt.dll from Windows startup using RegRun.
www.regrun.com

%sysdir%\vturr.dll

%SysDir%\vturr.dll is Adware Virtumundo.
Kill the file %SysDir%\vturr.dll and remove %SysDir%\vturr.dll from Windows startup.

%sysdir%\vwix32.exe

%sysdir%\vxgame1.exe

vxgame1.exe is a Trojan.Vixup-AC.
vxgame1.exe downloads code from the internet.
Related files:
%System%\vxgame1.exe
%System%\vxgame2.exe
%System%\vxgame3.exe
%System%\vxgame4.exe
%System%\vxgame5.exe
%System%\vxgame6.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill vxgame1.exe process and remove vxgame1.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\vxgame2.exe

vxgame2.exe is a Trojan.Vixup-AC.
vxgame2.exe downloads code from the internet.
Related files:
%System%\vxgame1.exe
%System%\vxgame2.exe
%System%\vxgame3.exe
%System%\vxgame4.exe
%System%\vxgame5.exe
%System%\vxgame6.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill vxgame2.exe process and remove vxgame2.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\vxgame3.exe

vxgame3.exe is a Trojan.Vixup-AC.
vxgame3.exe downloads code from the internet.
Related files:
%System%\vxgame1.exe
%System%\vxgame2.exe
%System%\vxgame3.exe
%System%\vxgame4.exe
%System%\vxgame5.exe
%System%\vxgame6.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill vxgame3.exe process and remove vxgame3.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\vxgame4.exe

vxgame4.exe is a Trojan.Vixup-AC.
vxgame4.exe downloads code from the internet.
Related files:
%System%\vxgame1.exe
%System%\vxgame2.exe
%System%\vxgame3.exe
%System%\vxgame4.exe
%System%\vxgame5.exe
%System%\vxgame6.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill vxgame4.exe process and remove vxgame4.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\vxgame5.exe

vxgame5.exe is a Trojan.Vixup-AC.
vxgame5.exe downloads code from the internet.
Related files:
%System%\vxgame1.exe
%System%\vxgame2.exe
%System%\vxgame3.exe
%System%\vxgame4.exe
%System%\vxgame5.exe
%System%\vxgame6.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill vxgame5.exe process and remove vxgame5.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\vxgame6.exe

vxgame6.exe is a Trojan.Vixup-AC.
vxgame6.exe downloads code from the internet.
Related files:
%System%\vxgame1.exe
%System%\vxgame2.exe
%System%\vxgame3.exe
%System%\vxgame4.exe
%System%\vxgame5.exe
%System%\vxgame6.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill vxgame6.exe process and remove vxgame6.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\vxh8jkdq2.exe

vxh8jkdq2.exe is Trojan/Backdoor.
Kill the process vxh8jkdq2.exe and remove xh8jkdq2.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\vxh8jkdq6.exe

vxh8jkdq6.exe is Trojan/Backdoor.
Kill the process vxh8jkdq6.exe and remove vxh8jkdq6.exe from Windows startup.

%sysdir%\vxvgfv.sys

vxvgfv.sys is rootkit Trojan.Haxdoor-BT.
vxvgfv.sys is used to hide files, processes and registry.
vxvgfv.sys is a kernel mode rootkit.
vxvgfv.sys tries to terminate antiviral programs installed on a user computer.
Rootkit contacts remote hacker server using HTTP session.
Related files:
%SysDir%\satmmc.dll
%SysDir%\vxvgfv.sys

vxvgfv.sys is created new system drivers:
service name: "vxvgfv"
display name: "VXV CPU device"
Added to registry:
HKLM\SYSTEM\CurrentControlSet\Services\vxvgfv\

Adds the value:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\satmmc
DllName
satmmc.dll

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\satmmc
Startup
satmmc

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\satmmc
Impersonate
1
to the Windows startup registry keys.
More info: http://www.sophos.com/security/analyses/...

%sysdir%\w?auclt.exe

%SysDir%\w?auclt.exe is PurityScan/Clickspring adware.
Kill the process %SysDir%\w?auclt.exe and remove %SysDir%\w?auclt.exe from Windows startup using RegRun.
www.regrun.com

%sysdir%\w16.dll

W16.dll is a Trojan PWSteal.Bancos.AA.
W16.dll monitors user Internet activity and bank information.
It sends stolen data to a hacker site.
Related files:
%System%\system.exe
%System%\sys32.exe
%System%\w16.dll
%System%\w16s.dll
%System%\win32.dll
Adds the value:
"System service" = "%System%\system.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove w16.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\w16s.dll

W16s.dll is a Trojan PWSteal.Bancos.AA.
W16s.dll monitors user Internet activity and bank information.
It sends stolen data to a hacker site.
Related files:
%System%\system.exe
%System%\sys32.exe
%System%\w16.dll
%System%\w16s.dll
%System%\win32.dll
Adds the value:
"System service" = "%System%\system.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove w16s.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\w32.ajm.worm

SysRtw32.exe is a mass-mailing worm W32.AJM.Worm.
SysRtw32.exe spreads by e-mail and via open network shares.
Related files:
%System%\User32Rem.exe
%System%\UserGDL.exe
%System%\BihUpdate.exe
%System%\SysRtw32.exe
%System%\Win32Dll.exe
%System%\MsCrt32.exe
%System%\Temp32.exe
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill SysRtw32.exe process and remove SysRtw32.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\w32_ss.exe

W32_SS.EXE is rootkit Trojan.Haxdoor-G.
W32_SS.EXE is used to hide files, processes and registry.
W32_SS.EXE is a kernel mode rootkit.
Rootkit contacts remote hacker server using HTTP session.
SDMAPI.SYS created new system drivers:
service name: "SDMAPI"
display name: "KESDM"

BOOT32.SYS created new system drivers:
service name: " BOOT32"
display name: " KEBOOT"

Related files:
%SysDir%\
%SysDir%\DEBUG.DLL
%SysDir%\SDMAPI.SYS
%SysDir%\BOOT32.SYS
%SysDir%\C3.DLL
%SysDir%\C3.SYS
%SysDir%\C4.SYS
%SysDir%\P2.INI
%SysDir%\KLOG.SYS
%SysDir%\KLOGINI.DLL
%SysDir%\IN.A3D
%SysDir%\PS.A3D
%SysDir%\ERROR.A3D
Adds the value:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\secboot

HKLM\SYSTEM\CurrentControlSet\Control\MPRServices\TestServices\
DllName = debugg.dll

HKLM\SYSTEM\CurrentControlSet\Control\MPRServices\TestServices\
EntryPoint = MemManager

HKLM\SYSTEM\CurrentControlSet\Control\MPRServices\TestServices\
StackSize = 0

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
debugg\DllName = debugg.dll

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
debugg\Startup = MemManager

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
debugg\Impersonate = 1

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
debugg\Asynchronous = 1

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
debugg\MaxWait = 1
to the Windows startup registry keys.
Added to registry:
HKLM\SYSTEM\RAdminv\2.0\Parameters\DisableTrayIcon
HKLM\SYSTEM\CurrentControlSet\Control\Impersonate

HKLM\SYSTEM\CurrentControlSet\Control\Session Management\EnforceWriteProtection

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersoin\hws
More info: http://www.sophos.com/virusinfo/analyses...

%sysdir%\w3264.exe

w3264.exe is a mass-mailing worm W32.Mytob-BO.
w3264.exe opens a back door on IRC channels.
w3264.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\w3264.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill w3264.exe process and remove w3264.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\w32secm.exe

w32secm.exe is a spyware worm W32.Antinny-P.
w32secm.exe spreads via open network shares.
w32secm.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Temp%\mstemp.exe
%%System%\w32secm.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill the process w32secm.exe and remove w32secm.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\w32t.dll

W32t.dll is a Trojan Backdoor.Fuwudoor.
W32t.dll spreads via open network shares.
Related files:
%System%\ipsec.dll
%System%\appmgmt.dll
%System%\browsvr.dll
%System%\trkw.dll
%System%\trks.dll
%System%\kdc.dll
%System%\dmsrv.dll
%System%\mesg.dll
%System%\netlogin.dll
%System%\protstrg.dll
%System%\lmhosts.dll
%System%\w32t.dll
%System%\ntms.dll
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove w32t.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\w32time.exe

%SysDir%\w32time.exe is Trojan/Backdoor.
Kill the process w32time.exe and remove w32time.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\w32tm.exe

Trojan Backdoor.Haxdoor.
Realated files:
* %System%\w32tm.exe
* %System%\drct16.dll
* %System%\cz.dll
* %System%\vdmt16.sys
* %System%\hz.dll
* %System%\winlow.sys
* %System%\wz.dll
* %System%\p2.ini
Adds the value:
"Secboot" = "w32tm.exe" to Windows startup registry keys.
Register the service called "memlow" and driver "vdmt16".
Adds the values:
"StackSize" = "21:10"
"Impersonate" = "[TIMESTAMP]"
to the following registry key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control
and
"hws" = "[0xRandom]"
to the following registry key:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion
and
"EnforceWriteProtect" = "0"

to the following registry key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Session Manager\Memory Management
in an attempt to disable the kernel from checking for abnormal memory overwrites and allows the Trojan to overwrite parts of the memory.

Modifies the values on Windows 95/98/Me computers:
"DllName" = "draw32.dll"
"EntryPoint" = "MedManager"
"StackSize" = "0"
to the following registry key:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\MPRServices\
TestService

Modifies the values on Windows 2000/NT/XP computers:
"DllName" = "drct16.dll"
"Startup" = "MedManager"
"Impersonate" = "dword:00000001"
"Asynchronous" = "dword:00000001"
"MaxWait" = "dword:00000001"
to the following registry key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\drct16
Opens the following TCP ports 16661, and two additional high random ports and waits for commands from a remote attacker.
Steals passwords.
Removal:
Stop the service "memlow", disable its autorun using Start Control.
Open RegRun AntiSpyware, got to Winlogon Notification.
Remove "drct16" or "TestService".
Kill w32tm.exe process using RegRun Terminator.

%sysdir%\w3ssveds.exe

w3ssveds.exe is rootkit Trojan.PPdoor-M.
w3ssveds.exe is used to hide files, processes and registry.
w3ssveds.exe is a user mode rootkit.
Rootkit contacts remote hacker server using HTTP session.
Rootkit injects itself into other process.
Related files:
%SysDir%\w3ssveds.exe
%SysDir%\gofsklzk.dll
%SysDir%\kasgfka.dll
Adds the value:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ ShellServiceObjectDelayLoad
Meeting Connection
(6A436F1A-92DA-4279-91D2-0F9955CE70DE)

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Access WebControl

to the Windows startup registry keys.
More info: http://www.sophos.com/virusinfo/analyses...

%sysdir%\w8673492.exe

w8673492.exe is a Trojan.Desktophijack.B.
w8673492.exe modifies the desktop settings.
w8673492.exe spreads via open network shares.
Related files:
%System%\w8673492.exe
%System%\wp.bmp
%Temp%\Terms!.txt
Adds the value:
"WindowsFZ" = "%CurrentFolder%\[Trojan File Name].exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill w8673492.exe process and remove w8673492.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\wali.dll

WALI.dll is a Spyware.WALogger.
WALI.dll logs keystrokes.
Related files:
%System%\WALI\SVCS\WALIMAIN.exe
%System%\WALI.dll
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove WALI.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\wali\svcs\walimain.exe

WALIMAIN.exe is a Spyware.WALogger.
WALIMAIN.exe logs keystrokes.
Related files:
%System%\WALI\SVCS\WALIMAIN.exe
%System%\WALI.dll
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill WALIMAIN.exe process and remove WALIMAIN.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\walib32.dll

walib32.dll is a Trojan.MancSyn-B.
walib32.dll opens a back door.
Related files:
%Startup%\office.exe
%System%\hwdetect.exe
%System%\walib32.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove walib32.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\wartsrv.exe

wartsrv.exe is Trojan/Backdoor.
Kill the process wartsrv.exe and remove wartsrv.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\waruclt.exe

%SysDir%\waruclt.exe is a variant Backdoor.Sdbot.
Kill the process %SysDir%\waruclt.exe and remove %SysDir%\waruclt.exe from Windows startup using RegRun.
Read more: http://www.symantec.com/avcenter/venc/da...

%sysdir%\watcher.dll

Watcher.dll is a mass-mailing worm W32.Aprilcone.A@mm.
Watcher.dll spreads by e-mail.
Related files:
%System%\syscon.exe
%System%\mschk.dll
%System%\Watcher.dll
%System%\sysMon.dll
%System%\syslog.dll
%System%\atchk.dll
%System%\sysmsg.dll
%System%\chkrun.dll
%System%\dskchk.dll
%System%\msevent.dll
%System%\ipchk.dll
%System%\client.dll
%System%\servr.dll
%System%\netchk.dll
%System%\mssys.dll
Adds the value:
"syscon" = "%System%\syscon.exe"
"AppInit_DLLs" = "%System%\Watcher.dll"
to the Windows startup registry keys.

More info: http://securityresponse.symantec.com/avc...
Removal:
Remove Watcher.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\watchole.exe

watchole.exe is worm W32.Sdranck-S.
watchole.exe spreads via open network shares.
Related files:
%SYSTEM32%\watchole.exe
%SYSTEM32%\holewatch.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill watchole.exe process and remove watchole.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\wbem\irjit.dll,export 1087

IRJIT.DLL,EXPORT 1087
IRJIT.DLL is Trojan/Backdoor.
Remove IRJIT.DLL using RegRun "Scan for Viruses" feature.

%sysdir%\wbem\wmiadapt.exe

wmiadapt.exe is a Trojan.Nithsys.
wmiadapt.exe opens a back door.
Related files:
%System%\wbem\wmiadapt.exe
%System%\systanten.exe
%System%\systhin.dll
Adds the value:
"shell" = "Explorer.exe %System%\wbem\wmiadapt.exe"
"[RANDOM NAME]" ="[PATH TO FILE]"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill the process wmiadapt.exe and remove wmiadapt.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\wbem\wmiprv.dll

wmiprv.dll is a Trojan.Mutech-A.
wmiprv.dll opens a back door.
Related files:
%System%\perfont.exe
%System%\drivers\netpt.sys
%System%\wbem\wmiprv.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove wmiprv.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\wbev\windrg32.exe

windrg32.exe is a Backdoor W32.Zotob.D.
windrg32.exe tries to terminate antiviral programs installed on a user computer.
windrg32.exe spreads by using the vulnerability in Microsoft Windows Plug and Play Service (Microsoft Security Bulletin MS05-039).
Related files:
%System%\wbev\windrg32.exe
Adds the value:
"WinDrg32" = "%System%\wbev\windrg32.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill windrg32.exe process and remove windrg32.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\wbtvsffd.exe

Wbtvsffd.exe is an adware program Adware.BetterInternet.
Wbtvsffd.exe is a Browser Helper Object.
Wbtvsffd.exe downloads and displays advertisements.
Related files:
%Windir%\Bi.dll
%Windir%\speeryox.dll
%Windir%\Mxtarget.dll
%Windir%\BTGrab.dll
%Windir%\farmmext.exe
%Windir%\dlmax.dll
%Windir%\speer2.dll
%Windir%\VoiceIP.dll
%Windir%\morphacl.dll
%Windir%\Pynix.dll
%Windir%\Biprep.exe
%Windir%\banner.dll
%System%\laziqn.exe
%System%\xxvyaj.exe
%System%\wbtvsffd.exe
%System%\nnmzoq.exe
%Temp%\DrTemp\thnall1b.exe
%Temp%\DrTemp\thnall1p.exe
%Temp%\DrTemp\thnall2r.exe
%Temp%\DrTemp\polall1b.exe
%Temp%\thnall1s.exe
%Temp%\morphrec.exe
Adds the value:
"[File name of adware]" = "[File path to adware]"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill wbtvsffd.exe process and remove wbtvsffd.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\wcmd.exe

wcmd.exe is a Trojan.KillFil-O.
wcmd.exe opens a back door.
Related files:
%System%\wcmd.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill wcmd.exe process and remove wcmd.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\wcsys.exe

wcsys.exe is a Trojan.Keylog-AP.
wcsys.exe spreads by e-mail and via open network shares.
wcsys.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\wcsys.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill wcsys.exe process and remove wcsys.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\wcupshell.exe

wcupshell.exe is a worm W32.Combra-I.
wcupshell.exe spreads by e-mail.
Related files:
%System%\wcupshell.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill wcupshell.exe process and remove wcupshell.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\wdata32.dll

wdata32.dll is a Trojan.Multidr-EU.
wdata32.dll opens a back door.
Related files:
%System%\ntdll32.dll
%System%\ranx.dll
%System%\god.sys
%System%\svch0st.exe
%Windows%\suniu.exe
%System%\mmdat.dat
%System%\wdata32.dll
%Windows%\123.jpg
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove wdata32.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\wdate.dll

Wdate.dll is a mass-mailing worm W32.Bagz@mm.
Wdate.dll tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\dl.exe
%System%\syslogin.exe
%System%\jobdb.dll
%System%\ipdb.dll
%System%\wdate.dll
Adds the value:
"syslogin.exe" = "syslogin.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove wdate.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\wdmfmc32.dll

%SysDir%\wdmfmc32.dll is Trojan/Backdoor.
Remove wdmfmc32.dll using RegRun "Scan for Viruses" feature.
http://www.regrun.com

%sysdir%\wdns33.exe

wdns33.exe is a mass-mailing worm W32.Mytob.GJ@mm.
wdns33.exe opens a back door on TCP port 9000.
wdns33.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\wdns33.exe
Adds the value:
"WDNS SYSTEM" = "wdns33.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill wdns33.exe process and remove wdns33.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\web.exe

Web.exe is a Trojan Trojan.Anicmoo.D.
Web.exe exploits the Windows User32.DLL ANI File Header Handling Stack-Based Buffer Overflow Vulnerability (Microsoft Security Bulletin MS05-002).
Related files:
C:\Windows\System32\web.exe
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill web.exe process and remove web.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\wftestb.exe

wftestb.exe is a Backdoor W32.Rbot-AFZ.
wftestb.exe spreads via open network shares.
wftestb.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\wftestb.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill wftestb.exe process and remove wftestb.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\wgse.exe

Wgse.exe is Adware.QuickLinks.Process.
Kill the process wgse.exe and remove wgse.exe from Windows startup using RegRun.
www.regrun.com

%sysdir%\wheax.exe

wheax.exe is a Trojan.BeastPWS-B.
wheax.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\wheax.exe
%Windows%\wheax.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill the process wheax.exe and remove wheax.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\why-.exe

why-.exe is a worm W32.Rbot-AMV .
why-.exe opens a back door.
why-.exe spreads via open network shares.
Related files:
%System%\why-.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill why-.exe process and remove why-.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\wiatwain.dll

wiatwain.dll is a Trojan.Zlob-EO.
wiatwain.dll opens a back door.
Related files:
%System%\wiatwain.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove wiatwain.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\wid32.exe

wID32.exe is a mass-mailing worm W32.Mytob.LD@mm.
wID32.exe opens a back door.
wID32.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\wID32.exe
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill wID32.exe process and remove wID32.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\wiinlogon.exe

wiinlogon.exe is a Trojan W32.Rbot-AVH.
wiinlogon.exe opens a back door on IRC channels.
wiinlogon.exe spreads via open network shares.
Related files:
%System%\wiinlogon.exe
%System%\svkp.sys
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill wiinlogon.exe process and remove wiinlogon.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\win.dll

win.dll is a Trojan.StartPage.P.
win.dll modifies the Internet Explorer home page.
Related files:
%Windir%\system\CTFM0N.exe
%Windir%\system\N0TEPAD.EXE
%Windir%\system32\N0TEPAD.EXE
%Windir%\N0TEPAD.EXE
%Windir%\system\windll.dll
%Windir%\system\win.dll
Adds the value:
"CTFM0N.exe" = "%Windir%\system\CTFM0N.exe"
"(Default)" = "N0TEPAD.EXE %1"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove win.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\win.exe.exe

Win.exe.exe is a mass-mailing worm W32.Mytob.FA@mm.
Win.exe.exe tries to terminate antiviral programs installed on a user computer.
Win.exe.exe opens a back door on TCP port 6667.
Related files:
%System%\win.exe.exe
Adds the value:
"WINDOWS SYSTEM" = "win.exe.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill win.exe.exe process and remove win.exe.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\win_rar.dll

win_rar.dll is a Trojan PWSteal.Raidys.
win_rar.dll opens a back door.
win_rar.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\userinit.exe
%System%\ctfmon.exe
%System%\win_rar.dll
%System%\raid.sys
%System%\sfc_os.dll
%System%\a.txt
%System%\twain.ini
Adds the value:
"ctfmon.exe" = "%System%\ctfmon.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove win_rar.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\win32.dll

win32.dll is rootkit Trojan.Nebuler-I.
win32.dll is used to hide files, processes.
win32.dll is a kernel mode rootkit.
Rootkit contacts remote hacker server using HTTP session.
Related files:
%Temp%\mst1.bat
%current folder>\mit.bat
%SysDir%\win32.dll
Adds the value:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\win32
DllName
win32.dll

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\win32
Impersonate
0

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\win32
Startup
EvtStartup
to the Windows startup registry keys.
More info: http://www.sophos.com/virusinfo/analyses...

%sysdir%\win052.exe

win052.exe is a Trojan Backdoor.Danrit.
win052.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Temp%\blat.exe
%Temp%\ntrights.exe
%System%\win052.exe
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill win052.exe process and remove win052.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\win24.exe

win24.exe is a mass-mailing worm W32.Kidala.A@mm.
Kill the process win24.exe and remove win24.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\win32.dll

win32.dll is a Trojan PWSteal.Bancos.AA.
win32.dll monitors user Internet activity and bank information.
It sends stolen data to a hacker site.
Related files:
%System%\system.exe
%System%\sys32.exe
%System%\w16.dll
%System%\w16s.dll
%System%\win32.dll
Adds the value:
"System service" = "%System%\system.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove win32.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\win3206365874237.exe

%SysDir%\win3206365874237.exe is Trojan/Backdoor.
Kill the process %SysDir%\win3206365874237.exe and remove %SysDir%\win3206365874237.exe from Windows startup.

%sysdir%\win32bat.exe

win32bat.exe is a mass-mailing worm W32.Mytob.FI@mm.
win32bat.exe opens a back door on TCP port 2817.
win32bat.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\win32bat.exe
Adds the value:
"Windows System 32-Bat Service" = "win32bat.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill win32bat.exe process and remove win32bat.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\win32debug.exe

win32debug.exe is a worm W32.Gudeb.
win32debug.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\win32debug.exe
Adds the value:
"win32debug" = "%System%\win32debug.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill win32debug.exe process and remove win32debug.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\win32dll.exe

Win32Dll.exe is a mass-mailing worm W32.AJM.Worm.
Win32Dll.exe spreads by e-mail and via open network shares.
Related files:
%System%\User32Rem.exe
%System%\UserGDL.exe
%System%\BihUpdate.exe
%System%\SysRtw32.exe
%System%\Win32Dll.exe
%System%\MsCrt32.exe
%System%\Temp32.exe
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill Win32Dll.exe process and remove Win32Dll.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\win32i.exe

win32i.exe is a Trojan.Bifrose-R.
win32i.exe spreads by e-mail.
Related files:
%System%\win32i.exe
%System%\plugin1.dat
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill win32i.exe process and remove win32i.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\win32imapsvr.exe

Win32IMAPSVR.exe is a mass-mailing worm W32.Mytob-FU.
Win32IMAPSVR.exe opens a back door on IRC channels.
Related files:
%System%\Win32IMAPSVR.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill Win32IMAPSVR.exe process and remove Win32IMAPSVR.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\win32lib.exe

win32lib.exe is a Trojan W32/Rbot-AUK.
win32lib.exe opens a back door on IRC channels.
win32lib.exe spreads via open network shares.
Related files:
%System%\win32lib.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill win32lib.exe process and remove win32lib.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\win32op.exe

WIN32OP.EXE is a mass-mailing worm W32/SdBot-U.
WIN32OP.EXE opens a back door on IRC channels.
WIN32OP.EXE spreads via open network shares.
Related files:
%System%\WIN32OP.EXE
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill WIN32OP.EXE process and remove WIN32OP.EXE from Windows startup using RegRun Startup Optimizer.

%sysdir%\win32scs.exe

win32scs.exe is a Trojan.Hackarmy-C.
win32scs.exe opens a back door on IRC channels.
Related files:
%System%\win32scs.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill win32scs.exe process and remove win32scs.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\winacpi.dll

winacpi.dll is a Trojan.Cimuz-C.
winacpi.dll opens a back door.
winacpi.dll tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\mdms.exe
%System%\winacpi.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove winacpi.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\winamp.exe

%SysDir%\winamp.exe is Trojan/Backdoor.
Kill the process %SysDir%\winamp.exe and remove %SysDir%\winamp.exe from Windows startup.

%sysdir%\winats.dll

%SysDir%\WinATS.dll is Adware.Mirar.
Remove %SysDir%\WinATS.dll from Windows using RegRun.
Read more: http://www.symantec.com/avcenter/venc/da...

%sysdir%\winb2s32.dll

winb2s32.dll is an adware program Adware.Begin2search.
winb2s32.dll monitors user Internet activity.
winb2s32.dll displays advertising information.
Related files:
%System%\reg6523.exe
%System%\winb2s32.dll
%System%\winbbb.dat
%System%\dsktrf.dll
%System%\ns.dll
%System%\trgen.dll
%System%\rtneg.dll
%Windir%\Downloaded Program Files\winb2s32.inf
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove winb2s32.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\winbery.exe

winbery.exe is a Trojan.LegMir-CG.
winbery.exe tries to terminate antiviral programs installed on a user computer.
winbery.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\winbery.exe
%System%\GroupPolicy\Machine\Scripts\scripts.ini
%Windows%\vbarun.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill winbery.exe process and remove winbery.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\winbin.exe

winbin.exe is a Trojan.Dloadr-AAX.
winbin.exe tries to terminate antiviral programs installed on a user computer.
winbin.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\winbin.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill winbin.exe process and remove winbin.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\winbrume.dll

%SysDir%\winbrume.dll is Trojan/Backdoor.
Kill the file winbrume.dll and remove winbrume.dll from Windows startup using RegRun Reanimator.
http://www.sophos.com/virusinfo/analyses...

%sysdir%\wincmd.exe

WINCMD.EXE is Trojan/Backdoor KDR_HAAN.A.
Related files:
%System%\WINCMD.EXE
%System%\SMSG.HTML
%System%\EVLOG.DAT
http://www.trendmicro.com/vinfo/virusenc...

Kill the process %SysDir%\WINCMD.EXE and remove %SysDir%\WINCMD.EXE from Windows startup.

%sysdir%\wincom32.sys

wincom32.sys is rootkit Storm Worm.
wincom32.sys is used to hide files, processes and registry.
wincom32.sys is a kernel mode rootkit.
wincom32.sys spreads by e-mail.
Rootkit injects itself into the services.exe process.
Rootkit contacts remote hacker server using various IP addresses.
Related files:
%SysDir%\wincom32.sys
%SysDir%\peers.ini

wincom32.sys is created new system drivers:
service name: " wincom32"

Added to registry:
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wincom32]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WINCOM32]
More info: http://www.f-secure.com/v-descs/small_da...

%sysdir%\winconfig.exe

%SysDir%\winconfig.exe is Trojan/Backdoor.
Kill the process winconfig.exe and remove winconfig.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\wincontrol.dll

wincontrol.dll is a Trojan.LegMir-CA.
wincontrol.dll opens a back door.
wincontrol.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\Svchost32.dll
%System%\ccsys_control.dll
%System%\wincontrol.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove wincontrol.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\wincontxt.dll

wincontxt.dll is a Trojan.Clunky-B.
wincontxt.dll opens a back door.
Related files:
%System%\Microsoft\fixcomdos.exe
%System%\Microsoft\iexplore.exe
%System%\wincontxt.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove wincontxt.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\wincqt32.dll

%SysDir%\wincqt32.dll is Trojan/Backdoor.
Remove wincqt32.dll using RegRun "Scan for Viruses" feature.
http://www.regrun.com

%sysdir%\wind2ll2.exe

wind2ll2.exe is a mass-mailing worm W32.Beagle.CQ@mm.
wind2ll2.exe opens a back door.
wind2ll2.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\wind2ll2.exe
Adds the value:
"erfgddfk" = "%System%\wind2ll2.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill wind2ll2.exe process and remove wind2ll2.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\windash.exe

WinDash.EXE is a worm W32.Attech-C.
WinDash.EXE downloads code from the internet.
WinDash.EXE spreads via open network shares and by AOL Instant Messenger.
Related files:
%System%\WinOIE789.exe
%System%\WinDash.EXE
%Windows%\FontLoader.exe
%System%\NetMeeting.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill WinDash.EXE process and remove WinDash.EXE from Windows startup using RegRun Startup Optimizer.

%sysdir%\windasz-updote.exe

windasz-updote.exe is a mass-mailing worm W32.Mytob-EZ.
windasz-updote.exe opens a back door on IRC channels.
windasz-updote.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\windasz-updote.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill windasz-updote.exe process and remove windasz-updote.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\windat32.exe

windat32.exe is a Trojan W32.Rbot-LU.
windat32.exe opens a back door.
windat32.exe spreads via open network shares.
windat32.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\windat32.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill windat32.exe process and remove windat32.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\windates.exe

%SysDir%\WinDates.exe is Trojan/Backdoor.
Kill the process %SysDir%\WinDates.exe and remove %SysDir%\WinDates.exe from Windows startup.
www.regrun.com

%sysdir%\windbg32.exe

Windbg32.exe is a Backdoor W32.Zotob.L.
Windbg32.exe spreads by exploiting vulnerabilities, including the Microsoft Windows Plug and Play Buffer Overflow Vulnerability (Microsoft Security Bulletin MS05-039).
Related files:
%System%\windbg32.exe
Adds the value:
"Windows Debugger" = "windbg32.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill windbg32.exe process and remove windbg32.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\windesktop.exe

windesktop.exe is a Trojan W32.Sdbot-XH.
windesktop.exe opens a back door on IRC channels.
windesktop.exe spreads via open network shares.
windesktop.exe tries to terminate antiviral programs installed on a user computer.
windesktop.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\windesktop.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill windesktop.exe process and remove windesktop.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\windinit.exe

windinit.exe is Trojan/Backdoor.
Kill the process windinit.exe and remove windinit.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\windio778.exe

WinDio778.exe is a worm W32.Attech-D.
WinDio778.exe downloads code from the internet.
WinDio778.exe modifies data on the computer.
Related files:
%System%\Dioxin.exe
%System%\WinDio778.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill WinDio778.exe process and remove WinDio778.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\windiqew.exe

%SysDir%\windiqew.exe is Trojan/Backdoor.
Kill the process windiqew.exe and remove windiqew.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\windir32.exe

%SysDir%\windir32.exe is W32/Sdbot-ABM.
Process windir32.exe connects to a remote IRC server where it waits for commands to execute.
Kill the process windir32.exe and remove %SysDir%\windir32.exe from Windows using RegRun.
www.regrun.com

%sysdir%\windky.dll

windky.dll is a Trojan.QQPass-AM.
windky.dll tries to terminate antiviral programs installed on a user computer.
windky.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\algesetp.exe
%System%\temp.jpg
%System%\windky.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove windky.dll Windows startup using RegRun Startup Optimizer.

%sysdir%\windlhhl.exe

Windlhhl.exe is a mass-mailing worm W32.Beagle.BH@mm.
Windlhhl.exe opens a back door on TCP port 80.
Windlhhl.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\windlhhl.exe
Adds the value:
"erghgjhjgdr" = "%System%\windlhhl.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill windlhhl.exe process and remove windlhhl.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\windll2.exe

Windll2.exe is a mass-mailing worm W32.Beagle.CG@mm.
Windll2.exe opens a back door on TCP port 80.
Windll2.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\windll2.exe
Adds the value:
"erthegdr" = "%System%\windll2.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill windll2.exe process and remove windll2.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\windll32lib.exe

windll32lib.exe is a mass-mailing worm W32.Beagle.DW@mm.
windll32lib.exe opens a back door.
windll32lib.exe spreads by e-mail and via open network shares.
windll32lib.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\windll32lib.exe
%System%\windll32lib.exeopen
%System%\windll32lib.exeopenopen
Adds the value:
"winshell" = "%System%\windll32lib.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill the process windll32lib.exe and remove windll32lib.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\windlls.exe

windlls.exe is a Trojan W32.Rbot-AZQ.
windlls.exe opens a back door on IRC channels.
windlls.exe spreads via open network shares.
Related files:
%System%\windlls.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill windlls.exe process and remove windlls.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\windllsys32.exe

windllsys32.exe is a Trojan.Mitglie-A.
windllsys32.exe opens a back door.
Related files:
%System%\windllsys32.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill windllsys32.exe process and remove windllsys32.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\windows.exe

%SysDir%\windows.exe is W32/Zotob-L.
Read more: http://www.sophos.com/virusinfo/analyses...
Kill the process %SysDir%\windows.exe and remove %SysDir%\windows.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\windows_kernel32.exe

%sysdir%\windows32.exe

Windows32.exe is a mass-mailing worm W32.Rants.B@mm.
Windows32.exe spreads by Microsoft Outlook, MSN Messenger and the America Online.
Windows32.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\windows32.exe
Adds the value:
"services" = "%System%\windows32.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill windows32.exe process and remove windows32.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\windowsfirewall.exe

WindowsFirewall.exe is a mass-mailing worm Win32.Mytob.
WindowsFirewall.exe opens a back door on IRC channels.
WindowsFirewall.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\WindowsFirewall.exe
More info: http://www.viruslist.com/en/viruses/ency...
Removal:
Kill the process WindowsFirewall.exe and remove WindowsFirewall.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\windowsfw.exe

windowsfw.exe is Trojan/Backdoor.
Kill the process windowsfw.exe and remove windowsfw.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\windowsp.exe

windowsp.exe is a Trojan W32.Rbot-AXI.
windowsp.exe opens a back door on IRC channels.
windowsp.exe spreads via open network shares.
Related files:
%System%\windowsp.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill windowsp.exe process and remove windowsp.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\windowssp2.exe

WindowsSP2.exe is a worm W32.Sdbot-TQ.
WindowsSP2.exe opens a back door on IRC channels.
WindowsSP2.exe spreads via open network shares.
WindowsSP2.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\WindowsSP2.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill svthx.exe process and remove svthx.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\windowsx.exe

windowsx.exe is a Trojan.Banker-SX.
windowsx.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\windowsx.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill windowsx.exe process and remove windowsx.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\windrvrs32.exe

windrvrs32.exe is a Trojan W32.Tilebot-AG.
windrvrs32.exe opens a back door on IRC channels.
windrvrs32.exe spreads via open network shares.
Related files:
%Windows%\windrvrs32.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill windrvrs32.exe process and remove windrvrs32.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\windsns.exe

Windsns.exe is a mass-mailing worm W32.Mytob.EY@mm.
Windsns.exe tries to terminate antiviral programs installed on a user computer.
Windsns.exe opens a back door on TCP port 6667.
Related files:
%System%\windsns.exe
Adds the value:
"WINDOWS SYSTEM Dns" = "windsns.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill windsns.exe process and remove windsns.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\windspl.exe

windspl.exe is a mass-mailing worm W32.Beagle.DN@mm.
windspl.exe opens a back door on on TCP port 6777.
windspl.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\windspl.exe
%System%\windspl.exeopen
%System%\windspl.exeopenopen
%Windir%\regisp32.exe
Adds the value:
"DsplObjects" = "%System%\windspl.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill the process windspl.exe and remove windspl.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\windump.exe

Windump.exe is a Spyware.EliteKeylogger.
Windump.exe logs key strokes.
Related files:
%UserProfile%\Desktop\ek_setup.exe
%System%\drivers\tdiip.sys
%System%\drivers\usbkbd.sys
%System%\mciole.dll
%System%\windump.exe
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill windump.exe process and remove windump.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\winet.dll

Winet.dll is a Trojan.QQPass-I.
Winet.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Windows%\winset.exe
%System%\winet.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove winet.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\winet.exe

winet.exe is a worm W32.Rbot-APV.
winet.exe opens a back door.
winet.exe spreads via open network shares.
winet.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\winet.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill winet.exe process and remove winet.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\winewtpas.dll

winewtpas.dll is a Trojan.Lineage-PO.
winewtpas.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\winewtpas.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove winewtpas.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\winexplore.exe

WinExplore.exe is a Adware.Getup.B.
WinExplore.exe is a Browser Helper Object.
WinExplore.exe displays advertisements.
Related files:
%System%\AANTX.DLL
%System%\WinExplore.exe
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill WinExplore.exe process and remove WinExplore.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\wingmt32.exe

wingmt32.exe is a mass-mailing worm W32/Mytob-EN.
wingmt32.exe opens a back door on IRC channels.
wingmt32.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\wingmt32.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill the process wingmt32.exe and remove wingmt32.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\wingo.exe

W32.Beagle worm.

1. Creates one of the following files:
%System%\wingo.exe
%System%\wingo.exeopen
%System%\wingo.exeopenopen
2. Adds the value:
"wingo" = "%System%\wingo.exe"
to registry Run keys.
3. Terminates antiviral software.
4. Opens backdoors on TCP port 81.
5. Sends e-mails using address book.

Remove it using RegRun Startup Optimizer.

%sysdir%\winguis.dll

winguis.dll is rootkit Trojan. Oscor-B.
winguis.dll is used to hide files, processes and registry.
winguis.dll is a user mode rootkit.
Rootkit contacts remote hacker server using HTTP session.
Rootkit injects itself in to all running processes.
Rootkit hooking the following Windows APIs:
Kernel32.dll FindFirstFileW
FindNextFileW
Module32NewW
Psapi.dll EnumProcessModules
GetModuleFileNameW
Advapi32.dll EnumServicesStatusA
EnumServicesStatusW
RegEnumKeyA
RegEnumKeyExA
RegEnumKeyExW
RegEnumKeyW
RegEnumValueA
RegEnumValueExA
RegEnumValueExW
RegEnumValueW
RegQueryValueExA
RegQueryValueExW
RegSetValueExA
RegSetValueExW
Related files:
%SysDir%\drivers\DetPort.sys
%SysDir%\drivers\IsPubDrv.sys
%SysDir%\drivers\RvdPort.sys
%SysDir%\winguis.dll
%Temp%\20060424.bak
Added to registry:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
AppInit_DLLs
%SysDir%\WINGUIS.DLL
More info: http://www.sophos.com/security/analyses/...

%sysdir%\wingv32.exe

%SysDir%\wingv32.exe is Trojan/Backdoor.
Kill the process %SysDir%\wingv32.exe and remove %SysDir%\wingv32.exe from Windows startup.

%sysdir%\winhcek32.exe

%sysdir%\winin.exe

winin.exe is a worm W32.Rbot-ARR.
winin.exe opens a back door on IRC channels.
winin.exe spreads via open network shares.
winin.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\winin.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill winin.exe process and remove winin.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\wininet.exe

%sysdir%\wininit.exe

%SysDir%\wininit.exe is Backdoor.Wollf.16.
Backdoor.Wollf.16 is a Backdoor Trojan Horse that installs itself as a server and allows unauthorized access to an infected computer. This Trojan is written in Microsoft Visual C++.
Read more: http://www.symantec.com/security_respons...
Kill the process %SysDir%\wininit.exe and remove %SysDir%\wininit.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com
NOTE. Please, be caureful! %WinDir%\Wininit.exe is legitimate Microsoft file in Windows 9x/Me.

%sysdir%\winint.exe

Winint.exe is a Trojan W32.Sdbot-ADA.
Winint.exe opens a back door.
Winint.exe spreads via open network shares.
Winint.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\winint.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill winint.exe process and remove winint.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\wininv.dll

wininv.dll is a Trojan.Prorat-R.
wininv.dll opens a back door.
Related files:
%Windows%\services.exe
%System%\sservice.exe
%System%\fservice.exe
%Windows%\ktd32.atm
%System%\wininv.dll
%System%\winkey.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove wininv.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\winiogom.exe

winIogom.exe is a Trojan.Bancban-ML.
winIogom.exe monitors user Internet activity and bank information.
It sends stolen data to a hacker site.
Related files:
%System%\winIogom.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill winIogom.exe process and remove winIogom.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\winjava.exe

winjava.exe is a worm W32.Agobot-TU.
winjava.exe opens a back door on IRC channels.
winjava.exe spreads via open network shares.
Related files:
%System%\winjava.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill winjava.exe process and remove winjava.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\winjjq32.dll

%SysDir%\WINJJQ32.DLL is Trojan/Backdoor.
Remove WINJJQ32.DLL using RegRun "Scan for Viruses" feature.
http://www.regrun.com

%sysdir%\winjvd32.dll

%SysDir%\WINJVD32.DLL is Trojan/Backdoor.
Remove mszsrn32.dll using RegRun "Scan for Viruses" feature.
http://www.regrun.com

%sysdir%\winkeam.exe

%SysDir%\Winkeam.exe is Trojan/Backdoor.
Kill the process %SysDir%\Winkeam.exe and remove %SysDir%\Winkeam.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\winkey.dll

winkey.dll is a Trojan.Prorat-R.
winkey.dll opens a back door.
Related files:
%Windows%\services.exe
%System%\sservice.exe
%System%\fservice.exe
%Windows%\ktd32.atm
%System%\wininv.dll
%System%\winkey.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove winkey.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\winkut.exe

%SysDir%\Winkut.exe is Trojan/Backdoor.
Kill the process %SysDir%\Winkut.exe and remove %SysDir%\Winkut.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\winkwgz.exe

%SysDir%\Winkwgz.exe is Trojan/Backdoor.
Kill the process %SysDir%\Winkwgz.exe and remove %SysDir%\Winkwgz.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\winl32xe.exe

winl32xe.exe is a Trojan W32.Rbot-AQO.
winl32xe.exe opens a back door on IRC channels.
winl32xe.exe spreads via open network shares.
Related files:
%System%\winl32xe.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill winl32xe.exe process and remove winl32xe.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\winldr.exe

winldr.exe is a mass-mailing worm W32.Magflag.A@mm.
winldr.exe spreads via open network shares.
winldr.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\winldr.exe
Adds the value:
"Shell" = "Explorer.exe winldr.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill winldr.exe process and remove winldr.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\winligon.exe

Winligon.exe is a mass-mailing worm W32.Mytob.EP@mm.
Winligon.exe tries to terminate antiviral programs installed on a user computer.
Winligon.exe opens a back door on TCP port 5232.
Related files:
%System%\winligon.exe
Adds the value:
"WINDOWS SYSTEM" = "winligon.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill winligon.exe process and remove winligon.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\winlite.exe

WINLITE.EXE is a worm W32.Rbot-AAN.
WINLITE.EXE opens a back door on IRC channels.
WINLITE.EXE spreads via open network shares.
WINLITE.EXE tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\WINLITE.EXE
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill WINLITE.EXE process and remove WINLITE.EXE from Windows startup using RegRun Startup Optimizer.

%sysdir%\winload.exe

WinLoad.exe is a Spyware.PCTattletale.
WinLoad.exe logs keystrokes.
WinLoad.exe monitors user Internet activity.
Related files:
%ProgramFiles%\Common Files\InstallShield\Driver\7\Intel 32\IDriver.exe
%ProgramFiles%\Common Files\InstallShield\Driver\7\Intel 32\IScript7.dll
%ProgramFiles%\Common Files\InstallShield\Driver\7\Intel 32\ISRT.dll
%ProgramFiles%\Common Files\InstallShield\Driver\7\Intel 32\IUser7.dll
%ProgramFiles%\Common Files\InstallShield\Driver\7\Intel 32\objps7.dll
%ProgramFiles%\Common Files\InstallShield\Driver\7\Intel 32\_ISRES1033.dll
%System%\explorer32\AutoUpdate.dll
%System%\explorer32\AutoUpdateClient.exe
%System%\explorer32\chattext.dll
%System%\explorer32\msn6mngr.exe
%System%\explorer32\Netlogon.exe
%System%\explorer32\Wincmd.exe
%System%\explorer32\WinSysMngr.exe
%System%\MSN32.dll
%System%\PCTT.exe
%System%\UninstallPCTT.exe
%System%\Unzip32.dll
%System%\WinLoad.exe
%System%\zip32.dll
Adds the value:
"(default)" = ""
"WinLoad" = "%System%\Winload.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill WinLoad.exe process and remove WinLoad.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\winlog.dll

winlog.dll is a Trojan.BagleDl-AQ.
winlog.dll tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\winlog.exe
%System%\winlog.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove winlog.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\winlogi.exe

winlogi.exe is a worm W32.Alcra-E.
winlogi.exe opens a back door.
Related files:
%Program Files%\MsMovies\MsMovies.exe
%Program Files%\MsMovies\p.zip
%System%\winlogi.exe
%System%\cmd.com
%System%\netstat.com
%System%\ping.com
%System%\regedit.com
%System%\taskkill.com
%System%\tasklist.com
%System%\tracert.com
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill winlogi.exe process and remove winlogi.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\winlogo.exe

Winlogo.EXE is a Trojan.GrayBir-CQ.
Winlogo.EXE opens a back door.
Related files:
%System%\Winlogo.EXE
%System%\Deleteme.bat
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill Winlogo.EXE process and remove Winlogo.EXE from Windows startup using RegRun Startup Optimizer.

%sysdir%\winlogon64.exe

winlogon64.exe is a worm W32.Amirecivel.B.
winlogon64.exe spreads via open network shares.
winlogon64.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\AVG.exe
%System%\servise64.exe
%System%\winlogon64.exe
%System%\lssass.exe
%System%\civil.exe
Adds the value:
"amircivil" = "%System%[FILE NAME].exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill the process winlogon64.exe and remove winlogon64.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\winlow.sys

winlow.sys is rootkit Trojan.Haxdoor-AF.
winlow.sys is used to hide files, processes and registry.
winlow.sys is a kernel mode rootkit.
Rootkit contacts remote hacker server using HTTP session.
winlow.sys tries to terminate antiviral programs installed on a user computer.

winlow.sys created new system drivers:
service name: "winlow"
display name: "SCNDmem"
Adds the value:
HKLM\SYSTEM\CurrentControlSet\Services\winlow\
to the Windows startup registry keys.

vdmt16.sys created new system drivers:
service name: "vdmt16"
display name: "VIRTwin"
Added to registry:
HKLM\SYSTEM\CurrentControlSet\Services\vdmt16\

Related files:
%SysDir%\cz.dll
%SysDir%\drct16.dll
%SysDir%\hz.sys
%SysDir%\p2.in
%SysDir%\vdmt16.sys
%SysDir%\winlow.sys
%SysDir%\wz.sys

Adds the value:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\drct16
DllName
drct16.dll

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\drct16
Startup
MeMessager

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\drct16
Impersonate
1
to the Windows startup registry keys.

More info: http://www.sophos.com/virusinfo/analyses...

%sysdir%\winm32.dll

%SysDir%\winm32.dll is Trojan/Backdoor Haxdoor.
Kill the file %SysDir%\winm32.dll and remove %SysDir%\winm32.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com
Related files:
%Temp%\temp.exe
%SysDir%\config\ssl
%SysDir%\klo5.sys
%SysDir%\klogini.dll
%SysDir%\p3.ini
%SysDir%\ps.a3d
%SysDir%\qy.sys
%SysDir%\qz.dll
<System>\qz.sys
%SysDir%\vinm32.dll
%SysDir%\vinm32.sys
%SysDir%\vinm64.sys
%SysDir%\winm32.dll
%SysDir%\winm32.sys
%SysDir%\winm64.sys
Read more:
http://www.sophos.com/virusinfo/analyses...

%sysdir%\winm32.sys

winm32.sys is rootkit Trojan.Haxdoor-CH.
winm32.sys is used to hide files, processes and registry.
winm32.sys is a kernel mode rootkit.
Rootkit contacts remote hacker server using HTTP session.
winm32.sys tries to terminate antiviral programs installed on a user computer.
Related files:
%SysDir%\klogini.dll
%SysDir%\p3.ini
%SysDir%\qy.sys
%SysDir%\qz.dll
%SysDir%\qz.sys
%SysDir%\winm32.dll
%SysDir%\winm32.sys
%SysDir%\winm64.sys

winm32.sys is created new system drivers:
service name: "winm32"
display name: "winm TCP"
Adds the value:
HKLM\SYSTEM\CurrentControlSet\Services\winm32\
to the Windows startup registry keys.

winm64.sys is created new system drivers:
service name: "winm64"
display name: "winm64 TCP"
Added to registry:
HKLM\SYSTEM\CurrentControlSet\Services\winm64\

Adds the value:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\winm32
DllName
winm32.dll

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\winm32
Startup
MemMMView7

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\winm32
Impersonate
1
to the Windows startup registry keys.
More info: http://www.sophos.com/security/analyses/...

%sysdir%\winm64.sys

WINM64.SYS is Spyware/Adware.
Kill the file WINM64.SYS and remove WINM64.SYS from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\win-mang.exe

win-mang.exe is a Trojan W32.Rbot-AFK.
win-mang.exe opens a back door.
win-mang.exe spreads via open network shares.
win-mang.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\itune.exe
%System%\win-mang.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill win-mang.exe process and remove win-mang.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\winmedia.exe

winmedia.exe is a Trojan.Banker-AVX.
winmedia.exe monitors user Internet activity and bank information.
It sends stolen data to a hacker site.
Related files:
%System%\winmedia.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill the process winmedia.exe and remove winmedia.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\winmedia32.exe

winmedia32.exe is a Trojan.Agent-UF.
winmedia32.exe opens a back door.
Related files:
%System%\winmedia32.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill winmedia32.exe process and remove winmedia32.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\winmedl.dll

Winmedl.dll is a Backdoor Trojan.Riler.B.
Winmedl.dll spreads via open network shares.
Related files:
%System%\srchost.exe
%System%\sporder.dll
%System%\winmedl.dll
%System%\WinSSi.exe
%System%\comsrm.dll
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove winmedl.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\winmer.exe

winmer.exe is a Trojan.LegMir-XG.
winmer.exe tries to terminate antiviral programs installed on a user computer.
winmer.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\winmer.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill the process winmer.exe and remove winmer.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\winmgnt_hook.dll

WinMgnt_Hook.DLL is a Trojan.Feutel-AP.
WinMgnt_Hook.DLL opens a back door.
Related files:
%Windows%\WinMgnt.DLL
%Windows%\WinMgntKey.DLL
%Windows%\WinMgnt_Hook.DLL
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove WinMgnt_Hook.DLL from Windows startup using RegRun Startup Optimizer.

%sysdir%\winmgr.exe

winmgr.exe is Trojan/Backdoor.
Kill the process winmgr.exe and remove winmgr.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\winmon.exe

winmon.exe is a mass-mailing worm W32.Mytob.GB@mm.
winmon.exe opens a back door on TCP port 27999.
winmon.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\winmon.exe
Adds the value:
"WINDOWS SYSTEM" = "winmon.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill winmon.exe process and remove winmon.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\winmssg.exe

winmssg.exe is a Trojan W32.Rbot-ATW.
winmssg.exe opens a back door on IRC channels.
winmssg.exe spreads via open network shares.
winmssg.exe tries to terminate antiviral programs installed on a user computer.
winmssg.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\winmssg.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill winmssg.exe process and remove winmssg.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\winmsx.exe

winmsx.exe is a Trojan W32.Rbot-AYG.
winmsx.exe opens a back door on IRC channels.
winmsx.exe spreads via open network shares.
Related files:
%System%\winmsx.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill winmsx.exe process and remove winmsx.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\winmuse.exe

%SysDir%\winmuse.exe is Trojan/Backdoor.
Kill the process winmuse.exe and remove winmuse.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\winmx32.exe

winmx32.EXE is a Trojan W32.Rbot-BFU.
winmx32.EXE opens a back door on IRC channels.
winmx32.EXE spreads via open network shares.
winmx32.EXE tries to terminate antiviral programs installed on a user computer.
winmx32.EXE monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\winmx32.EXE
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill winmx32.EXE process and remove winmx32.EXE from Windows startup using RegRun Startup Optimizer.

%sysdir%\winnnn.dll

winnnn.dll is a Trojan.QQPass-U.
winnnn.dll tries to terminate antiviral programs installed on a user computer.
winnnn.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\runlli32.exe
%System%\winnnn.dll
Removal:
Remove winnnn.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\winntcreate.exe

%sysdir%\winntupdate.exe

WinntUpdate.exe is a Trojan W32.Rbot-BAX.
WinntUpdate.exe opens a back door on IRC channels.
WinntUpdate.exe spreads via open network shares.
Related files:
%System%\WinntUpdate.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill WinntUpdate.exe process and remove WinntUpdate.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\winoie789.exe

WinOIE789.exe is a worm W32.Attech-C.
WinOIE789.exe downloads code from the internet.
WinOIE789.exe spreads via open network shares and by AOL Instant Messenger.
Related files:
%System%\WinOIE789.exe
%System%\WinDash.EXE
%Windows%\FontLoader.exe
%System%\NetMeeting.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill WinOIE789.exe process and remove WinOIE789.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\winowl32.dll

%SysDir%\winowl32.dll is Trojan/Backdoor.
Remove winowl32.dll using RegRun "Scan for Viruses" feature.
http://www.regrun.com

%sysdir%\winpn32.exe

winpn32.exe is a Trojan W32.Agobot-CW.
winpn32.exe opens a back door on IRC channels.
winpn32.exe spreads via open network shares.
Related files:
%System%\winpn32.exe
%System%\diagent.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill winpn32.exe process and remove winpn32.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\winpnp32.exe

Winpnp32.exe is W32.Wallz worm.
Winpnp32.exe uses LSSAS vulnerability:
http://www.microsoft.com/technet/securit...
Creates the service with name Windows 32-bit PnP Driver
Internal name: winpnp32
Creates the following file, which is not malicious:
%Windir%\Debug\dcpromo.log
Winpnp32 scans the local network and infects other computers.
Removal: stop and disable Winpnp32 service.

%sysdir%\winpup.exe

Winpup.exe is an adware program Adware.Winpup.
Winpup.exe downloads and displays advertisements.
Related files:
%System%\pup.exe
%System%\Winpup.exe
%System%\Winpup32.exe
Adds the value:
"[File name]"="%System%\[File name].exe
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill Winpup.exe process and remove Winpup.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\winpup32.exe

Winpup32.exe is an adware program Adware.Winpup.
Winpup32.exe downloads and displays advertisements.
Related files:
%System%\pup.exe
%System%\Winpup.exe
%System%\Winpup32.exe
Adds the value:
"[File name]"="%System%\[File name].exe
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill Winpup32.exe process and remove Winpup32.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\winresw.exe

winresw.exe is a mass-mailing worm W32.Beagle.DO@mm.
winresw.exe opens a back door.
winresw.exe spreads by e-mail and via open network shares.
winresw.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\regmaping.exe
%System%\regmaping.exeopen
%System%\regmaping.exeopenopen
%Windir%\winresw.exe
Adds the value:
"Regmonitor" = "%System%\regmaping.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill the process winresw.exe and remove winresw.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\winrpmsg.dll

winrpmsg.dll is a worm W32.PPdoor-R.
winrpmsg.dll opens a back door.
winrpmsg.dll spreads via open network shares.
Related files:
%System%\arpo412.exe
%System%\mqadonfg.dll
%System%\winrpmsg.dll
%System%\wndfxyfi.dll
%System%\hgakheg.dll
%System%\vjoytl32.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove winrpmsg.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\wins\svchost.exe

%SysDir%\wins\svchost.exe is W32.Sagevo.
Read more: http://www.symantec.com/enterprise/secur...
Kill the process %SysDir%\wins\svchost.exe and remove %SysDir%\wins\svchost.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\wins32.dll

wins32.dll is a Trojan.DownLdr-UP.
wins32.dll downloads code from the internet.
Related files:
%System%\wins32.dll
%System%\winselect.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove wins32.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\winsass.exe

winsass.exe is a Trojan W32.Rbot-AUO.
winsass.exe opens a back door on IRC channels.
winsass.exe spreads via open network shares.
Related files:
%System%\winsass.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill winsass.exe process and remove winsass.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\winscket.dll

winscket.dll is Trojan/Backdoor.
Kill the file winscket.dll and remove winscket.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\winscntrl.exe

winscntrl.exe is Trojan/Backdoor.
Kill the process winscntrl.exe and remove winscntrl.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\winscure.exe

winscure.exe is a worm W32.Rbot-BAF.
winscure.exe opens a back door.
winscure.exe spreads via open network shares.
winscure.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\winscure.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill winscure.exe process and remove winscure.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\winsecurityxp\rk.exe

%SysDir%\winsecurityxp\rk.exe is Trojan/Backdoor.
Kill the process %SysDir%\winsecurityxp\rk.exe and remove %SysDir%\winsecurityxp\rk.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\winselect.exe

winselect.exe is a Trojan.DownLdr-UP.
winselect.exe downloads code from the internet.
Related files:
%System%\wins32.dll
%System%\winselect.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill winselect.exe process and remove winselect.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\winserv.dll

Winserv.dll is a Trojan.Dermon.A.
Winserv.dll tries to terminate antiviral programs installed on a user computer.
Winserv.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\winserver.exe
%System%\winserv.dll
%System%\winserv32.dll
%System%\winserv.ini
%System%\winserv.dat
%System%\perflibs_.dat
Adds the value:
"win32 system server" = "%System%\winserver.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove winserv.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\winserv32.dll

Winserv32.dll is a Trojan.Dermon.A.
Winserv32.dll tries to terminate antiviral programs installed on a user computer.
Winserv32.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\winserver.exe
%System%\winserv.dll
%System%\winserv32.dll
%System%\winserv.ini
%System%\winserv.dat
%System%\perflibs_.dat
Adds the value:
"win32 system server" = "%System%\winserver.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove winserv32.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\winserver.exe

Winserver.exe is a Trojan.Dermon.A.
Winserver.exe tries to terminate antiviral programs installed on a user computer.
Winserver.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\winserver.exe
%System%\winserv.dll
%System%\winserv32.dll
%System%\winserv.ini
%System%\winserv.dat
%System%\perflibs_.dat
Adds the value:
"win32 system server" = "%System%\winserver.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill winserver.exe process and remove winserver.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\winsetup.exe

winsetup.exe is a Trojan.CashGrab-G.
winsetup.exe spreads via open network shares.
Related files:
%System%\svchost.dll
%System%\winsetup.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill winsetup.exe process and remove winsetup.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\winsfc.exe

winsfc.exe is a Trojan W32.Wisfc.
winsfc.exe downloads code from the internet.
Related files:
%System%\winsfc.exe
%Temp%\kb021119.exe
Adds the value:
"winsfc" = "%System%\winsfc.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill winsfc.exe process and remove winsfc.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\winsgr32.exe

WinSGR32.exe is a Trojan W32.Rbot-APU.
WinSGR32.exe opens a back door on IRC channels.
WinSGR32.exe spreads via open network shares.
WinSGR32.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\WinSGR32.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill WinSGR32.exe process and remove WinSGR32.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\winsis32.dll

winsis32.dll is rootkit Trojan.Nebuler-H.
winsis32.dll is used to hide files, processes.
winsis32.dll is a kernel mode rootkit.
Rootkit contacts remote hacker server using HTTP session.
Related files:
%SysDir%\winsis32.dll
Adds the value:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\winsis32
DllName
winsis32.dll

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\winsis32
Impersonate
0

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\winsis32
Startup
EvtStartup
to the Windows startup registry keys.
More info: http://www.sophos.com/security/analyses/...

%sysdir%\winskype.dll

winskype.dll is a Trojan.Brogger-C.
winskype.dll monitors user Internet activity and bank information.
It sends stolen data to a hacker site.
Related files:
%System%\dllonet.dll
%System%\lycky.sdf
%System%\qwerwqr234
%System%\winskype.dll
%System%\winskype.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove winskype.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\winskype.exe

winskype.exe is a Trojan.Brogger-C.
winskype.exe monitors user Internet activity and bank information.
It sends stolen data to a hacker site.
Related files:
%System%\dllonet.dll
%System%\lycky.sdf
%System%\qwerwqr234
%System%\winskype.dll
%System%\winskype.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill winskype.exe process and remove winskype.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\winsook.dll

winsook.dll is a Trojan.QQRob-AO.
winsook.dll records keystrokes.
winsook.dll downloads code from the internet.
Related files:
%System%\tmhk.dll
%System%\wnilogon.exe
%System%\winsook.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove winsook.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\winsp9.exe

winsp9.exe is a Trojan.Dagonit-B.
winsp9.exe opens a back door on random TCP port.
Related files:
%System%\dali.reg
%System%\dalia2.exe
%System%\system.bat
%System%\winsp9.exe
%System%\wpap.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill winsp9.exe process and remove winsp9.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\winspkn.exe

winspkn.exe is a worm W32.Rbot-AYD.
winspkn.exe opens a back door on IRC channels.
winspkn.exe spreads via open network shares.
Related files:
%System%\winspkn.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill winspkn.exe process and remove winspkn.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\winspol.exe

Winspol.exe is a mass-mailing worm W32.Kedebe.D@mm.
Winspol.exe tries to terminate antiviral programs installed on a user computer.
Winspol.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\nbtstat.exe
%System%\usrinit.exe
%System%\user.exe
%System%\winhlp32.exe
%System%\telnet.exe
%System%\locator.exe
%System%\recover.exe
%System%\logman.exe
%System%\dlhost.exe
%System%\logonui.exe
%System%\winspol.exe
%System%\services.exe
%System%\svchost.exe
%System%\lsas.exe
%System%\rundl32.exe
%System%\regedt32.exe
%System%\winlogon.exe
%System%\wuauclt.exe
Adds the value:
"Run" = "[PATH TO %System%\[FILE NAME]]"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill winspol.exe process and remove winspol.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\winspoolwowexec.exe

%SysDir%\winspoolwowexec.exe is Trojan/Backdoor.
Kill the process %SysDir%\winspoolwowexec.exe and remove %SysDir%\winspoolwowexec.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\winsrt.exe

winsrt.exe is a worm W32.Rbot-BFR.
winsrt.exe opens a back door.
winsrt.exe spreads via open network shares.
Related files:
%System%\winsrt.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill winsrt.exe process and remove winsrt.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\winsrv.exe

winsrv.exe is a Trojan.Netsnak-B.
winsrv.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\winsrv.exe
%System%\winsrvhk.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill winsrv.exe process and remove winsrv.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\winsrvhk.dll

winsrvhk.dll is a Trojan.Netsnak-B.
winsrvhk.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\winsrv.exe
%System%\winsrvhk.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove winsrvhk.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\winss.exe

%SysDir%\winss.exe is Trojan/Backdoor.
Kill the process %SysDir%\winss.exe and remove %SysDir%\winss.exe from Windows startup.
http://vil.nai.com/vil/content/Print1004...

%sysdir%\winssh.exe

winssh.exe is a Trojan W32.Rbot-AXC.
winssh.exe opens a back door on IRC channels.
winssh.exe spreads via open network shares.
winssh.exe tries to terminate antiviral programs installed on a user computer.
winssh.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\winssh.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill winssh.exe process and remove winssh.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\winssx.exe

winssx.exe is a Trojan W32.Rbot-ARW.
winssx.exe opens a back door on IRC channels.
winssx.exe spreads via open network shares.
winssx.exe tries to terminate antiviral programs installed on a user computer.
winssx.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\winssx.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill winssx.exe process and remove winssx.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\winstyle2.dll

Winstyle2.dll is a Trojan.Stwoyle.
Winstyle2.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\winstyle2.dll
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove winstyle2.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\winsv.exe

winsv.exe is a worm W32.Rbot-AUQ.
winsv.exe opens a back door on IRC channels.
winsv.exe spreads via open network shares.
Related files:
%System%\winsv.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill winsv.exe process and remove winsv.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\winsvc.exe

winsvc.exe is a mass-mailing worm W32.Mytob.KR@mm.
winsvc.exe opens a back door on TCP port 43287.
winsvc.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\winsvc.exe
Adds the value:
"WINDOWS SVC" = "winsvc.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill winsvc.exe process and remove winsvc.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\winsvc\svc\google.exe

%SysDir%\winsvc\svc\google.exe is Downloader.Goobiz.
Downloader.Goobiz is a Trojan horse that downloads potentially malicious files on to the compromised computer and may be used to access premium-rate services.
Related files:
%System%\winsvc\svc\google.exe
C:\Documents and Settings\Administrator\Desktop\Explorer.lnk
C:\Documents and Settings\Administrator\Start Menu\Internet.lnk
Read more: http://www.symantec.com/enterprise/secur...
Kill the process %SysDir%\winsvc\svc\google.exe and remove %SysDir%\winsvc\svc\google.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\winsvc32.exe

Winsvc32.exe is a mass-mailing worm W32.Mytob.HH@mm.
Winsvc32.exe opens a back door on TCP port 26418 and 5000.
Winsvc32.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\winsvc32.exe
Adds the value:
"WINDOWS SYSTEM" = "winsvc32.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill winsvc32.exe process and remove winsvc32.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\winsyei.dll

winsyei.dll is a Trojan.QQPass-AO.
winsyei.dll tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\ravseteyi.exe
%System%\temp.jpg
%System%\winsyei.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove winsyei.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\winsys32.exe

winsys32.exe is a Trojan W32.Sdbot-AHS.
winsys32.exe opens a back door on IRC channels.
winsys32.exe spreads via open network shares.
Related files:
%System%\winsys32.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill winsys32.exe process and remove winsys32.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\winsys33.exe

Winsys33.exe is a mass-mailing worm W32.Mytob.EK@mm.
Winsys33.exe opens a back door on IRC channal.
Winsys33.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\winsys33.exe
Adds the value:
"WINDOWS SYSTEM" = "winsys33.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill winsys33.exe process and remove winsys33.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\winsys64mnger.exe

winsys64mnger.exe is a worm W32.Rbot-BAG.
winsys64mnger.exe opens a back door on IRC channels.
winsys64mnger.exe spreads via open network shares.
Related files:
%System%\winsys64mnger.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill winsys64mnger.exe process and remove winsys64mnger.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\winsystema\freevideo5.exe

%SysDir%\Winsystema\Freevideo5.exe is W32.Annunci.A@mm.
Related files:
%Windir%\$hf_mig$\KB090545\semail.exe
%Windir%\$hf_mig$\KB090545\semail.tpl
%Windir%\$hf_mig$\KB090545\target.dat
Read more: http://www.symantec.com/enterprise/secur...
Kill the process %SysDir%\Winsystema\Freevideo5.exe and remove %SysDir%\Winsystema\Freevideo5.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\winsystems.exe

WinSystems.exe is a Spyware.CMKeyLogger.
WinSystems.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%ProgramFiles%\WINLOGON.exe
%System%\pl.dll
%System%\WinSystems.exe
%System%\WSCpmSet.dll
%System%\WSCpmWCl.dll
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill WinSystems.exe process and remove WinSystems.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\winsysupd.exe

winsysupd.exe is Trojan/Backdoor.
Kill the process winsysupd.exeand remove winsysupd.exefrom Windows startup.

%sysdir%\winsysupd10.exe

winsysupd10.exe is Trojan/Backdoor.
Kill the process winsysupd10.exe and remove winsysupd10.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\winsysupd9.exe

winsysupd9.exe is Trojan/Backdoor.
Kill the process winsysupd9.exe and remove winsysupd9.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\wintbp.exe

Wintbp.exe is a Backdoor W32.Zotob.E.
Wintbp.exe spreads by using the vulnerability in Microsoft Windows Plug and Play Service (Microsoft Security Bulletin MS05-039).
Related files:
%System%\wintbp.exe
Adds the value:
"Wintbp" = "wintbp.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill wintbp.exe process and remove wintbp.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\wintbpx.exe

Wintbpx.exe is a Backdoor W32.Zotob.F.
Wintbpx.exe spreads by using the vulnerability in Microsoft Windows Plug and Play Service (Microsoft Security Bulletin MS05-039).
Related files:
%System%\wintbpx.exe
Adds the value:
"Wintbpx" = "wintbpx.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill wintbpx.exe process and remove wintbpx.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\wintective.dll

Wintective.dll is a Spyware.Wintective.
Wintective.dll logs keystrokes.
Wintective.dll monitors user Internet activity.
Related files:
%ProgramFiles%\wintective\wintective.exe
%System%\VB6STKIT.DLL
%System%\wintective.dll
%Windir%\ST6UNST.EXE
Adds the value:
"wintective" = "%ProgramFiles%\wintective\wintective.exe"
"UninstallString" = "C:\WINDOWS\st6unst.exe -n "C:\Program Files\wintective\ST6UNST.LOG" "
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove wintective.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\wintems.exe

Wintems.exe is a Backdoor Trojan.Mitglieder.Q.
Wintems.exe tries to terminate antiviral programs installed on a user computer.
Wintems.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\wintems.exe
%System%\for?exe
%System%\noat.exe
%System%\ban_list.txt
Adds the value:
"ssgrate.exe" = "%System%\wintems.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill wintems.exe process and remove wintems.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\wintft.dll

wintft.dll is a Spyware.XpcSpy.
wintft.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%ProgramFiles%\XSoftware\Working\XPCSpyPro.exe
%ProgramFiles%\XSoftware\XPCSpyPro\AppSpy.dll
%ProgramFiles%\XSoftware\XPCSpyPro\IESpy.dll
%ProgramFiles%\XSoftware\XPCSpyPro\KeySpy.dll
%ProgramFiles%\XSoftware\Working\AppMon.dll
%ProgramFiles%\XSoftware\Working\IEMon.dll
%ProgramFiles%\XSoftware\Working\KeyMon.dll
%System%\systemout.exe
%System%\SysDll32.dll
%System%\rx.exe
%System%\wintft.dll
Adds the value:
"System Check" = "Rundll32.exe SysDll32.dll,SystemCheck"
"ImagePath" = "%System%\systemout.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove wintft.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\wintnl.exe

Wintnl.exe is a Backdoor W32.Zotob.K.
Wintnl.exe spreads by using the vulnerability in Microsoft Windows Plug and Play Service (Microsoft Security Bulletin MS05-039).
Related files:
%System%\wintnl.exe
Adds the value:
"wintnl.exe" = "wintnl.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill wintnl.exe process and remove wintnl.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\wintnpx.exe

Wintnpx.exe is a Backdoor W32.Zotob.H.
Wintnpx.exe spreads by using the vulnerability in Microsoft Windows Plug and Play Service (Microsoft Security Bulletin MS05-039).
Related files:
%System%\wintnpx.exe
Adds the value:
"wintnpx.exe" = "wintnpx.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill wintnpx.exe process and remove wintnpx.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\wintt1.dll

wintt1.dll is a Trojan.Lineage-KX.
wintt1.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\wintt1.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove wintt1.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\winudll.exe

winudll.exe is a Trojan.Mitglie-CE.
winudll.exe opens a back door.
winudll.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\winudll.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill winudll.exe process and remove winudll.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\winunits.dll

winunits.dll is a Trojan.Lineage-BN.
winunits.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\winunits.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove winunits.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\winupdate128.exe

winupdate128.exe is a Trojan.Banload-IY.
winupdate128.exe opens a back door.
Related files:
%System%\winupdate128.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill winupdate128.exe process and remove winupdate128.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\winupdatexx.exe

winupdatexx.exe is a Trojan W32.Rbot-BKV.
winupdatexx.exe opens a back door on IRC channels.
winupdatexx.exe spreads via open network shares.
Related files:
%System%\winupdatexx.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill winupdatexx.exe process and remove winupdatexx.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\winupdats.exe

%SysDir%\winupdats.exe is spyware worm W32.Spybot-IS.
Kill the process winupdats.exe and remove winupdats.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\winupdmon.exe

winupdmon.exe is a Trojan W32.Tilebot-AR.
winupdmon.exe opens a back door on IRC channels.
winupdmon.exe spreads via open network shares.
winupdmon.exe tries to terminate antiviral programs installed on a user computer.
winupdmon.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\winupdmon.exe
%System%\rdriv.sys.
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill winupdmon.exe process and remove winupdmon.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\winupgrad.exe

winupgrad.exe is a Trojan.Banload-Y.
winupgrad.exe opens a back door.
Related files:
%System%\winupgrad.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill winupgrad.exe process and remove winupgrad.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\winupl.exe

winupl.exe is a Trojan W32.Rbot-BCQ.
winupl.exe opens a back door on IRC channels.
winupl.exe spreads via open network shares.
winupl.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\winupl.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill winupl.exe process and remove winupl.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\winvex32.dll

winvex32.dll is rootkit Trojan.Nebuler-B.
winvex32.dll is used to hide files, processes and registry.
winvex32.dll is a user mode rootkit.
Rootkit contacts remote hacker server using HTTP session.
Related files:
%Temp%\cli1.bat
%SysDir%\winvex32.dll
Adds the value:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\winvex32
DllName
winvex32.dll

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\winvex32
Impersonate
0

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\winvex32
Startup
EvtStartup
to the Windows startup registry keys.
Added to registry:
HKLM\SOFTWARE\Microsoft\MSSMGR\
More info: http://www.sophos.com/security/analyses/...

%sysdir%\winvnc.exe

Winvnc.exe is a mass-mailing worm W32.Mytob.EU@mm.
Winvnc.exe tries to terminate antiviral programs installed on a user computer.
Winvnc.exe opens a back door on TCP port 27999.
Related files:
%System%\winvnc.exe
Adds the value:
"WINDOWS SYSTEM" = "winvnc.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill winvnc.exe process and remove winvnc.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\winword.exe

winword.exe is a Trojan.Kangenie.
winword.exe spreads via open network shares.
Related files:
%System%\winword.exe
%System%\winlog.dat
%System%\kangen.doc
Adds the value:
"OSA" = "%System%\winword.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill winword.exe process and remove winword.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\winxpro.exe

Winxpro.exe is a mass-mailing worm W32.Mytob.EZ@mm.
Winxpro.exe opens a back door on TCP port 10087.
Winxpro.exe tries to terminate antiviral programs installed on a user computer.
Winxpro.exe spreads by exploiting the Microsoft Windows Local Security Authority Service Remote Buffer Overflow (Microsoft Security Bulletin MS04-011).
Related files:
%System%\winxpro.exe
C:\funny_pic.scr
C:\see_this!!.scr
C:\my_photo2005.scr
C:\hellmsn.exe
Adds the value:
"WINTASKS" = "winxpro.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill winxpro.exe process and remove winxpro.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\winxpser.exe

winxpser.exe is a Trojan W32.Rbot-BDF.
winxpser.exe opens a back door.
winxpser.exe spreads via open network shares.
Related files:
%System%\winxpser.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill winxpser.exe process and remove winxpser.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\winxpsp2.exe

Winxpsp2.exe is Trojan/Backdoor.
Kill the process %SysDir%\winxpsp2.exe and remove %SysDir%\winxpsp2.exe from Windows startup.

%sysdir%\winyvo32.dll

winyvo32.dll is a Trojan.Bckdr-GIR.
winyvo32.dll opens a back door.
Related files:
%System%\AdService.bat
%System%\AdService.dll
%System%\winyvo32.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove winyvo32.dll using RegRun "Scan for Viruses" feature.
http://www.regrun.com

%sysdir%\winz0r.exe

%SysDir%\winz0r.exe is Trojan/Backdoor.
Kill the process winz0r.exe and remove winz0r.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\winzbp.exe

winzbp.exe is a Trojan W32.Rbot-AWZ.
winzbp.exe opens a back door.
winzbp.exe spreads via open network shares.
winzbp.exe tries to terminate antiviral programs installed on a user computer.
winzbp.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\winzbp.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill winzbp.exe process and remove winzbp.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\winzep.exe

winzep.exe is a Trojan W32.Agobot-TZ.
winzep.exe opens a back door on IRC channels.
winzep.exe spreads via open network shares.
Related files:
%System%\winzep.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill winzep.exe process and remove winzep.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\winzip.exe

%SysDir%\Winzip.exe is Trojan/Backdoor Nyxem.
Kill the process %SysDir%\Winzip.exe and remove %SysDir%\Winzip.exe from Windows startup.
Related files:
- %Windows%\rundll16.exe
- %System%\scanregw.exe
- %System%\Update.exe
- %System%\Winzip.exe
http://www.f-secure.com/v-descs/nyxem_e....

%sysdir%\winzip_tmp.exe

WinZip_Tmp.exe is a mass-mailing worm W32/Nyxem-D.
WinZip_Tmp.exe deletes files off the computer.
WinZip_Tmp.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%Windows%\Rundll16.exe
%System%\scanregw.exe /scan
%System%\Winzip.exe
%System%\Update.exe
%System%\WinZip_Tmp.exe
%System%\New WinZip File.exe
%System%\movies.exe
%System%\Zipped Files.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill the process WinZip_Tmp.exe and remove WinZip_Tmp.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\winzsq.exe

winzsq.exe is a Trojan.Stinx-G.
winzsq.exe opens a back door on IRC channels.
Related files:
%System%\winzsq.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill winzsq.exe process and remove winzsq.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\wiper.exe

wiper.exe is a TrojanProxyser-M.
wiper.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\wiper.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill wiper.exe process and remove wiper.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\wisp.exe

wisp.exe is a Trojan W32.Rbot-ASE .
wisp.exe opens a back door on IRC channels.
wisp.exe spreads via open network shares.
Related files:
%System%\wisp.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill wisp.exe process and remove wisp.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\wisvcc.exe

wisvcc.exe is a Trojan.Orse-G.
wisvcc.exe opens a back door.
Related files:
%System%\wisvcc.exe
%System%\zlbw.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill wisvcc.exe process and remove wisvcc.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\wksssv.exe

wksssv.exe is a Trojan W32.Tibick-B.
wksssv.exe opens a back door on IRC channels.
wksssv.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\wksssv.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill wksssv.exe process and remove wksssv.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\wldr.dll

%sysdir%\wlmsngr.exe

wlmsngr.exe is a worm W32.Rbot-BKL.
wlmsngr.exe opens a back door on IRC channels.
wlmsngr.exe spreads via open network shares.
wlmsngr.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\wlmsngr.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill wlmsngr.exe process and remove wlmsngr.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\wmdrtc32.dll

wmdrtc32.dll is rootkit W32.Sality.X.
wmdrtc32.dll is used to hide files, processes and registry.
wmdrtc32.dll is a kernel mode rootkit.
Rootkit injects itself into the all running process.
Rootkit contacts remote hacker server using HTTP session.

Added lines to the file %Windir%\System.ini:
[MCIDRV_VER]
DEVICEN1=[RANDOM_NUMBER]

Related files:
%SysDir%\wmdrtc32.dll
%SysDir%\wmdrtc32.dl_
%SysDir%\drivers\[RANDOM].sys
More info: http://www.symantec.com/enterprise/secur...

%sysdir%\wmedia32.exe

wmedia32.exe is rootkit Trojan.BankSnif-K.
wmedia32.exe is used to hide files, processes and registry.
wmedia32.exe is a user mode rootkit.
wmedia32.exe monitors user Internet activity and bank information.
It sends stolen data to a hacker site.
Related files:
%SysDir%\wmedia32.exe
More info: http://www.sophos.com/security/analyses/...

%sysdir%\wmiapi.exe

wmiapi.exe is a Backdoor W32.Spybot.RBY.
wmiapi.exe spreads via open network shares.
wmiapi.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\wmiapi.exe
%Temp%\1.reg
C:\a.bat
Adds the value:
"WMI Application Interface" = "wmiapi.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill wmiapi.exe process and remove wmiapi.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\wmimgr.exe

Wmimgr.exe is worm W32.Qdens.A.
Wmimgr.exe spreads through QQ Messenger.
Wmimgr.exe tries to terminate antiviral programs installed on a user computer.
Wmimgr.exe downloads a copy of Backdoor.Powerspider.
Related files:
%Windir%\DHelp.dll
%System%\DHelp.dll
%System%\wmimgr.exe
%System%\wbem\DHelp.dll
Adds the value:
"Windows Management Instrumentation" = "%System%\wmimgr.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill wmimgr.exe process and remove wmimgr.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\wmiprvi.dll

wmiprvi.dll is a Trojan.Mutech-C.
wmiprvi.dll downloads code from the internet.
Related files:
%System%\perfont.exe
%System%\drivers\netpt.sys
%System%\wbem\wmiprvi.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove wmiprvi.dll using RegRun "Scan for Viruses" feature.

%sysdir%\wmisg.exe

Wmisg.exe is a mass-mailing worm W32.Mytob.ES@mm.
Wmisg.exe tries to terminate antiviral programs installed on a user computer.
Wmisg.exe opens a back door.
Related files:
%System%\wmisg.exe
Adds the value:
"SYSTEM MESSAGER" = "wmisg.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill wmisg.exe process and remove wmisg.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\wmp.exe

%SysDir%\wmp.exe is TSPY_SKPE.A.
Read more: http://it.trendmicro-europe.com/enterpri...
Kill the process %SysDir%\wmp.exe and remove %SysDir%\wmp.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\wmpdrm.dll

WMPDRM.DLL is Trojan/Backdoor.
Remove WMPDRM.DLL using RegRun "Scan for Viruses" feature.
http://www.regrun.com

%sysdir%\wndfxyfi.dll

wndfxyfi.dll is a worm W32.PPdoor-R.
wndfxyfi.dll opens a back door.
wndfxyfi.dll spreads via open network shares.
Related files:
%System%\arpo412.exe
%System%\mqadonfg.dll
%System%\winrpmsg.dll
%System%\wndfxyfi.dll
%System%\hgakheg.dll
%System%\vjoytl32.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove wndfxyfi.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\wndl.exe

WnDl.exe is a Spyware.InTheKnow.
WnDl.exe detects keystrokes.
Related files:
%System%\WnDl.exe
%System%\MsW54.exe
Hooks32.exe
ITKDLL.dll
ITK.exe
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill WnDl.exe process and remove WnDl.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\wnuserv.exe

%SysDir%\wnuserv.exe is W32.Spybot.ANDM.
Related files:
%System%\wnuserv.exe
%System%\ctfmom.exe
%System%\napi32.exe
%System%\soundman.exe
Read more: http://www.symantec.com/enterprise/secur...
Kill the process %SysDir%\wnuserv.exe and remove %SysDir%\wnuserv.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\woaisaomm.exe

woaisaomm.exe is a Trojan.GrayBrd-AQ.
woaisaomm.exe opens a back door.
Related files:
%System%\woaisaomm.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill woaisaomm.exe process and remove woaisaomm.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\wookckse.exe

Wookckse.exe is Trojan/Backdoor.
Remove it from startup.
If you are not sure, please, use RegRun:
http://www.greatis.com/security/
or
Ask Computer Guys service:
http://www.greatis.com/security/askguys....

%sysdir%\wpa.exe

wpa.exe is a Backdoor W32.Esbot.B.
wpa.exe spreads by using the vulnerability in Microsoft Windows Plug and Play Service (Microsoft Security Bulletin MS05-039).
Related files:
%System%\wpa.exe
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill wpa.exe process and remove wpa.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\wpabaln32.exe

wpabaln32.exe is a Trojan.Bancos-XE.
wpabaln32.exe monitors user Internet activity and bank information.
It sends stolen data to a hacker site.
Related files:
%System%\wpabaln32.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill the process wpabaln32.exe and remove wpabaln32.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\wpwdmgr.exe

wpwdmgr.exe is a worm W32.Rbot-AUT.
wpwdmgr.exe opens a back door on IRC channels.
wpwdmgr.exe spreads via open network shares.
wpwdmgr.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\wpwdmgr.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill wpwdmgr.exe process and remove wpwdmgr.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\wrmana32.exe

Wrmana32.exe is a mass-mailing worm W32.Mytob.IM@mm.
Wrmana32.exe spreads by exploiting the Microsoft Windows Local Security Authority Service Remote Buffer Overflow (Microsoft Security Bulletin MS04-011).
Related files:
%System%\wrmana32.exe
Adds the value:
"Windows NetDDe" = "wrmana32.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill wrmana32.exe process and remove wrmana32.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\ws3lib.exe

ws3lib.exe is a worm W32.Secefa.A.
ws3lib.exe opens a back door.
ws3lib.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\msdef.exe
%System%\services.exe
%System%\ws3lib.exe
%Windir%\dodrrr.exe
%System%\qwe.bat
%System%\ftp.scr
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill ws3lib.exe process and remove ws3lib.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\wsa32.dll

WSA32.DLL is a Spyware.BEverywhere.B.
WSA32.DLL monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\WSA32.EXE
%System%\BEWLDR32.EXE
%System%\WSA32.DLL
%System%\Wsa32\BEWREP.EXE
%System%\Wsa32\RMBEW.EXE
%System%\Wsa32\BECONFIG.EXE
Adds the value:
"SysWsa32" = "%System%\WSA32.EXE"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove WSA32.DLL from Windows startup using RegRun Startup Optimizer.

%sysdir%\wsa32.exe

WSA32.EXE is a Spyware.BEverywhere.B.
WSA32.EXE monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\WSA32.EXE
%System%\BEWLDR32.EXE
%System%\WSA32.DLL
%System%\Wsa32\BEWREP.EXE
%System%\Wsa32\RMBEW.EXE
%System%\Wsa32\BECONFIG.EXE
Adds the value:
"SysWsa32" = "%System%\WSA32.EXE"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill WSA32.EXE process and remove WSA32.EXE from Windows startup using RegRun Startup Optimizer.

%sysdir%\wsa32\beconfig.exe

BECONFIG.EXE is a Spyware.BEverywhere.B.
BECONFIG.EXE monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\WSA32.EXE
%System%\BEWLDR32.EXE
%System%\WSA32.DLL
%System%\Wsa32\BEWREP.EXE
%System%\Wsa32\RMBEW.EXE
%System%\Wsa32\BECONFIG.EXE
Adds the value:
"SysWsa32" = "%System%\WSA32.EXE"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill BECONFIG.EXE process and remove BECONFIG.EXE from Windows startup using RegRun Startup Optimizer.

%sysdir%\wsa32\bewrep.exe

BEWREP.EXE is a Spyware.BEverywhere.B.
BEWREP.EXE monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\WSA32.EXE
%System%\BEWLDR32.EXE
%System%\WSA32.DLL
%System%\Wsa32\BEWREP.EXE
%System%\Wsa32\RMBEW.EXE
%System%\Wsa32\BECONFIG.EXE
Adds the value:
"SysWsa32" = "%System%\WSA32.EXE"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill BEWREP.EXE process and remove BEWREP.EXE from Windows startup using RegRun Startup Optimizer.

%sysdir%\wsa32\rmbew.exe

RMBEW.EXE is a Spyware.BEverywhere.B.
RMBEW.EXE monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\WSA32.EXE
%System%\BEWLDR32.EXE
%System%\WSA32.DLL
%System%\Wsa32\BEWREP.EXE
%System%\Wsa32\RMBEW.EXE
%System%\Wsa32\BECONFIG.EXE
Adds the value:
"SysWsa32" = "%System%\WSA32.EXE"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill RMBEW.EXE process and remove RMBEW.EXE from Windows startup using RegRun Startup Optimizer.

%sysdir%\wscnty.exe

wscnty.exe is a Trojan.LegMir-BE.
wscnty.exe tries to terminate antiviral programs installed on a user computer.
wscnty.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\wscnty.exe
%Windows%\vbarun.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill wscnty.exe process and remove wscnty.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\wscpmset.dll

WSCpmSet.dll is a Spyware.CMKeyLogger.
WSCpmSet.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%ProgramFiles%\WINLOGON.exe
%System%\pl.dll
%System%\WinSystems.exe
%System%\WSCpmSet.dll
%System%\WSCpmWCl.dll
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove WSCpmSet.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\wscpmwcl.dll

WSCpmWCl.dll is a Spyware.CMKeyLogger.
WSCpmWCl.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%ProgramFiles%\WINLOGON.exe
%System%\pl.dll
%System%\WinSystems.exe
%System%\WSCpmSet.dll
%System%\WSCpmWCl.dll
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove WSCpmWCl.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\wskrnl.exe

Wskrnl.exe is a Spyware.ActMon.
Wskrnl.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\drivers\wskrnlc.sys
%System%\acm-manual.chm
%System%\acmcc.exe
%System%\rbwinx1.dll
%System%\wskrnl.exe
%System%\wskrnlb.dll
%System%\wskrnlb.exe
%System%\wskrnlc.dll
%System%\wskrnlc.vxd
%System%\wskrnld.dll
%System%\wskrnle.dll
Adds the value:
"srvprc" = ""%System%\srvprc.exe" -at"
"wskrnl" = ""%System%\wskrnl.exe" -at"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill wskrnl.exe process and remove wskrnl.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\wskrnlb.dll

Wskrnlb.dll is a Spyware.ActMon.
Wskrnlb.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\drivers\wskrnlc.sys
%System%\acm-manual.chm
%System%\acmcc.exe
%System%\rbwinx1.dll
%System%\wskrnl.exe
%System%\wskrnlb.dll
%System%\wskrnlb.exe
%System%\wskrnlc.dll
%System%\wskrnlc.vxd
%System%\wskrnld.dll
%System%\wskrnle.dll
Adds the value:
"srvprc" = ""%System%\srvprc.exe" -at"
"wskrnl" = ""%System%\wskrnl.exe" -at"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove wskrnlb.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\wskrnlb.exe

Wskrnlb.exe is a Spyware.ActMon.
Wskrnlb.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\drivers\wskrnlc.sys
%System%\acm-manual.chm
%System%\acmcc.exe
%System%\rbwinx1.dll
%System%\wskrnl.exe
%System%\wskrnlb.dll
%System%\wskrnlb.exe
%System%\wskrnlc.dll
%System%\wskrnlc.vxd
%System%\wskrnld.dll
%System%\wskrnle.dll
Adds the value:
"srvprc" = ""%System%\srvprc.exe" -at"
"wskrnl" = ""%System%\wskrnl.exe" -at"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill wskrnlb.exe process and remove wskrnlb.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\wskrnlc.dll

Wskrnlc.dll is a Spyware.ActMon.
Wskrnlc.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\drivers\wskrnlc.sys
%System%\acm-manual.chm
%System%\acmcc.exe
%System%\rbwinx1.dll
%System%\wskrnl.exe
%System%\wskrnlb.dll
%System%\wskrnlb.exe
%System%\wskrnlc.dll
%System%\wskrnlc.vxd
%System%\wskrnld.dll
%System%\wskrnle.dll
Adds the value:
"srvprc" = ""%System%\srvprc.exe" -at"
"wskrnl" = ""%System%\wskrnl.exe" -at"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove wskrnlc.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\wskrnld.dll

Wskrnld.dll is a Spyware.ActMon.
Wskrnld.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\drivers\wskrnlc.sys
%System%\acm-manual.chm
%System%\acmcc.exe
%System%\rbwinx1.dll
%System%\wskrnl.exe
%System%\wskrnlb.dll
%System%\wskrnlb.exe
%System%\wskrnlc.dll
%System%\wskrnlc.vxd
%System%\wskrnld.dll
%System%\wskrnle.dll
Adds the value:
"srvprc" = ""%System%\srvprc.exe" -at"
"wskrnl" = ""%System%\wskrnl.exe" -at"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove wskrnld.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\wskrnle.dll

Wskrnle.dll is a Spyware.ActMon.
Wskrnle.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\drivers\wskrnlc.sys
%System%\acm-manual.chm
%System%\acmcc.exe
%System%\rbwinx1.dll
%System%\wskrnl.exe
%System%\wskrnlb.dll
%System%\wskrnlb.exe
%System%\wskrnlc.dll
%System%\wskrnlc.vxd
%System%\wskrnld.dll
%System%\wskrnle.dll
Adds the value:
"srvprc" = ""%System%\srvprc.exe" -at"
"wskrnl" = ""%System%\wskrnl.exe" -at"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove wskrnle.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\wsl21655.dll

wsl21655.dll is a Trojan.RemLoad-B.
wsl21655.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Syste%\checkreg.exe
%System%\iisload.dll
%System%\s32l.txt
%System%\ws386l.ini
%System%\wsl21655.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove wsl21655.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\wsl22764.dll

wsl22764.dll is a Trojan.Danmec-B.
wsl22764.dll opens a back door.
wsl22764.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\checkreg.exe
%System%\iisload.dll
%System%\s32l.txt
%System%\ws386l.ini
%System%\wsl22764.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove wsl22764.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\wsl7421.dll

wsl7421.dll is a Trojan.Danmec-H.
wsl7421.dll opens a back door.
Related files:
%System%\checkreg.exe
%System%\iisload.dll
%System%\s32l.txt
%System%\ws386l.ini
%System%\wsl7421.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove wsl7421.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\wsnfty.exe

wsnfty.exe is a Trojan W32.Rbot-AFU.
wsnfty.exe opens a back door on IRC channels.
wsnfty.exe spreads via open network shares.
wsnfty.exe tries to terminate antiviral programs installed on a user computer.
wsnfty.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\wsnfty.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill wsnfty.exe process and remove wsnfty.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\wsnpoem\audio.dll

%SysDir%\wsnpoem\audio.dll is Infostealer.Monstres.
Infostealer.Monstres is a Trojan horse that may steal sensitive information from the compromised computer and targets Monster.com users when they post data online.
Related files:
%System%\wsnpoem\audio.dll
%System%\wsnpoem\video.dll
Read more: http://www.symantec.com/enterprise/secur...
Kill the file %SysDir%\wsnpoem\audio.dll and remove %SysDir%\wsnpoem\audio.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\wsnpoem\video.dll

%SysDir%\wsnpoem\video.dll is Infostealer.Monstres.
Infostealer.Monstres is a Trojan horse that may steal sensitive information from the compromised computer and targets Monster.com users when they post data online.
Related files:
%System%\wsnpoem\audio.dll
%System%\wsnpoem\video.dll
Read more: http://www.symantec.com/enterprise/secur...
Kill the file %SysDir%\wsnpoem\video.dll and remove %SysDir%\wsnpoem\video.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\wsock32.exe

wsock32.exe is a Trojan.Horst-C.
wsock32.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\hookreg.dll
%System%\ks.dll
%System%\wsock32.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill wsock32.exe process and remove wsock32.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\wstart.dll

Wstart.dll is Trojan/Backdoor.
Remove wstart.dll from BHO list.
http://securityresponse.symantec.com/avc...

%sysdir%\wstask32.exe

wstask32.exe is a mass-mailing worm W32.Mytob-FE.
wstask32.exe opens a back door on IRC channels.
wstask32.exe spreads by e-mail and via open network shares.
Related files:
%System%\wstask32.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill wstask32.exe process and remove wstask32.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\wstime.exe

wstime.exe is a Trojan W32.Rbot-AZA.
wstime.exe spreads via open network shares.
Related files:
%System%\wstime.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill wstime.exe process and remove wstime.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\wsys32.exe

wsys32.exe is a worm W32.Agobot-BX.
wsys32.exe opens a back door on IRC channels.
wsys32.exe spreads via open network shares.
Related files:
%System%\wsys32.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill wsys32.exe process and remove wsys32.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\wtemp32.exe

wtemp32.exe is a Trojan W32.Rbot-AHQ .
wtemp32.exe opens a back door on IRC channels.
wtemp32.exe spreads via open network shares.
wtemp32.exe tries to terminate antiviral programs installed on a user computer.
wtemp32.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\wtemp32.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill wtemp32.exe process and remove wtemp32.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\wuamclt32.exe

%SysDir%\wuamclt32.exe is W32.Spybot.AMUV.
Read more: http://www.symantec.com/enterprise/secur...
Kill the process %SysDir%\wuamclt32.exe and remove %SysDir%\wuamclt32.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\wuamgrb.exe

wuamgrb.exe is a Trojan W32.Rbot-AZE.
wuamgrb.exe opens a back door on IRC channels.
wuamgrb.exe spreads via open network shares.
Related files:
%System%\wuamgrb.exe
%Windows%\Debug\dcpromo.log
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill wuamgrb.exe process and remove wuamgrb.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\wuamkop.exe

wuamkop.exe is a Trojan W32.Rbot-APG.
wuamkop.exe opens a back door on IRC channels.
wuamkop.exe spreads via open network shares.
Related files:
%System%\wuamkop.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill wuamkop.exe process and remove wuamkop.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\wuamkoppnp.exe

wuamkoppnp.exe is a worm W32.Rbot-ANI.
wuamkoppnp.exe opens a back door.
wuamkoppnp.exe spreads via open network shares.
wuamkoppnp.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\wuamkoppnp.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill wuamkoppnp.exe process and remove wuamkoppnp.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\wuaumqr.exe

wuaumqr.exe is a Trojan W32.Spybot-DZ.
wuaumqr.exe opens a back door on IRC channels.
wuaumqr.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\wuaumqr.exe
%System%\kazaabackupfiles\download_me.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill wuaumqr.exe process and remove wuaumqr.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\wucualt.exe

%SysDir%\wucualt.exe is Trojan/Backdoor.
Kill the process %SysDir%\wucualt.exe and remove %SysDir%\wucualt.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\wudates.exe

Wudates.exe is a Trojan W32.Rbot-BBG.
Wudates.exe opens a back door on IRC channels.
Wudates.exe spreads via open network shares.
Related files:
%System%\Wudates.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill Wudates.exe process and remove Wudates.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\wudpcom.exe

wudpcom.exe is a worm W32.Mocbot.A.
wudpcom.exe opens a back door on IRC channels.
Related files:
%System%\wudpcom.exe
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill wudpcom.exe process and remove wudpcom.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\wuinit.exe

wuinit.exe is a Trojan W32.Agobot-UE.
wuinit.exe opens a back door on IRC channels.
wuinit.exe spreads via open network shares.
Related files:
%System%\wuinit.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill wuinit.exe process and remove wuinit.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\wupdates.exe

wupdates.exe is a Trojan W32.Rbot-AUU.
wupdates.exe opens a back door on IRC channels.
wupdates.exe spreads via open network shares.
wupdates.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\wupdates.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill wupdates.exe process and remove wupdates.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\wurmgrd32.exe

wurmgrd32.exe is a Trojan W32.Rbot-ARX .
wurmgrd32.exe opens a back door on IRC channels.
wurmgrd32.exe spreads via open network shares.
Related files:
%System%\wurmgrd32.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill wurmgrd32.exe process and remove wurmgrd32.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\wuuaclt.exe

Wuuaclt.exe is a worm W32.Bratle.B.
Wuuaclt.exe opens a back door on TCP port 4123.
Wuuaclt.exe spread by exploiting the Microsoft Windows LSASS Buffer Overrun Vulnerability (Microsoft Security Bulletin MS04-011).
Related files:
%System%\wuuaclt.exe
Adds the value:
"Windows32" = "%System%\wuuaclt.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill wuuaclt.exe process and remove wuuaclt.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\wxtwdx.dll

wxtwdx.dll is rootkit Trojan.Haxdoor-IJ.
wxtwdx.dll is used to hide files, processes and registry.
wxtwdx.dll is a kernel mode rootkit.
wxtwdx.dll tries to terminate antiviral programs installed on a user computer.
Related files:
%SysDir%\klogini.dll
%SysDir%\qy.sys
%SysDir%\qz.dll
%SysDir%\qz.sys
%SysDir%\wxtwdu.sys
%SysDir%\wxtwdx.dll
%SysDir%\wxtwdx.sys
%SysDir%\xd.bin

wxtwdu.sys is created new system drivers:
service name: "wxtwdu"
display name: "wxtwdu PNP DRIVER"
Added to registry:
HKLM\SYSTEM\CurrentControlSet\Services\wxtwdu\

wxtwdx.sys is created new system drivers:
service name: "wxtwdx"
display name: "wxtw PNP DRIVER"
Added to registry:
HKLM\SYSTEM\CurrentControlSet\Services\wxtwdx\

Adds the value:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wxtwdx
DllName
wxtwdx.dll

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wxtwdx
Startup
RegroupMem

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wxtwdx
Impersonate
1
to the Windows startup registry keys.
More info: http://www.sophos.com/security/analyses/...

%sysdir%\wys.dll

wys.dll is an adware program Adware.WhileUSurf.
wys.dll downloads and displays advertisements.
Related files:
%System%\wys.dll
%System%\wys5.dll
%System%\wys.exe
%System%\printer32.dll
Adds the value:
"Spool" = "%CurrentFolder%\wys.exe /startup"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove wys.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\wys.exe

wys.exe is an adware program Adware.WhileUSurf.
wys.exe downloads and displays advertisements.
Related files:
%System%\wys.dll
%System%\wys5.dll
%System%\wys.exe
%System%\printer32.dll
Adds the value:
"Spool" = "%CurrentFolder%\wys.exe /startup"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill wys.exe process and remove wys.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\wys5.dll

wys5.dll is an adware program Adware.WhileUSurf.
wys5.dll downloads and displays advertisements.
Related files:
%System%\wys.dll
%System%\wys5.dll
%System%\wys.exe
%System%\printer32.dll
Adds the value:
"Spool" = "%CurrentFolder%\wys.exe /startup"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove wys5.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\wztoid.exe

wztoid.exe is a Trojan W32.Rbot-ASD.
wztoid.exe opens a back door on IRC channels.
wztoid.exe spreads via open network shares.
Related files:
%System%\wztoid.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill wztoid.exe process and remove wztoid.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\xcttgs.dll

xcttgs.dll is rootkit Trojan.Haxdoor-DK.
xcttgs.dll is used to hide files, processes and registry.
xcttgs.dll is a kernel mode rootkit.
Rootkit contacts remote hacker server using HTTP session.
xcttgs.dll tries to terminate antiviral programs installed on a user computer.
Related files:
%SysDir%\83ghh.ini
%SysDir%\qz.dll
%SysDir%\qz.sys
%SysDir%\xcttgm.sys
%SysDir%\xcttgs.dll

Adds the value:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\xcttgs
DllName
xcttgs.dll

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\xcttgs
Startup
OPNASRVZSQ

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\xcttgs
Impersonate
1
to the Windows startup registry keys.
More info: http://www.sophos.com/security/analyses/...

%sysdir%\xflash.exe

xflash.exe is a Trojan W32.Yurist-K.
xflash.exe spreads via open network shares.
xflash.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\xflash.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill xflash.exe process and remove xflash.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\xmchai.exe

xmchai.exe is a Trojan.Bifrose-AO.
xmchai.exe opens a back door.
Related files:
%System%\xmchai.exe
%System%\plugin1.dat
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill xmchai.exe process and remove xmchai.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\xmsk32.dll

xmsk32.dll is a Trojan Backdoor.Haxdoor.H.
xmsk32.dll spreads via open network shares.
xmsk32.dll tries to terminate antiviral programs installed on a user computer.
xmsk32.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\xmsk32.dll
%System%\xmsk64.sys
%System%\qz.dll
%System%\qz.sys
Adds the value:
"secureUID" = "[RANDOM NUMBER]"
"secureTIME" = "[DAY:MONTH]"
"DllName" = "xmsk32.dll"
"Startup" = "KeLoadData"
"Impersonate" = "1"
"Asynchronous" = "1"
"MaxWait" = "1"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove xmsk32.dll using RegRun "Scan for Viruses" feature.
http://www.regrun.com

%sysdir%\xmsk64.sys

xmsk64.sys is a Trojan Backdoor.Haxdoor.H.
xmsk64.sys spreads via open network shares.
xmsk64.sys tries to terminate antiviral programs installed on a user computer.
xmsk64.sys monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\xmsk32.dll
%System%\xmsk64.sys
%System%\qz.dll
%System%\qz.sys
Adds the value:
"secureUID" = "[RANDOM NUMBER]"
"secureTIME" = "[DAY:MONTH]"
"DllName" = "xmsk32.dll"
"Startup" = "KeLoadData"
"Impersonate" = "1"
"Asynchronous" = "1"
"MaxWait" = "1"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill the process xmsk64.sys and remove xmsk64.sys from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\xpiupdate.exe

xpiupdate.exe is a Trojan W32.Rbot-AAB.
xpiupdate.exe opens a back door on IRC channels.
xpiupdate.exe spreads via open network shares.
xpiupdate.exe tries to terminate antiviral programs installed on a user computer.
xpiupdate.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\xpiupdate.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill xpiupdate.exe process and remove xpiupdate.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\xploognt.exe

XPLoogNT.exe is a Trojan.Bancd-B.
XPLoogNT.exe monitors user Internet activity and bank information.
It sends stolen data to a hacker site.
Related files:
%System%\XPLoogNT.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill XPLoogNT.exe process and remove XPLoogNT.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\xptpmm.sys

xptpmm.sys is rootkit Trojan.Haxdoor-BN.
xptpmm.sys is used to hide files, processes and registry.
xptpmm.sys is a kernel mode rootkit.
xptpmm.sys tries to terminate antiviral programs installed on a user computer.
Rootkit contacts remote hacker server using HTTP session.
Related files:
%SysDir%\fux87.ini
%SysDir%\klgcptini.dat
%SysDir%\sd.dll
%SysDir%\sd.sys
%SysDir%\xptpmm.sys
%SysDir%\xptptt.dll

xptpmm.sys is created new system drivers:
service name: "xptpmm"
display name: "XPPTP 0x24 winsock"
Added to registry:
HKLM\SYSTEM\CurrentControlSet\Services\xptpmm\

xptpmm.sys is created new system drivers:
service name: "xptptt"
display name: "XPPTP 0x25 winsock"
Added to registry:
HKLM\SYSTEM\CurrentControlSet\Services\xptptt\

Adds the value:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\xptptt
DllName
xptptt.dll

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\xptptt
Startup
MmPageScan

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\xptptt
Impersonate
1
to the Windows startup registry keys.
More info: http://www.sophos.com/security/analyses/...

%sysdir%\xpupdate.exe

xpupdate.exe is a Trojan W32.Zotob-G.
xpupdate.exe opens a back door on IRC channel.
xpupdate.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\xpupdate.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill xpupdate.exe process and remove xpupdate.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\xxvyaj.exe

xxvyaj.exe is an adware program Adware.BetterInternet.
xxvyaj.exe is a Browser Helper Object.
xxvyaj.exe downloads and displays advertisements.
Related files:
%Windir%\Bi.dll
%Windir%\speeryox.dll
%Windir%\Mxtarget.dll
%Windir%\BTGrab.dll
%Windir%\farmmext.exe
%Windir%\dlmax.dll
%Windir%\speer2.dll
%Windir%\VoiceIP.dll
%Windir%\morphacl.dll
%Windir%\Pynix.dll
%Windir%\Biprep.exe
%Windir%\banner.dll
%System%\laziqn.exe
%System%\xxvyaj.exe
%System%\wbtvsffd.exe
%System%\nnmzoq.exe
%Temp%\DrTemp\thnall1b.exe
%Temp%\DrTemp\thnall1p.exe
%Temp%\DrTemp\thnall2r.exe
%Temp%\DrTemp\polall1b.exe
%Temp%\thnall1s.exe
%Temp%\morphrec.exe
Adds the value:
"[File name of adware]" = "[File path to adware]"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill xxvyaj.exe process and remove xxvyaj.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\xxxdefdrv.sys

xxxdefdrv.sys is rootkit Trojan.HacDef-AB.
xxxdefdrv.sys is used to hide files, processes and registry.
xxxdefdrv.sys is a kernel mode rootkit.
xxxdefdrv.sys created new system drivers:
service name: "Microsoft Information Driver"

Related files:
%SysDir%\wdl.exe
%SysDir%\wdl.dll
%SysDir%\xxxdefdrv.sys
%SysDir%\windows.exe
%SysDir%\xmlsvc.exe
%SysDir%\xmldata.dll
%SysDir%\xmlsvc.dll
%SysDir%\.tmp
%SysDir%\rpcsvc.exe
%SysDir%\ioservice.exe
%SysDir%\ioservice.ini
%SysDir%\rpcsvr.exe
%SysDir%\smap.exe
%SysDir%\sv.exe
%SysDir%\diketraffic.conf
%SysDir%\dikeentry.conf
%SysDir%\bitsm.exe
%SysDir%\kern32.dll
%SysDir%\bitsm.exe -start
%SysDir%\iobanana.exe
%SysDir%\ioA.exe

More info: http://www.sophos.com/virusinfo/analyses...

%sysdir%\ydsvga.sys

ydsvga.sys is rootkit Trojan.Haxdoor-CP.
ydsvga.sys is used to hide files, processes and registry.
ydsvga.sys is a kernel mode rootkit.
Rootkit contacts remote hacker server using HTTP session.
ydsvga.sys spreads by e-mail.
ydsvga.sys tries to terminate antiviral programs installed on a user computer.
Related files:
%SysDir%\kgctini.dat
%SysDir%\lps.dat
%SysDir%\qo.dll
%SysDir%\qo.sys
%SysDir%\ycsvga.sys
%SysDir%\yvsvga.dll
%SysDir%\yvsvga.sys
Rootkit creates new system driver:
service name: "ycsvga"
display name: "NDIS OSI"
Added to registry:
HKLM\SYSTEM\CurrentControlSet\Services\ycsvga\
Adds the value:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\yvsvga
DllName
yvsvga.dll

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\yvsvga
Startup
XFD00Safex

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\yvsvga
Impersonate
1
to the Windows startup registry keys.
More info: http://www.sophos.com/security/analyses/...

%sysdir%\ydsvgd.sys

ydsvgd.sys is rootkit Trojan.Haxdoor-DA.
ydsvgd.sys is used to hide files, processes and registry.
ydsvgd.sys is a kernel mode rootkit.
Rootkit contacts remote hacker server using HTTP session.
ydsvgd.sys spreads by e-mail.
ydsvgd.sys tries to terminate antiviral programs installed on a user computer.
Related files:
%SysDir%\kgctini.dat
%SysDir%\lps.dat
%SysDir%\qo.dll
%SysDir%\qo.sys
%SysDir%\ycsvgd.sys
%SysDir%\ydsvgd.dll
%SysDir%\ydsvgd.sys
Adds the value:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ydsvgd
DllName
ydsvgd.dll

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ydsvgd
Startup
XWD33Sifix

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ydsvgd
Impersonate
1
to the Windows startup registry keys.
Added to registry:
HKLM\SYSTEM\CurrentControlSet\Services\ycsvgd\

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ycsvgd.sys

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\ycsvgd.sys
More info: http://www.sophos.com/security/analyses/...

%sysdir%\ygyfrmrh.sys

Ygyfrmrh.sys is rootkit Trojan.Agent-EBK.
Ygyfrmrh.sys is used to hide files, processes and registry.
Ygyfrmrh.sys is a kernel mode rootkit.
Ygyfrmrh.sys monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Rootkit created new system driver.
Related files:
%SysDir%\Ygyfrmrh.d1l
%SysDir%\Ygyfrmrh.dll
%SysDir%\Ygyfrmrh.sys
More info: http://www.sophos.com/virusinfo/analyses...

%sysdir%\yvpp01.dll

yvpp01.dll is a Trojan Backdoor.Haxdoor.I.
yvpp01.dll opens a back door on Random TCP ports.
yvpp01.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\qo.dll
%System%\qo.sys
%System%\yvpp01.dll
%System%\yvpp01.sys
%System%\yvpp02.sys
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove yvpp01.dll using RegRun "Scan for Viruses" feature.
http://www.regrun.com

%sysdir%\yvpp01.sys

yvpp01.sys is rootkit Trojan.Haxdoor-BM.
yvpp01.sys is used to hide files, processes and registry.
yvpp01.sys is a kernel mode rootkit.
Rootkit contacts remote hacker server using HTTP session.
yvpp01.sys tries to terminate antiviral programs installed on a user computer.
Related files:
%SysDir%\kgctini.dat
%SysDir%\lps.dat
%SysDir%\qo.dll
%SysDir%\qo.sys
%SysDir%\yvpp01.dll
%SysDir%\yvpp01.sys
%SysDir%\yvpp02.sys

yvpp01.sys is created new system drivers:
service name: " yvpp01"
display name: "NDIS OSI32"
Adds the value:
HKLM\SYSTEM\CurrentControlSet\Services\yvpp01\
to the Windows startup registry keys.

yvpp02.sys is created new system drivers:
service name: "yvpp02"
display name: "NDIS OSI"
Added to registry:
HKLM\SYSTEM\CurrentControlSet\Services\yvpp02\

Adds the value:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\yvpp01
DllName
yvpp01.dll

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\yvpp01
Startup
CheckKiSDT

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\yvpp01
Impersonate
1
to the Windows startup registry keys.
More info: http://www.sophos.com/security/analyses/...

%sysdir%\yvpp02.sys

yvpp02.sys is a Trojan Backdoor.Haxdoor.I.
yvpp02.sys opens a back door on Random TCP ports.
yvpp02.sys monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\qo.dll
%System%\qo.sys
%System%\yvpp01.dll
%System%\yvpp01.sys
%System%\yvpp02.sys
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill the process yvpp02.sys and remove yvpp02.sys from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\yxgunlzu.dll

Yxgunlzu.dll is a Trojan Backdoor.Darkmoon.
Yxgunlzu.dll monitors user activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\Yxgunlzu.dll
%System%\drivers\Yxgunlzu.sys
%Windir%\@@@\___.exe
%Windir%\@@@\mydll.exe
%Windir%\@@@\win32.exe
%Windir%\win32log.dat
Adds the value:
"ServiceDll" = "%System%\Yxgunlzu.d1l"
"Microsoft" = "%Windir%\@@@\ mydll.exe "
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove Yxgunlzu.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\zcjflmoj.sys

Zcjflmoj.sys is rootkit Trojan.Bckdr-GPJ.
Zcjflmoj.sys is used to hide files, processes and registry.
Zcjflmoj.sys is a kernel mode rootkit.
Zcjflmoj.sys created new system drivers:
service name: "Zcjflmoj"
display name: "Zcjflmoj"
Adds the value:
HKLM\SYSTEM\CurrentControlSet\Services\Zcjflmoj
to the Windows startup registry keys.
Related files:
%SysDir%\Zcjflmoj.dll
%SysDir%\Zcjflmoj.drv
%SysDir%\Zcjflmoj.sys
Adds the value:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Zcjflmoj

to the Windows startup registry keys.
More info: http://www.sophos.com/virusinfo/analyses...

%sysdir%\zhopaizdupla.exe

%SysDir%\zhopaizdupla.exe is Trojan/Backdoor.
Kill the process zhopaizdupla.exe and remove zhopaizdupla.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\zip32.dll

zip32.dll is a Spyware.PCTattletale.
zip32.dll logs keystrokes.
zip32.dll monitors user Internet activity.
Related files:
%ProgramFiles%\Common Files\InstallShield\Driver\7\Intel 32\IDriver.exe
%ProgramFiles%\Common Files\InstallShield\Driver\7\Intel 32\IScript7.dll
%ProgramFiles%\Common Files\InstallShield\Driver\7\Intel 32\ISRT.dll
%ProgramFiles%\Common Files\InstallShield\Driver\7\Intel 32\IUser7.dll
%ProgramFiles%\Common Files\InstallShield\Driver\7\Intel 32\objps7.dll
%ProgramFiles%\Common Files\InstallShield\Driver\7\Intel 32\_ISRES1033.dll
%System%\explorer32\AutoUpdate.dll
%System%\explorer32\AutoUpdateClient.exe
%System%\explorer32\chattext.dll
%System%\explorer32\msn6mngr.exe
%System%\explorer32\Netlogon.exe
%System%\explorer32\Wincmd.exe
%System%\explorer32\WinSysMngr.exe
%System%\MSN32.dll
%System%\PCTT.exe
%System%\UninstallPCTT.exe
%System%\Unzip32.dll
%System%\WinLoad.exe
%System%\zip32.dll
Adds the value:
"(default)" = ""
"WinLoad" = "%System%\Winload.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove zip32.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\zipped files.exe

Zipped Files.exe is a mass-mailing worm W32/Nyxem-D.
Zipped Files.exe deletes files off the computer.
Zipped Files.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%Windows%\Rundll16.exe
%System%\scanregw.exe /scan
%System%\Winzip.exe
%System%\Update.exe
%System%\WinZip_Tmp.exe
%System%\New WinZip File.exe
%System%\movies.exe
%System%\Zipped Files.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill the process Zipped Files.exe and remove Zipped Files.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\zlib.dll

Zlib.dll is a Spyware.KeyKey.
Zlib.dll logs keystrokes and takes screenshots.
Related files:
%ProgramFiles%\KEYKEY\slman.exe
%ProgramFiles%\KEYKEY\slview.exe
%System%\sldrv.dll
%System%\zlib.dll
%System%\loadwin.exe
%ProgramFiles%\KEYKEY\keykey.exe
%ProgramFiles%\KEYKEY\kkmon.exe
%System%\kkdrv.dll
%System%\loadkk.exe
Adds the value:
"SL Loader" = "loadwin.exe"
"KK Loader" = "%System%\loadkk.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove zlib.dll from Windows startup using RegRun Startup Optimizer.

%sysdir%\znksvc32.exe

znksvc32.exe is a Backdoor W32.Agobot-AGI.
znksvc32.exe tries to terminate antiviral programs installed on a user computer.
znksvc32.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\znksvc32.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill znksvc32.exe process and remove znksvc32.exe from Windows startup using RegRun Startup Optimizer.

%sysdir%\zopenssl.dll

zopenssl.dll is a Trojan.Goldun.K with rootkit functions.
zopenssl.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\zopenssl.dll
%System%\zopenssld.sys
Adds the value:
"DllName" = "zopenssl.dll"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove zopenssl.dll using RegRun "Scan for Viruses" feature.
http://www.regrun.com

%sysdir%\zopenssld.sys

zopenssld.sys is rootkit Trojan.Hearse-A.
zopenssld.sys is used to hide files, processes and registry.
zopenssld.sys is a kernel mode rootkit.
Rootkit contacts remote hacker server using HTTP session.
Related files:
%SysDir%\zopenssl.dll
%SysDir%\zopenssld.sys

Adds the value:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\zopenssl
Asynchronous
dword:00000001

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\zopenssl
DllName
zopenssl.dll

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\zopenssl
Impersonate
dword:00000001

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\zopenssl
MaxWait
dword:00000001

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\zopenssl
nk48id
"[88BF38A86A50D1EAA]"

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\zopenssl
Startup
"zopenssl"
to the Windows startup registry keys.
More info: http://www.sophos.com/virusinfo/analyses...

%sysdir%\zsydll.dll

%SysDir%\zsydll.dll is Trojan/Backdoor.
Remove zsydll.dll using RegRun "Scan for Viruses" feature.
http://www.regrun.com

%sysdir%\zsyhide.dll

zsyhide.dll is Trojan/Backdoor.
Remove zsyhide.dll using RegRun "Scan for Viruses" feature.
http://www.regrun.com

%sysdir%\zsys.exe

zsys.exe is a Trojan PWSteal.Rivarts.
zsys.exe opens a back door on Random TCP ports.
zsys.exe tries to terminate antiviral programs installed on a user computer.
zsys.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\zsys.exe
%System%\zsys1.dll
%System%\zsys2.dll
%Windir%\wscntfy.exe
Adds the value:
"Zsys" = "%System%\Zsys.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill the process zsys.exe and remove zsys.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\zsys1.dll

zsys1.dll is a Trojan PWSteal.Rivarts.
zsys1.dll opens a back door on Random TCP ports.
zsys1.dll tries to terminate antiviral programs installed on a user computer.
zsys1.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\zsys.exe
%System%\zsys1.dll
%System%\zsys2.dll
%Windir%\wscntfy.exe
Adds the value:
"Zsys" = "%System%\Zsys.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove Zxbnredm.dll using RegRun "Scan for Viruses" feature.
http://www.regrun.com

%sysdir%\zsys2.dll

zsys2.dll is a Trojan PWSteal.Rivarts.
zsys2.dll opens a back door on Random TCP ports.
zsys2.dll tries to terminate antiviral programs installed on a user computer.
zsys2.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\zsys.exe
%System%\zsys1.dll
%System%\zsys2.dll
%Windir%\wscntfy.exe
Adds the value:
"Zsys" = "%System%\Zsys.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove zsys2.dll using RegRun "Scan for Viruses" feature.
http://www.regrun.com

%sysdir%\zxbnredm.dll

Zxbnredm.dll is rootkit Backdoor.Hesive.E.
Zxbnredm.dll is used to hide files, processes and registry.
Zxbnredm.dll is a kernel mode rootkit.
Rootkit injects itself into Explorer process.
Rootkit contacts remote hacker server using HTTP session.
Related files:
%SysDir%\Zxbnredm.dll
%SysDir%\Zxbnredm.sys

Adds the value:
"ServiceDll" = "%SystemRoot%\System32\Zxbnredm.dll"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
to the Windows startup registry keys.

Added to registry:
"ServiceDll" = "%SystemRoot%\System32\Zxbnredm.dll"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dmserver\Parameters

HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\ENUM\ROOT\LEGACY_ZXBNREDM
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Zxbnredm

More info: http://www.symantec.com/security_respons...

%sysdir%\zxbnredm.sys

Zxbnredm.sys is a Trojan Backdoor.Hesive.E.
Zxbnredm.sys spreads via open network shares.
Related files:
%System%\Zxbnredm.dll
%System%\Zxbnredm.sys
Adds the value:
"ServiceDll" = "%SystemRoot%\System32\Zxbnredm.dll"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill the process Zxbnredm.sys and remove Zxbnredm.sys from Windows startup using RegRun Reanimator.
http://www.regrun.com

%sysdir%\zztp\svchost.exe

Trojan Tannick.
Related files:
%SysDir%%\zztp\svchost.exe
"C:\Documents and Settings\%UserName%\Application Data\Microsoft\zztp\svchost.exe"
Terminates antiviral software.
Creates and loadss the %System%\_kwui.dll and %System%\_kwuiex.dll, for watching user Web activity.
Remove it from Windows startup.

%sysdir\\f4k3\dirote.exe

dirote.exe is rootkit W32/Randon-AH.
dirote.exe is used to hide files, processes and registry.
dirote.exe is a kernel mode rootkit.
dirote.exe opens a back door on IRC channels.
Related files:
%SysDir\\f4k3\calcu.exe
%SysDir\\f4k3\demo.txt
%SysDir\\f4k3\dir32.exe
%SysDir\\f4k3\dirote.exe
%SysDir\\f4k3\dorod.exe
%SysDir\\f4k3\dorod.ini
%SysDir\\f4k3\emoti.bat
%SysDir\\f4k3\kltye.exe
%SysDir\\f4k3\kolder.exe
%SysDir\\f4k3\roudSTID.exe
%SysDir\\f4k3\van32.exe
More info: http://www.sophos.com/virusinfo/analyses...

%system%\a.exe

Adware WinFavorites.Bridge.
Software that brings ads to your computer. Such ads may or may not be targeted, but are
"injected" and/or popup, and are not merely displayed within the form of an ad-sponsored
application.
Read more:
http://www.pestpatrol.com/pestinfo/w/win...
Also, remove BHO item using Advanced Optimize:
c:\windows\system32\bridge.dll.

%system%\bridge.dll

%system%\cmd32.exe

Worm Win32.P2P.Tanked.
It connects to an IRC channel and waits for commands to be issued by an attacker. Thus, the
attacker may:
* send private and system information from the infected system
* download files into the infected computer
* execute files onto the infected computer
* perform a DoS attack (Denial of Service) on an IP
* send the worm to other users
Read more:
http://www.bitdefender.com/bd/site/virus...
Remove it from startup by RegRun Startup Optimizer.

%system%\dx32cxlp.exe

Backdoor.Win32.Surila.k
It is a Trojan backdoor.
In order to gain full access to the Internet, Surila registers itself in the Windows FirewallPolicy, thereby becoming a legal program with full Internet rights.
Installs a proxy server on a random port to process HTTP and SMTP traffic.
Attempts to contact with IRC servers to receive commands.
Also changes the hosts file in order to try and block antivirus database updates and access to antivirus vendors' websites.

Remove it from startup by RegRun Startup Optimizer.

%system%\load32.exe

Backdoor.Nibu.F is a Trojan horse that attempts to steal passwords and bank account information.
Logs keystrokes and steals information to send to the hacker.
Looks for windows that have certain strings in the title bar.
These strings vary, but may include the following:
Bank; bank; bull; Bull; cash; ebay; e-metal; Fethard; fethard; gold; Keeper; localhost; mull; PayPal; Storm; WebMoney; Winamp; WM Keeper

Captures keystrokes that are typed into windows that contain the previously listed strings and stores them in a log file.
This file may be named %Windir%\vxdload.log.
Launches a thread that monitors the Clipboard, saving to a log file any data that it finds.
The file may be named %Windir%\rundllx.sys.

Periodically checks the size of the files it uses for logging stolen information.
When the files are a certain size, the log files will be emailed to a hard-coded email address, along with System information such as the IP address and operating system.

Use RegRun Startup Optimizer to remove it from startup.

%system%\msjet62.dll

%System%\msjet62.dll is W32.Dbit.
Related files:
%System%\msjet62.dll
%UserProfile%\Local Settings\Temp\NEW[RANDOM NUMBER].tmp
%CurrentFolder%[INFECTED HOST FILE]\i\i
Read more: http://www.symantec.com/enterprise/secur...
Kill the file %System%\msjet62.dll and remove %System%\msjet62.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

%system%\ntsvc.exe

Trojan.Gletta.A is a Trojan horse that steals Internet banking passwords.
It logs keystrokes when you visit certain Web pages and emails the log to the attacker.
Web pages that link to .CHM files to exploit the Microsoft Internet Explorer ITS Protocol Zone Bypass Vulnerability are known to distribute Trojan.Gletta.A.
Captures all the keystrokes entered into any windows that match predefined list, and writes them into a log file.
Uses its own SMTP engine to send the log file to an external mail account.
It uses an SMTP server in Russia to send the mail.

The mail has the following characteristics:
Both the FROM and TO addresses have the domain "mail.ru"
The subject starts with "Business News from "

Use RegRun Startup Optimizer to remove it from your system.

%system%\regedit.exe

Worm.Win32.Doomjuice.b
This worm spreads via the Internet, using computers infected by I-Worm.Mydoom.a and I-Worm.Mydoom.b to propagate.

Copies itself to:
%system%\regedit.exe

Adds the value: NeroCheck = %system%\regedit.exe
to registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

The worm creates the unique identifier _sncZZmtx_133 to show its presence in memory.
The worm connects to TCP port 3127, which has been opened by shimgapi.dll, the backdoor component of Mydoom, to receive commands.
If the infected computer answers the command, then Doomjuice establishes a connection and sends a copy of itself.
The backdoor component of Mydoom accepts the file and executes it.
To determine which IP addresses to attack, the worm uses the following formula: (A.B.C.D) where A,B,C,D is a random numbers.
If the current date is not between the 8th and the 12th of the month and it's not January the worm will launch a DoS attack on the www.microsoft.com site.

With RegRun Startup Optimizer you can automatical remove it from startup.

%system%\run32.exe

%system%\rundll16.exe

W32.Mydoom.K@mm
It is an encrypted, mass-mailing worm that arrives as an attachment with either a .pif, .scr, .exe, .cmd, .bat, or .zip extension.
Allows unauthorized remote access. Kills the process of several antivirus and security applications.

Searches for email addresses in files with different extensions.
Attempts to send itself to the email addresses it found.
The email will have the following characteristics.

From: may be spoofed.
Subject: may be one from predefined list.
Message: different.
Attachment: file with .pif, .scr, .exe, .cmd, .bat, or .zip extension.

Manual removal:
Navigate to the key: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
and delete the value: "Taskmon" = "%System%\Rundll16.exe"

%system%\system.exe

The Backdoor.Bifrose collects system information and sends it to the hacker.
Also, downloads and executes files.
Attempts to use Microsoft Internet Explorer to connect, using TCP port 1971, to one of the following addresses and send out the collected system information:
firedragon.no-ip.com; killvirus2002.serveftp.org; 222.65.219.234
Waits for commands from the attacker.

Automatic removal: Use RegRun Startup Optimizer to remove it from startup.

%system%\taskmon.exe

%system%\windll.exe

I-Worm.Bagle.al
Bagle.al is a worm that spreads as an email attachment and via file sharing networks.
Copies itself into the Windows system directory with the name windll.exe and registers the following system registry auto run key:
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "erthgdr"="%system%\windll.exe"
Bagle.al creates two additional files in the Windows system folder: windll.exeopen; windll.exeopenopen
The worm uses a built-in SMTP server to mail copies of itself to all email addresses founded on the infected computer.
Bagle.al opens port 80 on the local HTTP server allowing the controller to download and execute files on the infected machine.
The worm component of Bagle.al is scheduled to stop functioning and slef-destruct after August 10, 2004.
However, the downloader module will remain available for possible use for an unspecified period of time.

Remove it from startup by RegRun Startup Optimizer.

%system%\windll32.exe

Trojan.Mitglieder.L is a trojan horse program that allows a compromised system to be used as an email relay.
Also known as TrojanProxy.Win32.Mitglieder.bi

Copies itself to %System%\windll32.exe
Attempts to end some processes associated with various antivirus and security applications.
Attempts to contact a specific page on predefined Web sites and notify the attacker.

Manual removal:
Navigate to the key: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
and delete the value: "windll32.exe"="%System%\windll32.exe"

Also, delete the values:
HKEY_CURRENT_USER\SOFTWARE\Frame\pid=
HKEY_CURRENT_USER\SOFTWARE\Frame\uid=
HKEY_CURRENT_USER\SOFTWARE\Frame\port=

%system%\winsystems.exe

%System%\WinSystems.exe is Trojan Bagler.
Kill the process %System%\WinSystems.exe and remove %System%\WinSystems.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%system%\winupd.exe

Adware.SeachNew is a program that changes your Internet Explorer home page and search page.
Adds "thenewsearch.com" to the Internet Explorer Favorites.
Adds the following DNS entry to the hosts file: 69.50.173.250 auto.seach.msn.com
This Adware program must be manually installed or installed as a component of another program.

When Adware.SearchNew is executed, it performs the following actions:

Adds the value: "winupd" = "%System%\winupd.exe"
to the registry: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

Adds the registry key: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\yun

Must be removed by RegRun.

%system%\wmiprvse.exe

%systemdrive%\documents and settings\all users\application data\microsoft\pctools\pctools.dll

%SystemDrive%\Documents and Settings\All Users\Application Data\Microsoft\PCTools\pctools.dll is Trojan.Cinmeng.
Read more: http://www.symantec.com/enterprise/secur...
Kill the file %SystemDrive%\Documents and Settings\All Users\Application Data\Microsoft\PCTools\pctools.dll and remove %SystemDrive%\Documents and Settings\All Users\Application Data\Microsoft\PCTools\pctools.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

%temp%\atl.dll

Atl.dll is a Spyware.Apropos.
Atl.dll is a Browser Helper Object.
Atl.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Windir%\Downloaded Program Files\load.exe
%Windir%\Downloaded Program Files\monpop.exe
%Windir%\Downloaded Program Files\pop225.dll
%Windir%\Downloaded Program Files\pophook4.dll
%Windir%\Downloaded Program Files\PopSrv225.exe
%Temp%\auto_update_loader.exe
%Temp%\install_ct.exe
%Temp%\CXtPls.exe
%Temp%\ProxyStub.dll
%Temp%\WinGenerics.dll
%Temp%\ace.dll
%Temp%\atla.dll
%Temp%\atlw.dll
%Temp%\data.bin
%Temp%\libexpat.dll
%Temp%\ph.exe
%Temp%\pm.exe
%Temp%\setup.inf
%Temp%\uninstaller.exe
%Temp%\atl.dll
%System%\atmon.exe
%System%\intfaxui.exe
Adds the value:
"POP" = "C:\WINDOWS\Downloaded Program Files\PopSrv225.exe"
"AutoLoaderEnvoloAutoUpdater" = "auto_update_loader.exe"
"[random name]" = "intfaxui.exe"
"[random name]" = "atmon.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove atl.dll from Windows startup using RegRun Startup Optimizer.

%temp%\pe386.sys

%Temp%\pe386.sys is Backdoor.Rustock.A.
Read more: http://securityresponse.symantec.com/avc...
Kill the file %Temp%\pe386.sys and remove %Temp%\pe386.sys from Windows startup using RegRun.
www.regrun.com

%temp%\pm.exe

Pm.exe is a Spyware.Apropos.
Pm.exe is a Browser Helper Object.
Pm.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Windir%\Downloaded Program Files\load.exe
%Windir%\Downloaded Program Files\monpop.exe
%Windir%\Downloaded Program Files\pop225.dll
%Windir%\Downloaded Program Files\pophook4.dll
%Windir%\Downloaded Program Files\PopSrv225.exe
%Temp%\auto_update_loader.exe
%Temp%\install_ct.exe
%Temp%\CXtPls.exe
%Temp%\ProxyStub.dll
%Temp%\WinGenerics.dll
%Temp%\ace.dll
%Temp%\atla.dll
%Temp%\atlw.dll
%Temp%\data.bin
%Temp%\libexpat.dll
%Temp%\ph.exe
%Temp%\pm.exe
%Temp%\setup.inf
%Temp%\uninstaller.exe
%Temp%\atl.dll
%System%\atmon.exe
%System%\intfaxui.exe
Adds the value:
"POP" = "C:\WINDOWS\Downloaded Program Files\PopSrv225.exe"
"AutoLoaderEnvoloAutoUpdater" = "auto_update_loader.exe"
"[random name]" = "intfaxui.exe"
"[random name]" = "atmon.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill pm.exe process and remove pm.exe from Windows startup using RegRun Startup Optimizer.

%tmp%\cartao522.exe

%TMP%\Cartao522.exe is Trojan/Backdoor.
Kill the process Cartao522.exe and remove Cartao522.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%tmp%\dtmp106.exe

%TMP%\Dtmp106.exe is Trojan/Backdoor.
Kill the process Dtmp106.exe and remove Dtmp106.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%tmp%\hadb31.exe

%TMP%\HADB31.EXE is Trojan/Backdoor.
Kill the process HADB31.EXE and remove HADB31.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

%tmp%\mc26.tmp

MC26.TMP is Trojan/Backdoor.
Kill the file MC26.TMP and remove MC26.TMP from Windows startup using RegRun Reanimator.
http://www.regrun.com

%tmp%\mc29bd.tmp

MC29BD.TMP is Trojan/Backdoor.
Kill the file MC29BD.TMP and remove MC29BD.TMP from Windows startup using RegRun Reanimator.
http://www.regrun.com

%tmp%\mc2a.tmp

mc2A.tmp is a dialer program Dialer.ICcontrol.
Related files:
%Windir%\icc.dll
%Windir%\iccontrol.exe
%Windir%\madchook.dll
%Windir%\natydave1.exe
%Windir%\sp2ydave1.exe
%Windir%\ydave1.exe
%UserTemp%\mc2A.tmp
More info: http://www.symantec.com/avcenter/venc/da...
Removal:
Kill the process mc2A.tmp and remove mc2A.tmp from Windows startup using RegRun Reanimator.
http://www.regrun.com

%tmp%\mhs.exe

%TMP%\mhs.exe is Infostealer.Aobys.
Read more: http://www.symantec.com/security_respons...
Kill the process %TMP%\mhs.exe and remove %TMP%\mhs.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%tmp%\msdoc.exe

%TMP%\msdoc.exe is Trojan/Backdoor.
Kill the process msdoc.exe and remove msdoc.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%tmp%\msie.exe

%TMP%\msie.exe is Troj/Nobond-B.
Read more: http://www.sophos.com/security/analyses/...
Kill the process %TMP%\msie.exe and remove %TMP%\msie.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%tmp%\mstemp.exe

mstemp.exe is a spyware worm W32.Antinny-P.
mstemp.exe spreads via open network shares.
mstemp.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Temp%\mstemp.exe
%%System%\w32secm.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill the process mstemp.exe and remove mstemp.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%tmp%\pork.exe

We suggest you to remove %TMP%\pork.exe from your computer as soon as possible.
%TMP%\pork.exe is Troj/Psyme-FC.
Read more: http://www.sophos.com/security/analyses/...
Kill the process %TMP%\pork.exe and remove %TMP%\pork.exe from Windows startup.

%tmp%\registryfix.exe

%TMP%\REGISTRYFIX.EXE is Downloader.Affiliase.
Read more: http://www.symantec.com/enterprise/secur...
Kill the process %TMP%\REGISTRYFIX.EXE and remove %TMP%\REGISTRYFIX.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

%tmp%\rudll.exe

rudll.exe is rootkit Trojan.Vanti-K.
rudll.exe is used to hide files, processes and registry.
rudll.exe is a kernel mode rootkit.
Related files:
%Temp%\rudll.exe

rudll.exe is created new system drivers:
service name: " rudll"
display name: " rudll"
Added to registry:
HKLM\SYSTEM\CurrentControlSet\Services\rudll\

More info: http://www.sophos.com/virusinfo/analyses...

%tmp%\services.exe

%TMP%\services.exe is Infostealer.Yahmali.
Infostealer.Yahmali is a Trojan horse program that attempts to steal Yahoo! Messenger user names and passwords and sends them to a remote location.
Related files:
%TMP%\services.exe
%TMP%\LSASS.EXE
%TMP%\SMSS.EXE
%TMP%\CSRSS.EXE
%TMP%\WINLOGON.EXE
Read more: http://www.symantec.com/enterprise/secur...
Kill the process %TMP%\services.exe and remove %TMP%\services.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%tmp%\sexxx.exe

%TMP%\sexxx.exe is Trojan.Win32.Small.nt.
Read more: http://www.viruslist.com/en/viruses/ency...
Kill the process %TMP%\sexxx.exe and remove %TMP%\sexxx.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%tmp%\showinfo.exe

%TMP%\ShowInfo.exe is Trojan/Backdoor.
Kill the process ShowInfo.exe and remove ShowInfo.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%tmp%\step1.exe

step1.exe is rootkit Trojan.Zlob-XZ.
step1.exe is used to hide files, processes and registry.
step1.exe is a kernel mode rootkit.
Related files:
%Temp%\step1.exe
%Temp%\step2.exe
More info: http://www.sophos.com/security/analyses/...

%tmp%\svchost.exe

%TMP%\SVCHOST.EXE is Trojan/Backdoor.
Kill the process %TMP%\SVCHOST.EXE and remove %TMP%\SVCHOST.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

%tmp%\vgt.exe

%TMP%\vgt.exe is Trojan/Backdoor.
Kill the process vgt.exe and remove vgt.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%tmp%\vmmreg32.dll

%TMP%\vmmreg32.dll is Trojan-Downloader.VBS.Small.bo.
Read more: http://www.viruslist.com/en/viruses/ency...
Kill the file %TMP%\vmmreg32.dll and remove %TMP%\vmmreg32.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

%tmp%\winkgcbmt.exe

winkgcbmt.exe is a mass-mailing worm W32.Beagle.DR@mm.
winkgcbmt.exe opens a back door on TCP port 6777.
winkgcbmt.exe spreads via open network shares.
winkgcbmt.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%Windir%\Wimanager.exe
%System%\lsamgr.exe
%System%\lsamgr.exeopen
%System%\lsamgr.exeopenopen
%Temp%\winkgcbmt.exe
Adds the value:
"LsaManager" = ""%System%\lsamgr.exe"\lsamgr.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill the process winkgcbmt.exe and remove winkgcbmt.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%tmp%\winword.exe

%TMP%\WINWORD.EXE is Trojan.Mdropper.T.
Read more: http://www.symantec.com/enterprise/secur...
Kill the process %TMP%\WINWORD.EXE and remove %TMP%\WINWORD.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

%tmp%\xxmp82.exe

xxmp82.exe is Trojan/Backdoor.
Kill the process xxmp82.exe and remove xxmp82.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%user%\local settings\application data\winlogon.exe

%userprofile%\local settings\temp\winlogon.exe

%UserProfile%\Local Settings\Temp\winlogon.exe is W32.Grum.A.
W32.Grum.A is a virus that infects .exe files and installs a rootkit on the compromised computer.
Read more: http://www.symantec.com/enterprise/secur...
Kill the process %UserProfile%\Local Settings\Temp\winlogon.exe and remove %UserProfile%\Local Settings\Temp\winlogon.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%userprofile%\my documents\minesweeper.exe

%userprofile%\start menu\programs\startup\ctfmon.exe

%UserProfile%\Start Menu\Programs\Startup\ctfmon.exe is W32.Fakerecy.
Related files:
[DRIVE]:\autorun.inf
[DRIVE]:\Recycled\desktop.ini
[DRIVE]:\Recycled\INFO2
[DRIVE]:\Recycled\Recycled\ctfmon.exe
%UserProfile%\Start Menu\Programs\Startup\desktop.ini
%UserProfile%\Start Menu\Programs\Startup\ctfmon.exe
Read more: http://www.symantec.com/enterprise/secur...
Kill the process %UserProfile%\Start Menu\Programs\Startup\ctfmon.exe and remove %UserProfile%\Start Menu\Programs\Startup\ctfmon.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%windir%\@@@\mydll.exe

mydll.exe is rootkit Backdoor.Darkmoon.
mydll.exe is used to hide files, processes and registry.
mydll.exe is a kernel mode rootkit.
Rootkit injects itself into the iexplore.exe process.
mydll.exe opens a back door on on TCP ports 6868 and 7777.
Rootkit creates new system drivers.
mydll.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\[FILENAME].d1l
%System%\drivers\[FILENAME].sys .
%Windir%\@@@\___.exe
%Windir%\@@@\mydll.exe
%Windir%\@@@\win32.exe
%Windir%\win32log.dat
%Temp%\~MS[RANDOM CHARACTERS].doc
%Temp%\~$~MS[RANDOM CHARACTERS].doc
Adds the value:
"Microsoft" = "%Windir%\@@@\win32.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

"ServiceDll" = "%System%\[FILENAME].d1l"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dmserver\Parameters
to the Windows startup registry keys.
Added to registry:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\[FILENAME]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_[FILENAME]
More info: http://www.symantec.com/security_respons...

%windir%\_meaoi.exe

_meaoi.exe is a Trojan W32.Tilebot-AM.
_meaoi.exe opens a back door on IRC channels.
_meaoi.exe spreads via open network shares.
_meaoi.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Windows%\_meaoi.exe
%System%\meaoi.sys
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill _meaoi.exe process and remove _meaoi.exe from Windows startup using RegRun Startup Optimizer.

%windir%\1zu7m84a.exe

1zu7m84a.exe is Trojan/Backdoor.
Kill the process 1zu7m84a.exe and remove 1zu7m84a.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%windir%\2020search.dll

2020search.dll is a Spyware.2020search.
2020search.dll is a Browser Helper Object.
2020search.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%ProgramFiles%\Srng\Srng.exe
%Windir%\svchost.exe
%Windir%\2020search2.dll
%Windir%\2020Search.dll
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove 2020search.dll from Windows startup using RegRun Startup Optimizer.

%windir%\2020search2.dll

2020search2.dll is a Spyware.2020search.
2020search2.dll is a Browser Helper Object.
2020search2.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%ProgramFiles%\Srng\Srng.exe
%Windir%\svchost.exe
%Windir%\2020search2.dll
%Windir%\2020Search.dll
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove 2020search2.dll from Windows startup using RegRun Startup Optimizer.

%windir%\80xfire.exe

80xFire.exe is a worm W32.Tilebot-BK.
80xFire.exe opens a back door on IRC channels.
80xFire.exe spreads via open network shares.
Related files:
%Windows%\80xFire.exe
%System%\rdriv.sys
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill 80xFire.exe process and remove 80xFire.exe from Windows startup using RegRun Startup Optimizer.

%windir%\896588appinit.dll

896588AppInit.DLL is a Trojan.LegMir-BI.
896588AppInit.DLL monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Windows%\896588.dll
%Windows%\896588AppInit.DLL
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove 896588AppInit.DLL from Windows startup using RegRun Startup Optimizer.

%windir%\abcdefg.exe

Abcdefg.exe is a worm W32.Kelvir.DD.
Abcdefg.exe opens a back door on TCP port 8080.
Abcdefg.exe spreads through MSN Messenger.
Related files:
%Windir%\abcdefg.exe
Adds the value:
"FILE" = "%Windir%\abcdefg.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill abcdefg.exe process and remove abcdefg.exe from Windows startup using RegRun Startup Optimizer.

%windir%\abcdefg23.exe

abcdefg23.exe is a Trojan.VB-VT.
abcdefg23.exe modifies data on the computer.
Related files:
%Windows%\abcdefg23.exe
%Windows%\hiklmnop27.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill abcdefg23.exe process and remove abcdefg23.exe from Windows startup using RegRun Startup Optimizer.

%windir%\abox.exe

Abox.exe is aa adware program Adware.Adultbox.
Abox.exe monitors user Internet activity.
Abox.exe rtneg.dll displays pornographic and advertising information.
Related files:
%Windir%\Abox.exe
Adds the value:
"Abox"="%Windir%\Abox.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill Abox.exe process and remove Abox.exe from Windows startup using RegRun Startup Optimizer.

%windir%\acdsee demo.exe

Mass mailing worm W32.Salga.
Spreads through e-mail, mIRC, file-sharing networks, and network shares.
Adds the values:
"windows" = "%Windir%\system\system copy.exe"
"system xp" = "%Windir%\acdsee demo.exe"
to Windows startip registry keys.
Creates the file D:\autorun.inf containing the following lines:
[autorun]
open=FUN.ZIP.EXE
Creates the file E:\autorun.inf containing the following lines:
[autorun]
open=Messenger 9.00.ZIP.EXE
Changes the files:
C:\program files\mIRC\script.ini
C:\program files\mIRC32\script.ini
to allow spreading via IRC.
Copies itself as the following:
* %Windir%\acdsee demo.exe
* %Windir%\system\system copy.exe
* %Windir%\system32\egywormo[gen2].exe
* %Windir%\All Users\Desktop\magic\sex photoes of monika.zip.exe
* %Windir%\All Users\Start Menu\Programs\StartUp\salga.b.exe
* %Windir%\Start Menu\mob xp10 net speeder.zip.exe
* %Windir%\start menu\mob xp10 net speeder.zip.exe
* %Windir%\start menu\programs\DR.BLACK PERSON.zip.exe
* %Windir%\start menu\programs\DR.BLACK PERSON chat prog.zip.exe
* C:\BEST 10 SEX MOVIES IN 2004.zip
* C:\hard core hook from web\setup.zip.exe
* C:\magic_cam\magic_cam.ZIP.EXE
* C:\Program Files\Accessories\attachment.zip...............exe
* C:\Program Files\Accessories\Nicole kidman.zip...............exe
* C:\Program Files\mirc\Britny spears marriage with Bnladen son.zip.exe
* C:\Program Files\mirc32\Britny spears marriage with Bnladen son.zip.exe
* C:\Documents and Settings\All Users\DESKTOP\holywood stuff film.zip.exe
* C:\Documents and Settings\All Users\Start Menu\white fang sex.zip.exe
* C:\Documents and Settings\All Users\Start Menu\Programs\sisqoo^^007 progs.zip.exe
* C:\Documents and Settings\All Users\Start Menu\Programs\sisqoo^^007 progs.exe
* C:\Documents and Settings\All Users\Start Menu\Programs\Accessories\a7meedye graphices maker.zip.exe
* C:\Documents and Settings\All Users\Start Menu\Programs\Startup\salga.b.exe
* D:\FUN.ZIP.EXE
* D:\girlfriends emails.zip.exe
* D:\hook all sex movies from webs\setup.zip.exe
* E:\blood of fetch sex.zip.exe
* E:\Messenger 9.00.ZIP.EXE
* E:\real sex telephones\call from me.zip.exe
Adds the value:

"StartKazaa -SilentRun" = "C:\Program Files\Kazaa\My Shared Folder\Shared"
to the registry key:
HKEY_CURRENT_USER\Software\Kazaa\Transfer
Overwrites the Hosts file with the following text, which blocks access to certain Web sites.

%windir%\acls.exe

acls.exe is a Trojan.LeechPie-D.
acls.exe opens a back door.
acls.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%Windows%\pk.log
%Windows%\un\ComDlg.dll
%Windows%\un\ComDlg.ocx
%Windows%\un\CommonDlg32.pk1
%Windows%\un\CommonDlg32.pk2
%Windows%\un\acls.exe
%Windows%\un\admdll.dll
%Windows%\un\confini.exe
%Windows%\un\delsrv.exe
%Windows%\un\dtreg.exe
%Windows%\un\exe.bat
%Windows%\un\exec.bat
%Windows%\un\hiderun.exe
%Windows%\un\kill.exe
%Windows%\un\ntsvc.ocx
%Windows%\un\scvhost.exe
%Windows%\un\secure.exe
%Windows%\un\secure2.exe
%Windows%\un\serv.exe
%Windows%\un\wmc.exe
%System%\QuicktmeLib.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill acls.exe process and remove acls.exe from Windows startup using RegRun Startup Optimizer.

%windir%\adblockxp.exe

ADBlockXp.exe is a Trojan W32.Sdbot-AJR.
ADBlockXp.exe opens a back door on IRC channels.
ADBlockXp.exe spreads via open network shares.
Related files:
%Windows%\ADBlockXp.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill ADBlockXp.exe process and remove ADBlockXp.exe from Windows startup using RegRun Startup Optimizer.

%windir%\addins\svchost.exe

%WinDir%\addins\svchost.exe is W32.Reztrict@mm.
W32.Reztrict@mm is a mass-mailing worm that may download potentially malicious files on to the compromised computer.
Read more: http://www.symantec.com/enterprise/secur...
Kill the process %WinDir%\addins\svchost.exe and remove %WinDir%\addins\svchost.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%windir%\admdll.dll

admdll.dll is a Trojan.LeechPie-D.
admdll.dll opens a back door.
admdll.dll tries to terminate antiviral programs installed on a user computer.
Related files:
%Windows%\pk.log
%Windows%\un\ComDlg.dll
%Windows%\un\ComDlg.ocx
%Windows%\un\CommonDlg32.pk1
%Windows%\un\CommonDlg32.pk2
%Windows%\un\acls.exe
%Windows%\un\admdll.dll
%Windows%\un\confini.exe
%Windows%\un\delsrv.exe
%Windows%\un\dtreg.exe
%Windows%\un\exe.bat
%Windows%\un\exec.bat
%Windows%\un\hiderun.exe
%Windows%\un\kill.exe
%Windows%\un\ntsvc.ocx
%Windows%\un\scvhost.exe
%Windows%\un\secure.exe
%Windows%\un\secure2.exe
%Windows%\un\serv.exe
%Windows%\un\wmc.exe
%System%\QuicktmeLib.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove admdll.dll from Windows startup using RegRun Startup Optimizer.

%windir%\aig.exe

aig.exe is a Trojan.Aimbot-BC.
aig.exe opens a back door.
Related files:
%Windows%\aig.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill aig.exe process and remove aig.exe from Windows startup using RegRun Startup Optimizer.

%windir%\aim.dll

Aim.dll is a Trojan Backdoor.IRC.Ratsou.B.
Aim.dll spreads via open network shares.
Related files:
C:\Note.exe
%System%\Hid.exe
%System%\Explorer.dll
%System%\Iexplore.dll
%Windir%\Aim.dll
%Windir%\Boot.exe
%Windir%\C.dll
%Windir%\Crazy.exe
%Windir%\Dr.exe
%Windir%\Empavms.exe
%Windir%\Ipservers.dll
%Windir%\Java.dll
%Windir%\LibParse.exe
%Windir%\Lsass.exe
%Windir%\Miconfig.exe
%Windir%\Moo.dll
%Windir%\Msccl.dll
%Windir%\Msconig.exe
%Windir%\Nhtml.dll
%Windir%\Ratsou.exe
%Windir%\Regedit.dll
%Windir%\Restart.exe
%Windir%\Screen.dll
%Windir%\Sysboot.dll
%Windir%\Syste32.dll
%Windir%\Users.dll
%Windir%\Wind.dll
Adds the value:
"HID.EXE"="%System%\HID.EXE"
"lsass"="%Windir%\Debug\UserMode\lsass.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove Aim.dll from Windows startup using RegRun Startup Optimizer.

%windir%\aimclient.exe

aimclient.exe is Trojan/Backdoor.
Kill the process aimclient.exe and remove aimclient.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%windir%\antivirus32.exe

antivirus32.exe is rootkit W32/Tilebot-HV.
antivirus32.exe is used to hide files, processes and registry.
antivirus32.exe is a kernel mode rootkit.
Rootkit contacts remote hacker server using HTTP session.
antivirus32.exe spreads via open network shares.
antivirus32.exe opens a back door on IRC channels.
antivirus32.exe created new system drivers:
service name: "antivirus32"
display name: "antivirus32"
Adds the value:
HKLM\SYSTEM\CurrentControlSet\Services\antivirus32\
to the Windows startup registry keys.

rdriv.sys created new system drivers:
service name: "rdriv"
display name: "rdriv"
Added to registry:
HKLM\SYSTEM\CurrentControlSet\Services\rdriv\

Related files:
%WinDir%\antivirus32.exe
%SysDir%\rdriv.sys
Adds the value:
HKLM\SYSTEM\CurrentControlSet\Services\Messenger
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\RemoteRegistry
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\TlntSvr
Start
4
to the Windows startup registry keys.
Added to registry:
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
DoNotAllowXPSP2
1

HKLM\SOFTWARE\Microsoft\Ole
EnableDCOM
N

HKLM\SYSTEM\CurrentControlSet\Control\Lsa
restrictanonymous
1

HKLM\SOFTWARE\Microsoft\Security Center\
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\
More info: http://www.sophos.com/virusinfo/analyses...

%windir%\aornidle.dll

Aornidle.dll is an adware program Adware.Aornum.
Aornidle.dll is a Browser Helper Object.
Aornidle.dll downloads and displays advertisements.
Related files:
%Windir%\Aornum.exe
%Windir%\Aornidle.dll
%Windir%\Aornumax.dll
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove Aornidle.dll from Windows startup using RegRun Startup Optimizer.

%windir%\aornum.exe

Aornum.exe is an adware program Adware.Aornum.
Aornum.exe is a Browser Helper Object.
Aornum.exe downloads and displays advertisements.
Related files:
%Windir%\Aornum.exe
%Windir%\Aornidle.dll
%Windir%\Aornumax.dll
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill Aornum.exe process and remove Aornum.exe from Windows startup using RegRun Startup Optimizer.

%windir%\aornumax.dll

Aornumax.dll is an adware program Adware.Aornum.
Aornumax.dll is a Browser Helper Object.
Aornum.exe downloads and displays advertisements.
Related files:
%Windir%\Aornum.exe
%Windir%\Aornidle.dll
%Windir%\Aornumax.dll
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove Aornumax.dll from Windows startup using RegRun Startup Optimizer.

%windir%\appevent.exe

%WinDir%\AppEvent.exe is Trojan/Backdoor.
Kill the process AppEvent.exe and remove AppEvent.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%windir%\arcoiris.exe

%WinDir%\arcoiris.exe is Trojan/Backdoor.
Kill the process arcoiris.exe and remove arcoiris.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%windir%\asbltzun.exe

Asbltzun.exe is a Spyware.SafeSurfing.
Asbltzun.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Windir%\asbltzun.exe
%Windir%\netsync.exe
%Windir%\rsyncmon.dll
%Windir%\ISSM0064.DAT
%System%\COMMCOS2.DLL
%System%\InstallerV3.exe
%System%\regsync.exe
%System%\richedtr.dll
%System%\richup.exe
%System%\redtrsha.dll
%System%\vbrundll.dll
%System%\VBUninstall.exe
%System%\msxml3a.dll
Adds the value:
"RSync" = "%Windir%\netsync.exe"
"regsync" = "C:\WINDOWS\System32\regsync.exe"
"richup" = "C:\WINDOWS\System32\richup.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill asbltzun.exe process and remove asbltzun.exe from Windows startup using RegRun Startup Optimizer.

%windir%\ask\ask.dll

ASK.dll is a Spyware.StealthKeylog.
ASK.dll Logs keystrokes and captures screenshots.
Related files:
%Windir%\ASK\ASK.dll
%Windir%\ASK\ASK.exe
%Windir%\ASK\ScrCap.exe
%Windir%\ASK\SMTPSender.exe
Adds the value:
"ASK" = "%System%\rundll32.exe %Windir%\ASK\ASK.dll rdl"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove ASK.dll from Windows startup using RegRun Startup Optimizer.

%windir%\ask\ask.exe

ASK.exe is a Spyware.StealthKeylog.
ASK.exe Logs keystrokes and captures screenshots.
Related files:
%Windir%\ASK\ASK.dll
%Windir%\ASK\ASK.exe
%Windir%\ASK\ScrCap.exe
%Windir%\ASK\SMTPSender.exe
Adds the value:
"ASK" = "%System%\rundll32.exe %Windir%\ASK\ASK.dll rdl"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill ASK.exe process and remove ASK.exe from Windows startup using RegRun Startup Optimizer.

%windir%\ask\scrcap.exe

ScrCap.exe is a Spyware.StealthKeylog.
ScrCap.exe Logs keystrokes and captures screenshots.
Related files:
%Windir%\ASK\ASK.dll
%Windir%\ASK\ASK.exe
%Windir%\ASK\ScrCap.exe
%Windir%\ASK\SMTPSender.exe
Adds the value:
"ASK" = "%System%\rundll32.exe %Windir%\ASK\ASK.dll rdl"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill ScrCap.exe process and remove ScrCap.exe from Windows startup using RegRun Startup Optimizer.

%windir%\ask\smtpsender.exe

SMTPSender.exe is a Spyware.StealthKeylog.
SMTPSender.exe Logs keystrokes and captures screenshots.
Related files:
%Windir%\ASK\ASK.dll
%Windir%\ASK\ASK.exe
%Windir%\ASK\ScrCap.exe
%Windir%\ASK\SMTPSender.exe
Adds the value:
"ASK" = "%System%\rundll32.exe %Windir%\ASK\ASK.dll rdl"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill SMTPSender.exe process and remove SMTPSender.exe from Windows startup using RegRun Startup Optimizer.

%windir%\asnftpd.exe

AsnFtpd.exe is rootkit W32/Tilebot-BD.
AsnFtpd.exe is used to hide files, processes and registry.
AsnFtpd.exe is a kernel mode rootkit.
Rootkit contacts remote hacker server using HTTP session.
AsnFtpd.exe created new system drivers:
service name: "ASNFTPD"
display name: " ASNFTP daemon"
Adds the value:
HKLM\SYSTEM\CurrentControlSet\Services\ASNFTPD\
to the Windows startup registry keys.

rdriv.sys created new system drivers:
service name: " rdriv"
display name: "rdriv"
Adde to registry:
HKLM\SYSTEM\CurrentControlSet\Services\rdriv\

Related files:
%WinDir%\AsnFtpd.exe
%SysDir%\rdriv.sys.
Adds the value:
HKLM\SYSTEM\CurrentControlSet\Services\Messenger
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\RemoteRegistry
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\TlntSvr
Start
4
to the Windows startup registry keys.
Added to registry:
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
DoNotAllowXPSP2
1

HKLM\SOFTWARE\Microsoft\Ole
EnableDCOM
N

HKLM\SYSTEM\CurrentControlSet\Control\Lsa
restrictanonymous
1

HKLM\SOFTWARE\Microsoft\Security Center\
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\
More info: http://www.sophos.com/virusinfo/analyses...

%windir%\assistse.exe

assistse.exe is a Trojan.Bravo-C.
assistse.exe opens a back door.
Related files:
web.exe
%Windows%\assistse.exe
%Windows%\uninstall.exe
%Windows%\h00kdll.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill assistse.exe process and remove assistse.exe from Windows startup using RegRun Startup Optimizer.

%windir%\assistseex.exe

assistseex.exe is a Trojan.LegMir-BW.
assistseex.exe opens a back door.
assistseex.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%Windows%\assistseex.exe
%Windows%\sllserv.exe
%Windows%\uninstallex.exe
%Windows%\ced.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill assistseex.exe process and remove assistseex.exe from Windows startup using RegRun Startup Optimizer.

%windir%\asus.exe

%WinDir%\asus.exe is Trojan/Backdoor.
Kill the process asus.exe and remove asus.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%windir%\atomicpartc.exe

AtomicpartC.exe is a worm W32.Katomik-A.
AtomicpartC.exe spreads via open network shares.
Related files:
%Windows%\AtomicpartC.exe
%Windows%\K-set.bmp
%System%\Atomic-x27.exe
%System%\mastoer32.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill AtomicpartC.exe process and remove AtomicpartC.exe from Windows startup using RegRun Startup Optimizer.

%windir%\au.exe

I-Worm.Bagle.b
This worm spreads via the Internet as attachments to infected emails.

The infected messages have the following characteristics:

Header:
ID x... thanks
with x being a string of random characters.

Body:
Yours ID x
--
Thank
with x being a string of random characters.

Attachment:
The attachment has a random name, with a file size of 11KB.

The worm copies itself to the Windows system directory under the name 'au.exe'.
Adds the value: "au.exe" = "%system%\au.exe"
to registry key:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
Also creates the following registry key:
[HKCU\SOFTWARE\Windows2000] and saves its variables there.
The worm attempts to connect to remote sites, all of which are in some way connected with the Trojan proxy server TrojanProxy.Win32.Mitglieder
Send itself to all email addresses found in files on disks.

%windir%\avguard.exe

W32.Netsky.G@mm
It copies itself to %Windir%\Avguard.exe.

Deletes the values: Taskmon, Explorer, Windows Services Host, KasperskyAV, from the registry keys:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Some of these registry key values are typically associated with the worms W32.Mydoom.A@mm and W32.Mydoom.B@mm.
The W32.Mimail.T@mm worm may add the registry key value "KasperskyAV."

Deletes some values from the registry key
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
Such as: System, msgsvr32, DELETE ME, service, Sentry, d3dupdate.exe, au.exe, OLE, gouday.exe etc.

Deletes the registry keys:
HKEY_CLASSES_ROOT\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InProcServer32
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\PINF
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\WksPatch

Scans the predefined file types on drives C through Z for email addresses:
Uses its own SMTP engine to send itself to the email addresses it found above, sending to each address once.
The email has the following characteristics:
Subject: One of the predefined list.
For ex: Re: Your website

Body: (One of the following)
Your file is attached.
Please read the attached file.
Please have a look at the attached file.
See the attached file for details.
Here is the file.
Your document is attached.

Attachment: One of the predefined list.
For ex: Re: mp3music.pif

Manual removal:
Navigate to the key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
and delete the value: "Special Firewall Service" = %WinDir%\avguard.exe -av service

%windir%\avp.exe

%WinDir%\avp.exe is Trojan/Backdoor.
Kill the process %WinDir%\avp.exe and remove %WinDir%\avp.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%windir%\avpsvc.exe

Avpsvc.exe is a Trojan.Hugesot-A.
Avpsvc.exe downloads code from the internet.
Related files:
%Windows%\Avpsvc.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill Avpsvc.exe process and remove Avpsvc.exe from Windows startup using RegRun Startup Optimizer.

%windir%\axdcfasb.exe

axdcfasb.exe is rootkit W32/Sdbot-AGI.
axdcfasb.exe is used to hide files, processes and registry.
axdcfasb.exe is a kernel mode rootkit.
Rootkit contacts remote hacker server using HTTP session.
axdcfasb.exe spreads via open network shares.
axdcfasb.exe opens a back door on IRC channels.
axdcfasb.exe created new system drivers:
service name: "sdktemp"
display name: "sdktemp"
Adds the value:
HKLM\SYSTEM\CurrentControlSet\Services\sdktemp\
to the Windows startup registry keys.

rdriv.sys created new system drivers:
service name: " rdriv"
display name: " rdriv"
Added to registry:
HKLM\SYSTEM\CurrentControlSet\Services\rdriv\

Related files:
%WinDir%\axdcfasb.exe
%SysDir%\rdriv.sys
Adds the value:
HKLM\SYSTEM\CurrentControlSet\Services\Messenger
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\RemoteRegistry
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\TlntSvr
Start
4
to the Windows startup registry keys.
Added to registry:
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
DoNotAllowXPSP2
1

HKLM\SOFTWARE\Microsoft\Ole
EnableDCOM
N

HKLM\SYSTEM\CurrentControlSet\Control\Lsa
restrictanonymous
1

HKLM\SOFTWARE\Microsoft\Security Center\
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\
More info: http://www.sophos.com/virusinfo/analyses...

%windir%\bagle.exe

Bagle.exe is a mass-mailing worm W32.Reatle.I@mm.
Bagle.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%Windir%\bagle.exe
%System%\mcafee.exe
%Windir%\scan.exe
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill bagle.exe process and remove bagle.exe from Windows startup using RegRun Startup Optimizer.

%windir%\banmanpro.exe

%WinDir%\Banmanpro.exe is Trojan-Clicker.Win32.VB.kc.
Kill the process banmanpro.exe and remove banmanpro.exe from Windows startup using RegRun.
www.regrun.com

%windir%\banner.dll

Banner.dll is an adware program Adware.BetterInternet.
Banner.dll is a Browser Helper Object.
Banner.dll downloads and displays advertisements.
Related files:
%Windir%\Bi.dll
%Windir%\speeryox.dll
%Windir%\Mxtarget.dll
%Windir%\BTGrab.dll
%Windir%\farmmext.exe
%Windir%\dlmax.dll
%Windir%\speer2.dll
%Windir%\VoiceIP.dll
%Windir%\morphacl.dll
%Windir%\Pynix.dll
%Windir%\Biprep.exe
%Windir%\banner.dll
%System%\laziqn.exe
%System%\xxvyaj.exe
%System%\wbtvsffd.exe
%System%\nnmzoq.exe
%Temp%\DrTemp\thnall1b.exe
%Temp%\DrTemp\thnall1p.exe
%Temp%\DrTemp\thnall2r.exe
%Temp%\DrTemp\polall1b.exe
%Temp%\thnall1s.exe
%Temp%\morphrec.exe
Adds the value:
"[File name of adware]" = "[File path to adware]"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove banner.dll from Windows startup using RegRun Startup Optimizer.

%windir%\batserv2.exe

batserv2.exe is a Trojan.Loosky-AB.
batserv2.exe opens a back door.
Related files:
%Windows%\batserv2.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill batserv2.exe process and remove batserv2.exe from Windows startup using RegRun Startup Optimizer.

%windir%\bi.dll

Bi.dll is an adware program Adware.BetterInternet.
Bi.dll is a Browser Helper Object.
Bi.dll downloads and displays advertisements.
Related files:
%Windir%\Bi.dll
%Windir%\speeryox.dll
%Windir%\Mxtarget.dll
%Windir%\BTGrab.dll
%Windir%\farmmext.exe
%Windir%\dlmax.dll
%Windir%\speer2.dll
%Windir%\VoiceIP.dll
%Windir%\morphacl.dll
%Windir%\Pynix.dll
%Windir%\Biprep.exe
%Windir%\banner.dll
%System%\laziqn.exe
%System%\xxvyaj.exe
%System%\wbtvsffd.exe
%System%\nnmzoq.exe
%Temp%\DrTemp\thnall1b.exe
%Temp%\DrTemp\thnall1p.exe
%Temp%\DrTemp\thnall2r.exe
%Temp%\DrTemp\polall1b.exe
%Temp%\thnall1s.exe
%Temp%\morphrec.exe
Adds the value:
"[File name of adware]" = "[File path to adware]"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove Bi.dll from Windows startup using RegRun Startup Optimizer.

%windir%\biprep.exe

Biprep.exe is an adware program Adware.BetterInternet.
Biprep.exe is a Browser Helper Object.
Biprep.exe downloads and displays advertisements.
Related files:
%Windir%\Bi.dll
%Windir%\speeryox.dll
%Windir%\Mxtarget.dll
%Windir%\BTGrab.dll
%Windir%\farmmext.exe
%Windir%\dlmax.dll
%Windir%\speer2.dll
%Windir%\VoiceIP.dll
%Windir%\morphacl.dll
%Windir%\Pynix.dll
%Windir%\Biprep.exe
%Windir%\banner.dll
%System%\laziqn.exe
%System%\xxvyaj.exe
%System%\wbtvsffd.exe
%System%\nnmzoq.exe
%Temp%\DrTemp\thnall1b.exe
%Temp%\DrTemp\thnall1p.exe
%Temp%\DrTemp\thnall2r.exe
%Temp%\DrTemp\polall1b.exe
%Temp%\thnall1s.exe
%Temp%\morphrec.exe
Adds the value:
"[File name of adware]" = "[File path to adware]"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill Biprep.exe process and remove Biprep.exe from Windows startup using RegRun Startup Optimizer.

%windir%\boby.exe

%WinDir%\boby.exe is Trojan/Backdoor.
Kill the process boby.exe and remove boby.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%windir%\boot.exe

Boot.exe is a Trojan Backdoor.IRC.Ratsou.B.
Boot.exe spreads via open network shares.
Related files:
C:\Note.exe
%System%\Hid.exe
%System%\Explorer.dll
%System%\Iexplore.dll
%Windir%\Aim.dll
%Windir%\Boot.exe
%Windir%\C.dll
%Windir%\Crazy.exe
%Windir%\Dr.exe
%Windir%\Empavms.exe
%Windir%\Ipservers.dll
%Windir%\Java.dll
%Windir%\LibParse.exe
%Windir%\Lsass.exe
%Windir%\Miconfig.exe
%Windir%\Moo.dll
%Windir%\Msccl.dll
%Windir%\Msconig.exe
%Windir%\Nhtml.dll
%Windir%\Ratsou.exe
%Windir%\Regedit.dll
%Windir%\Restart.exe
%Windir%\Screen.dll
%Windir%\Sysboot.dll
%Windir%\Syste32.dll
%Windir%\Users.dll
%Windir%\Wind.dll
Adds the value:
"HID.EXE"="%System%\HID.EXE"
"lsass"="%Windir%\Debug\UserMode\lsass.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill Boot.exe process and remove Boot.exe from Windows startup using RegRun Startup Optimizer.

%windir%\browsvr.dll

Browsvr.dll is a Trojan Backdoor.Fuwudoor.
Browsvr.dll spreads via open network shares.
Related files:
%System%\ipsec.dll
%System%\appmgmt.dll
%System%\browsvr.dll
%System%\trkw.dll
%System%\trks.dll
%System%\kdc.dll
%System%\dmsrv.dll
%System%\mesg.dll
%System%\netlogin.dll
%System%\protstrg.dll
%System%\lmhosts.dll
%System%\w32t.dll
%System%\ntms.dll
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove browsvr.dll from Windows startup using RegRun Startup Optimizer.

%windir%\bslogitech.exe

bslogitech.exe is a Trojan.IRCBot-AY.
bslogitech.exe opens a back door.
Related files:
%Windows%\4DFlowerBox.scr
%Windows%\fontstyles.exe
%System%\iexplore.exe
%Windows%\webdav\bslogitech.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill bslogitech.exe process and remove bslogitech.exe from Windows startup using RegRun Startup Optimizer.

%windir%\btgrab.dll

BTGrab.dll is an adware program Adware.BetterInternet.
BTGrab.dll is a Browser Helper Object.
BTGrab.dll downloads and displays advertisements.
Related files:
%Windir%\Bi.dll
%Windir%\speeryox.dll
%Windir%\Mxtarget.dll
%Windir%\BTGrab.dll
%Windir%\farmmext.exe
%Windir%\dlmax.dll
%Windir%\speer2.dll
%Windir%\VoiceIP.dll
%Windir%\morphacl.dll
%Windir%\Pynix.dll
%Windir%\Biprep.exe
%Windir%\banner.dll
%System%\laziqn.exe
%System%\xxvyaj.exe
%System%\wbtvsffd.exe
%System%\nnmzoq.exe
%Temp%\DrTemp\thnall1b.exe
%Temp%\DrTemp\thnall1p.exe
%Temp%\DrTemp\thnall2r.exe
%Temp%\DrTemp\polall1b.exe
%Temp%\thnall1s.exe
%Temp%\morphrec.exe
Adds the value:
"[File name of adware]" = "[File path to adware]"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove BTGrab.dll from Windows startup using RegRun Startup Optimizer.

%windir%\btuihgter.exe

%WinDir%\BTuihgter.exe is Trojan/Backdoor.
Kill the process BTuihgter.exe and remove BTuihgter.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%windir%\c.dll

C.dll is a Trojan Backdoor.IRC.Ratsou.B.
C.dll spreads via open network shares.
Related files:
C:\Note.exe
%System%\Hid.exe
%System%\Explorer.dll
%System%\Iexplore.dll
%Windir%\Aim.dll
%Windir%\Boot.exe
%Windir%\C.dll
%Windir%\Crazy.exe
%Windir%\Dr.exe
%Windir%\Empavms.exe
%Windir%\Ipservers.dll
%Windir%\Java.dll
%Windir%\LibParse.exe
%Windir%\Lsass.exe
%Windir%\Miconfig.exe
%Windir%\Moo.dll
%Windir%\Msccl.dll
%Windir%\Msconig.exe
%Windir%\Nhtml.dll
%Windir%\Ratsou.exe
%Windir%\Regedit.dll
%Windir%\Restart.exe
%Windir%\Screen.dll
%Windir%\Sysboot.dll
%Windir%\Syste32.dll
%Windir%\Users.dll
%Windir%\Wind.dll
Adds the value:
"HID.EXE"="%System%\HID.EXE"
"lsass"="%Windir%\Debug\UserMode\lsass.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove C.dll from Windows startup using RegRun Startup Optimizer.

%windir%\calc.exe

%WinDir%\calc.exe is Trojan.Lydra.
Related files:
%UserProfile%\All Users\Start Menu\Programs\Startup\AdobeGammaLoader.scr
%Windir%\calc.exe
%Windir%\lsassv.exe
%Windir%\msrpc.exe
%Windir%\mui\rctfd.sys
%Windir%\regedit.exe
%Windir%\winsys.exe
%Windir%\iecomn.dll
%Windir%\viaud.dll
%Windir%\pool32.dll
%Windir%\setupiwz.dll
%Windir%\unrar.dll
Read more: http://www.symantec.com/enterprise/secur...
Kill the process %WinDir%\calc.exe and remove %WinDir%\calc.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%windir%\caner.exe

caner.exe is Trojan/Backdoor.
Kill the process caner.exe and remove caner.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%windir%\cbphook.dll

Cbphook.dll is a Spyware.ChatBlocker.
Cbphook.dll blocks applications.
Related files:
ChatBlocker.exe
Windir%\cbphook.dll
%Windir%\cbsys32.dll
%Windir%\cbtril32.dll
%Windir%\unvise32.exe
%Windir%\vmlmod.dll
%Windir%\winsscap.dll
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove cbphook.dll from Windows startup using RegRun Startup Optimizer.

%windir%\cbsys32.dll

Cbsys32.dll is a Spyware.ChatBlocker.
Cbsys32.dll blocks applications.
Related files:
ChatBlocker.exe
Windir%\cbphook.dll
%Windir%\cbsys32.dll
%Windir%\cbtril32.dll
%Windir%\unvise32.exe
%Windir%\vmlmod.dll
%Windir%\winsscap.dll
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove cbsys32.dll from Windows startup using RegRun Startup Optimizer.

%windir%\cbtril32.dll

Cbtril32.dll is a Spyware.ChatBlocker.
Cbtril32.dll blocks applications.
Related files:
ChatBlocker.exe
Windir%\cbphook.dll
%Windir%\cbsys32.dll
%Windir%\cbtril32.dll
%Windir%\unvise32.exe
%Windir%\vmlmod.dll
%Windir%\winsscap.dll
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove cbtril32.dll from Windows startup using RegRun Startup Optimizer.

%windir%\cdfs.exe

cdfs.exe is rootkit W32/Tilebot-HG.
cdfs.exe is used to hide files, processes and registry.
cdfs.exe is a kernel mode rootkit.
Rootkit contacts remote hacker server using HTTP session.
cdfs.exe spreads via open network shares.
cdfs.exe opens a back door on IRC channels.
cdfs.exe created new system drivers:
service name: "Windows Update Service"
display name: "Windows Update Service"
Adds the value:
HKLM\SYSTEM\CurrentControlSet\Services\Windows Update Service\
to the Windows startup registry keys.

rdriv.sys created new system drivers:
service name: " rdriv"
display name: " rdriv"
Added to registry:
HKLM\SYSTEM\CurrentControlSet\Services\rdriv\

Related files:
%WinDir%\cdfs.exe
%SysDir%\rdriv.sys
Adds the value:
HKLM\SYSTEM\CurrentControlSet\Services\Messenger
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\RemoteRegistry
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\TlntSvr
Start
4
to the Windows startup registry keys.
Added to registry:
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
DoNotAllowXPSP2
1

HKLM\SOFTWARE\Microsoft\Ole
EnableDCOM
N

HKLM\SYSTEM\CurrentControlSet\Control\Lsa
restrictanonymous
1

HKLM\SOFTWARE\Microsoft\Security Center\
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\
More info: http://www.sophos.com/virusinfo/analyses...

%windir%\cdplay.exe

CDPlay.exe is a mass-mailing worm Worm.Win32.LovGate.
CDPlay.exe opens a back door on TCP port 6000.
CDPlay.exe spreads via open network shares.
CDPlay.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%windir%\CDPlay.exe
%system%\Update_OB.exe
%system%\TkBellExe.exe
%system%\spollsv.exe
%system%\Kernel66.dll
Adds the value:
"WinHelp"="%system%\TkBellExe.exe"
"Hardware Profile"=""="%system%\hxdef.exe"
"Microsoft Associates, Inc."=" "="%system%\iexplorer.exe"
"SystemTra"=""="%swindir%\CdPlay.exe"
"Shell Extension"=""="%system%\spollsv.exe"
to the Windows startup registry keys.
More info: http://www.viruslist.com/en/viruses/ency...
Removal:
Kill the process CDPlay.exe and remove CDPlay.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%windir%\ced.dll

ced.dll is a Trojan.LegMir-BW.
ced.dll opens a back door.
ced.dll tries to terminate antiviral programs installed on a user computer.
Related files:
%Windows%\assistseex.exe
%Windows%\sllserv.exe
%Windows%\uninstallex.exe
%Windows%\ced.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove ced.dll from Windows startup using RegRun Startup Optimizer.

%windir%\celebrita.exe

Celebrita.exe is a Trojan Dial.DialCar-Q.
Celebrita.exe downloads code from the internet.
Related files:
%Windows%\Celebrita.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill Celebrita.exe process and remove Celebrita.exe from Windows startup using RegRun Startup Optimizer.

%windir%\charmmpxp.exe

charmmpxp.exe is a Trojann.Bancos-KG.
charmmpxp.exe monitors user Internet activity and bank information.
It sends stolen data to a hacker site.
Related files:
%Windows%\charmmpxp.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill charmmpxp.exe process and remove charmmpxp.exe from Windows startup using RegRun Startup Optimizer.

%windir%\chatlogs.dll

%windir%\chckntfs.exe

chckntfs.exe is Trojan/Backdoor.
Kill the process chckntfs.exe and remove chckntfs.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%windir%\checkers5.exe

%WinDir%\checkers5.exe is W32.Formshared.A.
Read more: http://www.symantec.com/enterprise/secur...
Kill the process %WinDir%\checkers5.exe and remove %WinDir%\checkers5.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%windir%\cjet.exe

CJet.exe is a Adware.FFToolBar.
CJet.exe display advertisements.
Related files:
%ProgramFiles%\FastFinder\fftoolbar.dll
%System%\ShowFF.exe
%Windir%\CJet.exe
%Windir%\nnmgr.exe
%Windir%\omi.dll
Adds the value:
"ShowFF" = "C:\Windows\System32\ShowFF.exe"
"nnmgr" = "C:\Windows\nnmgr.exe"
"CJET" = "C:\Windows\CJet.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill CJet.exe process and remove CJet.exe from Windows startup using RegRun Startup Optimizer.

%windir%\clmss.exe

clmss.exe is rootkit W32/Tilebot-AO.
clmss.exe is used to hide files, processes and registry.
clmss.exe is a kernel mode rootkit.
Rootkit contacts remote hacker server using HTTP session.
clmss.exe spreads via open network shares.
clmss.exe opens a back door on IRC channels.
clmss.exe created new system drivers:
service name: "Content List Management Sub System"
display name: " clmss"
Adds the value:
HKLM\SYSTEM\CurrentControlSet\Services\Content List Management Sub System\
to the Windows startup registry keys.

hpdriver.sys is created new system driver:
service name: " hpdriver"
display name: " hpdriver"
Added to registry:
HKLM\SYSTEM\CurrentControlSet\Services\hpdriver\

Related files:
%WinDir%\clmss.exe
%SysDir%\hpdriver.sys
Adds the value:
HKLM\SYSTEM\CurrentControlSet\Services\Messenger
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\RemoteRegistry
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\TlntSvr
Start
4
to the Windows startup registry keys.
Added to registry:
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
DoNotAllowXPSP2
1

HKLM\SOFTWARE\Microsoft\Ole
EnableDCOM
N

HKLM\SYSTEM\CurrentControlSet\Control\Lsa
restrictanonymous
1

HKLM\SOFTWARE\Microsoft\Security Center\
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\
More info: http://www.sophos.com/virusinfo/analyses...

%windir%\cmdpipe.exe

cmdpipe.exe is a Trojan W32.Tilebot-AE.
cmdpipe.exe opens a back door on IRC channels.
cmdpipe.exe spreads via open network shares.
Related files:
%Windows%\cmdpipe.exe
%System%\rofl.sys
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill cmdpipe.exe process and remove cmdpipe.exe from Windows startup using RegRun Startup Optimizer.

%windir%\comctsvc.exe

comctsvc.exe is a Trojan W32.Tilebot-CM.
comctsvc.exe opens a back door on IRC channels.
comctsvc.exe spreads via open network shares.
Related files:
%Windows%\comctsvc.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill comctsvc.exe process and remove comctsvc.exe from Windows startup using RegRun Startup Optimizer.

%windir%\command\sistrai.exe

Sistrai.exe is Trojan/Backdoor Trojan.Prova.
Read more:
http://securityresponse.symantec.com/avc...
Kill the process sistrai.exe and remove %WinDir%\command\sistrai.exe from Windows startup.

%windir%\command\sistray.exe

Sistray.exe is Trojan/Backdoor Trojan.Prova.
Read more:
http://securityresponse.symantec.com/avc...
Kill the process Sistray.exe and remove %WinDir%\Command\Sistray.exe from Windows startup.

%windir%\config\easy.windows.monitoring.exe.exe

Easy.Windows.Monitoring.exe.exe is a mass-mailing worm W32.Renama.A@mm.
Easy.Windows.Monitoring.exe.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%Windir%\system\svchost.exe
%System%\ERSvc.exe
%Windir%\mmsg\mcAfee.Update.exe.exe
%Windir%\mmsg\mmsg.exe.exe
%Windir%\Config\Easy.Windows.Monitoring.exe.exe
%Windir%\Config\system.update.exe.exe
%Windir%\notepad.exe.exe
Adds the value:
"notepad" = "%Windir%\notepad.exe.exe"
"mmsg" = "%Windir%\mmsg\mmsg.exe.exe"
"system.update" = "%Windir%\Config\system.update.exe.exe"
"mcAfee.Instan.Update" = "%Windir%\mmsg\mcAfee.Update.exe.exe"
"Easy.Windows.Monitor" = "%Windir%\Config\Easy.Windows.Monitoring.exe.exe"
"ImagePath" = "%System%\ERSvc.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill the process Easy.Windows.Monitoring.exe.exe and remove Easy.Windows.Monitoring.exe.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%windir%\config\system.update.exe.exe

system.update.exe.exe is a mass-mailing worm W32.Renama.A@mm.
system.update.exe.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%Windir%\system\svchost.exe
%System%\ERSvc.exe
%Windir%\mmsg\mcAfee.Update.exe.exe
%Windir%\mmsg\mmsg.exe.exe
%Windir%\Config\Easy.Windows.Monitoring.exe.exe
%Windir%\Config\system.update.exe.exe
%Windir%\notepad.exe.exe
Adds the value:
"notepad" = "%Windir%\notepad.exe.exe"
"mmsg" = "%Windir%\mmsg\mmsg.exe.exe"
"system.update" = "%Windir%\Config\system.update.exe.exe"
"mcAfee.Instan.Update" = "%Windir%\mmsg\mcAfee.Update.exe.exe"
"Easy.Windows.Monitor" = "%Windir%\Config\Easy.Windows.Monitoring.exe.exe"
"ImagePath" = "%System%\ERSvc.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill the process system.update.exe.exe and remove system.update.exe.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%windir%\confini.exe

confini.exe is a Trojan.LeechPie-D.
confini.exe opens a back door.
confini.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%Windows%\pk.log
%Windows%\un\ComDlg.dll
%Windows%\un\ComDlg.ocx
%Windows%\un\CommonDlg32.pk1
%Windows%\un\CommonDlg32.pk2
%Windows%\un\acls.exe
%Windows%\un\admdll.dll
%Windows%\un\confini.exe
%Windows%\un\delsrv.exe
%Windows%\un\dtreg.exe
%Windows%\un\exe.bat
%Windows%\un\exec.bat
%Windows%\un\hiderun.exe
%Windows%\un\kill.exe
%Windows%\un\ntsvc.ocx
%Windows%\un\scvhost.exe
%Windows%\un\secure.exe
%Windows%\un\secure2.exe
%Windows%\un\serv.exe
%Windows%\un\wmc.exe
%System%\QuicktmeLib.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill confini.exe process and remove confini.exe from Windows startup using RegRun Startup Optimizer.

%windir%\conmand.exe

conmand.exe is a worm W32.Jupir-C.
conmand.exe spreads over IRC chat.
Related files:
\Pacman.exe
\tetris.exe
%Windows%\conmand.com
%Windows%\conmand.exe
%Windows%\ini.bat
%Windows%\win.bat
%Windows%\system32.com
%Windows%\welcome.pif
%Windows%\win.bat
%Windows%\win.pif
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill conmand.exe process and remove conmand.exe from Windows startup using RegRun Startup Optimizer.

%windir%\cp.exe

cp.exe is a Spyware.IamBigBrother.
cp.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
cpanel.exe
nl.exe
ctl3d32.dll
winl.dll
dmm.dll
ma.exe
%System%\DOM.dll
%System%\DartFtp.dll
%System%\DartSock.dll
%System%\EncodeX.dll
%System%\MabryObj.dll
%System%\MimeX.dll
%System%\SmtpX.DLL
%Windir%\cp.exe
Adds the value:
"Windows System Tray" = "[PATH TO SECURITY RISK]"
"Windows Service Manager" = "[PATH TO SECURITY RISK]"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill cp.exe process and remove cpanel.exe from Windows startup using RegRun Startup Optimizer.

%windir%\cpds.exe

cpds.exe is a Trojan.Ghudl-C.
cpds.exe opens a back door.
Related files:
%Windows%\cpds.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill cpds.exe process and remove cpds.exe from Windows startup using RegRun Startup Optimizer.

%windir%\crazy.exe

Crazy.exe is a Trojan Backdoor.IRC.Ratsou.B.
Crazy.exe spreads via open network shares.
Related files:
C:\Note.exe
%System%\Hid.exe
%System%\Explorer.dll
%System%\Iexplore.dll
%Windir%\Aim.dll
%Windir%\Boot.exe
%Windir%\C.dll
%Windir%\Crazy.exe
%Windir%\Dr.exe
%Windir%\Empavms.exe
%Windir%\Ipservers.dll
%Windir%\Java.dll
%Windir%\LibParse.exe
%Windir%\Lsass.exe
%Windir%\Miconfig.exe
%Windir%\Moo.dll
%Windir%\Msccl.dll
%Windir%\Msconig.exe
%Windir%\Nhtml.dll
%Windir%\Ratsou.exe
%Windir%\Regedit.dll
%Windir%\Restart.exe
%Windir%\Screen.dll
%Windir%\Sysboot.dll
%Windir%\Syste32.dll
%Windir%\Users.dll
%Windir%\Wind.dll
Adds the value:
"HID.EXE"="%System%\HID.EXE"
"lsass"="%Windir%\Debug\UserMode\lsass.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill Crazy.exe process and remove Crazy.exe from Windows startup using RegRun Startup Optimizer.

%windir%\crrst32.exe

Crrst32.exe is a Spyware.PCSpy.
Crrst32.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%ProgramFiles%\PCS\pcs.exe
%Windir%\Crrst32.exe
%Windir%\Temp_Ig
Adds the value:
"Dconfig7"="%Windir%\crrst.32.exe"
to the Windows startup registry keys.
More info: http://www.symantec.com/avcenter/venc/da...
Removal:
Kill the process Crrst32.exe and remove Crrst32.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%windir%\crssr.exe

Mass mailing worm W32.Zar.A@mm.
It uses MAPI to send an email to all addresses in the Microsoft Outlook Address Book.
Adds the value:
"CaptionMgr32" = "%Windir%\crssr.exe"
to Windows startup registry keys.
Remove it from Window startup.

%windir%\csrs.exe

csrs.exe is rootkit W32/Tilebot-N.
csrs.exe is used to hide files, processes and registry.
csrs.exe is a kernel mode rootkit.
Rootkit contacts remote hacker server using HTTP session.
csrs.exe spreads via open network shares.
csrs.exe opens a back door on IRC channels.
csrs.exe created new system drivers:
service name: "wservtime"
display name: "Windows Time Sync"
Adds the value:
HKLM\SYSTEM\CurrentControlSet\Services\wservtime\
to the Windows startup registry keys.

rdriv.sys created new system drivers:
service name: "rdriv"
display name: "rdriv"
Added to registry:
HKLM\SYSTEM\CurrentControlSet\Services\rdriv\

Related files:
%WinDir%\csrs.exe
%SysDir%\rdriv.sys
Adds the value:
HKLM\SYSTEM\CurrentControlSet\Services\Messenger
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\RemoteRegistry
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\TlntSvr
Start
4
to the Windows startup registry keys.
Added to registry:
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
DoNotAllowXPSP2
1

HKLM\SOFTWARE\Microsoft\Ole
EnableDCOM
N

HKLM\SYSTEM\CurrentControlSet\Control\Lsa
restrictanonymous
1

HKLM\SOFTWARE\Microsoft\Security Center\
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\
More info: <http://www.sophos.com/virusinfo/analyses...

%windir%\csrss.exe

W32.Sndog@mm Worm.
Adds the value:
"Shockwave" = "%windir%\csrss.exe"
to registry Run key.
Remove it from startup.
Check your hard disk by antiviral software to remove all copies of the worm.
Read more:
http://securityresponse.symantec.com/avc...

%windir%\ctflog.exe

Ctflog.exe is a Trojan.Spexta.
Ctflog.exe spreads by e-mail and via open network shares.
Ctflog.exe is program that relays spam.
Related files:
%Windir%\ctflog.exe
%Windir%\explore.exe
%Windir%\inetinfomon.exe
%Windir%\MPM.exe
%Windir%\service.exe
%Windir%\winlog.exe
Adds the value:
"ctflog manager" = "%Windir%\ctflog.exe"
"explore manager" = "%Windir%\explore.exe"
"inetinfomon manager" = "%Windir%\inetinfomon.exe"
"MPM manager" = "%Windir%\MPM.exe"
"service manager" = "%Windir%\service.exe"
"winlog manager" = "%Windir%\winlog.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill ctflog.exe process and remove ctflog.exe from Windows startup using RegRun Startup Optimizer.

%windir%\cu.exe

cu.exe is an adware program Adware.iPend.
cu.exe monitors user Internet activity.
It sends stolen data to a hacker site.
Related files:
C:\Windows\cu.exe
C:\Windows\ip.dll
C:\Windows\Mach.exe
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill cu.exe process and remove cu.exe from Windows startup using RegRun Startup Optimizer.

%windir%\cursors\services.exe

%WinDir%\Cursors\services.exe is Worm.Win32.RussoTuristo.b.
Read more: http://www.viruslist.com/en/viruses/ency...
Kill the process %WinDir%\Cursors\services.exe and remove %WinDir%\Cursors\services.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%windir%\cytob.exe

cytob.exe is a Trojan W32.Tilebot-AY.
cytob.exe opens a back door on IRC channels.
cytob.exe spreads via open network shares.
cytob.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Windows%\cytob.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill cytob.exe process and remove cytob.exe from Windows startup using RegRun Startup Optimizer.

%windir%\d3tl32.exe

%WinDir%\d3tl32.exe is Trojan/Backdoor.
Kill the process %WinDir%\d3tl32.exe and remove %WinDir%\d3tl32.exe from Windows startup.

%windir%\data\services.exe

%WinDir%\data\services.exe is Trojan/Backdoor.
Kill the process %WinDir%\data\services.exe and remove %WinDir%\data\services.exe from Windows startup.

%windir%\dc.exe

%WinDir%\dc.exe is Trojan/Backdoor.
Kill the process %WinDir%\dc.exe and remove %WinDir%\dc.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%windir%\dcmhelp.exe

dcmhelp.exe is a Trojan W32.Sdbot-AJA.
dcmhelp.exe opens a back door on IRC channels.
dcmhelp.exe spreads via open network shares.
Related files:
%Windows%\dcmhelp.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill dcmhelp.exe process and remove dcmhelp.exe from Windows startup using RegRun Startup Optimizer.

%windir%\dcznetv2.exe

dcznetv2.exe is a Trojan W32.Tilebot-O.
dcznetv2.exe opens a back door.
dcznetv2.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Windows%\dcznetv2.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill dcznetv2.exe process and remove dcznetv2.exe from Windows startup using RegRun Startup Optimizer.

%windir%\dealhlpr.dll

Dealhlpr.dll is an adware program Adware.DealHelper.
Dealhlpr.dll downloads and displays advertisements.
Related files:
%Windir%\Dhbrowser.exe
%Windir%\DHP.dll
%Windir%\Dhsvr.exe
%Windir%\DHUpdt.exe
%Windir%\Dealhlpr.dll
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove Dealhlpr.dll from Windows startup using RegRun Startup Optimizer.

%windir%\debug\debugprogram.exe

DebugProgram.exe is a password-stealing Trojan PWSteal.Wowcraft.B.
DebugProgram.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Windir%\smss.exe
%System%\rundll32.com
%System%\finder.com
%Windir%\finder.com
%System%\command.pif
%ProgramFiles%\Internet Explorer\iexplore.com
%ProgramFiles%\Common Files\iexplore.pif
%Windir%\1.com
%Windir%\ExERoute.exe
%System%\MSCONFIG.COM
%System%\dxdiag.com
%System%\regedit.com
%Windir%\Debug\DebugProgram.exe
%windir%\explorer.com
C:\MSCONFIG.SYS
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill DebugProgram.exe process and remove DebugProgram.exe from Windows startup using RegRun Startup Optimizer.

%windir%\deomen.exe

deomen.exe is a Trojan.Lineage-AQ.
deomen.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Windows%\java\winlogin.exe
%Windows%\deomen.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill deomen.exe process and remove deomen.exe from Windows startup using RegRun Startup Optimizer.

%windir%\devldr.exe

devldr.exe is a Trojan W32.Prex-J.
devldr.exe opens a back door on IRC channels.
devldr.exe spreads via open network shares.
Related files:
%Windows%\devldr.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill devldr.exe process and remove devldr.exe from Windows startup using RegRun Startup Optimizer.

%windir%\dfp.exe

%WinDir%\dfp.exe is Backdoor.Trodal.
Kill the process %WinDir%\dfp.exe and remove %WinDir%\dfp.exe from Windows startup using RegRun.
www.regrun.com
Read more: http://www.symantec.com/avcenter/venc/da...

%windir%\dhbrowser.exe

Dhbrowser.exe is an adware program Adware.DealHelper.
Dhbrowser.exe downloads and displays advertisements.
Related files:
%Windir%\Dhbrowser.exe
%Windir%\DHP.dll
%Windir%\Dhsvr.exe
%Windir%\DHUpdt.exe
%Windir%\Dealhlpr.dll
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill Dhbrowser.exe process and remove Dhbrowser.exe from Windows startup using RegRun Startup Optimizer.

%windir%\dhcp.exe

%WinDir%\dhcp.exe is W32/Tilebot-JU.
Related files:
%System%\ftp.exe
%System%\sfc.dll
%System%\tftp.exe
Read more: http://www.sophos.com/security/analyses/...
Kill the process %WinDir%\dhcp.exe and remove %WinDir%\dhcp.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%windir%\dhp.dll

DHP.dll is an adware program Adware.DealHelper.
DHP.dll downloads and displays advertisements.
Related files:
%Windir%\Dhbrowser.exe
%Windir%\DHP.dll
%Windir%\Dhsvr.exe
%Windir%\DHUpdt.exe
%Windir%\Dealhlpr.dll
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove DHP.dll from Windows startup using RegRun Startup Optimizer.

%windir%\dhsvr.exe

Dhsvr.exe is an adware program Adware.DealHelper.
Dhsvr.exe downloads and displays advertisements.
Related files:
%Windir%\Dhbrowser.exe
%Windir%\DHP.dll
%Windir%\Dhsvr.exe
%Windir%\DHUpdt.exe
%Windir%\Dealhlpr.dll
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill Dhsvr.exe process and remove Dhsvr.exe from Windows startup using RegRun Startup Optimizer.

%windir%\dhu.exe

dhu.exe is a Trojan.AdClick-BJ.
dhu.exe downloads code from the internet.
Related files:
%Windows%\dh.dll
%Windows%\dhu.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill dhu.exe process and remove dhu.exe from Windows startup using RegRun Startup Optimizer.

%windir%\dhupdt.exe

DHUpdt.exe is an adware program Adware.DealHelper.
DHUpdt.exe downloads and displays advertisements.
Related files:
%Windir%\Dhbrowser.exe
%Windir%\DHP.dll
%Windir%\Dhsvr.exe
%Windir%\DHUpdt.exe
%Windir%\Dealhlpr.dll
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill DHUpdt.exe process and remove DHUpdt.exe from Windows startup using RegRun Startup Optimizer.

%windir%\dialer\_antispy.exe

_antispy.exe is a dialer program Dialer.Antispy.
_antispy.exe attempts to terminate some applications.
Related files:
%WINDOWS%\Dialer\_antispy.exe
Adds the value:
"antispy" = "%WINDOWS%\Dialer\_antispy.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill _antispy.exe process and remove _antispy.exe from Windows startup using RegRun Startup Optimizer.

%windir%\dinst.exe

dinst.exe is an Aurora spyware/adware.
Related files:
%WinDir%\dinst.exe
Removal:
Kill dinst.exe process and remove dinst.exe from Windows startup using RegRun Startup Optimizer.

%windir%\dlcomcnf.exe

dlcomcnf.exe is a Trojan.Xbot-F.
dlcomcnf.exe opens a back door on IRC channels.
dlcomcnf.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Windows%\sysload.exe
%Windows%\dlcomcnf.exe
%Windows%\svchost.exe
%Windows%\svchost.ini
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill dlcomcnf.exe process and remove dlcomcnf.exe from Windows startup using RegRun Startup Optimizer.

%windir%\dllhlp.exe

Trojan program Win32.Bizten.gen
Remove it from startup.
Restart your computer.
After that delete the files:
startupfolder+\msupdate.exe
startupfolder+\winlgn.exe
systemroot+\dllhlp.exe
trojan.win32.bizten.gen.exe

%windir%\dlmax.dll

Dlmax.dll is an adware program Adware.BetterInternet.
Dlmax.dll is a Browser Helper Object.
Dlmax.dll downloads and displays advertisements.
Related files:
%Windir%\Bi.dll
%Windir%\speeryox.dll
%Windir%\Mxtarget.dll
%Windir%\BTGrab.dll
%Windir%\farmmext.exe
%Windir%\dlmax.dll
%Windir%\speer2.dll
%Windir%\VoiceIP.dll
%Windir%\morphacl.dll
%Windir%\Pynix.dll
%Windir%\Biprep.exe
%Windir%\banner.dll
%System%\laziqn.exe
%System%\xxvyaj.exe
%System%\wbtvsffd.exe
%System%\nnmzoq.exe
%Temp%\DrTemp\thnall1b.exe
%Temp%\DrTemp\thnall1p.exe
%Temp%\DrTemp\thnall2r.exe
%Temp%\DrTemp\polall1b.exe
%Temp%\thnall1s.exe
%Temp%\morphrec.exe
Adds the value:
"[File name of adware]" = "[File path to adware]"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove dlmax.dll from Windows startup using RegRun Startup Optimizer.

%windir%\dodrrr.exe

dodrrr.exe is a Trojan.Gamqowi.
dodrrr.exe opens a back door on TCP port 4661.
dodrrr.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%Windir%\mwfirewall.exe
%Windir%\svch0st.exe
%Windir%\mscore32.dll
%Windir%\dodrrr.exe
%Windir%\msconfl.dat
Adds the value:
"ms_anti_spyware" = "%Windir%\mwfirewall.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill dodrrr.exe process and remove dodrrr.exe from Windows startup using RegRun Startup Optimizer.

%windir%\downloaded program files\cnshook.dll

cnshook.dll is a Spyware.CnsMin
Remove cnshook.dll using RegRun "Scan for Viruses" feature.
http://www.regrun.com

%windir%\downloaded program files\downloadhtml.dll

DownloadHtml.dll is an adware program Adware.AdBars.
DownloadHtml.dll is a Browser Helper Object.
DownloadHtml.dll displays advertisement web pages.
Related files:
%System%\AdBar.dll
%Windir%\Downloaded Program Files\DownloadHtml.dll
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove DownloadHtml.dll from Windows startup using RegRun Startup Optimizer.

%windir%\downloaded program files\gsda.dll

gsda.dll is a Adware.GameSpyArcade.
gsda.dll download and display advertisements.
Related files:
Aphex.exe
fpupdate.exe
GSAPak.exe
RptCrash.exe
ArcRes.dll
gslan.dll
gsws.dll
pw32.dll
%Windir%\Downloaded Program Files\gsda.dll
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove gsda.dll from Windows startup using RegRun Startup Optimizer.

%windir%\downloaded program files\hbinstie.dll

HbInstIE.dll is an adware program Adware.Hotbar.
HbInstIE.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Windir%\Downloaded Program Files\HbInstIE.dll
%System%\HbGuard.exe
hotbar.exe
HBCORESRV.DLL
HBINST.EXE
HbToolbar.dll
HBHOSTOE.DLL
HBHOSTOL.DLL
HBHOSTIE.DLL
HBSRV.EXE
ShprRprt.exe
ShprRpt.dll
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove HbInstIE.dll from Windows startup using RegRun Startup Optimizer.

%windir%\downloaded program files\load.exe

Load.exe is a Spyware.Apropos.
Load.exe is a Browser Helper Object.
Load.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Windir%\Downloaded Program Files\load.exe
%Windir%\Downloaded Program Files\monpop.exe
%Windir%\Downloaded Program Files\pop225.dll
%Windir%\Downloaded Program Files\pophook4.dll
%Windir%\Downloaded Program Files\PopSrv225.exe
%Temp%\auto_update_loader.exe
%Temp%\install_ct.exe
%Temp%\CXtPls.exe
%Temp%\ProxyStub.dll
%Temp%\WinGenerics.dll
%Temp%\ace.dll
%Temp%\atla.dll
%Temp%\atlw.dll
%Temp%\data.bin
%Temp%\libexpat.dll
%Temp%\ph.exe
%Temp%\pm.exe
%Temp%\setup.inf
%Temp%\uninstaller.exe
%Temp%\atl.dll
%System%\atmon.exe
%System%\intfaxui.exe
Adds the value:
"POP" = "C:\WINDOWS\Downloaded Program Files\PopSrv225.exe"
"AutoLoaderEnvoloAutoUpdater" = "auto_update_loader.exe"
"[random name]" = "intfaxui.exe"
"[random name]" = "atmon.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill load.exe process and remove load.exe from Windows startup using RegRun Startup Optimizer.

%windir%\downloaded program files\mediaaccx.dll

%WinDir%\Downloaded Program Files\MediaAccX.dll is Trojan Windupdates.
Read more: http://www.spywaredata.com/spyware/threa...
Kill the file %WinDir%\Downloaded Program Files\MediaAccX.dll and remove %WinDir%\Downloaded Program Files\MediaAccX.dll from Windows startup using RegRun.
www.regrun.com

%windir%\downloaded program files\monpop.exe

Monpop.exe is a Spyware.Apropos.
Monpop.exe is a Browser Helper Object.
Monpop.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Windir%\Downloaded Program Files\load.exe
%Windir%\Downloaded Program Files\monpop.exe
%Windir%\Downloaded Program Files\pop225.dll
%Windir%\Downloaded Program Files\pophook4.dll
%Windir%\Downloaded Program Files\PopSrv225.exe
%Temp%\auto_update_loader.exe
%Temp%\install_ct.exe
%Temp%\CXtPls.exe
%Temp%\ProxyStub.dll
%Temp%\WinGenerics.dll
%Temp%\ace.dll
%Temp%\atla.dll
%Temp%\atlw.dll
%Temp%\data.bin
%Temp%\libexpat.dll
%Temp%\ph.exe
%Temp%\pm.exe
%Temp%\setup.inf
%Temp%\uninstaller.exe
%Temp%\atl.dll
%System%\atmon.exe
%System%\intfaxui.exe
Adds the value:
"POP" = "C:\WINDOWS\Downloaded Program Files\PopSrv225.exe"
"AutoLoaderEnvoloAutoUpdater" = "auto_update_loader.exe"
"[random name]" = "intfaxui.exe"
"[random name]" = "atmon.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill monpop.exe process and remove monpop.exe from Windows startup using RegRun Startup Optimizer.

%windir%\downloaded program files\pop225.dll

Pop225.dll is a Spyware.Apropos.
Pop225.dll is a Browser Helper Object.
Pop225.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Windir%\Downloaded Program Files\load.exe
%Windir%\Downloaded Program Files\monpop.exe
%Windir%\Downloaded Program Files\pop225.dll
%Windir%\Downloaded Program Files\pophook4.dll
%Windir%\Downloaded Program Files\PopSrv225.exe
%Temp%\auto_update_loader.exe
%Temp%\install_ct.exe
%Temp%\CXtPls.exe
%Temp%\ProxyStub.dll
%Temp%\WinGenerics.dll
%Temp%\ace.dll
%Temp%\atla.dll
%Temp%\atlw.dll
%Temp%\data.bin
%Temp%\libexpat.dll
%Temp%\ph.exe
%Temp%\pm.exe
%Temp%\setup.inf
%Temp%\uninstaller.exe
%Temp%\atl.dll
%System%\atmon.exe
%System%\intfaxui.exe
Adds the value:
"POP" = "C:\WINDOWS\Downloaded Program Files\PopSrv225.exe"
"AutoLoaderEnvoloAutoUpdater" = "auto_update_loader.exe"
"[random name]" = "intfaxui.exe"
"[random name]" = "atmon.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove pop225.dll from Windows startup using RegRun Startup Optimizer.

%windir%\downloaded program files\pophook4.dll

Pophook4.dll is a Spyware.Apropos.
Pophook4.dll is a Browser Helper Object.
Pophook4.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Windir%\Downloaded Program Files\load.exe
%Windir%\Downloaded Program Files\monpop.exe
%Windir%\Downloaded Program Files\pop225.dll
%Windir%\Downloaded Program Files\pophook4.dll
%Windir%\Downloaded Program Files\PopSrv225.exe
%Temp%\auto_update_loader.exe
%Temp%\install_ct.exe
%Temp%\CXtPls.exe
%Temp%\ProxyStub.dll
%Temp%\WinGenerics.dll
%Temp%\ace.dll
%Temp%\atla.dll
%Temp%\atlw.dll
%Temp%\data.bin
%Temp%\libexpat.dll
%Temp%\ph.exe
%Temp%\pm.exe
%Temp%\setup.inf
%Temp%\uninstaller.exe
%Temp%\atl.dll
%System%\atmon.exe
%System%\intfaxui.exe
Adds the value:
"POP" = "C:\WINDOWS\Downloaded Program Files\PopSrv225.exe"
"AutoLoaderEnvoloAutoUpdater" = "auto_update_loader.exe"
"[random name]" = "intfaxui.exe"
"[random name]" = "atmon.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove pophook4.dll from Windows startup using RegRun Startup Optimizer

%windir%\downloaded program files\popsrv225.exe

PopSrv225.exe is a Spyware.Apropos.
PopSrv225.exe is a Browser Helper Object.
PopSrv225.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Windir%\Downloaded Program Files\load.exe
%Windir%\Downloaded Program Files\monpop.exe
%Windir%\Downloaded Program Files\pop225.dll
%Windir%\Downloaded Program Files\pophook4.dll
%Windir%\Downloaded Program Files\PopSrv225.exe
%Temp%\auto_update_loader.exe
%Temp%\install_ct.exe
%Temp%\CXtPls.exe
%Temp%\ProxyStub.dll
%Temp%\WinGenerics.dll
%Temp%\ace.dll
%Temp%\atla.dll
%Temp%\atlw.dll
%Temp%\data.bin
%Temp%\libexpat.dll
%Temp%\ph.exe
%Temp%\pm.exe
%Temp%\setup.inf
%Temp%\uninstaller.exe
%Temp%\atl.dll
%System%\atmon.exe
%System%\intfaxui.exe
Adds the value:
"POP" = "C:\WINDOWS\Downloaded Program Files\PopSrv225.exe"
"AutoLoaderEnvoloAutoUpdater" = "auto_update_loader.exe"
"[random name]" = "intfaxui.exe"
"[random name]" = "atmon.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill PopSrv225.exe process and remove PopSrv225.exe from Windows startup using RegRun Startup Optimizer.

%windir%\downloaded program files\potwbar.dll

potwbar.dll is a Adware.EZToolbar.
potwbar.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Windir%\Downloaded Program Files\potwbar.dll
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove potwbar.dll from Windows startup using RegRun Startup Optimizer.

%windir%\dr.exe

Dr.exe is a Trojan Backdoor.IRC.Ratsou.B.
Dr.exe spreads via open network shares.
Related files:
C:\Note.exe
%System%\Hid.exe
%System%\Explorer.dll
%System%\Iexplore.dll
%Windir%\Aim.dll
%Windir%\Boot.exe
%Windir%\C.dll
%Windir%\Crazy.exe
%Windir%\Dr.exe
%Windir%\Empavms.exe
%Windir%\Ipservers.dll
%Windir%\Java.dll
%Windir%\LibParse.exe
%Windir%\Lsass.exe
%Windir%\Miconfig.exe
%Windir%\Moo.dll
%Windir%\Msccl.dll
%Windir%\Msconig.exe
%Windir%\Nhtml.dll
%Windir%\Ratsou.exe
%Windir%\Regedit.dll
%Windir%\Restart.exe
%Windir%\Screen.dll
%Windir%\Sysboot.dll
%Windir%\Syste32.dll
%Windir%\Users.dll
%Windir%\Wind.dll
Adds the value:
"HID.EXE"="%System%\HID.EXE"
"lsass"="%Windir%\Debug\UserMode\lsass.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill Dr.exe process and remove Dr.exe from Windows startup using RegRun Startup Optimizer.

%windir%\dskcheck.exe

dskcheck.exe is a Trojan W32/Tilebot-CQ.
dskcheck.exe opens a back door on IRC channels.
dskcheck.exe spreads via open network shares.
dskcheck.exe tries to terminate antiviral programs installed on a user computer.
dskcheck.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Windows%\dskcheck.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill dskcheck.exe process and remove dskcheck.exe from Windows startup using RegRun Startup Optimizer.

%windir%\dsndup.exe

%WinDir%\DSNDUP.EXE is Adware.Findwhatever.
Adware.Findwhatever is an adware program that periodically changes the Internet Explorer start page.
Related files:
%Windir%\smss.exe
%Windir%\mshepl.exe
%Windir%\mssetup.exe
%Windir%\svchost.exe
%Windir%\ups.exe
%Windir%\xcopy.exe
%Windir%\mdm.exe
%Windir%\dpvsetup.exe
%Windir%\autolfn.exe
%Windir%\csrss.exe
%Windir%\label.exe
%Windir%\mmc.exe
%Windir%\msswchx.exe
%Windir%\mstask.exe
%Windir%\netdde.exe
%Windir%\ntvdm.exe
%Windir%\osk.exe
%Windir%\lasss.exe
%Windir%\spoolsv.exe
%Windir%\sptsupd.exe
%Windir%\subst.exe
%Windir%\w32tm.exe
%Windir%\mshta.exe
%Windir%\dsndup.exe
Read more: http://www.symantec.com/security_respons...
Kill the process %WinDir%\DSNDUP.EXE and remove %WinDir%\DSNDUP.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

%windir%\dtreg.exe

dtreg.exe is a Trojan.LeechPie-D.
dtreg.exe opens a back door.
dtreg.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%Windows%\pk.log
%Windows%\un\ComDlg.dll
%Windows%\un\ComDlg.ocx
%Windows%\un\CommonDlg32.pk1
%Windows%\un\CommonDlg32.pk2
%Windows%\un\acls.exe
%Windows%\un\admdll.dll
%Windows%\un\confini.exe
%Windows%\un\delsrv.exe
%Windows%\un\dtreg.exe
%Windows%\un\exe.bat
%Windows%\un\exec.bat
%Windows%\un\hiderun.exe
%Windows%\un\kill.exe
%Windows%\un\ntsvc.ocx
%Windows%\un\scvhost.exe
%Windows%\un\secure.exe
%Windows%\un\secure2.exe
%Windows%\un\serv.exe
%Windows%\un\wmc.exe
%System%\QuicktmeLib.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill dtreg.exe process and remove dtreg.exe from Windows startup using RegRun Startup Optimizer.

%windir%\dupadirect.exe

dupadirect.exe is a Trojan.Dupa-C.
dupadirect.exe opens a back door.
Related files:
%Windows%\dupadirect.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill dupadirect.exe process and remove dupadirect.exe from Windows startup using RegRun Startup Optimizer.

%windir%\dupadupam1.exe

dupadupam1.exe is a Trojan.Agent-AAJ.
dupadupam1.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Windows%\dupadupam1.exe
%Windows%\waudio.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill dupadupam1.exe process and remove dupadupam1.exe from Windows startup using RegRun Startup Optimizer.

%windir%\dupadupam2.exe

dupadupam2.exe is a Trojan.Dupa-B.
dupadupam2.exe opens a back door.
Related files:
%Windows%\dupadupam2.exe
%Windows%\waudio.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill dupadupam2.exe process and remove dupadupam2.exe from Windows startup using RegRun Startup Optimizer.

%windir%\dvpd.dll

Dvpd.dll is a Trojan Backdoor.Nibu.J.
Dvpd.dll spreads via open network shares.
Dvpd.dll tries to terminate antiviral programs installed on a user computer.
Dvpd.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\winldra.exe
%Windir%\dvpd.dll
%Windir%\netdx.dat
%Windir%\socks.dat
%Windir%\prntsvra.dll
%Windir%\TEMP\fa4537ef.tmp
%Windir%\prntk.log
%Windir%\prntc.log
Adds the value:
"load32" = "%System%\winldra.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove dvpd.dll from Windows startup using RegRun Startup Optimizer.

%windir%\edit.exe

Edit.exe is rootkit W32/Sdbot-AAY.
Edit.exe is used to hide files, processes and registry.
Edit.exe is a kernel mode rootkit.
Rootkit contacts remote hacker server using HTTP session.
Edit.exe spreads via open network shares.
Edit.exe opens a back door on IRC channels.
Edit.exe created new system drivers:
service name: 'HexadecimaRepresentation"
display name: "hexadecimal"

rdriv.sys created new system drivers:
service name: "rdriv"
display name: "rdriv"
Added to registry:
HKLM\SYSTEM\CurrentControlSet\Services\rdriv\

Related files:
%WinDir%\Edit.exe
%SysDir%\rdriv.sys
More info: http://www.sophos.com/virusinfo/analyses...

%windir%\eid.exe

%WinDir%\eid.exe is Trojan/Backdoor Troj/Hogdown-D.
Kill the process %WinDir%\eid.exe and remove %WinDir%\eid.exe from Windows startup.

%windir%\einfo.exe

Einfo.exe is a Trojan.GrayBrd-BD.
Einfo.exe opens a back door.
Related files:
%Windows%\Einfo.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill Einfo.exe process and remove Einfo.exe from Windows startup using RegRun Startup Optimizer.

%windir%\eiunin2.exe

eiunin2.exe is a Trojan.Alexmo.
eiunin2.exe spreads by e-mail.
eiunin2.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Desktop%\jump.url
%Windir%\eiunin2.exe
%Windir%\Temp\start5\install.DAT
%Windir%\Temp\start5\log1.txt
%Windir%\Temp\start5\msg.exe
%Windir%\Temp\start5\Start.exe
%Windir%\Temp\start5\data\img.bmp
%Windir%\Temp\start5\data\read.txt
%Documents and Settings%\[user id]\Local Settings\Temp\EINSTALL\INSTALL.EXE
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill eiunin2.exe process and remove eiunin2.exe from Windows startup using RegRun Startup Optimizer.

%windir%\eksplorasi.exe

eksplorasi.exe is a mass-mailing worm W32.Rontokbro.K@mm.
eksplorasi.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%UserProfile%\Local Settings\Application Data\csrss.exe
%UserProfile%\Local Settings\Application Data\inetinfo.exe
%UserProfile%\Local Settings\Application Data\lsass.exe
%UserProfile%\Local Settings\Application Data\services.exe
%UserProfile%\Local Settings\Application Data\smss.exe
%UserProfile%\Local Settings\Application Data\winlogon.exe
%UserProfile%\Start Menu\Programs\Startup\Empty.pif
%UserProfile%\Templates\Brengkolang.com
%Windir%\eksplorasi.exe
%Windir%\ShellNew\sempalong.exe
%System%\[USER NAME]'s Setting.scr
Adds the value:
"Shell" = "Explorer.exe "%Windir%\eksplorasi.exe""
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill eksplorasi.exe process and remove eksplorasi.exe from Windows startup using RegRun Startup Optimizer.

%windir%\elitemediapop.exe

elitemediapop.exe is a Trojan.DownLd-AAA.
elitemediapop.exe downloads code from the internet.
Related files:
%Windows%\elitemediapop.exe
%Windows%\eliteunstall.exe
%Windows%\mm63.ocx
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill elitemediapop.exe process and remove elitemediapop.exe from Windows startup using RegRun Startup Optimizer.

%windir%\emape.exe

emape.exe is rootkit W32/Tilebot-EM.
emape.exe is used to hide files, processes and registry.
emape.exe is a kernel mode rootkit.
Rootkit contacts remote hacker server using HTTP session.
emape.exe spreads via open network shares.
emape.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%CurrentFolder%\aspr_keys.ini
%SysDir%\rofl.sys
%WinDir%\emape.exe

ntndis.sys is created new system drivers:
service name: "EMAP Service"
display name: "EMAP Service"
Adds the value:
HKLM\SYSTEM\CurrentControlSet\Services\EMAP Service\
to the Windows startup registry keys.

rofl.sys is created new system drivers:
service name: " rofl"
display name: " rofl"
Added to registry:
HKLM\SYSTEM\CurrentControlSet\Services\rofl\

Adds the value:
HKLM\SYSTEM\CurrentControlSet\Services\Messenger
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\RemoteRegistry
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\TlntSvr
Start
4
to the Windows startup registry keys.

Added to registry:
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
DoNotAllowXPSP2
1

HKLM\SOFTWARE\Microsoft\Ole
EnableDCOM
N

HKLM\SYSTEM\CurrentControlSet\Control\Lsa
restrictanonymous
1

HKLM\SOFTWARE\Microsoft\Security Center\
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\

More info: http://www.sophos.com/virusinfo/analyses...

%windir%\empavms.exe

Empavms.exe is a Trojan Backdoor.IRC.Ratsou.B.
Empavms.exe spreads via open network shares.
Related files:
C:\Note.exe
%System%\Hid.exe
%System%\Explorer.dll
%System%\Iexplore.dll
%Windir%\Aim.dll
%Windir%\Boot.exe
%Windir%\C.dll
%Windir%\Crazy.exe
%Windir%\Dr.exe
%Windir%\Empavms.exe
%Windir%\Ipservers.dll
%Windir%\Java.dll
%Windir%\LibParse.exe
%Windir%\Lsass.exe
%Windir%\Miconfig.exe
%Windir%\Moo.dll
%Windir%\Msccl.dll
%Windir%\Msconig.exe
%Windir%\Nhtml.dll
%Windir%\Ratsou.exe
%Windir%\Regedit.dll
%Windir%\Restart.exe
%Windir%\Screen.dll
%Windir%\Sysboot.dll
%Windir%\Syste32.dll
%Windir%\Users.dll
%Windir%\Wind.dll
Adds the value:
"HID.EXE"="%System%\HID.EXE"
"lsass"="%Windir%\Debug\UserMode\lsass.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill Empavms.exe process and remove Empavms.exe from Windows startup using RegRun Startup Optimizer.

%windir%\eodbngt.exe

Eodbngt.exe is an adware program Adware.ZioCom.C.
Eodbngt.exe display advertisements.
Eodbngt.exe monitors user Internet activity.
Related files:
%Windir%\eodbngt.exe
Adds the value:
"nsysconf" = "%Windir%\eodbngt.exe.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill eodbngt.exe process and remove eodbngt.exe from Windows startup using RegRun Startup Optimizer.

%windir%\ermasys32.exe

Ermasys32.exe is a worm W32.Lerma-A.
Ermasys32.exe spreads via open network shares.
Ermasys32.exe deletes files off the computer.
Related files:
%Windows%\Ermasys32.exe
%Windows%\Lasiaf.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill Ermasys32.exe process and remove Ermasys32.exe from Windows startup using RegRun Startup Optimizer.

%windir%\errorhandler.exe

%WinDir%\ERRORHANDLER.exe is Trojan/Backdoor.
Kill the process %WinDir%\ERRORHANDLER.exe and remove %WinDir%\ERRORHANDLER.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%windir%\errorlog.exe

%windir%\etb\nt_hide78.dll

nt_hide78.dll is a Trojan.Elitebar-U.
nt_hide78.dll downloads code from the internet.
Related files:
%WinDir%\etb\nt_hide78.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove nt_hide78.dll from Windows startup using RegRun Startup Optimizer.

%windir%\exeload.exe

exeload.exe is a Trojan.Small-ES.
exeload.exe spreads via open network shares.
Related files:
%Windows%\exeload.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill exeload.exe process and remove exeload.exe from Windows startup using RegRun Startup Optimizer.

%windir%\exeroute.exe

ExERoute.exe is a password-stealing Trojan PWSteal.Wowcraft.B.
ExERoute.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Windir%\smss.exe
%System%\rundll32.com
%System%\finder.com
%Windir%\finder.com
%System%\command.pif
%ProgramFiles%\Internet Explorer\iexplore.com
%ProgramFiles%\Common Files\iexplore.pif
%Windir%\1.com
%Windir%\ExERoute.exe
%System%\MSCONFIG.COM
%System%\dxdiag.com
%System%\regedit.com
%Windir%\Debug\DebugProgram.exe
%windir%\explorer.com
C:\MSCONFIG.SYS
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill ExERoute.exe process and remove ExERoute.exe from Windows startup using RegRun Startup Optimizer.

%windir%\explcrer.exe

explcrer.exe is a Trojan.Agent-FW.
explcrer.exe opens a back door.
explcrer.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Windows%\explcrer.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill explcrer.exe process and remove explcrer.exe from Windows startup using RegRun Startup Optimizer.

%windir%\extel.exe

extel.exe is rootkit W32/Sdbot-AAX.
extel.exe is used to hide files, processes and registry.
extel.exe is a kernel mode rootkit.
Rootkit contacts remote hacker server using HTTP session.
extel.exe spreads via open network shares.
extel.exe opens a back door on IRC channels.
extel.exe tries to terminate antiviral programs installed on a user computer.
extel.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.

extel.exe created new system drivers:
service name: "extel"
display name: "extel"

rdriv.sys created new system drivers:
service name: " rdriv"
display name: " rdriv"
Added to registry:
HKLM\SYSTEM\CurrentControlSet\Services\rdriv\

Related files:
%WinDir%\extel.exe
%SysDir%\rdriv.sys
Added to registry:
HKLM\SOFTWARE\Microsoft\Security Center
AntiVirusDisableNotify
dword:00000001

HKLM\SOFTWARE\Microsoft\Security Center
AntiVirusOverride
dword:00000001

HKLM\SOFTWARE\Microsoft\Security Center
FirewallDisableNotify
dword:00000001

HKLM\SOFTWARE\Microsoft\Security Center
FirewallOverride
dword:00000001

HKLM\SOFTWARE\Microsoft\Security Center
UpdatesDisableNotify
dword:00000001

HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_EXTERNTELECOM

HKLM\SYSTEM\CurrentControlSet\Services\Externtelecom

HKLM\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters
AutoShareServer
dword:00000000

HKLM\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters
AutoShareWks
dword:00000000

HKLM\SYSTEM\CurrentControlSet\Services\lanmanworkstation\parameters
AutoShareServer
dword:00000000

HKLM\SYSTEM\CurrentControlSet\Services\lanmanworkstation\parameters
AutoShareWks
dword:00000000
More info: http://www.sophos.com/virusinfo/analyses...

%windir%\extract.exe

Extract.exe is an adware program Adware.IEPlugin.
Extract.exe monitors user Internet activity.
Extract.exe displays advertising information.
Related files:
%Windir%\pxckdla.exe
%Windir%\pxckdlauninstall.exe
%Windir%\Wupdt.exe
%Windir%\wdskctl.exe
%Windir%\systb.dll
%Windir%\systb.exe
%Windir%\snbho.exe
%Windir%\winserv.exe
%Windir%\extract.exe
%Windir%\rgrt.exe
%Windir%\package_IEPLUGIN4.exe
Adds the value:
"Win Server Updt" = "%WinDir%\[dropped adware file]"
"Win Server" = "%WinDir%\winserv.exe"
"wdskctl" = "C:\Windows\wdskctl.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill extract.exe process and remove extract.exe from Windows startup using RegRun Startup Optimizer.

%windir%\fi49.exe

%windir%\fontloader.exe

FontLoader.exe is a worm W32.Attech-C.
FontLoader.exe downloads code from the internet.
FontLoader.exe spreads via open network shares and by AOL Instant Messenger.
Related files:
%System%\WinOIE789.exe
%System%\WinDash.EXE
%Windows%\FontLoader.exe
%System%\NetMeeting.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill FontLoader.exe process and remove FontLoader.exe from Windows startup using RegRun Startup Optimizer.

%windir%\fonts\smss.exe

We suggest you to remove %WinDir%\fonts\smss.exe from your computer as soon as possible.
%WinDir%\fonts\smss.exe is W32/Brontok-CV.
Related files:
%Windows%\fonts\smss.exe
%System%\oobe\isperror\shell.exe
%System%\IExplorer.exe
%Windows%\System32.exe
%Startup%\Empty.pif
Open.exe
Music.exe
Read more: http://www.sophos.com/security/analyses/...
Kill the process %WinDir%\fonts\smss.exe and remove %WinDir%\fonts\smss.exe from Windows startup.

%windir%\freecell.exe

%Windir%\Freecell.exe is Trojan/Backdoor.
Kill the process %Windir%\Freecell.exe and remove %Windir%\Freecell.exe from Windows startup.
http://securityresponse.symantec.com/avc...

%windir%\g.exe

G.EXE is rootkit Backdoor.Graybird.Q.
G.EXE is used to hide files, processes and registry.
G.EXE is a kernel mode rootkit.
Rootkit contacts remote hacker server using HTTP session.
G.EXE created a Mutex: HUIGEZIVIP_MUTEX.
G.EXE created new system drivers:
service name: "GrayPigeonServer"
display name: "Gray_Pigeon_Server"
Added to registry:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services
\GrayPigeonServer
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Enum\Root
\LEGACY_GrayPigeonServer

Related files:
%Windir%\G.EXE
%Windir%\G.DLL
%Windir%\G_Hook.DLL
%Windir%\GKey.DLL
Adds the value:
"g.exe" = "%Windir%\g.exe"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
to the Windows startup registry keys.

More info: http://www.symantec.com/security_respons...

%windir%\g_server.dll

G_Server.DLL is a Trojan.Feutel-BI.
G_Server.DLL opens a back door.
G_Server.DLL monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Windows%\G_Server.DLL
%Windows%\G_ServerKey.DLL
%Windows%\G_Server_HOOk.DLL
%Windows%\uninstal.bat
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove G_Server.DLL from Windows startup using RegRun Startup Optimizer.

%windir%\g_server.exe

Trojan Feutel
Registers as service GrayPigeonServer.
Creates the following files:
* %Windir%\G_Server.DLL
* %Windir%\G_ServerKey.DLL
* %Windir%\G_Server_Hook.DLL
Depending on the number of running instances it might also create the following:
* %Windir%\G_Server_Hook[digit].DLL

%windir%\g_server_hook.dll

G_Server_HOOk.DLL is a Trojan.Feutel-BI.
G_Server_HOOk.DLL opens a back door.
G_Server_HOOk.DLL monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Windows%\G_Server.DLL
%Windows%\G_ServerKey.DLL
%Windows%\G_Server_HOOk.DLL
%Windows%\uninstal.bat
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove G_Server_HOOk.DLL from Windows startup using RegRun Startup Optimizer.

%windir%\g_server1.2.exe

G_Server1.2.exe is a Troj/GrayBrd-AP.
G_Server1.2.exe opens a back door.
Related files:
%Windows%\G_Server1.2.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill G_Server1.2.exe process and remove G_Server1.2.exe from Windows startup using RegRun Startup Optimizer.

%windir%\g_server2.0.exe

G_Server2.0.exe is a Trojan.Feutel-AD.
G_Server2.0.exe opens a back door.
Related files:
%Windows%\G_Server2.0.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill G_Server2.0.exe process and remove G_Server2.0.exe from Windows startup using RegRun Startup Optimizer.

%windir%\g_serverkey.dll

G_ServerKey.DLL is a Trojan.Feutel-BI.
G_ServerKey.DLL opens a back door.
G_ServerKey.DLL monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Windows%\G_Server.DLL
%Windows%\G_ServerKey.DLL
%Windows%\G_Server_HOOk.DLL
%Windows%\uninstal.bat
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove G_ServerKey.DLL from Windows startup using RegRun Startup Optimizer.

%windir%\g1_server.dll

G1_Server.DLL is a Trojan.Feutel-CE.
G1_Server.DLL opens a back door.
Related files:
%Windows%\G1_Server.exe
%Windows%\G1_Server.DLL
%Windows%\G1_Server_Hook.DLL
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove G1_Server.DLL from Windows startup using RegRun Startup Optimizer.

%windir%\g1_server.exe

G1_Server.exe is a Trojan.Feutel-CE.
G1_Server.exe opens a back door.
Related files:
%Windows%\G1_Server.exe
%Windows%\G1_Server.DLL
%Windows%\G1_Server_Hook.DLL
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill G1_Server.exe process and remove G1_Server.exe from Windows startup using RegRun Startup Optimizer.

%windir%\g1_server_hook.dll

G1_Server_Hook.DLL is a Trojan.Feutel-CE.
G1_Server_Hook.DLL opens a back door.
Related files:
%Windows%\G1_Server.exe
%Windows%\G1_Server.DLL
%Windows%\G1_Server_Hook.DLL
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove G1_Server_Hook.DLL from Windows startup using RegRun Startup Optimizer.

%windir%\gbesgr.exe

gbesgr.exe is a Trojan.Dloade-AAI.
gbesgr.exe opens a back door.
Related files:
%Windows%\degbes.exe
%Windows%\gbesgr.exe
%Windows%\hosts
%Windows%\kl.exe
%Windows%\secure32.html
%System%\paytime.exe
%Windows%\tool1.exe
%Windows%\tool2.exe
%Windows%\tool3.exe
%Windows%\tool4.exe
%Windows%\tool5.exe
%Windows%\toolbar.exe
%Windows%\uniq
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill gbesgr.exe process and remove gbesgr.exe from Windows startup using RegRun Startup Optimizer.

%windir%\gencroot.exe

gencroot.exe is rootkit Trojan.HacDef-X.
gencroot.exe is used to hide files, processes and registry.
gencroot.exe is a kernel mode rootkit.
gencroot.exe created new system drivers:
service name: "Windows Workstation Service"
display name: "Windows Workstation Service"

Related files:
%WinDir%\gencroot.exe

Adds the value:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
gencroot
%WinDir%\gencroot.exe
to the Windows startup registry keys.

More info: http://www.sophos.com/virusinfo/analyses...

%windir%\german.exe

german.exe is a Trojan.BagleDl-AM.
german.exe opens a back door.
german.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\wintems.exe
%System%\foro.exe
%System%\noat.exe
%Windows%\german.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill german.exe process and remove german.exe from Windows startup using RegRun Startup Optimizer.

%windir%\gpinstall.exe

GPinstall.exe is an adware program Adware.PopAdStop.
GPinstall.exe monitors user Internet activity.
Related files:
%Windir%\GPinstall.exe
%Windir%\popadstop.exe
Adds the value:
"PopAdStop"="\popadstop.exe s"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill GPinstall.exe process and remove GPinstall.exe from Windows startup using RegRun Startup Optimizer.

%windir%\gserver2.exe

GServer2.exe is a Trojan.GrayBrd-AK.
GServer2.exe opens a back door.
Related files:
%Windows%\GServer2.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill GServer2.exe process and remove GServer2.exe from Windows startup using RegRun Startup Optimizer.

%windir%\h00kdll.dll

h00kdll.dll is a Trojan.Bravo-C.
h00kdll.dll opens a back door.
Related files:
web.exe
%Windows%\assistse.exe
%Windows%\uninstall.exe
%Windows%\h00kdll.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove h00kdll.dll Windows startup using RegRun Startup Optimizer.

%windir%\hacker.com.cn.exe

Hacker.com.cn.exe is a Trojan.Feutel-CJ.
Hacker.com.cn.exe opens a back door.
Related files:
%Windows%\Hacker.com.cn.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill Hacker.com.cn.exe process and remove Hacker.com.cn.exe from Windows startup using RegRun Startup Optimizer.

%windir%\head24.exe

%WinDir%\Head24.exe is Trojan/Backdoor.
Kill the process Head24.exe and remove Head24.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%windir%\help\d563ba79b410.exe

%WinDir%\Help\D563BA79B410.exe is W32.Gammima.
W32.Gammima is a worm that spreads through removable media and steals information related to the MapleStory online game.
Related files:
%Windir%\Help\D563BA79B410.exe
[DRIVE LETTER]:\Shell.exe
[DRIVE LETTER]:\autorun.inf
%Windir%\Help\D563BA79B410.dll
Read more: http://www.symantec.com/enterprise/secur...
Kill the process %WinDir%\Help\D563BA79B410.exe and remove %WinDir%\Help\D563BA79B410.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%windir%\help\mshook.dll

MShook.dll is a Trojan.Lineage-BG.
MShook.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Windows%\help\MSpass.exe
%Windows%\help\mssj.chi
%Windows%\help\MShook.dll.
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove MShook.dll from Windows startup using RegRun Startup Optimizer.

%windir%\help\mspass.exe

MSpass.exe is a Trojan.Lineage-BG.
MSpass.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Windows%\help\MSpass.exe
%Windows%\help\mssj.chi
%Windows%\help\MShook.dll.
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill MSpass.exe process and remove MSpass.exe from Windows startup using RegRun Startup Optimizer.

%windir%\help_dcc.dll

help_dcc.dll is an adware programs Adware.WinLog.
help_dcc.dll downloads and display pornographic.
help_dcc.dll monitors user Internet activity.
Related files:
%Windir%\help_dcc.dll
%Windir%\help_ecc.dll
Adds the value:
"winlogon"="< path to adware file >"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove help_dcc.dll from Windows startup using RegRun Startup Optimizer.

%windir%\help_ecc.dll

help_ecc.dll is an adware programs Adware.WinLog.
help_ecc.dll downloads and display pornographic.
help_ecc.dll monitors user Internet activity.
Related files:
%Windir%\help_dcc.dll
%Windir%\help_ecc.dll
Adds the value:
"winlogon"="< path to adware file >"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove help_ecc.dll from Windows startup using RegRun Startup Optimizer.

%windir%\helper101.dll

Helper101.dll is a Adware.EnhanceMSearch.
Helper101.dll is a Browser Helper Object.
Helper101.dll displays advertisements.
Related files:
%WinDir%\Helper101.dll
%WinDir%\del.tmp
%WinDir%\searchen.dat
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove Helper101.dll from Windows startup using RegRun Startup Optimizer.

%windir%\hhbveeed.exe

hhbveeed.exe is a mass-mailing worm W32.Sober-X.
hhbveeed.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Windows%\hhbveeed.exe
%Windows%\ConnectionStatus\Microsoft\services.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill hhbveeed.exe process and remove hhbveeed.exe from Windows startup using RegRun Startup Optimizer.

%windir%\hide_evr2.sys

hide_evr2.sys is rootkit Trojan.PWS-ACZ.
hide_evr2.sys is used to hide files, processes and registry.
hide_evr2.sys is a kernel mode rootkit.
hide_evr2.sys monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Rootkit creates new system driver:
service name: "hide_evr2"
display name: "!!!!"
Related files:
%WinDir%\9129837.exe
%WinDir%\hide_evr2.sys
Adds the value:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
ttool
%Windows%\9129837.exe
to the Windows startup registry keys.
More info: http://www.sophos.com/security/analyses/...

%windir%\hiderun.exe

hiderun.exe is a Trojan.LeechPie-D.
hiderun.exe opens a back door.
hiderun.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%Windows%\pk.log
%Windows%\un\ComDlg.dll
%Windows%\un\ComDlg.ocx
%Windows%\un\CommonDlg32.pk1
%Windows%\un\CommonDlg32.pk2
%Windows%\un\acls.exe
%Windows%\un\admdll.dll
%Windows%\un\confini.exe
%Windows%\un\delsrv.exe
%Windows%\un\dtreg.exe
%Windows%\un\exe.bat
%Windows%\un\exec.bat
%Windows%\un\hiderun.exe
%Windows%\un\kill.exe
%Windows%\un\ntsvc.ocx
%Windows%\un\scvhost.exe
%Windows%\un\secure.exe
%Windows%\un\secure2.exe
%Windows%\un\serv.exe
%Windows%\un\wmc.exe
%System%\QuicktmeLib.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill hiderun.exe process and remove hiderun.exe from Windows startup using RegRun Startup Optimizer.

%windir%\hiklmnop27.exe

hiklmnop27.exe is a Trojan.VB-VT.
hiklmnop27.exe modifies data on the computer.
Related files:
%Windows%\abcdefg23.exe
%Windows%\hiklmnop27.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill hiklmnop27.exe process and remove hiklmnop27.exe from Windows startup using RegRun Startup Optimizer.

%windir%\ho2stdll.exe

ho2stdll.exe is a Trojan.Banker-HO.
ho2stdll.exe monitors user Internet activity and bank information.
It sends stolen data to a hacker site.
Related files:
%Windows%\ho2stdll.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill ho2stdll.exe process and remove ho2stdll.exe from Windows startup using RegRun Startup Optimizer.

%windir%\hpsv.exe

HPSV.exe is a Backdoor W32.Zotob.I.
HPSV.exe spreads by using the vulnerability in Microsoft Windows Plug and Play Service (Microsoft Security Bulletin MS05-039).
Related files:
%Windir%\HPSV.exe
Adds the value:
"SyBot v2.1 By Sky-Dancer" = "HPSV.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill HPSV.exe process and remove HPSV.exe from Windows startup using RegRun Startup Optimizer.

%windir%\htmlsync.exe

htmlsync.exe is a Trojan.Chorus-B.
htmlsync.exe changes settings for Microsoft Internet Explorer.
Related files:
%Windows%\htmlsync.exe
%System%\isystem.exe
%System%\ldriver.exe
%Windows%\zlibc.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill htmlsync.exe process and remove htmlsync.exe from Windows startup using RegRun Startup Optimizer.

%windir%\ibm00001.dll

ibm00001.dll is a Trojan.Torpig-U.
ibm00001.dll opens a back door.
Related files:
%Windows%\ibm00001.dll
%Windows%\ibm00001.exe
%Windows%\ibm00002.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove ibm00001.dll from Windows startup using RegRun Startup Optimizer.

%windir%\ibm00001.exe

ibm00001.exe is a Trojan.Torpig-U.
ibm00001.exe opens a back door.
Related files:
%Windows%\ibm00001.dll
%Windows%\ibm00001.exe
%Windows%\ibm00002.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill ibm00001.exe process and remove ibm00001.exe from Windows startup using RegRun Startup Optimizer.

%windir%\ibm00002.dll

ibm00002.dll is a Trojan.Torpig-U.
ibm00002.dll opens a back door.
Related files:
%Windows%\ibm00001.dll
%Windows%\ibm00001.exe
%Windows%\ibm00002.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove ibm00002.dll from Windows startup using RegRun Startup Optimizer.

%windir%\iccontrol.exe

iccontrol.exe is a dialer program Dialer.ICcontrol.
Related files:
%Windir%\icc.dll
%Windir%\iccontrol.exe
%Windir%\madchook.dll
%Windir%\natydave1.exe
%Windir%\sp2ydave1.exe
%Windir%\ydave1.exe
%UserTemp%\mc2A.tmp
More info: http://www.symantec.com/avcenter/venc/da...
Removal:
Kill the process iccontrol.exe and remove iccontrol.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%windir%\ie\md1.exe

MD1.exe is a Trojan.Dloader-OR.
MD1.exe downloads code from the internet.
Related files:
%WinDir%\IE\MD1.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill MD1.exe process and remove MD1.exe from Windows startup using RegRun Startup Optimizer.

%windir%\ie\winb_.exe

winB_.exe is a Trojan.Banker-HS.
winB_.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Windows%\ie\winB_.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill winB_.exe process and remove winB_.exe from Windows startup using RegRun Startup Optimizer.

%windir%\iexplore32.dll

iexplore32.dll is rootkit Trojan. Small-DNT.
iexplore32.dll is used to hide files, processes and registry.
iexplore32.dll is a user mode rootkit.
Rootkit contacts remote hacker server using HTTP session.
Related files:
%WinDir%\service32.exe
%WinDir%\iexplore32.dll
Adds the value:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
1
%WinDir%\service32.exe
to the Windows startup registry keys.
More info: http://www.sophos.com/security/analyses/...

%windir%\iexplorex.dll

iexplorex.dll is a Trojan.Havedo.
iexplorex.dll spreads via open network shares.
Related files:
PROJECT.PJX.EXE
%System%\cmd.exe
%Windir%\cmd.lnd
%Windir%\iexplorex.dll
Adds the value:
"(Default)" = "%Windir%\iexplorex.dll"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove iexplorex.dll from Windows startup using RegRun Startup Optimizer.

%windir%\iisdll.dll.vbs

%WinDir%\IISDLL.dll.vbs is VBS.Solow.E.
VBS.Solow.E is a worm that copies itself to removable drives.
Read more: http://www.symantec.com/enterprise/secur...
Kill the file %WinDir%\IISDLL.dll.vbs and remove %WinDir%\IISDLL.dll.vbs from Windows startup using RegRun Reanimator.
http://www.regrun.com

%windir%\image.exe

%windir%\ime\svchost.exe

%WinDir%\IME\svchost.exe is W32.Emiutao.
W32.Emiutao is a worm that spreads through removable storage devices. It also opens a back door on the compromised computer.
Related files:
%Windir%\IME\ime.exe
%Windir%\IME\svchost.exe
%Windir%\IME\Thumbs.db
%Windir%\IME\ime.sys
%Windir%\IME\Thumbs.sys
%UserProfile%\Start Menu\Programs\Startup\Adobe Gamma loader.lnk
%Windir%\IME\MSVBVM60.DLL
%Windir%\IME\MSWINSCK.DEP
%Windir%\IME\MSWINSCK.oca
%Windir%\IME\MSWINSCK.OCX
%Windir%\IME\mswsock.dll
%Windir%\IME\STDOLE2.TLB
%Windir%\IME\VB6.OLB
[DRIVE LETTER]\autorun.inf
[DRIVE LETTER]\Thumbs.dn\1.{3aea-1069-a2de-08002b30309d}\Thumbs.bat
[DRIVE LETTER]\Thumbs.dn\Desctop.ini
Read more: http://www.symantec.com/enterprise/secur...
Kill the process %WinDir%\IME\svchost.exe and remove %WinDir%\IME\svchost.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%windir%\imsins.exe

imsins.exe is a Trojan.Hupigon-U.
imsins.exe opens a back door.
Related files:
%Windows%\imsins.exe
%Windows%\imsins.dll
%Windows%\imsins_Hook.DLL
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill imsins.exe process and remove imsins.exe from Windows startup using RegRun Startup Optimizer.

%windir%\imsins_hook.dll

imsins_Hook.DLL is a Trojan.Hupigon-U.
imsins_Hook.DLL opens a back door.
Related files:
%Windows%\imsins.exe
%Windows%\imsins.dll
%Windows%\imsins_Hook.DLL
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove imsins_Hook.DLL from Windows startup using RegRun Startup Optimizer.

%windir%\inet20004\winlogon.exe

%WinDir%\inet20004\winlogon.exe is Trojan/Backdoor.
Kill the process %WinDir%\inet20004\winlogon.exe and remove %WinDir%\inet20004\winlogon.exe from Windows startup.

%windir%\inetinfomon.exe

Inetinfomon.exe is a Trojan.Spexta.
Inetinfomon.exe spreads by e-mail and via open network shares.
Inetinfomon.exe is program that relays spam.
Related files:
%Windir%\ctflog.exe
%Windir%\explore.exe
%Windir%\inetinfomon.exe
%Windir%\MPM.exe
%Windir%\service.exe
%Windir%\winlog.exe
Adds the value:
"ctflog manager" = "%Windir%\ctflog.exe"
"explore manager" = "%Windir%\explore.exe"
"inetinfomon manager" = "%Windir%\inetinfomon.exe"
"MPM manager" = "%Windir%\MPM.exe"
"service manager" = "%Windir%\service.exe"
"winlog manager" = "%Windir%\winlog.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill inetinfomon.exe process and remove inetinfomon.exe from Windows startup using RegRun Startup Optimizer.

%windir%\inetndata\services.exe

Troj/Krepper-G
Also known as TrojanDownloader.Win32.Krepper.g
It is a Trojan which changes browser settings, downloads and installs/runs new software and modifies the HOSTS file to redirect internet searches.
The Trojan copies itself to the Windows\inetdata folder as services.exe and creates the following registry entries:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\xp_system = c:\windows\inetndata\services.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\xp_system = c:\windows\inetndata\services.exe
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\run = "C:\\WINDOWS\\inetdata\\services.exe"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\(5321E378-FFAD-4999-8C62-03CA8155F0B3)
HKCU\Software\Microsoft\Internet Explorer\Main\Enable Browser Extensions = "yes"

You can automatical remove it from startup with RegRun Startup Optimizer.

%windir%\inf\norbtok.exe

norBtok.exe is a mass-mailing worm W32.Rontokbro.B@mm.
norBtok.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%UserProfile%\Local Settings\Application Data\csrss.exe
%UserProfile%\Local Settings\Application Data\inetinfo.exe
%UserProfile%\Local Settings\Application Data\lsass.exe
%UserProfile%\Local Settings\Application Data\services.exe
%UserProfile%\Local Settings\Application Data\smss.exe
%UserProfile%\Local Settings\Application Data\winlogon.exe
%UserProfile%\Start Menu\Programs\Startup\Empty.pif
%UserProfile%\Templates\A.kotnorB.com
%Windir%\inf\norBtok.exe
%System%\3D Animation.scr
Adds the value:
"Bron-Spizaetus" = "%Windir%\INF\norBtok.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill norBtok.exe process and remove norBtok.exe from Windows startup using RegRun Startup Optimizer.

%windir%\inf\services.exe

%WinDir%\inf\services.exe is Trojan/Backdoor.
Kill the process %WinDir%\inf\services.exe and remove %WinDir%\inf\services.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%windir%\inf\smss.exe

%WinDir%\inf\smss.exe is W32/Kukoo-A.
Related files:
%User%\Application Data\lsass.exe
%Windows%\inf\smss.exe
%System%\Sexy Girls.scr
Read more: http://www.sophos.com/security/analyses/...
Kill the process %WinDir%\inf\smss.exe and remove %WinDir%\inf\smss.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%windir%\inf\stray.exe

%WinDir%\inf\stray.exe is Trojan/Backdoor Hacktool Rootkit.
Kill the process %WinDir%\inf\stray.exe and remove %WinDir%\inf\stray.exe from Windows startup.

%windir%\inf3cted.exe

INF3CTED.EXE is a mass-mailing worm W32.Hilder-A.
INF3CTED.EXE tries to terminate antiviral programs installed on a user computer.
Related files:
funny.exe
unbelieveable.exe
C:\wichtig.exe
C:\FUUU.exe
%Windows%\INF3CTED.EXE
%Windows%\NET5KY.EXE
%Windows%\SA55ER.EXE
%Windows%\MYD00M.EXE
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill the process INF3CTED.EXE and remove INF3CTED.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

%windir%\injobw.exe

injobw.exe is a Trojan.Binjo.
injobw.exe registers porn service without notification.
injobw.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Windir%\injobw.exe
%System%\injobs.exe
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill injobw.exe process and remove injobw.exe from Windows startup using RegRun Startup Optimizer.

%windir%\inlook.exe

inlook.exe is a Spyware.InlookExpress.
inlook.exe logs keystrokes.
Related files:
%Windir%\inlook.exe
%Windir%\is-QV2PM.exe
%Windir%\is-QV2PM.lst
%Windir%\sds20.oca
C:\sds20\final.exe
C:\sds20\IEControl2.exe
C:\sds20\ijl11.dll
C:\sds20\remie20.exe
C:\sds20\settings.dat
C:\sds20\svchost.exe
C:\sds20\svchost32.exe
C:\sds20\TheHook.dll
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill inlook.exe process and remove inlook.exe from Windows startup using RegRun Startup Optimizer.

%windir%\installer2.0.28.exe

%WinDir%\installer2.0.28.exe is Trojan/Backdoor.
Kill the process installer2.0.28.exe and remove installer2.0.28.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%windir%\interbase.exe

INTERBASE.EXE is a Trojan.RemShell-B.
INTERBASE.EXE opens a back door on IRC channels.
Related files:
%Windows%\INTERBASE.EXE
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill INTERBASE.EXE process and remove INTERBASE.EXE from Windows startup using RegRun Startup Optimizer.

%windir%\internat.exe

W32/Protoride-H is a Windows worm that spreads via network shares.
The worm also has a backdoor component that allows a malicious user remote access to an infected computer via the IRC network.
This worm can also copy itself into the shared folders of several peer-to-peer (P2P) file sharing utilities.

Copy itself into the Windows system folder as INTERNAT.EXE and set the following registry entries so that it is executed automatically upon restart:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ "" = \"%1\" %*

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ Windows Taskbar Manager = C:\\internat.exe

In order to run automatically when Windows starts up the worm may change the following registry entry so that it is executed before any EXE files:
HKCR\exefile\shell\open\command\ "" = C:\ "%1 %*"

W32/Protoride-H may also set the registry entry: HKLM\Software\BeyonD inDustries\ProtoType[v3]

Use RegRun Startup Optimizer to remove it from your system.

%windir%\ioptixxx.dll

IoptiXXX.dll is an adware program Adware.NetOptimizer.
IoptiXXX.dll downloads and displays advertisements.
Related files:
%ProgramFiles%\Internet Optimizer\actalert.exe
%ProgramFiles%\Internet Optimizer\optimize.exe
%ProgramFiles%\Internet Optimizer\update\actalert.exe
%Windir%\nemXXX.dll
%Windir%\optimize.exe
%Windir%\wsemXXX.dll
%Windir%\ioptiXXX.dll
Adds the value:
"Internet Optimizer" = "C:\Program Files\Internet Optimizer\optimize.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove ioptiXXX.dll from Windows startup using RegRun Startup Optimizer.

%windir%\ip.dll

ip.dll is an adware program Adware.iPend.
ip.dll monitors user Internet activity.
It sends stolen data to a hacker site.
Related files:
C:\Windows\cu.exe
C:\Windows\ip.dll
C:\Windows\Mach.exe
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove ip.dll from Windows startup using RegRun Startup Optimizer.

%windir%\ipconfig32.exe

ipconfig32.exe is a Trojan W32.Tilebot-AP.
ipconfig32.exe opens a back door on IRC channels.
ipconfig32.exe spreads via open network shares.
ipconfig32.exe tries to terminate antiviral programs installed on a user computer.
ipconfig32.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Windows%\ipconfig32.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill ipconfig32.exe process and remove ipconfig32.exe from Windows startup using RegRun Startup Optimizer.

%windir%\ipservers.dll

Ipservers.dll is a Trojan Backdoor.IRC.Ratsou.B.
Ipservers.dll spreads via open network shares.
Related files:
C:\Note.exe
%System%\Hid.exe
%System%\Explorer.dll
%System%\Iexplore.dll
%Windir%\Aim.dll
%Windir%\Boot.exe
%Windir%\C.dll
%Windir%\Crazy.exe
%Windir%\Dr.exe
%Windir%\Empavms.exe
%Windir%\Ipservers.dll
%Windir%\Java.dll
%Windir%\LibParse.exe
%Windir%\Lsass.exe
%Windir%\Miconfig.exe
%Windir%\Moo.dll
%Windir%\Msccl.dll
%Windir%\Msconig.exe
%Windir%\Nhtml.dll
%Windir%\Ratsou.exe
%Windir%\Regedit.dll
%Windir%\Restart.exe
%Windir%\Screen.dll
%Windir%\Sysboot.dll
%Windir%\Syste32.dll
%Windir%\Users.dll
%Windir%\Wind.dll
Adds the value:
"HID.EXE"="%System%\HID.EXE"
"lsass"="%Windir%\Debug\UserMode\lsass.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove Ipservers.dll from Windows startup using RegRun Startup Optimizer.

%windir%\is-i9h1v.exe

IS-I9H1V.EXE is Trojan/Backdoor.
Kill the process IS-I9H1V.EXE and remove IS-I9H1V.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

%windir%\isnsys.dll

isnsys.dll is a Trojan.Chast-A.
isnsys.dll opens a back door.
isnsys.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Windows%\win16svc.exe
%Windows%\isnopt.dat
%Windows%\isnsys.dll
%Windows%\isnsys32zx.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove isnsys.dll from Windows startup using RegRun Startup Optimizer.

%windir%\isnsys32zx.dll

isnsys32zx.dll is a Trojan.Chast-A.
isnsys32zx.dll opens a back door.
isnsys32zx.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Windows%\win16svc.exe
%Windows%\isnopt.dat
%Windows%\isnsys.dll
%Windows%\isnsys32zx.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove isnsys32zx.dll from Windows startup using RegRun Startup Optimizer.

%windir%\is-puhug.exe

IS-PUHUG.EXE is Trojan/Backdoor.
Kill the process IS-PUHUG.EXE and remove IS-PUHUG.EXE from Windows startup.

%windir%\is-qv2pm.exe

is-QV2PM.exe is a Spyware.InlookExpress.
is-QV2PM.exe logs keystrokes.
Related files:
%Windir%\inlook.exe
%Windir%\is-QV2PM.exe
%Windir%\is-QV2PM.lst
%Windir%\sds20.oca
C:\sds20\final.exe
C:\sds20\IEControl2.exe
C:\sds20\ijl11.dll
C:\sds20\remie20.exe
C:\sds20\settings.dat
C:\sds20\svchost.exe
C:\sds20\svchost32.exe
C:\sds20\TheHook.dll
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill is-QV2PM.exe process and remove is-QV2PM.exe from Windows startup using RegRun Startup Optimizer.

%windir%\isrvs\desktop.exe

Desktop.exe is the new generation of VX2 adware components.
desktop.exe runs from Windows startup registry keys.
Also related files:
%WinDir%\isrvs\ffisearch.exe
%WinDir%\isrvs\desktop.exe
%SysDir%\Drivers\delprot.sys

Removal:
Go to the Safe mode.
Delete the key
HKLM\SYSTEM\CurrentControlSet\Services\Delprot
Remove ffisearch.exe and desktop.exe from Windows startup registry keys using RegRun.
Delete Files:
%WinDir%\isrvs\ffisearch.exe
%WinDir%\isrvs\desktop.exe
%SysDir%\Drivers\delprot.sys

%windir%\isrvs\ffisearch.exe

%windir%\isun0404.exe

IsUn0404.exe is a Trojan.Mifeng-D.
IsUn0404.exe opens a back door.
Related files:
%Windows%\IsUninst.exe
%Windows%\IsUn0404.exe
%Windows%\IsUn0804.exe
%System%\csrss.exe
%System%\smss.exe
%System%\services.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill IsUn0404.exe process and remove IsUn0404.exe from Windows startup using RegRun Startup Optimizer.

%windir%\isun0804.exe

IsUn0804.exe is a Trojan.Mifeng-D.
IsUn0804.exe opens a back door.
Related files:
%Windows%\IsUninst.exe
%Windows%\IsUn0404.exe
%Windows%\IsUn0804.exe
%System%\csrss.exe
%System%\smss.exe
%System%\services.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill IsUn0804.exe process and remove IsUn0804.exe from Windows startup using RegRun Startup Optimizer.

%windir%\isysuninst.exe

IsysUninst.exe is a Trojan.Banker-IJ.
IsysUninst.exe monitors user Internet activity and bank information.
It sends stolen data to a hacker site.
Related files:
%Windows%\IsysUninst.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill IsysUninst.exe process and remove IsysUninst.exe from Windows startup using RegRun Startup Optimizer.

%windir%\ita.exe

%WinDir%\ita.exe is Trojan/Backdoor Win32.Tactslay.
Kill the process %WinDir%\ita.exe and remove %WinDir%\ita.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com
Related files:
- svcrhost.exe
- outIook.exe
- expIorer.exe
- svcshost.exe
- sdhch.exe
- winagent.exe
- svchst.exe
- msnexploren.exe
- msgaol.exe
- deamon.exe
- browse.exe
- s_menu.exe
http://www3.ca.com/securityadvisor/virus...

%windir%\iun6002.exe

%windir%\java.dll

Java.dll is a Trojan Backdoor.IRC.Ratsou.B.
Java.dll spreads via open network shares.
Related files:
C:\Note.exe
%System%\Hid.exe
%System%\Explorer.dll
%System%\Iexplore.dll
%Windir%\Aim.dll
%Windir%\Boot.exe
%Windir%\C.dll
%Windir%\Crazy.exe
%Windir%\Dr.exe
%Windir%\Empavms.exe
%Windir%\Ipservers.dll
%Windir%\Java.dll
%Windir%\LibParse.exe
%Windir%\Lsass.exe
%Windir%\Miconfig.exe
%Windir%\Moo.dll
%Windir%\Msccl.dll
%Windir%\Msconig.exe
%Windir%\Nhtml.dll
%Windir%\Ratsou.exe
%Windir%\Regedit.dll
%Windir%\Restart.exe
%Windir%\Screen.dll
%Windir%\Sysboot.dll
%Windir%\Syste32.dll
%Windir%\Users.dll
%Windir%\Wind.dll
Adds the value:
"HID.EXE"="%System%\HID.EXE"
"lsass"="%Windir%\Debug\UserMode\lsass.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove Java.dll from Windows startup using RegRun Startup Optimizer.

%windir%\java\classes\java.dll

%WinDir%\java\classes\java.dll is W32/SillyFDC-AT.
Related files:
%Windows%\java\classes\java.dll
%System%\kernel32.sys
%System%\mfc48.dll
Read more: http://www.sophos.com/security/analyses/...
Kill the file %WinDir%\java\classes\java.dll and remove %WinDir%\java\classes\java.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

%windir%\jdbgmgrnt.exe

jdbgmgrnt.exe is a Trojan.Bancos-JQ.
jdbgmgrnt.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Windows%\jdbgmgrnt.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill jdbgmgrnt.exe process and remove jdbgmgrnt.exe from Windows startup using RegRun Startup Optimizer.

%windir%\jif.exe

jif.exe is a mass-mailing worm W32.Mytob.MK@mm.
jif.exe opens a back door.
Related files:
%WINDOWS%\jif.exe
Adds the value:
"WINDOWS" = "\jif.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill jif.exe process and remove jif.exe from Windows startup using RegRun Startup Optimizer.

%windir%\kane.exe

kane.exe is a Backdoor.Dckane.
kane.exe spreads via open network shares.
Related files:
%Windir%\kane.exe
%System%\kane.dll
Adds the value:
"Shell" = "Explorer.exe kane.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill kane.exe process and remove kane.exe from Windows startup using RegRun Startup Optimizer.

%windir%\karen.exe

Karen.exe is a mass-mailing worm W32.Gokar.A@mm.
Karen.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%WinDir%\karen.exe
Adds the value:
Karen c:\windows\karen.exe
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill karen.exe process and remove karen.exe from Windows startup using RegRun Startup Optimizer.

%windir%\kernelsxp.exe

kernelsxp.exe is a Trojan.Bancos-GG.
kernelsxp.exe monitors user Internet activity and bank information.
It sends stolen data to a hacker site.
Related files:
%Windows%\kernelsxp.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill kernelsxp.exe process and remove kernelsxp.exe from Windows startup using RegRun Startup Optimizer.

%windir%\kesenjangansosial.exe

KesenjanganSosial.exe is a worm W32.Brontok-L.
KesenjanganSosial.exe spreads by e-mail.
Related files:
%Windows%\KesenjanganSosial.exe
%Windows%\ShellNew\RakyatKelaparan.exe
%System%\cmd-brontok.exe
br6591on.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill KesenjanganSosial.exe process and remove KesenjanganSosial.exe from Windows startup using RegRun Startup Optimizer.

%windir%\keyhook.dll

KeyHook.dll is a Trojan.Netbus-C.
KeyHook.dll opens a back door.
Related files:
%Windows%\KeyHook.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove KeyHook.dll from Windows startup using RegRun Startup Optimizer.

%windir%\keyls.dll

keyls.dll is a Trojan.LdPinch-CF.
keyls.dll opens a back.
keyls.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Windows%\keyls.dll
%Windows%\temp.jpg
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove keyls.dll from Windows startup using RegRun Startup Optimizer.

%windir%\killer.exe

killer.exe is a Trojan.KillAV-FK.
killer.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%Windows%\killer.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill killer.exe process and remove killer.exe from Windows startup using RegRun Startup Optimizer.

%windir%\klg.dll

klg.dll is a Trojan.LdPinch-DY.
klg.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\q_sys.dll
%Windows%\klg.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove klg.dll from Windows startup using RegRun Startup Optimizer.

%windir%\kmc.dll

kmc.dll is a Trojan.Dropper-BT.
kmc.dll opens a back door.
Related files:
%Windows%\csrss.exe
%Windows%\kmc.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove kmc.dll from Windows startup using RegRun Startup Optimizer.

%windir%\kmonitor.exe

Kmonitor.exe is an adware program Spyware.AdvancedKey.
Kmonitor.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Windir%\IDDE\kmonitor.exe
%Windir%\IDDE\trace.exe
%Windir%\system\svchost.exe:
%System%\TMLib.dll
%System%\TMUtils.dll
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill kmonitor.exe process and remove kmonitor.exe from Windows startup using RegRun Startup Optimizer.

%windir%\lasiaf.exe

Lasiaf.exe is a worm W32.Lerma-A.
Lasiaf.exe spreads via open network shares.
Lasiaf.exe deletes files off the computer.
Related files:
%Windows%\Ermasys32.exe
%Windows%\Lasiaf.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill Lasiaf.exe process and remove Lasiaf.exe from Windows startup using RegRun Startup Optimizer.

%windir%\lass.dll

lass.dll is a Trojan.Feutel-AS.
lass.dll opens a back door.
lass.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Windows%\lass.exe
%Windows%\lass.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove lass.dll Windows startup using RegRun Startup Optimizer.

%windir%\lass.exe

lass.exe is a Trojan.Feutel-AS.
lass.exe opens a back door.
lass.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Windows%\lass.exe
%Windows%\lass.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill lass.exe process and remove lass.exe from Windows startup using RegRun Startup Optimizer.

%windir%\lastgood\system32\oleaut32.dll

OLEAUT32.DLL is a Spyware.WinRecon.
OLEAUT32.DLL logs keystrokes and takes screenshots.
Related files:
%ProgramFiles%\WinRecon\codex.exe
%ProgramFiles%\WinRecon\condex.exe
%ProgramFiles%\WinRecon\Dataview.exe
%ProgramFiles%\WinRecon\sp5.exe
%System%\kpAccess.dll
%System%\kpunzip.dll
%System%\kpzip.dll
%System%\MSSTDFMT.DLL
%Windir%\LastGood\System32\OLEAUT32.DLL
%Windir%\LastGood\System32\OLEPRO32.DLL
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove OLEAUT32.DLL from Windows startup using RegRun Startup Optimizer.

%windir%\lastgood\system32\olepro32.dll

OLEPRO32.DLL is a Spyware.WinRecon.
OLEPRO32.DLL logs keystrokes and takes screenshots.
Related files:
%ProgramFiles%\WinRecon\codex.exe
%ProgramFiles%\WinRecon\condex.exe
%ProgramFiles%\WinRecon\Dataview.exe
%ProgramFiles%\WinRecon\sp5.exe
%System%\kpAccess.dll
%System%\kpunzip.dll
%System%\kpzip.dll
%System%\MSSTDFMT.DLL
%Windir%\LastGood\System32\OLEAUT32.DLL
%Windir%\LastGood\System32\OLEPRO32.DLL
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove OLEPRO32.DLL from Windows startup using RegRun Startup Optimizer.

%windir%\lel.exe

lel.exe is a worm W32.Lile-A.
lel.exe spreads via open network shares.
lel.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%Windows%\MSRundll32.exe
%Windows%\lel.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill lel.exe process and remove lel.exe from Windows startup using RegRun Startup Optimizer.

%windir%\lemonyt.exe

lemonyt.exe is a Trojan Backdoor.Banito.
lemonyt.exe spreads via open network shares.
lemonyt.exe logs keystrokes.
Related files:
%Windir%\lemonyt.exe
Adds the value:
"StubPath" = "%Windir%\lemonyt.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill lemonyt.exe process and remove lemonyt.exe from Windows startup using RegRun Startup Optimizer.

%windir%\libimg.dll

Libimg.dll is a Spyware.SpyAgent.B.
Libimg.dll is a commercial keylogger/system-monitoring program.
Related files:
%System%\ntinvisible.dll
%Windir%\libimg.dll
%Windir%\sbrowse.exe
%Windir%\snmpapi.dll
%Windir%\yahoodll.dll
%ProgramFiles%\Spytech Software\Spytech SpyAgent\sagent.exe
%ProgramFiles%\Spytech Software\Spytech SpyAgent\deploy.exe
%ProgramFiles%\Spytech Software\Spytech SpyAgent\nostealth.exe
%ProgramFiles%\Spytech Software\Spytech SpyAgent\sysdiag.exe
Adds the value:
"System32"="%ProgramFiles%\Spytech Software\Spytech SpyAgent\sysdiag.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove libimg.dll from Windows startup using RegRun Startup Optimizer.

%windir%\libparse.exe

LibParse.exe is a Trojan Backdoor.IRC.Ratsou.B.
LibParse.exe spreads via open network shares.
Related files:
C:\Note.exe
%System%\Hid.exe
%System%\Explorer.dll
%System%\Iexplore.dll
%Windir%\Aim.dll
%Windir%\Boot.exe
%Windir%\C.dll
%Windir%\Crazy.exe
%Windir%\Dr.exe
%Windir%\Empavms.exe
%Windir%\Ipservers.dll
%Windir%\Java.dll
%Windir%\LibParse.exe
%Windir%\Lsass.exe
%Windir%\Miconfig.exe
%Windir%\Moo.dll
%Windir%\Msccl.dll
%Windir%\Msconig.exe
%Windir%\Nhtml.dll
%Windir%\Ratsou.exe
%Windir%\Regedit.dll
%Windir%\Restart.exe
%Windir%\Screen.dll
%Windir%\Sysboot.dll
%Windir%\Syste32.dll
%Windir%\Users.dll
%Windir%\Wind.dll
Adds the value:
"HID.EXE"="%System%\HID.EXE"
"lsass"="%Windir%\Debug\UserMode\lsass.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill LibParse.exe process and remove LibParse.exe from Windows startup using RegRun Startup Optimizer.

%windir%\loaddll.dll

Loaddll.dll is a Spyware.Winvest.
Loaddll.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%ProgramFiles%\wv\wvh.dll
%ProgramFiles%\wv\wvres.dll
%ProgramFiles%\wv\wv.exe
%Windir%\sysninit.dll
%Windir%\spoder.dll
%Windir%\syswvnt.dll
%Windir%\syswvh.dll
%Windir%\loaddll.exe
%Windir%\syswvwin.dll
%Windir%\syswvmail.dll
%Windir%\loaddll.dll
Adds the value:
"loaddll" = "loaddll.exe"
"(Default)" = "C:\Program Files\wv\wv.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove loaddll.dll from Windows startup using RegRun Startup Optimizer.

%windir%\loaddll.exe

Loaddll.exe is a Spyware.Winvest.
Loaddll.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%ProgramFiles%\wv\wvh.dll
%ProgramFiles%\wv\wvres.dll
%ProgramFiles%\wv\wv.exe
%Windir%\sysninit.dll
%Windir%\spoder.dll
%Windir%\syswvnt.dll
%Windir%\syswvh.dll
%Windir%\loaddll.exe
%Windir%\syswvwin.dll
%Windir%\syswvmail.dll
%Windir%\loaddll.dll
Adds the value:
"loaddll" = "loaddll.exe"
"(Default)" = "C:\Program Files\wv\wv.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill loaddll.exe process and remove loaddll.exe from Windows startup using RegRun Startup Optimizer.

%windir%\lodctr32.exe

%WinDir%\lodctr32.exe is Trojan/Backdoor.
Kill the process lodctr32.exe and remove lodctr32.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%windir%\logins32.exe

%windir%\logo1_.exe

Logo1_.exe is a worm W32.Looked.E.
Logo1_.exe spreads via open network shares.
Logo1_.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%Windir%\Logo1_.exe
virDll.dll
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill Logo1_.exe process and remove Logo1_.exe from Windows startup using RegRun Startup Optimizer.

%windir%\lovcx.exe

lovcx.exe is a Trojan.Shpiel-A.
lovcx.exe opens a back door.
Related files:
%Windows%\msnupdate.exe
%Windows%\winfog.exe
%Windows%\winsys.exe
%Windows%\lsass1.exe
%Windows%\lovcx.exe
%Windows%\winsress.exe
%Windows%\winlog.exe
%Windows%\winsock.exe
%Windows%\saveruser.exe
%Windows%\winbackup.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill lovcx.exe process and remove lovcx.exe from Windows startup using RegRun Startup Optimizer.

%windir%\lsa.exe

lsa.exe is rootkit W32/Sdbot-YV.
lsa.exe is used to hide files, processes and registry.
lsa.exe is a kernel mode rootkit.
Rootkit contacts remote hacker server using HTTP session.
MSDIRECTX.SYS created new system drivers:
service name: "MSDIRECTX"
display name: "MSDIRECTX"
Related files:
%WinDir%\lsa.exe
%SysDir%\MSDIRECTX.SYS
Adds the value:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
LSA
lsa.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
LSA
lsa.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices
LSA
lsa.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
LSA
lsa.exe

HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\wuauserv
Start
4
to the Windows startup registry keys.
Added to registry:
HKCU\SYSTEM\CurrentControlSet\Control\Lsa
LSA
lsa.exe

HKLM\SYSTEM\CurrentControlSet\Control\Lsa
LSA
lsa.exe

HKCU\Software\Microsoft\OLE
LSA
lsa.exe

HKLM\SOFTWARE\Microsoft\Ole
LSA
lsa.exe

HKLM\SOFTWARE\Microsoft\Ole
EnableDCOM
N

HKLM\SYSTEM\CurrentControlSet\Control\Lsa
restrictanonymous
1
More info: http://www.sophos.com/virusinfo/analyses...

%windir%\lsass.exe

rdriv.sys is rootkit Trojan.DwnLdr-FHX.
rdriv.sys is used to hide files, processes and registry.
rdriv.sys is a kernel mode rootkit.
Rootkit contacts remote hacker server using HTTP session.
rdriv.sys is created new system driver:
service name: "rdriv"
display name: "rdriv"
Added to registry:
HKLM\SYSTEM\CurrentControlSet\Services\rdriv\

lsass.exe is created new system driver:
service name: "lsass"
display name: "Local Security Authority Subsystem Service"
Added to registry:
HKLM\SYSTEM\CurrentControlSet\Services\lsass\

Related files:
%WinDir%\lsass.exe
%SysDir%\rdriv.sys
Adds the value:
HKLM\SYSTEM\CurrentControlSet\Services\Messenger
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\RemoteRegistry
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\TlntSvr
Start
4
to the Windows startup registry keys.

Added to registry:
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
DoNotAllowXPSP2
1

HKLM\SOFTWARE\Microsoft\Ole
EnableDCOM
N

HKLM\SYSTEM\CurrentControlSet\Control\Lsa
restrictanonymous
1

HKLM\SOFTWARE\Microsoft\Security Center\
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\
More info: http://www.sophos.com/virusinfo/analyses...

%windir%\lsass1.exe

lsass1.exe is a Trojan.Shpiel-A.
lsass1.exe opens a back door.
Related files:
%Windows%\msnupdate.exe
%Windows%\winfog.exe
%Windows%\winsys.exe
%Windows%\lsass1.exe
%Windows%\lovcx.exe
%Windows%\winsress.exe
%Windows%\winlog.exe
%Windows%\winsock.exe
%Windows%\saveruser.exe
%Windows%\winbackup.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill lsass1.exe process and remove lsass1.exe from Windows startup using RegRun Startup Optimizer.

%windir%\lsass32.exe

lsass32.exe is a Trojan.Lydra-C.
lsass32.exe tries to terminate antiviral programs installed on a user computer.
lsass32.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Windows%\calc.exe
%Windows%\internat.exe
%Windows%\lsass32.exe
%Windows%\mui\modem.sys
%Windows%\regedit2.exe
%Windows%\userun32.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill lsass32.exe process and remove lsass32.exe from Windows startup using RegRun Startup Optimizer.

%windir%\lsassftpdz.exe

LsassFtpdz.exe is rootkit W32/Rbot-ARL.
LsassFtpdz.exe is used to hide files, processes and registry.
LsassFtpdz.exe is a kernel mode rootkit.
Rootkit contacts remote hacker server using HTTP session.
LsassFtpdz.exe created new system drivers:
service name: "LsassFTPDzz"
display name: "LsassFTPzz daemon"
Adds the value:
HKLM\SYSTEM\CurrentControlSet\Services\LsassFTPDzz\
to the Windows startup registry keys.

rdriv.sys created new system drivers:
service name: "rdriv"
display name: " rdriv"
Added to registry:
HKLM\SYSTEM\CurrentControlSet\Services\rdriv\

Related files:
%WinDir%\LsassFtpdz.exe
%SysDir%\rdriv.sys
Adds the value:
HKLM\SYSTEM\CurrentControlSet\Services\Messenger
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\RemoteRegistry
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\TlntSvr
Start
4

Registry entries are set as follows:

HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
DoNotAllowXPSP2
1

HKLM\SOFTWARE\Microsoft\Ole
EnableDCOM
N

HKLM\SYSTEM\CurrentControlSet\Control\Lsa
restrictanonymous
1
to the Windows startup registry keys.
Added to registry:
HKLM\SOFTWARE\Microsoft\Security Center\
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\
More info: http://www.sophos.com/virusinfo/analyses...

%windir%\lsmass.exe

lsmass.exe is a Trojan.Wallop-B.
lsmass.exe opens a back door on IRC channels.
Related files:
%Windows%\lsmass.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill lsmass.exe process and remove lsmass.exe from Windows startup using RegRun Startup Optimizer.

%windir%\mach.exe

Mach.exe is an adware program Adware.iPend.
Mach.exe monitors user Internet activity.
It sends stolen data to a hacker site.
Related files:
C:\Windows\cu.exe
C:\Windows\ip.dll
C:\Windows\Mach.exe
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill Mach.exe process and remove Mach.exe from Windows startup using RegRun Startup Optimizer.

%windir%\mache.exe

mache.exe is a Trojan.QQRob-X.
mache.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%WinDir%\mache.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill mache.exe process and remove mache.exe from Windows startup using RegRun Startup Optimizer.

%windir%\mapserver.exe

mapserver.exe is a Trojan.Tompai-B.
mapserver.exe opens a back door.
mapserver.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%Windows%\mapserver.exe
%System%\mainsv.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill mapserver.exe process and remove mapserver.exe from Windows startup using RegRun Startup Optimizer.

%windir%\master.exe

Worm W32.Josam
Adds to Windows autostart Run key:
"WindowsKeyUpdate" = "%Windir%\master.exe"
Sends e-mails.
Remove it from startup using RegRun Startup Optimizer.

%windir%\mcafeescanplus.exe

McAfeeScanPlus.exe is a Trojan Backdoor.Mepcod.
McAfeeScanPlus.exe spreads via open network shares.
Related files:
%Windir%\McAfeeScanPlus.exe
%Windir%\winlogon9.log
Adds the value:
"McAfeeScanPlus" = %Windir%\McAfeeScanPlus.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill McAfeeScanPlus.exe process and remove McAfeeScanPlus.exe from Windows startup using RegRun Startup Optimizer.

%windir%\mdkiaf.exe

%WinDir%\mdkiaf.exe is Porn Dialer.
Kill the process %WinDir%\mdkiaf.exe and remove %WinDir%\mdkiaf.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%windir%\mdm.exe

We suggest you to remove %WinDir%\mdm.exe from your computer as soon as possible.
%WinDir%\mdm.exe is W32/LCJump-B.
Read more: http://www.sophos.com/security/analyses/...
Kill the process %WinDir%\mdm.exe and remove %WinDir%\mdm.exe from Windows startup.

%windir%\messenger.exe

messenger.exe is a Troj/Banker-HV.
messenger.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%WinDir%\messenger.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill messenger.exe process and remove messenger.exe from Windows startup using RegRun Startup Optimizer.

%windir%\mgsev.exe

mgsev.exe is a mass-mailing worm HackTool Rootkit/W32.Spybot.AGEN.
mgsev.exe opens a back door.
mgsev.exe spreads via open network shares and through AOL instant messenger.
Related files:
%Windir%\mgsev.exe
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill the process mgsev.exe and remove mgsev.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%windir%\miconfig.exe

Miconfig.exe is a Trojan Backdoor.IRC.Ratsou.B.
Miconfig.exe spreads via open network shares.
Related files:
C:\Note.exe
%System%\Hid.exe
%System%\Explorer.dll
%System%\Iexplore.dll
%Windir%\Aim.dll
%Windir%\Boot.exe
%Windir%\C.dll
%Windir%\Crazy.exe
%Windir%\Dr.exe
%Windir%\Empavms.exe
%Windir%\Ipservers.dll
%Windir%\Java.dll
%Windir%\LibParse.exe
%Windir%\Lsass.exe
%Windir%\Miconfig.exe
%Windir%\Moo.dll
%Windir%\Msccl.dll
%Windir%\Msconig.exe
%Windir%\Nhtml.dll
%Windir%\Ratsou.exe
%Windir%\Regedit.dll
%Windir%\Restart.exe
%Windir%\Screen.dll
%Windir%\Sysboot.dll
%Windir%\Syste32.dll
%Windir%\Users.dll
%Windir%\Wind.dll
Adds the value:
"HID.EXE"="%System%\HID.EXE"
"lsass"="%Windir%\Debug\UserMode\lsass.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill Miconfig.exe process and remove Miconfig.exe from Windows startup using RegRun Startup Optimizer.

%windir%\microsoft webserver.exe

Microsoft Webserver.exe is a Trojan.GrayBrd-U.
Microsoft Webserver.exe opens a back door.
Related files:
%Windows%\Microsoft Webserver.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill Microsoft Webserver.exe process and remove Microsoft Webserver.exe from Windows startup using RegRun Startup Optimizer.

%windir%\microsoft.net\framework\v1.0.3705\cvtres.exe

%WinDir%\Microsoft.Net\Framework\v1.0.3705\cvtres.exe is Backdoor.IRC.Aladinz.N.
Related folder:
%WinDir%\Microsoft.Net\Framework\v1.0.3705
This folder is legitimate if you have installed the Microsoft .NET framework.
Related files:
cmnicfg32.xml
cvtres.exe (detected as Hacktool.HideWindow)
IEExec.exe (detected as IRC.Backdoor.Trojan)
InstallUtil.bat (detected as BAT.Trojan)
InstallUtil.exe
RegAsm.exe
RegXml.exe
vsconfig.xml (detected as Backdoor.IRC.Aladinz.N)
wins.ini.
Kill the process cvtres.exe and remove %WinDir%\Microsoft.Net\Framework\v1.0.3705\cvtres.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com
Read more: http://www.sarc.com/avcenter/venc/data/b...

%windir%\mmsg\mcafee.update.exe.exe

mcAfee.Update.exe.exe is a mass-mailing worm W32.Renama.A@mm.
mcAfee.Update.exe.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%Windir%\system\svchost.exe
%System%\ERSvc.exe
%Windir%\mmsg\mcAfee.Update.exe.exe
%Windir%\mmsg\mmsg.exe.exe
%Windir%\Config\Easy.Windows.Monitoring.exe.exe
%Windir%\Config\system.update.exe.exe
%Windir%\notepad.exe.exe
Adds the value:
"notepad" = "%Windir%\notepad.exe.exe"
"mmsg" = "%Windir%\mmsg\mmsg.exe.exe"
"system.update" = "%Windir%\Config\system.update.exe.exe"
"mcAfee.Instan.Update" = "%Windir%\mmsg\mcAfee.Update.exe.exe"
"Easy.Windows.Monitor" = "%Windir%\Config\Easy.Windows.Monitoring.exe.exe"
"ImagePath" = "%System%\ERSvc.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill the process mcAfee.Update.exe.exe and remove mcAfee.Update.exe.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%windir%\mmsg\mmsg.exe.exe

mmsg.exe.exe is a mass-mailing worm W32.Renama.A@mm.
mmsg.exe.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%Windir%\system\svchost.exe
%System%\ERSvc.exe
%Windir%\mmsg\mcAfee.Update.exe.exe
%Windir%\mmsg\mmsg.exe.exe
%Windir%\Config\Easy.Windows.Monitoring.exe.exe
%Windir%\Config\system.update.exe.exe
%Windir%\notepad.exe.exe
Adds the value:
"notepad" = "%Windir%\notepad.exe.exe"
"mmsg" = "%Windir%\mmsg\mmsg.exe.exe"
"system.update" = "%Windir%\Config\system.update.exe.exe"
"mcAfee.Instan.Update" = "%Windir%\mmsg\mcAfee.Update.exe.exe"
"Easy.Windows.Monitor" = "%Windir%\Config\Easy.Windows.Monitoring.exe.exe"
"ImagePath" = "%System%\ERSvc.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill the process mmsg.exe.exe and remove mmsg.exe.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%windir%\modlb.exe

modlb.exe is a Trojan W32.Tilebot-BF.
modlb.exe opens a back door on IRC channels.
modlb.exe spreads via open network shares.
Related files:
%Windows%\modlb.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill modlb.exe process and remove modlb.exe from Windows startup using RegRun Startup Optimizer.

%windir%\molino110.exe

molino110.exe is a Trojan.Bancos-JZ.
molino110.exe monitors user Internet activity and bank information.
It sends stolen data to a hacker site.
Related files:
%Windows%\molino110.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill molino110.exe process and remove molino110.exe from Windows startup using RegRun Startup Optimizer.

%windir%\moo.dll

Moo.dll is a Trojan Backdoor.IRC.Ratsou.B.
Moo.dll spreads via open network shares.
Related files:
C:\Note.exe
%System%\Hid.exe
%System%\Explorer.dll
%System%\Iexplore.dll
%Windir%\Aim.dll
%Windir%\Boot.exe
%Windir%\C.dll
%Windir%\Crazy.exe
%Windir%\Dr.exe
%Windir%\Empavms.exe
%Windir%\Ipservers.dll
%Windir%\Java.dll
%Windir%\LibParse.exe
%Windir%\Lsass.exe
%Windir%\Miconfig.exe
%Windir%\Moo.dll
%Windir%\Msccl.dll
%Windir%\Msconig.exe
%Windir%\Nhtml.dll
%Windir%\Ratsou.exe
%Windir%\Regedit.dll
%Windir%\Restart.exe
%Windir%\Screen.dll
%Windir%\Sysboot.dll
%Windir%\Syste32.dll
%Windir%\Users.dll
%Windir%\Wind.dll
Adds the value:
"HID.EXE"="%System%\HID.EXE"
"lsass"="%Windir%\Debug\UserMode\lsass.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove Moo.dll from Windows startup using RegRun Startup Optimizer.

%windir%\morphacl.dll

Morphacl.dll is an adware program Adware.BetterInternet.
Morphacl.dll is a Browser Helper Object.
Morphacl.dll downloads and displays advertisements.
Related files:
%Windir%\Bi.dll
%Windir%\speeryox.dll
%Windir%\Mxtarget.dll
%Windir%\BTGrab.dll
%Windir%\farmmext.exe
%Windir%\dlmax.dll
%Windir%\speer2.dll
%Windir%\VoiceIP.dll
%Windir%\morphacl.dll
%Windir%\Pynix.dll
%Windir%\Biprep.exe
%Windir%\banner.dll
%System%\laziqn.exe
%System%\xxvyaj.exe
%System%\wbtvsffd.exe
%System%\nnmzoq.exe
%Temp%\DrTemp\thnall1b.exe
%Temp%\DrTemp\thnall1p.exe
%Temp%\DrTemp\thnall2r.exe
%Temp%\DrTemp\polall1b.exe
%Temp%\thnall1s.exe
%Temp%\morphrec.exe
Adds the value:
"[File name of adware]" = "[File path to adware]"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove morphacl.dll from Windows startup using RegRun Startup Optimizer.

%windir%\mpgcom.dll

Mpgcom.dll is an adware program Adware.Mpgcom.
Mpgcom.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Windir%\mpgcom.dll
%Windir%\msnarrator.exe
Adds the value:
"msnarrator" = "%Windir%\msnarrator.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove mpgcom.dll from Windows startup using RegRun Startup Optimizer.

%windir%\mpm.exe

MPM.exe is a Trojan.Spexta.
MPM.exe spreads by e-mail and via open network shares.
MPM.exe is program that relays spam
Related files:
%Windir%\ctflog.exe
%Windir%\explore.exe
%Windir%\inetinfomon.exe
%Windir%\MPM.exe
%Windir%\service.exe
%Windir%\winlog.exe
Adds the value:
"ctflog manager" = "%Windir%\ctflog.exe"
"explore manager" = "%Windir%\explore.exe"
"inetinfomon manager" = "%Windir%\inetinfomon.exe"
"MPM manager" = "%Windir%\MPM.exe"
"service manager" = "%Windir%\service.exe"
"winlog manager" = "%Windir%\winlog.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill MPM.exe process and remove MPM.exe from Windows startup using RegRun Startup Optimizer.

%windir%\mrgtask.exe

%WinDir%\mrgtask.exe is Trojan/Backdoor.
Kill the process mrgtask.exe and remove mrgtask.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%windir%\ms32.exe

Ms32.exe is Trojan/Backdoor SDBOT.BWH.
Kill the process ms32.exe and remove ms32.exe from Windows startup.

%windir%\msapps\msinfo\msappts32.exe

msappts32.exe is Trojan.Elburro-A.
msappts32.exe opens a back door.
msappts32.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Windows%\msapps\msinfo\msappts32.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill msappts32.exe process and remove msappts32.exe from Windows startup using RegRun Startup Optimizer.

%windir%\msarch.exe

msarch.exe is a Trojan.DownLdr-EF.
msarch.exe downloads code from the internet.
Related files:
%WinDir%\msarch.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill msarch.exe process and remove msarch.exe from Windows startup using RegRun Startup Optimizer.

%windir%\msbf32.exe

%WinDir%\msbf32.exe is Trojan/Backdoor.
Kill the process %WinDir%\msbf32.exe and remove %WinDir%\msbf32.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%windir%\msbpx32.dll

msbpx32.dll is a Trojan.Surila-D.
msbpx32.dll modifies data on the computer.
msbpx32.dll tries to terminate antiviral programs installed on a user computer.
msbpx32.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Windows%\mwfirebpx.exe
%Windows%\winl0gon.exe
%Windows%\msbpx32.dll
%Windows%\dodrrr.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove msbpx32.dll from Windows startup using RegRun Startup Optimizer.

%windir%\mscalc.exe

mscalc.exe is a worm W32.Floppy-E.
mscalc.exe spreads via open network shares.
Related files:
%Windows%\mscalc.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill mscalc.exe process and remove mscalc.exe from Windows startup using RegRun Startup Optimizer.

%windir%\mscarrt32.exe

mscarrt32.exe is a worm W32.Oscabot-K.
mscarrt32.exe opens a back door on IRC channels.
mscarrt32.exe spreads via chat programs.
Related files:
%Windows%\mscarrt32.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill the process mscarrt32.exe and remove mscarrt32.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%windir%\msccl.dll

Msccl.dll is a Trojan Backdoor.IRC.Ratsou.B.
Msccl.dll spreads via open network shares.
Related files:
C:\Note.exe
%System%\Hid.exe
%System%\Explorer.dll
%System%\Iexplore.dll
%Windir%\Aim.dll
%Windir%\Boot.exe
%Windir%\C.dll
%Windir%\Crazy.exe
%Windir%\Dr.exe
%Windir%\Empavms.exe
%Windir%\Ipservers.dll
%Windir%\Java.dll
%Windir%\LibParse.exe
%Windir%\Lsass.exe
%Windir%\Miconfig.exe
%Windir%\Moo.dll
%Windir%\Msccl.dll
%Windir%\Msconig.exe
%Windir%\Nhtml.dll
%Windir%\Ratsou.exe
%Windir%\Regedit.dll
%Windir%\Restart.exe
%Windir%\Screen.dll
%Windir%\Sysboot.dll
%Windir%\Syste32.dll
%Windir%\Users.dll
%Windir%\Wind.dll
Adds the value:
"HID.EXE"="%System%\HID.EXE"
"lsass"="%Windir%\Debug\UserMode\lsass.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove Msccl.dll from Windows startup using RegRun Startup Optimizer.

%windir%\msclean.exe

msclean.exe is a Trojan W32.Opanki-T.
msclean.exe opens a back door on IRC channels.
msclean.exe spreads via open network shares.
Related files:
%Windows%\msclean.exe
%Windows%\msvchost.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill msclean.exe process and remove msclean.exe from Windows startup using RegRun Startup Optimizer.

%windir%\msconfig32x.exe

msconfig32x.exe is a worm W32.Rbot-BCR.
msconfig32x.exe spreads via open network shares.
msconfig32x.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%Windows%\msconfig32x.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill msconfig32x.exe process and remove msconfig32x.exe from Windows startup using RegRun Startup Optimizer.

%windir%\msconig.exe

Msconig.exe is a Trojan Backdoor.IRC.Ratsou.B.
Msconig.exe spreads via open network shares.
Related files:
C:\Note.exe
%System%\Hid.exe
%System%\Explorer.dll
%System%\Iexplore.dll
%Windir%\Aim.dll
%Windir%\Boot.exe
%Windir%\C.dll
%Windir%\Crazy.exe
%Windir%\Dr.exe
%Windir%\Empavms.exe
%Windir%\Ipservers.dll
%Windir%\Java.dll
%Windir%\LibParse.exe
%Windir%\Lsass.exe
%Windir%\Miconfig.exe
%Windir%\Moo.dll
%Windir%\Msccl.dll
%Windir%\Msconig.exe
%Windir%\Nhtml.dll
%Windir%\Ratsou.exe
%Windir%\Regedit.dll
%Windir%\Restart.exe
%Windir%\Screen.dll
%Windir%\Sysboot.dll
%Windir%\Syste32.dll
%Windir%\Users.dll
%Windir%\Wind.dll
Adds the value:
"HID.EXE"="%System%\HID.EXE"
"lsass"="%Windir%\Debug\UserMode\lsass.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill Msconig.exe process and remove Msconig.exe from Windows startup using RegRun Startup Optimizer.

%windir%\mscore32.dll

mscore32.dll is a Trojan.Gamqowi.
mscore32.dll opens a back door on TCP port 4661.
mscore32.dll tries to terminate antiviral programs installed on a user computer.
Related files:
%Windir%\mwfirewall.exe
%Windir%\svch0st.exe
%Windir%\mscore32.dll
%Windir%\dodrrr.exe
%Windir%\msconfl.dat
Adds the value:
"ms_anti_spyware" = "%Windir%\mwfirewall.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove mscore32.dll from Windows startup using RegRun Startup Optimizer.

%windir%\msdeff.exe

msdeff.exe is a worm W32.Ritdoor-B.
msdeff.exe opens a back door.
msdeff.exe spreads via open network shares.
Related files:
%Windows%\msdeff.exe
%Windows%\winlogon.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill msdeff.exe process and remove msdeff.exe from Windows startup using RegRun Startup Optimizer.

%windir%\msdefr.exe

Msdefr.exe is a mass-mailing wormW32.Bobax.AA.
Msdefr.exe opens a back door on random port.
Msdefr.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%Windir%\services.exe
%Windir%\msdefr.exe
c:\Autorun.inf
Adds the value:
"RPCserv32g" = "%Windir%\services.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill msdefr.exe process and remove msdefr.exe from Windows startup using RegRun Startup Optimizer.

%windir%\msdevmgr32.exe

Trojan Backdoor.Lateda.
Adds the value:
"Microsoft Device Manager" = "%Windir%\msdevmgr32.exe"
to the Windows startup registry keys.
Connects to an IRC server on the domain xpsgamemail.gotdns.com through TCP port 6667, and joins the channel ##rofl.
Opens a back door on TCP port 9999, and waits for commands from a remote attacker.
Remove it from Windows startup.

%windir%\msdnupdate32.exe

msdnupdate32.exe is rootkit W32/Tilebot-M.
msdnupdate32.exe is used to hide files, processes and registry.
msdnupdate32.exe is a kernel mode rootkit.
Rootkit contacts remote hacker server using HTTP session.
msdnupdate32.exe spreads via open network shares.
msdnupdate32.exe opens a back door on IRC channels.
msdnupdate32.exe created new system drivers:
service name: "msdnupdate32"
display name: "Msdn Update 32"
Adds the value:
HKLM\SYSTEM\CurrentControlSet\Services\msdnupdate32\
to the Windows startup registry keys.

rdriv.sys created new system drivers:
service name: "rdriv"
display name: "rdriv"
Adds the value:
HKLM\SYSTEM\CurrentControlSet\Services\rdriv\
Related files:
%WinDir%\msdnupdate32.exe
%SysDir%\rdriv.sys
Adds the value:
HKLM\SYSTEM\CurrentControlSet\Services\Messenger
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\RemoteRegistry
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\TlntSvr
Start
4
to the Windows startup registry keys.
Added to registry:
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
DoNotAllowXPSP2
1

HKLM\SOFTWARE\Microsoft\Ole
EnableDCOM
N

HKLM\SYSTEM\CurrentControlSet\Control\Lsa
restrictanonymous
1

HKLM\SOFTWARE\Microsoft\Security Center\
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\
More info: http://www.sophos.com/virusinfo/analyses...

%windir%\msdt.exe

msdt.exe is a Trojan W32.Tilebot-BQ.
msdt.exe opens a back door on IRC channels.
msdt.exe spreads via open network shares.
Related files:
%Windows%\msdt.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill msdt.exe process and remove msdt.exe from Windows startup using RegRun Startup Optimizer.

%windir%\msdvd.exe

msdvd.exe is a Trojan W32.Sdbot-AFG.
msdvd.exe opens a back door on IRC channels.
msdvd.exe spreads via open network shares.
Related files:
%Windows%\msdvd.exe
%System%\rdriv.sys
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill msdvd.exe process and remove msdvd.exe from Windows startup using RegRun Startup Optimizer.

%windir%\msftupdatexp.exe

MsFtUpdateXP.exe is a Trojan W32.Tilebot-BL.
MsFtUpdateXP.exe opens a back door on IRC channels.
MsFtUpdateXP.exe spreads via open network shares.
Related files:
%Windows%\MsFtUpdateXP.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill MsFtUpdateXP.exe process and remove MsFtUpdateXP.exe from Windows startup using RegRun Startup Optimizer.

%windir%\msgupdater.exe

msgupdater.exe is rootkit W32/Sdbot-ADZ.
msgupdater.exe is used to hide files, processes and registry.
msgupdater.exe is a kernel mode rootkit.
Rootkit contacts remote hacker server using HTTP session.
msgupdater.exe spreads via open network shares.
msgupdater.exe opens a back door on IRC channels.
msgupdater.exe created new system drivers:
service name: "masry"
display name: "windows firewall"
Adds the value:
HKLM\SYSTEM\CurrentControlSet\Services\masry\
to the Windows startup registry keys.

rdriv.sys created new system drivers:
service name: "rdriv"
display name: "rdriv"
Added to registry:
HKLM\SYSTEM\CurrentControlSet\Services\rdriv\

Related files:
%WinDir%\msgupdater.exe
%SysDir%\rdriv.sys
Adds the value:
HKLM\SYSTEM\CurrentControlSet\Services\Messenger
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\RemoteRegistry
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\TlntSvr
Start
4
to the Windows startup registry keys.
Added to registry:
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
DoNotAllowXPSP2
1

HKLM\SOFTWARE\Microsoft\Ole
EnableDCOM
N

HKLM\SYSTEM\CurrentControlSet\Control\Lsa
restrictanonymous
1

HKLM\SOFTWARE\Microsoft\Security Center\
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\
More info: http://www.sophos.com/virusinfo/analyses...

%windir%\mshelp.exe

%WinDir%\MShelp.EXE is Trojan/Backdoor W32.Wullik.B@mm.
Kill the process %WinDir%\MShelp.EXE and remove %WinDir%\MShelp.EXE from Windows startup.
http://securityresponse.symantec.com/avc...

%windir%\mshelpdsk.exe

%WinDir%\mshelpdsk.exe is W32.Spybot.ANJJ.
Related files:
c:\symantc.exe
%Windir%\SMonitor.sys
Read more: http://www.symantec.com/enterprise/secur...
Kill the process %WinDir%\mshelpdsk.exe and remove %WinDir%\mshelpdsk.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%windir%\mshotfix.exe

Mshotfix.exe is an adware program Adware.Affilred.
Mshotfix.exe monitors user Internet activity.
Related files:
usbwin32.exe
C:\CriticalUpdate.exe
C:\cab.exe
C:\winsecure.exe
%Windir%\twain_32.exe
%Windir%\mshotfix.exe
%Windir%\msupdate.exe
%System%\security32.exe
%System%\iProtect.exe
%System%\axe.exe
%System%\inetconnect.dll
%System%\comnt32.dll.
Adds the value:
"MSUpdate" = "c:\criticalUpdate.exe"
"Microsoft Security Hot Fix Update" = "%SystemRoot%\mshotfix.exe"
"Microsoft Cab Manager" = "c:\exec.exe"
"Windows Security Manager" = "c:\winsecure.exe"
"Windows Security Update" = "%Windir%\security32.exe"
"Userinit" = "%System%\userinit.exe, %Windir%\iProtect.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill mshotfix.exe process and remove mshotfix.exe from Windows startup using RegRun Startup Optimizer.

%windir%\msie.exe

msie.exe is a worm W32.Tilebot-CT.
msie.exe opens a back door on IRC channels.
msie.exe spreads via open network shares.
Related files:
%Windows%\msie.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill msie.exe process and remove msie.exe from Windows startup using RegRun Startup Optimizer.

%windir%\mslx32.exe

MsLX32.exe is a Trojan W32.Sdbot-AFS.
MsLX32.exe opens a back door on IRC channels.
MsLX32.exe spreads via open network shares.
Related files:
%Windows%\MsLX32.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill MsLX32.exe process and remove MsLX32.exe from Windows startup using RegRun Startup Optimizer.

%windir%\msmedia.exe

MSmedia.exe is rootkit W32/Tilebot-BC.
MSmedia.exe is used to hide files, processes and registry.
MSmedia.exe is a kernel mode rootkit.
Rootkit contacts remote hacker server using HTTP session.
MSmedia.exe spreads via open network shares.
MSmedia.exe opens a back door on IRC channels.
MSmedia.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
MSmedia.exe created new system drivers:
service name: "MicroSoft Media Tools"
display name: "MicroSoft Media Tools"
Adds the value:
HKLM\SYSTEM\CurrentControlSet\Services\MicroSoft Media Tools\
to the Windows startup registry keys.

rdriv.sys created new system drivers:
service name: "rdriv"
display name: "rdriv"
Adds the value:
HKLM\SYSTEM\CurrentControlSet\Services\rdriv\
Related files:
%WinDir%\MSmedia.exe
%SysDir%\rdriv.sys
Adds the value:
HKLM\SYSTEM\CurrentControlSet\Services\Messenger
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\RemoteRegistry
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\TlntSvr
Start
4
to the Windows startup registry keys.
Added to registry:
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
DoNotAllowXPSP2
1

HKLM\SOFTWARE\Microsoft\Ole
EnableDCOM
N

HKLM\SYSTEM\CurrentControlSet\Control\Lsa
restrictanonymous
1

HKLM\SOFTWARE\Microsoft\Security Center\
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\
More info: http://www.sophos.com/virusinfo/analyses...

%windir%\msmedia32.exe

msmedia32.exe is a worm W32.Tilebot-BI.
msmedia32.exe opens a back door on IRC channels.
msmedia32.exe spreads via open network shares.
Related files:
%Windows%\msmedia32.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill msmedia32.exe process and remove msmedia32.exe from Windows startup using RegRun Startup Optimizer.

%windir%\msmsgredss.exe

msmsgredss.exe is a Trojan W32.Sdbot-AGL.
msmsgredss.exe opens a back door on IRC channels.
msmsgredss.exe spreads via open network shares.
Related files:
%Windows%\msmsgredss.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill msmsgredss.exe process and remove msmsgredss.exe from Windows startup using RegRun Startup Optimizer.

%windir%\msmsgrs.exe

msmsgrs.exe is a Trojan W32.Sdbot-ADN.
msmsgrs.exe opens a back door on IRC channels.
msmsgrs.exe spreads via open network shares.
Related files:
%Windows%\msmsgrs.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill msmsgrs.exe process and remove msmsgrs.exe from Windows startup using RegRun Startup Optimizer.

%windir%\msmsgs.exe

We suggest you to remove %WinDir%\msmsgs.exe from your computer as soon as possible.
%WinDir%\msmsgs.exe is W32.Forinsty.
W32.Forinsty is a worm that spreads through removable drives and opens a back door on the compromised computer.
Related files:
%Windir%\msmsgs.exe
%Windir%\debug\sysdeb.ini
%System%\ynhqttqd.d1l
%System%\ynhqttqd.dll
%System%\drivers\ynhqttqd.sys
%Temp%\ynhqttqd.log
%DriveLetter%\autorun.inf
%DriveLetter%\RECYCLER\RECYCLER\autorun.exe
Read more: http://www.symantec.com/business/securit...
Kill the process %WinDir%\msmsgs.exe and remove %WinDir%\msmsgs.exe from Windows startup.

%windir%\msmv32.dll

%WinDir%\msmv32.dll is Trojan/Backdoor.
Kill the file %WinDir%\msmv32.dll and remove %WinDir%\msmv32.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

%windir%\msn.exe

Backdoor.Ducy is a backdoor Trojan horse that uses MSN Messenger to give an attacker access to your computer.

When Backdoor.Ducy is run, it creates the file, %Windir%\Msn.exe.

Then adds the value: "control"="%Windir%\msn.exe "
to the registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Also, it opens a backdoor on the infected system, allowing an attacker to connect to the system using MSN Messenger.

Manual removal:
Navigate to the key: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
and delete the following value: "Control"="%Windir%\msn.exe"

Or use RegRun Startup Optimizer to automatically remove this troajn.

%windir%\msnarrator.exe

Msnarrator.exe is an adware program Adware.Mpgcom.
Msnarrator.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Windir%\mpgcom.dll
%Windir%\msnarrator.exe
Adds the value:
"msnarrator" = "%Windir%\msnarrator.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill msnarrator.exe process and remove msnarrator.exe from Windows startup using RegRun Startup Optimizer.

%windir%\msndr.exe

Msndr.exe is a Trojan PWSteal.Revcuss.C.
Msndr.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\msnnm.exe
%Windir%\msndr.exe
Adds the value:
"WinUpdate Loader" = "%System%\msnnm.exe"
"run" = "%Windir%\msndr.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill msndr.exe process and remove msndr.exe from Windows startup using RegRun Startup Optimizer.

%windir%\msngrabber.exe

Worm W32.Envid.A@mm
Attempts to download the file NovoDownExe.txt from the geocities.yahoo.com.br domain.
Attempts to send email messages to the addresses found on the system.

%windir%\msnlive.exe

msnlive.exe is rootkit W32/Tilebot-CN.
msnlive.exe is used to hide files, processes and registry.
msnlive.exe is a kernel mode rootkit.
Rootkit contacts remote hacker server using HTTP session.
msnlive.exe spreads via open network shares.
msnlive.exe opens a back door on IRC channels.
msnlive.exe created new system drivers:
service name: "Windows Updater"
display name: "Windows Updater"
Adds the value:
HKLM\SYSTEM\CurrentControlSet\Services\Windows Updater\
to the Windows startup registry keys.

rdriv.sys created new system drivers:
service name: "rdriv"
display name: "rdriv"
Added to registry:
HKLM\SYSTEM\CurrentControlSet\Services\rdriv\

Related files:
%WinDir%\msnlive.exe
%SysDir%\rdriv.sys
Adds the value:
HKLM\SYSTEM\CurrentControlSet\Services\Messenger
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\RemoteRegistry
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\TlntSvr
Start
4
to the Windows startup registry keys.
Added to registry:
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
DoNotAllowXPSP2
1

HKLM\SOFTWARE\Microsoft\Ole
EnableDCOM
N

HKLM\SYSTEM\CurrentControlSet\Control\Lsa
restrictanonymous
1

HKLM\SOFTWARE\Microsoft\Security Center\
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\
More info: http://www.sophos.com/virusinfo/analyses...

%windir%\msnmgr.exe

msnmgr.exe is rootkit W32/Kassbot-L.
msnmgr.exe is used to hide files, processes and registry.
msnmgr.exe is a kernel mode rootkit.
Rootkit contacts remote hacker server using HTTP session.
msnmgr.exe spreads via open network shares.
msnmgr.exe opens a back door on IRC channels.
msnmgr.exe created new system drivers:
service name: "Manager"
display name: "Windows XP Manager"
Adds the value:
HKLM\SYSTEM\CurrentControlSet\Services\Manager \
to the Windows startup registry keys.

rdriv.sys created new system drivers:
service name: "rdriv"
display name: "rdriv"
Added to registry:
HKLM\SYSTEM\CurrentControlSet\Services\rdriv\

Related files:
%WinDir%\msnmgr.exe
%SysDir%\rdriv.sys
Adds the value:
HKLM\SYSTEM\CurrentControlSet\Services\Messenger
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\RemoteRegistry
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\TlntSvr
Start
4
to the Windows startup registry keys.
Added to registry:
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
DoNotAllowXPSP2
1

HKLM\SOFTWARE\Microsoft\Ole
EnableDCOM
N

HKLM\SYSTEM\CurrentControlSet\Control\Lsa
restrictanonymous
1

HKLM\SOFTWARE\Microsoft\Security Center\
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\
More info: http://www.sophos.com/virusinfo/analyses...

%windir%\msnmsg.exe

msnmsg.exe is a Trojan.Bancban-KN.
msnmsg.exe monitors user Internet activity and bank information.
It sends stolen data to a hacker site.
Related files:
%Windows%\msnmsg.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill msnmsg.exe process and remove msnmsg.exe from Windows startup using RegRun Startup Optimizer.

%windir%\msnmsnr.exe

msnmsnr.exe is a Trojan.Banker-GG.
msnmsnr.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Windows%\msnmsnr.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill msnmsnr.exe process and remove msnmsnr.exe from Windows startup using RegRun Startup Optimizer.

%windir%\msnupdate.exe

msnupdate.exe is a Trojan.Shpiel-A.
msnupdate.exe opens a back door.
Related files:
%Windows%\msnupdate.exe
%Windows%\winfog.exe
%Windows%\winsys.exe
%Windows%\lsass1.exe
%Windows%\lovcx.exe
%Windows%\winsress.exe
%Windows%\winlog.exe
%Windows%\winsock.exe
%Windows%\saveruser.exe
%Windows%\winbackup.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill msnupdate.exe process and remove msnupdate.exe from Windows startup using RegRun Startup Optimizer.

%windir%\msnzx.exe

msnzx.exe is a Trojan W32.Sdbot-ACW.
msnzx.exe opens a back door on IRC channels.
msnzx.exe spreads via open network shares.
msnzx.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%Windows%\msnzx.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill msnzx.exe process and remove msnzx.exe from Windows startup using RegRun Startup Optimizer.

%windir%\msoevc.exe

msoevc.exe is a Trojan W32.Tilebot-CV.
msoevc.exe opens a back door on IRC channels.
msoevc.exe spreads via open network shares.
Related files:
%Windows%\msoevc.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill msoevc.exe process and remove msoevc.exe from Windows startup using RegRun Startup Optimizer.

%windir%\mspath.exe

mspath.exe is a Trojan W32.Sdbot-AEO.
mspath.exe opens a back door on IRC channels.
mspath.exe spreads via open network shares.
mspath.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Windows%\mspath.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill mspath.exe process and remove mspath.exe from Windows startup using RegRun Startup Optimizer.

%windir%\mspathfinder

%WinDir%\mspathfinder is Trojan/Backdoor.
mspathfinder is installed as system service "mspathfinder".
Kill the file %WinDir%\mspathfinder and remove %WinDir%\mspathfinder from Windows startup.

%windir%\msput.exe

msput.exe is a Trojan W32.Sdbot-BAY.
msput.exe opens a back door on IRC channels.
msput.exe spreads via open network shares.
Related files:
%Windows%\msput.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill the process msput.exe and remove msput.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%windir%\msrundll32.exe

MSRundll32.exe is a worm W32.Lile-A.
MSRundll32.exe spreads via open network shares.
MSRundll32.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%Windows%\MSRundll32.exe
%Windows%\lel.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill MSRundll32.exe process and remove MSRundll32.exe from Windows startup using RegRun Startup Optimizer.

%windir%\mssetup.exe

%WinDir%\mssetup.exe is Adware.Findwhatever.
Adware.Findwhatever is an adware program that periodically changes the Internet Explorer start page.
Related files:
%Windir%\smss.exe
%Windir%\mshepl.exe
%Windir%\mssetup.exe
%Windir%\svchost.exe
%Windir%\ups.exe
%Windir%\xcopy.exe
%Windir%\mdm.exe
%Windir%\dpvsetup.exe
%Windir%\autolfn.exe
%Windir%\csrss.exe
%Windir%\label.exe
%Windir%\mmc.exe
%Windir%\msswchx.exe
%Windir%\mstask.exe
%Windir%\netdde.exe
%Windir%\ntvdm.exe
%Windir%\osk.exe
%Windir%\lasss.exe
%Windir%\spoolsv.exe
%Windir%\sptsupd.exe
%Windir%\subst.exe
%Windir%\w32tm.exe
%Windir%\mshta.exe
%Windir%\dsndup.exe
Read more: http://www.symantec.com/security_respons...
Kill the process %WinDir%\mssetup.exe and remove %WinDir%\mssetup.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%windir%\mssmbios.exe

mssmbios.exe is rootkit W32/Tilebot-AI.
mssmbios.exe is used to hide files, processes and registry.
mssmbios.exe is a kernel mode rootkit.
Rootkit contacts remote hacker server using HTTP session.
mssmbios.exe spreads via open network shares.
mssmbios.exe opens a back door on IRC channels.
mssmbios.exe tries to terminate antiviral programs installed on a user computer.
mssmbios.exe monitors user Internet activity and bank information.
It sends stolen data to a hacker site.
mssmbios.exe created new system drivers:
service name: "Microsoft System Management BIOS Driver"
display name: "mssmbios"
Adds the value:
HKLM\SYSTEM\CurrentControlSet\Services\Microsoft System Management BIOS Driver\
to the Windows startup registry keys.

hpdriver.sys created new system drivers:
service name: " hpdriver"
display name: " hpdriver"
Added to registry:
HKLM\SYSTEM\CurrentControlSet\Services\hpdriver\

Related files:
%WinDir%\mssmbios.exe
%SysDir%\hpdriver.sys
Adds the value:
HKLM\SYSTEM\CurrentControlSet\Services\Messenger
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\RemoteRegistry
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\TlntSvr
Start
4
to the Windows startup registry keys.
Added to registry:
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
DoNotAllowXPSP2
1

HKLM\SOFTWARE\Microsoft\Ole
EnableDCOM
N

HKLM\SYSTEM\CurrentControlSet\Control\Lsa
restrictanonymous
1

HKLM\SOFTWARE\Microsoft\Security Center\
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\
More info: <http://www.sophos.com/virusinfo/analyses...

%windir%\mssol.dll

mssol.dll is a Trojan.Goldun-AE.
mssol.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove mssol.dll from Windows startup using RegRun Startup Optimizer.

%windir%\mstask.exe

%WinDir%\MSTask.exe is W32/Sdbot-DGM.
Related files:
%Windows%\MSTask.exe
%System%\trash1B9F4 (not malicious)
%System%\sfc_os.dll
Read more: http://www.sophos.com/security/analyses/...
Kill the process %WinDir%\MSTask.exe and remove %WinDir%\MSTask.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%windir%\mstdel32.exe

mstdel32.exe is a Trojan W32.Tilebot-BE.
mstdel32.exe opens a back door on IRC channels.
mstdel32.exe spreads via open network shares.
Related files:
%Windows%\mstdel32.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill mstdel32.exe process and remove mstdel32.exe from Windows startup using RegRun Startup Optimizer.

%windir%\mstempf.exe

mstempf.exe is a Trojan W32.Ritdoor-E.
mstempf.exe opens a back door.
mstempf.exe spreads via open network shares.
Related files:
%Windows%\msdef.exe
%Windows%\services.exe
%Windows%\mstempf.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill mstempf.exe process and remove mstempf.exe from Windows startup using RegRun Startup Optimizer.

%windir%\msupdate.exe

Msupdate.exe is an adware program Adware.Affilred.
Msupdate.exe monitors user Internet activity.
Related files:
usbwin32.exe
C:\CriticalUpdate.exe
C:\cab.exe
C:\winsecure.exe
%Windir%\twain_32.exe
%Windir%\mshotfix.exe
%Windir%\msupdate.exe
%System%\security32.exe
%System%\iProtect.exe
%System%\axe.exe
%System%\inetconnect.dll
%System%\comnt32.dll.
Adds the value:
"MSUpdate" = "c:\criticalUpdate.exe"
"Microsoft Security Hot Fix Update" = "%SystemRoot%\mshotfix.exe"
"Microsoft Cab Manager" = "c:\exec.exe"
"Windows Security Manager" = "c:\winsecure.exe"
"Windows Security Update" = "%Windir%\security32.exe"
"Userinit" = "%System%\userinit.exe, %Windir%\iProtect.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill msupdate.exe process and remove msupdate.exe from Windows startup using RegRun Startup Optimizer.

%windir%\msvcrt.exe

msvcrt.exe is rootkit W32/Tilebot-Q.
msvcrt.exe is used to hide files, processes and registry.
msvcrt.exe is a kernel mode rootkit.
Rootkit contacts remote hacker server using HTTP session.
msvcrt.exe spreads via open network shares.
msvcrt.exe opens a back door on IRC channels.
msvcrt.exe created new system drivers:
service name: "msvcrt"
display name: "Ampi32"
Adds the value:
HKLM\SYSTEM\CurrentControlSet\Services\msvcrt\
to the Windows startup registry keys.

rdriv.sys created new system drivers:
service name: "rdriv"
display name: "rdriv"
Added to registry:
HKLM\SYSTEM\CurrentControlSet\Services\rdriv\

Related files:
%WinDir%\msvcrt.exe
%SysDir%\rdriv.sys
Adds the value:
HKLM\SYSTEM\CurrentControlSet\Services\Messenger
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\RemoteRegistry
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\TlntSvr
Start
4
to the Windows startup registry keys.
Added to registry:
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
DoNotAllowXPSP2
1

HKLM\SOFTWARE\Microsoft\Ole
EnableDCOM
N

HKLM\SYSTEM\CurrentControlSet\Control\Lsa
restrictanonymous
1

HKLM\SOFTWARE\Microsoft\Security Center\
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\
More info: http://www.sophos.com/virusinfo/analyses...

%windir%\msvisi.exe

MSVISI.exe is a worm W32.Tilebot-EY.
MSVISI.exe opens a back door on IRC channels.
MSVISI.exe spreads via open network shares.
MSVISI.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Windows%\MSVISI.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill the process MSVISI.exe and remove MSVISI.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%windir%\msvm_sti.exe

MsVM_STI.EXE is a Trojan.LegMir-BY.
MsVM_STI.EXE opens a back door.
Related files:
%Windows%\MsVM_STI.EXE
%System%\explorer.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill MsVM_STI.EXE process and remove MsVM_STI.EXE from Windows startup using RegRun Startup Optimizer.

%windir%\mswindll32.exe

mswindll32.exe is a Trojan W32.Tilebot-AQ.
mswindll32.exe opens a back door on IRC channels.
mswindll32.exe spreads via open network shares.
Related files:
%Windows%\mswindll32.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill mswindll32.exe process and remove mswindll32.exe from Windows startup using RegRun Startup Optimizer.

%windir%\msxp32.exe

MsXP32.exe is a Trojan W32.Sdbot-AJU.
MsXP32.exe opens a back door on IRC channels.
MsXP32.exe spreads via open network shares.
Related files:
%Windows%\MsXP32.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill MsXP32.exe process and remove MsXP32.exe from Windows startup using RegRun Startup Optimizer.

%windir%\muamgr.exe

muamgr.exe is a Backdoor W32.Alcra.A.
muamgr.exe spreads via open network shares.
muamgr.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\regedit.com
%System%\taskmgr.exe
%System%\tasklist.com
%System%\taskkill.com
%System%\netstat.com
%System%\tracert.com
%System%\ping.com
%System%\cmd.com
%ProgramFiles%\MSConfigs\MSConfigs.exe
%System%\bt.exe
%System%\z.tmp
%System%\temp.zip
%System%\bszip.dll
%System%\p2pnetwork.exe
winis.exe
win32exe.exe
wini.exe
winlogins.exe
muamgr.exe
Adds the value:
"MsConfigs" = "MsConfigs.exe"
"p2pnetwork" = "p2pnetwork.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill muamgr.exe process and remove muamgr.exe from Windows startup using RegRun Startup Optimizer.

%windir%\mwfibpx.exe

mwfibpx.exe is a Trojan.Surila-J.
mwfibpx.exe opens a back door.
mwfibpx.exe tries to terminate antiviral programs installed on a user computer.
mwfibpx.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Windows%\mwfibpx.exe
%Windows%\smss.exe
%Windows%\dodrrr.exe
%Windows%\msfig.dat
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill mwfibpx.exe process and remove mwfibpx.exe from Windows startup using RegRun Startup Optimizer.

%windir%\mwfirebpx.exe

mwfirebpx.exe is a Trojan.Surila-D.
mwfirebpx.exe modifies data on the computer.
mwfirebpx.exe tries to terminate antiviral programs installed on a user computer.
mwfirebpx.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Windows%\mwfirebpx.exe
%Windows%\winl0gon.exe
%Windows%\msbpx32.dll
%Windows%\dodrrr.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill mwfirebpx.exe process and remove mwfirebpx.exe from Windows startup using RegRun Startup Optimizer.

%windir%\mwfirewall.exe

mwfirewall.exe is a Trojan.Gamqowi.
mwfirewall.exe opens a back door on TCP port 4661.
mwfirewall.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%Windir%\mwfirewall.exe
%Windir%\svch0st.exe
%Windir%\mscore32.dll
%Windir%\dodrrr.exe
%Windir%\msconfl.dat
Adds the value:
"ms_anti_spyware" = "%Windir%\mwfirewall.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill mwfirewall.exe process and remove mwfirewall.exe from Windows startup using RegRun Startup Optimizer.

%windir%\mxtarget.dll

Mxtarget.dll is an adware program Adware.BetterInternet.
Mxtarget.dll is a Browser Helper Object.
Mxtarget.dll downloads and displays advertisements.
Related files:
%Windir%\Bi.dll
%Windir%\speeryox.dll
%Windir%\Mxtarget.dll
%Windir%\BTGrab.dll
%Windir%\farmmext.exe
%Windir%\dlmax.dll
%Windir%\speer2.dll
%Windir%\VoiceIP.dll
%Windir%\morphacl.dll
%Windir%\Pynix.dll
%Windir%\Biprep.exe
%Windir%\banner.dll
%System%\laziqn.exe
%System%\xxvyaj.exe
%System%\wbtvsffd.exe
%System%\nnmzoq.exe
%Temp%\DrTemp\thnall1b.exe
%Temp%\DrTemp\thnall1p.exe
%Temp%\DrTemp\thnall2r.exe
%Temp%\DrTemp\polall1b.exe
%Temp%\thnall1s.exe
%Temp%\morphrec.exe
Adds the value:
"[File name of adware]" = "[File path to adware]"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove Mxtarget.dll from Windows startup using RegRun Startup Optimizer.

%windir%\myd00m.exe

MYD00M.EXE is a mass-mailing worm W32.Hilder-A.
MYD00M.EXE tries to terminate antiviral programs installed on a user computer.
Related files:
funny.exe
unbelieveable.exe
C:\wichtig.exe
C:\FUUU.exe
%Windows%\INF3CTED.EXE
%Windows%\NET5KY.EXE
%Windows%\SA55ER.EXE
%Windows%\MYD00M.EXE
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill the process MYD00M.EXE and remove MYD00M.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

%windir%\nail.exe

Nail.exe is a part of the new generation of VX2 adware components.
Nail.exe is protected from deleteion by Delprot driver.
Delprot.sys is the driver used to protect adware registry keys from deletion.
Also related files:
%WinDir%\isrvs\ffisearch.exe
%WinDir%\isrvs\desktop.exe
%SysDir%\Drivers\delprot.sys

Removal:
Go to the Safe mode.
Delete the key
HKLM\SYSTEM\CurrentControlSet\Services\Delprot
Remove ffisearch.exe and desktop.exe from Windows startup registry keys using RegRun.
Delete Files:
%WinDir%\isrvs\ffisearch.exe
%WinDir%\isrvs\desktop.exe
%SysDir%\Drivers\delprot.sys

Kill the process %WinDir%\Nail.exe and remove %WinDir%\Nail.exe from Windows startup.

%windir%\nakedx.exe

nakedx.exe is a Trojan W32.Sdbot-AGK.
nakedx.exe opens a back door on IRC channels.
nakedx.exe spreads via open network shares.
Related files:
%Windows%\nakedx.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill nakedx.exe process and remove nakedx.exe from Windows startup using RegRun Startup Optimizer.

%windir%\natydave1.exe

natydave1.exe is a dialer program Dialer.ICcontrol.
Related files:
%Windir%\icc.dll
%Windir%\iccontrol.exe
%Windir%\madchook.dll
%Windir%\natydave1.exe
%Windir%\sp2ydave1.exe
%Windir%\ydave1.exe
%UserTemp%\mc2A.tmp
More info: http://www.symantec.com/avcenter/venc/da...
Removal:
Kill the process natydave1.exe and remove natydave1.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%windir%\navapw32.exe

%windir%\nb32ext2.exe

nb32ext2.exe is a mass-mailing worm W32.Bobax.AF@mm.
nb32ext2.exe opens a back door.
nb32ext2.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%Windir%\msdefr.exe
%Windir%\nb32ext2.exe
Adds the value:
"helloworld" = "nb32ext2.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill nb32ext2.exe process and remove nb32ext2.exe from Windows startup using RegRun Startup Optimizer.

%windir%\nddenb.exe

NDDENB.exe is a Trojan Trojan.PWSYahoo-A.
NDDENB.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Windows%\NDDENB.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill NDDENB.exe process and remove NDDENB.exe from Windows startup using RegRun Startup Optimizer.

%windir%\ndppbzn.exe

ndppbzn.exe is a Trojan.Small-ACG.
ndppbzn.exe downloads code from the internet.
Related files:
%Windows%\ndppbzn.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill ndppbzn.exe process and remove ndppbzn.exe from Windows startup using RegRun Startup Optimizer.

%windir%\nemxxx.dll

NemXXX.dll is an adware program Adware.NetOptimizer.
NemXXX.dll downloads and displays advertisements.
Related files:
%ProgramFiles%\Internet Optimizer\actalert.exe
%ProgramFiles%\Internet Optimizer\optimize.exe
%ProgramFiles%\Internet Optimizer\update\actalert.exe
%Windir%\nemXXX.dll
%Windir%\optimize.exe
%Windir%\wsemXXX.dll
%Windir%\ioptiXXX.dll
Adds the value:
"Internet Optimizer" = "C:\Program Files\Internet Optimizer\optimize.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove nemXXX.dll from Windows startup using RegRun Startup Optimizer.

%windir%\net5ky.exe

NET5KY.EXE is a mass-mailing worm W32.Hilder-A.
NET5KY.EXE tries to terminate antiviral programs installed on a user computer.
Related files:
funny.exe
unbelieveable.exe
C:\wichtig.exe
C:\FUUU.exe
%Windows%\INF3CTED.EXE
%Windows%\NET5KY.EXE
%Windows%\SA55ER.EXE
%Windows%\MYD00M.EXE
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill the process NET5KY.EXE and remove NET5KY.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

%windir%\netconf32.exe

netconf32.exe is a Trojan W32.Tilebot-BN.
netconf32.exe opens a back door on IRC channels.
netconf32.exe spreads via open network shares and by AOL Instant Messenger.
netconf32.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%Windows%\netconf32.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill netconf32.exe process and remove netconf32.exe from Windows startup using RegRun Startup Optimizer.

%windir%\netmon.exe

%Windir%\netmon.exe is a W32.Mimail.M@mm.
netmon.exe adds the value "NetMon" = "%Windir%\netmon.exe" to the registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run.
Kill the process %WinDir%\netmon.exe, remove %WinDir%\netmon.exe and registry entry from Windows using RegRun Reanimator.
Read more: http://securityresponse.symantec.com/avc...
http://www.regrun.com

%windir%\nhtml.dll

Nhtml.dll is a Trojan Backdoor.IRC.Ratsou.B.
Nhtml.dll spreads via open network shares.
Related files:
C:\Note.exe
%System%\Hid.exe
%System%\Explorer.dll
%System%\Iexplore.dll
%Windir%\Aim.dll
%Windir%\Boot.exe
%Windir%\C.dll
%Windir%\Crazy.exe
%Windir%\Dr.exe
%Windir%\Empavms.exe
%Windir%\Ipservers.dll
%Windir%\Java.dll
%Windir%\LibParse.exe
%Windir%\Lsass.exe
%Windir%\Miconfig.exe
%Windir%\Moo.dll
%Windir%\Msccl.dll
%Windir%\Msconig.exe
%Windir%\Nhtml.dll
%Windir%\Ratsou.exe
%Windir%\Regedit.dll
%Windir%\Restart.exe
%Windir%\Screen.dll
%Windir%\Sysboot.dll
%Windir%\Syste32.dll
%Windir%\Users.dll
%Windir%\Wind.dll
Adds the value:
"HID.EXE"="%System%\HID.EXE"
"lsass"="%Windir%\Debug\UserMode\lsass.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove Nhtml.dll from Windows startup using RegRun Startup Optimizer.

%windir%\niteaim.exe

Niteaim.exe is an IRC Trojan W32.Opanki.B.
Niteaim.exe spreads through AOL Instant Messenger.
Related files:
%Windir%\niteaim.exe
Adds the value:
"WinNite" = "%Windir%\niteaim.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill niteaim.exe process and remove niteaim.exe from Windows startup using RegRun Startup Optimizer.

%windir%\niw.exe

niw.exe is a Trojan.Lewor-U.
niw.exe opens a back door.
niw.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%Windows%\niw.exe
%System%\impai.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill niw.exe process and remove niw.exe from Windows startup using RegRun Startup Optimizer.

%windir%\nm32.dll

nm32.dll is Trojan/Backdoor.
Kill the file nm32.dll and remove nm32.dll from Windows startup using RegRun Reanimator.
http://www.regrun.com

%windir%\nm32.exe

nm32.exe is a Trojan Keylogger.Stranget.B.
nm32.exe tries to terminate antiviral programs installed on a user computer.
nm32.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Windir%\fyt\nm32.exe
Adds the value:
"ujm" = "%Windir%\fyt\nm32.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill the process nm32.exe and remove nm32.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%windir%\nnmgr.exe

nnmgr.exe is a Adware.FFToolBar.
nnmgr.exe display advertisements.
Related files:
%ProgramFiles%\FastFinder\fftoolbar.dll
%System%\ShowFF.exe
%Windir%\CJet.exe
%Windir%\nnmgr.exe
%Windir%\omi.dll
Adds the value:
"ShowFF" = "C:\Windows\System32\ShowFF.exe"
"nnmgr" = "C:\Windows\nnmgr.exe"
"CJET" = "C:\Windows\CJet.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill nnmgr.exe process and remove nnmgr.exe from Windows startup using RegRun Startup Optimizer.

%windir%\nomtojz.exe

%WinDir%\NOMTOJZ.EXE is Trojan/Backdoor.
Kill the process NOMTOJZ.EXE and remove NOMTOJZ.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

%windir%\norton_antivirus.exe

Trojan Backdoor.Netjoe.
1.Registers in Windows startup.
2. Opens a backdoor on the infected computer through TCP ports 3436 and 3437.
Remove it from startup using RegRun Startup Optimizer.

%windir%\notepa.exe

Notepa.exe is Trojan/Backdoor.
Kill the process Notepa.exe and remove Notepa.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%windir%\notepad.exe

Notepad.exe is a mass-mailing worm W32.Alco.AB@mm.
Notepad.exe opens a back door on random TCP port.
Notepad.exe spreads by e-mail and via open network shares.
Related files:
%Windir%\Taskman.exe
%Windir%\Notepad.exe
%Windir%\Wjview.exe
%Windir%\Errorlog.exe
%ProgramFiles%\Evol.exe
%ProgramFiles%\Msn.exe
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill Notepad.exe process and remove Notepad.exe from Windows startup using RegRun Startup Optimizer.

%windir%\notepad.exe.exe

notepad.exe.exe is a mass-mailing worm W32.Renama.A@mm.
notepad.exe.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%Windir%\system\svchost.exe
%System%\ERSvc.exe
%Windir%\mmsg\mcAfee.Update.exe.exe
%Windir%\mmsg\mmsg.exe.exe
%Windir%\Config\Easy.Windows.Monitoring.exe.exe
%Windir%\Config\system.update.exe.exe
%Windir%\notepad.exe.exe
Adds the value:
"notepad" = "%Windir%\notepad.exe.exe"
"mmsg" = "%Windir%\mmsg\mmsg.exe.exe"
"system.update" = "%Windir%\Config\system.update.exe.exe"
"mcAfee.Instan.Update" = "%Windir%\mmsg\mcAfee.Update.exe.exe"
"Easy.Windows.Monitor" = "%Windir%\Config\Easy.Windows.Monitoring.exe.exe"
"ImagePath" = "%System%\ERSvc.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill the process notepad.exe.exe and remove notepad.exe.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%windir%\nssrv.exe

nssrv.exe is rootkit W32/Tilebot-EK.
nssrv.exe is used to hide files, processes and registry.
nssrv.exe is a kernel mode rootkit.
Rootkit contacts remote hacker server using HTTP session.
nssrv.exe spreads via open network shares.
Related files:
%SysDir%\rofl.sys
%WinDir%\nssrv.exe

nssrv.exe is created new system drivers:
service name: "Microsoft Name Server"
display name: "Microsoft Name Server"
Adds the value:
HKLM\SYSTEM\CurrentControlSet\Services\Microsoft Name Server\
to the Windows startup registry keys.

rofl.sys is created new system drivers:
service name: " rofl"
display name: " rofl"
Added to registry:
HKLM\SYSTEM\CurrentControlSet\Services\rofl\

Adds the value:
HKLM\SYSTEM\CurrentControlSet\Services\Messenger
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\RemoteRegistry
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\TlntSvr
Start
4
to the Windows startup registry keys.

Added to registry:
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
DoNotAllowXPSP2
1

HKLM\SOFTWARE\Microsoft\Ole
EnableDCOM
N

HKLM\SYSTEM\CurrentControlSet\Control\Lsa
restrictanonymous
1

Registry entries are created under:

HKLM\SOFTWARE\Microsoft\Security Center\
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\

More info: http://www.sophos.com/virusinfo/analyses...

%windir%\ntdlr.dll

ntdlr.dll is a Trojan.Feutel-CH.
ntdlr.dll opens a back door.
Related files:
%Windows%\ntdlr.exe
%Windows%\ntdlr.dll
%Windows%\ntdlr_Hook.DLL
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove ntdlr.dll from Windows startup using RegRun Startup Optimizer.

%windir%\ntdlr.exe

ntdlr.exe is a Trojan.Feutel-CH.
ntdlr.exe opens a back door.
Related files:
%Windows%\ntdlr.exe
%Windows%\ntdlr.dll
%Windows%\ntdlr_Hook.DLL
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill ntdlr.exe process and remove ntdlr.exe from Windows startup using RegRun Startup Optimizer.

%windir%\ntdlr_hook.dll

ntdlr_Hook.dll is a Trojan.Feutel-CH.
ntdlr_Hook.dll opens a back door.
Related files:
%Windows%\ntdlr.exe
%Windows%\ntdlr.dll
%Windows%\ntdlr_Hook.DLL
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove ntdlr_Hook.dll from Windows startup using RegRun Startup Optimizer.

%windir%\nted.exe

%WinDir%\nted.exe is Trojan/Backdoor.
Kill the process %WinDir%\nted.exe and remove %WinDir%\nted.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%windir%\ntinvisible.dll

NTInvisible.dll is a Spyware.Keycaptor.
NTInvisible.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%ProgramFiles%\KeyCaptor\KeyCaptor.exe
%ProgramFiles%\KeyCaptor\NoStealth.exe
%Windir%\NTInvisible.dll
%Windir%\SystemSA32.dll
%Windir%\unvise32.exe
Adds the value:
"Srv32Win" = "%ProgramFiles%\KeyCaptor\KeyCaptor.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove NTInvisible.dll from Windows startup using RegRun Startup Optimizer.

%windir%\nvidcgui.exe

nvidcgui.exe is a worm W32.Tilebot-GS.
nvidcgui.exe opens a back door on IRC channels.
nvidcgui.exe spreads via open network shares.
Related files:
%Windows%\nvidcgui.exe
%System%\remon.sys
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill nvidcgui.exe process and remove nvidcgui.exe from Windows startup using RegRun Startup Optimizer.

%windir%\nvidguiv.exe

nvidGUIv.exe is a Trojan W32.Tilebot-DK.
nvidGUIv.exe opens a back door on IRC channels.
nvidGUIv.exe spreads by AOL Instant Messenger and via open network shares.
nvidGUIv.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%Windows%\nvidGUIv.exe
%System%\remon.sys
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill the process nvidGUIv.exe and remove nvidGUIv.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%windir%\nvmsgdwn.exe

NVMSGDWN.EXE is Trojan.Graber-D.
NVMSGDWN.EXE downloads code from the internet.
Related files:
%WinDir%\NVMSGDWN.EXE
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill NVMSGDWN.EXE process and remove NVMSGDWN.EXE from Windows startup using RegRun Startup Optimizer.

%windir%\nwf.exe

%WinDir%\nwf.exe is Trojan/Backdoor.
Kill the process %WinDir%\nwf.exe and remove %WinDir%\nwf.exe from Windows startup.

%windir%\nwisse.exe

nwisse.exe is a Trojan.Fusion-B.
nwisse.exe opens a back door.
nwisse.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Windows%\nwisse.exe
%Windows%\winspols.scr
%System%\emgfx.exe
%System%\svch0st.com
%System%\svchost.klg
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill nwisse.exe process and remove nwisse.exe from Windows startup using RegRun Startup Optimizer.

%windir%\nwqgqgo.exe

NWQGQGO.EXE is Trojan/Backdoor.
Kill the process NWQGQGO.EXE and remove NWQGQGO.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

%windir%\omi.dll

omi.dll is a Adware.FFToolBar.
omi.dll display advertisements.
Related files:
%ProgramFiles%\FastFinder\fftoolbar.dll
%System%\ShowFF.exe
%Windir%\CJet.exe
%Windir%\nnmgr.exe
%Windir%\omi.dll
Adds the value:
"ShowFF" = "C:\Windows\System32\ShowFF.exe"
"nnmgr" = "C:\Windows\nnmgr.exe"
"CJET" = "C:\Windows\CJet.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove omi.dll from Windows startup using RegRun Startup Optimizer.

%windir%\osrwin32.exe

%WinDir%\Osrwin32.exe (windhost.exe) is BANKER-CB TROJAN.
Kill the process %WinDir%\Osrwin32.exe (windhost.exe) and remove %WinDir%\Osrwin32.exe (windhost.exe) from Windows using RegRun.
www.regrun.com

%windir%\p2sys.dll

p2sys.dll is a Trojan.LdPinch-UE.
p2sys.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Windows%\svchost.exe
%Windows%\p2sys.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove p2sys.dll from Windows startup using RegRun Startup Optimizer.

%windir%\package_ieplugin4.exe

package_IEPLUGIN4.exe is an adware program Adware.IEPlugin.
package_IEPLUGIN4.exe monitors user Internet activity.
package_IEPLUGIN4.exe displays advertising information.
Related files:
%Windir%\pxckdla.exe
%Windir%\pxckdlauninstall.exe
%Windir%\Wupdt.exe
%Windir%\wdskctl.exe
%Windir%\systb.dll
%Windir%\systb.exe
%Windir%\snbho.exe
%Windir%\winserv.exe
%Windir%\extract.exe
%Windir%\rgrt.exe
%Windir%\package_IEPLUGIN4.exe
Adds the value:
"Win Server Updt" = "%WinDir%\[dropped adware file]"
"Win Server" = "%WinDir%\winserv.exe"
"wdskctl" = "C:\Windows\wdskctl.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill package_IEPLUGIN4.exe process and remove package_IEPLUGIN4.exe from Windows startup using RegRun Startup Optimizer.

%windir%\pchealth\pcguard.exe

%WinDir%\PCHEALTH\PCGuard.exe is W32.Bakain.
Related files:
%Windir%\Web\Folder.htt
%Windir%\PCHEALTH\PCGuard.exe
%Windir%\lExplorer.exe
%Windir%\SERVICE5.exe
%Windir%\INF\Systroy.exe
%System%\Script.exe
[NETWORK SHARE]\Desktop.ini
[NETWORK SHARE]\SysFix.htt
[NETWORK SHARE]\About Linda.exe
%UserProfile%\Desktop.ini
%UserProfile%\SysFix.htt
%UserProfile%\All Users\Start Menu\Programs\Startup\Welcome.exe
Read more: http://www.symantec.com/enterprise/secur...
Kill the process %WinDir%\PCHEALTH\PCGuard.exe and remove %WinDir%\PCHEALTH\PCGuard.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%windir%\pclk.exe

PClK.exe is a Trojan.LegMir-BL.
PClK.exe tries to terminate antiviral programs installed on a user computer.
PClK.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Windows%\PClK.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill PClK.exe process and remove PClK.exe from Windows startup using RegRun Startup Optimizer.

%windir%\pi1.exe

pi1.exe is a Spyware.e2give.
pi1.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%ProgramFiles%\E2g\iebhos.dll
%Windir%\pi1.exe
%System%\pruttct.exe
%System%\skytown.exe
%System%\prutpct.exe
%System%\ptech.exe
%System%\prutsct.exe
%System%\askearth17.exe
%UserProfile%\Desktop\filgmo.exe
%UserProfile%\Local Settings\Temp\ei.exe
Adds the value:
"pruttct" = "[path to Adware]"
"filgmo" = "C:\Documents and Settings\symantec\Desktop\filgmo.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill pi1.exe process and remove pi1.exe from Windows startup using RegRun Startup Optimizer.

%windir%\playavi.exe

playavi.exe is a Trojan PWSteal.Gamanlock.
playavi.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Windir%\java\playavi.exe
Adds the value:
"Playboy" = "%Windir%\java\playavi.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill playavi.exe process and remove playavi.exe from Windows startup using RegRun Startup Optimizer.

%windir%\pooldata\csrss.exe

%WinDir%\PoolData\csrss.exe is W32.Sober.AA@mm.
W32.Sober.AA@mm is a mass-mailing worm that sends itself out as an email attachment. It also lowers security settings on the compromised computer.
Related files:
%Windir%\PoolData\csrss.exe
%Windir%\PoolData\services.exe
%Windir%\PoolData\smss.exe
%Windir%\PoolData\spxttx1.xnt
%Windir%\PoolData\spxttx2.xnt
%Windir%\PoolData\spxttx3.xnt
%Windir%\PoolData\runnor.ssy
%Windir%\PoolData\xpsys.ddr
%Windir%\PoolData\WinD.osa
Read more: http://www.symantec.com/enterprise/secur...
Kill the process %WinDir%\PoolData\csrss.exe and remove %WinDir%\PoolData\csrss.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%windir%\popadstop.exe

popadstop.exe is an adware program Adware.PopAdStop.
popadstop.exe monitors user Internet activity.
Related files:
%Windir%\GPinstall.exe
%Windir%\popadstop.exe
Adds the value:
"PopAdStop"="\popadstop.exe s"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill popadstop.exe process and remove popadstop.exe from Windows startup using RegRun Startup Optimizer.

%windir%\prntsvra.dll

Prntsvra.dll is a Trojan Backdoor.Nibu.J.
Prntsvra.dll spreads via open network shares.
Prntsvra.dll tries to terminate antiviral programs installed on a user computer.
Prntsvra.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\winldra.exe
%Windir%\dvpd.dll
%Windir%\netdx.dat
%Windir%\socks.dat
%Windir%\prntsvra.dll
%Windir%\TEMP\fa4537ef.tmp
%Windir%\prntk.log
%Windir%\prntc.log
Adds the value:
"load32" = "%System%\winldra.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove prntsvra.dll from Windows startup using RegRun Startup Optimizer.

%windir%\process.exe

Process.exe is PWSteal.Bancos.P Trojan.
Process.exe steals password and bank information.
Adds the value:
"process.exe" = "%Windir%\process.exe"
to the Windows startup registry keys.
Process.exe monitors active Internet Explorer windows. It logs keyboard presses and visited domains.
Process.exe sends information to a Web server on the domain of woolenhol.com.

%windir%\psexec.exe

%WinDir%\psexec.exe is Troj/MDrop-BPQ.
Related files:
%Windows%\ichan.txt
%Windows%\inv.txt
%Windows%\libparse.exe
%Windows%\login.txt
%Windows%\mcop.dll
%Windows%\os32.txt
%Windows%\ping.exe
%Windows%\pnp11.exe
%Windows%\psexec.exe
%Windows%\r.ini
%Windows%\reader.w
%Windows%\stde9.exe
%Windows%\tskdbg.exe
%Windows%\vlxd.bat
%Windows%\x89.reg
Read more: http://www.sophos.com/security/analyses/...
Kill the process %WinDir%\psexec.exe and remove %WinDir%\psexec.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%windir%\ptmens.exe

Ptmens.exe is a Trojan.Bancos-ED.
Ptmens.exe monitors user Internet activity and bank information.
It sends stolen data to a hacker site.
Related files:
%Windows%\Ptmens.exe
%System%\REGPTMENS.EXE
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill Ptmens.exe process and remove Ptmens.exe from Windows startup using RegRun Startup Optimizer.

%windir%\ptsnoop.exe

Ptsnoop.exe is a virus W32.Elet.
Ptsnoop.exe deletes .exe files from the %windir% and the %system% folders.
Related files:
%windir%\Ptsnoop.exe
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill Ptsnoop.exe process and remove Ptsnoop.exe from Windows startup using RegRun Startup Optimizer.

%windir%\pwrtst32.dll

pwrtst32.dll is Trojan/Backdoor.
Remove pwrtst32.dll using RegRun "Scan for Viruses" feature.
http://www.regrun.com

%windir%\pxckdlauninstall.exe

Pxckdlauninstall.exe is an adware program Adware.IEPlugin.
Pxckdlauninstall.exe monitors user Internet activity.
Pxckdlauninstall.exe displays advertising information.
Related files:
%Windir%\pxckdla.exe
%Windir%\pxckdlauninstall.exe
%Windir%\Wupdt.exe
%Windir%\wdskctl.exe
%Windir%\systb.dll
%Windir%\systb.exe
%Windir%\snbho.exe
%Windir%\winserv.exe
%Windir%\extract.exe
%Windir%\rgrt.exe
%Windir%\package_IEPLUGIN4.exe
Adds the value:
"Win Server Updt" = "%WinDir%\[dropped adware file]"
"Win Server" = "%WinDir%\winserv.exe"
"wdskctl" = "C:\Windows\wdskctl.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill pxckdlauninstall.exe process and remove pxckdlauninstall.exe from Windows startup using RegRun Startup Optimizer.

%windir%\pynix.dll

Pynix.dll is an adware program Adware.BetterInternet.
Pynix.dll is a Browser Helper Object.
Pynix.dll downloads and displays advertisements.
Related files:
%Windir%\Bi.dll
%Windir%\speeryox.dll
%Windir%\Mxtarget.dll
%Windir%\BTGrab.dll
%Windir%\farmmext.exe
%Windir%\dlmax.dll
%Windir%\speer2.dll
%Windir%\VoiceIP.dll
%Windir%\morphacl.dll
%Windir%\Pynix.dll
%Windir%\Biprep.exe
%Windir%\banner.dll
%System%\laziqn.exe
%System%\xxvyaj.exe
%System%\wbtvsffd.exe
%System%\nnmzoq.exe
%Temp%\DrTemp\thnall1b.exe
%Temp%\DrTemp\thnall1p.exe
%Temp%\DrTemp\thnall2r.exe
%Temp%\DrTemp\polall1b.exe
%Temp%\thnall1s.exe
%Temp%\morphrec.exe
Adds the value:
"[File name of adware]" = "[File path to adware]"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove Pynix.dll from Windows startup using RegRun Startup Optimizer.

%windir%\q4keygen.exe

Q4Keygen.exe is a W32.Mircnuf-A.
Q4Keygen.exe opens a back door on IRC channels.
Related files:
%Windows%\Q4Keygen.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill Q4Keygen.exe process and remove Q4Keygen.exe from Windows startup using RegRun Startup Optimizer.

%windir%\quicktmelib.dll

QuicktmeLib.dll is a Trojan.LeechPie-D.
QuicktmeLib.dll opens a back door.
QuicktmeLib.dll tries to terminate antiviral programs installed on a user computer.
Related files:
%Windows%\pk.log
%Windows%\un\ComDlg.dll
%Windows%\un\ComDlg.ocx
%Windows%\un\CommonDlg32.pk1
%Windows%\un\CommonDlg32.pk2
%Windows%\un\acls.exe
%Windows%\un\admdll.dll
%Windows%\un\confini.exe
%Windows%\un\delsrv.exe
%Windows%\un\dtreg.exe
%Windows%\un\exe.bat
%Windows%\un\exec.bat
%Windows%\un\hiderun.exe
%Windows%\un\kill.exe
%Windows%\un\ntsvc.ocx
%Windows%\un\scvhost.exe
%Windows%\un\secure.exe
%Windows%\un\secure2.exe
%Windows%\un\serv.exe
%Windows%\un\wmc.exe
%System%\QuicktmeLib.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove QuicktmeLib.dll from Windows startup using RegRun Startup Optimizer.

%windir%\rakyatkelaparan.exe

RakyatKelaparan.exe is a worm W32.Brontok-L.
RakyatKelaparan.exe spreads by e-mail.
Related files:
%Windows%\KesenjanganSosial.exe
%Windows%\ShellNew\RakyatKelaparan.exe
%System%\cmd-brontok.exe
br6591on.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill RakyatKelaparan.exe process and remove RakyatKelaparan.exe from Windows startup using RegRun Startup Optimizer.

%windir%\ramex.exe

ramex.exe is a Backdoor/Trojan.
Related files:
%WinDir%\ramex.exe
Removal:
Kill ramex.exe process and remove ramex.exe from Windows startup using RegRun Startup Optimizer.

%windir%\rasdfgl32.exe

rasdfgl32.exe is a Trojan W32.Tilebot-CH.
rasdfgl32.exe opens a back door on IRC channels.
rasdfgl32.exe spreads via open network shares.
Related files:
%Windows%\rasdfgl32.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill rasdfgl32.exe process and remove rasdfgl32.exe from Windows startup using RegRun Startup Optimizer.

%windir%\ratsou.exe

Ratsou.exe is a Trojan Backdoor.IRC.Ratsou.B.
Ratsou.exe spreads via open network shares.
Related files:
C:\Note.exe
%System%\Hid.exe
%System%\Explorer.dll
%System%\Iexplore.dll
%Windir%\Aim.dll
%Windir%\Boot.exe
%Windir%\C.dll
%Windir%\Crazy.exe
%Windir%\Dr.exe
%Windir%\Empavms.exe
%Windir%\Ipservers.dll
%Windir%\Java.dll
%Windir%\LibParse.exe
%Windir%\Lsass.exe
%Windir%\Miconfig.exe
%Windir%\Moo.dll
%Windir%\Msccl.dll
%Windir%\Msconig.exe
%Windir%\Nhtml.dll
%Windir%\Ratsou.exe
%Windir%\Regedit.dll
%Windir%\Restart.exe
%Windir%\Screen.dll
%Windir%\Sysboot.dll
%Windir%\Syste32.dll
%Windir%\Users.dll
%Windir%\Wind.dll
Adds the value:
"HID.EXE"="%System%\HID.EXE"
"lsass"="%Windir%\Debug\UserMode\lsass.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill Ratsou.exe process and remove Ratsou.exe from Windows startup using RegRun Startup Optimizer.

%windir%\rdriv.sys

rdriv.sys is rootkit W32.Tilebot-HF.
rdriv.sys is used to hide files, processes and registry.
rdriv.sys is a kernel mode rootkit.
Rootkit contacts remote hacker server using HTTP session.
realplayers.exe opens a back door on IRC channels.
realplayers.exe spreads via open network shares.
Rootkit creates new system drivers:
service name: "rdriv"
display name: "rdriv"

service name: "trojans"
display name: "this change me"
Related files:
%WinDir%\realplayers.exe
%SysDir%\rdriv.sys
Adds the value:
HKLM\SYSTEM\CurrentControlSet\Services\trojans\

HKLM\SYSTEM\CurrentControlSet\Services\Messenger
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\RemoteRegistry
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\TlntSvr
Start
4
to the Windows startup registry keys.

to the Windows startup registry keys.
Added to registry:
HKLM\SYSTEM\CurrentControlSet\Services\rdriv\
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions
Installed Time Me

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions
Record Me
272962

HKLM\SOFTWARE\Microsoft\Security Center
AntiVirusDisableNotify
1

HKLM\SOFTWARE\Microsoft\Security Center
AntiVirusOverride
1

HKLM\SOFTWARE\Microsoft\Security Center
FirewallDisableNotify
1

HKLM\SOFTWARE\Microsoft\Security Center
FirewallOverride
1

HKLM\SOFTWARE\Microsoft\Security Center
UpdatesDisableNotify
1

HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
DoNotAllowXPSP2
1

HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile
EnableFirewall
0

HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile
EnableFirewall
0

HKLM\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters
AutoShareServer
0

HKLM\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters
AutoShareWks
0

HKLM\SYSTEM\CurrentControlSet\Services\lanmanworkstation\parameters
AutoShareServer
0

HKLM\SYSTEM\CurrentControlSet\Services\lanmanworkstation\parameters
AutoShareWks
0

HKLM\SYSTEM\CurrentControlSet\Control\
WaitToKillServiceTimeout
7000

HKLM\SOFTWARE\Microsoft\Ole
EnableDCOM
N

HKLM\SYSTEM\CurrentControlSet\Control\Lsa
restrictanonymous
1
More info: http://www.sophos.com/security/analyses/...

%windir%\recycled.exe

Recycled.exe is a Trojan.VBClick-A.
Recycled.exe opens a back door.
Recycled.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%Windows%\Recycled.exe
%System%\Rundll32.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill Recycled.exe process and remove Recycled.exe from Windows startup using RegRun Startup Optimizer.

%windir%\regedit.dll

Regedit.dll is a Trojan Backdoor.IRC.Ratsou.B.
Regedit.dll spreads via open network shares.
Related files:
C:\Note.exe
%System%\Hid.exe
%System%\Explorer.dll
%System%\Iexplore.dll
%Windir%\Aim.dll
%Windir%\Boot.exe
%Windir%\C.dll
%Windir%\Crazy.exe
%Windir%\Dr.exe
%Windir%\Empavms.exe
%Windir%\Ipservers.dll
%Windir%\Java.dll
%Windir%\LibParse.exe
%Windir%\Lsass.exe
%Windir%\Miconfig.exe
%Windir%\Moo.dll
%Windir%\Msccl.dll
%Windir%\Msconig.exe
%Windir%\Nhtml.dll
%Windir%\Ratsou.exe
%Windir%\Regedit.dll
%Windir%\Restart.exe
%Windir%\Screen.dll
%Windir%\Sysboot.dll
%Windir%\Syste32.dll
%Windir%\Users.dll
%Windir%\Wind.dll
Adds the value:
"HID.EXE"="%System%\HID.EXE"
"lsass"="%Windir%\Debug\UserMode\lsass.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove Regedit.dll from Windows startup using RegRun Startup Optimizer.

%windir%\regedit2.exe

regedit2.exe is a Trojan.Lydra-C.
regedit2.exe tries to terminate antiviral programs installed on a user computer.
regedit2.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Windows%\calc.exe
%Windows%\internat.exe
%Windows%\lsass32.exe
%Windows%\mui\modem.sys
%Windows%\regedit2.exe
%Windows%\userun32.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill regedit2.exe process and remove regedit2.exe from Windows startup using RegRun Startup Optimizer.

%windir%\registry1.dll

Registry1.dll is a mass-mailing worm W32.Minusia-A.
Registry1.dll opens a back door on IRC channels.
Registry1.dll spreads by e-mail and via open network shares.
Registry1.dll deletes files off the computer.
Registry1.dll tries to terminate antiviral programs installed on a user computer.
Registry1.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Program Files%\Messenger\msmsgs.exe.exe
%Windows%\Config\system.update.exe.exe
%Windows%\mmsg\mcAfee.Update.exe.exe
%Windows%\mmsg\mmsg.exe.exe
%System%\svchost.exe
%System%\ERSvc.exe
%Windows%\Registry1.dll
%Windows%\Registry2.dll
%Windows%\system_log.txt
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove Registry1.dll RegRun "Scan for Viruses" feature.
http://www.regrun.com

%windir%\registry2.dll

Registry2.dll is a mass-mailing worm W32.Minusia-A.
Registry2.dll opens a back door on IRC channels.
Registry2.dll spreads by e-mail and via open network shares.
Registry2.dll deletes files off the computer.
Registry2.dll tries to terminate antiviral programs installed on a user computer.
Registry2.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Program Files%\Messenger\msmsgs.exe.exe
%Windows%\Config\system.update.exe.exe
%Windows%\mmsg\mcAfee.Update.exe.exe
%Windows%\mmsg\mmsg.exe.exe
%System%\svchost.exe
%System%\ERSvc.exe
%Windows%\Registry1.dll
%Windows%\Registry2.dll
%Windows%\system_log.txt
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove Registry2.dll RegRun "Scan for Viruses" feature.
http://www.regrun.com

%windir%\regmon32.exe

regmon32.exe is a Trojan W32.Sdbot-ALK.
regmon32.exe opens a back door on IRC channels.
regmon32.exe spreads via open network shares.
Related files:
%Windows%\regmon32.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill regmon32.exe process and remove regmon32.exe from Windows startup using RegRun Startup Optimizer.

%windir%\rejoice_06.exe

rejoice_06.exe is a Trojan.GrayBrd-Y.
rejoice_06.exe opens a back door.
Related files:
%Windows%\rejoice_06.exe
%Windows%\rejoice_06.exehook.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill rejoice_06.exe process and remove rejoice_06.exe from Windows startup using RegRun Startup Optimizer.

%windir%\rejoice_06.exehook.dll

rejoice_06.exehook.dll is a Trojan.GrayBrd-Y.
rejoice_06.exehook.dll opens a back door.
Related files:
%Windows%\rejoice_06.exe
%Windows%\rejoice_06.exehook.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove rejoice_06.exehook.dll from Windows startup using RegRun Startup Optimizer.

%windir%\restart.exe

Restart.exe is a Trojan Backdoor.IRC.Ratsou.B.
Restart.exe spreads via open network shares.
Related files:
C:\Note.exe
%System%\Hid.exe
%System%\Explorer.dll
%System%\Iexplore.dll
%Windir%\Aim.dll
%Windir%\Boot.exe
%Windir%\C.dll
%Windir%\Crazy.exe
%Windir%\Dr.exe
%Windir%\Empavms.exe
%Windir%\Ipservers.dll
%Windir%\Java.dll
%Windir%\LibParse.exe
%Windir%\Lsass.exe
%Windir%\Miconfig.exe
%Windir%\Moo.dll
%Windir%\Msccl.dll
%Windir%\Msconig.exe
%Windir%\Nhtml.dll
%Windir%\Ratsou.exe
%Windir%\Regedit.dll
%Windir%\Restart.exe
%Windir%\Screen.dll
%Windir%\Sysboot.dll
%Windir%\Syste32.dll
%Windir%\Users.dll
%Windir%\Wind.dll
Adds the value:
"HID.EXE"="%System%\HID.EXE"
"lsass"="%Windir%\Debug\UserMode\lsass.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill Restart.exe process and remove Restart.exe from Windows startup using RegRun Startup Optimizer.

%windir%\rfa.dll

rfa.dll is a Trojan PWSteal.Bankash.F.
rfa.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Windir%\rfa.dll
%Windir%\t593.exe
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove rfa.dll from Windows startup using RegRun Startup Optimizer.

%windir%\rgrt.exe

Rgrt.exe is an adware program Adware.IEPlugin.
Rgrt.exe monitors user Internet activity.
Rgrt.exe displays advertising information.
Related files:
%Windir%\pxckdla.exe
%Windir%\pxckdlauninstall.exe
%Windir%\Wupdt.exe
%Windir%\wdskctl.exe
%Windir%\systb.dll
%Windir%\systb.exe
%Windir%\snbho.exe
%Windir%\winserv.exe
%Windir%\extract.exe
%Windir%\rgrt.exe
%Windir%\package_IEPLUGIN4.exe
Adds the value:
"Win Server Updt" = "%WinDir%\[dropped adware file]"
"Win Server" = "%WinDir%\winserv.exe"
"wdskctl" = "C:\Windows\wdskctl.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill rgrt.exe process and remove rgrt.exe from Windows startup using RegRun Startup Optimizer.

%windir%\rmagentoutput.dll

%WinDir%\RMAgentOutput.dll is Trojan/Backdoor.
Kill the file %WinDir%\RMAgentOutput.dll and remove %WinDir%\RMAgentOutput.dll from Windows startup using RegRun.
www.regrun.com

%windir%\rogger.exe

%WinDir%\rogger.exe is Trojan/Backdoor.
Kill the process rogger.exe and remove rogger.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%windir%\rsr2b.exe

RSR2B.EXE is a Spyware.WebSurfWatch.
RSR2B.EXE monitors user Internet activity.
Related files:
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\WIND0WS.EXE
%ProgramFiles%\SWIS\WSW.exe
%Windir%\RSR2B.EXE
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill RSR2B.EXE process and remove RSR2B.EXE from Windows startup using RegRun Startup Optimizer.

%windir%\rudll.exe

rudll.exe is a Trojan.Hupigon-CF.
rudll.exe opens a back door.
Related files:
%Windows%\rudll.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill rudll.exe process and remove rudll.exe from Windows startup using RegRun Startup Optimizer.

%windir%\rundll132.exe

rundll132.exe is a Trojan.Ragrok-A.
rundll132.exe tries to terminate antiviral programs installed on a user computer.
rundll132.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Windows%\rundll132.exe
%System%\rodll.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill rundll132.exe process and remove rundll132.exe from Windows startup using RegRun Startup Optimizer.

%windir%\rundll32.exe

%WinDir%\rundll32.exe is IM-Worm.Win32.Funner.
Related files:
%System%\IEXPLORE.EXE
%System%\explorer.exe
%System%\userinit32.exe
%System%\bsfirst2.log
Read more: http://www.viruslist.com/en/viruses/ency...
Kill the process %WinDir%\rundll32.exe and remove %WinDir%\rundll32.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%windir%\runwin32.exe

runwin32.exe is a Trojan.VB-AET.
runwin32.exe opens a back door.
Related files:
%Windows%\runwin32.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill runwin32.exe process and remove runwin32.exe from Windows startup using RegRun Startup Optimizer.

%windir%\sa55er.exe

SA55ER.EXE is a mass-mailing worm W32.Hilder-A.
SA55ER.EXE tries to terminate antiviral programs installed on a user computer.
Related files:
funny.exe
unbelieveable.exe
C:\wichtig.exe
C:\FUUU.exe
%Windows%\INF3CTED.EXE
%Windows%\NET5KY.EXE
%Windows%\SA55ER.EXE
%Windows%\MYD00M.EXE
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill the process SA55ER.EXE and remove SA55ER.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

%windir%\sachostx.exe

sachostx.exe is a mass-mailing worm W32.Looksky.A@mm.
sachostx.exe opens a back door on TCP port 321.
sachostx.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%Windir%\sachostx.exe
%System%\msvcrl.dll
%System%\sachostb.exe
%System%\sachostc.exe
%System%\sachostp.exe
%System%\sachosts.exe
%System%\sachostw.exe
%System%\sachostm.exe
Adds the value:
"HostSrv" = "%Windir%\sachostx.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill sachostx.exe process and remove sachostx.exe from Windows startup using RegRun Startup Optimizer.

%windir%\saveruser.exe

saveruser.exe is a Trojan.Shpiel-A.
saveruser.exe opens a back door.
Related files:
%Windows%\msnupdate.exe
%Windows%\winfog.exe
%Windows%\winsys.exe.
%Windows%\lsass1.exe
%Windows%\lovcx.exe
%Windows%\winsress.exe
%Windows%\winlog.exe.
%Windows%\winsock.exe.
%Windows%\saveruser.exe
%Windows%\winbackup.exe.
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill saveruser.exe process and remove saveruser.exe from Windows startup using RegRun Startup Optimizer.

%windir%\sbrowse.exe

Sbrowse.exe is a Spyware.SpyAgent.B.
Sbrowse.exe is a commercial keylogger/system-monitoring program.
Related files:
%System%\ntinvisible.dll
%Windir%\libimg.dll
%Windir%\sbrowse.exe
%Windir%\snmpapi.dll
%Windir%\yahoodll.dll
%ProgramFiles%\Spytech Software\Spytech SpyAgent\sagent.exe
%ProgramFiles%\Spytech Software\Spytech SpyAgent\deploy.exe
%ProgramFiles%\Spytech Software\Spytech SpyAgent\nostealth.exe
%ProgramFiles%\Spytech Software\Spytech SpyAgent\sysdiag.exe
Adds the value:
"System32"="%ProgramFiles%\Spytech Software\Spytech SpyAgent\sysdiag.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill sbrowse.exe process and remove sbrowse.exe from Windows startup using RegRun Startup Optimizer.

%windir%\sc_reader.exe

SC_Reader.exe is a Trojan/Backdoor.
Kill the process SC_Reader.exe and remove SC_Reader.exe from Windows startup.

%windir%\scan.exe

Scan.exe is a mass-mailing worm W32.Reatle.I@mm.
Scan.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%Windir%\bagle.exe
%System%\mcafee.exe
%Windir%\scan.exe
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill scan.exe process and remove scan.exe from Windows startup using RegRun Startup Optimizer.

%windir%\scerver.dll

Scerver.DLL is a Trojan.Hupigon-CG.
Scerver.DLL opens a back door.
Related files:
%Windows%\Scerver.DLL
%Windows%\ScerverKey.DLL
%Windows%\Scerver_Hook.DLL
%System%\rapcklo.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove Scerver.DLL from Windows startup using RegRun Startup Optimizer.

%windir%\scerver_hook.dll

Scerver_Hook.DLL is a Trojan.Hupigon-CG.
Scerver_Hook.DLL opens a back door.
Related files:
%Windows%\Scerver.DLL
%Windows%\ScerverKey.DLL
%Windows%\Scerver_Hook.DLL
%System%\rapcklo.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove Scerver_Hook.DLL from Windows startup using RegRun Startup Optimizer.

%windir%\scerverkey.dll

ScerverKey.DLL is a Trojan.Hupigon-CG.
ScerverKey.DLL opens a back door.
Related files:
%Windows%\Scerver.DLL
%Windows%\ScerverKey.DLL
%Windows%\Scerver_Hook.DLL
%System%\rapcklo.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove ScerverKey.DLL from Windows startup using RegRun Startup Optimizer.

%windir%\schedul3.exe

schedul3.exe is a Trojan W32.Rbot-AVT.
schedul3.exe opens a back door on IRC channels.
schedul3.exe spreads via open network shares.
Related files:
%Windows%\schedul3.exe
%System%\rdriv.sys
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill schedul3.exe process and remove schedul3.exe from Windows startup using RegRun Startup Optimizer.

%windir%\sclureg32a.dll

Sclureg32a.dll is a Trojan PWSteal.Drorar.
Sclureg32a.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Program Files%\Common Files\system\ado\mssrv.exe
%Program Files%\Common Files\system\svchost.exe
%Windir%\WindowsUpdate.dat
%Windir%\sclureg32a.dll
%Windir%\winsock_32a.dll
Adds the value:
"PathName" = "%Windir%\winsock_32a.dll"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove sclureg32a.dll from Windows startup using RegRun Startup Optimizer.

%windir%\screen.dll

Screen.dll is a Trojan Backdoor.IRC.Ratsou.B.
Screen.dll spreads via open network shares.
Related files:
C:\Note.exe
%System%\Hid.exe
%System%\Explorer.dll
%System%\Iexplore.dll
%Windir%\Aim.dll
%Windir%\Boot.exe
%Windir%\C.dll
%Windir%\Crazy.exe
%Windir%\Dr.exe
%Windir%\Empavms.exe
%Windir%\Ipservers.dll
%Windir%\Java.dll
%Windir%\LibParse.exe
%Windir%\Lsass.exe
%Windir%\Miconfig.exe
%Windir%\Moo.dll
%Windir%\Msccl.dll
%Windir%\Msconig.exe
%Windir%\Nhtml.dll
%Windir%\Ratsou.exe
%Windir%\Regedit.dll
%Windir%\Restart.exe
%Windir%\Screen.dll
%Windir%\Sysboot.dll
%Windir%\Syste32.dll
%Windir%\Users.dll
%Windir%\Wind.dll
Adds the value:
"HID.EXE"="%System%\HID.EXE"
"lsass"="%Windir%\Debug\UserMode\lsass.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove Screen.dll from Windows startup using RegRun Startup Optimizer.

%windir%\scrsss.exe

Scrsss.exe is a Trojan.GrayBrd-AM.
Scrsss.exe opens a back door.
Related files:
%Windows%\Scrsss.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill Scrsss.exe process and remove Scrsss.exe from Windows startup using RegRun Startup Optimizer.

%windir%\sdktemp.exe

SDKTEMP.EXE is rootkit W32/Tilebot-A.
SDKTEMP.EXE is used to hide files, processes and registry.
SDKTEMP.EXE is a kernel mode rootkit.
Rootkit contacts remote hacker server using HTTP session.
SDKTEMP.EXE spreads via open network shares.
SDKTEMP.EXE opens a back door on IRC channels.
SDKTEMP.EXE monitors user Internet activity and bank information.
It sends stolen data to a hacker site.
SDKTEMP.EXE created new system drivers:
service name: "SDKTEMP"
display name: "Platform SDK Enviroment"
Adds the value:
HKLM\SYSTEM\CurrentControlSet\Services\SDKTEMP\
to the Windows startup registry keys.

rdriv.sys created new system drivers:
service name: "rdriv"
display name: "rdriv"
Added to registry:
HKLM\SYSTEM\CurrentControlSet\Services\rdriv\

Related files:
%WinDir%\SDKTEMP.EXE
%SysDir%\rdriv.sys
More info: <http://www.sophos.com/virusinfo/analyses...

%windir%\secure2.exe

secure2.exe is a Trojan.LeechPie-D.
secure2.exe opens a back door.
secure2.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%Windows%\pk.log
%Windows%\un\ComDlg.dll
%Windows%\un\ComDlg.ocx
%Windows%\un\CommonDlg32.pk1
%Windows%\un\CommonDlg32.pk2
%Windows%\un\acls.exe
%Windows%\un\admdll.dll
%Windows%\un\confini.exe
%Windows%\un\delsrv.exe
%Windows%\un\dtreg.exe
%Windows%\un\exe.bat
%Windows%\un\exec.bat
%Windows%\un\hiderun.exe
%Windows%\un\kill.exe
%Windows%\un\ntsvc.ocx
%Windows%\un\scvhost.exe
%Windows%\un\secure.exe
%Windows%\un\secure2.exe
%Windows%\un\serv.exe
%Windows%\un\wmc.exe
%System%\QuicktmeLib.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill secure2.exe process and remove secure2.exe from Windows startup using RegRun Startup Optimizer.

%windir%\seli.exe

%WinDir%\seli.exe is Trojan LowZone-AS.
Kill the process %WinDir%\seli.exe and remove %WinDir%\seli.exe from Windows startup using RegRun.
www.regrun.com

%windir%\sererver.dll

Sererver.DLL is a Trojan.Feutel-BB.
Sererver.DLL opens a back door.
Sererver.DLL modifies data on the computer
Sererver.DLL mownloads code from the internet Related files:
%Windows%\Sererver.exe
%Windows%\Sererver.DLL
%Windows%\SererverKey.DLL
%Windows%\Sererver_HOOk.DLL
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove Sererver.DLL from Windows startup using RegRun Startup Optimizer.

%windir%\sererver.exe

Sererver.exe is a Trojan.Feutel-BB.
Sererver.exe opens a back door.
Sererver.exe modifies data on the computer
Sererver.exe mownloads code from the internet Related files:
%Windows%\Sererver.exe
%Windows%\Sererver.DLL
%Windows%\SererverKey.DLL
%Windows%\Sererver_HOOk.DLL
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill Sererver.exe process and remove Sererver.exe from Windows startup using RegRun Startup Optimizer.

%windir%\sererver_hook.dll

Sererver_HOOk.DLL is a Trojan.Feutel-BB.
Sererver_HOOk.DLL opens a back door.
Sererver_HOOk.DLL modifies data on the computer
Sererver_HOOk.DLL mownloads code from the internet Related files:
%Windows%\Sererver.exe
%Windows%\Sererver.DLL
%Windows%\SererverKey.DLL
%Windows%\Sererver_HOOk.DLL
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove Sererver_HOOk.DLL from Windows startup using RegRun Startup Optimizer.

%windir%\sererverkey.dll

SererverKey.DLL is a Trojan.Feutel-BB.
SererverKey.DLL opens a back door.
SererverKey.DLL modifies data on the computer
SererverKey.DLL mownloads code from the internet Related files:
%Windows%\Sererver.exe
%Windows%\Sererver.DLL
%Windows%\SererverKey.DLL
%Windows%\Sererver_HOOk.DLL
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove SererverKey.DLL from Windows startup using RegRun Startup Optimizer.

%windir%\server.dll

Server.DLL is a Trojan Backdoor.Graybird.N.
Server.DLL injects into all running processes.
Related files:
%Windir%\Server.exe
%Windir%\Server.DLL
%Windir%\ServerKey.DLL
%Windir%\Server_Hook.DLL
Adds the value:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Windows Updata Server
HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\ENUM\ROOT\LEGACY_WINDOWS_UPDATA_SERVER
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove Server.DLL from Windows startup using RegRun Startup Optimizer.

%windir%\server.exe

Server.exe is a Trojan Backdoor.Graybird.N.
Server.exe injects into all running processes.
Related files:
%Windir%\Server.exe
%Windir%\Server.DLL
%Windir%\ServerKey.DLL
%Windir%\Server_Hook.DLL
Adds the value:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Windows Updata Server
HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\ENUM\ROOT\LEGACY_WINDOWS_UPDATA_SERVER
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill Server.exe process and remove Server.exe from Windows startup using RegRun Startup Optimizer.

%windir%\server_hook.dll

%Windir%\Server.exe
%Windir%\Server.DLL
%Windir%\ServerKey.DLL
%Windir%\Server_Hook.DLL
Adds the value:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Windows Updata Server
HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\ENUM\ROOT\LEGACY_WINDOWS_UPDATA_SERVER
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove Server_Hook.DLL from Windows startup using RegRun Startup Optimizer.

%windir%\serverkey.dll

ServerKey.DLL is a Trojan Backdoor.Graybird.N.
ServerKey.DLL injects into all running processes.
Related files:
%Windir%\Server.exe
%Windir%\Server.DLL
%Windir%\ServerKey.DLL
%Windir%\Server_Hook.DLL
Adds the value:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Windows Updata Server
HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\ENUM\ROOT\LEGACY_WINDOWS_UPDATA_SERVER
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove ServerKey.DLL from Windows startup using RegRun Startup Optimizer.

%windir%\service.exe

%WinDir%\service.exe is W32.Spybot.ANTR.
Read more: http://www.symantec.com/enterprise/secur...
Kill the process %WinDir%\service.exe and remove %WinDir%\service.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%windir%\service32.exe

SERVICE32.EXE is rootkit Rootkit.DialCall.
SERVICE32.EXE is used to hide files, processes, registry and network connections.
SERVICE32.EXE is a user mode rootkit.
SERVICE32.EXE tries to terminate antiviral programs installed on a user computer.
Related files:
%CACHE%\CONTENT.IE5\????????\SERVICE32[1].EXE
%WINDIR%\SERVICE32.EXE
%WINDIR%\395735127.EXE
%WINDIR%\125250127163.EXE
\DC1.EXE
More info: http://virusinfo.prevx.com/viruscenter.a...

%windir%\services.exe

I-Worm.Moodown.b
This worm spreads via the Internet as a file attached to infected emails.
Once launched, the worm displays a false error message on the screen: 'The file could not be opened'.

The worm copies itself to the Windows folder under the name 'services.exe' and adds the key:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"service" = "%windir%\services.exe -serv"

The worm also creates the unique identifier 'AdmSkynetJklS003' to flag its presence in memory.
The worm creates a number of copies of itself in all sub-directories on disks which contain the word 'share' or 'sharing' in the directory name.
The copies will be under names chosen from the predefined list.

The worm finds files with some extensions, searches them for email addresses and sends a copy of itself to the addresses found.
Infected messages have random headers and subject text.

Use RegRun Startup Optimizer to remove this worm.

%windir%\services32.exe

services32.exe is rootkit W32/Tilebot-C.
services32.exe is used to hide files, processes and registry.
services32.exe is a kernel mode rootkit.
Rootkit contacts remote hacker server using HTTP session.
services32.exe spreads via open network shares.
services32.exe opens a back door on IRC channels.
services32.exe created new system drivers:
service name: "Service Sequence"
display name: "Service32"
Adds the value:
HKLM\SYSTEM\CurrentControlSet\Services\Service Sequence\
to the Windows startup registry keys.

rdriv.sys created new system drivers:
service name: " rdriv"
display name: " rdriv"
Added to registry:
HKLM\SYSTEM\CurrentControlSet\Services\rdriv\

Related files:
%WinDir%\services32.exe
%SysDir%\rdriv.sys
Adds the value:
HKLM\SYSTEM\CurrentControlSet\Services\Messenger
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\RemoteRegistry
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\TlntSvr
Start
4
to the Windows startup registry keys.
Added to registry:
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
DoNotAllowXPSP2
1

HKLM\SOFTWARE\Microsoft\Ole
EnableDCOM
N

HKLM\SYSTEM\CurrentControlSet\Control\Lsa
restrictanonymous
1

HKLM\SYSTEM\CurrentControlSet\Hardware Profiles\0001\Software\
Microsoft\windows\CurrentVersion\Internet Settings
ProxyEnable
1

HKLM\SYSTEM\CurrentControlSet\Hardware Profiles\Current\Software\
Microsoft\windows\CurrentVersion\Internet Settings
ProxyEnable
1

HKLM\SOFTWARE\Microsoft\Security Center\
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\
More info: http://www.sophos.com/virusinfo/analyses...

%windir%\setdebugnt.exe

setdebugnt.exe is a Trojan.Bancos-FD.
setdebugnt.exe monitors user Internet activity and bank information.
It sends stolen data to a hacker site.
Related files:
%Windows%\setdebugnt.exe
%Windows%\ieupdate.dat
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill setdebugnt.exe process and remove setdebugnt.exe from Windows startup using RegRun Startup Optimizer.

%windir%\shared\aim_hack.exe

Aim_hack.exe is a worm W32.Incef.
Aim_hack.exe spreads via open network shares and mIRC.
Related files:
%Windir%\WinExec.exe
%Windir%\shared\aim_hack.exe
%Windir%\shared\msn_crack.exe
%Windir%\shared\icq_hack.exe
%Windir%\shared\ftp_crack.exe
%Windir%\shared\XP_keygen.exe
%Windir%\commad.pif
%Windir%\srvwin.scr
%System%\WinUpdate.exe
%System%\Winsys.exe
C:\commando.exe
C:\comand.scr
Adds the value:
"WinExec" = "%Windir%\WinExec.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill aim_hack.exe process and remove aim_hack.exe from Windows startup using RegRun Startup Optimizer.

%windir%\shared\ftp_crack.exe

Ftp_crack.exe is a worm W32.Incef.
Ftp_crack.exe spreads via open network shares and mIRC.
Related files:
%Windir%\WinExec.exe
%Windir%\shared\aim_hack.exe
%Windir%\shared\msn_crack.exe
%Windir%\shared\icq_hack.exe
%Windir%\shared\ftp_crack.exe
%Windir%\shared\XP_keygen.exe
%Windir%\commad.pif
%Windir%\srvwin.scr
%System%\WinUpdate.exe
%System%\Winsys.exe
C:\commando.exe
C:\comand.scr
Adds the value:
"WinExec" = "%Windir%\WinExec.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill ftp_crack.exe process and remove ftp_crack.exe from Windows startup using RegRun Startup Optimizer.

%windir%\shared\icq_hack.exe

icq_hack.exe is a worm W32.Incef.
icq_hack.exe spreads via open network shares and mIRC.
Related files:
%Windir%\WinExec.exe
%Windir%\shared\aim_hack.exe
%Windir%\shared\msn_crack.exe
%Windir%\shared\icq_hack.exe
%Windir%\shared\ftp_crack.exe
%Windir%\shared\XP_keygen.exe
%Windir%\commad.pif
%Windir%\srvwin.scr
%System%\WinUpdate.exe
%System%\Winsys.exe
C:\commando.exe
C:\comand.scr
Adds the value:
"WinExec" = "%Windir%\WinExec.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill icq_hack.exe process and remove icq_hack.exe from Windows startup using RegRun Startup Optimizer.

%windir%\shared\msn_crack.exe

Msn_crack.exe is a worm W32.Incef.
Msn_crack.exe spreads via open network shares and mIRC.
Related files:
%Windir%\WinExec.exe
%Windir%\shared\aim_hack.exe
%Windir%\shared\msn_crack.exe
%Windir%\shared\icq_hack.exe
%Windir%\shared\ftp_crack.exe
%Windir%\shared\XP_keygen.exe
%Windir%\commad.pif
%Windir%\srvwin.scr
%System%\WinUpdate.exe
%System%\Winsys.exe
C:\commando.exe
C:\comand.scr
Adds the value:
"WinExec" = "%Windir%\WinExec.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill msn_crack.exe process and remove msn_crack.exe from Windows startup using RegRun Startup Optimizer.

%windir%\shared\xp_keygen.exe

XP_keygen.exe is a worm W32.Incef.
XP_keygen.exe spreads via open network shares and mIRC.
Related files:
%Windir%\WinExec.exe
%Windir%\shared\aim_hack.exe
%Windir%\shared\msn_crack.exe
%Windir%\shared\icq_hack.exe
%Windir%\shared\ftp_crack.exe
%Windir%\shared\XP_keygen.exe
%Windir%\commad.pif
%Windir%\srvwin.scr
%System%\WinUpdate.exe
%System%\Winsys.exe
C:\commando.exe
C:\comand.scr
Adds the value:
"WinExec" = "%Windir%\WinExec.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill XP_keygen.exe process and remove XP_keygen.exe from Windows startup using RegRun Startup Optimizer.

%windir%\shellnew\bronstab.exe

bronstab.exe is a mass-mailing worm W32.Rontokbro.D@mm.
bronstab.exe overwrites the Autoexec.bat file.
Related files:
%UserProfile%\Local Settings\Application Data\csrss.exe
%UserProfile%\Local Settings\Application Data\inetinfo.exe
%UserProfile%\Local Settings\Application Data\lsass.exe
%UserProfile%\Local Settings\Application Data\services.exe
%UserProfile%\Local Settings\Application Data\smss.exe
%UserProfile%\Local Settings\Application Data\winlogon.exe
%UserProfile%\Start Menu\Programs\Startup\Empty.pif
%UserProfile%\Templates\WowTumpeh.com
%Windir%\eksplorasi.pif
%Windir%\ShellNew\bronstab.exe
%System%\[user name]'s Setting.scr
Adds the value:
"Bron-Spizaetus" = "%Windir%\ShellNew\bronstab.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill bronstab.exe process and remove bronstab.exe from Windows startup using RegRun Startup Optimizer.

%windir%\shellnew\elnorb.exe

ElnorB.exe is a mass-mailing worm W32.Brontok-A.
ElnorB.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Windows%\ShellNew\ElnorB.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill ElnorB.exe process and remove ElnorB.exe from Windows startup using RegRun Startup Optimizer.

%windir%\shellnew\sempalong.exe

sempalong.exe is a mass-mailing worm W32.Brontok-E.
sempalong.exe spreads by e-mail and via open network shares.
Related files:
%Windows%\ShellNew\sempalong.exe
%Windows%\eksplorasi.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill sempalong.exe process and remove sempalong.exe from Windows startup using RegRun Startup Optimizer.

%windir%\shtasks.exe

shtasks.exe is a worm W32.Tilebot-EB.
shtasks.exe opens a back door.
shtasks.exe spreads via open network shares.
Related files:
%Windows%\shtasks.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill the process shtasks.exe and remove shtasks.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%windir%\sistem32\svchost.exe

%WinDir%\sistem32\svchost.exe is Trojan/Backdoor.
Kill the process %WinDir%\sistem32\svchost.exe and remove %WinDir%\sistem32\svchost.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%windir%\skype32.exe

skype32.exe is a mass-mailing worm W32.Dolebot-A.
skype32.exe opens a back door on IRC channels.
skype32.exe spreads by e-mail and via open network shares.
Related files:
%Windows%\skype32.exe
%System%\rofl.sys
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill skype32.exe process and remove skype32.exe from Windows startup using RegRun Startup Optimizer.

%windir%\sllserv.exe

sllserv.exe is a Trojan.LegMir-BW.
sllserv.exe opens a back door.
sllserv.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%Windows%\assistseex.exe
%Windows%\sllserv.exe
%Windows%\uninstallex.exe
%Windows%\ced.dll
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill sllserv.exe process and remove sllserv.exe from Windows startup using RegRun Startup Optimizer.

%windir%\smgr.exe

%WinDir%\SMGR.EXE is Trojan/Backdoor.
Kill the process %WinDir%\SMGR.EXE and remove %WinDir%\SMGR.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

%windir%\sminst\launcher.exe

%WinDir%\SMINST\Launcher.exe is Trojan/Backdoor.
Kill the process %WinDir%\SMINST\Launcher.exe and remove %WinDir%\SMINST\Launcher.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%windir%\smncs.exe

smncs.exe is a Trojan W32.Tilebot-CK.
smncs.exe opens a back door.
smncs.exe spreads via open network shares.
Related files:
%Windows%\smncs.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill smncs.exe process and remove smncs.exe from Windows startup using RegRun Startup Optimizer.

%windir%\smsc.exe

%windir%\smsg.exe

smsg.exe is a Trojan W32.Tilebot-AB.
smsg.exe opens a back door on IRC channels.
smsg.exe spreads via open network shares.
smsg.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Windows%\smsg.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill smsg.exe process and remove smsg.exe from Windows startup using RegRun Startup Optimizer.

%windir%\smss.exe

%WinDir%\smss.exe is Trojan/Backdoor.
Do not mix up it withsmss.exe in the System32 folder.
%WinDir%\smss.exe is installed as SMSS service.
Kill the process %WinDir%\smss.exe and remove %WinDir%\smss.exe from Windows startup.

%windir%\smtpsvc.exe

smtpsvc.exe is a Trojan W32.Tilebot-AU.
smtpsvc.exe opens a back door on IRC channels.
smtpsvc.exe spreads via open network shares.
smtpsvc.exe tries to terminate antiviral programs installed on a user computer.
smtpsvc.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Windows%\smtpsvc.exe
%System%\rofl.sys
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill smtpsvc.exe process and remove smtpsvc.exe from Windows startup using RegRun Startup Optimizer.

%windir%\snbho.exe

Snbho.exe is an adware program Adware.IEPlugin.
Snbho.exe monitors user Internet activity.
Snbho.exe displays advertising information.
Related files:
%Windir%\pxckdla.exe
%Windir%\pxckdlauninstall.exe
%Windir%\Wupdt.exe
%Windir%\wdskctl.exe
%Windir%\systb.dll
%Windir%\systb.exe
%Windir%\snbho.exe
%Windir%\winserv.exe
%Windir%\extract.exe
%Windir%\rgrt.exe
%Windir%\package_IEPLUGIN4.exe
Adds the value:
"Win Server Updt" = "%WinDir%\[dropped adware file]"
"Win Server" = "%WinDir%\winserv.exe"
"wdskctl" = "C:\Windows\wdskctl.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill snbho.exe process and remove snbho.exe from Windows startup using RegRun Startup Optimizer.

%windir%\sndman.exe

%WinDir%\sndman.exe is Trojan/Backdoor.
Kill the process %WinDir%\sndman.exe and remove %WinDir%\sndman.exe from Windows startup.
http://www.sophos.com/virusinfo/analyses...

%windir%\sngpw36.exe

Sngpw36.exe is an adware program Adware.AdBlaster.
Sngpw36.exe downloads and displays advertisements.
Related files:
%System%\adprot.exe
%System%\ngpw36.exe
%System%\ngpw36.exe.exe
%System%\ngsh33.dll
%System%\MSWINSCK.OCX
%Windir%\Sngpw36.exe
%Windir%\Sngsh33.dll
%Windir%\morpheus_internet_accelerator2.exe
IEExplorer.exe
Adds the value:
"ngpw36" = "%System%\ngpw36.exe"
"adprot" = "%System%\adprot.exe"
"Aapp" = "%System%\adprot"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill Sngpw36.exe process and remove Sngpw36.exe from Windows startup using RegRun Startup Optimizer.

%windir%\sngsh33.dll

Sngsh33.dll is an adware program Adware.AdBlaster.
Sngsh33.dll downloads and displays advertisements.
Related files:
%System%\adprot.exe
%System%\ngpw36.exe
%System%\ngpw36.exe.exe
%System%\ngsh33.dll
%System%\MSWINSCK.OCX
%Windir%\Sngpw36.exe
%Windir%\Sngsh33.dll
%Windir%\morpheus_internet_accelerator2.exe
IEExplorer.exe
Adds the value:
"ngpw36" = "%System%\ngpw36.exe"
"adprot" = "%System%\adprot.exe"
"Aapp" = "%System%\adprot"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove Sngsh33.dll from Windows startup using RegRun Startup Optimizer.

%windir%\snuninst.exe

Snuninst.exe is a Trojan.Cmapp.
Snuninst.exe downloads and display advertisements.
Snuninst.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%ProgramFiles%\CMAPP\cmappstub.exe
%ProgramFiles%\CMAPP\Client\cmappclient.exe
%ProgramFiles%\CMAPP\Client\cmappmf.dll
%ProgramFiles%\asys\Stb.exe
%ProgramFiles%\asys\VFX8.0-1.exe
%Windir%\sysnet.exe
%Windir%\snuninst.exe
%Windir%\svc.exe
%Windir%\visfxun.exe
%UserProfile%\Local Settings\Temp\cmappsetup.exe
Adds the value:
"CMAPP" = ""%ProgramFiles%\CMAPP\Client\cmappclient.exe""
"Sysnet" = "%Windir%\sysnet.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill snuninst.exe process and remove snuninst.exe from Windows startup using RegRun Startup Optimizer.

%windir%\softdwind.exe

softdwind.exe is a Trojan.Bancos-JS.
softdwind.exe opens a back door.
softdwind.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Windows%\softdwind.exe
%Windows%\ieupdate.dat
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill softdwind.exe process and remove softdwind.exe from Windows startup using RegRun Startup Optimizer.

%windir%\sonudman.exe

SonudMan.exe is a Trojan.Startpage.Q.
SonudMan.exe changes the Internet Explorer home page.
Related files:
%Windir%\SonudMan.exe
%System%\help.exe
Adds the value:
"SonudMan" = "Windir%\SonudMan.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill SonudMan.exe process and remove SonudMan.exe from Windows startup using RegRun Startup Optimizer.

%windir%\sonudmon.exe

SonudMon.exe is a Trojan.Lewor-J.
SonudMon.exe downloads code from the internet.
Related files:
%Windows%\SonudMon.exe
%System%\sevrices.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill SonudMon.exe process and remove SonudMon.exe from Windows startup using RegRun Startup Optimizer.

%windir%\soundfun.exe

%WinDir%\soundfun.exe is Trojan/Backdoor.
Kill the process soundfun.exe and remove soundfun.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%windir%\sp2ydave1.exe

sp2ydave1.exe is a dialer program Dialer.ICcontrol.
Related files:
%Windir%\icc.dll
%Windir%\iccontrol.exe
%Windir%\madchook.dll
%Windir%\natydave1.exe
%Windir%\sp2ydave1.exe
%Windir%\ydave1.exe
%UserTemp%\mc2A.tmp
More info: http://www.symantec.com/avcenter/venc/da...
Removal:
Kill the process sp2ydave1.exe and remove sp2ydave1.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%windir%\spcmon\hook.dll

HOOK.DLL is a Spyware.SpyloPCMonitor.
HOOK.DLL tries to terminate antiviral programs installed on a user computer.
HOOK.DLL monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Windir%\SPCMon\SPYLO.EXE
%Windir%\SPCMon\Uninstall.exe
%Windir%\SPCMon\HOOK.DLL
%Windir%\SPCMon\WSYS.DLL
%Windir%\SPCMon\WSYS.EXE
%Windir%\SPCMon\WSYSSRV.EXE
Adds the value:
"wsys.exe" = "%Windir%\SPCMon\wsys.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove HOOK.DLL from Windows startup using RegRun Startup Optimizer.

%windir%\spcmon\spylo.exe

SPYLO.EXE is a Spyware.SpyloPCMonitor.
SPYLO.EXE tries to terminate antiviral programs installed on a user computer.
SPYLO.EXE monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Windir%\SPCMon\SPYLO.EXE
%Windir%\SPCMon\Uninstall.exe
%Windir%\SPCMon\HOOK.DLL
%Windir%\SPCMon\WSYS.DLL
%Windir%\SPCMon\WSYS.EXE
%Windir%\SPCMon\WSYSSRV.EXE
Adds the value:
"wsys.exe" = "%Windir%\SPCMon\wsys.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill SPYLO.EXE process and remove SPYLO.EXE from Windows startup using RegRun Startup Optimizer.

%windir%\spcmon\wsys.dll

WSYS.DLL is a Spyware.SpyloPCMonitor.
WSYS.DLL tries to terminate antiviral programs installed on a user computer.
WSYS.DLL monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Windir%\SPCMon\SPYLO.EXE
%Windir%\SPCMon\Uninstall.exe
%Windir%\SPCMon\HOOK.DLL
%Windir%\SPCMon\WSYS.DLL
%Windir%\SPCMon\WSYS.EXE
%Windir%\SPCMon\WSYSSRV.EXE
Adds the value:
"wsys.exe" = "%Windir%\SPCMon\wsys.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove WSYS.DLL from Windows startup using RegRun Startup Optimizer.

%windir%\spcmon\wsys.exe

WSYS.EXE is a Spyware.SpyloPCMonitor.
WSYS.EXE tries to terminate antiviral programs installed on a user computer.
WSYS.EXE monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Windir%\SPCMon\SPYLO.EXE
%Windir%\SPCMon\Uninstall.exe
%Windir%\SPCMon\HOOK.DLL
%Windir%\SPCMon\WSYS.DLL
%Windir%\SPCMon\WSYS.EXE
%Windir%\SPCMon\WSYSSRV.EXE
Adds the value:
"wsys.exe" = "%Windir%\SPCMon\wsys.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill WSYS.EXE process and remove WSYS.EXE from Windows startup using RegRun Startup Optimizer.

%windir%\spcmon\wsyssrv.exe

WSYSSRV.EXE is a Spyware.SpyloPCMonitor.
WSYSSRV.EXE tries to terminate antiviral programs installed on a user computer.
WSYSSRV.EXE monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Windir%\SPCMon\SPYLO.EXE
%Windir%\SPCMon\Uninstall.exe
%Windir%\SPCMon\HOOK.DLL
%Windir%\SPCMon\WSYS.DLL
%Windir%\SPCMon\WSYS.EXE
%Windir%\SPCMon\WSYSSRV.EXE
Adds the value:
"wsys.exe" = "%Windir%\SPCMon\wsys.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill WSYSSRV.EXE process and remove WSYSSRV.EXE from Windows startup using RegRun Startup Optimizer.

%windir%\speer2.dll

Speer2.dll is an adware program Adware.BetterInternet.
Speer2.dll is a Browser Helper Object.
Speer2.dll downloads and displays advertisements.
Related files:
%Windir%\Bi.dll
%Windir%\speeryox.dll
%Windir%\Mxtarget.dll
%Windir%\BTGrab.dll
%Windir%\farmmext.exe
%Windir%\dlmax.dll
%Windir%\speer2.dll
%Windir%\VoiceIP.dll
%Windir%\morphacl.dll
%Windir%\Pynix.dll
%Windir%\Biprep.exe
%Windir%\banner.dll
%System%\laziqn.exe
%System%\xxvyaj.exe
%System%\wbtvsffd.exe
%System%\nnmzoq.exe
%Temp%\DrTemp\thnall1b.exe
%Temp%\DrTemp\thnall1p.exe
%Temp%\DrTemp\thnall2r.exe
%Temp%\DrTemp\polall1b.exe
%Temp%\thnall1s.exe
%Temp%\morphrec.exe
Adds the value:
"[File name of adware]" = "[File path to adware]"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove speer2.dll from Windows startup using RegRun Startup Optimizer.

%windir%\speeryox.dll

Speeryox.dll is an adware program Adware.BetterInternet.
Speeryox.dll is a Browser Helper Object.
Speeryox.dll downloads and displays advertisements.
Related files:
%Windir%\Bi.dll
%Windir%\speeryox.dll
%Windir%\Mxtarget.dll
%Windir%\BTGrab.dll
%Windir%\farmmext.exe
%Windir%\dlmax.dll
%Windir%\speer2.dll
%Windir%\VoiceIP.dll
%Windir%\morphacl.dll
%Windir%\Pynix.dll
%Windir%\Biprep.exe
%Windir%\banner.dll
%System%\laziqn.exe
%System%\xxvyaj.exe
%System%\wbtvsffd.exe
%System%\nnmzoq.exe
%Temp%\DrTemp\thnall1b.exe
%Temp%\DrTemp\thnall1p.exe
%Temp%\DrTemp\thnall2r.exe
%Temp%\DrTemp\polall1b.exe
%Temp%\thnall1s.exe
%Temp%\morphrec.exe
Adds the value:
"[File name of adware]" = "[File path to adware]"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove speeryox.dll from Windows startup using RegRun Startup Optimizer.

%windir%\spoder.dll

Spoder.dll is a Spyware.Winvest.
Spoder.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%ProgramFiles%\wv\wvh.dll
%ProgramFiles%\wv\wvres.dll
%ProgramFiles%\wv\wv.exe
%Windir%\sysninit.dll
%Windir%\spoder.dll
%Windir%\syswvnt.dll
%Windir%\syswvh.dll
%Windir%\loaddll.exe
%Windir%\syswvwin.dll
%Windir%\syswvmail.dll
%Windir%\loaddll.dll
Adds the value:
"loaddll" = "loaddll.exe"
"(Default)" = "C:\Program Files\wv\wv.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove spoder.dll from Windows startup using RegRun Startup Optimizer.

%windir%\spoolmgr.exe

SpoolMgr.exe is W32.Assiral mailing worm.
Adds to Windows startup the values:
"MS_LARISSA" = "%System%\MS_LARISSA.exe"
"spoolsv manager" = "%Windir%\SpoolMgr.exe"
Changes IE home page.
To disable regsitry tools SpoolMgr.exe process adds the values:
"DisableRegistryTools" = "1"
"NoAdminPage" = "1"
to the registry subkey:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System
Adds the value:
"Disabled" = "1"
to the registry subkey:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\WinOldApp
Sends itself by e-mail.
Removal:
Kill the processes SpoolMgr.exe, MS_LARISSA.exe.
Remove it from startup.
Creates the following files:
Delete files:
C:\MESSAGE.txt
C:\MS_LARISSA.exe
%Windir%\SpoolMgr.exe
%Windir%\love_letter.txt.exe
%System%\MS_LARISSA.exe
C:\WINDOWS\WinVBS_32.vbs
C:\WINDOWS\System32\REG_32.vbs
C:\LARISSA_ANTI_BROPIA.html

%windir%\spoolsv.exe

Spoolsv.exe is a worm W32.Linkbot.M.
Spoolsv.exe opens a back door through IRC.
Spoolsv.exe spreads by exploiting the Microsoft Windows LSASS Buffer Overrun Vulnerability (Microsoft Security Bulletin MS04-011).
Spoolsv.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%System%\lssas.exe
%System%\Isass.exe
%System%\csrs.exe
%System%\logon.exe
%System%\winlogon.exe
%System%\explorer.exe
%System%\winamp.exe
%System%\firewall.exe
%System%\spoolsvc.exe
%System%\spoolsv.exe
%System%\algs.exe
%System%\iexplore.exe
Adds the value:
"Local Security Authority Service" = "%System%\lssas.exe"
"Local Security Authority Service" = "%System%\Isass.exe"
"Client Server Runtime Process" = "%System%\csrs.exe"
"Windows Logon Application" = "%System%\logon.exe"
"Windows Logon Application" = "%System%\winIogon.exe"
"Windows Explorer" = "%System%\explorer.exe"
"Winamp Agent" = "%System%\winamp.exe"
"Windows Network Firewall" = "%System%\firewall.exe"
"Spooler SubSystem App" = "%System%\spoolsvc.exe"
"Spooler SubSystem App" = "%System%\spooIsv.exe"
"Application Layer Gateway Service" = "%System%\algs.exe"
"Microsoft Internet Explorer" = "%System%\iexplore.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill spoolsv.exe process and remove spoolsv.exe from Windows startup using RegRun Startup Optimizer.

%windir%\spoolsvr.exe

%WinDir%\spoolsvr.exe is Trojan/Backdoor hackTool Rootkit.
Kill the process %WinDir%\spoolsvr.exe and remove %WinDir%\spoolsvr.exe from Windows startup.

%windir%\sqlserv.exe

%WinDir%\sqlserv.exe is WORM_SDBOT.BZO.
Related files:
HPDRIVER.EXE
HPR34K8.SYS
ORANS.SYS
Read more: http://www.trendmicro.com/vinfo/virusenc...
Kill the process %WinDir%\sqlserv.exe and remove %WinDir%\sqlserv.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%windir%\sqltob.exe

Sqltob.exe is a worm W32.Dasher.A.
Sqltob.exe opens a back door.
Related files:
%Windir%\Temp\SqlExp.exe
%Windir%\Temp\Sqlrep.exe
%Windir%\Temp\SqlScan.exe
%Windir%\Temp\Sqltob.exe
Adds the value:
"Windows Update" = "%windir%\Temp\Sqltob.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill Sqltob.exe process and remove Sqltob.exe from Windows startup using RegRun Startup Optimizer.

%windir%\sserver.dll

sServer.DLL is a Trojan.Feutel-AB.
sServer.DLL opens a back door.
sServer.DLL spreads via open network shares.
Related files:
%Windows%\sServer.exe
%Windows%\sServer.DLL
%Windows%\uninstal.bat
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove sServer.DLL from Windows startup using RegRun Startup Optimizer.

%windir%\sserver.exe

sServer.exe is a Trojan.Feutel-AB.
sServer.exe opens a back door.
sServer.exe spreads via open network shares.
Related files:
%Windows%\sServer.exe
%Windows%\sServer.DLL
%Windows%\uninstal.bat
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill sServer.exe process and remove sServer.exe from Windows startup using RegRun Startup Optimizer.

%windir%\ssmc.dll

ssmc.dll is a Trojan Backdoor.Berbew.R .
ssmc.dll tries to terminate antiviral programs installed on a user computer.
ssmc.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%SystemDrive%\1.dml
%System%\winhost.exe
%Windir%\ssmc.dll
Adds the value:
"System" = "{DD434173-550E-401D-9B0F-78A5481B2AA8}"
HKEY_CLASSES_ROOT\CLSID\{DD434173-550E-401D-9B0F-78A5481B2AA8}\InProcServer32
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove ssmc.dll from Windows startup using RegRun Startup Optimizer.

%windir%\startupmgr.exe

startupmgr.exe is a Trojan W32/Rbot-BFX.
startupmgr.exe opens a back door on IRC channels.
startupmgr.exe spreads via open network shares.
Related files:
%Windows%\startupmgr.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill startupmgr.exe process and remove startupmgr.exe from Windows startup using RegRun Startup Optimizer.

%windir%\story.exe

story.exe is a Trojan.Clagger-G.
story.exe downloads code from the internet.
story.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%Windows%\story.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill the process story.exe and remove story.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%windir%\stubbish.exe

stubbish.exe is a Trojan W32.Stubbot-D.
stubbish.exe opens a back door on IRC channels.
stubbish.exe tries to terminate antiviral programs installed on a user computer.
stubbish.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Windows%\stubbish.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill stubbish.exe process and remove stubbish.exe from Windows startup using RegRun Startup Optimizer.

%windir%\suhoy112.exe

suhoy112.exe is a Trojan PWSteal.Tarno.U.
suhoy112.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\guisetup.exe
%Windir%\suhoy112.exe
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill the process suhoy112.exe and remove suhoy112.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%windir%\suhoy330.exe

%WinDir%\suhoy330.exe is Trojan/Backdoor.
Kill the process suhoy330.exe and remove suhoy330.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%windir%\suniu.exe

suniu.exe is a Trojan.Multidr-EU.
suniu.exe opens a back door.
Related files:
%System%\ntdll32.dll
%System%\ranx.dll
%System%\god.sys
%System%\svch0st.exe
%Windows%\suniu.exe
%System%\mmdat.dat
%System%\wdata32.dll
%Windows%\123.jpg
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill suniu.exe process and remove suniu.exe from Windows startup using RegRun Startup Optimizer.

%windir%\svch0st.dll

svch0st.dll is a Trojan.Feutel-AZ.
svch0st.dll opens a back door.
Related files:
%Windows%\svch0st.dll
%Windows%\svch0stKey.DLL
%Windows%\svch0st_Hook.DLL
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove svch0st.dll from Windows startup using RegRun Startup Optimizer.

%windir%\svch0st_hook.dll

svch0st_Hook.DLL is a Trojan.Feutel-AZ.
svch0st_Hook.DLL opens a back door.
Related files:
%Windows%\svch0st.dll
%Windows%\svch0stKey.DLL
%Windows%\svch0st_Hook.DLL
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove svch0st_Hook.DLL from Windows startup using RegRun Startup Optimizer.

%windir%\svch0stkey.dll

svch0stKey.DLL is a Trojan.Feutel-AZ.
svch0stKey.DLL opens a back door.
Related files:
%Windows%\svch0st.dll
%Windows%\svch0stKey.DLL
%Windows%\svch0st_Hook.DLL
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove svch0stKey.DLL from Windows startup using RegRun Startup Optimizer.

%windir%\svchost.exe

svchost.exe is rootkit Trojan.Bifrose-JF.
svchost.exe is used to hide files, processes and registry.
svchost.exe is a user mode rootkit.
Rootkit injects itself into running process.
Rootkit contacts remote hacker server using HTTP session.
svchost.exe spreads by e-mail.
Related files:
%WinDir%\svchost.exe
%WinDir%\plugin1.dat
Adds the value:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
msupdate
%WinDir%\svchost.exe
to the Windows startup registry keys.
Added to registry:
HKCU\Software\wget
More info: http://www.sophos.com/security/analyses/...

Also, it may be Backdoor.XTS.
Related files:
%Windows%\Svchost.exe
%System%\Extapi.dll
%System%\Sysmsg.dll
%System%\Rascfg.dll
Read more: http://www.sarc.com/avcenter/venc/data/b...
Kill the process %WinDir%\svchost.exe and remove %WinDir%\svchost.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%windir%\svchost.exe.exe

%WinDir%\svchost.exe.exe is W32/Lovgate.AD@mm.
Kill the process svchost.exe.exe and remove %WinDir%\svchost.exe.exe from Windows startup.
Read more: http://www.symantec.com/avcenter/venc/da...

%windir%\svchost_hook.dll

svchost_Hook.DLL is a Trojan.Feutel-AN.
svchost_Hook.DLL opens a back door.
Related files:
%Windows%\svchost.exe
%Windows%\svchost.dll
%Windows%\svchost_Hook.DLL
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove svchost_Hook.DLL from Windows startup using RegRun Startup Optimizer.

%windir%\svchostt.exe

svchostt.exe is a Trojan.Bancos-GQ.
svchostt.exe tries to terminate antiviral programs installed on a user computer.
svchostt.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Windows%\inf\svchostt.exe.
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill svchostt.exe process and remove svchostt.exe from Windows startup using RegRun Startup Optimizer.

%windir%\svehost32.exe

svehost32.exe is rootkit W32/Tilebot-I.
svehost32.exe is used to hide files, processes and registry.
svehost32.exe is a kernel mode rootkit.
Rootkit contacts remote hacker server using HTTP session.
svehost32.exe spreads via open network shares.
svehost32.exe opens a back door on IRC channels.
svehost32.exe created new system drivers:
service name: " svehost32"
display name: "Microsoft New Game 2"
Adds the value:
HKLM\SYSTEM\CurrentControlSet\Services\svehost32\
to the Windows startup registry keys.

rdriv.sys created new system drivers:
service name: "rdriv"
display name: "rdriv"
Adds the value:
HKLM\SYSTEM\CurrentControlSet\Services\rdriv\
Related files:
%WinDir%\svehost32.exe
%SysDir%\rdriv.sys
Adds the value:
HKLM\SYSTEM\CurrentControlSet\Services\Messenger
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\RemoteRegistry
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\TlntSvr
Start
4
to the Windows startup registry keys.
Added to registry:
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
DoNotAllowXPSP2
1

HKLM\SOFTWARE\Microsoft\Ole
EnableDCOM
N

HKLM\SYSTEM\CurrentControlSet\Control\Lsa
restrictanonymous
1

HKLM\SOFTWARE\Microsoft\Security Center\
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\
More info: http://www.sophos.com/virusinfo/analyses...

%windir%\svhost.exe

%windir%\svhosts.exe

svhosts.exe is rootkit W32/Tilebot-AC.
svhosts.exe is used to hide files, processes and registry.
svhosts.exe is a kernel mode rootkit.
Rootkit contacts remote hacker server using HTTP session.
svhosts.exe spreads via open network shares.
svhosts.exe opens a back door on IRC channels.
svhosts.exe created new system drivers:
service name: "Host Services"
display name: "Host Services"
Adds the value:
HKLM\SYSTEM\CurrentControlSet\Services\Host Services\
to the Windows startup registry keys.

rdriv.sys created new system drivers:
service name: "rdriv"
display name: "rdriv"
Adds the value:
HKLM\SYSTEM\CurrentControlSet\Services\rdriv\
Related files:
%WinDir%\svhosts.exe
%SysDir%\rdriv.sys
Adds the value:
HKLM\SYSTEM\CurrentControlSet\Services\Messenger
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\RemoteRegistry
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\TlntSvr
Start
4
to the Windows startup registry keys.
Added to registry:
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
DoNotAllowXPSP2
1

HKLM\SOFTWARE\Microsoft\Ole
EnableDCOM
N

HKLM\SYSTEM\CurrentControlSet\Control\Lsa
restrictanonymous
1

HKLM\SOFTWARE\Microsoft\Security Center\
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\
More info: http://www.sophos.com/virusinfo/analyses...

%windir%\svhosts32.exe

svhosts32.exe is a Trojan W32.Tilebot-CD.
svhosts32.exe opens a back door on IRC channels.
svhosts32.exe spreads via open network shares.
Related files:
%Windows%\svhosts32.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill svhosts32.exe process and remove svhosts32.exe from Windows startup using RegRun Startup Optimizer.

%windir%\svlhost.exe

%WinDir%\SVLHOST.EXE is Trojan/Backdoor.
Kill the process SVLHOST.EXE and remove SVLHOST.EXE from Windows startup using RegRun Reanimator.
http://www.regrun.com

%windir%\svohcst.exe

%WinDir%\svohcst.exe is Trojan/Backdoor.
Kill the process svohcst.exe and remove svohcst.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%windir%\svohost.exe

SVOHOST.EXE is a Trojan.Joex.
SVOHOST.EXE changes the Internet Explorer home page.
SVOHOST.EXE disables the Windows Task Manager.
Related files:
%Windir%\SVOHOST.EXE
%System%\commamd.exe
%System%\lsasa.exe
Adds the value:
"ctfnom.exe" = "%Windir%\SVOHOST.exe"
"Shell" = "Explorer.exe commamd.exe"
"command" = "%System%\lsasa.exe "%1""
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill SVOHOST.EXE process and remove SVOHOST.EXE from Windows startup using RegRun Startup Optimizer.

%windir%\svshost.exe

Trojan Backdoor.Alets.
Opens a back door by contacting an IRC server at the IP address 140.239.119.102 through TCP port 32440. This allows a remote attacker to have unauthorized access to the compromised computer.
Remove it from startup using RegRun Startup Optimizer.

%windir%\switpa.exe

Switpa.exe is an adware program Adware.OfferAgent.
Switpa.exe displays pop-up advertisements.
Related files:
%Windir%\switpa.exe
%Windir%\switpb.exe
Adds the value:
"switp" = "%Windir%\switpa.exe"
"switp" = "%Windir%\switpb.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill switpa.exe process and remove switpa.exe from Windows startup using RegRun Startup Optimizer.

%windir%\switpb.exe

Switpb.exe is an adware program Adware.OfferAgent.
Switpb.exe displays pop-up advertisements.
Related files:
%Windir%\switpa.exe
%Windir%\switpb.exe
Adds the value:
"switp" = "%Windir%\switpa.exe"
"switp" = "%Windir%\switpb.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill switpb.exe process and remove switpb.exe from Windows startup using RegRun Startup Optimizer.

%windir%\symantecg.exe

symantecg.exe is a Trojan.Bancban-NW.
symantecg.exe monitors user Internet activity and bank information.
It sends stolen data to a hacker site.
Related files:
%Windows%\symantecg.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill symantecg.exe process and remove symantecg.exe from Windows startup using RegRun Startup Optimizer.

%windir%\sys\mccagent.exe

Mccagent.exe is a Trojan.Dloader-UD.
Mccagent.exe spreads via open network shares.
Mccagent.exe monitors user Internet activity.
Related files:
%Windows%\sys\abr.txt
%Windows%\sys\fim.txt
%Windows%\sys\ini.txt
%Windows%\sys\mccagent.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill mccagent.exe process and remove mccagent.exe from Windows startup using RegRun Startup Optimizer.

%windir%\sys32dll.exe

%windir%\sysboot.dll

Sysboot.dll is a Trojan Backdoor.IRC.Ratsou.B.
Sysboot.dll spreads via open network shares.
Related files:
C:\Note.exe
%System%\Hid.exe
%System%\Explorer.dll
%System%\Iexplore.dll
%Windir%\Aim.dll
%Windir%\Boot.exe
%Windir%\C.dll
%Windir%\Crazy.exe
%Windir%\Dr.exe
%Windir%\Empavms.exe
%Windir%\Ipservers.dll
%Windir%\Java.dll
%Windir%\LibParse.exe
%Windir%\Lsass.exe
%Windir%\Miconfig.exe
%Windir%\Moo.dll
%Windir%\Msccl.dll
%Windir%\Msconig.exe
%Windir%\Nhtml.dll
%Windir%\Ratsou.exe
%Windir%\Regedit.dll
%Windir%\Restart.exe
%Windir%\Screen.dll
%Windir%\Sysboot.dll
%Windir%\Syste32.dll
%Windir%\Users.dll
%Windir%\Wind.dll
Adds the value:
"HID.EXE"="%System%\HID.EXE"
"lsass"="%Windir%\Debug\UserMode\lsass.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove Sysboot.dll from Windows startup using RegRun Startup Optimizer.

%windir%\sysc00.exe

%WinDir%\sysc00.exe is Trojan/Dloadr-LO.
Kill the process sysc00.exe and remove %WinDir%\sysc00.exe from Windows startup.

%windir%\syscfg16.exe

syscfg16.exe is a Trojan.Domwis-P.
syscfg16.exe opens a back door.
Related files:
%Windows%\syscfg16.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill syscfg16.exe process and remove syscfg16.exe from Windows startup using RegRun Startup Optimizer.

%windir%\syscvhost.exe

syscvhost.exe is rootkit W32/Tilebot-BU.
syscvhost.exe is used to hide files, processes and registry.
syscvhost.exe is a kernel mode rootkit.
Rootkit contacts remote hacker server using HTTP session.
syscvhost.exe spreads via open network shares.
syscvhost.exe opens a back door on IRC channels.
syscvhost.exe created new system drivers:
service name: "syscvhost"
display name: "syscvhost"
Adds the value:
HKLM\SYSTEM\CurrentControlSet\Services\syscvhost\
to the Windows startup registry keys.

rdriv.sys created new system drivers:
service name: "rdriv"
display name: "rdriv"
Added to registry:
HKLM\SYSTEM\CurrentControlSet\Services\rdriv\

Related files:
%WinDir%\syscvhost.exe
%WinDir%\MsHS64.exe
%SysDir%\rdriv.sys
Adds the value:
HKLM\SYSTEM\CurrentControlSet\Services\Messenger
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\RemoteRegistry
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\TlntSvr
Start
4
to the Windows startup registry keys.
Added to registry:
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
DoNotAllowXPSP2
1

HKLM\SOFTWARE\Microsoft\Ole
EnableDCOM
N

HKLM\SYSTEM\CurrentControlSet\Control\Lsa
restrictanonymous
1

HKLM\SOFTWARE\Microsoft\Security Center\
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\
More info: http://www.sophos.com/virusinfo/analyses...

%windir%\sysldr32.exe

sysldr32.exe is a Trojan.DownLdr-NS.
sysldr32.exe downloads code from the internet.
Related files:
%Windows%\sysldr32.exe
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill sysldr32.exe process and remove sysldr32.exe from Windows startup using RegRun Startup Optimizer.

%windir%\sysload.exe

sysload.exe is a Trojan.Xbot-F.
sysload.exe opens a back door on IRC channels.
sysload.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%Windows%\sysload.exe
%Windows%\dlcomcnf.exe
%Windows%\svchost.exe
%Windows%\svchost.ini
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill sysload.exe process and remove sysload.exe from Windows startup using RegRun Startup Optimizer.

%windir%\sysnet.exe

Sysnet.exe is a Trojan.Cmapp.
Sysnet.exe downloads and display advertisements.
Sysnet.exe tries to terminate antiviral programs installed on a user computer.
Related files:
%ProgramFiles%\CMAPP\cmappstub.exe
%ProgramFiles%\CMAPP\Client\cmappclient.exe
%ProgramFiles%\CMAPP\Client\cmappmf.dll
%ProgramFiles%\asys\Stb.exe
%ProgramFiles%\asys\VFX8.0-1.exe
%Windir%\sysnet.exe
%Windir%\snuninst.exe
%Windir%\svc.exe
%Windir%\visfxun.exe
%UserProfile%\Local Settings\Temp\cmappsetup.exe
Adds the value:
"CMAPP" = ""%ProgramFiles%\CMAPP\Client\cmappclient.exe""
"Sysnet" = "%Windir%\sysnet.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill sysnet.exe process and remove sysnet.exe from Windows startup using RegRun Startup Optimizer.

%windir%\sysninit.dll

Sysninit.dll is a Spyware.Winvest.
Sysninit.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%ProgramFiles%\wv\wvh.dll
%ProgramFiles%\wv\wvres.dll
%ProgramFiles%\wv\wv.exe
%Windir%\sysninit.dll
%Windir%\spoder.dll
%Windir%\syswvnt.dll
%Windir%\syswvh.dll
%Windir%\loaddll.exe
%Windir%\syswvwin.dll
%Windir%\syswvmail.dll
%Windir%\loaddll.dll
Adds the value:
"loaddll" = "loaddll.exe"
"(Default)" = "C:\Program Files\wv\wv.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove sysninit.dll from Windows startup using RegRun Startup Optimizer.

%windir%\sysop.exe

%WinDir%\sysop.exe is Trojan/Backdoor.
Kill the process %WinDir%\sysop.exe and remove %WinDir%\sysop.exe from Windows startup.

%windir%\syspw32.exe

Syspw32.exe is a mass-mailing worm W32.Appflet.A@mm.
Syspw32.exe spreads by e-mail.
Related files:
%Windir%\syspw32.exe
%Windir%\system\InstallGallery.exe
%Windir%\system\winpw32.exe
%Windir%\system\ActorsGallery.zip
%Windir%\system\zippwdinfo.dat
%Windir%\system\sysfile.dat
%Windir%\Flagex.Flg
Adds the value:
"syspw32.exe" = %Windir%\syspw32.exe
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill syspw32.exe process and remove syspw32.exe from Windows startup using RegRun Startup Optimizer.

%windir%\systb.exe

Systb.exe is an adware program Adware.IEPlugin.
Systb.exe monitors user Internet activity.
Systb.exe displays advertising information.
Related files:
%Windir%\pxckdla.exe
%Windir%\pxckdlauninstall.exe
%Windir%\Wupdt.exe
%Windir%\wdskctl.exe
%Windir%\systb.dll
%Windir%\systb.exe
%Windir%\snbho.exe
%Windir%\winserv.exe
%Windir%\extract.exe
%Windir%\rgrt.exe
%Windir%\package_IEPLUGIN4.exe
Adds the value:
"Win Server Updt" = "%WinDir%\[dropped adware file]"
"Win Server" = "%WinDir%\winserv.exe"
"wdskctl" = "C:\Windows\wdskctl.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill systb.exe process and remove systb.exe from Windows startup using RegRun Startup Optimizer.

%windir%\syste32.dll

Syste32.dll is a Trojan Backdoor.IRC.Ratsou.B.
Syste32.dll spreads via open network shares.
Related files:
C:\Note.exe
%System%\Hid.exe
%System%\Explorer.dll
%System%\Iexplore.dll
%Windir%\Aim.dll
%Windir%\Boot.exe
%Windir%\C.dll
%Windir%\Crazy.exe
%Windir%\Dr.exe
%Windir%\Empavms.exe
%Windir%\Ipservers.dll
%Windir%\Java.dll
%Windir%\LibParse.exe
%Windir%\Lsass.exe
%Windir%\Miconfig.exe
%Windir%\Moo.dll
%Windir%\Msccl.dll
%Windir%\Msconig.exe
%Windir%\Nhtml.dll
%Windir%\Ratsou.exe
%Windir%\Regedit.dll
%Windir%\Restart.exe
%Windir%\Screen.dll
%Windir%\Sysboot.dll
%Windir%\Syste32.dll
%Windir%\Users.dll
%Windir%\Wind.dll
Adds the value:
"HID.EXE"="%System%\HID.EXE"
"lsass"="%Windir%\Debug\UserMode\lsass.exe"
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Remove Syste32.dll from Windows startup using RegRun Startup Optimizer.

%windir%\system idle procese

System Idle Procese is rootkit Trojan.DDoS-E.
System Idle Procese is used to hide files, processes and registry.
System Idle Procese is a kernel mode rootkit.
Rootkit injects itself into the winlogon.exe process.
Rootkit executes a denial-of-service attack on an IP address
Related files:
%WinDir%\System Idle Procese
Adds the value:
HKLM\SOFWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell
Explorer.exe %WinDir%\System Idle Procese
to the Windows startup registry keys.
More info: http://www.sophos.com/security/analyses/...

%windir%\system proess.dll

system proess.DLL is a Trojan.Feutel-BA.
system proess.DLL opens a back door.
system proess.DLL downloads code from the internet.
Related files:
%Windows%\system proess.exe
%Windows%\system proess.DLL
%Windows%\system proessKey.DLL
%Windows%\system proess_Hook.DLL
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove system proess.DLL from Windows startup using RegRun Startup Optimizer.

%windir%\system proess.exe

system proess.exe is a Trojan.Feutel-BA.
system proess.exe opens a back door.
system proess.exe downloads code from the internet.
Related files:
%Windows%\system proess.exe
%Windows%\system proess.DLL
%Windows%\system proessKey.DLL
%Windows%\system proess_Hook.DLL
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Kill system proess.exe process and remove system proess.exe from Windows startup using RegRun Startup Optimizer.

%windir%\system proess_hook.dll

system proess_Hook.DLL is a Trojan.Feutel-BA.
system proess_Hook.DLL opens a back door.
system proess_Hook.DLL downloads code from the internet.
Related files:
%Windows%\system proess.exe
%Windows%\system proess.DLL
%Windows%\system proessKey.DLL
%Windows%\system proess_Hook.DLL
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove system proess_Hook.DLL from Windows startup using RegRun Startup Optimizer.

%windir%\system proesskey.dll

system proessKey.DLL is a Trojan.Feutel-BA.
system proessKey.DLL opens a back door.
system proessKey.DLL downloads code from the internet.
Related files:
%Windows%\system proess.exe
%Windows%\system proess.DLL
%Windows%\system proessKey.DLL
%Windows%\system proess_Hook.DLL
More info: http://www.sophos.com/virusinfo/analyses...
Removal:
Remove system proessKey.DLL from Windows startup using RegRun Startup Optimizer.

%windir%\system\cscript.exe

%WinDir%\system\cscript.exe is Troj/Glibma-A.
Related files:
cscript.exe
Hd.vbs
gm.BAT
gm.vbe
Read more: http://www.sophos.com/security/analyses/...
Kill the process %WinDir%\system\cscript.exe and remove %WinDir%\system\cscript.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%windir%\system\csrss.exe

I-Worm.Netsky.ac
This worm spreads via the Internet as an attachment to infected messages, and via shared network resources.

Characteristics of infected messages:
Message header, body and attachment name (with .pif extension) are chosen at random from predefined list.
The worm uses a direct connection to the SMTP-server to send messages.

The wom copies itself to the Windows directory under the name csrss.exe
and registers this file in the system registry auto-run key:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\BagleAV
thus attempting to disguise itself as an antivirus working against Bagle.

Also, the worm attempts to delete registry keys created by I-Worm.Bagle.y

Automatic removal:
Use RegRun Startup Optimizer to delete this worm from your machine.

%windir%\system\ctfmon.exe

%WinDir%\system\ctfmon.exe is W32.Addsones.
W32.Addsones is a virus that may display advertisements and copy itself to all removable drives.
Related files:
%Windir%\system\ctfmon.exe
%Windir%\system\gg_ads_clk.dll
%Windir%\system\gg_ads_clk.cfg
%Windir%\system\gg_ads_clk.ini
%Windir%\system\gg_ads_rep.dat
%Windir%\system\DATA_0FAB1924-5DBF-1947-157BA64AC7945BB1
%Windir%\system\nthide.dll (Detected as Hacktool.Rootkit)
%Windir%\system\CURE.EXE
Read more: http://www.symantec.com/enterprise/secur...
Kill the process %WinDir%\system\ctfmon.exe and remove %WinDir%\system\ctfmon.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%windir%\system\installgallery.exe

InstallGallery.exe is a mass-mailing worm W32.Appflet.A@mm.
InstallGallery.exe spreads by e-mail.
Related files:
%Windir%\syspw32.exe
%Windir%\system\InstallGallery.exe
%Windir%\system\winpw32.exe
%Windir%\system\ActorsGallery.zip
%Windir%\system\zippwdinfo.dat
%Windir%\system\sysfile.dat
%Windir%\Flagex.Flg
Adds the value:
"syspw32.exe" = %Windir%\syspw32.exe
to the Windows startup registry keys.
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill InstallGallery.exe process and remove InstallGallery.exe from Windows startup using RegRun Startup Optimizer.

%windir%\system\lsass.exe

Lsass.exe is W32.Banleed.B.
Directory: c:\windows\system
Read more: http://securityresponse.symantec.com/avc...
Kill the process lsass.exe and remove lsass.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%windir%\system\service.exe

Service.exe is a Trojan Backdoor.Sdbot.
Service.exe spreads via Internet Relay Chat (IRC).
Service.exe tries to terminate antiviral programs installed on a user computer.
Service.exe monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%System%\Cnfgldr.exe
%System%\cthelp.exe
%System%\Sysmon16.exe
%System%\Sys3f2.exe
%System%\Syscfg32.exe
%System%\Mssql.exe
%System%\Aim95.exe
%System%\Svchosts.exe
%System%\FB_PNU.EXE
%System%\Cmd32.exe
%System%\Sys32.exe
%System%\Explorer.exe
%System%\IEXPL0RE.EXE
%System%\iexplore.exe
%System%\sock32.exe
%System%\MSTasks.exe
%System%\service.exe
%System%\Regrun.exe
%System%\ipcl32.exe
%System%\syswin32.exe
%System%\CMagesta.exe
%System%\YahooMsgr.exe
%System%\vcvw.exe
%System%\spooler.exe
%System%\MSsrvs32.exe
%System%\svhost.exe
%System%\winupdate32.exe
%System%\quicktimeprom.exe
More info: http://securityresponse.symantec.com/avc...
Removal:
Kill service.exe process and remove service.exe from Windows startup using RegRun Startup Optimizer.

%windir%\system\smss.exe

%WINDIR%\system\smss.exe is BackDoor-CXT.
Related files:
%WINDIR%\system32\nvsvcd.exe
%WINDIR%\system\smss.exe
C:\documents and settings\%USER%\local settings\temp\smssb.exe
C:\documents and settings\%USER%\local settings\temp\smss.exe
Read more: http://vil.nai.com/vil/content/v_138575....
Kill the process %WINDIR%\system\smss.exe and remove %WINDIR%\system\smss.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%windir%\system\svchost.exe

Worm Cycle
It uses LSASS vulnerability described in:
http://www.microsoft.com/technet/securit...
Please, do not confuse with the svchost.exe located in the Windows\system32 folder.
Download and install the patch. After that terminate it by RegRun Start Control.
Use Termintae option.

%windir%\system\svchost.exe

%windir%\system\winlogin.exe

%WinDir%\system\winlogin.exe is Trojan/Backdoor.
Kill the process %WinDir%\system\winlogin.exe and remove %WinDir%\system\winlogin.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%windir%\system\winlogon.exe

%WinDir%\system\winlogon.exe is W32.Mumawow.F.
W32.Mumawow.F is a virus that infects executable files.
Related files:
%Windir%\system\winlogon.exe
[DRIVE LETTER]:\setup.exe
%Windir%\win.log - a log file
[DRIVE LETTER]:\autorun.inf
Read more: http://www.symantec.com/enterprise/secur...
Kill the process %WinDir%\system\winlogon.exe and remove %WinDir%\system\winlogon.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

%windir%\system\winpw32.exe