MalwarePro Ransomware

How To Remove MalwarePro?
You must download trial version of "Exterminate-It" antivirus software,to check your computer instantly.

---

MalwarePro is dangerous virus:
A cryptovirus, cryptotrojan or cryptoworm is a type of
malware that encrypts the data belonging to an individual on a computer,
demanding a ransom for its restoration.

The term ransomware is commonly used to describe such software,
although the field known as cryptovirology predates the term "ransomware".

This type of ransom attack can be accomplished by (for example) attaching
a specially crafted file/program to an e-mail message and sending this to the victim.

If the victim opens/executes the attachment, the program encrypts
a number of files on the victim's computer. A ransom note is then left behind for the victim.

The victim will be unable to open the encrypted files without the correct decryption key.
Once the ransom demanded in the ransom note is paid, the cracker may (or may not)
send the decryption key, enabling decryption of the "kidnapped" files.

---

---

MalwarePro Symptoms:

Files:
[%DESKTOP%]\MalwarePro.lnk
[%WINDOWS%]\MalwarePro Setup Log.txt
[%WINDOWS%]\MalwarePro\uninstall.exe
[%DESKTOP%]\MalwarePro.lnk
[%WINDOWS%]\MalwarePro Setup Log.txt
[%WINDOWS%]\MalwarePro\uninstall.exe

Folders:
[%PROGRAMS%]\MalwarePro
[%PROGRAM_FILES%]\MalwarePro

Registry Keys:
HKEY_CURRENT_USER\software\mpmfc1
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\malwarepro5.2

Registry Values:
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run

---

You must clean you computer ASAP !!!
Download Free Trial Version of antivirus software here, to check your computer instantly.

---

Also Be Aware of the Following Threats:
Removing TrojanDownloader.Win32.IstBar.gm Downloader
Removing Lycos.Boot.Helper Trojan
Australian.Little Trojan Symptoms
Shutdown Trojan Removal

CommonName.Internet.Keyword BHO

How To Remove CommonName.Internet.Keyword?
You must download trial version of "Exterminate-It" antivirus software,to check your computer instantly.

---

CommonName.Internet.Keyword is dangerous virus:
The BHO (Browser Helper Object) waits for the user to post personal information to a monitored website.
As this information is entered by the user, it is captured by the BHO and sent back to the attacker.

---

---

CommonName.Internet.Keyword It also known as:

[Panda]Spyware/CommonName

---

CommonName.Internet.Keyword Symptoms:

Files:
[%SYSTEM%]\inetmgr.ini
[%SYSTEM%]\inetmgr.ini

Registry Keys:
HKEY_LOCAL_MACHINE\software\internet keyword

Registry Values:
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run

---

You must clean you computer ASAP !!!
Download Free Trial Version of antivirus software here, to check your computer instantly.

---

Also Be Aware of the Following Threats:
insightexpress.com Tracking Cookie Removal instruction
Morpheus Adware Removal instruction
Removing Vxidl.AIB Trojan
Downhill.Demo RAT Cleaner

Notiex Trojan

How To Remove Notiex?
You must download trial version of "Exterminate-It" antivirus software,to check your computer instantly.

---

Notiex is dangerous virus:
This category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

---

---

Notiex It also known as:

[Kaspersky]Trojna-PSW.Win32.LdPinch,Trojan-Downloader.Win32.VB.nw,Trojan-Dropper.Win32.Agent.tb,Trojan-Dropper.Win32.Agent.xw;
[McAfee]Downloader-ACV;
[F-Prot]W32/TrojanX.ZA;
[Other]WIn32/Notiex,Win32/Notiex.C,Troj/Agent-JK,Trojan.Popper,TROJ_DLOADER.ALW,Win32/Notiex.H,Trojan.Dropper,TrojanDropper:Win32/Agent!AA6D,W32/Smalldrp.GHG,Troj/DwnLdr-ACV,FullContext.FCHelp,cas

---

Notiex Symptoms:

Files:
[%WINDOWS%]\isf.dat
[%WINDOWS%]\jptc.dat
[%WINDOWS%]\offnm.dat
[%WINDOWS%]\offun.exe
[%WINDOWS%]\tcb.pmw
[%WINDOWS%]\uid32.key
[%WINDOWS%]\wocnm.dat
[%WINDOWS%]\offnm.ini
[%WINDOWS%]\isf.dat
[%WINDOWS%]\jptc.dat
[%WINDOWS%]\offnm.dat
[%WINDOWS%]\offun.exe
[%WINDOWS%]\tcb.pmw
[%WINDOWS%]\uid32.key
[%WINDOWS%]\wocnm.dat
[%WINDOWS%]\offnm.ini

Registry Keys:
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\ovmon
HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\legacy_windows_overlay_components
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\windows overlay components

Registry Values:
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run

---

You must clean you computer ASAP !!!
Download Free Trial Version of antivirus software here, to check your computer instantly.

---

Also Be Aware of the Following Threats:
Removing AOL.WinSpy Trojan
Removing Free.Ice.Remote.Spy Spyware
Unmanarc.Remote.Control.Server.05b1 Backdoor Symptoms

ToolbarCC BHO

How To Remove ToolbarCC?
You must download trial version of "Exterminate-It" antivirus software,to check your computer instantly.

---

ToolbarCC is dangerous virus:
As this information is entered by the user, it is captured by the BHO (Browser Helper Object) and
sent back to the attacker.
Typically, keyloggers of this type will send the stolen information back to the attacker via email
or HTTP POST, which can appear suspicious.Toolbar presents itself as a helpful add-on for Internet Explorer but it is a real pest.

---

---

ToolbarCC Symptoms:

Registry Keys:
HKEY_CLASSES_ROOT\clsid\{1f48aa48-c53a-4e21-85e7-ac7cc6b5ffa2}
HKEY_CLASSES_ROOT\software\microsoft\windows\currentversion\explorer\browser helper objects\{1f48aa48-c53a-4e21-85e7-ac7cc6b5ffa2}
HKEY_CLASSES_ROOT\typelib\{1f48aa48-c53a-4e21-85e7-ac7cc6b5ffa2}
HKEY_CLASSES_ROOT\typelib\{1f48aa48-c53a-4e21-85e7-ac7cc6b5ffa7}
HKEY_LOCAL_MACHINE\software\classes\clsid\{1f48aa48-c53a-4e21-85e7-ac7cc6b5ffa2}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{1f48aa48-c53a-4e21-85e7-ac7cc6b5ffa2}

---

You must clean you computer ASAP !!!
Download Free Trial Version of antivirus software here, to check your computer instantly.

---

Also Be Aware of the Following Threats:
Remove CHCB Backdoor

Frethog.ADV Trojan

How To Remove Frethog.ADV?
You must download trial version of "Exterminate-It" antivirus software,to check your computer instantly.

---

Frethog.ADV is dangerous virus:
This category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

---

---

Frethog.ADV Symptoms:

Registry Values:
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run

---

You must clean you computer ASAP !!!
Download Free Trial Version of antivirus software here, to check your computer instantly.

---

Also Be Aware of the Following Threats:
Removing SMS.Samurai DoS

Crontel.Ltd Adware

How To Remove Crontel.Ltd?
You must download trial version of "Exterminate-It" antivirus software,to check your computer instantly.

---

Crontel.Ltd is dangerous virus:
Adware are programs that facilitate delivery for advertising content
to the user and in some cases gather information from the user's computer,
including information related to Internet browser usage or other computer habits

---

---

Crontel.Ltd Symptoms:

Registry Keys:
HKEY_LOCAL_MACHINE\software\diallerprogram

---

You must clean you computer ASAP !!!
Download Free Trial Version of antivirus software here, to check your computer instantly.

---

Also Be Aware of the Following Threats:
Remove Mr.Twister Trojan
APStrojan.gen4 Trojan Information

Gold.Bug Trojan

How To Remove Gold.Bug?
You must download trial version of "Exterminate-It" antivirus software,to check your computer instantly.

---

Gold.Bug is dangerous virus:
This category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.
Backdoors are the most dangerous type of Trojans and the most popular.
Backdoors open infected machines to external control via Internet.
Often the backdoor will not be visible in the log of active programs.
This family of Trojans downloads and installs new malware or adware on the computer.
The downloader then either launches the new malware or registers it to enable autorun
according to the local operating system requirements.

The names and locations of malware to be downloaded are either coded into the
Trojan or downloaded from a specified website.
DoS programs attack web servers by sending numerous requests to the specified server,
often causing it to crash under an excessive volume of requests.

---

---

Gold.Bug It also known as:

[Kaspersky]GoldBug;
[Panda]GoldBug.1400,Goldbug.A.Drp,Intended.GoldBug;
[Computer Associates]Gold Bug

---

Gold.Bug Symptoms:

Registry Keys:
HKEY_LOCAL_MACHINE\software\btv

---

You must clean you computer ASAP !!!
Download Free Trial Version of antivirus software here, to check your computer instantly.

---

Also Be Aware of the Following Threats:
Orce Trojan Removal instruction
Bancos.HSI Trojan Information
Removing Wingkill Trojan
Kaos.WebDownloader Trojan Information
Win32.Realpan Trojan Removal

Pigeon.DSH Trojan

How To Remove Pigeon.DSH?
You must download trial version of "Exterminate-It" antivirus software,to check your computer instantly.

---

Pigeon.DSH is dangerous virus:
This loose category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

Multi-purpose Trojans are also included in this group, as some virus writers
create multi-functional Trojans rather than Trojan packs.

---

---

Pigeon.DSH It also known as:

[Other]Backdoor.Graybird

---

Pigeon.DSH Symptoms:

Files:
[%SYSTEM%]\csrssar
[%SYSTEM%]\csrssar

Registry Keys:
HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\legacy_remate_run_rpc_(asp)
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\remate run rpc (asp)

---

You must clean you computer ASAP !!!
Download Free Trial Version of antivirus software here, to check your computer instantly.

---

Also Be Aware of the Following Threats:
Pigeon.ATD Trojan Removal
Win32.Revenge Trojan Removal
Bancos.ICC Trojan Removal

BAT.SS Trojan

How To Remove BAT.SS?
You must download trial version of "Exterminate-It" antivirus software,to check your computer instantly.

---

BAT.SS is dangerous virus:
This category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

---

---

BAT.SS Symptoms:

Folders:
[%PROGRAM_FILES%]\TS Trial

Registry Values:
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run

---

You must clean you computer ASAP !!!
Download Free Trial Version of antivirus software here, to check your computer instantly.

---

Also Be Aware of the Following Threats:
Removing Bancos.GXO Trojan
Vxidl.ASU Trojan Removal instruction
Removing KillSAP Trojan

HLLP.Philis Trojan

How To Remove HLLP.Philis?
You must download trial version of "Exterminate-It" antivirus software,to check your computer instantly.

---

HLLP.Philis is dangerous virus:
This loose category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

Multi-purpose Trojans are also included in this group, as some virus writers
create multi-functional Trojans rather than Trojan packs.
Many of the worms which managed to cause significant outbreaks use more then
one propagation method as well as more than one infection technique.

---

---

HLLP.Philis It also known as:

[McAfee]W32/HLLP.Philis;
[F-Prot]W32/PWStealer.gen1;
[Other]Win32/Vanti.FB,VirTool:Win32/Obfuscator.A

---

HLLP.Philis Symptoms:

Files:
[%PROFILE_TEMP%]\c0nime.exe
[%PROFILE_TEMP%]\c0nime.exe

Registry Values:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

---

You must clean you computer ASAP !!!
Download Free Trial Version of antivirus software here, to check your computer instantly.

---

Also Be Aware of the Following Threats:
Remove Xupiter.Browser BHO

StartPage.ip Hijacker

How To Remove StartPage.ip?
You must download trial version of "Exterminate-It" antivirus software,to check your computer instantly.

---

StartPage.ip is dangerous virus:
A Search hijacker redirects search results to other pages and may
transmit search and browsing data to unknown servers. An error page hijacker directs
the browser to another page, usually an advertising page, instead of the usual error
page when the requested URL is not found.

---

---

StartPage.ip Symptoms:

Folders:
[%PROGRAM_FILES%]\halflemon

Registry Keys:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{D94AAA2A-C415-42E3-82B6-49FAB4EBFFE9}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{d94aaa2a-c415-42e3-82b6-49fab4ebffe9}

Registry Values:
HKEY_CURRENT_USER\software\microsoft\internet explorer\main
HKEY_CURRENT_USER\software\microsoft\internet explorer\main

---

You must clean you computer ASAP !!!
Download Free Trial Version of antivirus software here, to check your computer instantly.

---

Also Be Aware of the Following Threats:
Removing Sober Trojan

SeekSeek Adware

How To Remove SeekSeek?
You must download trial version of "Exterminate-It" antivirus software,to check your computer instantly.

---

SeekSeek is dangerous virus:
Adware are programs that facilitate delivery for advertising content
to the user and in some cases gather information from the user's computer,
including information related to Internet browser usage or other computer habits
As this information is entered by the user, it is captured by the BHO (Browser Helper Object) and
sent back to the attacker.
Typically, keyloggers of this type will send the stolen information back to the attacker via email
or HTTP POST, which can appear suspicious.

---

---

SeekSeek Symptoms:

Files:
[%SYSTEM%]\ieasst.dll
[%SYSTEM%]\iecomp.dll
[%WINDOWS%]\system\ieasst.dll
[%WINDOWS%]\system\iecomp.dll
[%SYSTEM%]\ieasst.dll
[%SYSTEM%]\iecomp.dll
[%WINDOWS%]\system\ieasst.dll
[%WINDOWS%]\system\iecomp.dll

Registry Keys:
HKEY_CLASSES_ROOT\clsid\{5074851c-f67a-488e-a9c9-c244573f4068}
HKEY_CLASSES_ROOT\defaultsearch.seekseek
HKEY_CLASSES_ROOT\defaultsearch.seekseek.1
HKEY_CLASSES_ROOT\interface\{39341eb6-c340-4f68-ab9d-ee4917309828}
HKEY_CLASSES_ROOT\software\microsoft\windows\currentversion\explorer\browser helper objects\{5074851c-f67a-488e-a9c9-c244573f4068}
HKEY_CLASSES_ROOT\typelib\{eac42c32-1fe3-4fd0-9f27-e7f9ccf5fcd9}
HKEY_LOCAL_MACHINE\software\classes\clsid\{5074851c-f67a-488e-a9c9-c244573f4068}
HKEY_LOCAL_MACHINE\software\classes\typelib\{97b4f55a-b1f8-41f3-8a4e-7844d03d9242}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{df042e4a-5577-4d32-9305-442923d7838b}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{5074851c-f67a-488e-a9c9-c244573f4068}

Registry Values:
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\moduleusage\[%WINDOWS%]/downloaded program files/uninstall_ds.ocx
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\moduleusage\[%WINDOWS%]/downloaded program files/uninstall_ds.ocx
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run

---

You must clean you computer ASAP !!!
Download Free Trial Version of antivirus software here, to check your computer instantly.

---

Also Be Aware of the Following Threats:
Remove PSW.Lmir.ec Trojan
Biene Trojan Removal
IRC.Posix Backdoor Symptoms
SillyDl.CXC Trojan Information

Netrunner Trojan

How To Remove Netrunner?
You must download trial version of "Exterminate-It" antivirus software,to check your computer instantly.

---

Netrunner is dangerous virus:
This category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.
Backdoors are the most dangerous type of Trojans and the most popular.
Backdoors open infected machines to external control via Internet.
They function in the same way as legal remote administration programs used by system administrators.
This makes them difficult to detect.

Backdoors are installed and launched without the consent of the user of computer.
Often the backdoor will not be visible in the log of active programs.

Once a backdoor has been successfully launched, the computer is wide open.
Backdoor functions can include:

• Launching/ deleting files


• Sending/ receiving files


• Deleting data


• Displaying notification


• Rebooting the machine


• Executing files

Backdoors are used by virus writers to detect and download confidential information,
execute malicious code, destroy data, include the machine in bot networks and so forth.
Backdoors combine the functionality of most other types of in one package.

Backdoors have one especially dangerous sub-class: variants that can propagate like worms.
Some RAT trojans are pranks that are most likely being controlled by a friend or enemy on
April Fool's day or a holiday. Prank RATS are generally not harmful, and won't log keystrokes or hack.

---

---

Netrunner It also known as:

[Kaspersky]Backdoor.NetRunner.20;
[Eset]Win32/NetRunner.20 trojan;
[Panda]Backdoor Program;
[Computer Associates]Backdoor/NetRunner.20!Server

---

Netrunner Symptoms:

Registry Values:
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run

---

You must clean you computer ASAP !!!
Download Free Trial Version of antivirus software here, to check your computer instantly.

---

Also Be Aware of the Following Threats:
W95.Kenston Trojan Removal instruction
Removing AOKilla Trojan
visiostats.com Tracking Cookie Removal instruction
Remove Destruction DoS
Removing Cam2Ftp Trojan

VB.lj Trojan

How To Remove VB.lj?
You must download trial version of "Exterminate-It" antivirus software,to check your computer instantly.

---

VB.lj is dangerous virus:
This category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

---

---

VB.lj Symptoms:

Files:
[%PROFILE_TEMP%]\CSERVER.exe
[%DESKTOP%]\crack-inf.exe
[%PROFILE_TEMP%]\CSERVER.exe
[%DESKTOP%]\crack-inf.exe

---

You must clean you computer ASAP !!!
Download Free Trial Version of antivirus software here, to check your computer instantly.

---

Also Be Aware of the Following Threats:
Removing W95.CIH Trojan

Emptybase Trojan

How To Remove Emptybase?
You must download trial version of "Exterminate-It" antivirus software,to check your computer instantly.

---

Emptybase is dangerous virus:
This loose category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

Multi-purpose Trojans are also included in this group, as some virus writers
create multi-functional Trojans rather than Trojan packs.
Spyware can even change computer settings, resulting in slow connection speeds,
different home pages, and loss of Internet or other programs.
In an attempt to increase the understanding of spyware, a more formal classification
of its included software types is captured under the term privacy-invasive software.

---

---

Emptybase It also known as:

[Kaspersky]Trojan-Downloader.Win32.Small.ehe,Trojan-Spy.Win32.Small.gv;
[McAfee]Generic PWS.o;
[F-Prot]W32/TrojanX.XYU;
[Other]Win32/Emptybase.E,Win32/Emptybase.F,Infostealer,Win32/Emptybase.I,Troj/BHO-DB,Infostealer.Nuklus,TrojanSpy:Win32/Small.DH,W32/Smalltroj.BJXE,TSPY_SMALL.IIY,Mal/EncPk-AY

---

Emptybase Symptoms:

Files:
[%SYSTEM%]\gdid32.dll
[%SYSTEM%]\mt_32.dll
[%SYSTEM%]\protect.dll
[%SYSTEM%]\winload.dll
[%SYSTEM%]\cbrowse.dll
[%SYSTEM%]\credigui.dll
[%SYSTEM%]\dcphnet.dll
[%SYSTEM%]\ftpsystem.dll
[%SYSTEM%]\iphelp.dll
[%SYSTEM%]\mscert.dll
[%SYSTEM%]\netd.dll
[%SYSTEM%]\psx.dll
[%SYSTEM%]\pxcrt.dll
[%SYSTEM%]\rcpdu.dll
[%SYSTEM%]\rsh.dll
[%SYSTEM%]\winsoft.nls
[%SYSTEM%]\yatool.dll
[%SYSTEM%]\gdid32.dll
[%SYSTEM%]\mt_32.dll
[%SYSTEM%]\protect.dll
[%SYSTEM%]\winload.dll
[%SYSTEM%]\cbrowse.dll
[%SYSTEM%]\credigui.dll
[%SYSTEM%]\dcphnet.dll
[%SYSTEM%]\ftpsystem.dll
[%SYSTEM%]\iphelp.dll
[%SYSTEM%]\mscert.dll
[%SYSTEM%]\netd.dll
[%SYSTEM%]\psx.dll
[%SYSTEM%]\pxcrt.dll
[%SYSTEM%]\rcpdu.dll
[%SYSTEM%]\rsh.dll
[%SYSTEM%]\winsoft.nls
[%SYSTEM%]\yatool.dll

Registry Keys:
HKEY_CLASSES_ROOT\clsid\{3c49ddac-3da4-4743-af6c-5974feaf875c}
HKEY_CLASSES_ROOT\clsid\{54c7d1dd-4296-451e-b756-1e94f665b4ff}
HKEY_CLASSES_ROOT\ya.t00lbar
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{3c49ddac-3da4-4743-af6c-5974feaf875c}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{54c7d1dd-4296-451e-b756-1e94f665b4ff}

Registry Values:
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler

---

You must clean you computer ASAP !!!
Download Free Trial Version of antivirus software here, to check your computer instantly.

---

Also Be Aware of the Following Threats:
Maxifiles Adware Removal instruction
Removing Bailey Trojan
Removing Yewbdown Trojan

ActiveSearch Adware

How To Remove ActiveSearch?
You must download trial version of "Exterminate-It" antivirus software,to check your computer instantly.

---

ActiveSearch is dangerous virus:
Adware are programs that facilitate delivery for advertising content
to the user and in some cases gather information from the user's computer,
including information related to Internet browser usage or other computer habits
Toolbar presents itself as a helpful add-on for Internet Explorer but it is a real pest.
It replaces your start page, continuosly open a number of pop up windows and so on.

---

---

ActiveSearch Symptoms:

Folders:
[%PROGRAM_FILES%]\411ferret

Registry Keys:
HKEY_CLASSES_ROOT\clsid\{12f02779-6d88-4958-8ad3-83c12d86adc7}
HKEY_CLASSES_ROOT\typelib\{b36cb30a-6ed9-4c62-9a8a-7de9fa234608}
HKEY_CURRENT_USER\software\btb\ietoolbar
HKEY_CLASSES_ROOT\btb.ietoolbar
HKEY_CLASSES_ROOT\btb.ietoolbar.1
HKEY_CLASSES_ROOT\toolbarbesttoolbarstoolbar.besttoolbarstoolbarobeject
HKEY_CLASSES_ROOT\toolbarbesttoolbarstoolbar.besttoolbarstoolbarobeject.1
HKEY_CURRENT_USER\software\microsoft\internet explorer\menuext\&411 ferret toolbar search
HKEY_CURRENT_USER\software\microsoft\internet explorer\toolbar\webbrowser\{12f02779-6d88-4958-8ad3-83c12d86adc7}
HKEY_CURRENT_USER\software\microsoft\internet explorer\urlsearchhooks\{12f02779-6d88-4958-8ad3-83c12d86adc7}
HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\toolbar\{12f02779-6d88-4958-8ad3-83c12d86adc7}

Registry Values:
HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\toolbar
HKEY_CURRENT_USER\software\microsoft\internet explorer\toolbar\webbrowser
HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\toolbar

---

You must clean you computer ASAP !!!
Download Free Trial Version of antivirus software here, to check your computer instantly.

---

Also Be Aware of the Following Threats:
ColumbiaHouse.com Tracking Cookie Cleaner

Small.fl Trojan

How To Remove Small.fl?
You must download trial version of "Exterminate-It" antivirus software,to check your computer instantly.

---

Small.fl is dangerous virus:
This loose category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

Multi-purpose Trojans are also included in this group, as some virus writers
create multi-functional Trojans rather than Trojan packs.

---

---

Small.fl Symptoms:

Files:
[%PROFILE%]\applic~1\wa_inst.exe
[%PROFILE%]\progra~1\thsfrlydcrst.lib
[%PROFILE%]\progra~1\wa_inst.exe
[%PROFILE%]\progra~1\yshthfblztr.dll
[%PROGRAM_FILES%]\antico~1\film.exe
[%PROGRAM_FILES%]\antico~1\waybait.exe
[%PROGRAM_FILES%]\fivefind\antedefault.dll
[%PROGRAM_FILES%]\log2do~1\audio dumb.exe
[%PROGRAM_FILES%]\log2do~1\binsect.exe
[%PROGRAM_FILES%]\log2do~1\bits.exe
[%PROGRAM_FILES%]\onesoa~1\play.exe
[%PROFILE%]\applic~1\wa_inst.exe
[%PROFILE%]\progra~1\thsfrlydcrst.lib
[%PROFILE%]\progra~1\wa_inst.exe
[%PROFILE%]\progra~1\yshthfblztr.dll
[%PROGRAM_FILES%]\antico~1\film.exe
[%PROGRAM_FILES%]\antico~1\waybait.exe
[%PROGRAM_FILES%]\fivefind\antedefault.dll
[%PROGRAM_FILES%]\log2do~1\audio dumb.exe
[%PROGRAM_FILES%]\log2do~1\binsect.exe
[%PROGRAM_FILES%]\log2do~1\bits.exe
[%PROGRAM_FILES%]\onesoa~1\play.exe

Folders:
[%PROGRAM_FILES%]\paintingroom
[%APPDATA%]\grey style help
[%APPDATA%]\softeggsbait2
[%PROFILE%]\applic~1\audioa~1
[%PROGRAM_FILES%]\grey style help

Registry Keys:
HKEY_CLASSES_ROOT\clsid\{fe8aca46-adf0-4785-b550-89762dc330e6}
HKEY_CLASSES_ROOT\interface\{e29be7f1-e2d8-4036-91ce-c3f8aac42495}
HKEY_CLASSES_ROOT\paintingroomclasses.animatedicon
HKEY_CLASSES_ROOT\paintingroomclasses.animatedicon.1
HKEY_CLASSES_ROOT\typelib\{979c2ead-48cb-454a-adfa-a123158dd508}
HKEY_CURRENT_USER\software\paintingroom
HKEY_CLASSES_ROOT\clsid\{7ed16894-5097-7a34-ca64-b62edc94c43f}
HKEY_CLASSES_ROOT\clsid\{dfcafadd-c370-d67c-41ad-bf0e262df349}
HKEY_CURRENT_USER\software\booblogacid
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\uninstall\burnsixthenc
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{dfcafadd-c370-d67c-41ad-bf0e262df349}
HKEY_LOCAL_MACHINE\software\paintingroom

Registry Values:
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run

---

You must clean you computer ASAP !!!
Download Free Trial Version of antivirus software here, to check your computer instantly.

---

Also Be Aware of the Following Threats:
Pigeon.AKC Trojan Information
Remove Mabul Trojan
Masters.Paradise.Angel Trojan Symptoms

CProc Downloader

How To Remove CProc?
You must download trial version of "Exterminate-It" antivirus software,to check your computer instantly.

---

CProc is dangerous virus:
This family of Trojans downloads and installs new malware or adware on the computer.
The downloader then either launches the new malware or registers it to enable autorun
according to the local operating system requirements.

The names and locations of malware to be downloaded are either coded into the
Trojan or downloaded from a specified website.

---

---

CProc It also known as:

[Kaspersky]Trojan-Downloader.MSIL.Agent.c;
[Other]Adware.TargetSaver

---

CProc Symptoms:

Files:
[%SYSTEM%]\crunner\cproc.exe
[%SYSTEM%]\crunner\cupdater.exe
[%SYSTEM%]\crunner\cproc.exe
[%SYSTEM%]\crunner\cupdater.exe

Folders:
[%SYSTEM%]\crunner

Registry Values:
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run
HKEY_CURRENT_USER\software\classes\clsid\{f4c4d3ae-0bb0-1033-0729-050001}
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run

---

You must clean you computer ASAP !!!
Download Free Trial Version of antivirus software here, to check your computer instantly.

---

Also Be Aware of the Following Threats:
Bancos.HKW Trojan Cleaner
PWS.Algus Trojan Cleaner
Java.ClassLoader Trojan Removal

Grokster Adware

How To Remove Grokster?
You must download trial version of "Exterminate-It" antivirus software,to check your computer instantly.

---

Grokster is dangerous virus:
Adware are programs that facilitate delivery for advertising content
to the user and in some cases gather information from the user's computer,
including information related to Internet browser usage or other computer habits
Worms can be classified according to the propagation method they use,
i.e. how they deliver copies of themselves to new victim machines.
Worms can also be classified by installation method, launch method and finally according
to characteristics standard to all malware: polymorphism, stealth etc.

Many of the worms which managed to cause significant outbreaks use more then
one propagation method as well as more than one infection technique.
The methods are listed separately below.
Hijackers are software programs that modify users' default browser home page,
search settings, error page settings, or desktop wallpaper without adequate notice, disclosure,
or user consent.
Toolbar presents itself as a helpful add-on for Internet Explorer but it is a real pest.

---

---

Grokster It also known as:

[F-Prot]->license.txt;
[Panda]Adware/MoeMoney,Adware/PurityScan,Adware/TopMoxie;
[Other]PurityScan

---

Grokster Symptoms:

Files:
[%DESKTOP%]\get $10 free now at zodiac casino.url
[%DESKTOP%]\high rollers club casino.url
[%DESKTOP%]\my grokster files.lnk
[%DESKTOP%]\my grokster.lnk
[%DESKTOP%]\spors interaction casino.url
[%DESKTOP%]\sportsbook.url
[%PROFILE%]\administrator\start menu\programs\grokster\check for grokster updates.lnk
[%PROFILE%]\administrator\start menu\programs\grokster\grokster on the web.lnk
[%PROFILE%]\administrator\start menu\programs\grokster\launch grokster.lnk
[%PROFILE%]\administrator\start menu\programs\grokster\my grokster files.lnk
[%PROFILE%]\administrator\start menu\sportsbook.url
[%PROFILE_TEMP%]\cpr_in.exe
[%PROFILE_TEMP%]\ferretbar.exe
[%PROFILE_TEMP%]\grokstersetup.exe
[%PROFILE_TEMP%]\inst_bpc.exe
[%PROFILE_TEMP%]\searchlocate.exe
[%PROFILE_TEMP%]\supportinstall.exe
[%PROFILE_TEMP%]\sysren.exe
[%PROGRAMS%]\grokster\check for grokster updates.lnk
[%PROGRAMS%]\grokster\grokster on the web.lnk
[%PROGRAMS%]\grokster\launch grokster.lnk
[%PROGRAMS%]\grokster\my grokster files.lnk
[%PROGRAMS%]\grokster\uninstall grokster.lnk
[%STARTUP%]\update grokster.lnk
[%SYSTEM%]\gr03.dll
[%SYSTEM%]\gr0ck03.dll
[%WINDOWS%]\cache371\b_371_0_1_503300.htm
[%WINDOWS%]\cache371\b_371_0_1_523000.htm
[%WINDOWS%]\cache371\b_371_0_1_532400.htm
[%WINDOWS%]\cache371\b_371_0_1_534700.htm
[%WINDOWS%]\cache371\b_371_0_1_537300.htm
[%WINDOWS%]\cache371\b_525100.htm
[%WINDOWS%]\cache371\b_561000.htm
[%WINDOWS%]\cache371\t_b_371_2_1_577800.htm
[%WINDOWS%]\cache371\t_b_371_2_1_755100.htm
[%WINDOWS%]\cache371\t_b_371_2_2_568100.htm
[%WINDOWS%]\cache371\t_b_371_2_2_570100.htm
[%WINDOWS%]\cache371\t_b_371_2_2_572300.htm
[%WINDOWS%]\cache371\t_b_371_2_2_573900.htm
[%WINDOWS%]\cache371\t_b_371_2_2_576000.htm
[%WINDOWS%]\cache371\t_b_371_2_2_703900.htm
[%WINDOWS%]\cache371\t_b_371_2_3_778600.htm
[%WINDOWS%]\cache371\t_b_501000.htm
[%WINDOWS%]\cache371\t_b_525100.htm
[%WINDOWS%]\cache371\t_b_561000.htm
[%WINDOWS%]\cache371\t_b_605600.htm
[%WINDOWS%]\cache371\t_b_605800.htm
[%DESKTOP%]\get $10 free now at zodiac casino.url
[%DESKTOP%]\high rollers club casino.url
[%DESKTOP%]\my grokster files.lnk
[%DESKTOP%]\my grokster.lnk
[%DESKTOP%]\spors interaction casino.url
[%DESKTOP%]\sportsbook.url
[%PROFILE%]\administrator\start menu\programs\grokster\check for grokster updates.lnk
[%PROFILE%]\administrator\start menu\programs\grokster\grokster on the web.lnk
[%PROFILE%]\administrator\start menu\programs\grokster\launch grokster.lnk
[%PROFILE%]\administrator\start menu\programs\grokster\my grokster files.lnk
[%PROFILE%]\administrator\start menu\sportsbook.url
[%PROFILE_TEMP%]\cpr_in.exe
[%PROFILE_TEMP%]\ferretbar.exe
[%PROFILE_TEMP%]\grokstersetup.exe
[%PROFILE_TEMP%]\inst_bpc.exe
[%PROFILE_TEMP%]\searchlocate.exe
[%PROFILE_TEMP%]\supportinstall.exe
[%PROFILE_TEMP%]\sysren.exe
[%PROGRAMS%]\grokster\check for grokster updates.lnk
[%PROGRAMS%]\grokster\grokster on the web.lnk
[%PROGRAMS%]\grokster\launch grokster.lnk
[%PROGRAMS%]\grokster\my grokster files.lnk
[%PROGRAMS%]\grokster\uninstall grokster.lnk
[%STARTUP%]\update grokster.lnk
[%SYSTEM%]\gr03.dll
[%SYSTEM%]\gr0ck03.dll
[%WINDOWS%]\cache371\b_371_0_1_503300.htm
[%WINDOWS%]\cache371\b_371_0_1_523000.htm
[%WINDOWS%]\cache371\b_371_0_1_532400.htm
[%WINDOWS%]\cache371\b_371_0_1_534700.htm
[%WINDOWS%]\cache371\b_371_0_1_537300.htm
[%WINDOWS%]\cache371\b_525100.htm
[%WINDOWS%]\cache371\b_561000.htm
[%WINDOWS%]\cache371\t_b_371_2_1_577800.htm
[%WINDOWS%]\cache371\t_b_371_2_1_755100.htm
[%WINDOWS%]\cache371\t_b_371_2_2_568100.htm
[%WINDOWS%]\cache371\t_b_371_2_2_570100.htm
[%WINDOWS%]\cache371\t_b_371_2_2_572300.htm
[%WINDOWS%]\cache371\t_b_371_2_2_573900.htm
[%WINDOWS%]\cache371\t_b_371_2_2_576000.htm
[%WINDOWS%]\cache371\t_b_371_2_2_703900.htm
[%WINDOWS%]\cache371\t_b_371_2_3_778600.htm
[%WINDOWS%]\cache371\t_b_501000.htm
[%WINDOWS%]\cache371\t_b_525100.htm
[%WINDOWS%]\cache371\t_b_561000.htm
[%WINDOWS%]\cache371\t_b_605600.htm
[%WINDOWS%]\cache371\t_b_605800.htm

Folders:
[%PROFILE%]\documents\softwrap\groksterfrtrial1
[%PROFILE%]\start menu\programs\grokster
[%PROGRAM_FILES%]\gatinst
[%PROGRAM_FILES%]\grokster
[%PROGRAM_FILES%]\grokstersupport

Registry Keys:
HKEY_CLASSES_ROOT\bidll.bidllobj.1
HKEY_CLASSES_ROOT\clsid\{952ec978-4920-4f18-8237-91d69b54c580}
HKEY_CLASSES_ROOT\clsid\{d6ca5d91-5ea2-4654-9b75-499267012611}
HKEY_CLASSES_ROOT\interface\{43e7f027-c2d6-41b3-a5de-261e0e42211c}
HKEY_CLASSES_ROOT\interface\{92b1c4ac-39a6-469c-a1e4-bd3ddc6f8425}
HKEY_CLASSES_ROOT\magnet
HKEY_CLASSES_ROOT\signingmodule.signingmodule
HKEY_CLASSES_ROOT\signingmodule.signingmodule.1
HKEY_CLASSES_ROOT\typelib\{5830698f-7fc0-40cd-a453-9a0cafdf3a64}
HKEY_CLASSES_ROOT\typelib\{676f6d1d-c559-42a9-860b-27c1477b7179}
HKEY_CLASSES_ROOT\typelib\{c03ec1bf-654e-4b01-bd4e-0902ad31f8c6}
HKEY_CURRENT_USER\software\grokster
HKEY_LOCAL_MACHINE\software\grokster
HKEY_LOCAL_MACHINE\software\microsoft\mediaplayer\shimexclusionlist\grokster.exe
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\grokster
HKEY_LOCAL_MACHINE\software\wast
HKEY_LOCAL_MACHINE\software\wise solutions\wiseupdate\apps\grokster

Registry Values:
HKEY_CURRENT_USER\software\appconf
HKEY_CURRENT_USER\software\microsoft\internet explorer\toolbar\webbrowser
HKEY_CURRENT_USER\software\softomate\batoolbar
HKEY_CURRENT_USER\software\softomate\batoolbar
HKEY_CURRENT_USER\software\softomate\batoolbar
HKEY_CURRENT_USER\software\softomate\batoolbar
HKEY_CURRENT_USER\software\softomate\batoolbar
HKEY_CURRENT_USER\software\softomate\batoolbar
HKEY_LOCAL_MACHINE\software\dvx
HKEY_LOCAL_MACHINE\software\dvx
HKEY_LOCAL_MACHINE\software\dvx
HKEY_LOCAL_MACHINE\software\dvx
HKEY_LOCAL_MACHINE\software\dvx
HKEY_LOCAL_MACHINE\software\lnplpp
HKEY_LOCAL_MACHINE\software\lnplpp
HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\explorer bars
HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\main
HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\toolbar
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\control panel\cpls
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\installer\userdata\s-1-5-18\products\c8d617f6f8933d11581e000540386890\usage
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\relevantknowledge
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\relevantknowledge
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\toolbarbesttoolbarstoolbar.besttoolbarstoolbarobjectietoolbar
HKEY_LOCAL_MACHINE\software\sys ren
HKEY_LOCAL_MACHINE\software\sys ren
HKEY_LOCAL_MACHINE\software\sys ren
HKEY_LOCAL_MACHINE\software\sys ren
HKEY_LOCAL_MACHINE\software\sys ren
HKEY_LOCAL_MACHINE\software\sys ren
HKEY_LOCAL_MACHINE\software\sys ren
HKEY_LOCAL_MACHINE\software\sys ren
HKEY_LOCAL_MACHINE\software\wise solutions\wiseupdate\apppaths

---

You must clean you computer ASAP !!!
Download Free Trial Version of antivirus software here, to check your computer instantly.

---

Also Be Aware of the Following Threats:
Bonus.joke Trojan Removal instruction
Death.For.All Trojan Symptoms
Remove Bancos.GUF Trojan
BackDoor.AFF Trojan Removal instruction
Remove TrojanDownloader.Win32.VB.cn Downloader

Clspring Trojan

How To Remove Clspring?
You must download trial version of "Exterminate-It" antivirus software,to check your computer instantly.

---

Clspring is dangerous virus:
This category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.
The BHO (Browser Helper Object) waits for the user to post personal information to a monitored website.
As this information is entered by the user, it is captured by the BHO and sent back to the attacker.

---

---

Clspring It also known as:

[Kaspersky]AdWare.Win32.PrutiyScan.ak,AdWare.Win32.PurityScan.ak,Trojan-Downloader.Win32.PurityScan.cl,Trojan-Downloader.Win32.PurityScan.eb,AdWare.Win32.PurityScan.gl;
[McAfee]Adware-ClickSpring;
[Other]Win32/Clspring.GB,Adware.Purityscan,Win32/Clspring.FZ,Adware.PurityScan,ClickSpring.PuritySCAN,purityscan,Win32/Clspring.GG,ClickSpring,Win32/Clspring.GR,Win32/Clspring.GW,Troj/PurScan-BE,Win32/Clspring!generic,Adware:Win32/ClickSpring.PuritySCAN,Win32/Clspring.GZ,Trojan.Adclicker

---

Clspring Symptoms:

Files:
[%APPDATA%]\CROSOF~1.NET\msconfig.exe
[%APPDATA%]\FNTS~1\msiexec.exe
[%APPDATA%]\YMBOLS~1\lsass.exe
[%INTERNET_CACHE%]\Content.IE5\4LM3S9IZ\116[1].net
[%INTERNET_CACHE%]\Content.IE5\5461ZY3K\!update-4395[1].0000
[%INTERNET_CACHE%]\content.ie5\5MOG1H6V\!update-4395[1].0000
[%INTERNET_CACHE%]\content.ie5\DSUZ3EO9\!update-4395[1].0000
[%INTERNET_CACHE%]\Content.IE5\KLYBC1E3\!update-4395[1].0000
[%PROFILE_TEMP%]\!update.exe
[%PROFILE_TEMP%]\!update.exe.ren
[%PROFILE_TEMP%]\b116.exe
[%PROFILE_TEMP%]\sdexe.exe
[%PROFILE_TEMP%]\YazzleBundle-1281.exe
[%PROFILE_TEMP%]\yazzlesnet.exe
[%PROGRAM_FILES%]\ASEMBL~1\nopdb.exe
[%PROGRAM_FILES%]\RACLE~1\tracert.exe
[%PROGRAM_FILES_COMMON%]\%A5%CCICRO~1.NET\svchost.exe
[%PROGRAM_FILES_COMMON%]\ASEMBL~1\services.exe
[%SYSTEM%]\ICROSO~1.NET\lsass.exe
[%SYSTEM%]\ICROSO~1.NET\tracert.exe
[%SYSTEM%]\regedit.dll
[%SYSTEM%]\smss.dll
[%SYSTEM%]\SSTEM3~1\dexplore.exe
[%SYSTEM%]\wuauboot.dll
[%WINDOWS%]\CROSOF~1.NET\winlogon.exe
[%WINDOWS%]\YAXUninst.exe
[%SYSTEM%]\Outerinfo-1199.exe
[%APPDATA%]\CROSOF~1.NET\msconfig.exe
[%APPDATA%]\FNTS~1\msiexec.exe
[%APPDATA%]\YMBOLS~1\lsass.exe
[%INTERNET_CACHE%]\Content.IE5\4LM3S9IZ\116[1].net
[%INTERNET_CACHE%]\Content.IE5\5461ZY3K\!update-4395[1].0000
[%INTERNET_CACHE%]\content.ie5\5MOG1H6V\!update-4395[1].0000
[%INTERNET_CACHE%]\content.ie5\DSUZ3EO9\!update-4395[1].0000
[%INTERNET_CACHE%]\Content.IE5\KLYBC1E3\!update-4395[1].0000
[%PROFILE_TEMP%]\!update.exe
[%PROFILE_TEMP%]\!update.exe.ren
[%PROFILE_TEMP%]\b116.exe
[%PROFILE_TEMP%]\sdexe.exe
[%PROFILE_TEMP%]\YazzleBundle-1281.exe
[%PROFILE_TEMP%]\yazzlesnet.exe
[%PROGRAM_FILES%]\ASEMBL~1\nopdb.exe
[%PROGRAM_FILES%]\RACLE~1\tracert.exe
[%PROGRAM_FILES_COMMON%]\%A5%CCICRO~1.NET\svchost.exe
[%PROGRAM_FILES_COMMON%]\ASEMBL~1\services.exe
[%SYSTEM%]\ICROSO~1.NET\lsass.exe
[%SYSTEM%]\ICROSO~1.NET\tracert.exe
[%SYSTEM%]\regedit.dll
[%SYSTEM%]\smss.dll
[%SYSTEM%]\SSTEM3~1\dexplore.exe
[%SYSTEM%]\wuauboot.dll
[%WINDOWS%]\CROSOF~1.NET\winlogon.exe
[%WINDOWS%]\YAXUninst.exe
[%SYSTEM%]\Outerinfo-1199.exe

Folders:
[%PROGRAMS%]\Outerinfo
[%PROGRAM_FILES%]\Outerinfo

Registry Keys:
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\outerinfo
HKEY_CLASSES_ROOT\clsid\{2e9d4c81-9f27-4c14-b804-7b0f6bc88a4f}
HKEY_CLASSES_ROOT\clsid\{55bb27b1-b15e-b2df-2c22-bcce64b8e8b7}
HKEY_CLASSES_ROOT\clsid\{661d9ab6-595d-0b89-2bc2-0295c1a289b1}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{2e9d4c81-9f27-4c14-b804-7b0f6bc88a4f}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{55bb27b1-b15e-b2df-2c22-bcce64b8e8b7}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{661d9ab6-595d-0b89-2bc2-0295c1a289b1}
HKEY_LOCAL_MACHINE\software\outerinfo

Registry Values:
HKEY_CURRENT_USER\software\microsoft\internet explorer\urlsearchhooks
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run
HKEY_CURRENT_USER\software\mozilla\firefox\extensions

---

You must clean you computer ASAP !!!
Download Free Trial Version of antivirus software here, to check your computer instantly.

---

Also Be Aware of the Following Threats:
Remove Pathhunt Trojan

Win32.TrojanDownloader.Rameh Trojan

How To Remove Win32.TrojanDownloader.Rameh?
You must download trial version of "Exterminate-It" antivirus software,to check your computer instantly.

---

Win32.TrojanDownloader.Rameh is dangerous virus:
This category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.
Trojans-downloaders downloads and installs new malware or adware on the computer.

---

---

Win32.TrojanDownloader.Rameh It also known as:

[Kaspersky]TrojanDownloader.Win32.Rameh.c;
[Eset]Win32/TrojanDownloader.Rameh.C trojan;
[Panda]Adware/NetPals

---

Win32.TrojanDownloader.Rameh Symptoms:

Files:
[%PROFILE_TEMP%]\ICD2.tmp\ATPartners.inf
[%PROFILE_TEMP%]\ICD3.tmp\ATPartners.inf
[%PROFILE_TEMP%]\ICD4.tmp\ATPartners.inf
[%SYSTEM%]\ATPartners.dll
[%SYSTEM%]\atpart~1.dll
[%WINDOWS%]\Downloaded Program Files\ATPartners.inf
[%WINDOWS%]\system\atpart~1.dll
[%PROFILE_TEMP%]\ICD2.tmp\ATPartners.inf
[%PROFILE_TEMP%]\ICD3.tmp\ATPartners.inf
[%PROFILE_TEMP%]\ICD4.tmp\ATPartners.inf
[%SYSTEM%]\ATPartners.dll
[%SYSTEM%]\atpart~1.dll
[%WINDOWS%]\Downloaded Program Files\ATPartners.inf
[%WINDOWS%]\system\atpart~1.dll

---

You must clean you computer ASAP !!!
Download Free Trial Version of antivirus software here, to check your computer instantly.

---

Also Be Aware of the Following Threats:
Bancos.MV!downloader Trojan Symptoms
BAT.BWG Trojan Symptoms
SubSearch Adware Information
Removing Pigeon.AVOO Trojan

3wPlayer Adware

How To Remove 3wPlayer?
You must download trial version of "Exterminate-It" antivirus software,to check your computer instantly.

---

3wPlayer is dangerous virus:
Adware are programs that facilitate delivery for advertising content
to the user and in some cases gather information from the user's computer.

---

---

3wPlayer Symptoms:

Files:
[%DESKTOP%]\3wPlayer.lnk
[%DESKTOP%]\3wPlayer.lnk

Folders:
[%COMMON_PROGRAMS%]\3wPlayer
[%PROGRAM_FILES%]\3wPlayer

Registry Keys:
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\menuorder\start menu\programs\3wplayer
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\3wplayer_is1

Registry Values:
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run

---

You must clean you computer ASAP !!!
Download Free Trial Version of antivirus software here, to check your computer instantly.

---

Also Be Aware of the Following Threats:
ARM Trojan Removal instruction
Removing Backage.Server Trojan
Shark Trojan Cleaner
Remove Gaban.Bus RAT

Matite Downloader

How To Remove Matite?
You must download trial version of "Exterminate-It" antivirus software,to check your computer instantly.

---

Matite is dangerous virus:
The downloader either launches the new malware or registers it to enable autorun
according to the local operating system requirements.
These utilities are designed to penetrate remote computers
in order to use them as zombies (by using backdoors) or to download other malicious programs to computer.

Exploits use vulnerabilities in operating systems and applications to achieve the same result.

---

---

Matite Symptoms:

Files:
[%WINDOWS%]\system\portconfig.exe
[%WINDOWS%]\system\portconfig.exe

---

You must clean you computer ASAP !!!
Download Free Trial Version of antivirus software here, to check your computer instantly.

---

Also Be Aware of the Following Threats:
Pigeon.EPE Trojan Removal

Husrtdo Trojan

How To Remove Husrtdo?
You must download trial version of "Exterminate-It" antivirus software,to check your computer instantly.

---

Husrtdo is dangerous virus:
This loose category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

Multi-purpose Trojans are also included in this group, as some virus writers
create multi-functional Trojans rather than Trojan packs.

---

---

Husrtdo It also known as:

[Kaspersky]Trojan.Win32.Delf.ada;
[McAfee]Spy-Agent.ch;
[Other]Win32/Husrtdo.A

---

Husrtdo Symptoms:

Files:
[%SYSTEM%]\almqe.exe
[%SYSTEM%]\almqe.dll
[%SYSTEM%]\nekyn.kjm
[%SYSTEM%]\almqe.exe
[%SYSTEM%]\almqe.dll
[%SYSTEM%]\nekyn.kjm

Registry Keys:
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{tlqmpgcq-jyvu-pfap-hqmu-jnflywibhmkb}

Registry Values:
HKEY_CURRENT_USER\software\adobe\ialc
HKEY_CURRENT_USER\software\adobe\ialc

---

You must clean you computer ASAP !!!
Download Free Trial Version of antivirus software here, to check your computer instantly.

---

Also Be Aware of the Following Threats:
Urname Hostile Code Information
MalwareDestructor Ransomware Removal
Gator.GAIN.Claria Adware Cleaner

OneStep.Search Toolbar

How To Remove OneStep.Search?
You must download trial version of "Exterminate-It" antivirus software,to check your computer instantly.

---

OneStep.Search is dangerous virus:
Toolbar presents itself as a helpful add-on for Internet Explorer but it is a real pest.

---

---

OneStep.Search Symptoms:

Folders:
[%PROGRAM_FILES%]\OneStepSearch

Registry Keys:
HKEY_CURRENT_USER\software\microsoft\internet explorer\searchscopes\{5b4c3b43-49b6-42a7-a602-f7acdca0d409}
HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\searchscopes\{5b4c3b43-49b6-42a7-a602-f7acdca0d409}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\onestepsearch
HKEY_LOCAL_MACHINE\software\onestepsearch
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\onestep search service

---

You must clean you computer ASAP !!!
Download Free Trial Version of antivirus software here, to check your computer instantly.

---

Also Be Aware of the Following Threats:
Remove VICE1 Trojan

Magania Trojan

How To Remove Magania?
You must download trial version of "Exterminate-It" antivirus software,to check your computer instantly.

---

Magania is dangerous virus:
This category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.
These utilities are designed to penetrate remote computers
in order to use them as zombies (by using backdoors) or to download other malicious programs to computer.

Exploits use vulnerabilities in operating systems and applications to achieve the same result.

---

---

Magania It also known as:

[Kaspersky]Trojan.Win32.Pakes;
[Other]Win32/Magania.B!Trojan,Win32/NSAnti,Trojan Horse

---

Magania Symptoms:

Registry Keys:
HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\legacy_aa1king

---

You must clean you computer ASAP !!!
Download Free Trial Version of antivirus software here, to check your computer instantly.

---

Also Be Aware of the Following Threats:
monster.com Tracking Cookie Cleaner
Removing Stats Trojan
OICQ Trojan Symptoms
Apdoor Trojan Symptoms

Transponder Malware

How To Remove Transponder?
You must download trial version of "Exterminate-It" antivirus software,to check your computer instantly.

---

Transponder is dangerous virus:
Malware includes a range of programs that do not threaten computers directly,
but are used to create viruses or Trojans, or used to carry out illegal activities
such as DoS attacks and breaking into other computers. The BHO (Browser Helper Object) waits for the user to post personal information to a monitored website.
As this information is entered by the user, it is captured by the BHO and sent back to the attacker.

---

---

Transponder Symptoms:

Files:
[%WINDOWS%]\abiuninst.htm
[%WINDOWS%]\bi.dll
[%WINDOWS%]\Biprep.exe
[%WINDOWS%]\Buddy.exe
[%WINDOWS%]\ceres.dll
[%WINDOWS%]\Downloaded Program Files\thin.inf
[%WINDOWS%]\DrUninst.exe
[%WINDOWS%]\farmmext.ini
[%WINDOWS%]\inf\biK.inf
[%WINDOWS%]\inf\ceres.inf
[%WINDOWS%]\inf\farmmext.inf
[%WINDOWS%]\inf\morphstb.inf
[%WINDOWS%]\inf\payload.inf
[%WINDOWS%]\inf\payload2.inf
[%WINDOWS%]\inf\Pynix.inf
[%WINDOWS%]\inf\Pynix.PNF
[%WINDOWS%]\inf\sprnopol.inf
[%WINDOWS%]\inf\zserv.inf
[%WINDOWS%]\morphstb.ini
[%WINDOWS%]\mxTarget.dll
[%WINDOWS%]\satmat.exe
[%WINDOWS%]\speeryox.dll
[%WINDOWS%]\voiceip.dll
[%WINDOWS%]\abiuninst.htm
[%WINDOWS%]\bi.dll
[%WINDOWS%]\Biprep.exe
[%WINDOWS%]\Buddy.exe
[%WINDOWS%]\ceres.dll
[%WINDOWS%]\Downloaded Program Files\thin.inf
[%WINDOWS%]\DrUninst.exe
[%WINDOWS%]\farmmext.ini
[%WINDOWS%]\inf\biK.inf
[%WINDOWS%]\inf\ceres.inf
[%WINDOWS%]\inf\farmmext.inf
[%WINDOWS%]\inf\morphstb.inf
[%WINDOWS%]\inf\payload.inf
[%WINDOWS%]\inf\payload2.inf
[%WINDOWS%]\inf\Pynix.inf
[%WINDOWS%]\inf\Pynix.PNF
[%WINDOWS%]\inf\sprnopol.inf
[%WINDOWS%]\inf\zserv.inf
[%WINDOWS%]\morphstb.ini
[%WINDOWS%]\mxTarget.dll
[%WINDOWS%]\satmat.exe
[%WINDOWS%]\speeryox.dll
[%WINDOWS%]\voiceip.dll

Registry Keys:
HKEY_CLASSES_ROOT\clsid\{000006b1-19b5-414a-849f-2a3c64ae6939}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{000006B1-19B5-414A-849F-2A3C64AE6939}

Registry Values:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

---

You must clean you computer ASAP !!!
Download Free Trial Version of antivirus software here, to check your computer instantly.

---

Also Be Aware of the Following Threats:
Bancos.HZC Trojan Removal
Pigeon.EWK Trojan Information

IntermixMedia.PowerSearch BHO

How To Remove IntermixMedia.PowerSearch?
You must download trial version of "Exterminate-It" antivirus software,to check your computer instantly.

---

IntermixMedia.PowerSearch is dangerous virus:
BHO (Browser Helper Object) Trojan.
The BHO waits for the user to post personal information to a monitored website.
As this information is entered by the user, it is captured by the BHO and sent back to the attacker.
The method of network transport used by the attacker makes this Trojan unique.
Typically, keyloggers of this type will send the stolen information back to the attacker via email
or HTTP POST, which can appear suspicious.
Instead, this Trojan encodes the data with a simple XOR algorithm before placing it into
the data section of an ICMP ping packet." explained the company.
Toolbar presents itself as a helpful add-on for Internet Explorer but it is a real pest.

---

---

IntermixMedia.PowerSearch Symptoms:

Files:
[%PROGRAM_FILES%]\powers~1\toolbar\pwrs0102.dll
[%SYSTEM%]\flgobar.dll
[%SYSTEM%]\infobar.dll
[%SYSTEM%]\pwrs0102.dll
[%SYSTEM%]\pwrs0104.dll
[%SYSTEM%]\pwrs0108.dll
[%SYSTEM%]\pwrs0rbi.dll
[%SYSTEM%]\pwrsaimf.dll
[%SYSTEM%]\pwrsbikd.dll
[%SYSTEM%]\pwrsc032.dll
[%SYSTEM%]\pwrscuz3.dll
[%SYSTEM%]\pwrscznc.dll
[%SYSTEM%]\pwrsqsim.dll
[%SYSTEM%]\pwrswmda.dll
[%SYSTEM%]\searchbr.dll
[%WINDOWS%]\system\flgobar.dll
[%WINDOWS%]\system\infobar.dll
[%WINDOWS%]\system\pwrs0102.dll
[%WINDOWS%]\system\pwrs0104.dll
[%WINDOWS%]\system\pwrs0108.dll
[%WINDOWS%]\system\pwrs0rbi.dll
[%WINDOWS%]\system\pwrsaimf.dll
[%WINDOWS%]\system\pwrsbikd.dll
[%WINDOWS%]\system\pwrsc032.dll
[%WINDOWS%]\system\pwrscuz3.dll
[%WINDOWS%]\system\pwrscznc.dll
[%WINDOWS%]\system\pwrsqsim.dll
[%WINDOWS%]\system\pwrswmda.dll
[%WINDOWS%]\system\searchbr.dll
[%PROGRAM_FILES%]\powers~1\toolbar\pwrs0102.dll
[%SYSTEM%]\flgobar.dll
[%SYSTEM%]\infobar.dll
[%SYSTEM%]\pwrs0102.dll
[%SYSTEM%]\pwrs0104.dll
[%SYSTEM%]\pwrs0108.dll
[%SYSTEM%]\pwrs0rbi.dll
[%SYSTEM%]\pwrsaimf.dll
[%SYSTEM%]\pwrsbikd.dll
[%SYSTEM%]\pwrsc032.dll
[%SYSTEM%]\pwrscuz3.dll
[%SYSTEM%]\pwrscznc.dll
[%SYSTEM%]\pwrsqsim.dll
[%SYSTEM%]\pwrswmda.dll
[%SYSTEM%]\searchbr.dll
[%WINDOWS%]\system\flgobar.dll
[%WINDOWS%]\system\infobar.dll
[%WINDOWS%]\system\pwrs0102.dll
[%WINDOWS%]\system\pwrs0104.dll
[%WINDOWS%]\system\pwrs0108.dll
[%WINDOWS%]\system\pwrs0rbi.dll
[%WINDOWS%]\system\pwrsaimf.dll
[%WINDOWS%]\system\pwrsbikd.dll
[%WINDOWS%]\system\pwrsc032.dll
[%WINDOWS%]\system\pwrscuz3.dll
[%WINDOWS%]\system\pwrscznc.dll
[%WINDOWS%]\system\pwrsqsim.dll
[%WINDOWS%]\system\pwrswmda.dll
[%WINDOWS%]\system\searchbr.dll

Folders:
[%PROGRAM_FILES%]\powersearch
[%PROGRAM_FILES%]\powersoft\toolbar

Registry Keys:
HKEY_CLASSES_ROOT\clsid\{bbbe1c1a-89f7-4af6-abd1-f8fbcfa47408}
HKEY_CLASSES_ROOT\accent-graphics.powersearch.2.0
HKEY_CLASSES_ROOT\clsid\{47801270-3ce6-434f-8e71-75b7e0cd64b2}
HKEY_CLASSES_ROOT\clsid\{4e7bd74f-2b8d-469e-a08d-8f6fa787ad2d}
HKEY_CLASSES_ROOT\clsid\{4e7bd74f-2b8d-469e-a08e-8e1ca787ad2d}
HKEY_CLASSES_ROOT\clsid\{4e7bd74f-2b8d-469e-a1e4-ea6fa787ad2d}
HKEY_CLASSES_ROOT\clsid\{4e7bd74f-2b8d-469e-a68e-8e1ca787ad2d}
HKEY_CLASSES_ROOT\clsid\{4e7bd74f-2b8d-469e-aa8e-8e1ca787ad2d}
HKEY_CLASSES_ROOT\clsid\{4e7bd74f-2b8d-469e-c0fc-f378a787ad2d}
HKEY_CLASSES_ROOT\clsid\{4e7bd74f-2b8d-469e-c0fc-f76fa694bf2e}
HKEY_CLASSES_ROOT\clsid\{4e7bd74f-2b8d-469e-c0ff-fd63b29bb37d}
HKEY_CLASSES_ROOT\clsid\{4e7bd74f-2b8d-469e-c0ff-fd63b399bc7d}
HKEY_CLASSES_ROOT\clsid\{4e7bd74f-2b8d-469e-d1f0-e56fa787ad2d}
HKEY_CLASSES_ROOT\clsid\{4e7bd74f-2b8d-469e-d3fa-f27ba787ad2d}
HKEY_CLASSES_ROOT\clsid\{4e7bd74f-2b8d-469e-d4f3-f66da787ad2d}
HKEY_CLASSES_ROOT\clsid\{4e7bd74f-2b8d-469e-d6f5-f66ea787ad2d}
HKEY_CLASSES_ROOT\clsid\{4e7bd74f-2b8d-469e-dbfc-ed1ca787ad2d}
HKEY_CLASSES_ROOT\clsid\{4e7bd74f-2b8d-469e-dff7-ec7da787ad2d}
HKEY_CLASSES_ROOT\clsid\{5154cbed-e3ea-4bf6-90c9-32776282076b}
HKEY_CLASSES_ROOT\software\microsoft\windows\currentversion\explorer\browser helper objects\{4e7bd74f-2b8d-469e-c0fc-f76fa694bf2e}
HKEY_CLASSES_ROOT\software\microsoft\windows\currentversion\explorer\browser helper objects\{4e7bd74f-2b8d-469e-d6f5-f66ea787ad2d}
HKEY_CLASSES_ROOT\software\microsoft\windows\currentversion\explorer\browser helper objects\{4e7bd74f-2b8d-469e-dff7-ec7da787ad2d}
HKEY_CLASSES_ROOT\toolband.xbtb03439
HKEY_CLASSES_ROOT\toolband.xbtb03439.1
HKEY_CLASSES_ROOT\typelib\{d737944e-4270-4774-b3ce-062fa7369a23}
HKEY_CLASSES_ROOT\xbtb03439.ietoolbar
HKEY_CLASSES_ROOT\xbtb03439.ietoolbar.1
HKEY_CLASSES_ROOT\xbtb03439.xbtb03439.1
HKEY_CURRENT_USER\software\xbtb03439\toolbar
HKEY_LOCAL_MACHINE\software\classes\clsid\{4e7bd74f-2b8d-469e-a08d-8f6fa787ad2d}
HKEY_LOCAL_MACHINE\software\classes\clsid\{4e7bd74f-2b8d-469e-a08e-8e1ca787ad2d}
HKEY_LOCAL_MACHINE\software\classes\clsid\{4e7bd74f-2b8d-469e-a1e4-ea6fa787ad2d}
HKEY_LOCAL_MACHINE\software\classes\clsid\{4e7bd74f-2b8d-469e-a68e-8e1ca787ad2d}
HKEY_LOCAL_MACHINE\software\classes\clsid\{4e7bd74f-2b8d-469e-aa8e-8e1ca787ad2d}
HKEY_LOCAL_MACHINE\software\classes\clsid\{4e7bd74f-2b8d-469e-c0fc-f378a787ad2d}
HKEY_LOCAL_MACHINE\software\classes\clsid\{4e7bd74f-2b8d-469e-c0fc-f76fa694bf2e}
HKEY_LOCAL_MACHINE\software\classes\clsid\{4e7bd74f-2b8d-469e-c0ff-fd63b29bb37d}
HKEY_LOCAL_MACHINE\software\classes\clsid\{4e7bd74f-2b8d-469e-d1f0-e56fa787ad2d}
HKEY_LOCAL_MACHINE\software\classes\clsid\{4e7bd74f-2b8d-469e-d3fa-f27ba787ad2d}
HKEY_LOCAL_MACHINE\software\classes\clsid\{4e7bd74f-2b8d-469e-d4f3-f66da787ad2d}
HKEY_LOCAL_MACHINE\software\classes\clsid\{4e7bd74f-2b8d-469e-d6f5-f66ea787ad2d}
HKEY_LOCAL_MACHINE\software\classes\clsid\{4e7bd74f-2b8d-469e-dbfc-ed1ca787ad2d}
HKEY_LOCAL_MACHINE\software\classes\clsid\{4e7bd74f-2b8d-469e-dff7-ec7da787ad2d}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{5629aaa8-dad0-493d-b8a7-fe3e0b06be37}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{4e7bd74f-2b8d-469e-c0fc-f76fa694bf2e}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{4e7bd74f-2b8d-469e-dff7-ec7da787ad2d}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\moduleusage\[%WINDOWS%]\downloaded program files\powersearch_toolbar.dll

Registry Values:
HKEY_CURRENT_USER\software\microsoft\internet explorer\toolbar\webbrowser
HKEY_CURRENT_USER\software\microsoft\internet explorer\toolbar\webbrowser
HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\toolbar
HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\toolbar
HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\toolbar
HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\toolbar
HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\toolbar
HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\toolbar
HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\toolbar
HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\toolbar
HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\toolbar
HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\toolbar
HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\toolbar
HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\toolbar
HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\toolbar
HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\toolbar
HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\toolbar
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\moduleusage\[%WINDOWS%]/downloaded program files/about.html
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\moduleusage\[%WINDOWS%]/downloaded program files/basis.xml
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\moduleusage\[%WINDOWS%]/downloaded program files/error.html
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\moduleusage\[%WINDOWS%]/downloaded program files/logo.bmp
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\moduleusage\[%WINDOWS%]/downloaded program files/nav.bmp
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\moduleusage\[%WINDOWS%]/downloaded program files/options.html
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\moduleusage\[%WINDOWS%]/downloaded program files/toolbar.crc
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\moduleusage\[%WINDOWS%]/downloaded program files/version.txt

---

You must clean you computer ASAP !!!
Download Free Trial Version of antivirus software here, to check your computer instantly.

---

Also Be Aware of the Following Threats:
Real.Spy.Common.Components Spyware Removal instruction
Removing Simon Trojan
Backdoor.Netbus Trojan Cleaner
W112.hitbox.Tracking.Cookie Tracking Cookie Removal instruction
Cabronator.12b Backdoor Removal

2020Search Adware

How To Remove 2020Search?
You must download trial version of "Exterminate-It" antivirus software,to check your computer instantly.

---

2020Search is dangerous virus:
Adware are programs that facilitate delivery for advertising content
to the user and in some cases gather information from the user's computer,
including information related to Internet browser usage or other computer habits
BHO (Browser Helper Object) Trojan.
The BHO waits for the user to post personal information to a monitored website.
As this information is entered by the user, it is captured by the BHO and sent back to the attacker.
The method of network transport used by the attacker makes this Trojan unique.
Typically, keyloggers of this type will send the stolen information back to the attacker via email
or HTTP POST, which can appear suspicious.
Instead, this Trojan encodes the data with a simple XOR algorithm before placing it into
the data section of an ICMP ping packet." explained the company.
Toolbar presents itself as a helpful add-on for Internet Explorer but it is a real pest.

---

---

2020Search It also known as:

[Panda]Adware/ToolbarCC

---

2020Search Symptoms:

Files:
[%WINDOWS%]\2020search2.dll
[%WINDOWS%]\mssvr.exe
[%SYSTEM%]\2020search.dll
[%SYSTEM%]\2020search2.dll
[%WINDOWS%]\2020install.exe
[%WINDOWS%]\downloaded program files\2020search.dll
[%WINDOWS%]\downloaded program files\2020search.inf
[%WINDOWS%]\system\2020search.dll
[%WINDOWS%]\system\2020search2.dll
[%WINDOWS%]\2020search2.dll
[%WINDOWS%]\mssvr.exe
[%SYSTEM%]\2020search.dll
[%SYSTEM%]\2020search2.dll
[%WINDOWS%]\2020install.exe
[%WINDOWS%]\downloaded program files\2020search.dll
[%WINDOWS%]\downloaded program files\2020search.inf
[%WINDOWS%]\system\2020search.dll
[%WINDOWS%]\system\2020search2.dll

Registry Keys:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4E7BD74F-2B8D-469E-92C6-CE7EB590A94D}
HKEY_CLASSES_ROOT\clsid\{4e1075f4-eec4-4a86-add7-cd5f52858c31}
HKEY_CLASSES_ROOT\clsid\{4e7bd74f-2b8d-469e-92c6-ce7eb590a94d}
HKEY_CLASSES_ROOT\clsid\{fc2493d6-a673-49fe-a2ee-efe03e95c27c}
HKEY_CLASSES_ROOT\gorsdn.contextitem
HKEY_CLASSES_ROOT\gorsdn.contextitem.1
HKEY_CLASSES_ROOT\interface\{eaf2ccee-21a1-4203-9f36-4929fd104d43}
HKEY_CLASSES_ROOT\software\microsoft\windows\currentversion\explorer\browser helper objects\{4e7bd74f-2b8d-469e-92c6-ce7eb590a94d}
HKEY_CLASSES_ROOT\typelib\{48da6120-a779-4c12-8584-47b625efb469}
HKEY_CURRENT_USER\software\microsoft\internet explorer\menuext\&rsdn search
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{4e7bd74f-2b8d-469e-92c6-ce7eb590a94d}

Registry Values:
HKEY_CURRENT_USER\software\microsoft\internet explorer\toolbar\webbrowser
HKEY_CURRENT_USER\software\microsoft\internet explorer\toolbar\webbrowser
HKEY_CURRENT_USER\software\microsoft\internet explorer\toolbar\webbrowser
HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\toolbar
HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\toolbar

---

You must clean you computer ASAP !!!
Download Free Trial Version of antivirus software here, to check your computer instantly.

---

Also Be Aware of the Following Threats:
Removing CWS.IEFeads Hijacker

Lookup.Absnro Hijacker

How To Remove Lookup.Absnro?
You must download trial version of "Exterminate-It" antivirus software,to check your computer instantly.

---

Lookup.Absnro is dangerous virus:
A Search hijacker redirects search results to other pages and may
transmit search and browsing data to unknown servers. An error page hijacker directs
the browser to another page, usually an advertising page, instead of the usual error
page when the requested URL is not found.

---

---

Lookup.Absnro Symptoms:

Files:
[%SYSTEM%]\absnro.dll
[%WINDOWS%]\system\absnro.dll
[%SYSTEM%]\absnro.dll
[%WINDOWS%]\system\absnro.dll

---

You must clean you computer ASAP !!!
Download Free Trial Version of antivirus software here, to check your computer instantly.

---

Also Be Aware of the Following Threats:
Removing Pigeon.AJN Trojan

SpywareSecure Ransomware

How To Remove SpywareSecure?
You must download trial version of "Exterminate-It" antivirus software,to check your computer instantly.

---

SpywareSecure is dangerous virus:
The term ransomware is commonly used to describe such software,
although the field known as cryptovirology predates the term "ransomware".

This type of ransom attack can be accomplished by (for example) attaching
a specially crafted file/program to an e-mail message and sending this to the victim.

---

---

SpywareSecure Symptoms:

Files:
[%DESKTOP%]\Spyware-Secure.lnk
[%WINDOWS%]\pack.epk
[%DESKTOP%]\Spyware-Secure.lnk
[%WINDOWS%]\pack.epk

Folders:
[%PROGRAMS%]\Spyware-Secure
[%PROGRAM_FILES%]\Spyware-Secure

Registry Keys:
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\spyware-secure
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\spyware-secure

Registry Values:
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run
HKEY_LOCAL_MACHINE\software\spyware-secure
HKEY_LOCAL_MACHINE\software\spyware-secure
HKEY_LOCAL_MACHINE\software\spyware-secure
HKEY_LOCAL_MACHINE\software\spyware-secure
HKEY_LOCAL_MACHINE\software\spyware-secure
HKEY_LOCAL_MACHINE\software\spyware-secure

---

You must clean you computer ASAP !!!
Download Free Trial Version of antivirus software here, to check your computer instantly.

---

Also Be Aware of the Following Threats:
Removing Backdoor.Tetris Trojan
Pap Trojan Removal instruction
Removing Razor.Wintrinoo DoS

BAT.SMF Trojan

How To Remove BAT.SMF?
You must download trial version of "Exterminate-It" antivirus software,to check your computer instantly.

---

BAT.SMF is dangerous virus:
This category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

---

---

BAT.SMF It also known as:

[Kaspersky]BAT.MF.b,BAT.SMF.b,BAT.SMF.d;
[Eset]BAT/102 virus,BAT/SMF.120.A virus,BAT/SMF.121.A virus,BAT/SMF.137.A virus,BAT/SMF.155.A virus,BAT/SMF.166.A virus;
[Panda]BAT/BAT91.A,Univ.EP,BAT/SMF.137,BAT/SMF.155,BAT/SMF.166;
[Computer Associates]Bat/SMF.102,Bat/SMF.120,Bat/SMF.137,Bat/SMF.155

---

BAT.SMF Symptoms:

Files:
[%PROGRAM_FILES%]\support software\ss2.dll
[%PROGRAM_FILES%]\support software\ss2.dll

---

You must clean you computer ASAP !!!
Download Free Trial Version of antivirus software here, to check your computer instantly.

---

Also Be Aware of the Following Threats:
Remove PS.MPC.Family Trojan
Adware.DesktopMedia Hijacker Information
Remove Pigeon.AOR Trojan
SillyDl.CSB Trojan Removal instruction
Removing Frethog.ADQ Trojan

IEHlpr Adware

How To Remove IEHlpr?
You must download trial version of "Exterminate-It" antivirus software,to check your computer instantly.

---

IEHlpr is dangerous virus:
Adware are programs that facilitate delivery for advertising content
to the user and in some cases gather information from the user's computer,
including information related to Internet browser usage or other computer habits

---

---

IEHlpr It also known as:

[Kaspersky]AdWare.win32.IEHlpr.g,AdWare.win32.IEHlpr.I,AdWare.Win32.AdHelper.bv,AdWare.Win32.IEHlpr.w;
[McAfee]Generic Downloader.g;
[Other]Adware.IEhlpr,Adware.IEHlpr

---

IEHlpr Symptoms:

Files:
[%PROGRAM_FILES%]\Internet Explorer\Connection Wizard\iccon.dll
[%PROGRAM_FILES%]\Internet Explorer\Connection Wizard\Q902220.cat
[%PROGRAM_FILES%]\Internet Explorer\Connection Wizard\Q902222.cat
[%PROGRAM_FILES%]\internet explorer\hmapi.dll
[%PROGRAM_FILES%]\internet explorer\licenses.txt
[%PROGRAM_FILES%]\internet explorer\supports.txt
[%PROGRAM_FILES%]\Internet Explorer\Connection Wizard\iccon.dll
[%PROGRAM_FILES%]\Internet Explorer\Connection Wizard\Q902220.cat
[%PROGRAM_FILES%]\Internet Explorer\Connection Wizard\Q902222.cat
[%PROGRAM_FILES%]\internet explorer\hmapi.dll
[%PROGRAM_FILES%]\internet explorer\licenses.txt
[%PROGRAM_FILES%]\internet explorer\supports.txt

Registry Keys:
HKEY_CLASSES_ROOT\iehlprobj.iehlprobj
HKEY_CLASSES_ROOT\iehlprobj.iehlprobj.1
HKEY_CLASSES_ROOT\clsid\{02c9b9ab-6372-46c5-b356-773faf3b6b1e}
HKEY_CLASSES_ROOT\clsid\{ee7c3cf0-4b15-11d1-abed-709549c10000}
HKEY_CLASSES_ROOT\clsid\{ee7c3cf0-4b15-11d1-abed-709549c10001}
HKEY_CLASSES_ROOT\iehelper.winhelper
HKEY_CLASSES_ROOT\iehelper.winhelper.1
HKEY_CLASSES_ROOT\interface\{ee7c3cef-4b15-11d1-abed-709549c10000}
HKEY_CLASSES_ROOT\interface\{ee7c3cef-4b15-11d1-abed-709549c10001}
HKEY_CLASSES_ROOT\typelib\{ee7c3ce2-4b15-11d1-abed-709549c10000}
HKEY_CLASSES_ROOT\typelib\{ee7c3ce2-4b15-11d1-abed-709549c10001}\1.0
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\ext\stats\{ee7c3cf0-4b15-11d1-abed-709549c10000}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{ee7c3cf0-4b15-11d1-abed-709549c10000}

---

You must clean you computer ASAP !!!
Download Free Trial Version of antivirus software here, to check your computer instantly.

---

Also Be Aware of the Following Threats:
Mesfed Trojan Removal instruction
HaczYK Adware Symptoms
Reboot Trojan Removal

Dratawl Trojan

How To Remove Dratawl?
You must download trial version of "Exterminate-It" antivirus software,to check your computer instantly.

---

Dratawl is dangerous virus:
This category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.
Adware are programs that facilitate delivery for advertising content
to the user and in some cases gather information from the user's computer,
including information related to Internet browser usage or other computer habits

---

---

Dratawl Symptoms:

Files:
[%SYSTEM%]\AlxTool.dll
[%SYSTEM%]\Com\atlgui.tlb
[%SYSTEM%]\AlxTool.dll
[%SYSTEM%]\Com\atlgui.tlb

Registry Keys:
HKEY_CLASSES_ROOT\clsid\{6cf4d74b-e6bd-4c8f-83d7-90d6439705b9}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{6cf4d74b-e6bd-4c8f-83d7-90d6439705b9}

---

You must clean you computer ASAP !!!
Download Free Trial Version of antivirus software here, to check your computer instantly.

---

Also Be Aware of the Following Threats:
hitvirus Ransomware Information
Cotmonger Trojan Information
Remove Kastem Trojan
Bat.P69 Trojan Cleaner
Coreflood.Tracker.Serve Trojan Information