Categories: Adware,Spyware,BHO,Downloader
Adware are programs that facilitate delivery for advertising content
to the user and in some cases gather information from the user's computer.
Spyware is computer software that is installed surreptitiously on a personal computer
to intercept or take partial control over the user's interaction
with the computer, without the user's informed consent.
While the term spyware suggests software that secretly monitors the user's behavior,
the functions of spyware extend well beyond simple monitoring.
Spyware programs can collect various types of personal information,
such as Internet surfing habit, sites that have been visited,
but can also interfere with user control of the computer in other ways,
such as installing additional software, redirecting Web browser activity,
accessing websites blindly that will cause more harmful viruses,
or diverting advertising revenue to a third party.
Spyware can even change computer settings, resulting in slow connection speeds,
different home pages, and loss of Internet or other programs.
In an attempt to increase the understanding of spyware, a more formal classification
of its included software types is captured under the term privacy-invasive software.
BHO (Browser Helper Object) Trojan.
The BHO waits for the user to post personal information to a monitored website.
As this information is entered by the user, it is captured by the BHO and sent back to the attacker.
The method of network transport used by the attacker makes this Trojan unique.
Typically, keyloggers of this type will send the stolen information back to the attacker via email
or HTTP POST, which can appear suspicious.
Instead, this Trojan encodes the data with a simple XOR algorithm before placing it into
the data section of an ICMP ping packet." explained the company.
Trojans-downloaders downloads and installs new malware or adware on the computer.
[Kaspersky]Trojan-Dropper.Win32.Agent.ata;
[Panda]Adware/ISearch,Trj/Downloader.NL,Spyware/7r7t;
[Other]Sypare.ISearch,Adware:Win32/iSearch.Toolbar,Agent.CZZD,CommAd Installer,Trojan-Downloader.Small.BUYVisible Symptoms:
Files in system folders:
[%INTERNET_CACHE%]\Content.IE5\0X27Y3CT\installer[1].exe
[%INTERNET_CACHE%]\Content.IE5\CLUJWDEZ\installer[1].exe
[%INTERNET_CACHE%]\Content.IE5\GFQX01WC\installer[1].exe
[%INTERNET_CACHE%]\content.ie5\UXTUADDS\installer[1].exe
[%PROFILE_TEMP%]\b104.exe
[%PROFILE_TEMP%]\cmdinst.exe
[%PROFILE_TEMP%]\temp.fr????
[%SYSTEM%]\atmtd.dll
[%SYSTEM%]\atmtd.dll._
[%SYSTEM%]\atmtd.dll
[%SYSTEM%]\atmtd.dll._
[%SYSTEM%]\toolbar.dll
[%WINDOWS%]\aQ\asappsrv.dll
[%WINDOWS%]\aQ\command.exe
[%WINDOWS%]\b104.exe
[%WINDOWS%]\cmFj\asappsrv.dll
[%WINDOWS%]\cmFj\command.exe
[%WINDOWS%]\Downloaded Program Files\initial.inf
[%WINDOWS%]\dXRpbGlzYXRldXI\asappsrv.dll
[%WINDOWS%]\dXRpbGlzYXRldXI\command.exe~
[%WINDOWS%]\dXRpbGlzYXRldXI\xrlDv35Wsrl5xrK.vbs
[%WINDOWS%]\IA\asappsrv.dll
[%WINDOWS%]\IA\command.exe
[%WINDOWS%]\IA\KE.vbs
[%WINDOWS%]\idlemg.exe
[%WINDOWS%]\IGRvbg\asappsrv.dll
[%WINDOWS%]\IGRvbg\command.exe
[%WINDOWS%]\Lg\asappsrv.dll
[%WINDOWS%]\Lg\command.exe
[%WINDOWS%]\Q2hyaXN0b3BoZXIgSmV3ZWxscw\kZ1VurhXva1CtrK0mApatqUPwT.vbs
[%WINDOWS%]\QmFyYmFyYSBNIEhhd2tpbnM\asappsrv.dll
[%WINDOWS%]\QmFyYmFyYSBNIEhhd2tpbnM\command.exe
[%WINDOWS%]\QmVuamFtaW4gQm9nYXJkdXM\kApRuAIQuqb0kA6BsrL4xrg.vbs
[%WINDOWS%]\QWFyb25z\asappsrv.dll
[%WINDOWS%]\QWFyb25z\command.exe
[%WINDOWS%]\RGFycmVu\asappsrv.dll
[%WINDOWS%]\RGFycmVu\command.exe
[%WINDOWS%]\RmFtLiBkZSBHcmVlZg\asappsrv.dll
[%WINDOWS%]\RmFtLiBkZSBHcmVlZg\command.exe
[%WINDOWS%]\RWR3YXJkIEZvcnRlc2N1ZQ\asappsrv.dll
[%WINDOWS%]\RWR3YXJkIEZvcnRlc2N1ZQ\command.exe
[%WINDOWS%]\S1VMTEFNQUE\mYpgnHIhkoH.vbs
[%WINDOWS%]\S3Jpc3Rlbg\asappsrv.dll
[%WINDOWS%]\S3Jpc3Rlbg\command.exe
[%WINDOWS%]\SG9tZQ\asappsrv.dll
[%WINDOWS%]\SG9tZQ\command.exe
[%WINDOWS%]\Sm9lIFN0ZXJu\asappsrv.dll
[%WINDOWS%]\SmF5IGN1cnRpcw\asappsrv.dll
[%WINDOWS%]\SmFtYWhs\asappsrv.dll
[%WINDOWS%]\SmFtYWhs\command.exe
[%WINDOWS%]\SmFtZXMgRCBWb3lsZXM\asappsrv.dll
[%WINDOWS%]\SmFtZXMgRCBWb3lsZXM\command.exe
[%WINDOWS%]\SmFtZXMgTGF1cmVuY2UgV2hpdGluZw\asappsrv.dll
[%WINDOWS%]\SmFtZXMgTGF1cmVuY2UgV2hpdGluZw\command.exe
[%WINDOWS%]\SmVhbmV0dGUgTGV1c2luaw\asappsrv.dll
[%WINDOWS%]\SmVhbmV0dGUgTGV1c2luaw\command.exe
[%WINDOWS%]\SmVmZiBNb3JhbGVz\asappsrv.dll
[%WINDOWS%]\SmVmZiBNb3JhbGVz\command.exe
[%WINDOWS%]\SmVmZnJleQ\asappsrv.dll
[%WINDOWS%]\SmVmZnJleQ\command.exe
[%WINDOWS%]\SmVmZnJleQ\mApAtBL5yk.vbs
[%WINDOWS%]\SnVhbiBGIExlemFtYQ\asappsrv.dll
[%WINDOWS%]\SnVhbiBGIExlemFtYQ\command.exe
[%WINDOWS%]\SW5tYW4\asappsrv.dll
[%WINDOWS%]\SW5tYW4\command.exe
[%WINDOWS%]\T0VN\asappsrv.dll
[%WINDOWS%]\T0VN\command.exe
[%WINDOWS%]\TEMP\cmdinst.exe
[%WINDOWS%]\TGFycnkgTWFjaW9jaQ\asappsrv.dll
[%WINDOWS%]\TGFycnkgTWFjaW9jaQ\command.exe
[%WINDOWS%]\TGlhbmUgV2hpdG5leQ\asappsrv.dll
[%WINDOWS%]\TGlhbmUgV2hpdG5leQ\command.exe
[%WINDOWS%]\TW9sbHkgQXJub2xk\asappsrv.dll
[%WINDOWS%]\TW9sbHkgQXJub2xk\command.exe
[%WINDOWS%]\TWF0dCBaZXR6\asappsrv.dll
[%WINDOWS%]\TWF0dCBaZXR6\command.exe
[%WINDOWS%]\TWU\asappsrv.dll
[%WINDOWS%]\TWU\command.exe
[%WINDOWS%]\U2FiaWhhIE1hbGlr\asappsrv.dll
[%WINDOWS%]\U3RhbiBTbWl0aA\asappsrv.dll
[%WINDOWS%]\U3RhbiBTbWl0aA\command.exe
[%WINDOWS%]\U3RlcGhlbiBBcndpbmU\asappsrv.dll
[%WINDOWS%]\U3RlcGhlbiBBcndpbmU\command.exe
[%WINDOWS%]\UE9PUA\oH6joE.vbs
[%WINDOWS%]\UGF0IERlc2hhdw\asappsrv.dll
[%WINDOWS%]\UGF0IERlc2hhdw\command.exe
[%WINDOWS%]\V2lsbCBNaXRjaGVsbA\asappsrv.dll
[%WINDOWS%]\V2lsbCBNaXRjaGVsbA\command.exe
[%WINDOWS%]\VXNlcg\asappsrv.dll
[%WINDOWS%]\VXNlcg\command.exe
[%WINDOWS%]\WGlhb0Jyb3RoZXI\asappsrv.dll
[%WINDOWS%]\WGlhb0Jyb3RoZXI\command.exe
[%WINDOWS%]\Y2hhbmVnbWU\sZ11vApBvqo.vbs
[%WINDOWS%]\YWRtaW4\asappsrv.dll
[%WINDOWS%]\YWRtaW4\command.exe
[%WINDOWS%]\ZHk\asappsrv.dll
[%WINDOWS%]\ZHk\command.exe
[%WINDOWS%]\Zm8\asappsrv.dll
[%WINDOWS%]\Zm8\command.exe
[%WINDOWS%]\Zm8\tAf.vbs
[%WINDOWS%]\ZW5yaXF1ZXRhIGRhaWxleQ\tqcVurIYtrl1K3l1uqU5yk.vbs
[%WINDOWS%]\Buddy.exe
[%WINDOWS%]\ceres.dll
[%WINDOWS%]\inst\3p_1n.exe
[%WINDOWS%]\isrvs\edmond.exe
[%WINDOWS%]\isrvs\icons\spywareavenger.ico
[%WINDOWS%]\isrvs\icons\virushunter.ico
[%WINDOWS%]\isrvs\isearch.xpi
[%WINDOWS%]\isrvs\mfiltis.dll
[%WINDOWS%]\isrvs\msdbhk.dll
[%WINDOWS%]\isrvs\sysupd.dll
[%DESKTOP%]\isearch.com.url
[%PROFILE_TEMP%]\b1\build2.exe
[%PROFILE_TEMP%]\b1\ping2.bat
[%SYSTEM%]\a13\rarndrll2.exe
[%SYSTEM%]\toolbar_.dll
[%SYSTEM%]\winhot32.dll
[%WINDOWS%]\system\toolbar.dll
[%WINDOWS%]\system\toolbar_.dll
[%INTERNET_CACHE%]\Content.IE5\0X27Y3CT\installer[1].exe
[%INTERNET_CACHE%]\Content.IE5\CLUJWDEZ\installer[1].exe
[%INTERNET_CACHE%]\Content.IE5\GFQX01WC\installer[1].exe
[%INTERNET_CACHE%]\content.ie5\UXTUADDS\installer[1].exe
[%PROFILE_TEMP%]\b104.exe
[%PROFILE_TEMP%]\cmdinst.exe
[%PROFILE_TEMP%]\temp.fr????
[%SYSTEM%]\atmtd.dll
[%SYSTEM%]\atmtd.dll._
[%SYSTEM%]\atmtd.dll
[%SYSTEM%]\atmtd.dll._
[%SYSTEM%]\toolbar.dll
[%WINDOWS%]\aQ\asappsrv.dll
[%WINDOWS%]\aQ\command.exe
[%WINDOWS%]\b104.exe
[%WINDOWS%]\cmFj\asappsrv.dll
[%WINDOWS%]\cmFj\command.exe
[%WINDOWS%]\Downloaded Program Files\initial.inf
[%WINDOWS%]\dXRpbGlzYXRldXI\asappsrv.dll
[%WINDOWS%]\dXRpbGlzYXRldXI\command.exe~
[%WINDOWS%]\dXRpbGlzYXRldXI\xrlDv35Wsrl5xrK.vbs
[%WINDOWS%]\IA\asappsrv.dll
[%WINDOWS%]\IA\command.exe
[%WINDOWS%]\IA\KE.vbs
[%WINDOWS%]\idlemg.exe
[%WINDOWS%]\IGRvbg\asappsrv.dll
[%WINDOWS%]\IGRvbg\command.exe
[%WINDOWS%]\Lg\asappsrv.dll
[%WINDOWS%]\Lg\command.exe
[%WINDOWS%]\Q2hyaXN0b3BoZXIgSmV3ZWxscw\kZ1VurhXva1CtrK0mApatqUPwT.vbs
[%WINDOWS%]\QmFyYmFyYSBNIEhhd2tpbnM\asappsrv.dll
[%WINDOWS%]\QmFyYmFyYSBNIEhhd2tpbnM\command.exe
[%WINDOWS%]\QmVuamFtaW4gQm9nYXJkdXM\kApRuAIQuqb0kA6BsrL4xrg.vbs
[%WINDOWS%]\QWFyb25z\asappsrv.dll
[%WINDOWS%]\QWFyb25z\command.exe
[%WINDOWS%]\RGFycmVu\asappsrv.dll
[%WINDOWS%]\RGFycmVu\command.exe
[%WINDOWS%]\RmFtLiBkZSBHcmVlZg\asappsrv.dll
[%WINDOWS%]\RmFtLiBkZSBHcmVlZg\command.exe
[%WINDOWS%]\RWR3YXJkIEZvcnRlc2N1ZQ\asappsrv.dll
[%WINDOWS%]\RWR3YXJkIEZvcnRlc2N1ZQ\command.exe
[%WINDOWS%]\S1VMTEFNQUE\mYpgnHIhkoH.vbs
[%WINDOWS%]\S3Jpc3Rlbg\asappsrv.dll
[%WINDOWS%]\S3Jpc3Rlbg\command.exe
[%WINDOWS%]\SG9tZQ\asappsrv.dll
[%WINDOWS%]\SG9tZQ\command.exe
[%WINDOWS%]\Sm9lIFN0ZXJu\asappsrv.dll
[%WINDOWS%]\SmF5IGN1cnRpcw\asappsrv.dll
[%WINDOWS%]\SmFtYWhs\asappsrv.dll
[%WINDOWS%]\SmFtYWhs\command.exe
[%WINDOWS%]\SmFtZXMgRCBWb3lsZXM\asappsrv.dll
[%WINDOWS%]\SmFtZXMgRCBWb3lsZXM\command.exe
[%WINDOWS%]\SmFtZXMgTGF1cmVuY2UgV2hpdGluZw\asappsrv.dll
[%WINDOWS%]\SmFtZXMgTGF1cmVuY2UgV2hpdGluZw\command.exe
[%WINDOWS%]\SmVhbmV0dGUgTGV1c2luaw\asappsrv.dll
[%WINDOWS%]\SmVhbmV0dGUgTGV1c2luaw\command.exe
[%WINDOWS%]\SmVmZiBNb3JhbGVz\asappsrv.dll
[%WINDOWS%]\SmVmZiBNb3JhbGVz\command.exe
[%WINDOWS%]\SmVmZnJleQ\asappsrv.dll
[%WINDOWS%]\SmVmZnJleQ\command.exe
[%WINDOWS%]\SmVmZnJleQ\mApAtBL5yk.vbs
[%WINDOWS%]\SnVhbiBGIExlemFtYQ\asappsrv.dll
[%WINDOWS%]\SnVhbiBGIExlemFtYQ\command.exe
[%WINDOWS%]\SW5tYW4\asappsrv.dll
[%WINDOWS%]\SW5tYW4\command.exe
[%WINDOWS%]\T0VN\asappsrv.dll
[%WINDOWS%]\T0VN\command.exe
[%WINDOWS%]\TEMP\cmdinst.exe
[%WINDOWS%]\TGFycnkgTWFjaW9jaQ\asappsrv.dll
[%WINDOWS%]\TGFycnkgTWFjaW9jaQ\command.exe
[%WINDOWS%]\TGlhbmUgV2hpdG5leQ\asappsrv.dll
[%WINDOWS%]\TGlhbmUgV2hpdG5leQ\command.exe
[%WINDOWS%]\TW9sbHkgQXJub2xk\asappsrv.dll
[%WINDOWS%]\TW9sbHkgQXJub2xk\command.exe
[%WINDOWS%]\TWF0dCBaZXR6\asappsrv.dll
[%WINDOWS%]\TWF0dCBaZXR6\command.exe
[%WINDOWS%]\TWU\asappsrv.dll
[%WINDOWS%]\TWU\command.exe
[%WINDOWS%]\U2FiaWhhIE1hbGlr\asappsrv.dll
[%WINDOWS%]\U3RhbiBTbWl0aA\asappsrv.dll
[%WINDOWS%]\U3RhbiBTbWl0aA\command.exe
[%WINDOWS%]\U3RlcGhlbiBBcndpbmU\asappsrv.dll
[%WINDOWS%]\U3RlcGhlbiBBcndpbmU\command.exe
[%WINDOWS%]\UE9PUA\oH6joE.vbs
[%WINDOWS%]\UGF0IERlc2hhdw\asappsrv.dll
[%WINDOWS%]\UGF0IERlc2hhdw\command.exe
[%WINDOWS%]\V2lsbCBNaXRjaGVsbA\asappsrv.dll
[%WINDOWS%]\V2lsbCBNaXRjaGVsbA\command.exe
[%WINDOWS%]\VXNlcg\asappsrv.dll
[%WINDOWS%]\VXNlcg\command.exe
[%WINDOWS%]\WGlhb0Jyb3RoZXI\asappsrv.dll
[%WINDOWS%]\WGlhb0Jyb3RoZXI\command.exe
[%WINDOWS%]\Y2hhbmVnbWU\sZ11vApBvqo.vbs
[%WINDOWS%]\YWRtaW4\asappsrv.dll
[%WINDOWS%]\YWRtaW4\command.exe
[%WINDOWS%]\ZHk\asappsrv.dll
[%WINDOWS%]\ZHk\command.exe
[%WINDOWS%]\Zm8\asappsrv.dll
[%WINDOWS%]\Zm8\command.exe
[%WINDOWS%]\Zm8\tAf.vbs
[%WINDOWS%]\ZW5yaXF1ZXRhIGRhaWxleQ\tqcVurIYtrl1K3l1uqU5yk.vbs
[%WINDOWS%]\Buddy.exe
[%WINDOWS%]\ceres.dll
[%WINDOWS%]\inst\3p_1n.exe
[%WINDOWS%]\isrvs\edmond.exe
[%WINDOWS%]\isrvs\icons\spywareavenger.ico
[%WINDOWS%]\isrvs\icons\virushunter.ico
[%WINDOWS%]\isrvs\isearch.xpi
[%WINDOWS%]\isrvs\mfiltis.dll
[%WINDOWS%]\isrvs\msdbhk.dll
[%WINDOWS%]\isrvs\sysupd.dll
[%DESKTOP%]\isearch.com.url
[%PROFILE_TEMP%]\b1\build2.exe
[%PROFILE_TEMP%]\b1\ping2.bat
[%SYSTEM%]\a13\rarndrll2.exe
[%SYSTEM%]\toolbar_.dll
[%SYSTEM%]\winhot32.dll
[%WINDOWS%]\system\toolbar.dll
[%WINDOWS%]\system\toolbar_.dll How to detect ISearch:
Files:
[%INTERNET_CACHE%]\Content.IE5\0X27Y3CT\installer[1].exe
[%INTERNET_CACHE%]\Content.IE5\CLUJWDEZ\installer[1].exe
[%INTERNET_CACHE%]\Content.IE5\GFQX01WC\installer[1].exe
[%INTERNET_CACHE%]\content.ie5\UXTUADDS\installer[1].exe
[%PROFILE_TEMP%]\b104.exe
[%PROFILE_TEMP%]\cmdinst.exe
[%PROFILE_TEMP%]\temp.fr????
[%SYSTEM%]\atmtd.dll
[%SYSTEM%]\atmtd.dll._
[%SYSTEM%]\atmtd.dll
[%SYSTEM%]\atmtd.dll._
[%SYSTEM%]\toolbar.dll
[%WINDOWS%]\aQ\asappsrv.dll
[%WINDOWS%]\aQ\command.exe
[%WINDOWS%]\b104.exe
[%WINDOWS%]\cmFj\asappsrv.dll
[%WINDOWS%]\cmFj\command.exe
[%WINDOWS%]\Downloaded Program Files\initial.inf
[%WINDOWS%]\dXRpbGlzYXRldXI\asappsrv.dll
[%WINDOWS%]\dXRpbGlzYXRldXI\command.exe~
[%WINDOWS%]\dXRpbGlzYXRldXI\xrlDv35Wsrl5xrK.vbs
[%WINDOWS%]\IA\asappsrv.dll
[%WINDOWS%]\IA\command.exe
[%WINDOWS%]\IA\KE.vbs
[%WINDOWS%]\idlemg.exe
[%WINDOWS%]\IGRvbg\asappsrv.dll
[%WINDOWS%]\IGRvbg\command.exe
[%WINDOWS%]\Lg\asappsrv.dll
[%WINDOWS%]\Lg\command.exe
[%WINDOWS%]\Q2hyaXN0b3BoZXIgSmV3ZWxscw\kZ1VurhXva1CtrK0mApatqUPwT.vbs
[%WINDOWS%]\QmFyYmFyYSBNIEhhd2tpbnM\asappsrv.dll
[%WINDOWS%]\QmFyYmFyYSBNIEhhd2tpbnM\command.exe
[%WINDOWS%]\QmVuamFtaW4gQm9nYXJkdXM\kApRuAIQuqb0kA6BsrL4xrg.vbs
[%WINDOWS%]\QWFyb25z\asappsrv.dll
[%WINDOWS%]\QWFyb25z\command.exe
[%WINDOWS%]\RGFycmVu\asappsrv.dll
[%WINDOWS%]\RGFycmVu\command.exe
[%WINDOWS%]\RmFtLiBkZSBHcmVlZg\asappsrv.dll
[%WINDOWS%]\RmFtLiBkZSBHcmVlZg\command.exe
[%WINDOWS%]\RWR3YXJkIEZvcnRlc2N1ZQ\asappsrv.dll
[%WINDOWS%]\RWR3YXJkIEZvcnRlc2N1ZQ\command.exe
[%WINDOWS%]\S1VMTEFNQUE\mYpgnHIhkoH.vbs
[%WINDOWS%]\S3Jpc3Rlbg\asappsrv.dll
[%WINDOWS%]\S3Jpc3Rlbg\command.exe
[%WINDOWS%]\SG9tZQ\asappsrv.dll
[%WINDOWS%]\SG9tZQ\command.exe
[%WINDOWS%]\Sm9lIFN0ZXJu\asappsrv.dll
[%WINDOWS%]\SmF5IGN1cnRpcw\asappsrv.dll
[%WINDOWS%]\SmFtYWhs\asappsrv.dll
[%WINDOWS%]\SmFtYWhs\command.exe
[%WINDOWS%]\SmFtZXMgRCBWb3lsZXM\asappsrv.dll
[%WINDOWS%]\SmFtZXMgRCBWb3lsZXM\command.exe
[%WINDOWS%]\SmFtZXMgTGF1cmVuY2UgV2hpdGluZw\asappsrv.dll
[%WINDOWS%]\SmFtZXMgTGF1cmVuY2UgV2hpdGluZw\command.exe
[%WINDOWS%]\SmVhbmV0dGUgTGV1c2luaw\asappsrv.dll
[%WINDOWS%]\SmVhbmV0dGUgTGV1c2luaw\command.exe
[%WINDOWS%]\SmVmZiBNb3JhbGVz\asappsrv.dll
[%WINDOWS%]\SmVmZiBNb3JhbGVz\command.exe
[%WINDOWS%]\SmVmZnJleQ\asappsrv.dll
[%WINDOWS%]\SmVmZnJleQ\command.exe
[%WINDOWS%]\SmVmZnJleQ\mApAtBL5yk.vbs
[%WINDOWS%]\SnVhbiBGIExlemFtYQ\asappsrv.dll
[%WINDOWS%]\SnVhbiBGIExlemFtYQ\command.exe
[%WINDOWS%]\SW5tYW4\asappsrv.dll
[%WINDOWS%]\SW5tYW4\command.exe
[%WINDOWS%]\T0VN\asappsrv.dll
[%WINDOWS%]\T0VN\command.exe
[%WINDOWS%]\TEMP\cmdinst.exe
[%WINDOWS%]\TGFycnkgTWFjaW9jaQ\asappsrv.dll
[%WINDOWS%]\TGFycnkgTWFjaW9jaQ\command.exe
[%WINDOWS%]\TGlhbmUgV2hpdG5leQ\asappsrv.dll
[%WINDOWS%]\TGlhbmUgV2hpdG5leQ\command.exe
[%WINDOWS%]\TW9sbHkgQXJub2xk\asappsrv.dll
[%WINDOWS%]\TW9sbHkgQXJub2xk\command.exe
[%WINDOWS%]\TWF0dCBaZXR6\asappsrv.dll
[%WINDOWS%]\TWF0dCBaZXR6\command.exe
[%WINDOWS%]\TWU\asappsrv.dll
[%WINDOWS%]\TWU\command.exe
[%WINDOWS%]\U2FiaWhhIE1hbGlr\asappsrv.dll
[%WINDOWS%]\U3RhbiBTbWl0aA\asappsrv.dll
[%WINDOWS%]\U3RhbiBTbWl0aA\command.exe
[%WINDOWS%]\U3RlcGhlbiBBcndpbmU\asappsrv.dll
[%WINDOWS%]\U3RlcGhlbiBBcndpbmU\command.exe
[%WINDOWS%]\UE9PUA\oH6joE.vbs
[%WINDOWS%]\UGF0IERlc2hhdw\asappsrv.dll
[%WINDOWS%]\UGF0IERlc2hhdw\command.exe
[%WINDOWS%]\V2lsbCBNaXRjaGVsbA\asappsrv.dll
[%WINDOWS%]\V2lsbCBNaXRjaGVsbA\command.exe
[%WINDOWS%]\VXNlcg\asappsrv.dll
[%WINDOWS%]\VXNlcg\command.exe
[%WINDOWS%]\WGlhb0Jyb3RoZXI\asappsrv.dll
[%WINDOWS%]\WGlhb0Jyb3RoZXI\command.exe
[%WINDOWS%]\Y2hhbmVnbWU\sZ11vApBvqo.vbs
[%WINDOWS%]\YWRtaW4\asappsrv.dll
[%WINDOWS%]\YWRtaW4\command.exe
[%WINDOWS%]\ZHk\asappsrv.dll
[%WINDOWS%]\ZHk\command.exe
[%WINDOWS%]\Zm8\asappsrv.dll
[%WINDOWS%]\Zm8\command.exe
[%WINDOWS%]\Zm8\tAf.vbs
[%WINDOWS%]\ZW5yaXF1ZXRhIGRhaWxleQ\tqcVurIYtrl1K3l1uqU5yk.vbs
[%WINDOWS%]\Buddy.exe
[%WINDOWS%]\ceres.dll
[%WINDOWS%]\inst\3p_1n.exe
[%WINDOWS%]\isrvs\edmond.exe
[%WINDOWS%]\isrvs\icons\spywareavenger.ico
[%WINDOWS%]\isrvs\icons\virushunter.ico
[%WINDOWS%]\isrvs\isearch.xpi
[%WINDOWS%]\isrvs\mfiltis.dll
[%WINDOWS%]\isrvs\msdbhk.dll
[%WINDOWS%]\isrvs\sysupd.dll
[%DESKTOP%]\isearch.com.url
[%PROFILE_TEMP%]\b1\build2.exe
[%PROFILE_TEMP%]\b1\ping2.bat
[%SYSTEM%]\a13\rarndrll2.exe
[%SYSTEM%]\toolbar_.dll
[%SYSTEM%]\winhot32.dll
[%WINDOWS%]\system\toolbar.dll
[%WINDOWS%]\system\toolbar_.dll
[%INTERNET_CACHE%]\Content.IE5\0X27Y3CT\installer[1].exe
[%INTERNET_CACHE%]\Content.IE5\CLUJWDEZ\installer[1].exe
[%INTERNET_CACHE%]\Content.IE5\GFQX01WC\installer[1].exe
[%INTERNET_CACHE%]\content.ie5\UXTUADDS\installer[1].exe
[%PROFILE_TEMP%]\b104.exe
[%PROFILE_TEMP%]\cmdinst.exe
[%PROFILE_TEMP%]\temp.fr????
[%SYSTEM%]\atmtd.dll
[%SYSTEM%]\atmtd.dll._
[%SYSTEM%]\atmtd.dll
[%SYSTEM%]\atmtd.dll._
[%SYSTEM%]\toolbar.dll
[%WINDOWS%]\aQ\asappsrv.dll
[%WINDOWS%]\aQ\command.exe
[%WINDOWS%]\b104.exe
[%WINDOWS%]\cmFj\asappsrv.dll
[%WINDOWS%]\cmFj\command.exe
[%WINDOWS%]\Downloaded Program Files\initial.inf
[%WINDOWS%]\dXRpbGlzYXRldXI\asappsrv.dll
[%WINDOWS%]\dXRpbGlzYXRldXI\command.exe~
[%WINDOWS%]\dXRpbGlzYXRldXI\xrlDv35Wsrl5xrK.vbs
[%WINDOWS%]\IA\asappsrv.dll
[%WINDOWS%]\IA\command.exe
[%WINDOWS%]\IA\KE.vbs
[%WINDOWS%]\idlemg.exe
[%WINDOWS%]\IGRvbg\asappsrv.dll
[%WINDOWS%]\IGRvbg\command.exe
[%WINDOWS%]\Lg\asappsrv.dll
[%WINDOWS%]\Lg\command.exe
[%WINDOWS%]\Q2hyaXN0b3BoZXIgSmV3ZWxscw\kZ1VurhXva1CtrK0mApatqUPwT.vbs
[%WINDOWS%]\QmFyYmFyYSBNIEhhd2tpbnM\asappsrv.dll
[%WINDOWS%]\QmFyYmFyYSBNIEhhd2tpbnM\command.exe
[%WINDOWS%]\QmVuamFtaW4gQm9nYXJkdXM\kApRuAIQuqb0kA6BsrL4xrg.vbs
[%WINDOWS%]\QWFyb25z\asappsrv.dll
[%WINDOWS%]\QWFyb25z\command.exe
[%WINDOWS%]\RGFycmVu\asappsrv.dll
[%WINDOWS%]\RGFycmVu\command.exe
[%WINDOWS%]\RmFtLiBkZSBHcmVlZg\asappsrv.dll
[%WINDOWS%]\RmFtLiBkZSBHcmVlZg\command.exe
[%WINDOWS%]\RWR3YXJkIEZvcnRlc2N1ZQ\asappsrv.dll
[%WINDOWS%]\RWR3YXJkIEZvcnRlc2N1ZQ\command.exe
[%WINDOWS%]\S1VMTEFNQUE\mYpgnHIhkoH.vbs
[%WINDOWS%]\S3Jpc3Rlbg\asappsrv.dll
[%WINDOWS%]\S3Jpc3Rlbg\command.exe
[%WINDOWS%]\SG9tZQ\asappsrv.dll
[%WINDOWS%]\SG9tZQ\command.exe
[%WINDOWS%]\Sm9lIFN0ZXJu\asappsrv.dll
[%WINDOWS%]\SmF5IGN1cnRpcw\asappsrv.dll
[%WINDOWS%]\SmFtYWhs\asappsrv.dll
[%WINDOWS%]\SmFtYWhs\command.exe
[%WINDOWS%]\SmFtZXMgRCBWb3lsZXM\asappsrv.dll
[%WINDOWS%]\SmFtZXMgRCBWb3lsZXM\command.exe
[%WINDOWS%]\SmFtZXMgTGF1cmVuY2UgV2hpdGluZw\asappsrv.dll
[%WINDOWS%]\SmFtZXMgTGF1cmVuY2UgV2hpdGluZw\command.exe
[%WINDOWS%]\SmVhbmV0dGUgTGV1c2luaw\asappsrv.dll
[%WINDOWS%]\SmVhbmV0dGUgTGV1c2luaw\command.exe
[%WINDOWS%]\SmVmZiBNb3JhbGVz\asappsrv.dll
[%WINDOWS%]\SmVmZiBNb3JhbGVz\command.exe
[%WINDOWS%]\SmVmZnJleQ\asappsrv.dll
[%WINDOWS%]\SmVmZnJleQ\command.exe
[%WINDOWS%]\SmVmZnJleQ\mApAtBL5yk.vbs
[%WINDOWS%]\SnVhbiBGIExlemFtYQ\asappsrv.dll
[%WINDOWS%]\SnVhbiBGIExlemFtYQ\command.exe
[%WINDOWS%]\SW5tYW4\asappsrv.dll
[%WINDOWS%]\SW5tYW4\command.exe
[%WINDOWS%]\T0VN\asappsrv.dll
[%WINDOWS%]\T0VN\command.exe
[%WINDOWS%]\TEMP\cmdinst.exe
[%WINDOWS%]\TGFycnkgTWFjaW9jaQ\asappsrv.dll
[%WINDOWS%]\TGFycnkgTWFjaW9jaQ\command.exe
[%WINDOWS%]\TGlhbmUgV2hpdG5leQ\asappsrv.dll
[%WINDOWS%]\TGlhbmUgV2hpdG5leQ\command.exe
[%WINDOWS%]\TW9sbHkgQXJub2xk\asappsrv.dll
[%WINDOWS%]\TW9sbHkgQXJub2xk\command.exe
[%WINDOWS%]\TWF0dCBaZXR6\asappsrv.dll
[%WINDOWS%]\TWF0dCBaZXR6\command.exe
[%WINDOWS%]\TWU\asappsrv.dll
[%WINDOWS%]\TWU\command.exe
[%WINDOWS%]\U2FiaWhhIE1hbGlr\asappsrv.dll
[%WINDOWS%]\U3RhbiBTbWl0aA\asappsrv.dll
[%WINDOWS%]\U3RhbiBTbWl0aA\command.exe
[%WINDOWS%]\U3RlcGhlbiBBcndpbmU\asappsrv.dll
[%WINDOWS%]\U3RlcGhlbiBBcndpbmU\command.exe
[%WINDOWS%]\UE9PUA\oH6joE.vbs
[%WINDOWS%]\UGF0IERlc2hhdw\asappsrv.dll
[%WINDOWS%]\UGF0IERlc2hhdw\command.exe
[%WINDOWS%]\V2lsbCBNaXRjaGVsbA\asappsrv.dll
[%WINDOWS%]\V2lsbCBNaXRjaGVsbA\command.exe
[%WINDOWS%]\VXNlcg\asappsrv.dll
[%WINDOWS%]\VXNlcg\command.exe
[%WINDOWS%]\WGlhb0Jyb3RoZXI\asappsrv.dll
[%WINDOWS%]\WGlhb0Jyb3RoZXI\command.exe
[%WINDOWS%]\Y2hhbmVnbWU\sZ11vApBvqo.vbs
[%WINDOWS%]\YWRtaW4\asappsrv.dll
[%WINDOWS%]\YWRtaW4\command.exe
[%WINDOWS%]\ZHk\asappsrv.dll
[%WINDOWS%]\ZHk\command.exe
[%WINDOWS%]\Zm8\asappsrv.dll
[%WINDOWS%]\Zm8\command.exe
[%WINDOWS%]\Zm8\tAf.vbs
[%WINDOWS%]\ZW5yaXF1ZXRhIGRhaWxleQ\tqcVurIYtrl1K3l1uqU5yk.vbs
[%WINDOWS%]\Buddy.exe
[%WINDOWS%]\ceres.dll
[%WINDOWS%]\inst\3p_1n.exe
[%WINDOWS%]\isrvs\edmond.exe
[%WINDOWS%]\isrvs\icons\spywareavenger.ico
[%WINDOWS%]\isrvs\icons\virushunter.ico
[%WINDOWS%]\isrvs\isearch.xpi
[%WINDOWS%]\isrvs\mfiltis.dll
[%WINDOWS%]\isrvs\msdbhk.dll
[%WINDOWS%]\isrvs\sysupd.dll
[%DESKTOP%]\isearch.com.url
[%PROFILE_TEMP%]\b1\build2.exe
[%PROFILE_TEMP%]\b1\ping2.bat
[%SYSTEM%]\a13\rarndrll2.exe
[%SYSTEM%]\toolbar_.dll
[%SYSTEM%]\winhot32.dll
[%WINDOWS%]\system\toolbar.dll
[%WINDOWS%]\system\toolbar_.dll
Folders:
[%SYSTEM%]\cache32_hsrb
[%PROGRAM_FILES%]\isearch firefox installer
Registry Keys:
HKEY_CLASSES_ROOT\clsid\{2490a770-d039-4b60-a94d-ad22f9ac605b}
HKEY_CLASSES_ROOT\clsid\{285b5ccd-c3f0-4eb6-9632-7d0a3c3af824}
HKEY_CLASSES_ROOT\clsid\{76c13acd-b6fd-4cbe-ac7b-46551f360048}
HKEY_CLASSES_ROOT\clsid\{de910060-8efb-44b9-b492-75180696643f}
HKEY_CLASSES_ROOT\isearch.object
HKEY_CLASSES_ROOT\isearch.object.1
HKEY_CLASSES_ROOT\Typelib\{6D3F5DE4-E980-4407-A10F-9AC771ABAAE6}
HKEY_CURRENT_USER\software\isearch
HKEY_CURRENT_USER\software\_hsrb
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1C78AB3F-A857-482E-80C0-3A1E5238A565}
HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\legacy_cmdservice
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\cmdservice
HKEY_CLASSES_ROOT\CeresDll.CeresDllObj
HKEY_CLASSES_ROOT\CeresDll.CeresDllObj.1
HKEY_CLASSES_ROOT\CLSID\{00000049-8F91-4D9C-9573-F016E7626484}
HKEY_CLASSES_ROOT\Interface\{BB0D5ADC-028D-4185-9288-722DDCE2C757}
HKEY_LOCAL_MACHINE\Software\Classes\CeresDll.CeresDllObj
HKEY_LOCAL_MACHINE\Software\Classes\CeresDll.CeresDllObj.1
HKEY_CLASSES_ROOT\clsid\{1c78ab3f-a857-482e-80c0-3a1e5238a565}
HKEY_CLASSES_ROOT\clsid\{60ebe9c3-3f82-407d-acdf-f1a7bd01169a}
HKEY_CLASSES_ROOT\clsid\{8b224779-3b0e-4fea-8ae1-b66c20dd840f}
HKEY_CLASSES_ROOT\clsid\{99802379-7362-40e2-9d28-8a3b9af880b7}
HKEY_CLASSES_ROOT\clsid\{d9d08235-3baa-4271-a2a6-f394c6636e07}
HKEY_CLASSES_ROOT\clsid\{e07b839e-eb50-487f-b102-fb62808ffca8}
HKEY_CLASSES_ROOT\clsid\{f53d87ad-02aa-432c-90fb-f8c912f15369}
HKEY_CLASSES_ROOT\dsktrf.amo
HKEY_CLASSES_ROOT\dsktrf.amo.1
HKEY_CLASSES_ROOT\dsktrf.cmod
HKEY_CLASSES_ROOT\dsktrf.cmod.1
HKEY_CLASSES_ROOT\dsktrf.iiittt
HKEY_CLASSES_ROOT\dsktrf.iiittt.1
HKEY_CLASSES_ROOT\dsktrf.momo
HKEY_CLASSES_ROOT\dsktrf.momo.1
HKEY_CLASSES_ROOT\dsktrf.ohb
HKEY_CLASSES_ROOT\dsktrf.ohb.1
HKEY_CLASSES_ROOT\dsktrf.omoc
HKEY_CLASSES_ROOT\dsktrf.omoc.1
HKEY_CLASSES_ROOT\software\microsoft\windows\currentversion\explorer\browser helper objects\{1c78ab3f-a857-482e-80c0-3a1e5238a565}
HKEY_CLASSES_ROOT\typelib\{6d3f5de4-e980-4407-a10f-9ac771abaae6}
HKEY_CLASSES_ROOT\typelib\{b5921564-ca50-4d36-a088-fca56eb57812}
HKEY_CLASSES_ROOT\typelib\{f177a37f-e8a8-47ad-a7e9-e95fed03d7ee}
HKEY_CLASSES_ROOT\winalot.amo
HKEY_CLASSES_ROOT\winalot.amo.1
HKEY_CLASSES_ROOT\winalot.cmod
HKEY_CLASSES_ROOT\winalot.dbi
HKEY_CLASSES_ROOT\winalot.dbi.1
HKEY_CLASSES_ROOT\winalot.iiittt
HKEY_CLASSES_ROOT\winalot.iiittt.1
HKEY_CLASSES_ROOT\winalot.momo
HKEY_CLASSES_ROOT\winalot.momo.1
HKEY_CLASSES_ROOT\winalot.ohb
HKEY_CLASSES_ROOT\winalot.ohb.1
HKEY_CLASSES_ROOT\winalot.omoc
HKEY_CURRENT_USER\software\hsb
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{1c78ab3f-a857-482e-80c0-3a1e5238a565}
Registry Values:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\toolbar
HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\toolbar
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\isearch toolbar_is1
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\isearch toolbar_is1
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\isearch toolbar_is1
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\isearch toolbar_is1
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\isearch toolbar_is1
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\isearch toolbar_is1
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\isearch toolbar_is1
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\isearch toolbar_is1
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\isearch toolbar_is1
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\isearch toolbar_is1
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\isearch toolbar_is1
Removing ISearch:
You can download trial version of "Exterminate-It" antivirus software here, to check your computer instantly.
Or buy it to remove ALL viruses from your computer.Also Be Aware of the Following Threats:
Moonpie.Server.family Backdoor Information
TrojanDropper.Win32.VB.bj Trojan Removal instruction
Galorion Trojan Cleaner
Removing CWS.MSConfig Hijacker
No comments:
Post a Comment