AntiSpyShield Ransomware

How To Remove AntiSpyShield?
You must download trial version of "Exterminate-It" antivirus software,to check your computer instantly.

---

AntiSpyShield is dangerous virus:
A cryptovirus, cryptotrojan or cryptoworm is a type of
malware that encrypts the data belonging to an individual on a computer,
demanding a ransom for its restoration.

The term ransomware is commonly used to describe software that encrypts the data
belonging to an individual on a computer, demanding a ransom for its restoration.
Although the field known as cryptovirology predates the term "ransomware".

---

---

AntiSpyShield It also known as:

[Kaspersky]FraudTool.Win32.SpySheriff.f;
[Other]AntiSpyShield,Program:Win32/SpySheriff

---

AntiSpyShield Symptoms:

Files:
[%DESKTOP%]\AntiSpywareShield.lnk
[%DESKTOP%]\AntiSpywareShield.lnk
[%DESKTOP%]\AntiSpywareShield.lnk
[%DESKTOP%]\AntiSpywareShield.lnk

Folders:
[%PROGRAMS%]\AntiSpywareShield
[%PROGRAM_FILES%]\AntiSpywareShield

Registry Keys:
HKEY_CURRENT_USER\software\antispywareshield
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\antispywareshield

Registry Values:
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run
HKEY_CURRENT_USER\software\microsoft\windows\shellnoroam\muicache

---

You must clean you computer ASAP !!!
Download Free Trial Version of antivirus software here, to check your computer instantly.

---

Also Be Aware of the Following Threats:
Mersting Trojan Removal
NeededWare Adware Cleaner
Remove Raid Backdoor
Twobotkill Trojan Cleaner

1stAntiVirus Trojan

How To Remove 1stAntiVirus?
You must download trial version of "Exterminate-It" antivirus software,to check your computer instantly.

---

1stAntiVirus is dangerous virus:
This loose category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

Multi-purpose Trojans are also included in this group, as some virus writers
create multi-functional Trojans rather than Trojan packs.

---

---

1stAntiVirus Symptoms:

Files:
[%DESKTOP%]\1stantivirus.lnk
[%DESKTOP%]\1stantivirus.pkg
[%DESKTOP%]\1stantivirus.lnk
[%DESKTOP%]\1stantivirus.pkg

Folders:
[%PROGRAMS%]\1stantivirus
[%PROGRAM_FILES%]\1stantivirus

Registry Keys:
HKEY_CURRENT_USER\software\xxi\1stantivirus
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\1stantivirus

---

You must clean you computer ASAP !!!
Download Free Trial Version of antivirus software here, to check your computer instantly.

---

Also Be Aware of the Following Threats:
Excalibur Trojan Removal
Tieing.up.the.schools.phones DoS Removal

SillyDl.ATT Downloader

How To Remove SillyDl.ATT?
You must download trial version of "Exterminate-It" antivirus software,to check your computer instantly.

---

SillyDl.ATT is dangerous virus:
The downloader either launches the new malware or registers it to enable autorun
according to the local operating system requirements.

---

---

SillyDl.ATT It also known as:

[Kaspersky]Trojan-Dropper.Win32.Agent.mu;
[Other]Win32/SillyDl.ATT,Trojan.Popper

---

SillyDl.ATT Symptoms:

Files:
[%WINDOWS%]\arqugeu.exe
[%WINDOWS%]\oagjioz.exe
[%WINDOWS%]\pgnxnzv.exe
[%WINDOWS%]\arqugeu.exe
[%WINDOWS%]\oagjioz.exe
[%WINDOWS%]\pgnxnzv.exe

---

You must clean you computer ASAP !!!
Download Free Trial Version of antivirus software here, to check your computer instantly.

---

Also Be Aware of the Following Threats:
Ehg.Thomas.hitbox Tracking Cookie Information

Tiuq Trojan

How To Remove Tiuq?
You must download trial version of "Exterminate-It" antivirus software,to check your computer instantly.

---

Tiuq is dangerous virus:
This loose category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

Multi-purpose Trojans are also included in this group, as some virus writers
create multi-functional Trojans rather than Trojan packs.

---

---

Tiuq It also known as:

[Other]Win32/Tiuq,Win32/Tiuq.A

---

Tiuq Symptoms:

Files:
[%PROFILE%]\Acroread\AcroRD32.exe
[%SYSTEM%]\httpdrv.dll
[%PROFILE%]\Acroread\AcroRD32.exe
[%SYSTEM%]\httpdrv.dll

---

You must clean you computer ASAP !!!
Download Free Trial Version of antivirus software here, to check your computer instantly.

---

Also Be Aware of the Following Threats:
Benuti.A!downloader Trojan Symptoms
VFSI Trojan Symptoms
Removing Ehks Trojan

Infostealer.Bzup Trojan

How To Remove Infostealer.Bzup?
You must download trial version of "Exterminate-It" antivirus software,to check your computer instantly.

---

Infostealer.Bzup is dangerous virus:
This loose category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

Multi-purpose Trojans are also included in this group, as some virus writers
create multi-functional Trojans rather than Trojan packs.
Spyware is computer software that is installed surreptitiously on a personal computer
to intercept or take partial control over the user's interaction
with the computer, without the user's informed consent.

While the term spyware suggests software that secretly monitors the user's behavior,
the functions of spyware extend well beyond simple monitoring.

Spyware programs can collect various types of personal information,
such as Internet surfing habit, sites that have been visited,
but can also interfere with user control of the computer in other ways,
such as installing additional software, redirecting Web browser activity,
accessing websites blindly that will cause more harmful viruses,
or diverting advertising revenue to a third party.

Spyware can even change computer settings, resulting in slow connection speeds,
different home pages, and loss of Internet or other programs.
In an attempt to increase the understanding of spyware, a more formal classification
of its included software types is captured under the term privacy-invasive software.

---

---

Infostealer.Bzup Symptoms:

Files:
[%PROFILE%]\LOCAL.EXE
[%SYSTEM%]\ipv6monl.dll
[%SYSTEM%]\ipv6monr.dll
[%SYSTEM%]\ipv6mons.dll
[%SYSTEM%]\ipv6motp.dll
[%PROFILE%]\LOCAL.EXE
[%SYSTEM%]\ipv6monl.dll
[%SYSTEM%]\ipv6monr.dll
[%SYSTEM%]\ipv6mons.dll
[%SYSTEM%]\ipv6motp.dll

Registry Keys:
HKEY_CLASSES_ROOT\AppID\{36DBC179-A19F-48F2-B16A-6A3E19B42A87}
HKEY_CLASSES_ROOT\appid\{73364d99-1240-4dff-b12a-67e448373148}
HKEY_CLASSES_ROOT\CLSID\{36645342-9475-2663-166A-466739207346}
HKEY_CLASSES_ROOT\clsid\{36dbc179-a19f-48f2-b16a-6a3e19b42a87}
HKEY_CLASSES_ROOT\CLSID\{73364D99-1240-4DFF-B12A-67E448373148}
HKEY_CLASSES_ROOT\CLSID\{8F9DAF73-4AC0-42FF-932C-8F1E42D623B1}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\control panel\load1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{36645342-9475-2663-166A-466739207346}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{36DBC179-A19F-48F2-B16A-6A3E19B42A87}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{73364D99-1240-4DFF-B12A-67E448373148}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8F9DAF73-4AC0-42FF-932C-8F1E42D623B1}

---

You must clean you computer ASAP !!!
Download Free Trial Version of antivirus software here, to check your computer instantly.

---

Also Be Aware of the Following Threats:
Pigeon.AVIQ Trojan Symptoms

RightFinder Hijacker

How To Remove RightFinder?
You must download trial version of "Exterminate-It" antivirus software,to check your computer instantly.

---

RightFinder is dangerous virus:
Hijackers take control of various parts of your web browser, including your home page,
search pages, and search bar. They may also redirect you to certain sites should you
mistype an address or prevent you from going to a website they would rather you not,
such as sites that combat malware. Some will even redirect you to their own search engine
when you attempt a search.

---

---

RightFinder Symptoms:

Files:
[%FAVORITES%]\find anything in the net.url
[%FAVORITES%]\find hot porn in the net.url
[%FAVORITES%]\find anything in the net.url
[%FAVORITES%]\find hot porn in the net.url

Registry Values:
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run

---

You must clean you computer ASAP !!!
Download Free Trial Version of antivirus software here, to check your computer instantly.

---

Also Be Aware of the Following Threats:
PopupWithCast Adware Cleaner
Remove Antispywarebox Adware
Near.Mohists RAT Symptoms
TrojanSpy.Win32.Agent Trojan Removal

Lineage.AAU Trojan

How To Remove Lineage.AAU?
You must download trial version of "Exterminate-It" antivirus software,to check your computer instantly.

---

Lineage.AAU is dangerous virus:
This category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

---

---

Lineage.AAU It also known as:

[Kaspersky]Trojan.Win32.Inject.ci;
[Other]Win32/Lineage.AAU,W32/Inject.KN,Infostealer,Mal/EncPk-AS

---

Lineage.AAU Symptoms:

Files:
[%SYSTEM%]\Ir32_a.exe
[%SYSTEM%]\Ir32_a.exe

---

You must clean you computer ASAP !!!
Download Free Trial Version of antivirus software here, to check your computer instantly.

---

Also Be Aware of the Following Threats:
KO Trojan Symptoms
FearlessKeySpy Trojan Removal

HuntBar.BTLink Hijacker

How To Remove HuntBar.BTLink?
You must download trial version of "Exterminate-It" antivirus software,to check your computer instantly.

---

HuntBar.BTLink is dangerous virus:
Hijackers take control of various parts of your web browser, including your home page,
search pages, and search bar. They may also redirect you to certain sites should you
mistype an address or prevent you from going to a website they would rather you not,
such as sites that combat malware. Some will even redirect you to their own search engine
when you attempt a search.

---

---

HuntBar.BTLink Symptoms:

Files:
[%PROGRAM_FILES_COMMON%]\btlink\btlink.dll
[%PROGRAM_FILES%]\common files\btlink\btlink.dll
[%PROGRAM_FILES_COMMON%]\btlink\btlink.dll
[%PROGRAM_FILES%]\common files\btlink\btlink.dll

---

You must clean you computer ASAP !!!
Download Free Trial Version of antivirus software here, to check your computer instantly.

---

Also Be Aware of the Following Threats:
Vxidl.AGO Trojan Information

Delf.rc Trojan

How To Remove Delf.rc?
You must download trial version of "Exterminate-It" antivirus software,to check your computer instantly.

---

Delf.rc is dangerous virus:
This loose category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

Multi-purpose Trojans are also included in this group, as some virus writers
create multi-functional Trojans rather than Trojan packs.

---

---

Delf.rc Symptoms:

Registry Values:
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run

---

You must clean you computer ASAP !!!
Download Free Trial Version of antivirus software here, to check your computer instantly.

---

Also Be Aware of the Following Threats:
Small.adb Downloader Information
Remove CEU Trojan

CWS Downloader Trojan

How To Remove CWS Downloader?
You must download trial version of "Exterminate-It" antivirus software,to check your computer instantly.

---

CWS Downloader is dangerous virus:
This category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.
The downloader either launches the new malware or registers it to enable autorun
according to the local operating system requirements.

---

---

CWS Downloader Symptoms:

Files:
[%PROGRAM_FILES%]\AutoPrint\srvany.exe
[%PROGRAM_FILES%]\AXIS Communications\AXIS ThinWizard\SRVANY.EXE
[%PROGRAM_FILES%]\Favorite Ware\Reminder.exe
[%PROGRAM_FILES%]\Gateway\EzTune\DTSRVC.exe
[%PROGRAM_FILES%]\Gateway\EzTune\dtsslsrv.exe
[%PROGRAM_FILES%]\gnway\ddns\gnsrv.exe
[%PROGRAM_FILES%]\LAN-Control\srvany.exe
[%PROGRAM_FILES%]\Network Monitor\netmon.exe
[%PROGRAM_FILES%]\Power Translator\LogoMedia TranslateDotNet Server.exe
[%PROGRAM_FILES%]\Priva\Priva Office\tools\srvany.exe
[%PROGRAM_FILES%]\RAdmin\r_server.exe
[%PROGRAM_FILES%]\Remote Task Manager\rtmservice.exe
[%PROGRAM_FILES%]\SAMSUNG\FW LiveUpdate\FWManager.exe
[%PROGRAM_FILES%]\SAPpc\SapGui\srvany.exe
[%PROGRAM_FILES%]\timbuktu pro\tb2launch.exe
[%PROGRAM_FILES%]\WinAntiVirus 2005 Pro\AVKernel.exe
[%PROGRAM_FILES%]\WinAntiVirus Pro 2006\FWSvc.exe
[%PROGRAM_FILES_COMMON%]\SNAPST~1\Common\X10nets.exe
[%PROGRAM_FILES_COMMON%]\WinTools\WToolsS.exe
[%PROGRAM_FILES_COMMON%]\X10\Common\X10nets.exe
[%SYSTEM%]\$sys$filesystem\$sys$DRMServer.exe
[%SYSTEM%]\acs.exe
[%SYSTEM%]\altsvc.exe
[%SYSTEM%]\aniServ.exe
[%SYSTEM%]\CfgSrvc.exe
[%SYSTEM%]\dllcache\win32\winlogon.exe
[%SYSTEM%]\drivers\etc\smss.exe
[%SYSTEM%]\FreezeScreenSaver.exe
[%SYSTEM%]\lsas.exe
[%SYSTEM%]\msCMTsrvc.exe
[%SYSTEM%]\ndesjcoq6.exe
[%SYSTEM%]\rtmservice.exe
[%SYSTEM%]\r_server.exe
[%SYSTEM%]\slee503.exe
[%SYSTEM%]\SnoopFreeSvc.exe
[%SYSTEM%]\Srvany.exe
[%SYSTEM%]\ujqdrj.exe
[%SYSTEM%]\windlls.exe
[%SYSTEM%]\x10nets.exe
[%WINDOWS%]\am9yZGFu\command.exe
[%WINDOWS%]\aQ\command.exe
[%WINDOWS%]\b3duZXI\command.exe
[%WINDOWS%]\c2FpZg\command.exe
[%WINDOWS%]\cmFj\command.exe
[%WINDOWS%]\IA\command.exe
[%WINDOWS%]\iejs.exe
[%WINDOWS%]\IGRvbg\command.exe
[%WINDOWS%]\Lg\command.exe
[%WINDOWS%]\QmFyYmFyYSBNIEhhd2tpbnM\command.exe
[%WINDOWS%]\QnJpYW4\command.exe
[%WINDOWS%]\QWFyb25z\command.exe
[%WINDOWS%]\RGFycmVu\command.exe
[%WINDOWS%]\RmFtLiBkZSBHcmVlZg\command.exe
[%WINDOWS%]\RWR3YXJkIEZvcnRlc2N1ZQ\command.exe
[%WINDOWS%]\S3Jpc3Rlbg\command.exe
[%WINDOWS%]\SG9tZQ\command.exe
[%WINDOWS%]\Sm9lIFN0ZXJu\command.exe
[%WINDOWS%]\SmFtYWhs\command.exe
[%WINDOWS%]\SmFtZXMgRCBWb3lsZXM\command.exe
[%WINDOWS%]\SmFtZXMgTGF1cmVuY2UgV2hpdGluZw\command.exe
[%WINDOWS%]\SmVhbmV0dGUgTGV1c2luaw\command.exe
[%WINDOWS%]\SmVmZiBNb3JhbGVz\command.exe
[%WINDOWS%]\SmVmZnJleQ\command.exe
[%WINDOWS%]\SnU\command.exe
[%WINDOWS%]\SnVhbiBGIExlemFtYQ\command.exe
[%WINDOWS%]\srvany.exe
[%WINDOWS%]\svcproc.exe
[%WINDOWS%]\SW5tYW4\command.exe
[%WINDOWS%]\SYSTEM\DRIVER\ntsrv.exe
[%WINDOWS%]\SYSTEM\DRIVER\ntuser.exe
[%WINDOWS%]\T0VN\command.exe
[%WINDOWS%]\T3duZXI\command.exe
[%WINDOWS%]\TGFycnkgTWFjaW9jaQ\command.exe
[%WINDOWS%]\TGlhbmUgV2hpdG5leQ\command.exe
[%WINDOWS%]\Tm9taXM\command.exe
[%WINDOWS%]\TmljayBTdGVyY3phbGE\command.exe
[%WINDOWS%]\TUlOSCBMRQ\command.exe
[%WINDOWS%]\TW9sbHkgQXJub2xk\command.exe
[%WINDOWS%]\twain_32\SiPix\SCBlink2\srvany.exe
[%WINDOWS%]\TWF0dCBaZXR6\command.exe
[%WINDOWS%]\TWU\command.exe
[%WINDOWS%]\U2V3YSBTaW5nYWw\command.exe
[%WINDOWS%]\U3RhbiBTbWl0aA\command.exe
[%WINDOWS%]\U3RlcGhlbiBBcndpbmU\command.exe
[%WINDOWS%]\UEI\command.exe
[%WINDOWS%]\UGF0IERlc2hhdw\command.exe
[%WINDOWS%]\UHJlZmVycmVkIEN1c3RvbWVy\command.exe
[%WINDOWS%]\UkQ\command.exe
[%WINDOWS%]\Um9iZXJ0bw\command.exe
[%WINDOWS%]\UXVhbGNvbW0\command.exe
[%WINDOWS%]\V2lsbCBNaXRjaGVsbA\command.exe
[%WINDOWS%]\VXNlcg\command.exe
[%WINDOWS%]\WGlhb0Jyb3RoZXI\command.exe
[%WINDOWS%]\YmI\command.exe
[%WINDOWS%]\YmVybmFyZCBj\command.exe
[%WINDOWS%]\YWRtaW4\command.exe
[%WINDOWS%]\zeta.exe
[%WINDOWS%]\ZHk\command.exe
[%WINDOWS%]\Zm8\command.exe
[%PROGRAM_FILES%]\AutoPrint\srvany.exe
[%PROGRAM_FILES%]\AXIS Communications\AXIS ThinWizard\SRVANY.EXE
[%PROGRAM_FILES%]\Favorite Ware\Reminder.exe
[%PROGRAM_FILES%]\Gateway\EzTune\DTSRVC.exe
[%PROGRAM_FILES%]\Gateway\EzTune\dtsslsrv.exe
[%PROGRAM_FILES%]\gnway\ddns\gnsrv.exe
[%PROGRAM_FILES%]\LAN-Control\srvany.exe
[%PROGRAM_FILES%]\Network Monitor\netmon.exe
[%PROGRAM_FILES%]\Power Translator\LogoMedia TranslateDotNet Server.exe
[%PROGRAM_FILES%]\Priva\Priva Office\tools\srvany.exe
[%PROGRAM_FILES%]\RAdmin\r_server.exe
[%PROGRAM_FILES%]\Remote Task Manager\rtmservice.exe
[%PROGRAM_FILES%]\SAMSUNG\FW LiveUpdate\FWManager.exe
[%PROGRAM_FILES%]\SAPpc\SapGui\srvany.exe
[%PROGRAM_FILES%]\timbuktu pro\tb2launch.exe
[%PROGRAM_FILES%]\WinAntiVirus 2005 Pro\AVKernel.exe
[%PROGRAM_FILES%]\WinAntiVirus Pro 2006\FWSvc.exe
[%PROGRAM_FILES_COMMON%]\SNAPST~1\Common\X10nets.exe
[%PROGRAM_FILES_COMMON%]\WinTools\WToolsS.exe
[%PROGRAM_FILES_COMMON%]\X10\Common\X10nets.exe
[%SYSTEM%]\$sys$filesystem\$sys$DRMServer.exe
[%SYSTEM%]\acs.exe
[%SYSTEM%]\altsvc.exe
[%SYSTEM%]\aniServ.exe
[%SYSTEM%]\CfgSrvc.exe
[%SYSTEM%]\dllcache\win32\winlogon.exe
[%SYSTEM%]\drivers\etc\smss.exe
[%SYSTEM%]\FreezeScreenSaver.exe
[%SYSTEM%]\lsas.exe
[%SYSTEM%]\msCMTsrvc.exe
[%SYSTEM%]\ndesjcoq6.exe
[%SYSTEM%]\rtmservice.exe
[%SYSTEM%]\r_server.exe
[%SYSTEM%]\slee503.exe
[%SYSTEM%]\SnoopFreeSvc.exe
[%SYSTEM%]\Srvany.exe
[%SYSTEM%]\ujqdrj.exe
[%SYSTEM%]\windlls.exe
[%SYSTEM%]\x10nets.exe
[%WINDOWS%]\am9yZGFu\command.exe
[%WINDOWS%]\aQ\command.exe
[%WINDOWS%]\b3duZXI\command.exe
[%WINDOWS%]\c2FpZg\command.exe
[%WINDOWS%]\cmFj\command.exe
[%WINDOWS%]\IA\command.exe
[%WINDOWS%]\iejs.exe
[%WINDOWS%]\IGRvbg\command.exe
[%WINDOWS%]\Lg\command.exe
[%WINDOWS%]\QmFyYmFyYSBNIEhhd2tpbnM\command.exe
[%WINDOWS%]\QnJpYW4\command.exe
[%WINDOWS%]\QWFyb25z\command.exe
[%WINDOWS%]\RGFycmVu\command.exe
[%WINDOWS%]\RmFtLiBkZSBHcmVlZg\command.exe
[%WINDOWS%]\RWR3YXJkIEZvcnRlc2N1ZQ\command.exe
[%WINDOWS%]\S3Jpc3Rlbg\command.exe
[%WINDOWS%]\SG9tZQ\command.exe
[%WINDOWS%]\Sm9lIFN0ZXJu\command.exe
[%WINDOWS%]\SmFtYWhs\command.exe
[%WINDOWS%]\SmFtZXMgRCBWb3lsZXM\command.exe
[%WINDOWS%]\SmFtZXMgTGF1cmVuY2UgV2hpdGluZw\command.exe
[%WINDOWS%]\SmVhbmV0dGUgTGV1c2luaw\command.exe
[%WINDOWS%]\SmVmZiBNb3JhbGVz\command.exe
[%WINDOWS%]\SmVmZnJleQ\command.exe
[%WINDOWS%]\SnU\command.exe
[%WINDOWS%]\SnVhbiBGIExlemFtYQ\command.exe
[%WINDOWS%]\srvany.exe
[%WINDOWS%]\svcproc.exe
[%WINDOWS%]\SW5tYW4\command.exe
[%WINDOWS%]\SYSTEM\DRIVER\ntsrv.exe
[%WINDOWS%]\SYSTEM\DRIVER\ntuser.exe
[%WINDOWS%]\T0VN\command.exe
[%WINDOWS%]\T3duZXI\command.exe
[%WINDOWS%]\TGFycnkgTWFjaW9jaQ\command.exe
[%WINDOWS%]\TGlhbmUgV2hpdG5leQ\command.exe
[%WINDOWS%]\Tm9taXM\command.exe
[%WINDOWS%]\TmljayBTdGVyY3phbGE\command.exe
[%WINDOWS%]\TUlOSCBMRQ\command.exe
[%WINDOWS%]\TW9sbHkgQXJub2xk\command.exe
[%WINDOWS%]\twain_32\SiPix\SCBlink2\srvany.exe
[%WINDOWS%]\TWF0dCBaZXR6\command.exe
[%WINDOWS%]\TWU\command.exe
[%WINDOWS%]\U2V3YSBTaW5nYWw\command.exe
[%WINDOWS%]\U3RhbiBTbWl0aA\command.exe
[%WINDOWS%]\U3RlcGhlbiBBcndpbmU\command.exe
[%WINDOWS%]\UEI\command.exe
[%WINDOWS%]\UGF0IERlc2hhdw\command.exe
[%WINDOWS%]\UHJlZmVycmVkIEN1c3RvbWVy\command.exe
[%WINDOWS%]\UkQ\command.exe
[%WINDOWS%]\Um9iZXJ0bw\command.exe
[%WINDOWS%]\UXVhbGNvbW0\command.exe
[%WINDOWS%]\V2lsbCBNaXRjaGVsbA\command.exe
[%WINDOWS%]\VXNlcg\command.exe
[%WINDOWS%]\WGlhb0Jyb3RoZXI\command.exe
[%WINDOWS%]\YmI\command.exe
[%WINDOWS%]\YmVybmFyZCBj\command.exe
[%WINDOWS%]\YWRtaW4\command.exe
[%WINDOWS%]\zeta.exe
[%WINDOWS%]\ZHk\command.exe
[%WINDOWS%]\Zm8\command.exe

Registry Keys:
HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\legacy__11f*00df*00e4*0006#*00b7*00ba*00c4*00d6`i
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ 11F%DF%E4%06#%B7%BA%C4%D6`I
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\$sys$DRMServer
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\%8F 6Q%D4%F5%13'%AA%B4%C6%D08
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ACS
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ANISERVICE
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AppSched
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AppSched10
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Asset Management Daemon
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AutoPrintPro
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AVKernel
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Blink2PnP
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CfgSrvc
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\cmdservice
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DanaReg
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DanaSubst
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DistRestart
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Domino
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DTSRVC
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Endcust
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\FreezeScreenSaver
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\FWSvc
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\GHServer
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\gnwayDDNS
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HsspConfig
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IBAffinity
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LAN-MySQL
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LogDataMgr
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LogoMedia TranslateDotNet Server
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Maximizer1
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\msCMTSrvc
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netbios Helper Service
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netddehard
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Network Monitor
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Network Switching Alerter
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTBOOT
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTLOAD
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTSVCMGR
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Office Mail
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PosysMirror
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\promtdbmsserver
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\promtmonitor
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PSecret
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PsqlWge
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\QcomPostInstall
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RecTracBroker
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RRAANXGN
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RTM
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\r_server
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SAP IGS Service
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SLEE_503_SERVICE
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SnoopFreeSvc
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SurferService
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SvcProc
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sv_logger
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tadxrgsb6
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tb2Launch
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ThinWizard
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TunnelBroker
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Windows smss
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\wintoolssvc
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\x10nets
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ZESOFT

Registry Values:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run-
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices

---

You must clean you computer ASAP !!!
Download Free Trial Version of antivirus software here, to check your computer instantly.

---

Also Be Aware of the Following Threats:
Keylogger Trojan Symptoms
RegClean Ransomware Symptoms

HelpExpress Adware

How To Remove HelpExpress?
You must download trial version of "Exterminate-It" antivirus software,to check your computer instantly.

---

HelpExpress is dangerous virus:
Adware are programs that facilitate delivery for advertising content
to the user and in some cases gather information from the user's computer.

Spyware is computer software that is installed surreptitiously on a personal computer
to with the computer, without the user's informed consent.

---

---

HelpExpress It also known as:

[Panda]Adware/HelpExpress

---

HelpExpress Symptoms:

Files:
[%WINDOWS%]\emsw.exe
[%WINDOWS%]\emsw.exe

Folders:
[%PROGRAM_FILES%]\alset
[%PROGRAM_FILES%]\aveo
[%PROGRAM_FILES%]\alset network

Registry Keys:
HKEY_CURRENT_USER\software\hx
HKEY_CURRENT_USER\software\hxdl

Registry Values:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run

---

You must clean you computer ASAP !!!
Download Free Trial Version of antivirus software here, to check your computer instantly.

---

Also Be Aware of the Following Threats:
Removing Serv.5b.Broken.Link.Uploader Trojan
Remove Iesar Hijacker

Keylogger.Express Spyware

How To Remove Keylogger.Express?
You must download trial version of "Exterminate-It" antivirus software,to check your computer instantly.

---

Keylogger.Express is dangerous virus:
Spyware is computer software that is installed surreptitiously on a personal computer
to intercept or take partial control over the user's interaction
with the computer, without the user's informed consent.

While the term spyware suggests software that secretly monitors the user's behavior,
the functions of spyware extend well beyond simple monitoring.

Spyware programs can collect various types of personal information,
such as Internet surfing habit, sites that have been visited,
but can also interfere with user control of the computer in other ways,
such as installing additional software, redirecting Web browser activity,
accessing websites blindly that will cause more harmful viruses,
or diverting advertising revenue to a third party.

Spyware can even change computer settings, resulting in slow connection speeds,
different home pages, and loss of Internet or other programs.
In an attempt to increase the understanding of spyware, a more formal classification
of its included software types is captured under the term privacy-invasive software.

---

---

Keylogger.Express Symptoms:

Folders:
[%PROGRAM_FILES%]\hk

Registry Values:
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run

---

You must clean you computer ASAP !!!
Download Free Trial Version of antivirus software here, to check your computer instantly.

---

Also Be Aware of the Following Threats:
Remove rtcode.com Tracking Cookie
INetSpeak Trojan Cleaner
IRC.Mskey Trojan Information
Bad.Sectors Trojan Removal
Brokno Trojan Information

Nssys32 Trojan

How To Remove Nssys32?
You must download trial version of "Exterminate-It" antivirus software,to check your computer instantly.

---

Nssys32 is dangerous virus:
This category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

---

---

Nssys32 Symptoms:

Files:
[%WINDOWS%]\system\nssys32.exe
[%WINDOWS%]\system\nssys32.exe

---

You must clean you computer ASAP !!!
Download Free Trial Version of antivirus software here, to check your computer instantly.

---

Also Be Aware of the Following Threats:
Kwak Trojan Removal instruction
Bat.Wavefunc.Wise Trojan Information
Remove Vxidl.BCA Trojan
Removing StartPage.ig Hijacker
Vxidl.ANS Trojan Removal

Zlob.Fam.Security Messenger Trojan

How To Remove Zlob.Fam.Security Messenger?
You must download trial version of "Exterminate-It" antivirus software,to check your computer instantly.

---

Zlob.Fam.Security Messenger is dangerous virus:
This loose category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

Multi-purpose Trojans are also included in this group, as some virus writers
create multi-functional Trojans rather than Trojan packs.
Adware is the class of programs that place advertisements on your screen.
These may be in the form of pop-ups, pop-unders, advertisements embedded in programs,
advertisements placed on top of ads in web sites, or any other way the authors can
think of showing you an ad.

The pop-ups generally will not be stopped by pop-up stoppers, and often are
not dependent on your having Internet Explorer open.
They may show up when you are playing a game, writing a document, listening to music,
or anything else. Should you be surfing, the advertisements will often be related to
the web page you are viewing.

---

---

Zlob.Fam.Security Messenger Symptoms:

Registry Keys:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Security Messenger

---

You must clean you computer ASAP !!!
Download Free Trial Version of antivirus software here, to check your computer instantly.

---

Also Be Aware of the Following Threats:
Remove Generic.MultiDropper Trojan
PWS.Hooker.dll Trojan Removal
Removing Orpdea Trojan
Perfect.Cleaner Ransomware Information
Trepid RAT Information

Ptakks Trojan

How To Remove Ptakks?
You must download trial version of "Exterminate-It" antivirus software,to check your computer instantly.

---

Ptakks is dangerous virus:
This loose category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

Multi-purpose Trojans are also included in this group, as some virus writers
create multi-functional Trojans rather than Trojan packs.
Backdoors are the most dangerous type of Trojans and the most popular.
Backdoors open infected machines to external control via Internet.
Often the backdoor will not be visible in the log of active programs.
Many trojans and backdoors now have remote administration capabilities
allowing an individual to control the victim's computer.
Many times a file called the server must be opened on the victim's computer before
the trojan can have access to it.

These are generally sent through email, P2P file sharing software,
and in internet downloads. They are usually disguised as a legitimate program or file.
Many server files will display a fake error message when opened, to make it seem like it didn't open.
Some will also kill antivirus and firewall software.

---

---

Ptakks It also known as:

[Kaspersky]Backdoor.Ptakks.XP.b,Backdoor.Ptakks.209,Backdoor.Ptakks.XP.d,Backdoor.Ptakks.XP.e,Backdoor.Ptakks.211,Backdoor.Ptakks.215,Backdoor.Ptakks.216,Backdoor.Ptakks.01;
[Eset]Win32/Ptakks.XP.B trojan,Win32/Ptakks.R1 trojan;
[McAfee]BackDoor-KL,BackDoor-KL.dr;
[F-Prot]security risk or a "backdoor" program;
[Panda]Bck/Ptakks.2.1,Bck/Ptakksbomb,Bck/PtAkkS.02,Bck/Ptakks.209,Bck/Ptakks.2c.cfg,Bck/Ptakks.XP.C,Bck/Ptakks.211,Trojan Horse,Bck/Ptakks.216,Bck/Ptakks.Res;
[Computer Associates]Backdoor/PTaks.2_15!Setup,Backdoor/Ptakks.209!Server,Backdoor/PtakksResur!Server,Win32.Ptakks.H,Win32.Ptakks.I,Win32/Ptakks.R2.C!Trojan,Backdoor/Ptakks.2_16,Backdoor/Ptakks.216,Win32.Ptakks.B,Win32.Ptakks.J,Win32/Ptakks.215!Trojan,Backdoor/Ptakks.P1

---

Ptakks Symptoms:

Files:
[%PROGRAM_FILES%]\IC\Card Reader Driver v1.9e2\irunin.lng
[%PROGRAM_FILES%]\Kazaa Lite K++\defuserset.exe
[%PROGRAM_FILES%]\Kazaa Lite K++\Kazaa.kpp.manifest
[%PROGRAM_FILES%]\Kazaa Lite K++\KazaaLite.kpp.manifest
[%PROGRAM_FILES%]\Kazaa Lite K++\KDat.exe.manifest
[%PROGRAM_FILES%]\Kazaa Lite K++\KLConfigWizard.exe.manifest
[%PROGRAM_FILES%]\Kazaa Lite K++\kpp.exe
[%PROGRAM_FILES%]\Kazaa Lite K++\ksharedfolder.exe
[%PROGRAM_FILES%]\Kazaa Lite K++\KSig.exe.manifest
[%PROGRAM_FILES%]\Kazaa Lite Resurrection\kazaalite.kpp.manifest
[%PROGRAM_FILES%]\RJCE\Agenda de Amparo y Penal Federal 2004\irunin.lng
[%PROGRAM_FILES%]\IC\Card Reader Driver v1.9e2\irunin.lng
[%PROGRAM_FILES%]\Kazaa Lite K++\defuserset.exe
[%PROGRAM_FILES%]\Kazaa Lite K++\Kazaa.kpp.manifest
[%PROGRAM_FILES%]\Kazaa Lite K++\KazaaLite.kpp.manifest
[%PROGRAM_FILES%]\Kazaa Lite K++\KDat.exe.manifest
[%PROGRAM_FILES%]\Kazaa Lite K++\KLConfigWizard.exe.manifest
[%PROGRAM_FILES%]\Kazaa Lite K++\kpp.exe
[%PROGRAM_FILES%]\Kazaa Lite K++\ksharedfolder.exe
[%PROGRAM_FILES%]\Kazaa Lite K++\KSig.exe.manifest
[%PROGRAM_FILES%]\Kazaa Lite Resurrection\kazaalite.kpp.manifest
[%PROGRAM_FILES%]\RJCE\Agenda de Amparo y Penal Federal 2004\irunin.lng

---

You must clean you computer ASAP !!!
Download Free Trial Version of antivirus software here, to check your computer instantly.

---

Also Be Aware of the Following Threats:
Pigeon.AVBH Trojan Cleaner
Shadow.Bot DoS Cleaner
Removing Slod Trojan
TinyKeyLogger Spyware Cleaner

BHO BHO

How To Remove BHO?
You must download trial version of "Exterminate-It" antivirus software,to check your computer instantly.

---

BHO is dangerous virus:
The BHO (Browser Helper Object) waits for the user to post personal information to a monitored website.
As this information is entered by the user, it is captured by the BHO and sent back to the attacker.

---

---

BHO Symptoms:

Files:
[%SYSTEM%]\ir4axb.dll
[%SYSTEM%]\ir4axb.dll

---

You must clean you computer ASAP !!!
Download Free Trial Version of antivirus software here, to check your computer instantly.

---

Also Be Aware of the Following Threats:
StartPage.ea Hijacker Information

PWS.EyeOnIE Trojan

How To Remove PWS.EyeOnIE?
You must download trial version of "Exterminate-It" antivirus software,to check your computer instantly.

---

PWS.EyeOnIE is dangerous virus:
This loose category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

Multi-purpose Trojans are also included in this group, as some virus writers
create multi-functional Trojans rather than Trojan packs.
The BHO (Browser Helper Object) waits for the user to post personal information to a monitored website.
As this information is entered by the user, it is captured by the BHO and sent back to the attacker.
Hacker Tools are designed to penetrate remote computers
in order to use them as zombies or to download other malicious programs to computer.

---

---

PWS.EyeOnIE It also known as:

[McAfee]PWS-EyeOnIE;
[Other]Infostealer.Eyoni

---

PWS.EyeOnIE Symptoms:

Files:
[%SYSTEM%]\atsldr.dll
[%SYSTEM%]\atsldr.dll

Registry Keys:
HKEY_CLASSES_ROOT\bhoplugin.eyeonie
HKEY_CLASSES_ROOT\bhoplugin.eyeonie.1
HKEY_CLASSES_ROOT\clsid\{c14393e1-95ff-4dff-9be0-ea008d4ef930}
HKEY_CLASSES_ROOT\interface\{a1ff2696-03d0-4221-8149-55c4609fb343}
HKEY_CLASSES_ROOT\typelib\{849f576d-4e1d-414d-a06a-085a2d8b8d7f}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{c14393e1-95ff-4dff-9be0-ea008d4ef930}

---

You must clean you computer ASAP !!!
Download Free Trial Version of antivirus software here, to check your computer instantly.

---

Also Be Aware of the Following Threats:
Remove Plovdiv Trojan
Kazoom Worm Removal
Duole8 Adware Symptoms

Win32.Spy.BiSpy Adware

How To Remove Win32.Spy.BiSpy?
You must download trial version of "Exterminate-It" antivirus software,to check your computer instantly.

---

Win32.Spy.BiSpy is dangerous virus:
Adware are programs that facilitate delivery for advertising content
to the user and in some cases gather information from the user's computer,
including information related to Internet browser usage or other computer habits
As this information is entered by the user, it is captured by the BHO (Browser Helper Object) and
sent back to the attacker.
Typically, keyloggers of this type will send the stolen information back to the attacker via email
or HTTP POST, which can appear suspicious.

---

---

Win32.Spy.BiSpy It also known as:

[Eset]Win32/Spy.BiSpy.C trojan;
[Panda]Adware/MultiMPP,Adware/Twain-Tech,Spyware/BetterInet

---

Win32.Spy.BiSpy Symptoms:

Files:
[%PROFILE_TEMP%]\twtini.inf
[%PROFILE_TEMP%]\bi.ini
[%PROFILE_TEMP%]\THI223E.tmp\preInsTT.exe
[%PROFILE_TEMP%]\THI223E.tmp\twaintec.cab
[%PROFILE_TEMP%]\THI223E.tmp\twaintec.dll
[%PROFILE_TEMP%]\THI223E.tmp\twaintec.inf
[%PROFILE_TEMP%]\THI2738.tmp\twaintec.dll
[%PROFILE_TEMP%]\THI369D.tmp\twaintec.inf
[%PROFILE_TEMP%]\THI3896.tmp\twaintec.inf
[%PROFILE_TEMP%]\THI3E25.tmp\twaintec.dll
[%PROFILE_TEMP%]\THI417E.tmp\twaintec.inf
[%PROFILE_TEMP%]\THI52F3.tmp\twaintec.inf
[%PROFILE_TEMP%]\THI5CAB.tmp\twaintec.inf
[%PROFILE_TEMP%]\THI62BF.tmp\preInsTT.exe
[%PROFILE_TEMP%]\THI62BF.tmp\twaintec.dll
[%PROFILE_TEMP%]\THI6A6D.tmp\twaintec.inf
[%PROFILE_TEMP%]\THI6C63.tmp\twaintec.inf
[%PROFILE_TEMP%]\THI76C2.tmp\twaintec.inf
[%PROFILE_TEMP%]\THI7817.tmp\twaintec.inf
[%PROFILE_TEMP%]\THI842.tmp\mxTarget.dll
[%PROFILE_TEMP%]\twaintec.ini
[%PROFILE_TEMP%]\twtini.cab
[%WINDOWS%]\bi.ini
[%WINDOWS%]\Biprep.exe
[%WINDOWS%]\ft1_01_0_279_gepfah.exe
[%WINDOWS%]\inf\twtini.inf
[%WINDOWS%]\msview.ini
[%WINDOWS%]\multimpp.dll
[%WINDOWS%]\mxtarget.ini
[%WINDOWS%]\preInsTT.exe
[%WINDOWS%]\preInsTT.exe_
[%WINDOWS%]\smdat32a.sys
[%WINDOWS%]\smdat32m.sys
[%WINDOWS%]\twaintec.ini
[%WINDOWS%]\wsem218.dll
[%PROFILE%]\locals~1\temp\twtini.inf
[%PROFILE_TEMP%]\mxtarget.dll
[%PROFILE_TEMP%]\oyyilj8kl.exe
[%PROFILE_TEMP%]\preinsmt.exe
[%PROFILE_TEMP%]\thi1206.tmp\mxtarget.dll
[%PROFILE_TEMP%]\thi1206.tmp\preinsmt.exe
[%PROFILE_TEMP%]\thi13ca.tmp\preinsmt.exe
[%PROFILE_TEMP%]\thi15e8.tmp\twaintec.dll
[%PROFILE_TEMP%]\thi15e8.tmp\twaintec.inf
[%PROFILE_TEMP%]\thi168d.tmp\preinstt.exe
[%PROFILE_TEMP%]\thi168d.tmp\twaintec.dll
[%PROFILE_TEMP%]\thi174f.tmp\twaintec.inf
[%PROFILE_TEMP%]\thi1832.tmp\twaintec.dll
[%PROFILE_TEMP%]\thi1832.tmp\twaintec.inf
[%PROFILE_TEMP%]\thi18b1.tmp\mxtarget.dll
[%PROFILE_TEMP%]\thi18b1.tmp\preinsmt.exe
[%PROFILE_TEMP%]\thi19a6.tmp\mxtarget.dll
[%PROFILE_TEMP%]\thi19a6.tmp\preinsmt.exe
[%PROFILE_TEMP%]\thi1c5b.tmp\mxtarget.dll
[%PROFILE_TEMP%]\thi1c5b.tmp\preinsmt.exe
[%PROFILE_TEMP%]\thi1ff4.tmp\mxtarget.dll
[%PROFILE_TEMP%]\thi1ff4.tmp\preinsmt.exe
[%PROFILE_TEMP%]\thi205e.tmp\mxtarget.inf
[%PROFILE_TEMP%]\thi2096.tmp\mxtarget.dll
[%PROFILE_TEMP%]\thi2096.tmp\preinsmt.exe
[%PROFILE_TEMP%]\thi23a2.tmp\mxtarget.dll
[%PROFILE_TEMP%]\thi23a2.tmp\preinsmt.exe
[%PROFILE_TEMP%]\thi23f0.tmp\twaintec.dll
[%PROFILE_TEMP%]\thi23f0.tmp\twaintec.inf
[%PROFILE_TEMP%]\thi2dfe.tmp\mxtarget.dll
[%PROFILE_TEMP%]\thi2dfe.tmp\preinsmt.exe
[%PROFILE_TEMP%]\thi2eec.tmp\wsebate1.exe
[%PROFILE_TEMP%]\thi3687.tmp\mxtarget.dll
[%PROFILE_TEMP%]\thi3687.tmp\preinsmt.exe
[%PROFILE_TEMP%]\thi390d.tmp\twaintec.inf
[%PROFILE_TEMP%]\thi3a0.tmp\twaintec.dll
[%PROFILE_TEMP%]\thi3a0.tmp\twaintec.inf
[%PROFILE_TEMP%]\thi3c79.tmp\twaintec.inf
[%PROFILE_TEMP%]\thi4020.tmp\twaintec.dll
[%PROFILE_TEMP%]\thi4020.tmp\twaintec.inf
[%PROFILE_TEMP%]\thi406.tmp\twaintec.dll
[%PROFILE_TEMP%]\thi406.tmp\twaintec.inf
[%PROFILE_TEMP%]\thi40a8.tmp\preinstt.exe
[%PROFILE_TEMP%]\thi40a8.tmp\twaintec.dll
[%PROFILE_TEMP%]\thi43de.tmp\mxtarget.dll
[%PROFILE_TEMP%]\thi43de.tmp\preinsmt.exe
[%PROFILE_TEMP%]\thi45ff.tmp\mxtarget.dll
[%PROFILE_TEMP%]\thi45ff.tmp\preinsmt.exe
[%PROFILE_TEMP%]\thi4ceb.tmp\twaintec.dll
[%PROFILE_TEMP%]\thi4ceb.tmp\twaintec.inf
[%PROFILE_TEMP%]\thi4d5b.tmp\mxtarget.dll
[%PROFILE_TEMP%]\thi4d5b.tmp\preinsmt.exe
[%PROFILE_TEMP%]\thi4e88.tmp\twaintec.dll
[%PROFILE_TEMP%]\thi4e88.tmp\twaintec.inf
[%PROFILE_TEMP%]\thi5213.tmp\mxtarget.dll
[%PROFILE_TEMP%]\thi5213.tmp\preinsmt.exe
[%PROFILE_TEMP%]\thi53de.tmp\mxtarget.dll
[%PROFILE_TEMP%]\thi53de.tmp\preinsmt.exe
[%PROFILE_TEMP%]\thi5755.tmp\twaintec.dll
[%PROFILE_TEMP%]\thi5755.tmp\twaintec.inf
[%PROFILE_TEMP%]\thi57dc.tmp\mxtarget.dll
[%PROFILE_TEMP%]\thi57dc.tmp\preinsmt.exe
[%PROFILE_TEMP%]\thi6046.tmp\twaintec.inf
[%PROFILE_TEMP%]\thi6399.tmp\mxtarget.dll
[%PROFILE_TEMP%]\thi6399.tmp\mxtarget.inf
[%PROFILE_TEMP%]\thi6513.tmp\twaintec.dll
[%PROFILE_TEMP%]\thi6513.tmp\twaintec.inf
[%PROFILE_TEMP%]\thi6592.tmp\mxtarget.dll
[%PROFILE_TEMP%]\thi6592.tmp\preinsmt.exe
[%PROFILE_TEMP%]\thi6688.tmp\twaintec.inf
[%PROFILE_TEMP%]\thi6de0.tmp\mxtarget.dll
[%PROFILE_TEMP%]\thi6de0.tmp\preinsmt.exe
[%PROFILE_TEMP%]\thi6ea2.tmp\preinstt.exe
[%PROFILE_TEMP%]\thi6ea2.tmp\twaintec.dll
[%PROFILE_TEMP%]\thi6ea2.tmp\twaintec.inf
[%PROFILE_TEMP%]\thi70.tmp\mxtarget.dll
[%PROFILE_TEMP%]\thi70.tmp\mxtarget.inf
[%PROFILE_TEMP%]\thi7063.tmp\mxtarget.dll
[%PROFILE_TEMP%]\thi7063.tmp\preinsmt.exe
[%PROFILE_TEMP%]\thi70b2.tmp\conflict.inf
[%PROFILE_TEMP%]\thi70d0.tmp\mxtarget.dll
[%PROFILE_TEMP%]\thi70d0.tmp\preinsmt.exe
[%PROFILE_TEMP%]\thi717a.tmp\mxtarget.dll
[%PROFILE_TEMP%]\thi717a.tmp\preinsmt.exe
[%PROFILE_TEMP%]\thi71ff.tmp\mxtarget.dll
[%PROFILE_TEMP%]\thi71ff.tmp\preinsmt.exe
[%PROFILE_TEMP%]\thi79a1.tmp\mxtarget.dll
[%PROFILE_TEMP%]\thi79a1.tmp\preinsmt.exe
[%PROFILE_TEMP%]\thi7caf.tmp\twaintec.dll
[%PROFILE_TEMP%]\thi7caf.tmp\twaintec.inf
[%PROFILE_TEMP%]\thi7d25.tmp\mxtarget.dll
[%PROFILE_TEMP%]\thi7d25.tmp\preinsmt.exe
[%PROFILE_TEMP%]\thi7fb1.tmp\mxtarget.dll
[%PROFILE_TEMP%]\thi7fb1.tmp\preinsmt.exe
[%PROFILE_TEMP%]\thi7fc9.tmp\twaintec.inf
[%PROFILE_TEMP%]\thi98a.tmp\twaintec.dll
[%PROFILE_TEMP%]\thi98a.tmp\twaintec.inf
[%PROFILE_TEMP%]\thia1d.tmp\mxtarget.dll
[%PROFILE_TEMP%]\thia1d.tmp\mxtarget.inf
[%PROFILE_TEMP%]\thia59.tmp\twaintec.inf
[%PROFILE_TEMP%]\thib58.tmp\twaintec.dll
[%PROFILE_TEMP%]\thib58.tmp\twaintec.inf
[%PROFILE_TEMP%]\thib6f.tmp\twaintec.dll
[%PROFILE_TEMP%]\thib6f.tmp\twaintec.inf
[%PROFILE_TEMP%]\thib74.tmp\mxtarget.dll
[%PROFILE_TEMP%]\thib74.tmp\preinsmt.exe
[%SYSTEM%]\mxtarget.dll
[%SYSTEM%]\twaintec.dll
[%SYSTEM%]\uduftm.exe
[%WINDOWS%]\biprep.exe
[%WINDOWS%]\cache371\b_371_0_1_585800.htm
[%WINDOWS%]\mxtarget.dll
[%WINDOWS%]\system\mxtarget.dll
[%WINDOWS%]\system\twaintec.dll
[%WINDOWS%]\temp\thi43e2.tmp\preinstt.exe
[%WINDOWS%]\temp\thi43e2.tmp\twaintec.inf
[%WINDOWS%]\temp\thi4487.tmp\preinstt.exe
[%WINDOWS%]\temp\thi4487.tmp\twaintec.inf
[%WINDOWS%]\temp\thi5a9c.tmp\preinstt.exe
[%WINDOWS%]\temp\thi5a9c.tmp\twaintec.inf
[%WINDOWS%]\temp\thi6026.tmp\twaintec.dll
[%WINDOWS%]\temp\thi72ea.tmp\preinstt.exe
[%WINDOWS%]\temp\thi72ea.tmp\twaintec.dll
[%WINDOWS%]\temp\thi72ea.tmp\twaintec.inf
[%WINDOWS%]\urls.bin
[%WINDOWS%]\vurls.bin
[%WINDOWS%]\wast2.exe
[%WINDOWS%]\xgn.exe
[%PROFILE_TEMP%]\twtini.inf
[%PROFILE_TEMP%]\bi.ini
[%PROFILE_TEMP%]\THI223E.tmp\preInsTT.exe
[%PROFILE_TEMP%]\THI223E.tmp\twaintec.cab
[%PROFILE_TEMP%]\THI223E.tmp\twaintec.dll
[%PROFILE_TEMP%]\THI223E.tmp\twaintec.inf
[%PROFILE_TEMP%]\THI2738.tmp\twaintec.dll
[%PROFILE_TEMP%]\THI369D.tmp\twaintec.inf
[%PROFILE_TEMP%]\THI3896.tmp\twaintec.inf
[%PROFILE_TEMP%]\THI3E25.tmp\twaintec.dll
[%PROFILE_TEMP%]\THI417E.tmp\twaintec.inf
[%PROFILE_TEMP%]\THI52F3.tmp\twaintec.inf
[%PROFILE_TEMP%]\THI5CAB.tmp\twaintec.inf
[%PROFILE_TEMP%]\THI62BF.tmp\preInsTT.exe
[%PROFILE_TEMP%]\THI62BF.tmp\twaintec.dll
[%PROFILE_TEMP%]\THI6A6D.tmp\twaintec.inf
[%PROFILE_TEMP%]\THI6C63.tmp\twaintec.inf
[%PROFILE_TEMP%]\THI76C2.tmp\twaintec.inf
[%PROFILE_TEMP%]\THI7817.tmp\twaintec.inf
[%PROFILE_TEMP%]\THI842.tmp\mxTarget.dll
[%PROFILE_TEMP%]\twaintec.ini
[%PROFILE_TEMP%]\twtini.cab
[%WINDOWS%]\bi.ini
[%WINDOWS%]\Biprep.exe
[%WINDOWS%]\ft1_01_0_279_gepfah.exe
[%WINDOWS%]\inf\twtini.inf
[%WINDOWS%]\msview.ini
[%WINDOWS%]\multimpp.dll
[%WINDOWS%]\mxtarget.ini
[%WINDOWS%]\preInsTT.exe
[%WINDOWS%]\preInsTT.exe_
[%WINDOWS%]\smdat32a.sys
[%WINDOWS%]\smdat32m.sys
[%WINDOWS%]\twaintec.ini
[%WINDOWS%]\wsem218.dll
[%PROFILE%]\locals~1\temp\twtini.inf
[%PROFILE_TEMP%]\mxtarget.dll
[%PROFILE_TEMP%]\oyyilj8kl.exe
[%PROFILE_TEMP%]\preinsmt.exe
[%PROFILE_TEMP%]\thi1206.tmp\mxtarget.dll
[%PROFILE_TEMP%]\thi1206.tmp\preinsmt.exe
[%PROFILE_TEMP%]\thi13ca.tmp\preinsmt.exe
[%PROFILE_TEMP%]\thi15e8.tmp\twaintec.dll
[%PROFILE_TEMP%]\thi15e8.tmp\twaintec.inf
[%PROFILE_TEMP%]\thi168d.tmp\preinstt.exe
[%PROFILE_TEMP%]\thi168d.tmp\twaintec.dll
[%PROFILE_TEMP%]\thi174f.tmp\twaintec.inf
[%PROFILE_TEMP%]\thi1832.tmp\twaintec.dll
[%PROFILE_TEMP%]\thi1832.tmp\twaintec.inf
[%PROFILE_TEMP%]\thi18b1.tmp\mxtarget.dll
[%PROFILE_TEMP%]\thi18b1.tmp\preinsmt.exe
[%PROFILE_TEMP%]\thi19a6.tmp\mxtarget.dll
[%PROFILE_TEMP%]\thi19a6.tmp\preinsmt.exe
[%PROFILE_TEMP%]\thi1c5b.tmp\mxtarget.dll
[%PROFILE_TEMP%]\thi1c5b.tmp\preinsmt.exe
[%PROFILE_TEMP%]\thi1ff4.tmp\mxtarget.dll
[%PROFILE_TEMP%]\thi1ff4.tmp\preinsmt.exe
[%PROFILE_TEMP%]\thi205e.tmp\mxtarget.inf
[%PROFILE_TEMP%]\thi2096.tmp\mxtarget.dll
[%PROFILE_TEMP%]\thi2096.tmp\preinsmt.exe
[%PROFILE_TEMP%]\thi23a2.tmp\mxtarget.dll
[%PROFILE_TEMP%]\thi23a2.tmp\preinsmt.exe
[%PROFILE_TEMP%]\thi23f0.tmp\twaintec.dll
[%PROFILE_TEMP%]\thi23f0.tmp\twaintec.inf
[%PROFILE_TEMP%]\thi2dfe.tmp\mxtarget.dll
[%PROFILE_TEMP%]\thi2dfe.tmp\preinsmt.exe
[%PROFILE_TEMP%]\thi2eec.tmp\wsebate1.exe
[%PROFILE_TEMP%]\thi3687.tmp\mxtarget.dll
[%PROFILE_TEMP%]\thi3687.tmp\preinsmt.exe
[%PROFILE_TEMP%]\thi390d.tmp\twaintec.inf
[%PROFILE_TEMP%]\thi3a0.tmp\twaintec.dll
[%PROFILE_TEMP%]\thi3a0.tmp\twaintec.inf
[%PROFILE_TEMP%]\thi3c79.tmp\twaintec.inf
[%PROFILE_TEMP%]\thi4020.tmp\twaintec.dll
[%PROFILE_TEMP%]\thi4020.tmp\twaintec.inf
[%PROFILE_TEMP%]\thi406.tmp\twaintec.dll
[%PROFILE_TEMP%]\thi406.tmp\twaintec.inf
[%PROFILE_TEMP%]\thi40a8.tmp\preinstt.exe
[%PROFILE_TEMP%]\thi40a8.tmp\twaintec.dll
[%PROFILE_TEMP%]\thi43de.tmp\mxtarget.dll
[%PROFILE_TEMP%]\thi43de.tmp\preinsmt.exe
[%PROFILE_TEMP%]\thi45ff.tmp\mxtarget.dll
[%PROFILE_TEMP%]\thi45ff.tmp\preinsmt.exe
[%PROFILE_TEMP%]\thi4ceb.tmp\twaintec.dll
[%PROFILE_TEMP%]\thi4ceb.tmp\twaintec.inf
[%PROFILE_TEMP%]\thi4d5b.tmp\mxtarget.dll
[%PROFILE_TEMP%]\thi4d5b.tmp\preinsmt.exe
[%PROFILE_TEMP%]\thi4e88.tmp\twaintec.dll
[%PROFILE_TEMP%]\thi4e88.tmp\twaintec.inf
[%PROFILE_TEMP%]\thi5213.tmp\mxtarget.dll
[%PROFILE_TEMP%]\thi5213.tmp\preinsmt.exe
[%PROFILE_TEMP%]\thi53de.tmp\mxtarget.dll
[%PROFILE_TEMP%]\thi53de.tmp\preinsmt.exe
[%PROFILE_TEMP%]\thi5755.tmp\twaintec.dll
[%PROFILE_TEMP%]\thi5755.tmp\twaintec.inf
[%PROFILE_TEMP%]\thi57dc.tmp\mxtarget.dll
[%PROFILE_TEMP%]\thi57dc.tmp\preinsmt.exe
[%PROFILE_TEMP%]\thi6046.tmp\twaintec.inf
[%PROFILE_TEMP%]\thi6399.tmp\mxtarget.dll
[%PROFILE_TEMP%]\thi6399.tmp\mxtarget.inf
[%PROFILE_TEMP%]\thi6513.tmp\twaintec.dll
[%PROFILE_TEMP%]\thi6513.tmp\twaintec.inf
[%PROFILE_TEMP%]\thi6592.tmp\mxtarget.dll
[%PROFILE_TEMP%]\thi6592.tmp\preinsmt.exe
[%PROFILE_TEMP%]\thi6688.tmp\twaintec.inf
[%PROFILE_TEMP%]\thi6de0.tmp\mxtarget.dll
[%PROFILE_TEMP%]\thi6de0.tmp\preinsmt.exe
[%PROFILE_TEMP%]\thi6ea2.tmp\preinstt.exe
[%PROFILE_TEMP%]\thi6ea2.tmp\twaintec.dll
[%PROFILE_TEMP%]\thi6ea2.tmp\twaintec.inf
[%PROFILE_TEMP%]\thi70.tmp\mxtarget.dll
[%PROFILE_TEMP%]\thi70.tmp\mxtarget.inf
[%PROFILE_TEMP%]\thi7063.tmp\mxtarget.dll
[%PROFILE_TEMP%]\thi7063.tmp\preinsmt.exe
[%PROFILE_TEMP%]\thi70b2.tmp\conflict.inf
[%PROFILE_TEMP%]\thi70d0.tmp\mxtarget.dll
[%PROFILE_TEMP%]\thi70d0.tmp\preinsmt.exe
[%PROFILE_TEMP%]\thi717a.tmp\mxtarget.dll
[%PROFILE_TEMP%]\thi717a.tmp\preinsmt.exe
[%PROFILE_TEMP%]\thi71ff.tmp\mxtarget.dll
[%PROFILE_TEMP%]\thi71ff.tmp\preinsmt.exe
[%PROFILE_TEMP%]\thi79a1.tmp\mxtarget.dll
[%PROFILE_TEMP%]\thi79a1.tmp\preinsmt.exe
[%PROFILE_TEMP%]\thi7caf.tmp\twaintec.dll
[%PROFILE_TEMP%]\thi7caf.tmp\twaintec.inf
[%PROFILE_TEMP%]\thi7d25.tmp\mxtarget.dll
[%PROFILE_TEMP%]\thi7d25.tmp\preinsmt.exe
[%PROFILE_TEMP%]\thi7fb1.tmp\mxtarget.dll
[%PROFILE_TEMP%]\thi7fb1.tmp\preinsmt.exe
[%PROFILE_TEMP%]\thi7fc9.tmp\twaintec.inf
[%PROFILE_TEMP%]\thi98a.tmp\twaintec.dll
[%PROFILE_TEMP%]\thi98a.tmp\twaintec.inf
[%PROFILE_TEMP%]\thia1d.tmp\mxtarget.dll
[%PROFILE_TEMP%]\thia1d.tmp\mxtarget.inf
[%PROFILE_TEMP%]\thia59.tmp\twaintec.inf
[%PROFILE_TEMP%]\thib58.tmp\twaintec.dll
[%PROFILE_TEMP%]\thib58.tmp\twaintec.inf
[%PROFILE_TEMP%]\thib6f.tmp\twaintec.dll
[%PROFILE_TEMP%]\thib6f.tmp\twaintec.inf
[%PROFILE_TEMP%]\thib74.tmp\mxtarget.dll
[%PROFILE_TEMP%]\thib74.tmp\preinsmt.exe
[%SYSTEM%]\mxtarget.dll
[%SYSTEM%]\twaintec.dll
[%SYSTEM%]\uduftm.exe
[%WINDOWS%]\biprep.exe
[%WINDOWS%]\cache371\b_371_0_1_585800.htm
[%WINDOWS%]\mxtarget.dll
[%WINDOWS%]\system\mxtarget.dll
[%WINDOWS%]\system\twaintec.dll
[%WINDOWS%]\temp\thi43e2.tmp\preinstt.exe
[%WINDOWS%]\temp\thi43e2.tmp\twaintec.inf
[%WINDOWS%]\temp\thi4487.tmp\preinstt.exe
[%WINDOWS%]\temp\thi4487.tmp\twaintec.inf
[%WINDOWS%]\temp\thi5a9c.tmp\preinstt.exe
[%WINDOWS%]\temp\thi5a9c.tmp\twaintec.inf
[%WINDOWS%]\temp\thi6026.tmp\twaintec.dll
[%WINDOWS%]\temp\thi72ea.tmp\preinstt.exe
[%WINDOWS%]\temp\thi72ea.tmp\twaintec.dll
[%WINDOWS%]\temp\thi72ea.tmp\twaintec.inf
[%WINDOWS%]\urls.bin
[%WINDOWS%]\vurls.bin
[%WINDOWS%]\wast2.exe
[%WINDOWS%]\xgn.exe

Registry Keys:
HKEY_CLASSES_ROOT\CLSID\{000020DD-C72E-4113-AF77-DD56626C6C42}
HKEY_CLASSES_ROOT\interface\{5326b223-dc21-43a4-9b79-635e2d18dcb2}
HKEY_CLASSES_ROOT\twaintecdll.twaintecdllobj
HKEY_CLASSES_ROOT\twaintecdll.twaintecdllobj.1
HKEY_LOCAL_MACHINE\software\classes\clsid\{000020dd-c72e-4113-af77-dd56626c6c42}
HKEY_LOCAL_MACHINE\software\classes\clsid\{386a771c-e96a-421f-8ba7-32f1b706892f}
HKEY_LOCAL_MACHINE\software\classes\twaintecdll.twaintecdllobj.1
HKEY_LOCAL_MACHINE\software\classes\typelib\{72892e8e-75df-4cd2-be11-e9a0077f44a8}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{000020DD-C72E-4113-AF77-DD56626C6C42}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\twaintec
HKEY_CLASSES_ROOT\clsid\{000020dd-c72e-4113-af77-dd56626c6c42}
HKEY_CLASSES_ROOT\software\microsoft\windows\currentversion\explorer\browser helper objects\{000020dd-c72e-4113-af77-dd56626c6c42}
HKEY_CLASSES_ROOT\software\microsoft\windows\currentversion\explorer\browser helper objects\{0000607d-d204-42c7-8e46-216055bf9918}
HKEY_LOCAL_MACHINE\software\classes\clsid\{0000607d-d204-42c7-8e46-216055bf9918}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{000020dd-c72e-4113-af77-dd56626c6c42}

Registry Values:
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run
HKEY_LOCAL_MACHINE\system\lastknowngoodrecovery\lastgood
HKEY_LOCAL_MACHINE\system\lastknowngoodrecovery\lastgood
HKEY_LOCAL_MACHINE\system\lastknowngoodrecovery\lastgood
HKEY_LOCAL_MACHINE\system\lastknowngoodrecovery\lastgood
HKEY_LOCAL_MACHINE\system\lastknowngoodrecovery\lastgood
HKEY_LOCAL_MACHINE\system\lastknowngoodrecovery\lastgood

---

You must clean you computer ASAP !!!
Download Free Trial Version of antivirus software here, to check your computer instantly.

---

Also Be Aware of the Following Threats:
Vxidl.AKK Trojan Information

Sasser.B Worm

How To Remove Sasser.B?
You must download trial version of "Exterminate-It" antivirus software,to check your computer instantly.

---

Sasser.B is dangerous virus:
Many of the worms which managed to cause significant outbreaks use more then
one propagation method as well as more than one infection technique.

---

---

Sasser.B Symptoms:

Files:
[%WINDOWS%]\avserve2.exe
[%WINDOWS%]\avserve2.exe

---

You must clean you computer ASAP !!!
Download Free Trial Version of antivirus software here, to check your computer instantly.

---

Also Be Aware of the Following Threats:
Gaxaph Adware Cleaner
Pigeon.AWJF Trojan Removal
Small.fl Trojan Cleaner
Progetto1 RAT Removal

ABetterInternet.Aurora Adware

How To Remove ABetterInternet.Aurora?
You must download trial version of "Exterminate-It" antivirus software,to check your computer instantly.

---

ABetterInternet.Aurora is dangerous virus:
Adware are programs that facilitate delivery for advertising content
to the user and in some cases gather information from the user's computer.

---

---

ABetterInternet.Aurora Symptoms:

Files:
[%PROFILE_TEMP%]\ARZ\aurareco.exe
[%PROFILE_TEMP%]\EAA\aurareco.exe
[%PROFILE_TEMP%]\HDS\aurareco.exe
[%PROFILE_TEMP%]\LGT\aurareco.exe
[%PROFILE_TEMP%]\VRO\aurareco.exe
[%PROFILE_TEMP%]\WXM\aurareco.exe
[%PROFILE_TEMP%]\ZJJ\aurareco.exe
[%WINDOWS%]\10-47488c40c3cddfee98fc3b173f6d7beb.exe
[%WINDOWS%]\Nail.exe
[%WINDOWS%]\nail.exe
[%WINDOWS%]\oezjlo.exe
[%PROFILE_TEMP%]\ARZ\aurareco.exe
[%PROFILE_TEMP%]\EAA\aurareco.exe
[%PROFILE_TEMP%]\HDS\aurareco.exe
[%PROFILE_TEMP%]\LGT\aurareco.exe
[%PROFILE_TEMP%]\VRO\aurareco.exe
[%PROFILE_TEMP%]\WXM\aurareco.exe
[%PROFILE_TEMP%]\ZJJ\aurareco.exe
[%WINDOWS%]\10-47488c40c3cddfee98fc3b173f6d7beb.exe
[%WINDOWS%]\Nail.exe
[%WINDOWS%]\nail.exe
[%WINDOWS%]\oezjlo.exe

Registry Keys:
HKEY_CLASSES_ROOT\aurorahandlerdll.aurorahandlerdllobj
HKEY_CLASSES_ROOT\typelib\{6d992911-b563-47fc-ab29-437f42d1c729}\1.1
HKEY_CURRENT_USER\software\aurora
HKEY_CURRENT_USER\software\aurorahandler
HKEY_CLASSES_ROOT\clsid\{4aa870ac-8427-42a4-b92e-ecd956197489}

Registry Values:
HKEY_CLASSES_ROOT\interface\{544b6a3f-4024-4403-9661-69b8410be505}

---

You must clean you computer ASAP !!!
Download Free Trial Version of antivirus software here, to check your computer instantly.

---

Also Be Aware of the Following Threats:
Pigeon.AKZ Trojan Cleaner
Removing ItAdEm Trojan
TrojanDownloader.Win32.Swizzor.bn Trojan Symptoms

InCommand.7b2 Backdoor

How To Remove InCommand.7b2?
You must download trial version of "Exterminate-It" antivirus software,to check your computer instantly.

---

InCommand.7b2 is dangerous virus:
Backdoors are used by virus writers to detect and download confidential information,
execute malicious code, destroy data, include the machine in bot networks and so forth.

Many trojans and backdoors now have remote administration capabilities
allowing an individual to control the victim's computer.
Many times a file called the server must be opened on the victim's computer before
the trojan can have access to it.

These are generally sent through email, P2P file sharing software,
and in internet downloads. They are usually disguised as a legitimate program or file.
Many server files will display a fake error message when opened, to make it seem like it didn't open.
Some will also kill antivirus and firewall software.

---

---

InCommand.7b2 It also known as:

[Kaspersky]Backdoor.InCommander.17.b;
[Panda]Backdoor Program,Backdoor Program.LC,Bck/Infector.20;
[Computer Associates]Backdoor/InCommand_Server_family,Backdoor/Incommander.1_2,Win32.InCommand.17.B

---

InCommand.7b2 Symptoms:

Files:
[%WINDOWS%]\incsrv.exe
[%WINDOWS%]\incsrv.exe

---

You must clean you computer ASAP !!!
Download Free Trial Version of antivirus software here, to check your computer instantly.

---

Also Be Aware of the Following Threats:
Removing Windows.Remote RAT
Adware.DirectIP Adware Removal
Mmviewer Adware Cleaner

SafeStrip Ransomware

How To Remove SafeStrip?
You must download trial version of "Exterminate-It" antivirus software,to check your computer instantly.

---

SafeStrip is dangerous virus:
The term ransomware is commonly used to describe such software,
although the field known as cryptovirology predates the term "ransomware".

This type of ransom attack can be accomplished by (for example) attaching
a specially crafted file/program to an e-mail message and sending this to the victim.

---

---

SafeStrip Symptoms:

Files:
[%APPDATA%]\Microsoft\Internet Explorer\Quick Launch\SafeStrip.lnk
[%DESKTOP%]\SafeStrip.lnk
[%APPDATA%]\Microsoft\Internet Explorer\Quick Launch\SafeStrip.lnk
[%DESKTOP%]\SafeStrip.lnk

Folders:
[%PROGRAM_FILES%]\SafeStrip
[%COMMON_PROGRAMS%]\SafeStrip

Registry Keys:
HKEY_CURRENT_USER\software\safestrip
HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\legacy_safestripfilter
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\safestripfilter
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\safestrip_is1

Registry Values:
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run
HKEY_CURRENT_USER\software\microsoft\windows\shellnoroam\muicache
HKEY_CURRENT_USER\software\microsoft\windows\shellnoroam\muicache

---

You must clean you computer ASAP !!!
Download Free Trial Version of antivirus software here, to check your computer instantly.

---

Also Be Aware of the Following Threats:
Removing FDoS.Ras Trojan
BackDoor.CCT Backdoor Information

Keyboard.Spectator.Pro Spyware

How To Remove Keyboard.Spectator.Pro?
You must download trial version of "Exterminate-It" antivirus software,to check your computer instantly.

---

Keyboard.Spectator.Pro is dangerous virus:
Spyware can even change computer settings, resulting in slow connection speeds,
different home pages, and loss of Internet or other programs.
In an attempt to increase the understanding of spyware, a more formal classification
of its included software types is captured under the term privacy-invasive software.

---

---

Keyboard.Spectator.Pro Symptoms:

Files:
[%DESKTOP%]\keyboard spectator pro.lnk
[%PROFILE%]\administrator\start menu\programs\keyboard spectator pro\buy online!.lnk
[%PROFILE%]\administrator\start menu\programs\keyboard spectator pro\keyboard spectator pro help.lnk
[%PROFILE%]\administrator\start menu\programs\keyboard spectator pro\keyboard spectator pro.lnk
[%PROFILE%]\administrator\start menu\programs\keyboard spectator pro\uninstall.lnk
[%PROFILE%]\administrator\start menu\programs\keyboard spectator pro\visit homepage.lnk
[%DESKTOP%]\keyboard spectator pro.lnk
[%PROFILE%]\administrator\start menu\programs\keyboard spectator pro\buy online!.lnk
[%PROFILE%]\administrator\start menu\programs\keyboard spectator pro\keyboard spectator pro help.lnk
[%PROFILE%]\administrator\start menu\programs\keyboard spectator pro\keyboard spectator pro.lnk
[%PROFILE%]\administrator\start menu\programs\keyboard spectator pro\uninstall.lnk
[%PROFILE%]\administrator\start menu\programs\keyboard spectator pro\visit homepage.lnk

Folders:
[%PROFILE%]\start menu\programs\keyboard spectator pro
[%PROGRAM_FILES%]\keyboard spectator pro

Registry Keys:
HKEY_CURRENT_USER\software\refog software\keyboard spectator pro
HKEY_LOCAL_MACHINE\software\refog software\keyboard spectator pro
HKEY_CLASSES_ROOT\clsid\{ee5529ca-c052-4604-5286-e44669146c95}
HKEY_CLASSES_ROOT\typelib\{498701f1-9d1a-56ce-1125-9bb25636cfaa}
HKEY_LOCAL_MACHINE\software\classes\clsid\{ee5529ca-c052-4604-5286-e44669146c95}

Registry Values:
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\keyboard spectator pro
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\keyboard spectator pro
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\keyboard spectator pro
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\keyboard spectator pro
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\keyboard spectator pro
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\keyboard spectator pro
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\keyboard spectator pro
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\keyboard spectator pro
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\keyboard spectator pro

---

You must clean you computer ASAP !!!
Download Free Trial Version of antivirus software here, to check your computer instantly.

---

Also Be Aware of the Following Threats:
Bancos.GLR Trojan Removal instruction

PeopleOnPage.Apropos BHO

How To Remove PeopleOnPage.Apropos?
You must download trial version of "Exterminate-It" antivirus software,to check your computer instantly.

---

PeopleOnPage.Apropos is dangerous virus:
The BHO (Browser Helper Object) waits for the user to post personal information to a monitored website.
As this information is entered by the user, it is captured by the BHO and sent back to the attacker.
Hijackers take control of various parts of your web browser, including your home page,
search pages, and search bar. They may also redirect you to certain sites should you
mistype an address or prevent you from going to a website they would rather you not,
such as sites that combat malware. Some will even redirect you to their own search engine
when you attempt a search.

---

---

PeopleOnPage.Apropos Symptoms:

Files:
[%PROFILE_TEMP%]\cxtpls_loader.exe
[%PROGRAM_FILES%]\Aprps\libexpat.dll
[%SYSTEM%]\cicmp13n.exe
[%SYSTEM%]\cnekpart.exe
[%SYSTEM%]\subup.exe
[%SYSTEM%]\wmvi32.exe
[%WINDOWS%]\downloaded program files\pop.inf
[%PROFILE%]\apropos_client_loader.exe
[%PROFILE_TEMP%]\wk_122.exe
[%PROFILE_TEMP%]\wk_123.exe
[%PROFILE_TEMP%]\wk_12a.exe
[%PROFILE_TEMP%]\wk_12b.exe
[%PROFILE_TEMP%]\wk_12d.exe
[%PROFILE_TEMP%]\wk_13a.exe
[%PROFILE_TEMP%]\wk_395.exe
[%PROFILE_TEMP%]\~compoundinst0\auto_update_loader.exe
[%SYSTEM%]\internetfeatures.exe
[%SYSTEM%]\ulioci.exe
[%WINDOWS%]\downloaded program files\monpop.exe
[%WINDOWS%]\downloaded program files\mybutton.swf
[%WINDOWS%]\downloaded program files\pop225.dll
[%WINDOWS%]\downloaded program files\pophook4.dll
[%WINDOWS%]\downloaded program files\popsrv225.exe
[%PROFILE_TEMP%]\cxtpls_loader.exe
[%PROGRAM_FILES%]\Aprps\libexpat.dll
[%SYSTEM%]\cicmp13n.exe
[%SYSTEM%]\cnekpart.exe
[%SYSTEM%]\subup.exe
[%SYSTEM%]\wmvi32.exe
[%WINDOWS%]\downloaded program files\pop.inf
[%PROFILE%]\apropos_client_loader.exe
[%PROFILE_TEMP%]\wk_122.exe
[%PROFILE_TEMP%]\wk_123.exe
[%PROFILE_TEMP%]\wk_12a.exe
[%PROFILE_TEMP%]\wk_12b.exe
[%PROFILE_TEMP%]\wk_12d.exe
[%PROFILE_TEMP%]\wk_13a.exe
[%PROFILE_TEMP%]\wk_395.exe
[%PROFILE_TEMP%]\~compoundinst0\auto_update_loader.exe
[%SYSTEM%]\internetfeatures.exe
[%SYSTEM%]\ulioci.exe
[%WINDOWS%]\downloaded program files\monpop.exe
[%WINDOWS%]\downloaded program files\mybutton.swf
[%WINDOWS%]\downloaded program files\pop225.dll
[%WINDOWS%]\downloaded program files\pophook4.dll
[%WINDOWS%]\downloaded program files\popsrv225.exe

Folders:
[%PROFILE_TEMP%]\autoupdate0
[%PROGRAM_FILES%]\aprps
[%PROGRAM_FILES%]\cxtpls
[%APPDATA%]\pop!
[%PROGRAM_FILES%]\aproposclient

Registry Keys:
HKEY_CLASSES_ROOT\CLSID\{016235BE-59D4-4CEB-ADD5-E2378282A1D9}
HKEY_CLASSES_ROOT\CLSID\{B5AB638F-D76C-415B-A8F2-F3CEAC502212}
HKEY_CLASSES_ROOT\CLSID\{BC333116-6EA1-40A1-9D07-ECB192DB8CEA}
HKEY_CLASSES_ROOT\interface\{a1558b18-f76c-40fe-b358-9e47449f3cfe}
HKEY_CLASSES_ROOT\interface\{a2872b10-39f2-42df-9335-7dd38cf75255}
HKEY_CLASSES_ROOT\interface\{a7d0472e-c1fc-4d8f-aba1-98a7692561bf}
HKEY_CLASSES_ROOT\Interface\{BC333116-6EA1-40A1-9D07-ECB192DB8CEA}
HKEY_CURRENT_USER\software\apropos
HKEY_LOCAL_MACHINE\software\aprps
HKEY_LOCAL_MACHINE\Software\AutoLoader
HKEY_LOCAL_MACHINE\SOFTWARE\Envolo
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{016235BE-59D4-4CEB-ADD5-E2378282A1D9}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AproposClient
HKEY_CLASSES_ROOT\apropos.client
HKEY_CLASSES_ROOT\apropos.client.1.1
HKEY_CLASSES_ROOT\clsid\{016235be-59d4-4ceb-add5-e2378282a1d9}
HKEY_CLASSES_ROOT\clsid\{645fd3bc-c314-4f7a-9d2e-64d62a0fdd78}
HKEY_CLASSES_ROOT\clsid\{65c8c1f5-230e-4dc9-9a0d-f3159a5e7778}
HKEY_CLASSES_ROOT\clsid\{8023a3e7-ab95-4c23-8313-0be9842cc70e}
HKEY_CLASSES_ROOT\clsid\{976c4e11-b9c5-4b2b-97ef-f7d06ba4242f}
HKEY_CLASSES_ROOT\clsid\{a2872b10-39f2-42df-9335-7dd38cf75255}
HKEY_CLASSES_ROOT\clsid\{a4a58a2c-b039-432b-8bc1-dca7ac0757dc}
HKEY_CLASSES_ROOT\clsid\{b5ab638f-d76c-415b-a8f2-f3ceac502212}
HKEY_CLASSES_ROOT\clsid\{bc333116-6ea1-40a1-9d07-ecb192db8cea}
HKEY_CLASSES_ROOT\clsid\{d5580d6f-0e5f-4bdb-9cdf-f8ee68beb008}
HKEY_CLASSES_ROOT\interface\{bc333116-6ea1-40a1-9d07-ecb192db8cea}
HKEY_CLASSES_ROOT\pop.server
HKEY_CLASSES_ROOT\pop.server.1
HKEY_CURRENT_USER\software\pop
HKEY_LOCAL_MACHINE\software\apropos
HKEY_LOCAL_MACHINE\software\autoloader
HKEY_LOCAL_MACHINE\software\classes\apropos.client
HKEY_LOCAL_MACHINE\software\classes\apropos.client.1.1
HKEY_LOCAL_MACHINE\software\classes\pop.server\clsid
HKEY_LOCAL_MACHINE\software\classes\pop.server\curver
HKEY_LOCAL_MACHINE\software\cvttsacsmv39
HKEY_LOCAL_MACHINE\software\envolo
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{d5580d6f-0e5f-4bdb-9cdf-f8ee68beb008}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{016235be-59d4-4ceb-add5-e2378282a1d9}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\moduleusage\[%WINDOWS%]\downloaded program files\aprload.bin
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\moduleusage\[%WINDOWS%]\downloaded program files\load.exe
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\moduleusage\[%WINDOWS%]\downloaded program files\pop225.dll
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\moduleusage\[%WINDOWS%]\downloaded program files\pophook4.dll
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\moduleusage\[%WINDOWS%]\downloaded program files\popsrv225.exe
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\aproposclient
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\pop
HKEY_LOCAL_MACHINE\software\pop
HKEY_USERS\.default\software\microsoft\windows\currentversion\internet settings\zonemap\domains\apropos-media.com

Registry Values:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_CLASSES_ROOT\clsid
HKEY_CURRENT_USER\clsid
HKEY_CURRENT_USER\software\classes\clsid
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app management\arpcache\pop
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app management\arpcache\pop
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\moduleusage\[%WINDOWS%]/downloaded program files/monpop.exe
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\moduleusage\[%WINDOWS%]/downloaded program files/monpop.exe
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\moduleusage\[%WINDOWS%]/downloaded program files/pop225.dll
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\moduleusage\[%WINDOWS%]/downloaded program files/pop225.dll
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\moduleusage\[%WINDOWS%]/downloaded program files/pophook4.dll
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\moduleusage\[%WINDOWS%]/downloaded program files/pophook4.dll
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\moduleusage\[%WINDOWS%]/downloaded program files/popsrv225.exe
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\moduleusage\[%WINDOWS%]/downloaded program files/popsrv225.exe
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shareddlls
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shareddlls
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shareddlls
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shareddlls
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shareddlls

---

You must clean you computer ASAP !!!
Download Free Trial Version of antivirus software here, to check your computer instantly.

---

Also Be Aware of the Following Threats:
SillyDl.CZL Trojan Cleaner
ClickSpring.PurityScan Adware Cleaner
BO2K.Server Trojan Information
PSW.Delf.cf Trojan Symptoms

Softomate Adware

How To Remove Softomate?
You must download trial version of "Exterminate-It" antivirus software,to check your computer instantly.

---

Softomate is dangerous virus:
Adware are programs that facilitate delivery for advertising content
to the user and in some cases gather information from the user's computer.

Toolbar presents itself as a helpful add-on for Internet Explorer but it is a real pest.
It replaces your start page, continuosly open a number of pop up windows and so on.

---

---

Softomate It also known as:

[Kaspersky]AdWare.Win32.Softomate.y,AdWare.Win32.Softomate.p;
[F-Prot]W32/Adware.JUS;
[Other]Adware.Kuaiso,Adware.Softomate

---

Softomate Symptoms:

Files:
[%PROFILE_TEMP%]\b116.exe
[%PROGRAM_FILES%]\DosPop Toolbar\dospop.dll
[%PROGRAM_FILES%]\Win Stream plugin\tbu05354\win_stream_plugin.dll
[%PROGRAM_FILES%]\Win Stream plugin\win_stream_plugin.dll
[%SYSTEM%]\Search\tbu02653\wizard.dll
[%SYSTEM%]\Search\wizard.dll
[%PROFILE_TEMP%]\b116.exe
[%PROGRAM_FILES%]\DosPop Toolbar\dospop.dll
[%PROGRAM_FILES%]\Win Stream plugin\tbu05354\win_stream_plugin.dll
[%PROGRAM_FILES%]\Win Stream plugin\win_stream_plugin.dll
[%SYSTEM%]\Search\tbu02653\wizard.dll
[%SYSTEM%]\Search\wizard.dll

Folders:
[%PROGRAM_FILES%]\kuaiso

Registry Keys:
HKEY_CLASSES_ROOT\clsid\{031f120a-bbaf-45d8-b306-375f2a6b9398}
HKEY_CLASSES_ROOT\clsid\{1ce4ee89-2d5c-4361-af3b-d902ab545381}
HKEY_CLASSES_ROOT\clsid\{ca3eb689-8f09-4026-aa10-b9534c691ce0}
HKEY_CLASSES_ROOT\interface\{4897bba6-48d9-468c-8efa-846275d7701b}
HKEY_CLASSES_ROOT\interface\{9ebb289a-2d7b-465b-825f-1530b813e95a}
HKEY_CLASSES_ROOT\interface\{cd5c92ae-97b0-4bc3-ba65-ba0308d543bf}
HKEY_CLASSES_ROOT\toolband.xbtp05231
HKEY_CLASSES_ROOT\toolband.xbtp05231.1
HKEY_CLASSES_ROOT\toolbar3.xbtbpos00
HKEY_CLASSES_ROOT\toolbar3.xbtbpos00.1
HKEY_CLASSES_ROOT\typelib\{4509d3cc-b642-4745-b030-645b79522c6d}
HKEY_CLASSES_ROOT\typelib\{70bb6404-eb9e-4ab5-9bb2-bd9376304521}
HKEY_CLASSES_ROOT\urlsearchhook.toolbarurlsearchhook
HKEY_CLASSES_ROOT\urlsearchhook.toolbarurlsearchhook.1
HKEY_CLASSES_ROOT\xbtb05231.ietoolbar
HKEY_CLASSES_ROOT\xbtb05231.ietoolbar.1
HKEY_CLASSES_ROOT\xbtb05231.xbtb05231
HKEY_CLASSES_ROOT\xbtb05231.xbtb05231.1
HKEY_CURRENT_USER\software\xbtb05231
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{031f120a-bbaf-45d8-b306-375f2a6b9398}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\xbtb05231.xbtb05231too23423lbar
HKEY_CLASSES_ROOT\CLSID\{BFB5F154-9212-46F3-B547-AC6106030A54}
HKEY_CLASSES_ROOT\clsid\{6d53adb7-6ad5-4a59-bfe4-7b57d2f4aa89}
HKEY_CLASSES_ROOT\clsid\{92f02779-6d88-4958-8ad3-83c12d86adc7}
HKEY_CLASSES_ROOT\clsid\{b52d0b62-0895-47f7-aec7-4d609aa83d08}
HKEY_CLASSES_ROOT\tbsb01425.ietoolbar
HKEY_CLASSES_ROOT\tbsb01425.ietoolbar.1
HKEY_CLASSES_ROOT\toolband.xbtp03129
HKEY_CLASSES_ROOT\toolband.xbtp03129.1
HKEY_CLASSES_ROOT\typelib\{38d87ffe-f20d-47ec-b1e8-885b5677bcba}
HKEY_CLASSES_ROOT\typelib\{3966157b-0703-4c7c-9053-f148ade82c45}
HKEY_CLASSES_ROOT\xbtb03129.ietoolbar
HKEY_CLASSES_ROOT\xbtb03129.ietoolbar.1
HKEY_CLASSES_ROOT\xbtb03129.xbtb03129
HKEY_CLASSES_ROOT\xbtb03129.xbtb03129.1
HKEY_CURRENT_USER\software\xbtb04474

Registry Values:
HKEY_CURRENT_USER\software\microsoft\internet explorer\toolbar\webbrowser
HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\toolbar
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar
HKEY_CURRENT_USER\software\microsoft\internet explorer\extensions\cmdmapping
HKEY_CURRENT_USER\software\microsoft\internet explorer\toolbar\shellbrowser
HKEY_CURRENT_USER\software\microsoft\internet explorer\toolbar\webbrowser
HKEY_CURRENT_USER\software\microsoft\internet explorer\toolbar\webbrowser
HKEY_CURRENT_USER\software\microsoft\internet explorer\toolbar\webbrowser
HKEY_CURRENT_USER\software\microsoft\internet explorer\toolbar\webbrowser
HKEY_CURRENT_USER\software\microsoft\internet explorer\toolbar\webbrowser
HKEY_CURRENT_USER\software\softomate\batoolbar
HKEY_CURRENT_USER\software\softomate\batoolbar
HKEY_CURRENT_USER\software\softomate\batoolbar
HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\extensions\{6d53adb7-6ad5-4a59-bfe4-7b57d2f4aa89}
HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\extensions\{6d53adb7-6ad5-4a59-bfe4-7b57d2f4aa89}
HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\extensions\{6d53adb7-6ad5-4a59-bfe4-7b57d2f4aa89}
HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\extensions\{6d53adb7-6ad5-4a59-bfe4-7b57d2f4aa89}
HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\extensions\{6d53adb7-6ad5-4a59-bfe4-7b57d2f4aa89}
HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\extensions\{6d53adb7-6ad5-4a59-bfe4-7b57d2f4aa89}
HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\extensions\{6d53adb7-6ad5-4a59-bfe4-7b57d2f4aa89}
HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\extensions\{6d53adb7-6ad5-4a59-bfe4-7b57d2f4aa89}
HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\toolbar
HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\toolbar
HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\toolbar
HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\toolbar
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\toolbarbesttoolbarstoolbar.toolbarbesttoolbarstoolbarobjectietoolbar
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\xbtb03129.xbtb03129too23423lbar
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\xbtb03129.xbtb03129too23423lbar

---

You must clean you computer ASAP !!!
Download Free Trial Version of antivirus software here, to check your computer instantly.

---

Also Be Aware of the Following Threats:
HidePE Trojan Removal instruction
REG.ShareC Trojan Removal instruction
Rosyba.Server Trojan Symptoms

XXXDial Adware

How To Remove XXXDial?
You must download trial version of "Exterminate-It" antivirus software,to check your computer instantly.

---

XXXDial is dangerous virus:
Adware are programs that facilitate delivery for advertising content
to the user and in some cases gather information from the user's computer.

---

---

XXXDial Symptoms:

Files:
[%DESKTOP%]\sexpass.lnk
[%PROFILE%]\start menu\sexpass.lnk
[%WINDOWS%]\sexpass.exe
[%DESKTOP%]\sexpass.lnk
[%PROFILE%]\start menu\sexpass.lnk
[%WINDOWS%]\sexpass.exe

---

You must clean you computer ASAP !!!
Download Free Trial Version of antivirus software here, to check your computer instantly.

---

Also Be Aware of the Following Threats:
APStrojan.ob Trojan Symptoms

Snavems Adware

How To Remove Snavems?
You must download trial version of "Exterminate-It" antivirus software,to check your computer instantly.

---

Snavems is dangerous virus:
Adware are programs that facilitate delivery for advertising content
to the user and in some cases gather information from the user's computer.

---

---

Snavems It also known as:

[Kaspersky]AdWare.Win32.Agent.bn;
[Other]Trojan.Adclicker

---

Snavems Symptoms:

Registry Keys:
HKEY_CLASSES_ROOT\CLSID\{366B2151-E1C7-44a3-86A3-E5686C2A3D2F}
HKEY_CLASSES_ROOT\interface\{967a494a-6aec-4555-9caf-fa6eb00acf91}
HKEY_CLASSES_ROOT\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}
HKEY_CLASSES_ROOT\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}
HKEY_CLASSES_ROOT\VPNS.VPNSApp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{366B2151-E1C7-44a3-86A3-E5686C2A3D2F}
HKEY_CLASSES_ROOT\clsid\{366b2151-e1c7-44a3-86a3-e5686c2a3d2f}
HKEY_CLASSES_ROOT\vpns.vpnsapp
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{366b2151-e1c7-44a3-86a3-e5686c2a3d2f}

---

You must clean you computer ASAP !!!
Download Free Trial Version of antivirus software here, to check your computer instantly.

---

Also Be Aware of the Following Threats:
Pigeon.EJH Trojan Symptoms
EVision.Megapro Spyware Symptoms