Monday, December 1, 2008

UKVideo2 Adware

How To Remove UKVideo2?
You must download trial version of "Exterminate-It" antivirus software,to check your computer instantly.
UKVideo2 is dangerous virus:
Adware are programs that facilitate delivery for advertising content
to the user and in some cases gather information from the user's computer,
including information related to Internet browser usage or other computer habits


UKVideo2 Symptoms:

Registry Keys:
HKEY_CURRENT_USER\software\siteicons
HKEY_LOCAL_MACHINE\software\siteicons

Registry Values:
HKEY_CURRENT_USER\software\comsoft


You must clean you computer ASAP !!!
Download Free Trial Version of antivirus software here, to check your computer instantly.

Also Be Aware of the Following Threats:
HUC.Tool DoS Symptoms
Delf Trojan Removal

VB.is Trojan

How To Remove VB.is?
You must download trial version of "Exterminate-It" antivirus software,to check your computer instantly.
VB.is is dangerous virus:
This category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.
Backdoors are the most dangerous type of Trojans and the most popular.
Backdoors open infected machines to external control via Internet.
They function in the same way as legal remote administration programs used by system administrators.
This makes them difficult to detect.

Backdoors are installed and launched without the consent of the user of computer.
Often the backdoor will not be visible in the log of active programs.

Once a backdoor has been successfully launched, the computer is wide open.
Backdoor functions can include:


  • Launching/ deleting files

  • Sending/ receiving files

  • Deleting data

  • Displaying notification

  • Rebooting the machine

  • Executing files




Backdoors are used by virus writers to detect and download confidential information,
execute malicious code, destroy data, include the machine in bot networks and so forth.
Backdoors combine the functionality of most other types of in one package.

Backdoors have one especially dangerous sub-class: variants that can propagate like worms.


VB.is It also known as:

[Kaspersky]Backdoor.VB.ls;
[Eset]Win32/VB.IS trojan,Win32/VB.LS trojan;
[Computer Associates]Win32/Happy.A.Trojan

VB.is Symptoms:

Files:
[%WINDOWS%]\pcevbb.dat
[%WINDOWS%]\v1201.exe
[%WINDOWS%]\pcevbb.dat
[%WINDOWS%]\v1201.exe

Registry Keys:
HKEY_LOCAL_MACHINE\software\microsoft\tadqww


You must clean you computer ASAP !!!
Download Free Trial Version of antivirus software here, to check your computer instantly.

Also Be Aware of the Following Threats:
Remove CWS.SmartSearch Hijacker
Win32.PSW.Yaher Trojan Information
Vundo (Virtumondo) Trojan Removal

SystemProcess Adware

How To Remove SystemProcess?
You must download trial version of "Exterminate-It" antivirus software,to check your computer instantly.
SystemProcess is dangerous virus:
Adware are programs that facilitate delivery for advertising content
to the user and in some cases gather information from the user's computer,
including information related to Internet browser usage or other computer habits


SystemProcess Symptoms:

Files:
[%PROFILE_TEMP%]\ustart.exe
[%PROGRAM_FILES%]\Give4Free Plugin\ustart.exe
[%SYSTEM%]\ccapp.exe
[%SYSTEM%]\navshext1.dll
[%SYSTEM%]\navshext2.dll
[%SYSTEM%]\ustart.exe
[%SYSTEM%]\~ustart.exe
[%PROFILE_TEMP%]\ustart.exe
[%PROGRAM_FILES%]\Give4Free Plugin\ustart.exe
[%SYSTEM%]\ccapp.exe
[%SYSTEM%]\navshext1.dll
[%SYSTEM%]\navshext2.dll
[%SYSTEM%]\ustart.exe
[%SYSTEM%]\~ustart.exe

Registry Keys:
HKEY_CLASSES_ROOT\clsid\{c2eeb4fa-b6d6-41b9-9cfa-aba87f862bcb}

Registry Values:
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\New Windows\Allow
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{c2eeb4fa-b6d6-41b9-9cfa-aba87f862bcb}
HKEY_CURRENT_USER\software\microsoft\internet explorer\new windows\allow
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{c2eeb4fa-b6d6-41b9-9cfa-aba87f862bcb}


You must clean you computer ASAP !!!
Download Free Trial Version of antivirus software here, to check your computer instantly.

Also Be Aware of the Following Threats:
Vgvpo.ANSI.Bomb Worm Removal instruction
PWS.Fib Trojan Symptoms

Popper Trojan

How To Remove Popper?
You must download trial version of "Exterminate-It" antivirus software,to check your computer instantly.
Popper is dangerous virus:
This category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.


Popper Symptoms:

Files:
[%WINDOWS%]\arqugeu.exe
[%WINDOWS%]\nqphygo.exe
[%WINDOWS%]\obxscfj.exe
[%WINDOWS%]\pgnxnzv.exe
[%WINDOWS%]\srycase.exe
[%WINDOWS%]\arqugeu.exe
[%WINDOWS%]\nqphygo.exe
[%WINDOWS%]\obxscfj.exe
[%WINDOWS%]\pgnxnzv.exe
[%WINDOWS%]\srycase.exe

Registry Keys:
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\windows overlay components


You must clean you computer ASAP !!!
Download Free Trial Version of antivirus software here, to check your computer instantly.

Also Be Aware of the Following Threats:
Remove SillyDl.CQH Trojan
Dailytoolbar Adware Removal
MalwareAlarm Ransomware Symptoms

FloodNet Trojan

How To Remove FloodNet?
You must download trial version of "Exterminate-It" antivirus software,to check your computer instantly.
FloodNet is dangerous virus:
This category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.
Many of the worms which managed to cause significant outbreaks use more then
one propagation method as well as more than one infection technique.

Backdoors are the most dangerous type of Trojans and the most popular.
Backdoors open infected machines to external control via Internet.
Often the backdoor will not be visible in the log of active programs.
Some RAT trojans are pranks that are most likely being controlled by a friend or enemy on
April Fool's day or a holiday. Prank RATS are generally not harmful, and won't log keystrokes or hack.

DoS trojans conduct attacks from a single computer with the consent of the user.
Trojans-downloaders downloads and installs new malware or adware on the computer.



FloodNet It also known as:

[Kaspersky]Backdoor.Flobo.a,Backdoor.Floodnet.b;
[Eset]Win32/Tendolf.A trojan,Win32/Tendolf.B trojan;
[Panda]Backdoor Program;
[Computer Associates]Backdoor/Flobo,Backdoor/Flobo.A!Server,Backdoor/Floodnet.b,Backdoor/Floodnet.B!Server,Win32.FloodNet.11,Win32/Cute.Worm,Win32.FloodNet.10,Win32/Tendoolf.Worm

FloodNet Symptoms:

Files:
[%WINDOWS%]\winform.exe
[%WINDOWS%]\winform.exe

Registry Values:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run


You must clean you computer ASAP !!!
Download Free Trial Version of antivirus software here, to check your computer instantly.

Also Be Aware of the Following Threats:
Remove Xtractor.Plus Adware
Zlob.Fam.PornPass Manager Trojan Removal instruction
Removing PcLog Trojan
Remove AI Trojan

EasyBar.Toolbarcash BHO

How To Remove EasyBar.Toolbarcash?
You must download trial version of "Exterminate-It" antivirus software,to check your computer instantly.
EasyBar.Toolbarcash is dangerous virus:
As this information is entered by the user, it is captured by the BHO (Browser Helper Object) and
sent back to the attacker.
Typically, keyloggers of this type will send the stolen information back to the attacker via email
or HTTP POST, which can appear suspicious.Toolbar presents itself as a helpful add-on for Internet Explorer but it is a real pest.
It replaces your start page, continuosly open a number of pop up windows and so on.


EasyBar.Toolbarcash Symptoms:

Files:
[%SYSTEM%]\toolbarstarter.dll
[%WINDOWS%]\system\toolbarstarter.dll
[%SYSTEM%]\toolbarstarter.dll
[%WINDOWS%]\system\toolbarstarter.dll

Registry Keys:
HKEY_CLASSES_ROOT\clsid\{c77e900a-ff55-400e-9baa-e042c8212898}
HKEY_CLASSES_ROOT\software\microsoft\windows\currentversion\explorer\browser helper objects\{c77e900a-ff55-400e-9baa-e042c8212898}
HKEY_LOCAL_MACHINE\software\classes\clsid\{c77e900a-ff55-400e-9baa-e042c8212898}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{c77e900a-ff55-400e-9baa-e042c8212898}


You must clean you computer ASAP !!!
Download Free Trial Version of antivirus software here, to check your computer instantly.

Also Be Aware of the Following Threats:
Removing IRC.Bun Trojan
Bancos.BNQ Trojan Cleaner
Remove Bancos.IPY Trojan
Home.Key.Logger Spyware Cleaner
Removing Harbag Trojan

QuickButton Trojan

How To Remove QuickButton?
You must download trial version of "Exterminate-It" antivirus software,to check your computer instantly.
QuickButton is dangerous virus:
This category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.
Adware are programs that facilitate delivery for advertising content
to the user and in some cases gather information from the user's computer.



QuickButton It also known as:

[Kaspersky]Adware.Win32.AdHelper.ay,AdWare.Win32.AdHelper.gen,Trojan-Dwonloader.Win32.QQHelper.gb,Trojan-Downloader.Win32.QQHelper.gen,AdWare.Win32.AdHelper.cz;
[McAfee]Generic Downloader.h,Backdoor-CVM;
[F-Prot]W32/Downloader.AAWI;
[Other]Infostealer,Backdoor.CVM,Trojan-Downloader.win32.QQHelper.ce,Win32/QQHelp.N,Adware.Adhelper,Win32/Sillydl.AHL,Win32/SillyDl.AHL,Win32/QQHelp.J,Win32/QQHelpBP,Downloader

QuickButton Symptoms:

Files:
[%PROGRAM_FILES_COMMON%]\System\Updaterun.exe
[%SYSTEM%]\advport.dll
[%SYSTEM%]\nt.sys
[%SYSTEM%]\Score.txt
[%SYSTEM%]\wbem\ocmor.dat
[%SYSTEM%]\wbem\ocmor.dll
[%PROGRAM_FILES%]\CoolWebsite\QuickLink.dll
[%PROGRAM_FILES%]\CoolWebsite\uninst.exe
[%SYSTEM%]\bind_40255.exe
[%SYSTEM%]\spted.dll
[%SYSTEM%]\wbem\IRJIT.dll
[%PROGRAM_FILES_COMMON%]\System\Updaterun.exe
[%SYSTEM%]\advport.dll
[%SYSTEM%]\nt.sys
[%SYSTEM%]\Score.txt
[%SYSTEM%]\wbem\ocmor.dat
[%SYSTEM%]\wbem\ocmor.dll
[%PROGRAM_FILES%]\CoolWebsite\QuickLink.dll
[%PROGRAM_FILES%]\CoolWebsite\uninst.exe
[%SYSTEM%]\bind_40255.exe
[%SYSTEM%]\spted.dll
[%SYSTEM%]\wbem\IRJIT.dll

Folders:
[%PROGRAM_FILES%]\coolsign
[%PROGRAM_FILES_COMMON%]\UPDAT

Registry Keys:
HKEY_CLASSES_ROOT\clsid\{d1bb7cf4-4463-4e91-88d7-ecc3ce0a13b7}
HKEY_CLASSES_ROOT\quickbutton.quickbtn
HKEY_CLASSES_ROOT\sss1.sss2.1
HKEY_CLASSES_ROOT\{d1bb7cf4-4463-4e91-88d7-ecc3ce0a13b7}
HKEY_LOCAL_MACHINE\software\divnet
HKEY_LOCAL_MACHINE\software\lamp
HKEY_LOCAL_MACHINE\software\microsoft\directoutput
HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\extensions\{1d901067-2529-4a9b-9b6b-7a1db3a44cb5}
HKEY_LOCAL_MACHINE\software\microsoft\studio
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\coolsign
HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\legacy_barcase
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\barcase
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\eventlog\application\barcase
HKEY_CLASSES_ROOT\interface\{0083de51-eb2e-4521-a95c-735d8e563373}
HKEY_CLASSES_ROOT\ssss1.ssss2.1
HKEY_CLASSES_ROOT\typelib\{933db9d6-9447-4efe-aba2-eaf3b309b44c}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{d1bb7cf4-4463-4e91-88d7-ecc3ce0a13b7}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\quicklink
HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\legacy_atwork
HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\legacy_dateing
HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\legacy_ipdodrg
HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\legacy_iunag
HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\legacy_soscar
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\atwork
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\dateing
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\eventlog\application\dateing
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\eventlog\application\soscar
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\ipdodrg
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\iunag
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\soscar

Registry Values:
HKEY_CURRENT_USER\software\microsoft\internet explorer\extensions\cmdmapping
HKEY_CURRENT_USER\software\microsoft\internet explorer\extensions\cmdmapping
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run
HKEY_CURRENT_USER\software\microsoft\internet explorer\extensions\cmdmapping
HKEY_CURRENT_USER\software\microsoft\internet explorer\typedurls
HKEY_CURRENT_USER\software\microsoft\internet explorer\typedurls
HKEY_CURRENT_USER\software\microsoft\internet explorer\typedurls
HKEY_CURRENT_USER\software\microsoft\internet explorer\typedurls
HKEY_CURRENT_USER\software\microsoft\internet explorer\typedurls
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\license\parameters
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\templates\parameters


You must clean you computer ASAP !!!
Download Free Trial Version of antivirus software here, to check your computer instantly.

Also Be Aware of the Following Threats:
Remove FDoS.Buwah DoS
Remove Msolob Ransomware

Digi.Watcher Spyware

How To Remove Digi.Watcher?
You must download trial version of "Exterminate-It" antivirus software,to check your computer instantly.
Digi.Watcher is dangerous virus:
Spyware can even change computer settings, resulting in slow connection speeds,
different home pages, and loss of Internet or other programs.
In an attempt to increase the understanding of spyware, a more formal classification
of its included software types is captured under the term privacy-invasive software.


Digi.Watcher Symptoms:

Folders:
[%PROGRAM_FILES%]\Digi-Watcher.com

Registry Keys:
HKEY_CLASSES_ROOT\.dgw
HKEY_CLASSES_ROOT\applications\watcher.exe
HKEY_CLASSES_ROOT\clsid\{a4545e47-89ca-11d6-af8d-000347889858}
HKEY_CLASSES_ROOT\clsid\{e2cfc218-a5ad-11d6-8e1a-000086427baf}
HKEY_CLASSES_ROOT\dgw_auto_file
HKEY_CLASSES_ROOT\dwbutton.dwbuttonctrl.1
HKEY_CLASSES_ROOT\interface\{e2cfc216-a5ad-11d6-8e1a-000086427baf}
HKEY_CLASSES_ROOT\interface\{e2cfc217-a5ad-11d6-8e1a-000086427baf}
HKEY_CLASSES_ROOT\typelib\{e2cfc215-a5ad-11d6-8e1a-000086427baf}
HKEY_CURRENT_USER\.default\audiert
HKEY_CURRENT_USER\applications\watcher.exe
HKEY_CURRENT_USER\software\audiert
HKEY_CURRENT_USER\software\classes\applications\watcher.exe
HKEY_CURRENT_USER\software\digi-watcher c:
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\digi-watcher.com

Registry Values:
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run


You must clean you computer ASAP !!!
Download Free Trial Version of antivirus software here, to check your computer instantly.

Also Be Aware of the Following Threats:
Niblenyo Trojan Information
Remove TrojanClicker.Win32.Delf.ab Trojan
TrojanDownloader.Win32.Zlob.jc Downloader Symptoms
SpyBot.H Worm Removal

Zlob.Fam.Security Tools Trojan

How To Remove Zlob.Fam.Security Tools?
You must download trial version of "Exterminate-It" antivirus software,to check your computer instantly.
Zlob.Fam.Security Tools is dangerous virus:
This loose category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

Multi-purpose Trojans are also included in this group, as some virus writers
create multi-functional Trojans rather than Trojan packs.
The pop-ups generally will not be stopped by pop-up stoppers, and often are
not dependent on your having Internet Explorer open.



Zlob.Fam.Security Tools Symptoms:

Folders:
[%PROGRAM_FILES%]\Security Tools

Registry Keys:
HKEY_CURRENT_USER\SOFTWARE\Security Tools


You must clean you computer ASAP !!!
Download Free Trial Version of antivirus software here, to check your computer instantly.

Also Be Aware of the Following Threats:
Bebe Trojan Removal instruction

Lemmy BHO

How To Remove Lemmy?
You must download trial version of "Exterminate-It" antivirus software,to check your computer instantly.
Lemmy is dangerous virus:
As this information is entered by the user, it is captured by the BHO (Browser Helper Object) and
sent back to the attacker.
Typically, keyloggers of this type will send the stolen information back to the attacker via email
or HTTP POST, which can appear suspicious.This family of Trojans downloads and installs new malware or adware on the computer.
The downloader then either launches the new malware or registers it to enable autorun
according to the local operating system requirements.

The names and locations of malware to be downloaded are either coded into the
Trojan or downloaded from a specified website.


Lemmy Symptoms:

Files:
[%WINDOWS%]\nbfmkzbe.dll
[%WINDOWS%]\gieeumr.dll
[%WINDOWS%]\grbrof.dll
[%WINDOWS%]\hohrychue.dll
[%WINDOWS%]\jmyg.dll
[%WINDOWS%]\mcdhgosa.dll
[%WINDOWS%]\nhteose.dll
[%WINDOWS%]\njjpmlil.dll
[%WINDOWS%]\ntzjeiyup.dll
[%WINDOWS%]\ptfdtcet.dll
[%WINDOWS%]\ugki.dll
[%WINDOWS%]\wcszaalu.dll
[%WINDOWS%]\wtznh.dll
[%WINDOWS%]\zkfmtdehl.dll
[%WINDOWS%]\nbfmkzbe.dll
[%WINDOWS%]\gieeumr.dll
[%WINDOWS%]\grbrof.dll
[%WINDOWS%]\hohrychue.dll
[%WINDOWS%]\jmyg.dll
[%WINDOWS%]\mcdhgosa.dll
[%WINDOWS%]\nhteose.dll
[%WINDOWS%]\njjpmlil.dll
[%WINDOWS%]\ntzjeiyup.dll
[%WINDOWS%]\ptfdtcet.dll
[%WINDOWS%]\ugki.dll
[%WINDOWS%]\wcszaalu.dll
[%WINDOWS%]\wtznh.dll
[%WINDOWS%]\zkfmtdehl.dll

Registry Keys:
HKEY_CLASSES_ROOT\clsid\{8e339f58-0553-4ca7-9ba3-042905614fb6}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{8e339f58-0553-4ca7-9ba3-042905614fb6}


You must clean you computer ASAP !!!
Download Free Trial Version of antivirus software here, to check your computer instantly.

Also Be Aware of the Following Threats:
Pigeon.AVRF Trojan Information
Remove FDoS.Zfn Hacker Tool
TMouse Trojan Information
Generic.Dialer Adware Removal instruction

Lycos.Sidesearch BHO

How To Remove Lycos.Sidesearch?
You must download trial version of "Exterminate-It" antivirus software,to check your computer instantly.
Lycos.Sidesearch is dangerous virus:
The BHO (Browser Helper Object) waits for the user to post personal information to a monitored website.
As this information is entered by the user, it is captured by the BHO and sent back to the attacker.
Hijackers are software programs that modify users' default browser home page,
search settings, error page settings, or desktop wallpaper without adequate notice, disclosure,
or user consent.


Lycos.Sidesearch It also known as:

[Panda]Adware/SideSearch,Spyware/ClearSearch

Lycos.Sidesearch Symptoms:

Files:
[%PROGRAMS%]\lycos sidesearch.lnk
[%DESKTOP%]\lycos sidesearch.lnk
[%PROFILE%]\desktop\lycos sidesearch.lnk
[%PROFILE%]\start-meny\program\lycos sidesearch.lnk
[%PROFILE_TEMP%]\nsv37.tmp.dll
[%SYSTEM%]\sidesearch.dll
[%WINDOWS%]\start menu\programs\lycos sidesearch.lnk
[%WINDOWS%]\system\sidesearch.dll
[%PROGRAMS%]\lycos sidesearch.lnk
[%DESKTOP%]\lycos sidesearch.lnk
[%PROFILE%]\desktop\lycos sidesearch.lnk
[%PROFILE%]\start-meny\program\lycos sidesearch.lnk
[%PROFILE_TEMP%]\nsv37.tmp.dll
[%SYSTEM%]\sidesearch.dll
[%WINDOWS%]\start menu\programs\lycos sidesearch.lnk
[%WINDOWS%]\system\sidesearch.dll

Folders:
[%APPDATA%]\lycos\sidesearch
[%PROGRAM_FILES%]\lycos

Registry Keys:
HKEY_CLASSES_ROOT\clsid\{000007ab-7059-463e-bd44-101a1750d732}
HKEY_LOCAL_MACHINE\software\lycos\sidesearch
HKEY_CLASSES_ROOT\clsid\{00000762-3965-4a1a-98ce-3d4bf457d4c8}
HKEY_CLASSES_ROOT\software\microsoft\windows\currentversion\explorer\browser helper objects\{00000762-3965-4a1a-98ce-3d4bf457d4c8}
HKEY_LOCAL_MACHINE\software\classes\clsid\{00000762-3965-4a1a-98ce-3d4bf457d4c8}
HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\explorer bars\{000007ab-7059-463e-bd44-101a1750d732}
HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\extensions\{000007c6-17df-4438-92a4-de5537471ba3}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{00000762-3965-4a1a-98ce-3d4bf457d4c8}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\lycos sidesearch

Registry Values:
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shell extensions\approved
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shell extensions\approved
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shell extensions\approved
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shell extensions\approved


You must clean you computer ASAP !!!
Download Free Trial Version of antivirus software here, to check your computer instantly.

Also Be Aware of the Following Threats:
IGMP.Tejanos DoS Removal instruction
Removing WhistleSoftware Adware
Remove Constructor.VBS.HPWG Trojan

FreeWire Worm

How To Remove FreeWire?
You must download trial version of "Exterminate-It" antivirus software,to check your computer instantly.
FreeWire is dangerous virus:
Worms can be classified according to the propagation method they use,
i.e. how they deliver copies of themselves to new victim machines.
Worms can also be classified by installation method, launch method and finally according
to characteristics standard to all malware: polymorphism, stealth etc.

Many of the worms which managed to cause significant outbreaks use more then
one propagation method as well as more than one infection technique.
The methods are listed separately below.


FreeWire Symptoms:

Registry Values:
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run


You must clean you computer ASAP !!!
Download Free Trial Version of antivirus software here, to check your computer instantly.

Also Be Aware of the Following Threats:
Activex.Runner Trojan Information
Removing Sality Trojan
SpyLocked Ransomware Information

Verticity Adware

How To Remove Verticity?
You must download trial version of "Exterminate-It" antivirus software,to check your computer instantly.
Verticity is dangerous virus:
Adware are programs that facilitate delivery for advertising content
to the user and in some cases gather information from the user's computer.

A desktop hijacker replaces the desktop wallpaper with advertising
for products and services on the desktop.
This family of Trojans downloads and installs new malware or adware on the computer.
The downloader then either launches the new malware or registers it to enable autorun
according to the local operating system requirements.

The names and locations of malware to be downloaded are either coded into the
Trojan or downloaded from a specified website.


Verticity It also known as:

[Kaspersky]TrojanDownloader.Win32.Turown.a,TrojanDownloader.Win32.Turown.h;
[Panda]Adware/IEDriver;
[Computer Associates]Win32.Startpage.JK,Win32.Startpage.JK!downloader,Win32/SearchBar.sb!Downloader,Win32/SearchBar.sb!Trojan

Verticity Symptoms:

Files:
[%PROFILE_TEMP%]\ckz3f3b55cc\Files\IEDriver.bin
[%PROFILE_TEMP%]\ckz3f3b55cc\Files\vii.tty
[%PROFILE_TEMP%]\ckz3f3b55cc\Files\IEDriver.bin
[%PROFILE_TEMP%]\ckz3f3b55cc\Files\vii.tty


You must clean you computer ASAP !!!
Download Free Trial Version of antivirus software here, to check your computer instantly.

Also Be Aware of the Following Threats:
Delfile1.Cab Hostile Code Removal
Stoned.Angelina Trojan Cleaner
Shutdown Trojan Removal instruction
clickbooth.com Tracking Cookie Cleaner
Gorman Trojan Cleaner

Affiliate Adware

How To Remove Affiliate?
You must download trial version of "Exterminate-It" antivirus software,to check your computer instantly.
Affiliate is dangerous virus:
Adware are programs that facilitate delivery for advertising content
to the user and in some cases gather information from the user's computer,
including information related to Internet browser usage or other computer habits
Trojans-downloaders downloads and installs new malware or adware on the computer.



Affiliate It also known as:

[Kaspersky]Trojan-Downloader.Win32.Agent.aqx,Trojan-Downloader.Win32.Small.dxm;
[McAfee]Downloader-AZH;
[F-Prot]W32/Downloader.BCBB;
[Other]W32/Agent.AGTQ,W32/Downloader.BDAG,Downloader,Trojan:Win32/Meredrop,Trojan-Downloader.Small.YM,Win32/Filitop!generic

Affiliate Symptoms:

Files:
[%SYSTEM%]\ldcore.dll
[%WINDOWS%]\aff_0006.exe
[%PROFILE_TEMP%]\affiliate.exe
[%SYSTEM%]\ldcore.dll
[%WINDOWS%]\aff_0006.exe
[%PROFILE_TEMP%]\affiliate.exe


You must clean you computer ASAP !!!
Download Free Trial Version of antivirus software here, to check your computer instantly.

Also Be Aware of the Following Threats:
Remove Key.Generator Backdoor
StartPage.yc Hijacker Cleaner
MyWebSearch (MySearch) Adware Information
Cmapp Adware Removal
Bancos.AAF Trojan Cleaner

Netrunner Trojan

How To Remove Netrunner?
You must download trial version of "Exterminate-It" antivirus software,to check your computer instantly.
Netrunner is dangerous virus:
This category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.
Backdoors are the most dangerous type of Trojans and the most popular.
Backdoors open infected machines to external control via Internet.
Often the backdoor will not be visible in the log of active programs.
Many trojans and backdoors now have remote administration capabilities
allowing an individual to control the victim's computer.
Many times a file called the server must be opened on the victim's computer before
the trojan can have access to it.

These are generally sent through email, P2P file sharing software,
and in internet downloads. They are usually disguised as a legitimate program or file.
Many server files will display a fake error message when opened, to make it seem like it didn't open.
Some will also kill antivirus and firewall software.

Some RAT trojans are pranks that are most likely being controlled by a friend or enemy on
April Fool's day or a holiday. Prank RATS are generally not harmful, and won't log keystrokes or hack.
They usually do whimsical things like flip the screen upside-down, open the CD-ROM tray,
and swap mouse buttons. However, they can be quite hard to remove.


Netrunner It also known as:

[Kaspersky]Backdoor.NetRunner.20;
[Eset]Win32/NetRunner.20 trojan;
[Panda]Backdoor Program;
[Computer Associates]Backdoor/NetRunner.20!Server

Netrunner Symptoms:

Registry Values:
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run


You must clean you computer ASAP !!!
Download Free Trial Version of antivirus software here, to check your computer instantly.

Also Be Aware of the Following Threats:
Remove Back.Construction Trojan
PSW.ICQ.Fixerror Trojan Removal instruction
Hi.Wire Adware Cleaner
Viresals Trojan Removal
Myzor.FK Trojan Cleaner

Friends.fr BHO

How To Remove Friends.fr?
You must download trial version of "Exterminate-It" antivirus software,to check your computer instantly.
Friends.fr is dangerous virus:
BHO (Browser Helper Object) Trojan.
The BHO waits for the user to post personal information to a monitored website.
As this information is entered by the user, it is captured by the BHO and sent back to the attacker.
The method of network transport used by the attacker makes this Trojan unique.
Typically, keyloggers of this type will send the stolen information back to the attacker via email
or HTTP POST, which can appear suspicious.
Instead, this Trojan encodes the data with a simple XOR algorithm before placing it into
the data section of an ICMP ping packet." explained the company.
Toolbar presents itself as a helpful add-on for Internet Explorer but it is a real pest.
It replaces your start page, continuosly open a number of pop up windows and so on.


Friends.fr Symptoms:

Files:
[%SYSTEM%]\msvri.dll
[%WINDOWS%]\system\msvri.dll
[%SYSTEM%]\msvri.dll
[%WINDOWS%]\system\msvri.dll

Registry Keys:
HKEY_CLASSES_ROOT\clsid\{08dbde36-df28-11d5-8ca5-0050da44a764}
HKEY_CLASSES_ROOT\software\microsoft\windows\currentversion\explorer\browser helper objects\{08dbde36-df28-11d5-8ca5-0050da44a764}
HKEY_LOCAL_MACHINE\software\classes\clsid\{08dbde36-df28-11d5-8ca5-0050da44a764}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{08dbde36-df28-11d5-8ca5-0050da44a764}


You must clean you computer ASAP !!!
Download Free Trial Version of antivirus software here, to check your computer instantly.

Also Be Aware of the Following Threats:
Tribe.FloodNet DoS Information

CC.Invader Trojan

How To Remove CC.Invader?
You must download trial version of "Exterminate-It" antivirus software,to check your computer instantly.
CC.Invader is dangerous virus:
This loose category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

Multi-purpose Trojans are also included in this group, as some virus writers
create multi-functional Trojans rather than Trojan packs.
Backdoors are used by virus writers to detect and download confidential information,
execute malicious code, destroy data, include the machine in bot networks and so forth.

Many trojans and backdoors now have remote administration capabilities
allowing an individual to control the victim's computer.
Many times a file called the server must be opened on the victim's computer before
the trojan can have access to it.

These are generally sent through email, P2P file sharing software,
and in internet downloads. They are usually disguised as a legitimate program or file.
Many server files will display a fake error message when opened, to make it seem like it didn't open.
Some will also kill antivirus and firewall software.

Some RAT trojans are pranks that are most likely being controlled by a friend or enemy on
April Fool's day or a holiday. Prank RATS are generally not harmful, and won't log keystrokes or hack.
They usually do whimsical things like flip the screen upside-down, open the CD-ROM tray,
and swap mouse buttons. However, they can be quite hard to remove.


CC.Invader It also known as:

[Kaspersky]Backdoor.CCInvader.10,Backdoor.Win32.CCInvader.10;
[Eset]Win32/CCInvader.10 trojan;
[McAfee]BackDoor-GY;
[F-Prot]security risk or a "backdoor" program;
[Panda]Bck/CCInvader.10;
[Computer Associates]Backdoor/ICS-FTP

CC.Invader Symptoms:

Registry Values:
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run


You must clean you computer ASAP !!!
Download Free Trial Version of antivirus software here, to check your computer instantly.

Also Be Aware of the Following Threats:
Remove Pigeon.AVSF Trojan
Backdoor/Worm/Sdbot Worm Cleaner
Remove Surila Trojan
ExitWin Trojan Symptoms
Bancos.GPT Trojan Removal instruction

Oplads Trojan

How To Remove Oplads?
You must download trial version of "Exterminate-It" antivirus software,to check your computer instantly.
Oplads is dangerous virus:
This loose category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

Multi-purpose Trojans are also included in this group, as some virus writers
create multi-functional Trojans rather than Trojan packs.


Oplads Symptoms:

Files:
[%SYSTEM%]\alg32.exe
[%SYSTEM%]\alg32.exe


You must clean you computer ASAP !!!
Download Free Trial Version of antivirus software here, to check your computer instantly.

Also Be Aware of the Following Threats:
Removing HBR.Server Trojan
GMSoft Adware Cleaner
Remove The.Shield Adware

Riviera.Gold.Casino Adware

How To Remove Riviera.Gold.Casino?
You must download trial version of "Exterminate-It" antivirus software,to check your computer instantly.
Riviera.Gold.Casino is dangerous virus:
Adware are programs that facilitate delivery for advertising content
to the user and in some cases gather information from the user's computer,
including information related to Internet browser usage or other computer habits


Riviera.Gold.Casino Symptoms:

Registry Keys:
HKEY_LOCAL_MACHINE\software\realtime gaming


You must clean you computer ASAP !!!
Download Free Trial Version of antivirus software here, to check your computer instantly.

Also Be Aware of the Following Threats:
Removing DeskAdTop Adware
Removing Pigeon.EOW Trojan

ATGames Adware

How To Remove ATGames?
You must download trial version of "Exterminate-It" antivirus software,to check your computer instantly.
ATGames is dangerous virus:
Adware are programs that facilitate delivery for advertising content
to the user and in some cases gather information from the user's computer.



ATGames Symptoms:

Files:
[%SYSTEM%]\ATPartners.dll
[%SYSTEM%]\atpartners.dll
[%SYSTEM%]\ATPartners.dll
[%SYSTEM%]\atpartners.dll


You must clean you computer ASAP !!!
Download Free Trial Version of antivirus software here, to check your computer instantly.

Also Be Aware of the Following Threats:
Removing Rbot Trojan
Remove CMOSFormat Trojan
Diwali RAT Cleaner
Gigex.SpeedDelivery Hijacker Removal
Ptakks.R1 Backdoor Removal

CWS.OSLogo Hijacker

How To Remove CWS.OSLogo?
You must download trial version of "Exterminate-It" antivirus software,to check your computer instantly.
CWS.OSLogo is dangerous virus:
Hijackers are software programs that modify users' default browser home page,
search settings, error page settings, or desktop wallpaper without adequate notice, disclosure,
or user consent.

When the default home page is hijacked, the browser opens to the web page set by the hijacker
instead of the user's designated home page. In some cases, the hijacker may block users from
restoring their desired home page.

A search hijacker redirects search results to other pages and may
transmit search and browsing data to unknown servers. An error page hijacker directs
the browser to another page, usually an advertising page, instead of the usual error
page when the requested URL is not found.

A desktop hijacker replaces the desktop wallpaper with advertising
for products and services on the desktop.

Hijackers take control of various parts of your web browser, including your home page,
search pages, and search bar. They may also redirect you to certain sites should you
mistype an address or prevent you from going to a website they would rather you not,
such as sites that combat malware. Some will even redirect you to their own search engine
when you attempt a search. NB: hijackers almost exclusively target Internet Explorer.


CWS.OSLogo Symptoms:

Files:
[%WINDOWS%]\web\oslogo.bmp
[%WINDOWS%]\web\oslogo.bmp


You must clean you computer ASAP !!!
Download Free Trial Version of antivirus software here, to check your computer instantly.

Also Be Aware of the Following Threats:
SpywareStrike Trojan Removal
Totempole Adware Removal
aSpy Spyware Removal instruction
VirusRanger Ransomware Removal

Yobe.worm Trojan

How To Remove Yobe.worm?
You must download trial version of "Exterminate-It" antivirus software,to check your computer instantly.
Yobe.worm is dangerous virus:
This loose category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

Multi-purpose Trojans are also included in this group, as some virus writers
create multi-functional Trojans rather than Trojan packs.


Yobe.worm It also known as:

[Kaspersky]Win95.Yobe;
[McAfee]W32/Yobe.worm;
[Computer Associates]Win95/Yobe,Win98.Yobe

Yobe.worm Symptoms:

Files:
[%FAVORITES%]\links\chat.url
[%FAVORITES%]\links\shopping.url
[%FAVORITES%]\links\chat.url
[%FAVORITES%]\links\shopping.url


You must clean you computer ASAP !!!
Download Free Trial Version of antivirus software here, to check your computer instantly.

Also Be Aware of the Following Threats:
Anna Trojan Removal
Remove Benuti.F!downloader Trojan
Remove IntermixMedia.KeenValue Adware
Nagem Trojan Cleaner
Bancos.IBV Trojan Symptoms

Microspy Spyware

How To Remove Microspy?
You must download trial version of "Exterminate-It" antivirus software,to check your computer instantly.
Microspy is dangerous virus:
Spyware is computer software that is installed surreptitiously on a personal computer
to intercept or take partial control over the user's interaction
with the computer, without the user's informed consent.

While the term spyware suggests software that secretly monitors the user's behavior,
the functions of spyware extend well beyond simple monitoring.

Spyware programs can collect various types of personal information,
such as Internet surfing habit, sites that have been visited,
but can also interfere with user control of the computer in other ways,
such as installing additional software, redirecting Web browser activity,
accessing websites blindly that will cause more harmful viruses,
or diverting advertising revenue to a third party.

Spyware can even change computer settings, resulting in slow connection speeds,
different home pages, and loss of Internet or other programs.
In an attempt to increase the understanding of spyware, a more formal classification
of its included software types is captured under the term privacy-invasive software.
Backdoors are the most dangerous type of Trojans and the most popular.
Backdoors open infected machines to external control via Internet.
Often the backdoor will not be visible in the log of active programs.
Many trojans and backdoors now have remote administration capabilities
allowing an individual to control the victim's computer.
Many times a file called the server must be opened on the victim's computer before
the trojan can have access to it.

These are generally sent through email, P2P file sharing software,
and in internet downloads. They are usually disguised as a legitimate program or file.
Many server files will display a fake error message when opened, to make it seem like it didn't open.
Some will also kill antivirus and firewall software.

Some RAT trojans are pranks that are most likely being controlled by a friend or enemy on
April Fool's day or a holiday. Prank RATS are generally not harmful, and won't log keystrokes or hack.
They usually do whimsical things like flip the screen upside-down, open the CD-ROM tray,
and swap mouse buttons. However, they can be quite hard to remove.
These utilities are designed to penetrate remote computers
in order to use them as zombies (by using backdoors) or to download other malicious programs to computer.

Exploits use vulnerabilities in operating systems and applications to achieve the same result.


Microspy It also known as:

[Kaspersky]Backdoor.MicroSpy.10;
[McAfee]BackDoor-MR;
[F-Prot]security risk or a "backdoor" program;
[Panda]Bck/Microspy;
[Computer Associates]Backdoor/MicroSpy.10

Microspy Symptoms:

Files:
[%WINDOWS%]\win32.exe
[%WINDOWS%]\win32.exe

Registry Values:
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run


You must clean you computer ASAP !!!
Download Free Trial Version of antivirus software here, to check your computer instantly.

Also Be Aware of the Following Threats:
WinF**k Trojan Cleaner
MyGlobalSearch Toolbar Symptoms
Remove Softomate Adware
Cottered Trojan Removal

Frethog.ACV Trojan

How To Remove Frethog.ACV?
You must download trial version of "Exterminate-It" antivirus software,to check your computer instantly.
Frethog.ACV is dangerous virus:
This loose category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

Multi-purpose Trojans are also included in this group, as some virus writers
create multi-functional Trojans rather than Trojan packs.


Frethog.ACV Symptoms:

Files:
[%PROFILE_TEMP%]\pre.exe
[%PROFILE_TEMP%]\suicidetb.exe
[%PROFILE_TEMP%]\temp.fr????\etl
[%PROFILE_TEMP%]\temp.fr????\xml\adult.tbr
[%PROFILE_TEMP%]\temp.fr????\xml\images\50kwincash2.bmp
[%PROFILE_TEMP%]\temp.fr????\xml\images\casino.bmp
[%PROFILE_TEMP%]\temp.fr????\xml\images\dating.bmp
[%PROFILE_TEMP%]\temp.fr????\xml\images\findemails.bmp
[%PROFILE_TEMP%]\temp.fr????\xml\images\ringtones.bmp
[%PROFILE_TEMP%]\temp.fr????\xml\images\searchpeople.bmp
[%PROFILE_TEMP%]\temp.fr????\xml\images\virus.bmp
[%WINDOWS%]\EliteToolBar\xml\images\casino.bmp
[%WINDOWS%]\EliteToolBar\xml\images\dating.bmp
[%WINDOWS%]\EliteToolBar\xml\images\findemails.bmp
[%WINDOWS%]\EliteToolBar\xml\images\searchpeople.bmp
[%WINDOWS%]\EliteToolBar\xml\images\virus.bmp
[%PROFILE_TEMP%]\pre.exe
[%PROFILE_TEMP%]\suicidetb.exe
[%PROFILE_TEMP%]\temp.fr????\etl
[%PROFILE_TEMP%]\temp.fr????\xml\adult.tbr
[%PROFILE_TEMP%]\temp.fr????\xml\images\50kwincash2.bmp
[%PROFILE_TEMP%]\temp.fr????\xml\images\casino.bmp
[%PROFILE_TEMP%]\temp.fr????\xml\images\dating.bmp
[%PROFILE_TEMP%]\temp.fr????\xml\images\findemails.bmp
[%PROFILE_TEMP%]\temp.fr????\xml\images\ringtones.bmp
[%PROFILE_TEMP%]\temp.fr????\xml\images\searchpeople.bmp
[%PROFILE_TEMP%]\temp.fr????\xml\images\virus.bmp
[%WINDOWS%]\EliteToolBar\xml\images\casino.bmp
[%WINDOWS%]\EliteToolBar\xml\images\dating.bmp
[%WINDOWS%]\EliteToolBar\xml\images\findemails.bmp
[%WINDOWS%]\EliteToolBar\xml\images\searchpeople.bmp
[%WINDOWS%]\EliteToolBar\xml\images\virus.bmp

Folders:
[%WINDOWS%]\elitetoolbar

Registry Values:
HKEY_CURRENT_USER\software\microsoft\internet explorer\toolbar\webbrowser


You must clean you computer ASAP !!!
Download Free Trial Version of antivirus software here, to check your computer instantly.

Also Be Aware of the Following Threats:
VBS.Subsil Trojan Removal
QFat Trojan Cleaner
Removing Backdoor.Assasin.Server Trojan
Pigeon.AVNH Trojan Information
Remove SwimSuitNetwork Adware

Desktop.Search Adware

How To Remove Desktop.Search?
You must download trial version of "Exterminate-It" antivirus software,to check your computer instantly.
Desktop.Search is dangerous virus:
Adware are programs that facilitate delivery for advertising content
to the user and in some cases gather information from the user's computer,
including information related to Internet browser usage or other computer habits


Desktop.Search It also known as:

[Kaspersky]Trojan-Downloader.Win32.Ieser.a

Desktop.Search Symptoms:

Files:
[%WINDOWS%]\delprot.ini
[%WINDOWS%]\delprot.log
[%DESKTOP%]\anal exploits.url
[%DESKTOP%]\big dick school for 2.95.url
[%DESKTOP%]\evidence eraser.lnk
[%DESKTOP%]\popup blocker stops popups.lnk
[%DESKTOP%]\spyware avenger.lnk
[%DESKTOP%]\virus hunter security.lnk
[%DESKTOP%]\virus hunter.url
[%DESKTOP%]\your platinum visa.lnk
[%WINDOWS%]\delprot.ini
[%WINDOWS%]\delprot.log
[%DESKTOP%]\anal exploits.url
[%DESKTOP%]\big dick school for 2.95.url
[%DESKTOP%]\evidence eraser.lnk
[%DESKTOP%]\popup blocker stops popups.lnk
[%DESKTOP%]\spyware avenger.lnk
[%DESKTOP%]\virus hunter security.lnk
[%DESKTOP%]\virus hunter.url
[%DESKTOP%]\your platinum visa.lnk

Folders:
[%WINDOWS%]\isrvs

Registry Keys:
HKEY_CLASSES_ROOT\mfiltis
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\delprot
HKEY_CLASSES_ROOT\clsid\{5b4ab8e2-6dc5-477a-b637-bf3c1a2e5993}
HKEY_CLASSES_ROOT\clsid\{950238fb-c706-4791-8674-4d429f85897e}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{5b4ab8e2-6dc5-477a-b637-bf3c1a2e5993}

Registry Values:
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\ext\clsid
HKEY_CLASSES_ROOT\protocols\filter\text/html
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\ext\clsid
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run


You must clean you computer ASAP !!!
Download Free Trial Version of antivirus software here, to check your computer instantly.

Also Be Aware of the Following Threats:
TinyFWB RAT Information

2nd.Thought Trojan

How To Remove 2nd.Thought?
You must download trial version of "Exterminate-It" antivirus software,to check your computer instantly.
2nd.Thought is dangerous virus:
This loose category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

Multi-purpose Trojans are also included in this group, as some virus writers
create multi-functional Trojans rather than Trojan packs.
Adware are programs that facilitate delivery for advertising content
to the user and in some cases gather information from the user's computer.

BHO (Browser Helper Object) Trojan.
The BHO waits for the user to post personal information to a monitored website.
As this information is entered by the user, it is captured by the BHO and sent back to the attacker.
The method of network transport used by the attacker makes this Trojan unique.
Typically, keyloggers of this type will send the stolen information back to the attacker via email
or HTTP POST, which can appear suspicious.
Instead, this Trojan encodes the data with a simple XOR algorithm before placing it into
the data section of an ICMP ping packet." explained the company.
When the default home page is hijacked, the browser opens to the web page set by the hijacker
instead of the user's designated home page. In some cases, the hijacker may block users from
restoring their desired home page.


2nd.Thought It also known as:

[Kaspersky]Trojan.Win32.SecondThought.b,Trojan.Win32.SecondThought,Trojan.Win32.SecondThought.a;
[Panda]Adware/PortalScan,Spyware/BetterInet,Spyware/ClearSearch;
[Computer Associates]Win32.BettInet.E;
[Other]Adware.SecondThought,Trojan.Win32.SecondThought.c,Win32/SecondThought.G

2nd.Thought Symptoms:

Files:
[%PROFILE_TEMP%]\randreco.exe
[%PROFILE_TEMP%]\THI1EA2.tmp\VoiceIp.dll
[%PROFILE_TEMP%]\THI1EA2.tmp\VoiceIP.inf
[%PROFILE_TEMP%]\THI75D.tmp\VoiceIp.dll
[%PROFILE_TEMP%]\THI75D.tmp\VoiceIP.inf
[%PROFILE_TEMP%]\tt_unadd.inf
[%SYSTEM%]\2ndsrch.dll
[%SYSTEM%]\automove.exe_
[%SYSTEM%]\data.xml
[%SYSTEM%]\idleui.dll
[%SYSTEM%]\retpdat32.xml
[%SYSTEM%]\sp32.xml
[%SYSTEM%]\stcloader.exe
[%SYSTEM%]\swin32.dll
[%SYSTEM%]\SWRT01.dll
[%WINDOWS%]\bokja.exe
[%WINDOWS%]\jawa32.ocx
[%WINDOWS%]\stcloader.exe
[%WINDOWS%]\voiceip.dll
[%DESKTOP%]\second thought.lnk
[%DESKTOP%]\spediabar.lnk
[%PROFILE%]\administrator\start menu\programs\spediabar.lnk
[%PROFILE%]\locals~1\temp\randreco.exe
[%SYSTEM%]\automove.exe
[%SYSTEM%]\cdsm32.dll
[%WINDOWS%]\mwsvm.ocx
[%WINDOWS%]\system\idleui.dll
[%WINDOWS%]\system\stcloader.exe
[%PROFILE_TEMP%]\randreco.exe
[%PROFILE_TEMP%]\THI1EA2.tmp\VoiceIp.dll
[%PROFILE_TEMP%]\THI1EA2.tmp\VoiceIP.inf
[%PROFILE_TEMP%]\THI75D.tmp\VoiceIp.dll
[%PROFILE_TEMP%]\THI75D.tmp\VoiceIP.inf
[%PROFILE_TEMP%]\tt_unadd.inf
[%SYSTEM%]\2ndsrch.dll
[%SYSTEM%]\automove.exe_
[%SYSTEM%]\data.xml
[%SYSTEM%]\idleui.dll
[%SYSTEM%]\retpdat32.xml
[%SYSTEM%]\sp32.xml
[%SYSTEM%]\stcloader.exe
[%SYSTEM%]\swin32.dll
[%SYSTEM%]\SWRT01.dll
[%WINDOWS%]\bokja.exe
[%WINDOWS%]\jawa32.ocx
[%WINDOWS%]\stcloader.exe
[%WINDOWS%]\voiceip.dll
[%DESKTOP%]\second thought.lnk
[%DESKTOP%]\spediabar.lnk
[%PROFILE%]\administrator\start menu\programs\spediabar.lnk
[%PROFILE%]\locals~1\temp\randreco.exe
[%SYSTEM%]\automove.exe
[%SYSTEM%]\cdsm32.dll
[%WINDOWS%]\mwsvm.ocx
[%WINDOWS%]\system\idleui.dll
[%WINDOWS%]\system\stcloader.exe

Folders:
[%FAVORITES%]\ cool stuff
[%PROGRAMS%]\addestroyer
[%PROGRAM_FILES%]\clearsearch
[%PROGRAM_FILES_COMMON%]\slmss
[%PROGRAM_FILES%]\STC
[%PROFILE_TEMP%]\132.zip
[%PROGRAM_FILES%]\common files\slmss
[%PROGRAM_FILES%]\second thought
[%PROGRAM_FILES%]\stc

Registry Keys:
HKEY_CLASSES_ROOT\clsid\{00000250-0320-4dd4-be4f-7566d2314352}
HKEY_CLASSES_ROOT\clsid\{5fa6752a-c4a0-4222-88c2-928ae5ab4966}
HKEY_CLASSES_ROOT\clsid\{965a592f-8efa-4250-8630-7960230792f1}
HKEY_CLASSES_ROOT\csie.csiecore
HKEY_CLASSES_ROOT\csie.csiecore.1
HKEY_CLASSES_ROOT\interface\{0f2a4adc-dabf-4980-8db4-19f67d7b1f95}
HKEY_CLASSES_ROOT\interface\{96b3b1b9-a510-4603-bd66-2bb2c9f21542}
HKEY_CLASSES_ROOT\typelib\{60494593-5408-447d-bd5e-a16640d6af99}
HKEY_CLASSES_ROOT\typelib\{69db5061-ff0a-418b-ada6-68ac77d69e44}
HKEY_CLASSES_ROOT\urlsearch.urlsearch.1
HKEY_CLASSES_ROOT\voiceipdll.voiceipdllobj.1
HKEY_CURRENT_USER\Software\STC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00000250-0320-4DD4-BE4F-7566D2314352}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5FA6752A-C4A0-4222-88C2-928AE5AB4966}
HKEY_CLASSES_ROOT\clsid\{13197ace-6851-45c3-a7ff-c281324d5489}
HKEY_CLASSES_ROOT\clsid\{95c60327-8e17-44d6-98eb-7eb70cc606dd}
HKEY_CURRENT_USER\software\stc
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{00000250-0320-4dd4-be4f-7566d2314352}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{5fa6752a-c4a0-4222-88c2-928ae5ab4966}

Registry Values:
HKEY_LOCAL_MACHINE\software\bokja
HKEY_LOCAL_MACHINE\software\bokja
HKEY_LOCAL_MACHINE\software\bokja
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\contextsidebar
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\contextsidebar
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\contextsidebar
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\mirrorunder
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\mirrorunder
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\mirrorunder
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\mirrorunder
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\ronsidebar
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\ronsidebar
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\ronsidebar
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\spidersidebar
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\spidersidebar
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\urlsidebar
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\urlsidebar
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\urlsidebar
HKEY_LOCAL_MACHINE\software\y036
HKEY_LOCAL_MACHINE\software\bokja
HKEY_LOCAL_MACHINE\software\bokja
HKEY_LOCAL_MACHINE\software\bokja
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\contextsidebar
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\contextsidebar
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\mirrorunder
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\mirrorunder
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\ronsidebar
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\ronsidebar
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\spidersidebar
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\spidersidebar
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\urlsidebar
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\urlsidebar
HKEY_LOCAL_MACHINE\software\y036


You must clean you computer ASAP !!!
Download Free Trial Version of antivirus software here, to check your computer instantly.

Also Be Aware of the Following Threats:
Vienna Trojan Removal
Remove Pigeon.AVEW Trojan
Vxidl.AMT Trojan Removal

Actual.Spy Spyware

How To Remove Actual.Spy?
You must download trial version of "Exterminate-It" antivirus software,to check your computer instantly.
Actual.Spy is dangerous virus:
Spyware can even change computer settings, resulting in slow connection speeds,
different home pages, and loss of Internet or other programs.
In an attempt to increase the understanding of spyware, a more formal classification
of its included software types is captured under the term privacy-invasive software.
Hijackers are software programs that modify users' default browser home page,
search settings, error page settings, or desktop wallpaper without adequate notice, disclosure,
or user consent.


Actual.Spy Symptoms:

Files:
[%WINDOWS%]\system\actualspy.lnk
[%DESKTOP%]\Actual Spy.lnk
[%WINDOWS%]\system\actualspy.lnk
[%DESKTOP%]\Actual Spy.lnk

Folders:
[%COMMON_PROGRAMS%]\Actual Spy
[%PROGRAM_FILES%]\asmonitor
[%PROGRAMS%]\actual spy

Registry Keys:
HKEY_CURRENT_USER\software\asmonitor
HKEY_LOCAL_MACHINE\software\asmonitor
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\actualspy_is1
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\actual spy_is1
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\actual spy_is1

Registry Values:
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run


You must clean you computer ASAP !!!
Download Free Trial Version of antivirus software here, to check your computer instantly.

Also Be Aware of the Following Threats:
QFat6 Trojan Symptoms
Public Messenger Trojan Information
Bullguard.Tracking.Cookie Tracking Cookie Cleaner
SillyDl.CSB Trojan Removal
FastKill Trojan Removal

SysVenFakU Adware

How To Remove SysVenFakU?
You must download trial version of "Exterminate-It" antivirus software,to check your computer instantly.
SysVenFakU is dangerous virus:
Adware are programs that facilitate delivery for advertising content
to the user and in some cases gather information from the user's computer,
including information related to Internet browser usage or other computer habits


SysVenFakU Symptoms:

Registry Values:
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run


You must clean you computer ASAP !!!
Download Free Trial Version of antivirus software here, to check your computer instantly.

Also Be Aware of the Following Threats:
Removing YapBrowser Adware
Pigeon.AGN Trojan Removal instruction
Remove Vxidl.ATF Trojan
Removing Pigeon.ADW Trojan

Delf.fl Trojan

How To Remove Delf.fl?
You must download trial version of "Exterminate-It" antivirus software,to check your computer instantly.
Delf.fl is dangerous virus:
This category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.
Adware are programs that facilitate delivery for advertising content
to the user and in some cases gather information from the user's computer.



Delf.fl Symptoms:

Registry Values:
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run


You must clean you computer ASAP !!!
Download Free Trial Version of antivirus software here, to check your computer instantly.

Also Be Aware of the Following Threats:
Removing Downloader.AUE.dll Trojan
Bancos.GTJ Trojan Cleaner
LV Trojan Symptoms

Doly Trojan

How To Remove Doly?
You must download trial version of "Exterminate-It" antivirus software,to check your computer instantly.
Doly is dangerous virus:
This category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.
Spyware can even change computer settings, resulting in slow connection speeds,
different home pages, and loss of Internet or other programs.
In an attempt to increase the understanding of spyware, a more formal classification
of its included software types is captured under the term privacy-invasive software.
Backdoors are used by virus writers to detect and download confidential information,
execute malicious code, destroy data, include the machine in bot networks and so forth.

Many trojans and backdoors now have remote administration capabilities
allowing an individual to control the victim's computer.
Many times a file called the server must be opened on the victim's computer before
the trojan can have access to it.

These are generally sent through email, P2P file sharing software,
and in internet downloads. They are usually disguised as a legitimate program or file.
Many server files will display a fake error message when opened, to make it seem like it didn't open.
Some will also kill antivirus and firewall software.

Some RAT trojans are pranks that are most likely being controlled by a friend or enemy on
April Fool's day or a holiday. Prank RATS are generally not harmful, and won't log keystrokes or hack.
They usually do whimsical things like flip the screen upside-down, open the CD-ROM tray,
and swap mouse buttons. However, they can be quite hard to remove.
Hacker Tools are designed to penetrate remote computers
in order to use them as zombies or to download other malicious programs to computer.


Doly It also known as:

[Kaspersky]Backdoor.Doly.15,Backdoor.Doly.20,Backdoor.Doly,Backdoor.Doly.11,Backdoor.Doly.12,Backdoor.Doly.135,Backdoor.Doly.16;
[McAfee]Generic,BackDoor-AZ;
[F-Prot]security risk or a "backdoor" program;
[Panda]Bck/Doly.1.5,Bck/Doly.20,Backdoor Program,Backdoor Program.LC,Bck/Doly.1.1,Bck/Doly.1.2;
[Computer Associates]Backdoor/Doly.15,Backdoor/Doly.20,Win32.Doly.20,Backdoor/Doly,Backdoor/Doly.1_2!Server

Doly Symptoms:

Files:
[%PROGRAMS%]\doly trojan 1.5\dolyt15.exe.lnk
[%PROGRAMS%]\doly trojan 1.5\remove doly trojan v1.35.lnk
[%PROGRAMS%]\doly trojan 1.6\doly trojan 1.6.lnk
[%PROGRAMS%]\doly trojan 1.6\read-me.lnk
[%PROGRAMS%]\doly trojan 1.5\dolyt15.exe.lnk
[%PROGRAMS%]\doly trojan 1.5\remove doly trojan v1.35.lnk
[%PROGRAMS%]\doly trojan 1.6\doly trojan 1.6.lnk
[%PROGRAMS%]\doly trojan 1.6\read-me.lnk

Folders:
[%PROFILE%]\start menu\programs\doly trojan 1.5
[%PROFILE%]\start menu\programs\doly trojan 1.6
[%PROGRAM_FILES%]\doly trojan1.6
[%PROGRAM_FILES%]\doly15

Registry Keys:
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\doly
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\doly trojan 1.6

Registry Values:
HKEY_LOCAL_MACHINE\software\-a-=d=-m-\doly trojan\1.6
HKEY_LOCAL_MACHINE\software\tg byte software\setup\currentversion\uninstall specialist


You must clean you computer ASAP !!!
Download Free Trial Version of antivirus software here, to check your computer instantly.

Also Be Aware of the Following Threats:
Pigeon.EJE Trojan Information
agentinteractive.com Tracking Cookie Cleaner
Sysrater Trojan Information
Spot.Bot Trojan Removal
Storark Trojan Symptoms