Trojan List 60: December 2008

Wednesday, December 31, 2008

Hijacker Hostile Code

Hijacker description:
Hijacker Category:Hostile Code
Hostile code is any process running on a system that is
not authorized by the system administrator, such as Trojans, viruses, or spyware.

Removing Hijacker:

you can run trial version of ExterminateIt, or remove Hijacker manually.

To completely manually remove Hijacker malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Hijacker.

Pigeon.EFN description:
Pigeon.EFN Category:Trojan
This loose category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

Multi-purpose Trojans are also included in this group, as some virus writers
create multi-functional Trojans rather than Trojan packs.

Removing Pigeon.EFN:

you can run trial version of ExterminateIt, or remove Pigeon.EFN manually.

To completely manually remove Pigeon.EFN malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Pigeon.EFN.

W95.Tick.dr Trojan

Click here to remove W95.Tick.dr malware

W95.Tick.dr description:
W95.Tick.dr Category:Trojan,Backdoor,Downloader,DoS
This category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.
Backdoors are used by virus writers to detect and download confidential information,
execute malicious code, destroy data, include the machine in bot networks and so forth.

Trojans-downloaders downloads and installs new malware or adware on the computer.

These programs attack web servers by sending numerous requests to the specified server,
often causing it to crash under an excessive volume of requests.

DoS trojans conduct such attacks from a single computer with the consent of the user.

Worms can carry a DoS procedure as part of their payload.

Removing W95.Tick.dr:

you can run trial version of ExterminateIt, or remove W95.Tick.dr manually.

To completely manually remove W95.Tick.dr malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with W95.Tick.dr.

System33r.Tiny.Webdownloader Downloader

Click here to remove System33r.Tiny.Webdownloader malware

System33r.Tiny.Webdownloader description:
System33r.Tiny.Webdownloader Category:Downloader
Trojans-downloaders downloads and installs new malware or adware on the computer.

Removing System33r.Tiny.Webdownloader:

you can run trial version of ExterminateIt, or remove System33r.Tiny.Webdownloader manually.

To completely manually remove System33r.Tiny.Webdownloader malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with System33r.Tiny.Webdownloader.

Suicidal Trojan

Suicidal description:
Suicidal Category:Trojan,Backdoor,Downloader,DoS
This category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.
Backdoors are used by virus writers to detect and download confidential information,
execute malicious code, destroy data, include the machine in bot networks and so forth.

Trojans-downloaders downloads and installs new malware or adware on the computer.

These programs attack web servers by sending numerous requests to the specified server,
often causing it to crash under an excessive volume of requests.

DoS trojans conduct such attacks from a single computer with the consent of the user.

Worms can carry a DoS procedure as part of their payload.

Removing Suicidal:

you can run trial version of ExterminateIt, or remove Suicidal manually.

To completely manually remove Suicidal malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Suicidal.

Smile Trojan

Smile description:
Smile Category:Trojan,Backdoor,Downloader,DoS
This category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.
Backdoors are the most dangerous type of Trojans and the most popular.
Backdoors open infected machines to external control via Internet.
Often the backdoor will not be visible in the log of active programs.
The downloader either launches the new malware or registers it to enable autorun
according to the local operating system requirements.
These programs attack web servers by sending numerous requests to the specified server,
often causing it to crash under an excessive volume of requests.

DoS trojans conduct such attacks from a single computer with the consent of the user.

Worms can carry a DoS procedure as part of their payload.

Removing Smile:

you can run trial version of ExterminateIt, or remove Smile manually.

To completely manually remove Smile malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Smile.

Bigbot Backdoor

Bigbot description:
Bigbot Category:Backdoor
Backdoors are the most dangerous type of Trojans and the most popular.
Backdoors open infected machines to external control via Internet.
They function in the same way as legal remote administration programs used by system administrators.
This makes them difficult to detect.

Backdoors are installed and launched without the consent of the user of computer.
Often the backdoor will not be visible in the log of active programs.

Once a backdoor has been successfully launched, the computer is wide open.
Backdoor functions can include:

Launching/ deleting files

Sending/ receiving files

Deleting data

Displaying notification

Rebooting the machine

Executing files

Backdoors are used by virus writers to detect and download confidential information,
execute malicious code, destroy data, include the machine in bot networks and so forth.
Backdoors combine the functionality of most other types of in one package.

Backdoors have one especially dangerous sub-class: variants that can propagate like worms.

Removing Bigbot:

you can run trial version of ExterminateIt, or remove Bigbot manually.

To completely manually remove Bigbot malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Bigbot.

Agent.BDO Trojan

Agent.BDO description:
Agent.BDO Category:Trojan
This loose category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

Multi-purpose Trojans are also included in this group, as some virus writers
create multi-functional Trojans rather than Trojan packs.

Detection Agent.BDO :

Agent.BDO Files:
[%WINDOWS%]\AntiAdwa.exe
[%WINDOWS%]\NTServer.DLL
[%WINDOWS%]\sclgntfys.dll
[%WINDOWS%]\winamps.dll
[%WINDOWS%]\AntiAdwa.exe
[%WINDOWS%]\NTServer.DLL
[%WINDOWS%]\sclgntfys.dll
[%WINDOWS%]\winamps.dll

Agent.BDO Folders:
[%SYSTEM%]\system\.setupq

Agent.BDO Registry Keys:
HKEY_CLASSES_ROOT\clsid\{fdc9c3c0-4b00-1d11-abed-70495e710015}
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\sclgntfys
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\.setupq
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\umwdfmgr

Removing Agent.BDO:

you can run trial version of ExterminateIt, or remove Agent.BDO manually.

To completely manually remove Agent.BDO malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Agent.BDO.

CGI.Bin Tracking Cookie

CGI.Bin description:
CGI.Bin Category:Tracking Cookie
Tracking cookies, like regular cookies, are small files that get deposited
onto your computer's hard drive as you browse the Internet.
Unlike harmless cookies that normally let you use certain websites more easily,
tracking cookies usually collect and report information about what websites you visit
and what you do at those websites.

Removing CGI.Bin:

you can run trial version of ExterminateIt, or remove CGI.Bin manually.

To completely manually remove CGI.Bin malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with CGI.Bin.

TrojanDownloader.Win32.Pixar Trojan

Click here to remove TrojanDownloader.Win32.Pixar malware

TrojanDownloader.Win32.Pixar description:
TrojanDownloader.Win32.Pixar Category:Trojan,Downloader
This category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.
Trojans-downloaders downloads and installs new malware or adware on the computer.

Removing TrojanDownloader.Win32.Pixar:

you can run trial version of ExterminateIt, or remove TrojanDownloader.Win32.Pixar manually.

To completely manually remove TrojanDownloader.Win32.Pixar malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with TrojanDownloader.Win32.Pixar.

VBS.Rekun Trojan

VBS.Rekun description:
VBS.Rekun Category:Trojan
This category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

Removing VBS.Rekun:

you can run trial version of ExterminateIt, or remove VBS.Rekun manually.

To completely manually remove VBS.Rekun malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with VBS.Rekun.

Cabronator.Kill.beta3 Backdoor

Click here to remove Cabronator.Kill.beta3 malware

Cabronator.Kill.beta3 description:
Cabronator.Kill.beta3 Category:Backdoor,RAT
Backdoors are used by virus writers to detect and download confidential information,
execute malicious code, destroy data, include the machine in bot networks and so forth.

Many trojans and backdoors now have remote administration capabilities
allowing an individual to control the victim's computer.
Many times a file called the server must be opened on the victim's computer before
the trojan can have access to it.

These are generally sent through email, P2P file sharing software,
and in internet downloads. They are usually disguised as a legitimate program or file.
Many server files will display a fake error message when opened, to make it seem like it didn't open.
Some will also kill antivirus and firewall software.

Removing Cabronator.Kill.beta3:

you can run trial version of ExterminateIt, or remove Cabronator.Kill.beta3 manually.

To completely manually remove Cabronator.Kill.beta3 malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Cabronator.Kill.beta3.

kanoodle.com Tracking Cookie

Click here to remove kanoodle.com malware

kanoodle.com description:
kanoodle.com Category:Tracking Cookie
Tracking cookies, like regular cookies, are small files that get deposited
onto your computer's hard drive as you browse the Internet.
Unlike harmless cookies that normally let you use certain websites more easily,
tracking cookies usually collect and report information about what websites you visit
and what you do at those websites.

If you fill out forms online with your real name and contact information,
click on banners and then purchase an item, or fill out sweepstakes or contests forms,
then it's possible that major online advertisers know your name and have associated it
with your IP address and other information.

Removing kanoodle.com:

you can run trial version of ExterminateIt, or remove kanoodle.com manually.

To completely manually remove kanoodle.com malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with kanoodle.com.

Tuesday, December 30, 2008

Bancos.IBE Trojan

Bancos.IBE description:
Bancos.IBE Category:Trojan
This loose category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

Multi-purpose Trojans are also included in this group, as some virus writers
create multi-functional Trojans rather than Trojan packs.

Removing Bancos.IBE:

you can run trial version of ExterminateIt, or remove Bancos.IBE manually.

To completely manually remove Bancos.IBE malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Bancos.IBE.

IncrediFind Hijacker

Click here to remove IncrediFind malware

IncrediFind description:
IncrediFind Category:Hijacker
Hijackers are software programs that modify users' default browser home page,
search settings, error page settings, or desktop wallpaper without adequate notice, disclosure,
or user consent.

When the default home page is hijacked, the browser opens to the web page set by the hijacker
instead of the user's designated home page. In some cases, the hijacker may block users from
restoring their desired home page.

A search hijacker redirects search results to other pages and may
transmit search and browsing data to unknown servers. An error page hijacker directs
the browser to another page, usually an advertising page, instead of the usual error
page when the requested URL is not found.

A desktop hijacker replaces the desktop wallpaper with advertising
for products and services on the desktop.

Hijackers take control of various parts of your web browser, including your home page,
search pages, and search bar. They may also redirect you to certain sites should you
mistype an address or prevent you from going to a website they would rather you not,
such as sites that combat malware. Some will even redirect you to their own search engine
when you attempt a search. NB: hijackers almost exclusively target Internet Explorer.

Detection IncrediFind :

IncrediFind Files:
[%PROFILE_TEMP%]\incredifindbholog.tmp
[%PROFILE_TEMP%]\incredifindbholog.tmp

IncrediFind Registry Values:
HKEY_CURRENT_USER\software\microsoft\internet explorer\urlsearchhooks
HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\urlsearchhooks

Removing IncrediFind:

you can run trial version of ExterminateIt, or remove IncrediFind manually.

To completely manually remove IncrediFind malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with IncrediFind.

Frethog.ADZ Trojan

Click here to remove Frethog.ADZ malware

Frethog.ADZ description:
Frethog.ADZ Category:Trojan
This category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

Removing Frethog.ADZ:

you can run trial version of ExterminateIt, or remove Frethog.ADZ manually.

To completely manually remove Frethog.ADZ malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Frethog.ADZ.

Pigeon.EUS Trojan

Pigeon.EUS description:
Pigeon.EUS Category:Trojan
This category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

Removing Pigeon.EUS:

you can run trial version of ExterminateIt, or remove Pigeon.EUS manually.

To completely manually remove Pigeon.EUS malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Pigeon.EUS.

Vxidl.ARM Trojan

Vxidl.ARM description:
Vxidl.ARM Category:Trojan
This loose category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

Multi-purpose Trojans are also included in this group, as some virus writers
create multi-functional Trojans rather than Trojan packs.

Removing Vxidl.ARM:

you can run trial version of ExterminateIt, or remove Vxidl.ARM manually.

To completely manually remove Vxidl.ARM malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Vxidl.ARM.

NetTrash.xs Backdoor

Click here to remove NetTrash.xs malware

NetTrash.xs description:
NetTrash.xs Category:Backdoor,RAT
Backdoors combine the functionality of most other types of in one package.
Backdoors have one especially dangerous sub-class: variants that can propagate like worms.

Some RAT trojans are pranks that are most likely being controlled by a friend or enemy on
April Fool's day or a holiday. Prank RATS are generally not harmful, and won't log keystrokes or hack.

Removing NetTrash.xs:

you can run trial version of ExterminateIt, or remove NetTrash.xs manually.

To completely manually remove NetTrash.xs malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with NetTrash.xs.

Bancos.GZG Trojan

Bancos.GZG description:
Bancos.GZG Category:Trojan
This category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

Removing Bancos.GZG:

you can run trial version of ExterminateIt, or remove Bancos.GZG manually.

To completely manually remove Bancos.GZG malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Bancos.GZG.

PWS.Coced.ASPask.Troja Trojan

Click here to remove PWS.Coced.ASPask.Troja malware

PWS.Coced.ASPask.Troja description:
PWS.Coced.ASPask.Troja Category:Trojan,Hacker Tool
This loose category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

Multi-purpose Trojans are also included in this group, as some virus writers
create multi-functional Trojans rather than Trojan packs.
These utilities are designed to penetrate remote computers
in order to use them as zombies (by using backdoors) or to download other malicious programs to computer.

Exploits use vulnerabilities in operating systems and applications to achieve the same result.

Removing PWS.Coced.ASPask.Troja:

you can run trial version of ExterminateIt, or remove PWS.Coced.ASPask.Troja manually.

To completely manually remove PWS.Coced.ASPask.Troja malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with PWS.Coced.ASPask.Troja.

Vasilich Trojan

Vasilich description:
Vasilich Category:Trojan
This category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

Removing Vasilich:

you can run trial version of ExterminateIt, or remove Vasilich manually.

To completely manually remove Vasilich malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Vasilich.

Zimenok.Zender Trojan

Click here to remove Zimenok.Zender malware

Zimenok.Zender description:
Zimenok.Zender Category:Trojan,Backdoor,Hacker Tool
This category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.
Backdoors combine the functionality of most other types of in one package.
Backdoors have one especially dangerous sub-class: variants that can propagate like worms.

Exploits use vulnerabilities in operating systems and applications to achieve the same result.

Removing Zimenok.Zender:

you can run trial version of ExterminateIt, or remove Zimenok.Zender manually.

To completely manually remove Zimenok.Zender malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Zimenok.Zender.

Bancodor Trojan

Bancodor description:
Bancodor Category:Trojan,Backdoor
This loose category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

Multi-purpose Trojans are also included in this group, as some virus writers
create multi-functional Trojans rather than Trojan packs.
Backdoors combine the functionality of most other types of in one package.
Backdoors have one especially dangerous sub-class: variants that can propagate like worms.

Removing Bancodor:

you can run trial version of ExterminateIt, or remove Bancodor manually.

To completely manually remove Bancodor malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Bancodor.

Baley Trojan

Baley description:
Baley Category:Trojan
This loose category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

Multi-purpose Trojans are also included in this group, as some virus writers
create multi-functional Trojans rather than Trojan packs.

Removing Baley:

you can run trial version of ExterminateIt, or remove Baley manually.

To completely manually remove Baley malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Baley.

Monday, December 29, 2008

Win32.Devsog Downloader

Click here to remove Win32.Devsog malware

Win32.Devsog description:
Win32.Devsog Category:Downloader
The downloader either launches the new malware or registers it to enable autorun
according to the local operating system requirements.

Removing Win32.Devsog:

you can run trial version of ExterminateIt, or remove Win32.Devsog manually.

To completely manually remove Win32.Devsog malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Win32.Devsog.

TrojanDownloader.Dyfica.NAC Trojan

Click here to remove TrojanDownloader.Dyfica.NAC malware

TrojanDownloader.Dyfica.NAC description:
TrojanDownloader.Dyfica.NAC Category:Trojan,Downloader
This category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.
This family of Trojans downloads and installs new malware or adware on the computer.
The downloader then either launches the new malware or registers it to enable autorun
according to the local operating system requirements.

The names and locations of malware to be downloaded are either coded into the
Trojan or downloaded from a specified website.

Removing TrojanDownloader.Dyfica.NAC:

you can run trial version of ExterminateIt, or remove TrojanDownloader.Dyfica.NAC manually.

To completely manually remove TrojanDownloader.Dyfica.NAC malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with TrojanDownloader.Dyfica.NAC.

OrbitExplorer Adware

Click here to remove OrbitExplorer malware

OrbitExplorer description:
OrbitExplorer Category:Adware,Toolbar
Adware are programs that facilitate delivery for advertising content
to the user and in some cases gather information from the user's computer,
including information related to Internet browser usage or other computer habits
Toolbar presents itself as a helpful add-on for Internet Explorer but it is a real pest.
It replaces your start page, continuosly open a number of pop up windows and so on.

Detection OrbitExplorer :

OrbitExplorer Registry Keys:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{197AB1D7-A7DD-4C86-A938-1FCC0DB21B85}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{197ab1d7-a7dd-4c86-a938-1fcc0db21b85}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{cdf2114e-8ff2-49e6-9ea9-10ac826298cf}

Removing OrbitExplorer:

you can run trial version of ExterminateIt, or remove OrbitExplorer manually.

To completely manually remove OrbitExplorer malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with OrbitExplorer.

Super.Dial Adware

Super.Dial description:
Super.Dial Category:Adware
Adware are programs that facilitate delivery for advertising content
to the user and in some cases gather information from the user's computer.

Removing Super.Dial:

you can run trial version of ExterminateIt, or remove Super.Dial manually.

To completely manually remove Super.Dial malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Super.Dial.

Dengdoor Trojan

Dengdoor description:
Dengdoor Category:Trojan,Backdoor
This category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.
Backdoors are the most dangerous type of Trojans and the most popular.
Backdoors open infected machines to external control via Internet.
They function in the same way as legal remote administration programs used by system administrators.
This makes them difficult to detect.

Backdoors are installed and launched without the consent of the user of computer.
Often the backdoor will not be visible in the log of active programs.

Once a backdoor has been successfully launched, the computer is wide open.
Backdoor functions can include:

Launching/ deleting files

Sending/ receiving files

Deleting data

Displaying notification

Rebooting the machine

Executing files

Backdoors are used by virus writers to detect and download confidential information,
execute malicious code, destroy data, include the machine in bot networks and so forth.
Backdoors combine the functionality of most other types of in one package.

Backdoors have one especially dangerous sub-class: variants that can propagate like worms.

Removing Dengdoor:

you can run trial version of ExterminateIt, or remove Dengdoor manually.

To completely manually remove Dengdoor malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Dengdoor.

Takholl Trojan

Takholl description:
Takholl Category:Trojan
This loose category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

Multi-purpose Trojans are also included in this group, as some virus writers
create multi-functional Trojans rather than Trojan packs.

Removing Takholl:

you can run trial version of ExterminateIt, or remove Takholl manually.

To completely manually remove Takholl malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Takholl.

For.Guest Trojan

For.Guest description:
For.Guest Category:Trojan
This loose category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

Multi-purpose Trojans are also included in this group, as some virus writers
create multi-functional Trojans rather than Trojan packs.

Removing For.Guest:

you can run trial version of ExterminateIt, or remove For.Guest manually.

To completely manually remove For.Guest malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with For.Guest.

Netmetro.Patch RAT

Click here to remove Netmetro.Patch malware

Netmetro.Patch description:
Netmetro.Patch Category:RAT
Many trojans and backdoors now have remote administration capabilities
allowing an individual to control the victim's computer.
Many times a file called the server must be opened on the victim's computer before
the trojan can have access to it.

These are generally sent through email, P2P file sharing software,
and in internet downloads. They are usually disguised as a legitimate program or file.
Many server files will display a fake error message when opened, to make it seem like it didn't open.
Some will also kill antivirus and firewall software.

Some RAT trojans are pranks that are most likely being controlled by a friend or enemy on
April Fool's day or a holiday. Prank RATS are generally not harmful, and won't log keystrokes or hack.
They usually do whimsical things like flip the screen upside-down, open the CD-ROM tray,
and swap mouse buttons. However, they can be quite hard to remove.

Removing Netmetro.Patch:

you can run trial version of ExterminateIt, or remove Netmetro.Patch manually.

To completely manually remove Netmetro.Patch malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Netmetro.Patch.

Sunday, December 28, 2008

Ad4All Adware

Ad4All description:
Ad4All Category:Adware
Adware are programs that facilitate delivery for advertising content
to the user and in some cases gather information from the user's computer,
including information related to Internet browser usage or other computer habits

Detection Ad4All :

Ad4All Files:
[%COMMON_DESKTOPDIRECTORY%]\Ò×È¤¹ºÎï.lnk
[%COMMON_STARTMENU%]\Ò×È¤¹ºÎï.lnk
[%FAVORITES%]\Ò×È¤¹ºÎï.lnk
[%COMMON_DESKTOPDIRECTORY%]\Ò×È¤¹ºÎï.lnk
[%COMMON_STARTMENU%]\Ò×È¤¹ºÎï.lnk
[%FAVORITES%]\Ò×È¤¹ºÎï.lnk

Ad4All Folders:
[%PROGRAM_FILES%]\AD4All

Removing Ad4All:

you can run trial version of ExterminateIt, or remove Ad4All manually.

To completely manually remove Ad4All malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Ad4All.

Monker Adware

Monker description:
Monker Category:Adware
Adware are programs that facilitate delivery for advertising content
to the user and in some cases gather information from the user's computer,
including information related to Internet browser usage or other computer habits

Detection Monker :

Monker Registry Keys:
HKEY_CURRENT_USER\software\awp

Monker Registry Values:
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run

Removing Monker:

you can run trial version of ExterminateIt, or remove Monker manually.

To completely manually remove Monker malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Monker.

YourFreeVitamins.com Tracking Cookie

Click here to remove YourFreeVitamins.com malware

YourFreeVitamins.com description:
YourFreeVitamins.com Category:Tracking Cookie
Tracking cookies, like regular cookies, are small files that get deposited
onto your computer's hard drive as you browse the Internet.
Unlike harmless cookies that normally let you use certain websites more easily,
tracking cookies usually collect and report information about what websites you visit
and what you do at those websites.

Removing YourFreeVitamins.com:

you can run trial version of ExterminateIt, or remove YourFreeVitamins.com manually.

To completely manually remove YourFreeVitamins.com malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with YourFreeVitamins.com.

Win32.CmjSpy Trojan

Click here to remove Win32.CmjSpy malware

Win32.CmjSpy description:
Win32.CmjSpy Category:Trojan,Backdoor
This category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.
Backdoors are the most dangerous type of Trojans and the most popular.
Backdoors open infected machines to external control via Internet.
Often the backdoor will not be visible in the log of active programs.

Removing Win32.CmjSpy:

you can run trial version of ExterminateIt, or remove Win32.CmjSpy manually.

To completely manually remove Win32.CmjSpy malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Win32.CmjSpy.

ultraroi.com Tracking Cookie

Click here to remove ultraroi.com malware

ultraroi.com description:
ultraroi.com Category:Tracking Cookie
Tracking cookies, like regular cookies, are small files that get deposited
onto your computer's hard drive as you browse the Internet.
Unlike harmless cookies that normally let you use certain websites more easily,
tracking cookies usually collect and report information about what websites you visit
and what you do at those websites.

Removing ultraroi.com:

you can run trial version of ExterminateIt, or remove ultraroi.com manually.

To completely manually remove ultraroi.com malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with ultraroi.com.

description:

Removing :

you can run trial version of ExterminateIt, or remove manually.

To completely manually remove malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with .

description:

Removing :

you can run trial version of ExterminateIt, or remove manually.

To completely manually remove malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with .

description:

Removing :

you can run trial version of ExterminateIt, or remove manually.

To completely manually remove malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with .

PC.Invader Backdoor

PC.Invader description:
PC.Invader Category:Backdoor,RAT
Backdoors are the most dangerous type of Trojans and the most popular.
Backdoors open infected machines to external control via Internet.
Often the backdoor will not be visible in the log of active programs.
Some RAT trojans are pranks that are most likely being controlled by a friend or enemy on
April Fool's day or a holiday. Prank RATS are generally not harmful, and won't log keystrokes or hack.

Removing PC.Invader:

you can run trial version of ExterminateIt, or remove PC.Invader manually.

To completely manually remove PC.Invader malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with PC.Invader.

Bad.Brains Trojan

Bad.Brains description:
Bad.Brains Category:Trojan,Backdoor,Downloader,DoS
This category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.
Backdoors are used by virus writers to detect and download confidential information,
execute malicious code, destroy data, include the machine in bot networks and so forth.

This family of Trojans downloads and installs new malware or adware on the computer.
The downloader then either launches the new malware or registers it to enable autorun
according to the local operating system requirements.

The names and locations of malware to be downloaded are either coded into the
Trojan or downloaded from a specified website.
These programs attack web servers by sending numerous requests to the specified server,
often causing it to crash under an excessive volume of requests.

DoS trojans conduct such attacks from a single computer with the consent of the user.

Worms can carry a DoS procedure as part of their payload.

Removing Bad.Brains:

you can run trial version of ExterminateIt, or remove Bad.Brains manually.

To completely manually remove Bad.Brains malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Bad.Brains.

Fluxay46 Backdoor

Fluxay46 description:
Fluxay46 Category:Backdoor
Backdoors are used by virus writers to detect and download confidential information,
execute malicious code, destroy data, include the machine in bot networks and so forth.

Removing Fluxay46:

you can run trial version of ExterminateIt, or remove Fluxay46 manually.

To completely manually remove Fluxay46 malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Fluxay46.

RedHacker Backdoor

RedHacker description:
RedHacker Category:Backdoor
Backdoors are the most dangerous type of Trojans and the most popular.
Backdoors open infected machines to external control via Internet.
They function in the same way as legal remote administration programs used by system administrators.
This makes them difficult to detect.

Backdoors are installed and launched without the consent of the user of computer.
Often the backdoor will not be visible in the log of active programs.

Once a backdoor has been successfully launched, the computer is wide open.
Backdoor functions can include:

Launching/ deleting files

Sending/ receiving files

Deleting data

Displaying notification

Rebooting the machine

Executing files

Backdoors are used by virus writers to detect and download confidential information,
execute malicious code, destroy data, include the machine in bot networks and so forth.
Backdoors combine the functionality of most other types of in one package.

Backdoors have one especially dangerous sub-class: variants that can propagate like worms.

Removing RedHacker:

you can run trial version of ExterminateIt, or remove RedHacker manually.

To completely manually remove RedHacker malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with RedHacker.

Saturday, December 27, 2008

Vxidl.BGB Trojan

Vxidl.BGB description:
Vxidl.BGB Category:Trojan
This category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

Detection Vxidl.BGB :

Vxidl.BGB Files:
[%SYSTEM%]\dllgh8jkd1q1.exe
[%SYSTEM%]\dllgh8jkd1q2.exe
[%SYSTEM%]\dllgh8jkd1q5.exe
[%SYSTEM%]\dllgh8jkd1q6.exe
[%SYSTEM%]\dllgh8jkd1q7.exe
[%SYSTEM%]\dllgh8jkd1q8.exe
[%SYSTEM%]\dllgh8jkd1q1.exe
[%SYSTEM%]\dllgh8jkd1q2.exe
[%SYSTEM%]\dllgh8jkd1q5.exe
[%SYSTEM%]\dllgh8jkd1q6.exe
[%SYSTEM%]\dllgh8jkd1q7.exe
[%SYSTEM%]\dllgh8jkd1q8.exe

Removing Vxidl.BGB:

you can run trial version of ExterminateIt, or remove Vxidl.BGB manually.

To completely manually remove Vxidl.BGB malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Vxidl.BGB.

Win32.Spool Trojan

Click here to remove Win32.Spool malware

Win32.Spool description:
Win32.Spool Category:Trojan,Backdoor
This category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.
Backdoors are the most dangerous type of Trojans and the most popular.
Backdoors open infected machines to external control via Internet.
They function in the same way as legal remote administration programs used by system administrators.
This makes them difficult to detect.

Backdoors are installed and launched without the consent of the user of computer.
Often the backdoor will not be visible in the log of active programs.

Once a backdoor has been successfully launched, the computer is wide open.
Backdoor functions can include:

Launching/ deleting files

Sending/ receiving files

Deleting data

Displaying notification

Rebooting the machine

Executing files

Backdoors are used by virus writers to detect and download confidential information,
execute malicious code, destroy data, include the machine in bot networks and so forth.
Backdoors combine the functionality of most other types of in one package.

Backdoors have one especially dangerous sub-class: variants that can propagate like worms.

Removing Win32.Spool:

you can run trial version of ExterminateIt, or remove Win32.Spool manually.

To completely manually remove Win32.Spool malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Win32.Spool.

IRC.Darkirc Backdoor

Click here to remove IRC.Darkirc malware

IRC.Darkirc description:
IRC.Darkirc Category:Backdoor
Backdoors combine the functionality of most other types of in one package.
Backdoors have one especially dangerous sub-class: variants that can propagate like worms.

Removing IRC.Darkirc:

you can run trial version of ExterminateIt, or remove IRC.Darkirc manually.

To completely manually remove IRC.Darkirc malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with IRC.Darkirc.

ICQ.Chamel DoS

ICQ.Chamel description:
ICQ.Chamel Category:DoS
DoS trojans conduct attacks from a single computer with the consent of the user.

Removing ICQ.Chamel:

you can run trial version of ExterminateIt, or remove ICQ.Chamel manually.

To completely manually remove ICQ.Chamel malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with ICQ.Chamel.

Pigeon.ANN Trojan

Pigeon.ANN description:
Pigeon.ANN Category:Trojan
This category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

Removing Pigeon.ANN:

you can run trial version of ExterminateIt, or remove Pigeon.ANN manually.

To completely manually remove Pigeon.ANN malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Pigeon.ANN.

Pigeon.EGX Trojan

Pigeon.EGX description:
Pigeon.EGX Category:Trojan
This category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

Removing Pigeon.EGX:

you can run trial version of ExterminateIt, or remove Pigeon.EGX manually.

To completely manually remove Pigeon.EGX malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Pigeon.EGX.

GirlFriend Trojan

GirlFriend description:
GirlFriend Category:Trojan,Backdoor,RAT
This loose category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

Multi-purpose Trojans are also included in this group, as some virus writers
create multi-functional Trojans rather than Trojan packs.
Backdoors combine the functionality of most other types of in one package.
Backdoors have one especially dangerous sub-class: variants that can propagate like worms.

Many trojans and backdoors now have remote administration capabilities
allowing an individual to control the victim's computer.
Many times a file called the server must be opened on the victim's computer before
the trojan can have access to it.

These are generally sent through email, P2P file sharing software,
and in internet downloads. They are usually disguised as a legitimate program or file.
Many server files will display a fake error message when opened, to make it seem like it didn't open.
Some will also kill antivirus and firewall software.

Some RAT trojans are pranks that are most likely being controlled by a friend or enemy on
April Fool's day or a holiday. Prank RATS are generally not harmful, and won't log keystrokes or hack.
They usually do whimsical things like flip the screen upside-down, open the CD-ROM tray,
and swap mouse buttons. However, they can be quite hard to remove.

Removing GirlFriend:

you can run trial version of ExterminateIt, or remove GirlFriend manually.

To completely manually remove GirlFriend malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with GirlFriend.

Srizbi Trojan

Srizbi description:
Srizbi Category:Trojan
This loose category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

Multi-purpose Trojans are also included in this group, as some virus writers
create multi-functional Trojans rather than Trojan packs.

Removing Srizbi:

you can run trial version of ExterminateIt, or remove Srizbi manually.

To completely manually remove Srizbi malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Srizbi.

Files.Secure Ransomware

Click here to remove Files.Secure malware

Files.Secure description:
Files.Secure Category:Ransomware
The term ransomware is commonly used to describe such software,
although the field known as cryptovirology predates the term "ransomware".

This type of ransom attack can be accomplished by (for example) attaching
a specially crafted file/program to an e-mail message and sending this to the victim.

Detection Files.Secure :

Files.Secure Files:
[%PROFILE%]\Desktop\Files Secure 2.1.lnk
[%PROFILE%]\Start Menu\Programs\Files Secure 2.1.lnk
[%PROFILE%]\Desktop\Files Secure 2.1.lnk
[%PROFILE%]\Start Menu\Programs\Files Secure 2.1.lnk

Files.Secure Folders:
[%PROGRAM_FILES%]\Files-Secure

Files.Secure Registry Keys:
HKEY_CURRENT_USER\software\filessecure
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\files secure

Removing Files.Secure:

you can run trial version of ExterminateIt, or remove Files.Secure manually.

To completely manually remove Files.Secure malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Files.Secure.

Win32.Tibs.br Trojan

Click here to remove Win32.Tibs.br malware

Win32.Tibs.br description:
Win32.Tibs.br Category:Trojan,Downloader
This category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.
This family of Trojans downloads and installs new malware or adware on the computer.
The downloader then either launches the new malware or registers it to enable autorun
according to the local operating system requirements.

The names and locations of malware to be downloaded are either coded into the
Trojan or downloaded from a specified website.

Detection Win32.Tibs.br :

Win32.Tibs.br Files:
[%SYSTEM%]\dlh9jkd1q1.exe
[%SYSTEM%]\dlh9jkd1q2.exe
[%SYSTEM%]\dlh9jkd1q5.exe
[%SYSTEM%]\dlh9jkd1q6.exe
[%SYSTEM%]\dlh9jkd1q7.exe
[%SYSTEM%]\dlh9jkd1q8.exe
[%SYSTEM%]\dlh9jkd1q1.exe
[%SYSTEM%]\dlh9jkd1q2.exe
[%SYSTEM%]\dlh9jkd1q5.exe
[%SYSTEM%]\dlh9jkd1q6.exe
[%SYSTEM%]\dlh9jkd1q7.exe
[%SYSTEM%]\dlh9jkd1q8.exe

Removing Win32.Tibs.br:

you can run trial version of ExterminateIt, or remove Win32.Tibs.br manually.

To completely manually remove Win32.Tibs.br malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Win32.Tibs.br.

NaughtyPops Adware

Click here to remove NaughtyPops malware

NaughtyPops description:
NaughtyPops Category:Adware
Adware are programs that facilitate delivery for advertising content
to the user and in some cases gather information from the user's computer,
including information related to Internet browser usage or other computer habits

Detection NaughtyPops :

NaughtyPops Files:
[%WINDOWS%]\downloaded program files\ctadl.inf
[%SYSTEM%]\ctadl3.dll
[%WINDOWS%]\downloaded program files\ctadl.inf
[%SYSTEM%]\ctadl3.dll

NaughtyPops Registry Keys:
HKEY_LOCAL_MACHINE\software\apdl
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{87D1A6EF-8CBC-458A-84B5-0333562418CD}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\moduleusage\c:\windows\system32\ctadl3.dll
HKEY_CLASSES_ROOT\clsid\{87d1a6ef-8cbc-458a-84b5-0333562418cd}
HKEY_CLASSES_ROOT\ctadl1.ctadl
HKEY_CLASSES_ROOT\ctadl1.ctadl.1
HKEY_CLASSES_ROOT\ctadl1.ctadlctrl
HKEY_CLASSES_ROOT\ctadl1.ctadlctrl.1
HKEY_CLASSES_ROOT\interface\{07e890e3-ef0c-4ea6-9f79-c5749aca9cc1}
HKEY_CLASSES_ROOT\interface\{96515724-397e-48c7-8974-86c203e666e1}
HKEY_CLASSES_ROOT\typelib\{458be2d9-f8db-43d1-a7ef-73e29c4ef9b6}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{87d1a6ef-8cbc-458a-84b5-0333562418cd}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\moduleusage\[%SYSTEM%]\ctadl3.dll

Removing NaughtyPops:

you can run trial version of ExterminateIt, or remove NaughtyPops manually.

To completely manually remove NaughtyPops malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with NaughtyPops.

RPack Trojan

RPack description:
RPack Category:Trojan,Backdoor
This category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.
Backdoors combine the functionality of most other types of in one package.
Backdoors have one especially dangerous sub-class: variants that can propagate like worms.

Removing RPack:

you can run trial version of ExterminateIt, or remove RPack manually.

To completely manually remove RPack malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with RPack.

Digital.Error DoS

Click here to remove Digital.Error malware

Digital.Error description:
Digital.Error Category:DoS
DoS programs attack web servers by sending numerous requests to the specified server,
often causing it to crash under an excessive volume of requests.

Removing Digital.Error:

you can run trial version of ExterminateIt, or remove Digital.Error manually.

To completely manually remove Digital.Error malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Digital.Error.

ServiceDown Downloader

Click here to remove ServiceDown malware

ServiceDown description:
ServiceDown Category:Downloader
Trojans-downloaders downloads and installs new malware or adware on the computer.

Removing ServiceDown:

you can run trial version of ExterminateIt, or remove ServiceDown manually.

To completely manually remove ServiceDown malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with ServiceDown.

Pigeon.ABD Trojan

Pigeon.ABD description:
Pigeon.ABD Category:Trojan
This loose category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

Multi-purpose Trojans are also included in this group, as some virus writers
create multi-functional Trojans rather than Trojan packs.

Removing Pigeon.ABD:

you can run trial version of ExterminateIt, or remove Pigeon.ABD manually.

To completely manually remove Pigeon.ABD malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Pigeon.ABD.

Cermpsy Trojan

Cermpsy description:
Cermpsy Category:Trojan
This category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

Removing Cermpsy:

you can run trial version of ExterminateIt, or remove Cermpsy manually.

To completely manually remove Cermpsy malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Cermpsy.

Friday, December 26, 2008

Blole Trojan

Blole description:
Blole Category:Trojan,Backdoor
This category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.
Backdoors are the most dangerous type of Trojans and the most popular.
Backdoors open infected machines to external control via Internet.
Often the backdoor will not be visible in the log of active programs.

Removing Blole:

you can run trial version of ExterminateIt, or remove Blole manually.

To completely manually remove Blole malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Blole.

Unke339 Trojan

Unke339 description:
Unke339 Category:Trojan,Backdoor,Downloader,DoS
This loose category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

Multi-purpose Trojans are also included in this group, as some virus writers
create multi-functional Trojans rather than Trojan packs.
Backdoors are the most dangerous type of Trojans and the most popular.
Backdoors open infected machines to external control via Internet.
Often the backdoor will not be visible in the log of active programs.
Trojans-downloaders downloads and installs new malware or adware on the computer.

These programs attack web servers by sending numerous requests to the specified server,
often causing it to crash under an excessive volume of requests.

DoS trojans conduct such attacks from a single computer with the consent of the user.

Worms can carry a DoS procedure as part of their payload.

Removing Unke339:

you can run trial version of ExterminateIt, or remove Unke339 manually.

To completely manually remove Unke339 malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Unke339.

Track4.com Tracking Cookie

Track4.com description:
Track4.com Category:Tracking Cookie
Tracking cookies, like regular cookies, are small files that get deposited
onto your computer's hard drive as you browse the Internet.
Unlike harmless cookies that normally let you use certain websites more easily,
tracking cookies usually collect and report information about what websites you visit
and what you do at those websites.

If you fill out forms online with your real name and contact information,
click on banners and then purchase an item, or fill out sweepstakes or contests forms,
then it's possible that major online advertisers know your name and have associated it
with your IP address and other information.

Detection Track4.com :

Track4.com Registry Keys:
HKEY_CLASSES_ROOT\38

Removing Track4.com:

you can run trial version of ExterminateIt, or remove Track4.com manually.

To completely manually remove Track4.com malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Track4.com.

Pigeon.AMN Trojan

Pigeon.AMN description:
Pigeon.AMN Category:Trojan
This category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

Removing Pigeon.AMN:

you can run trial version of ExterminateIt, or remove Pigeon.AMN manually.

To completely manually remove Pigeon.AMN malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Pigeon.AMN.

DarkThoughts Trojan

Click here to remove DarkThoughts malware

DarkThoughts description:
DarkThoughts Category:Trojan
This category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

Removing DarkThoughts:

you can run trial version of ExterminateIt, or remove DarkThoughts manually.

To completely manually remove DarkThoughts malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with DarkThoughts.

Pigeon.AVJU Trojan

Click here to remove Pigeon.AVJU malware

Pigeon.AVJU description:
Pigeon.AVJU Category:Trojan
This loose category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

Multi-purpose Trojans are also included in this group, as some virus writers
create multi-functional Trojans rather than Trojan packs.

Removing Pigeon.AVJU:

you can run trial version of ExterminateIt, or remove Pigeon.AVJU manually.

To completely manually remove Pigeon.AVJU malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Pigeon.AVJU.

Bancos.GIZ Trojan

Bancos.GIZ description:
Bancos.GIZ Category:Trojan
This category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

Removing Bancos.GIZ:

you can run trial version of ExterminateIt, or remove Bancos.GIZ manually.

To completely manually remove Bancos.GIZ malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Bancos.GIZ.

Backdoor.Tetris Trojan

Click here to remove Backdoor.Tetris malware

Backdoor.Tetris description:
Backdoor.Tetris Category:Trojan,Backdoor
This category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.
Backdoors are the most dangerous type of Trojans and the most popular.
Backdoors open infected machines to external control via Internet.
They function in the same way as legal remote administration programs used by system administrators.
This makes them difficult to detect.

Backdoors are installed and launched without the consent of the user of computer.
Often the backdoor will not be visible in the log of active programs.

Once a backdoor has been successfully launched, the computer is wide open.
Backdoor functions can include:

Launching/ deleting files

Sending/ receiving files

Deleting data

Displaying notification

Rebooting the machine

Executing files

Backdoors are used by virus writers to detect and download confidential information,
execute malicious code, destroy data, include the machine in bot networks and so forth.
Backdoors combine the functionality of most other types of in one package.

Backdoors have one especially dangerous sub-class: variants that can propagate like worms.

Removing Backdoor.Tetris:

you can run trial version of ExterminateIt, or remove Backdoor.Tetris manually.

To completely manually remove Backdoor.Tetris malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Backdoor.Tetris.

Bancos.ICU Trojan

Bancos.ICU description:
Bancos.ICU Category:Trojan
This category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

Removing Bancos.ICU:

you can run trial version of ExterminateIt, or remove Bancos.ICU manually.

To completely manually remove Bancos.ICU malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Bancos.ICU.

Bancos.EOY Trojan

Bancos.EOY description:
Bancos.EOY Category:Trojan
This loose category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

Multi-purpose Trojans are also included in this group, as some virus writers
create multi-functional Trojans rather than Trojan packs.

Removing Bancos.EOY:

you can run trial version of ExterminateIt, or remove Bancos.EOY manually.

To completely manually remove Bancos.EOY malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Bancos.EOY.

SysMan Trojan

SysMan description:
SysMan Category:Trojan
This loose category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

Multi-purpose Trojans are also included in this group, as some virus writers
create multi-functional Trojans rather than Trojan packs.

Removing SysMan:

you can run trial version of ExterminateIt, or remove SysMan manually.

To completely manually remove SysMan malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with SysMan.

Thursday, December 25, 2008

Bionix Trojan

Bionix description:
Bionix Category:Trojan,Backdoor,Hacker Tool
This category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.
Backdoors are the most dangerous type of Trojans and the most popular.
Backdoors open infected machines to external control via Internet.
They function in the same way as legal remote administration programs used by system administrators.
This makes them difficult to detect.

Backdoors are installed and launched without the consent of the user of computer.
Often the backdoor will not be visible in the log of active programs.

Once a backdoor has been successfully launched, the computer is wide open.
Backdoor functions can include:

Launching/ deleting files

Sending/ receiving files

Deleting data

Displaying notification

Rebooting the machine

Executing files

Backdoors are used by virus writers to detect and download confidential information,
execute malicious code, destroy data, include the machine in bot networks and so forth.
Backdoors combine the functionality of most other types of in one package.

Backdoors have one especially dangerous sub-class: variants that can propagate like worms.
Hacker Tools are designed to penetrate remote computers
in order to use them as zombies or to download other malicious programs to computer.

Removing Bionix:

you can run trial version of ExterminateIt, or remove Bionix manually.

To completely manually remove Bionix malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Bionix.

IRC.Kaiten Backdoor

IRC.Kaiten description:
IRC.Kaiten Category:Backdoor
Backdoors are the most dangerous type of Trojans and the most popular.
Backdoors open infected machines to external control via Internet.
They function in the same way as legal remote administration programs used by system administrators.
This makes them difficult to detect.

Backdoors are installed and launched without the consent of the user of computer.
Often the backdoor will not be visible in the log of active programs.

Once a backdoor has been successfully launched, the computer is wide open.
Backdoor functions can include:

Launching/ deleting files

Sending/ receiving files

Deleting data

Displaying notification

Rebooting the machine

Executing files

Backdoors are used by virus writers to detect and download confidential information,
execute malicious code, destroy data, include the machine in bot networks and so forth.
Backdoors combine the functionality of most other types of in one package.

Backdoors have one especially dangerous sub-class: variants that can propagate like worms.

Removing IRC.Kaiten:

you can run trial version of ExterminateIt, or remove IRC.Kaiten manually.

To completely manually remove IRC.Kaiten malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with IRC.Kaiten.

Pigeon.ECN Trojan

Pigeon.ECN description:
Pigeon.ECN Category:Trojan
This category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

Removing Pigeon.ECN:

you can run trial version of ExterminateIt, or remove Pigeon.ECN manually.

To completely manually remove Pigeon.ECN malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Pigeon.ECN.

System33r.Multi.Webdownloader Downloader

Click here to remove System33r.Multi.Webdownloader malware

System33r.Multi.Webdownloader description:
System33r.Multi.Webdownloader Category:Downloader
The downloader either launches the new malware or registers it to enable autorun
according to the local operating system requirements.

Removing System33r.Multi.Webdownloader:

you can run trial version of ExterminateIt, or remove System33r.Multi.Webdownloader manually.

To completely manually remove System33r.Multi.Webdownloader malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with System33r.Multi.Webdownloader.

Lookup.Drbr BHO

Click here to remove Lookup.Drbr malware

Lookup.Drbr description:
Lookup.Drbr Category:BHO,Hijacker,Toolbar
As this information is entered by the user, it is captured by the BHO (Browser Helper Object) and
sent back to the attacker.
Typically, keyloggers of this type will send the stolen information back to the attacker via email
or HTTP POST, which can appear suspicious.Hijackers take control of various parts of your web browser, including your home page,
search pages, and search bar. They may also redirect you to certain sites should you
mistype an address or prevent you from going to a website they would rather you not,
such as sites that combat malware. Some will even redirect you to their own search engine
when you attempt a search.
Toolbar presents itself as a helpful add-on for Internet Explorer but it is a real pest.

Detection Lookup.Drbr :

Lookup.Drbr Files:
[%SYSTEM%]\drbr.dll
[%WINDOWS%]\system\drbr.dll
[%SYSTEM%]\drbr.dll
[%WINDOWS%]\system\drbr.dll

Lookup.Drbr Registry Keys:
HKEY_CLASSES_ROOT\clsid\{2d556983-83d7-4630-9aa5-27c74ca27b79}
HKEY_CLASSES_ROOT\clsid\{382aa497-20d7-4ebb-a188-74660465940d}
HKEY_CLASSES_ROOT\software\microsoft\windows\currentversion\explorer\browser helper objects\{2d556983-83d7-4630-9aa5-27c74ca27b79}
HKEY_LOCAL_MACHINE\software\classes\clsid\{2d556983-83d7-4630-9aa5-27c74ca27b79}
HKEY_LOCAL_MACHINE\software\classes\clsid\{382aa497-20d7-4ebb-a188-74660465940d}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{2d556983-83d7-4630-9aa5-27c74ca27b79}

Lookup.Drbr Registry Values:
HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\toolbar

Removing Lookup.Drbr:

you can run trial version of ExterminateIt, or remove Lookup.Drbr manually.

To completely manually remove Lookup.Drbr malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Lookup.Drbr.

Neodurk Trojan

Neodurk description:
Neodurk Category:Trojan,Backdoor
This loose category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

Multi-purpose Trojans are also included in this group, as some virus writers
create multi-functional Trojans rather than Trojan packs.
Backdoors are the most dangerous type of Trojans and the most popular.
Backdoors open infected machines to external control via Internet.
Often the backdoor will not be visible in the log of active programs.

Removing Neodurk:

you can run trial version of ExterminateIt, or remove Neodurk manually.

To completely manually remove Neodurk malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Neodurk.

Win32.QQSendMess Trojan

Click here to remove Win32.QQSendMess malware

Win32.QQSendMess description:
Win32.QQSendMess Category:Trojan
This category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

Removing Win32.QQSendMess:

you can run trial version of ExterminateIt, or remove Win32.QQSendMess manually.

To completely manually remove Win32.QQSendMess malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Win32.QQSendMess.

Tie Trojan

Tie description:
Tie Category:Trojan,Backdoor,Downloader,DoS
This category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.
Backdoors are the most dangerous type of Trojans and the most popular.
Backdoors open infected machines to external control via Internet.
They function in the same way as legal remote administration programs used by system administrators.
This makes them difficult to detect.

Backdoors are installed and launched without the consent of the user of computer.
Often the backdoor will not be visible in the log of active programs.

Once a backdoor has been successfully launched, the computer is wide open.
Backdoor functions can include:

Launching/ deleting files

Sending/ receiving files

Deleting data

Displaying notification

Rebooting the machine

Executing files

Backdoors are used by virus writers to detect and download confidential information,
execute malicious code, destroy data, include the machine in bot networks and so forth.
Backdoors combine the functionality of most other types of in one package.

Backdoors have one especially dangerous sub-class: variants that can propagate like worms.
This family of Trojans downloads and installs new malware or adware on the computer.
The downloader then either launches the new malware or registers it to enable autorun
according to the local operating system requirements.

The names and locations of malware to be downloaded are either coded into the
Trojan or downloaded from a specified website.
These programs attack web servers by sending numerous requests to the specified server,
often causing it to crash under an excessive volume of requests.

DoS trojans conduct such attacks from a single computer with the consent of the user.

Worms can carry a DoS procedure as part of their payload.

Removing Tie:

you can run trial version of ExterminateIt, or remove Tie manually.

To completely manually remove Tie malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Tie.

MSNFlood Trojan

MSNFlood description:
MSNFlood Category:Trojan
This loose category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

Multi-purpose Trojans are also included in this group, as some virus writers
create multi-functional Trojans rather than Trojan packs.

Detection MSNFlood :

MSNFlood Folders:
[%APPDATA%]\sysdata

Removing MSNFlood:

you can run trial version of ExterminateIt, or remove MSNFlood manually.

To completely manually remove MSNFlood malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with MSNFlood.

JS.Mijail Trojan

JS.Mijail description:
JS.Mijail Category:Trojan
This loose category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

Multi-purpose Trojans are also included in this group, as some virus writers
create multi-functional Trojans rather than Trojan packs.

Removing JS.Mijail:

you can run trial version of ExterminateIt, or remove JS.Mijail manually.

To completely manually remove JS.Mijail malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with JS.Mijail.

Wednesday, December 24, 2008

Voob Trojan

Voob description:
Voob Category:Trojan,Hacker Tool
This loose category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

Multi-purpose Trojans are also included in this group, as some virus writers
create multi-functional Trojans rather than Trojan packs.
These utilities are designed to penetrate remote computers
in order to use them as zombies (by using backdoors) or to download other malicious programs to computer.

Exploits use vulnerabilities in operating systems and applications to achieve the same result.

Removing Voob:

you can run trial version of ExterminateIt, or remove Voob manually.

To completely manually remove Voob malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Voob.

Vxidl.BED Trojan

Vxidl.BED description:
Vxidl.BED Category:Trojan
This category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

Removing Vxidl.BED:

you can run trial version of ExterminateIt, or remove Vxidl.BED manually.

To completely manually remove Vxidl.BED malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Vxidl.BED.

Erkle Trojan

Erkle description:
Erkle Category:Trojan
This category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

Removing Erkle:

you can run trial version of ExterminateIt, or remove Erkle manually.

To completely manually remove Erkle malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Erkle.

Quell Trojan

Quell description:
Quell Category:Trojan,Backdoor,Downloader,DoS
This category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.
Backdoors are used by virus writers to detect and download confidential information,
execute malicious code, destroy data, include the machine in bot networks and so forth.

The downloader either launches the new malware or registers it to enable autorun
according to the local operating system requirements.
DoS trojans conduct attacks from a single computer with the consent of the user.

Removing Quell:

you can run trial version of ExterminateIt, or remove Quell manually.

To completely manually remove Quell malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Quell.

Insect Backdoor

Insect description:
Insect Category:Backdoor,RAT
Backdoors are used by virus writers to detect and download confidential information,
execute malicious code, destroy data, include the machine in bot networks and so forth.

Some RAT trojans are pranks that are most likely being controlled by a friend or enemy on
April Fool's day or a holiday. Prank RATS are generally not harmful, and won't log keystrokes or hack.

Removing Insect:

you can run trial version of ExterminateIt, or remove Insect manually.

To completely manually remove Insect malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Insect.

WinCOM.LPD DoS

WinCOM.LPD description:
WinCOM.LPD Category:DoS
DoS trojans conduct attacks from a single computer with the consent of the user.

Removing WinCOM.LPD:

you can run trial version of ExterminateIt, or remove WinCOM.LPD manually.

To completely manually remove WinCOM.LPD malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with WinCOM.LPD.

TOD Trojan

TOD description:
TOD Category:Trojan
This category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

Removing TOD:

you can run trial version of ExterminateIt, or remove TOD manually.

To completely manually remove TOD malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with TOD.

ConHook Trojan

ConHook description:
ConHook Category:Trojan,Downloader
This category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.
Trojans-downloaders downloads and installs new malware or adware on the computer.

Removing ConHook:

you can run trial version of ExterminateIt, or remove ConHook manually.

To completely manually remove ConHook malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with ConHook.

Petribot.ABU Trojan

Click here to remove Petribot.ABU malware

Petribot.ABU description:
Petribot.ABU Category:Trojan
This loose category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

Multi-purpose Trojans are also included in this group, as some virus writers
create multi-functional Trojans rather than Trojan packs.

Removing Petribot.ABU:

you can run trial version of ExterminateIt, or remove Petribot.ABU manually.

To completely manually remove Petribot.ABU malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Petribot.ABU.

Vxidl.ANR Trojan

Vxidl.ANR description:
Vxidl.ANR Category:Trojan
This category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

Removing Vxidl.ANR:

you can run trial version of ExterminateIt, or remove Vxidl.ANR manually.

To completely manually remove Vxidl.ANR malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Vxidl.ANR.

Win95.Win32Call Trojan

Click here to remove Win95.Win32Call malware

Win95.Win32Call description:
Win95.Win32Call Category:Trojan
This category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

Removing Win95.Win32Call:

you can run trial version of ExterminateIt, or remove Win95.Win32Call manually.

To completely manually remove Win95.Win32Call malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Win95.Win32Call.

Tuesday, December 23, 2008

Itti Trojan

Itti description:
Itti Category:Trojan,Backdoor,Downloader,DoS
This category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.
Backdoors are the most dangerous type of Trojans and the most popular.
Backdoors open infected machines to external control via Internet.
They function in the same way as legal remote administration programs used by system administrators.
This makes them difficult to detect.

Backdoors are installed and launched without the consent of the user of computer.
Often the backdoor will not be visible in the log of active programs.

Once a backdoor has been successfully launched, the computer is wide open.
Backdoor functions can include:

Launching/ deleting files

Sending/ receiving files

Deleting data

Displaying notification

Rebooting the machine

Executing files

Backdoors are used by virus writers to detect and download confidential information,
execute malicious code, destroy data, include the machine in bot networks and so forth.
Backdoors combine the functionality of most other types of in one package.

Backdoors have one especially dangerous sub-class: variants that can propagate like worms.
Trojans-downloaders downloads and installs new malware or adware on the computer.

DoS programs attack web servers by sending numerous requests to the specified server,
often causing it to crash under an excessive volume of requests.

Removing Itti:

you can run trial version of ExterminateIt, or remove Itti manually.

To completely manually remove Itti malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Itti.

KLF Trojan

KLF description:
KLF Category:Trojan,Backdoor,Downloader,DoS
This loose category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

Multi-purpose Trojans are also included in this group, as some virus writers
create multi-functional Trojans rather than Trojan packs.
Backdoors are used by virus writers to detect and download confidential information,
execute malicious code, destroy data, include the machine in bot networks and so forth.

Trojans-downloaders downloads and installs new malware or adware on the computer.

DoS trojans conduct attacks from a single computer with the consent of the user.

Removing KLF:

you can run trial version of ExterminateIt, or remove KLF manually.

To completely manually remove KLF malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with KLF.

Rbot.DSB Trojan

Rbot.DSB description:
Rbot.DSB Category:Trojan
This loose category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

Multi-purpose Trojans are also included in this group, as some virus writers
create multi-functional Trojans rather than Trojan packs.

Detection Rbot.DSB :

Rbot.DSB Files:
[%SYSTEM%]\ntsystem.exe
[%SYSTEM%]\ntsystem.exe

Rbot.DSB Registry Values:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Removing Rbot.DSB:

you can run trial version of ExterminateIt, or remove Rbot.DSB manually.

To completely manually remove Rbot.DSB malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Rbot.DSB.

BackDoor.AEZ RAT

Click here to remove BackDoor.AEZ malware

BackDoor.AEZ description:
BackDoor.AEZ Category:RAT
Some RAT trojans are pranks that are most likely being controlled by a friend or enemy on
April Fool's day or a holiday. Prank RATS are generally not harmful, and won't log keystrokes or hack.

Removing BackDoor.AEZ:

you can run trial version of ExterminateIt, or remove BackDoor.AEZ manually.

To completely manually remove BackDoor.AEZ malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with BackDoor.AEZ.

Pigeon.ASD Trojan

Pigeon.ASD description:
Pigeon.ASD Category:Trojan
This loose category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

Multi-purpose Trojans are also included in this group, as some virus writers
create multi-functional Trojans rather than Trojan packs.

Removing Pigeon.ASD:

you can run trial version of ExterminateIt, or remove Pigeon.ASD manually.

To completely manually remove Pigeon.ASD malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Pigeon.ASD.

SexoBFAX Adware

SexoBFAX description:
SexoBFAX Category:Adware
Adware are programs that facilitate delivery for advertising content
to the user and in some cases gather information from the user's computer,
including information related to Internet browser usage or other computer habits

Detection SexoBFAX :

SexoBFAX Registry Keys:
HKEY_CLASSES_ROOT\clsid\{8f575708-0000-0000-0000-000000000000}

Removing SexoBFAX:

you can run trial version of ExterminateIt, or remove SexoBFAX manually.

To completely manually remove SexoBFAX malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with SexoBFAX.

Holzpferd RAT

Holzpferd description:
Holzpferd Category:RAT
Many trojans and backdoors now have remote administration capabilities
allowing an individual to control the victim's computer.
Many times a file called the server must be opened on the victim's computer before
the trojan can have access to it.

These are generally sent through email, P2P file sharing software,
and in internet downloads. They are usually disguised as a legitimate program or file.
Many server files will display a fake error message when opened, to make it seem like it didn't open.
Some will also kill antivirus and firewall software.

Removing Holzpferd:

you can run trial version of ExterminateIt, or remove Holzpferd manually.

To completely manually remove Holzpferd malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Holzpferd.

Win32.CoreFlood Trojan

Click here to remove Win32.CoreFlood malware

Win32.CoreFlood description:
Win32.CoreFlood Category:Trojan
This category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

Removing Win32.CoreFlood:

you can run trial version of ExterminateIt, or remove Win32.CoreFlood manually.

To completely manually remove Win32.CoreFlood malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Win32.CoreFlood.

KillDisk Trojan

KillDisk description:
KillDisk Category:Trojan,Hacker Tool
This category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.
These utilities are designed to penetrate remote computers
in order to use them as zombies (by using backdoors) or to download other malicious programs to computer.

Exploits use vulnerabilities in operating systems and applications to achieve the same result.

Removing KillDisk:

you can run trial version of ExterminateIt, or remove KillDisk manually.

To completely manually remove KillDisk malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with KillDisk.

Monday, December 22, 2008

Agobot.hj Backdoor

Agobot.hj description:
Agobot.hj Category:Backdoor
Backdoors combine the functionality of most other types of in one package.
Backdoors have one especially dangerous sub-class: variants that can propagate like worms.

Removing Agobot.hj:

you can run trial version of ExterminateIt, or remove Agobot.hj manually.

To completely manually remove Agobot.hj malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Agobot.hj.

SuperBar Adware

SuperBar description:
SuperBar Category:Adware,BHO,Hijacker,Toolbar
Adware are programs that facilitate delivery for advertising content
to the user and in some cases gather information from the user's computer.

BHO (Browser Helper Object) Trojan.
The BHO waits for the user to post personal information to a monitored website.
As this information is entered by the user, it is captured by the BHO and sent back to the attacker.
The method of network transport used by the attacker makes this Trojan unique.
Typically, keyloggers of this type will send the stolen information back to the attacker via email
or HTTP POST, which can appear suspicious.
Instead, this Trojan encodes the data with a simple XOR algorithm before placing it into
the data section of an ICMP ping packet." explained the company.
A desktop hijacker replaces the desktop wallpaper with advertising
for products and services on the desktop.
Toolbar presents itself as a helpful add-on for Internet Explorer but it is a real pest.

Detection SuperBar :

SuperBar Files:
[%PROFILE_TEMP%]\superbarinstall.exe
[%PROFILE_TEMP%]\container.exe
[%PROGRAM_FILES%]\installshield installation information\{8669bd13-2c83-431a-95a9-24b69daf3a41}\layout.bin
[%PROGRAM_FILES%]\installshield installation information\{8669bd13-2c83-431a-95a9-24b69daf3a41}\setup.exe
[%PROGRAM_FILES%]\installshield installation information\{8669bd13-2c83-431a-95a9-24b69daf3a41}\setup.ini
[%PROGRAM_FILES%]\_superbar\_superbar.dll
[%SYSTEM%]\astart.exe
[%SYSTEM%]\cerjtmgr.dll
[%SYSTEM%]\dnasrslvr.dll
[%SYSTEM%]\superbar.dll
[%WINDOWS%]\pspmpsp.exe
[%WINDOWS%]\system\superbar.dll
[%PROFILE_TEMP%]\superbarinstall.exe
[%PROFILE_TEMP%]\container.exe
[%PROGRAM_FILES%]\installshield installation information\{8669bd13-2c83-431a-95a9-24b69daf3a41}\layout.bin
[%PROGRAM_FILES%]\installshield installation information\{8669bd13-2c83-431a-95a9-24b69daf3a41}\setup.exe
[%PROGRAM_FILES%]\installshield installation information\{8669bd13-2c83-431a-95a9-24b69daf3a41}\setup.ini
[%PROGRAM_FILES%]\_superbar\_superbar.dll
[%SYSTEM%]\astart.exe
[%SYSTEM%]\cerjtmgr.dll
[%SYSTEM%]\dnasrslvr.dll
[%SYSTEM%]\superbar.dll
[%WINDOWS%]\pspmpsp.exe
[%WINDOWS%]\system\superbar.dll

SuperBar Folders:
[%PROGRAM_FILES%]\superbar
[%PROGRAM_FILES%]\\superbar

SuperBar Registry Keys:
HKEY_CLASSES_ROOT\typelib\{60f8fb2a-9915-4202-967d-1fa694a8bcf5}
HKEY_LOCAL_MACHINE\software\classes\clsid\{49c3014f-03ed-4634-9fb2-2881f2c7a057}
HKEY_LOCAL_MACHINE\software\classes\clsid\{cf1e49b3-24a6-4b17-94be-c25102e3bf04}
HKEY_LOCAL_MACHINE\software\classes\clsid\{d7f2fd62-6c1b-4b52-85b1-f65a414bf050}
HKEY_LOCAL_MACHINE\software\classes\clsid\{e5dfb380-3988-4c07-8afb-8a47769d9db5}
HKEY_LOCAL_MACHINE\software\classes\interface\{9d1b86c7-1b93-4586-9009-ea3bd0ad63a5}
HKEY_LOCAL_MACHINE\software\classes\interface\{b8afa251-4efb-4703-87d4-da7d2435ba5e}
HKEY_LOCAL_MACHINE\software\classes\interface\{df7d760c-b7e2-4735-bb77-f5a1a9745e16}
HKEY_LOCAL_MACHINE\software\classes\superbar.component
HKEY_LOCAL_MACHINE\software\classes\superbarbho.component
HKEY_LOCAL_MACHINE\software\classes\superbarbl.component
HKEY_LOCAL_MACHINE\software\classes\superbarcws.component
HKEY_LOCAL_MACHINE\software\classes\superbarexts.savedatainterface
HKEY_LOCAL_MACHINE\software\classes\superbarexts.userprofileinterface
HKEY_LOCAL_MACHINE\software\classes\superbarse.component
HKEY_LOCAL_MACHINE\software\classes\typelib\{60f8fb2a-9915-4202-967d-1fa694a8bcf5}
HKEY_CLASSES_ROOT\clsid\{00ec76b0-1952-4f0e-a5e0-f14ffaf01f61}
HKEY_CLASSES_ROOT\clsid\{0af014f4-cbdf-4fd5-8cc4-11c0156e8aec}
HKEY_CLASSES_ROOT\clsid\{0cebef5f-8c3d-4afb-894c-ae547509a7c5}
HKEY_CLASSES_ROOT\clsid\{130dfec0-29ea-11d8-99de-00600fe1a94f}
HKEY_CLASSES_ROOT\clsid\{1548c55c-b1e7-483f-973d-11c58ad44d4a}
HKEY_CLASSES_ROOT\clsid\{20594b79-beba-49c4-a3d6-4bc74fef4746}
HKEY_CLASSES_ROOT\clsid\{3c525947-f2b1-4237-a02b-2ac0ffdab8fb}
HKEY_CLASSES_ROOT\clsid\{450c33b9-5592-49b3-ab91-0681601b63a8}
HKEY_CLASSES_ROOT\clsid\{4d77d848-2989-4c70-9e02-b144bf2808d1}
HKEY_CLASSES_ROOT\clsid\{5b3364b6-7e31-4b06-961c-43a164a8ea09}
HKEY_CLASSES_ROOT\clsid\{66fdb831-bacd-4abe-8035-cfbcbc22cf72}
HKEY_CLASSES_ROOT\clsid\{8c06d78b-93ce-4255-8fa2-c18dd509f18f}
HKEY_CLASSES_ROOT\clsid\{9b065794-84fc-47ec-a99c-8fd33436c2f6}
HKEY_CLASSES_ROOT\clsid\{a693a29b-931c-4367-9c60-ca3c303e35fb3}
HKEY_CLASSES_ROOT\clsid\{b17aba78-ebb3-483c-a56c-d2969e84e6f1}
HKEY_CLASSES_ROOT\clsid\{b8c44339-f1a5-46d5-a207-45cf02db88e8}
HKEY_CLASSES_ROOT\clsid\{c5a80b44-892e-4f46-be6e-db45479787e7}
HKEY_CLASSES_ROOT\clsid\{c776136e-fdb9-4f4b-837d-90593fb5a3fa}
HKEY_CLASSES_ROOT\clsid\{d2af0096-9a71-4bdf-90da-508634fba976}
HKEY_CLASSES_ROOT\clsid\{d33aaf20-50c1-4a4c-9b83-b3b1946aa821}
HKEY_CLASSES_ROOT\clsid\{e513445c-e14a-4b63-8092-49fe687ae023}
HKEY_CLASSES_ROOT\clsid\{f7e5c3b2-2087-458b-9084-61d93b3b17de}
HKEY_CLASSES_ROOT\software\microsoft\windows\currentversion\explorer\browser helper objects\{136a9d1d-1f4b-43d4-8359-6f2382449255}
HKEY_CLASSES_ROOT\typelib\{00ec76b0-1952-4f0e-a5e0-f14ffaf01f61}
HKEY_CLASSES_ROOT\typelib\{1548c55c-b1e7-483f-973d-11c58ad44d4a}
HKEY_CLASSES_ROOT\typelib\{3c525947-f2b1-4237-a02b-2ac0ffdab8fb}
HKEY_CLASSES_ROOT\typelib\{a693a29b-931c-4367-9c60-ca3c303e35fb3}
HKEY_CLASSES_ROOT\typelib\{c5a80b44-892e-4f46-be6e-db45479787e7}
HKEY_CLASSES_ROOT\typelib\{d33aaf20-50c1-4a4c-9b83-b3b1946aa821}
HKEY_CLASSES_ROOT\typelib\{e513445c-e14a-4b63-8092-49fe687ae023}
HKEY_LOCAL_MACHINE\software\classes\clsid\{********-****-****-****-************}
HKEY_LOCAL_MACHINE\software\classes\clsid\{0af014f4-cbdf-4fd5-8cc4-11c0156e8aec}
HKEY_LOCAL_MACHINE\software\classes\clsid\{0cebef5f-8c3d-4afb-894c-ae547509a7c5}
HKEY_LOCAL_MACHINE\software\classes\clsid\{130dfec0-29ea-11d8-99de-00600fe1a94f}
HKEY_LOCAL_MACHINE\software\classes\clsid\{136a9d1d-1f4b-43d4-8359-6f2382449255}
HKEY_LOCAL_MACHINE\software\classes\clsid\{20594b79-beba-49c4-a3d6-4bc74fef4746}
HKEY_LOCAL_MACHINE\software\classes\clsid\{4d77d848-2989-4c70-9e02-b144bf2808d1}
HKEY_LOCAL_MACHINE\software\classes\clsid\{5b3364b6-7e31-4b06-961c-43a164a8ea09}
HKEY_LOCAL_MACHINE\software\classes\clsid\{5f2edea3-930b-45d5-9e9c-9ede29a85ed6}
HKEY_LOCAL_MACHINE\software\classes\clsid\{77f5ace5-ee66-4905-9dfd-ea0d5a7c1ba2}
HKEY_LOCAL_MACHINE\software\classes\clsid\{9b065794-84fc-47ec-a99c-8fd33436c2f6}
HKEY_LOCAL_MACHINE\software\classes\clsid\{b03902b4-d8e5-4d00-8859-a4861e35c3f9}
HKEY_LOCAL_MACHINE\software\classes\clsid\{b17aba78-ebb3-483c-a56c-d2969e84e6f1}
HKEY_LOCAL_MACHINE\software\classes\clsid\{b8c44339-f1a5-46d5-a207-45cf02db88e8}
HKEY_LOCAL_MACHINE\software\classes\clsid\{f7e5c3b2-2087-458b-9084-61d93b3b17de}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{9b065794-84fc-47ec-a99c-8fd33436c2f6}

SuperBar Registry Values:
HKEY_CLASSES_ROOT\clsid\{721b9490-da39-42ae-a00b-4d9f5e4420b2}
HKEY_CLASSES_ROOT\clsid\{721b9490-da39-42ae-a00b-4d9f5e4420b2}\inprocserver32
HKEY_CURRENT_USER\software\1622439085
HKEY_CURRENT_USER\software\dnasrslvr
HKEY_CURRENT_USER\software\dnasrslvr
HKEY_CURRENT_USER\software\microsoft\internet explorer\toolbar\shellbrowser
HKEY_CURRENT_USER\software\microsoft\internet explorer\toolbar\shellbrowser
HKEY_CURRENT_USER\software\microsoft\internet explorer\toolbar\webbrowser
HKEY_CURRENT_USER\software\microsoft\internet explorer\toolbar\webbrowser
HKEY_CURRENT_USER\software\microsoft\internet explorer\toolbar\webbrowser
HKEY_CURRENT_USER\software\microsoft\internet explorer\toolbar\webbrowser
HKEY_CURRENT_USER\software\microsoft\internet explorer\toolbar\webbrowser
HKEY_CURRENT_USER\software\microsoft\internet explorer\toolbar\webbrowser
HKEY_CURRENT_USER\software\microsoft\internet explorer\toolbar\webbrowser
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\internet settings\5.0\cache\extensible cache\mshist012004111620041117
HKEY_LOCAL_MACHINE\software\cvryptdll
HKEY_LOCAL_MACHINE\software\cvryptdll
HKEY_LOCAL_MACHINE\software\cvryptdll
HKEY_LOCAL_MACHINE\software\cvryptdll
HKEY_LOCAL_MACHINE\software\cvryptdll
HKEY_LOCAL_MACHINE\software\cvryptdll
HKEY_LOCAL_MACHINE\software\dnasrslvr
HKEY_LOCAL_MACHINE\software\dnasrslvr
HKEY_LOCAL_MACHINE\software\dnasrslvr
HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\toolbar
HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\toolbar
HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\toolbar
HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\toolbar
HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\toolbar
HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\toolbar
HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\toolbar
HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\toolbar
HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\toolbar
HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\toolbar
HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\toolbar
HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\toolbar
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{8669bd13-2c83-431a-95a9-24b69daf3a41}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{8669bd13-2c83-431a-95a9-24b69daf3a41}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{8669bd13-2c83-431a-95a9-24b69daf3a41}

Removing SuperBar:

you can run trial version of ExterminateIt, or remove SuperBar manually.

To completely manually remove SuperBar malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with SuperBar.

Bancos.HRC Trojan

Bancos.HRC description:
Bancos.HRC Category:Trojan
This loose category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

Multi-purpose Trojans are also included in this group, as some virus writers
create multi-functional Trojans rather than Trojan packs.

Removing Bancos.HRC:

you can run trial version of ExterminateIt, or remove Bancos.HRC manually.

To completely manually remove Bancos.HRC malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Bancos.HRC.

Agent.BOQ Trojan

Agent.BOQ description:
Agent.BOQ Category:Trojan
This loose category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

Multi-purpose Trojans are also included in this group, as some virus writers
create multi-functional Trojans rather than Trojan packs.

Removing Agent.BOQ:

you can run trial version of ExterminateIt, or remove Agent.BOQ manually.

To completely manually remove Agent.BOQ malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Agent.BOQ.

Backdoor.Excalibur Trojan

Click here to remove Backdoor.Excalibur malware

Backdoor.Excalibur description:
Backdoor.Excalibur Category:Trojan,Backdoor
This category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.
Backdoors are used by virus writers to detect and download confidential information,
execute malicious code, destroy data, include the machine in bot networks and so forth.

Removing Backdoor.Excalibur:

you can run trial version of ExterminateIt, or remove Backdoor.Excalibur manually.

To completely manually remove Backdoor.Excalibur malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Backdoor.Excalibur.

247RealMedia.com Tracking Cookie

Click here to remove 247RealMedia.com malware

247RealMedia.com description:
247RealMedia.com Category:Tracking Cookie
Tracking cookies, like regular cookies, are small files that get deposited
onto your computer's hard drive as you browse the Internet.
Unlike harmless cookies that normally let you use certain websites more easily,
tracking cookies usually collect and report information about what websites you visit
and what you do at those websites.

Removing 247RealMedia.com:

you can run trial version of ExterminateIt, or remove 247RealMedia.com manually.

To completely manually remove 247RealMedia.com malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with 247RealMedia.com.

Comando Backdoor

Comando description:
Comando Category:Backdoor,RAT
Backdoors are the most dangerous type of Trojans and the most popular.
Backdoors open infected machines to external control via Internet.
Often the backdoor will not be visible in the log of active programs.
Some RAT trojans are pranks that are most likely being controlled by a friend or enemy on
April Fool's day or a holiday. Prank RATS are generally not harmful, and won't log keystrokes or hack.

Removing Comando:

you can run trial version of ExterminateIt, or remove Comando manually.

To completely manually remove Comando malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Comando.

Benuti.H!downloader Trojan

Click here to remove Benuti.H!downloader malware

Benuti.H!downloader description:
Benuti.H!downloader Category:Trojan
This category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

Removing Benuti.H!downloader:

you can run trial version of ExterminateIt, or remove Benuti.H!downloader manually.

To completely manually remove Benuti.H!downloader malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Benuti.H!downloader.

Sunday, December 21, 2008

Kbd.Turkce.Aciklamasi Backdoor

Click here to remove Kbd.Turkce.Aciklamasi malware

Kbd.Turkce.Aciklamasi description:
Kbd.Turkce.Aciklamasi Category:Backdoor
Backdoors are the most dangerous type of Trojans and the most popular.
Backdoors open infected machines to external control via Internet.
Often the backdoor will not be visible in the log of active programs.

Removing Kbd.Turkce.Aciklamasi:

you can run trial version of ExterminateIt, or remove Kbd.Turkce.Aciklamasi manually.

To completely manually remove Kbd.Turkce.Aciklamasi malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Kbd.Turkce.Aciklamasi.

Clear.Search Hijacker

Click here to remove Clear.Search malware

Clear.Search description:
Clear.Search Category:Hijacker
A Search hijacker redirects search results to other pages and may
transmit search and browsing data to unknown servers. An error page hijacker directs
the browser to another page, usually an advertising page, instead of the usual error
page when the requested URL is not found.

Detection Clear.Search :

Clear.Search Folders:
[%PROGRAM_FILES%]\csbb

Clear.Search Registry Keys:
HKEY_LOCAL_MACHINE\software\ppcleanbait

Removing Clear.Search:

you can run trial version of ExterminateIt, or remove Clear.Search manually.

To completely manually remove Clear.Search malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Clear.Search.

Augudor.Server Trojan

Click here to remove Augudor.Server malware

Augudor.Server description:
Augudor.Server Category:Trojan,Backdoor,RAT
This loose category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

Multi-purpose Trojans are also included in this group, as some virus writers
create multi-functional Trojans rather than Trojan packs.
Backdoors are the most dangerous type of Trojans and the most popular.
Backdoors open infected machines to external control via Internet.
Often the backdoor will not be visible in the log of active programs.
Some RAT trojans are pranks that are most likely being controlled by a friend or enemy on
April Fool's day or a holiday. Prank RATS are generally not harmful, and won't log keystrokes or hack.

Removing Augudor.Server:

you can run trial version of ExterminateIt, or remove Augudor.Server manually.

To completely manually remove Augudor.Server malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Augudor.Server.

Pigeon.DZZ Trojan

Pigeon.DZZ description:
Pigeon.DZZ Category:Trojan
This loose category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

Multi-purpose Trojans are also included in this group, as some virus writers
create multi-functional Trojans rather than Trojan packs.

Removing Pigeon.DZZ:

you can run trial version of ExterminateIt, or remove Pigeon.DZZ manually.

To completely manually remove Pigeon.DZZ malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Pigeon.DZZ.

Spy.Agent.ak Trojan

Click here to remove Spy.Agent.ak malware

Spy.Agent.ak description:
Spy.Agent.ak Category:Trojan
This loose category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

Multi-purpose Trojans are also included in this group, as some virus writers
create multi-functional Trojans rather than Trojan packs.

Removing Spy.Agent.ak:

you can run trial version of ExterminateIt, or remove Spy.Agent.ak manually.

To completely manually remove Spy.Agent.ak malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Spy.Agent.ak.

Plaupwa Trojan

Plaupwa description:
Plaupwa Category:Trojan
This category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

Removing Plaupwa:

you can run trial version of ExterminateIt, or remove Plaupwa manually.

To completely manually remove Plaupwa malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Plaupwa.