Friday, November 14, 2008

Virus.Ray Ransomware

Removing Virus.Ray
Categories: Ransomware
A cryptovirus, cryptotrojan or cryptoworm is a type of
malware that encrypts the data belonging to an individual on a computer,
demanding a ransom for its restoration.

The term ransomware is commonly used to describe software that encrypts the data
belonging to an individual on a computer, demanding a ransom for its restoration.
Although the field known as cryptovirology predates the term "ransomware".

Visible Symptoms:
Files in system folders:
[%DESKTOP%]\VirusRay 3.8.lnk
[%STARTMENU%]\VirusRay 3.8.lnk
[%DESKTOP%]\VirusRay 3.8.lnk
[%STARTMENU%]\VirusRay 3.8.lnk

How to detect Virus.Ray:

Files:
[%DESKTOP%]\VirusRay 3.8.lnk
[%STARTMENU%]\VirusRay 3.8.lnk
[%DESKTOP%]\VirusRay 3.8.lnk
[%STARTMENU%]\VirusRay 3.8.lnk

Folders:
[%PROGRAMS%]\VirusRay 3.8
[%PROGRAM_FILES%]\VirusRay 3.8

Registry Keys:
HKEY_CLASSES_ROOT\clsid\{97c6e0e9-1d24-48ca-11e7-dc22c5308aba}
HKEY_CLASSES_ROOT\interface\{1d723c81-2c9f-44dd-8f94-a2d3a06845e9}
HKEY_CLASSES_ROOT\interface\{41fc2ebd-79f5-4fe0-8558-708dcb7fe255}
HKEY_CLASSES_ROOT\interface\{45db217b-965d-4917-a653-c2a871534b4c}
HKEY_CLASSES_ROOT\interface\{48a95844-a761-4d96-8191-0913d493823e}
HKEY_CLASSES_ROOT\interface\{60fd2747-818b-4242-a041-4c1209f3d3a6}
HKEY_CLASSES_ROOT\interface\{70f731fd-6c5f-4d46-a29c-6b97fabef0d0}
HKEY_CLASSES_ROOT\interface\{77f6abaa-c14b-4e0c-975e-0cffa568b0be}
HKEY_CLASSES_ROOT\interface\{78aa9209-ded5-4f37-93a0-89fbee57e4fc}
HKEY_CLASSES_ROOT\interface\{869b656b-142e-47e6-b4f6-973d17e80bbf}
HKEY_CLASSES_ROOT\interface\{89f84a04-f5ef-4f4a-af97-7da43dd0371f}
HKEY_CLASSES_ROOT\interface\{8f9c1393-41d7-4be1-8752-098bc97514d2}
HKEY_CLASSES_ROOT\interface\{9097fa96-8efd-4d04-8024-c920ab56bbea}
HKEY_CLASSES_ROOT\interface\{acd5d550-4481-4f05-b6d8-a78566bd81d3}
HKEY_CLASSES_ROOT\interface\{be096ecd-d62e-4b2d-bba5-cbf9bfa4ab23}
HKEY_CLASSES_ROOT\interface\{dda20808-84a0-48c3-902a-7e31ff47ea6b}
HKEY_CLASSES_ROOT\interface\{e9c4cbeb-7bdf-47ff-8edf-d72b50bb50ef}
HKEY_CLASSES_ROOT\typelib\{1ae427b0-e3b7-4d2e-a6b9-36605b0f214e}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\virusray 3.8.exe 3.8
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\virusray 3.8
HKEY_LOCAL_MACHINE\software\virusray 3.8

Registry Values:
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run

Removing Virus.Ray:

You can download trial version of "Exterminate-It" antivirus software here, to check your computer instantly.

Or buy it to remove ALL viruses from your computer.

Also Be Aware of the Following Threats:
Win32.ControlTotal Trojan Symptoms
Lineage Trojan Removal
Vxidl.AMP Trojan Removal
CommonName.Internet.Keyword BHO Symptoms
Real.Spy Spyware Cleaner

TrojanDownloader.Win32.Agent.nj Downloader

Removing TrojanDownloader.Win32.Agent.nj
Categories: Downloader
Trojans-downloaders downloads and installs new malware or adware on the computer.


TrojanDownloader.Win32.Agent.nj Also known as:

[F-Prot]W32/Istbar.BO@dl;
[Other]Win32/TrojanDownloader.Delf.EB

Visible Symptoms:
Files in system folders:
[%SYSTEM%]\poker.exe
[%SYSTEM%]\poker.exe

How to detect TrojanDownloader.Win32.Agent.nj:

Files:
[%SYSTEM%]\poker.exe
[%SYSTEM%]\poker.exe

Removing TrojanDownloader.Win32.Agent.nj:

You can download trial version of "Exterminate-It" antivirus software here, to check your computer instantly.

Or buy it to remove ALL viruses from your computer.

Also Be Aware of the Following Threats:
Pigeon.AHN Trojan Cleaner
Win32.Revop Trojan Symptoms
SupremeSpy Spyware Removal instruction
Lookup.Abeb BHO Symptoms
JoyURLs19 Adware Cleaner

Marawi Trojan

Removing Marawi
Categories: Trojan,Backdoor,Downloader,DoS
This category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.
Backdoors are used by virus writers to detect and download confidential information,
execute malicious code, destroy data, include the machine in bot networks and so forth.

Trojans-downloaders downloads and installs new malware or adware on the computer.

DoS programs attack web servers by sending numerous requests to the specified server,
often causing it to crash under an excessive volume of requests.



Marawi Also known as:

[Panda]Philippines.2897

Visible Symptoms:
Files in system folders:
[%APPDATA%]\HbTools\v3.0\HbTools\static\1\ads.cdf
[%APPDATA%]\HbTools\v3.0\HbTools\static\1\btntrans.idx
[%APPDATA%]\HbTools\v3.0\HbTools\static\1\btntrans1.dat
[%APPDATA%]\HbTools\v3.0\HbTools\static\1\business_promo.htm
[%APPDATA%]\HbTools\v3.0\HbTools\static\1\Default_hotbarcom.mnu
[%APPDATA%]\HbTools\v3.0\HbTools\static\1\Default_Mails.mnu
[%APPDATA%]\HbTools\v3.0\HbTools\static\1\d_icons_buttons_1000.res
[%APPDATA%]\HbTools\v3.0\HbTools\static\1\d_icons_buttons_2000.res
[%APPDATA%]\HbTools\v3.0\HbTools\static\1\d_icons_buttons_3000.res
[%APPDATA%]\HbTools\v3.0\HbTools\static\1\d_icons_buttons_bar.res
[%APPDATA%]\HbTools\v3.0\HbTools\static\1\d_icons_buttons_bbar1.res
[%APPDATA%]\HbTools\v3.0\HbTools\static\1\d_icons_buttons_logos.res
[%APPDATA%]\HbTools\v3.0\HbTools\static\1\d_icons_buttons_other.res
[%APPDATA%]\HbTools\v3.0\HbTools\static\1\d_icons_weather.res
[%APPDATA%]\HbTools\v3.0\HbTools\static\1\email-def-511724-548964.mnu
[%APPDATA%]\HbTools\v3.0\HbTools\static\1\email-def-511724-9595.mnu
[%APPDATA%]\HbTools\v3.0\HbTools\static\1\hotbar-premium-hotbar-premium.mnu
[%APPDATA%]\HbTools\v3.0\HbTools\static\1\hotbar-premium.cdf
[%APPDATA%]\HbTools\v3.0\HbTools\static\1\hotbar_promo.htm
[%APPDATA%]\HbTools\v3.0\HbTools\static\1\icons2.res
[%APPDATA%]\HbTools\v3.0\HbTools\static\1\linkpathlegal.txt
[%APPDATA%]\HbTools\v3.0\HbTools\static\1\progress.res
[%APPDATA%]\HbTools\v3.0\HbTools\static\1\s_icons_buttons.res
[%APPDATA%]\HbTools\v3.0\HbTools\static\1\t2_bg.res
[%APPDATA%]\HbTools\v3.0\HbTools\static\1\tsd_bg.res
[%APPDATA%]\HbTools\v3.0\HbTools\static\2\ads.cdf
[%APPDATA%]\HbTools\v3.0\HbTools\static\2\btntrans.idx
[%APPDATA%]\HbTools\v3.0\HbTools\static\2\btntrans1.dat
[%APPDATA%]\HbTools\v3.0\HbTools\static\2\business_promo.htm
[%APPDATA%]\HbTools\v3.0\HbTools\static\2\Default_hotbarcom.mnu
[%APPDATA%]\HbTools\v3.0\HbTools\static\2\Default_Mails.mnu
[%APPDATA%]\HbTools\v3.0\HbTools\static\2\d_icons_buttons_1000.res
[%APPDATA%]\HbTools\v3.0\HbTools\static\2\d_icons_buttons_2000.res
[%APPDATA%]\HbTools\v3.0\HbTools\static\2\d_icons_buttons_3000.res
[%APPDATA%]\HbTools\v3.0\HbTools\static\2\d_icons_buttons_bar.res
[%APPDATA%]\HbTools\v3.0\HbTools\static\2\d_icons_buttons_bbar1.res
[%APPDATA%]\HbTools\v3.0\HbTools\static\2\d_icons_buttons_logos.res
[%APPDATA%]\HbTools\v3.0\HbTools\static\2\d_icons_buttons_other.res
[%APPDATA%]\HbTools\v3.0\HbTools\static\2\d_icons_weather.res
[%APPDATA%]\HbTools\v3.0\HbTools\static\2\email-def-511724-548964.mnu
[%APPDATA%]\HbTools\v3.0\HbTools\static\2\email-def-511724-9595.mnu
[%APPDATA%]\HbTools\v3.0\HbTools\static\2\hotbar-premium-hotbar-premium.mnu
[%APPDATA%]\HbTools\v3.0\HbTools\static\2\hotbar-premium.cdf
[%APPDATA%]\HbTools\v3.0\HbTools\static\2\hotbar_promo.htm
[%APPDATA%]\HbTools\v3.0\HbTools\static\2\icons2.res
[%APPDATA%]\HbTools\v3.0\HbTools\static\2\linkpathlegal.txt
[%APPDATA%]\HbTools\v3.0\HbTools\static\2\progress.res
[%APPDATA%]\HbTools\v3.0\HbTools\static\2\s_icons_buttons.res
[%APPDATA%]\HbTools\v3.0\HbTools\static\2\t2_bg.res
[%APPDATA%]\HbTools\v3.0\HbTools\static\2\tsd_bg.res
[%APPDATA%]\HbTools\v3.0\HbTools\static\DownLoad\ads.xip
[%APPDATA%]\HbTools\v3.0\HbTools\static\DownLoad\BtnTrans.xip
[%APPDATA%]\HbTools\v3.0\HbTools\static\DownLoad\BtnTrans1.xip
[%APPDATA%]\HbTools\v3.0\HbTools\static\DownLoad\business_promo.xip
[%APPDATA%]\HbTools\v3.0\HbTools\static\DownLoad\d_icons_buttons_1000.xip
[%APPDATA%]\HbTools\v3.0\HbTools\static\DownLoad\d_icons_buttons_2000.xip
[%APPDATA%]\HbTools\v3.0\HbTools\static\DownLoad\d_icons_buttons_3000.xip
[%APPDATA%]\HbTools\v3.0\HbTools\static\DownLoad\d_icons_buttons_bar.xip
[%APPDATA%]\HbTools\v3.0\HbTools\static\DownLoad\d_icons_buttons_bbar1.xip
[%APPDATA%]\HbTools\v3.0\HbTools\static\DownLoad\d_icons_buttons_logos.xip
[%APPDATA%]\HbTools\v3.0\HbTools\static\DownLoad\d_icons_buttons_other.xip
[%APPDATA%]\HbTools\v3.0\HbTools\static\DownLoad\d_icons_weather.xip
[%APPDATA%]\HbTools\v3.0\HbTools\static\DownLoad\hotbar-premium.xip
[%APPDATA%]\HbTools\v3.0\HbTools\static\DownLoad\hotbar_promo.xip
[%APPDATA%]\HbTools\v3.0\HbTools\static\DownLoad\icons2.xip
[%APPDATA%]\HbTools\v3.0\HbTools\static\DownLoad\linkpathlegal.xip
[%APPDATA%]\HbTools\v3.0\HbTools\static\DownLoad\progress.xip
[%APPDATA%]\HbTools\v3.0\HbTools\static\DownLoad\s_icons_buttons.xip
[%APPDATA%]\HbTools\v3.0\HbTools\static\DownLoad\t2_bg.xip
[%APPDATA%]\HbTools\v3.0\HbTools\static\DownLoad\tsd_bg.xip
[%APPDATA%]\HbTools_Icons\games2.ico
[%APPDATA%]\HbTools_Icons\Registryrepair.ico
[%APPDATA%]\HbTools_Icons\wallpapere1.ico
[%APPDATA%]\ShopperReports\cs\report\ag_ShopperReports.xml
[%APPDATA%]\ShopperReports\cs\report\send_ShopperReports.xml.db
[%APPDATA%]\SpamBlockerUtility\v3.0\HostOI\static\1\business_promo.htm
[%APPDATA%]\SpamBlockerUtility\v3.0\HostOI\static\1\email-def-511724-9595.mnu
[%APPDATA%]\SpamBlockerUtility\v3.0\HostOI\static\1\email-def-email-backgrounds.mnu
[%APPDATA%]\SpamBlockerUtility\v3.0\HostOI\static\1\email-premium-email-premium.mnu
[%APPDATA%]\SpamBlockerUtility\v3.0\HostOI\static\1\progress.res
[%APPDATA%]\SpamBlockerUtility\v3.0\HostOI\static\2\business_promo.htm
[%APPDATA%]\SpamBlockerUtility\v3.0\HostOI\static\2\email-def-511724-9595.mnu
[%APPDATA%]\SpamBlockerUtility\v3.0\HostOI\static\2\email-def-email-backgrounds.mnu
[%APPDATA%]\SpamBlockerUtility\v3.0\HostOI\static\2\email-premium-email-premium.mnu
[%APPDATA%]\SpamBlockerUtility\v3.0\HostOI\static\2\progress.res
[%APPDATA%]\SpamBlockerUtility\v3.0\HostOI\static\DownLoad\business_promo.xip
[%APPDATA%]\SpamBlockerUtility\v3.0\HostOI\static\DownLoad\progress.xip
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\1\ads.cdf
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\1\btntrans.idx
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\1\btntrans1.dat
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\1\business_promo.htm
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\1\Default_Mails.mnu
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\1\d_icons_buttons_1000.res
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\1\d_icons_buttons_2000.res
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\1\d_icons_buttons_3000.res
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\1\d_icons_buttons_bar.res
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\1\d_icons_buttons_bbar1.res
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\1\d_icons_buttons_logos.res
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\1\d_icons_buttons_other.res
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\1\d_icons_weather.res
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\1\email-def-511724-9595.mnu
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\1\hotbar-premium-hotbar-premium.mnu
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\1\hotbar-premium.cdf
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\1\linkpathlegal.txt
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\1\progress.res
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\1\tsd_bg.res
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\2\ads.cdf
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\2\btntrans.idx
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\2\btntrans1.dat
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\2\business_promo.htm
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\2\Default_Mails.mnu
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\2\d_icons_buttons_1000.res
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\2\d_icons_buttons_2000.res
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\2\d_icons_buttons_3000.res
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\2\d_icons_buttons_bar.res
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\2\d_icons_buttons_bbar1.res
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\2\d_icons_buttons_logos.res
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\2\d_icons_buttons_other.res
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\2\d_icons_weather.res
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\2\email-def-511724-9595.mnu
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\2\hotbar-premium-hotbar-premium.mnu
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\2\hotbar-premium.cdf
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\2\linkpathlegal.txt
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\2\progress.res
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\2\tsd_bg.res
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\DownLoad\ads.xip
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\DownLoad\BtnTrans.xip
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\DownLoad\BtnTrans1.xip
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\DownLoad\business_promo.xip
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\DownLoad\d_icons_buttons_1000.xip
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\DownLoad\d_icons_buttons_2000.xip
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\DownLoad\d_icons_buttons_3000.xip
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\DownLoad\d_icons_buttons_bar.xip
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\DownLoad\d_icons_buttons_bbar1.xip
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\DownLoad\d_icons_buttons_logos.xip
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\DownLoad\d_icons_buttons_other.xip
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\DownLoad\d_icons_weather.xip
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\DownLoad\hotbar-premium.xip
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\DownLoad\linkpathlegal.xip
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\DownLoad\progress.xip
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\DownLoad\tsd_bg.xip
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\1\btntrans.idx
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\1\btntrans1.dat
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\1\Default_hotbarcom.mnu
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\1\Default_Mails.mnu
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\1\d_icons_buttons_1000.res
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\1\d_icons_buttons_2000.res
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\1\d_icons_buttons_3000.res
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\1\d_icons_buttons_bar.res
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\1\d_icons_buttons_bbar1.res
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\1\d_icons_buttons_logos.res
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\1\d_icons_buttons_other.res
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\1\email-def-511724-548964.mnu
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\1\email-def-511724-9595.mnu
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\1\icons2.res
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\1\linkpathlegal.txt
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\1\progress.res
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\2\btntrans.idx
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\2\btntrans1.dat
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\2\Default_hotbarcom.mnu
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\2\Default_Mails.mnu
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\2\d_icons_buttons_1000.res
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\2\d_icons_buttons_2000.res
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\2\d_icons_buttons_3000.res
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\2\d_icons_buttons_bar.res
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\2\d_icons_buttons_bbar1.res
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\2\d_icons_buttons_logos.res
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\2\d_icons_buttons_other.res
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\2\email-def-511724-548964.mnu
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\2\email-def-511724-9595.mnu
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\2\icons2.res
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\2\linkpathlegal.txt
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\2\progress.res
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\DownLoad\BtnTrans.xip
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\DownLoad\BtnTrans1.xip
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\DownLoad\d_icons_buttons_1000.xip
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\DownLoad\d_icons_buttons_2000.xip
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\DownLoad\d_icons_buttons_3000.xip
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\DownLoad\d_icons_buttons_bar.xip
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\DownLoad\d_icons_buttons_bbar1.xip
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\DownLoad\d_icons_buttons_logos.xip
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\DownLoad\d_icons_buttons_other.xip
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\DownLoad\icons2.xip
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\DownLoad\linkpathlegal.xip
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\DownLoad\progress.xip
[%DESKTOP%]\Find And Fix Errors.lnk
[%DESKTOP%]\free pc wallpapers.lnk
[%PROFILE_TEMP%]\cdE6.tmp.exe
[%PROGRAM_FILES%]\SpamBlockerUtility\bin\4.7.5.0\dBenderC.dll
[%PROGRAM_FILES%]\SpamBlockerUtility\bin\4.7.5.0\Redemption.dll
[%PROGRAM_FILES%]\SpamBlockerUtility\bin\4.7.5.0\SBClientSinkPS.dll
[%PROGRAM_FILES%]\SpamBlockerUtility\bin\4.7.5.0\SBInst.exe
[%PROGRAM_FILES%]\SpamBlockerUtility\bin\4.7.5.0\SbOEAddOn.exe
[%PROGRAM_FILES%]\SpamBlockerUtility\bin\4.7.5.0\SBOLExp.dll
[%PROGRAM_FILES%]\SpamBlockerUtility\bin\4.7.5.0\SBOLExt.dll
[%PROGRAM_FILES%]\SpamBlockerUtility\bin\4.7.5.0\SBSrvPS.dll
[%PROGRAM_FILES%]\SpamBlockerUtility\bin\4.7.5.0\SBTrayAppPS.dll
[%PROGRAM_FILES%]\SpamBlockerUtility\bin\4.7.5.0\SBUIRes.dll
[%PROGRAM_FILES%]\SpamBlockerUtility\bin\4.7.5.0\SBUISkin.dll
[%PROGRAM_FILES%]\SpamBlockerUtility\bin\4.7.5.0\SpamBlocker.exe
[%PROGRAM_FILES%]\SpamBlockerUtility\bin\4.8.0.0\dBenderC.dll
[%PROGRAM_FILES%]\SpamBlockerUtility\bin\4.8.0.0\Redemption.dll
[%PROGRAM_FILES%]\SpamBlockerUtility\bin\4.8.0.0\SBClientSinkPS.dll
[%PROGRAM_FILES%]\SpamBlockerUtility\bin\4.8.0.0\SBInst.exe
[%PROGRAM_FILES%]\SpamBlockerUtility\bin\4.8.0.0\SBOLExp.dll
[%PROGRAM_FILES%]\SpamBlockerUtility\bin\4.8.0.0\SBOLExt.dll
[%PROGRAM_FILES%]\SpamBlockerUtility\bin\4.8.0.0\SBSrvPS.dll
[%PROGRAM_FILES%]\SpamBlockerUtility\bin\4.8.0.0\SBTrayAppPS.dll
[%PROGRAM_FILES%]\SpamBlockerUtility\bin\4.8.0.0\SBUIRes.dll
[%PROGRAM_FILES%]\SpamBlockerUtility\bin\4.8.0.0\SBUISkin.dll
[%PROGRAM_FILES%]\SpamBlockerUtility\bin\4.8.0.0\SpamBlocker.exe
[%PROGRAM_FILES%]\SPAMBL~1\Bin\480~1.0\SBInst.exe
[%PROGRAM_FILES%]\SPAMBL~1\Bin\480~1.0\SBOLExp.dll
[%PROGRAM_FILES%]\ZangoToolbar\Bin\4.8.2.0\dBenderC.dll
[%SYSTEM%]\dwqvukbf.exe
[%SYSTEM%]\ubsopymh.exe
[%SYSTEM%]\yrztrupg.exe
[%WINDOWS%]\downloaded program files\hbtools.inf
[%WINDOWS%]\downloaded program files\hotbar.inf
[%WINDOWS%]\Downloaded Program Files\SpamBlockerUtility.inf
[%APPDATA%]\HbTools\v3.0\HbTools\static\1\ads.cdf
[%APPDATA%]\HbTools\v3.0\HbTools\static\1\btntrans.idx
[%APPDATA%]\HbTools\v3.0\HbTools\static\1\btntrans1.dat
[%APPDATA%]\HbTools\v3.0\HbTools\static\1\business_promo.htm
[%APPDATA%]\HbTools\v3.0\HbTools\static\1\Default_hotbarcom.mnu
[%APPDATA%]\HbTools\v3.0\HbTools\static\1\Default_Mails.mnu
[%APPDATA%]\HbTools\v3.0\HbTools\static\1\d_icons_buttons_1000.res
[%APPDATA%]\HbTools\v3.0\HbTools\static\1\d_icons_buttons_2000.res
[%APPDATA%]\HbTools\v3.0\HbTools\static\1\d_icons_buttons_3000.res
[%APPDATA%]\HbTools\v3.0\HbTools\static\1\d_icons_buttons_bar.res
[%APPDATA%]\HbTools\v3.0\HbTools\static\1\d_icons_buttons_bbar1.res
[%APPDATA%]\HbTools\v3.0\HbTools\static\1\d_icons_buttons_logos.res
[%APPDATA%]\HbTools\v3.0\HbTools\static\1\d_icons_buttons_other.res
[%APPDATA%]\HbTools\v3.0\HbTools\static\1\d_icons_weather.res
[%APPDATA%]\HbTools\v3.0\HbTools\static\1\email-def-511724-548964.mnu
[%APPDATA%]\HbTools\v3.0\HbTools\static\1\email-def-511724-9595.mnu
[%APPDATA%]\HbTools\v3.0\HbTools\static\1\hotbar-premium-hotbar-premium.mnu
[%APPDATA%]\HbTools\v3.0\HbTools\static\1\hotbar-premium.cdf
[%APPDATA%]\HbTools\v3.0\HbTools\static\1\hotbar_promo.htm
[%APPDATA%]\HbTools\v3.0\HbTools\static\1\icons2.res
[%APPDATA%]\HbTools\v3.0\HbTools\static\1\linkpathlegal.txt
[%APPDATA%]\HbTools\v3.0\HbTools\static\1\progress.res
[%APPDATA%]\HbTools\v3.0\HbTools\static\1\s_icons_buttons.res
[%APPDATA%]\HbTools\v3.0\HbTools\static\1\t2_bg.res
[%APPDATA%]\HbTools\v3.0\HbTools\static\1\tsd_bg.res
[%APPDATA%]\HbTools\v3.0\HbTools\static\2\ads.cdf
[%APPDATA%]\HbTools\v3.0\HbTools\static\2\btntrans.idx
[%APPDATA%]\HbTools\v3.0\HbTools\static\2\btntrans1.dat
[%APPDATA%]\HbTools\v3.0\HbTools\static\2\business_promo.htm
[%APPDATA%]\HbTools\v3.0\HbTools\static\2\Default_hotbarcom.mnu
[%APPDATA%]\HbTools\v3.0\HbTools\static\2\Default_Mails.mnu
[%APPDATA%]\HbTools\v3.0\HbTools\static\2\d_icons_buttons_1000.res
[%APPDATA%]\HbTools\v3.0\HbTools\static\2\d_icons_buttons_2000.res
[%APPDATA%]\HbTools\v3.0\HbTools\static\2\d_icons_buttons_3000.res
[%APPDATA%]\HbTools\v3.0\HbTools\static\2\d_icons_buttons_bar.res
[%APPDATA%]\HbTools\v3.0\HbTools\static\2\d_icons_buttons_bbar1.res
[%APPDATA%]\HbTools\v3.0\HbTools\static\2\d_icons_buttons_logos.res
[%APPDATA%]\HbTools\v3.0\HbTools\static\2\d_icons_buttons_other.res
[%APPDATA%]\HbTools\v3.0\HbTools\static\2\d_icons_weather.res
[%APPDATA%]\HbTools\v3.0\HbTools\static\2\email-def-511724-548964.mnu
[%APPDATA%]\HbTools\v3.0\HbTools\static\2\email-def-511724-9595.mnu
[%APPDATA%]\HbTools\v3.0\HbTools\static\2\hotbar-premium-hotbar-premium.mnu
[%APPDATA%]\HbTools\v3.0\HbTools\static\2\hotbar-premium.cdf
[%APPDATA%]\HbTools\v3.0\HbTools\static\2\hotbar_promo.htm
[%APPDATA%]\HbTools\v3.0\HbTools\static\2\icons2.res
[%APPDATA%]\HbTools\v3.0\HbTools\static\2\linkpathlegal.txt
[%APPDATA%]\HbTools\v3.0\HbTools\static\2\progress.res
[%APPDATA%]\HbTools\v3.0\HbTools\static\2\s_icons_buttons.res
[%APPDATA%]\HbTools\v3.0\HbTools\static\2\t2_bg.res
[%APPDATA%]\HbTools\v3.0\HbTools\static\2\tsd_bg.res
[%APPDATA%]\HbTools\v3.0\HbTools\static\DownLoad\ads.xip
[%APPDATA%]\HbTools\v3.0\HbTools\static\DownLoad\BtnTrans.xip
[%APPDATA%]\HbTools\v3.0\HbTools\static\DownLoad\BtnTrans1.xip
[%APPDATA%]\HbTools\v3.0\HbTools\static\DownLoad\business_promo.xip
[%APPDATA%]\HbTools\v3.0\HbTools\static\DownLoad\d_icons_buttons_1000.xip
[%APPDATA%]\HbTools\v3.0\HbTools\static\DownLoad\d_icons_buttons_2000.xip
[%APPDATA%]\HbTools\v3.0\HbTools\static\DownLoad\d_icons_buttons_3000.xip
[%APPDATA%]\HbTools\v3.0\HbTools\static\DownLoad\d_icons_buttons_bar.xip
[%APPDATA%]\HbTools\v3.0\HbTools\static\DownLoad\d_icons_buttons_bbar1.xip
[%APPDATA%]\HbTools\v3.0\HbTools\static\DownLoad\d_icons_buttons_logos.xip
[%APPDATA%]\HbTools\v3.0\HbTools\static\DownLoad\d_icons_buttons_other.xip
[%APPDATA%]\HbTools\v3.0\HbTools\static\DownLoad\d_icons_weather.xip
[%APPDATA%]\HbTools\v3.0\HbTools\static\DownLoad\hotbar-premium.xip
[%APPDATA%]\HbTools\v3.0\HbTools\static\DownLoad\hotbar_promo.xip
[%APPDATA%]\HbTools\v3.0\HbTools\static\DownLoad\icons2.xip
[%APPDATA%]\HbTools\v3.0\HbTools\static\DownLoad\linkpathlegal.xip
[%APPDATA%]\HbTools\v3.0\HbTools\static\DownLoad\progress.xip
[%APPDATA%]\HbTools\v3.0\HbTools\static\DownLoad\s_icons_buttons.xip
[%APPDATA%]\HbTools\v3.0\HbTools\static\DownLoad\t2_bg.xip
[%APPDATA%]\HbTools\v3.0\HbTools\static\DownLoad\tsd_bg.xip
[%APPDATA%]\HbTools_Icons\games2.ico
[%APPDATA%]\HbTools_Icons\Registryrepair.ico
[%APPDATA%]\HbTools_Icons\wallpapere1.ico
[%APPDATA%]\ShopperReports\cs\report\ag_ShopperReports.xml
[%APPDATA%]\ShopperReports\cs\report\send_ShopperReports.xml.db
[%APPDATA%]\SpamBlockerUtility\v3.0\HostOI\static\1\business_promo.htm
[%APPDATA%]\SpamBlockerUtility\v3.0\HostOI\static\1\email-def-511724-9595.mnu
[%APPDATA%]\SpamBlockerUtility\v3.0\HostOI\static\1\email-def-email-backgrounds.mnu
[%APPDATA%]\SpamBlockerUtility\v3.0\HostOI\static\1\email-premium-email-premium.mnu
[%APPDATA%]\SpamBlockerUtility\v3.0\HostOI\static\1\progress.res
[%APPDATA%]\SpamBlockerUtility\v3.0\HostOI\static\2\business_promo.htm
[%APPDATA%]\SpamBlockerUtility\v3.0\HostOI\static\2\email-def-511724-9595.mnu
[%APPDATA%]\SpamBlockerUtility\v3.0\HostOI\static\2\email-def-email-backgrounds.mnu
[%APPDATA%]\SpamBlockerUtility\v3.0\HostOI\static\2\email-premium-email-premium.mnu
[%APPDATA%]\SpamBlockerUtility\v3.0\HostOI\static\2\progress.res
[%APPDATA%]\SpamBlockerUtility\v3.0\HostOI\static\DownLoad\business_promo.xip
[%APPDATA%]\SpamBlockerUtility\v3.0\HostOI\static\DownLoad\progress.xip
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\1\ads.cdf
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\1\btntrans.idx
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\1\btntrans1.dat
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\1\business_promo.htm
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\1\Default_Mails.mnu
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\1\d_icons_buttons_1000.res
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\1\d_icons_buttons_2000.res
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\1\d_icons_buttons_3000.res
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\1\d_icons_buttons_bar.res
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\1\d_icons_buttons_bbar1.res
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\1\d_icons_buttons_logos.res
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\1\d_icons_buttons_other.res
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\1\d_icons_weather.res
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\1\email-def-511724-9595.mnu
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\1\hotbar-premium-hotbar-premium.mnu
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\1\hotbar-premium.cdf
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\1\linkpathlegal.txt
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\1\progress.res
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\1\tsd_bg.res
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\2\ads.cdf
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\2\btntrans.idx
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\2\btntrans1.dat
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\2\business_promo.htm
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\2\Default_Mails.mnu
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\2\d_icons_buttons_1000.res
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\2\d_icons_buttons_2000.res
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\2\d_icons_buttons_3000.res
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\2\d_icons_buttons_bar.res
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\2\d_icons_buttons_bbar1.res
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\2\d_icons_buttons_logos.res
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\2\d_icons_buttons_other.res
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\2\d_icons_weather.res
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\2\email-def-511724-9595.mnu
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\2\hotbar-premium-hotbar-premium.mnu
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\2\hotbar-premium.cdf
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\2\linkpathlegal.txt
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\2\progress.res
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\2\tsd_bg.res
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\DownLoad\ads.xip
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\DownLoad\BtnTrans.xip
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\DownLoad\BtnTrans1.xip
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\DownLoad\business_promo.xip
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\DownLoad\d_icons_buttons_1000.xip
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\DownLoad\d_icons_buttons_2000.xip
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\DownLoad\d_icons_buttons_3000.xip
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\DownLoad\d_icons_buttons_bar.xip
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\DownLoad\d_icons_buttons_bbar1.xip
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\DownLoad\d_icons_buttons_logos.xip
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\DownLoad\d_icons_buttons_other.xip
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\DownLoad\d_icons_weather.xip
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\DownLoad\hotbar-premium.xip
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\DownLoad\linkpathlegal.xip
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\DownLoad\progress.xip
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\DownLoad\tsd_bg.xip
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\1\btntrans.idx
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\1\btntrans1.dat
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\1\Default_hotbarcom.mnu
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\1\Default_Mails.mnu
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\1\d_icons_buttons_1000.res
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\1\d_icons_buttons_2000.res
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\1\d_icons_buttons_3000.res
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\1\d_icons_buttons_bar.res
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\1\d_icons_buttons_bbar1.res
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\1\d_icons_buttons_logos.res
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\1\d_icons_buttons_other.res
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\1\email-def-511724-548964.mnu
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\1\email-def-511724-9595.mnu
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\1\icons2.res
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\1\linkpathlegal.txt
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\1\progress.res
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\2\btntrans.idx
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\2\btntrans1.dat
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\2\Default_hotbarcom.mnu
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\2\Default_Mails.mnu
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\2\d_icons_buttons_1000.res
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\2\d_icons_buttons_2000.res
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\2\d_icons_buttons_3000.res
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\2\d_icons_buttons_bar.res
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\2\d_icons_buttons_bbar1.res
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\2\d_icons_buttons_logos.res
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\2\d_icons_buttons_other.res
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\2\email-def-511724-548964.mnu
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\2\email-def-511724-9595.mnu
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\2\icons2.res
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\2\linkpathlegal.txt
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\2\progress.res
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\DownLoad\BtnTrans.xip
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\DownLoad\BtnTrans1.xip
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\DownLoad\d_icons_buttons_1000.xip
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\DownLoad\d_icons_buttons_2000.xip
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\DownLoad\d_icons_buttons_3000.xip
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\DownLoad\d_icons_buttons_bar.xip
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\DownLoad\d_icons_buttons_bbar1.xip
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\DownLoad\d_icons_buttons_logos.xip
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\DownLoad\d_icons_buttons_other.xip
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\DownLoad\icons2.xip
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\DownLoad\linkpathlegal.xip
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\DownLoad\progress.xip
[%DESKTOP%]\Find And Fix Errors.lnk
[%DESKTOP%]\free pc wallpapers.lnk
[%PROFILE_TEMP%]\cdE6.tmp.exe
[%PROGRAM_FILES%]\SpamBlockerUtility\bin\4.7.5.0\dBenderC.dll
[%PROGRAM_FILES%]\SpamBlockerUtility\bin\4.7.5.0\Redemption.dll
[%PROGRAM_FILES%]\SpamBlockerUtility\bin\4.7.5.0\SBClientSinkPS.dll
[%PROGRAM_FILES%]\SpamBlockerUtility\bin\4.7.5.0\SBInst.exe
[%PROGRAM_FILES%]\SpamBlockerUtility\bin\4.7.5.0\SbOEAddOn.exe
[%PROGRAM_FILES%]\SpamBlockerUtility\bin\4.7.5.0\SBOLExp.dll
[%PROGRAM_FILES%]\SpamBlockerUtility\bin\4.7.5.0\SBOLExt.dll
[%PROGRAM_FILES%]\SpamBlockerUtility\bin\4.7.5.0\SBSrvPS.dll
[%PROGRAM_FILES%]\SpamBlockerUtility\bin\4.7.5.0\SBTrayAppPS.dll
[%PROGRAM_FILES%]\SpamBlockerUtility\bin\4.7.5.0\SBUIRes.dll
[%PROGRAM_FILES%]\SpamBlockerUtility\bin\4.7.5.0\SBUISkin.dll
[%PROGRAM_FILES%]\SpamBlockerUtility\bin\4.7.5.0\SpamBlocker.exe
[%PROGRAM_FILES%]\SpamBlockerUtility\bin\4.8.0.0\dBenderC.dll
[%PROGRAM_FILES%]\SpamBlockerUtility\bin\4.8.0.0\Redemption.dll
[%PROGRAM_FILES%]\SpamBlockerUtility\bin\4.8.0.0\SBClientSinkPS.dll
[%PROGRAM_FILES%]\SpamBlockerUtility\bin\4.8.0.0\SBInst.exe
[%PROGRAM_FILES%]\SpamBlockerUtility\bin\4.8.0.0\SBOLExp.dll
[%PROGRAM_FILES%]\SpamBlockerUtility\bin\4.8.0.0\SBOLExt.dll
[%PROGRAM_FILES%]\SpamBlockerUtility\bin\4.8.0.0\SBSrvPS.dll
[%PROGRAM_FILES%]\SpamBlockerUtility\bin\4.8.0.0\SBTrayAppPS.dll
[%PROGRAM_FILES%]\SpamBlockerUtility\bin\4.8.0.0\SBUIRes.dll
[%PROGRAM_FILES%]\SpamBlockerUtility\bin\4.8.0.0\SBUISkin.dll
[%PROGRAM_FILES%]\SpamBlockerUtility\bin\4.8.0.0\SpamBlocker.exe
[%PROGRAM_FILES%]\SPAMBL~1\Bin\480~1.0\SBInst.exe
[%PROGRAM_FILES%]\SPAMBL~1\Bin\480~1.0\SBOLExp.dll
[%PROGRAM_FILES%]\ZangoToolbar\Bin\4.8.2.0\dBenderC.dll
[%SYSTEM%]\dwqvukbf.exe
[%SYSTEM%]\ubsopymh.exe
[%SYSTEM%]\yrztrupg.exe
[%WINDOWS%]\downloaded program files\hbtools.inf
[%WINDOWS%]\downloaded program files\hotbar.inf
[%WINDOWS%]\Downloaded Program Files\SpamBlockerUtility.inf

How to detect Marawi:

Files:
[%APPDATA%]\HbTools\v3.0\HbTools\static\1\ads.cdf
[%APPDATA%]\HbTools\v3.0\HbTools\static\1\btntrans.idx
[%APPDATA%]\HbTools\v3.0\HbTools\static\1\btntrans1.dat
[%APPDATA%]\HbTools\v3.0\HbTools\static\1\business_promo.htm
[%APPDATA%]\HbTools\v3.0\HbTools\static\1\Default_hotbarcom.mnu
[%APPDATA%]\HbTools\v3.0\HbTools\static\1\Default_Mails.mnu
[%APPDATA%]\HbTools\v3.0\HbTools\static\1\d_icons_buttons_1000.res
[%APPDATA%]\HbTools\v3.0\HbTools\static\1\d_icons_buttons_2000.res
[%APPDATA%]\HbTools\v3.0\HbTools\static\1\d_icons_buttons_3000.res
[%APPDATA%]\HbTools\v3.0\HbTools\static\1\d_icons_buttons_bar.res
[%APPDATA%]\HbTools\v3.0\HbTools\static\1\d_icons_buttons_bbar1.res
[%APPDATA%]\HbTools\v3.0\HbTools\static\1\d_icons_buttons_logos.res
[%APPDATA%]\HbTools\v3.0\HbTools\static\1\d_icons_buttons_other.res
[%APPDATA%]\HbTools\v3.0\HbTools\static\1\d_icons_weather.res
[%APPDATA%]\HbTools\v3.0\HbTools\static\1\email-def-511724-548964.mnu
[%APPDATA%]\HbTools\v3.0\HbTools\static\1\email-def-511724-9595.mnu
[%APPDATA%]\HbTools\v3.0\HbTools\static\1\hotbar-premium-hotbar-premium.mnu
[%APPDATA%]\HbTools\v3.0\HbTools\static\1\hotbar-premium.cdf
[%APPDATA%]\HbTools\v3.0\HbTools\static\1\hotbar_promo.htm
[%APPDATA%]\HbTools\v3.0\HbTools\static\1\icons2.res
[%APPDATA%]\HbTools\v3.0\HbTools\static\1\linkpathlegal.txt
[%APPDATA%]\HbTools\v3.0\HbTools\static\1\progress.res
[%APPDATA%]\HbTools\v3.0\HbTools\static\1\s_icons_buttons.res
[%APPDATA%]\HbTools\v3.0\HbTools\static\1\t2_bg.res
[%APPDATA%]\HbTools\v3.0\HbTools\static\1\tsd_bg.res
[%APPDATA%]\HbTools\v3.0\HbTools\static\2\ads.cdf
[%APPDATA%]\HbTools\v3.0\HbTools\static\2\btntrans.idx
[%APPDATA%]\HbTools\v3.0\HbTools\static\2\btntrans1.dat
[%APPDATA%]\HbTools\v3.0\HbTools\static\2\business_promo.htm
[%APPDATA%]\HbTools\v3.0\HbTools\static\2\Default_hotbarcom.mnu
[%APPDATA%]\HbTools\v3.0\HbTools\static\2\Default_Mails.mnu
[%APPDATA%]\HbTools\v3.0\HbTools\static\2\d_icons_buttons_1000.res
[%APPDATA%]\HbTools\v3.0\HbTools\static\2\d_icons_buttons_2000.res
[%APPDATA%]\HbTools\v3.0\HbTools\static\2\d_icons_buttons_3000.res
[%APPDATA%]\HbTools\v3.0\HbTools\static\2\d_icons_buttons_bar.res
[%APPDATA%]\HbTools\v3.0\HbTools\static\2\d_icons_buttons_bbar1.res
[%APPDATA%]\HbTools\v3.0\HbTools\static\2\d_icons_buttons_logos.res
[%APPDATA%]\HbTools\v3.0\HbTools\static\2\d_icons_buttons_other.res
[%APPDATA%]\HbTools\v3.0\HbTools\static\2\d_icons_weather.res
[%APPDATA%]\HbTools\v3.0\HbTools\static\2\email-def-511724-548964.mnu
[%APPDATA%]\HbTools\v3.0\HbTools\static\2\email-def-511724-9595.mnu
[%APPDATA%]\HbTools\v3.0\HbTools\static\2\hotbar-premium-hotbar-premium.mnu
[%APPDATA%]\HbTools\v3.0\HbTools\static\2\hotbar-premium.cdf
[%APPDATA%]\HbTools\v3.0\HbTools\static\2\hotbar_promo.htm
[%APPDATA%]\HbTools\v3.0\HbTools\static\2\icons2.res
[%APPDATA%]\HbTools\v3.0\HbTools\static\2\linkpathlegal.txt
[%APPDATA%]\HbTools\v3.0\HbTools\static\2\progress.res
[%APPDATA%]\HbTools\v3.0\HbTools\static\2\s_icons_buttons.res
[%APPDATA%]\HbTools\v3.0\HbTools\static\2\t2_bg.res
[%APPDATA%]\HbTools\v3.0\HbTools\static\2\tsd_bg.res
[%APPDATA%]\HbTools\v3.0\HbTools\static\DownLoad\ads.xip
[%APPDATA%]\HbTools\v3.0\HbTools\static\DownLoad\BtnTrans.xip
[%APPDATA%]\HbTools\v3.0\HbTools\static\DownLoad\BtnTrans1.xip
[%APPDATA%]\HbTools\v3.0\HbTools\static\DownLoad\business_promo.xip
[%APPDATA%]\HbTools\v3.0\HbTools\static\DownLoad\d_icons_buttons_1000.xip
[%APPDATA%]\HbTools\v3.0\HbTools\static\DownLoad\d_icons_buttons_2000.xip
[%APPDATA%]\HbTools\v3.0\HbTools\static\DownLoad\d_icons_buttons_3000.xip
[%APPDATA%]\HbTools\v3.0\HbTools\static\DownLoad\d_icons_buttons_bar.xip
[%APPDATA%]\HbTools\v3.0\HbTools\static\DownLoad\d_icons_buttons_bbar1.xip
[%APPDATA%]\HbTools\v3.0\HbTools\static\DownLoad\d_icons_buttons_logos.xip
[%APPDATA%]\HbTools\v3.0\HbTools\static\DownLoad\d_icons_buttons_other.xip
[%APPDATA%]\HbTools\v3.0\HbTools\static\DownLoad\d_icons_weather.xip
[%APPDATA%]\HbTools\v3.0\HbTools\static\DownLoad\hotbar-premium.xip
[%APPDATA%]\HbTools\v3.0\HbTools\static\DownLoad\hotbar_promo.xip
[%APPDATA%]\HbTools\v3.0\HbTools\static\DownLoad\icons2.xip
[%APPDATA%]\HbTools\v3.0\HbTools\static\DownLoad\linkpathlegal.xip
[%APPDATA%]\HbTools\v3.0\HbTools\static\DownLoad\progress.xip
[%APPDATA%]\HbTools\v3.0\HbTools\static\DownLoad\s_icons_buttons.xip
[%APPDATA%]\HbTools\v3.0\HbTools\static\DownLoad\t2_bg.xip
[%APPDATA%]\HbTools\v3.0\HbTools\static\DownLoad\tsd_bg.xip
[%APPDATA%]\HbTools_Icons\games2.ico
[%APPDATA%]\HbTools_Icons\Registryrepair.ico
[%APPDATA%]\HbTools_Icons\wallpapere1.ico
[%APPDATA%]\ShopperReports\cs\report\ag_ShopperReports.xml
[%APPDATA%]\ShopperReports\cs\report\send_ShopperReports.xml.db
[%APPDATA%]\SpamBlockerUtility\v3.0\HostOI\static\1\business_promo.htm
[%APPDATA%]\SpamBlockerUtility\v3.0\HostOI\static\1\email-def-511724-9595.mnu
[%APPDATA%]\SpamBlockerUtility\v3.0\HostOI\static\1\email-def-email-backgrounds.mnu
[%APPDATA%]\SpamBlockerUtility\v3.0\HostOI\static\1\email-premium-email-premium.mnu
[%APPDATA%]\SpamBlockerUtility\v3.0\HostOI\static\1\progress.res
[%APPDATA%]\SpamBlockerUtility\v3.0\HostOI\static\2\business_promo.htm
[%APPDATA%]\SpamBlockerUtility\v3.0\HostOI\static\2\email-def-511724-9595.mnu
[%APPDATA%]\SpamBlockerUtility\v3.0\HostOI\static\2\email-def-email-backgrounds.mnu
[%APPDATA%]\SpamBlockerUtility\v3.0\HostOI\static\2\email-premium-email-premium.mnu
[%APPDATA%]\SpamBlockerUtility\v3.0\HostOI\static\2\progress.res
[%APPDATA%]\SpamBlockerUtility\v3.0\HostOI\static\DownLoad\business_promo.xip
[%APPDATA%]\SpamBlockerUtility\v3.0\HostOI\static\DownLoad\progress.xip
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\1\ads.cdf
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\1\btntrans.idx
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\1\btntrans1.dat
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\1\business_promo.htm
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\1\Default_Mails.mnu
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\1\d_icons_buttons_1000.res
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\1\d_icons_buttons_2000.res
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\1\d_icons_buttons_3000.res
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\1\d_icons_buttons_bar.res
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\1\d_icons_buttons_bbar1.res
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\1\d_icons_buttons_logos.res
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\1\d_icons_buttons_other.res
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\1\d_icons_weather.res
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\1\email-def-511724-9595.mnu
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\1\hotbar-premium-hotbar-premium.mnu
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\1\hotbar-premium.cdf
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\1\linkpathlegal.txt
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\1\progress.res
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\1\tsd_bg.res
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\2\ads.cdf
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\2\btntrans.idx
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\2\btntrans1.dat
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\2\business_promo.htm
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\2\Default_Mails.mnu
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\2\d_icons_buttons_1000.res
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\2\d_icons_buttons_2000.res
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\2\d_icons_buttons_3000.res
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\2\d_icons_buttons_bar.res
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\2\d_icons_buttons_bbar1.res
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\2\d_icons_buttons_logos.res
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\2\d_icons_buttons_other.res
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\2\d_icons_weather.res
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\2\email-def-511724-9595.mnu
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\2\hotbar-premium-hotbar-premium.mnu
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\2\hotbar-premium.cdf
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\2\linkpathlegal.txt
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\2\progress.res
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\2\tsd_bg.res
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\DownLoad\ads.xip
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\DownLoad\BtnTrans.xip
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\DownLoad\BtnTrans1.xip
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\DownLoad\business_promo.xip
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\DownLoad\d_icons_buttons_1000.xip
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\DownLoad\d_icons_buttons_2000.xip
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\DownLoad\d_icons_buttons_3000.xip
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\DownLoad\d_icons_buttons_bar.xip
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\DownLoad\d_icons_buttons_bbar1.xip
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\DownLoad\d_icons_buttons_logos.xip
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\DownLoad\d_icons_buttons_other.xip
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\DownLoad\d_icons_weather.xip
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\DownLoad\hotbar-premium.xip
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\DownLoad\linkpathlegal.xip
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\DownLoad\progress.xip
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\DownLoad\tsd_bg.xip
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\1\btntrans.idx
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\1\btntrans1.dat
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\1\Default_hotbarcom.mnu
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\1\Default_Mails.mnu
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\1\d_icons_buttons_1000.res
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\1\d_icons_buttons_2000.res
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\1\d_icons_buttons_3000.res
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\1\d_icons_buttons_bar.res
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\1\d_icons_buttons_bbar1.res
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\1\d_icons_buttons_logos.res
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\1\d_icons_buttons_other.res
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\1\email-def-511724-548964.mnu
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\1\email-def-511724-9595.mnu
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\1\icons2.res
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\1\linkpathlegal.txt
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\1\progress.res
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\2\btntrans.idx
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\2\btntrans1.dat
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\2\Default_hotbarcom.mnu
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\2\Default_Mails.mnu
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\2\d_icons_buttons_1000.res
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\2\d_icons_buttons_2000.res
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\2\d_icons_buttons_3000.res
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\2\d_icons_buttons_bar.res
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\2\d_icons_buttons_bbar1.res
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\2\d_icons_buttons_logos.res
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\2\d_icons_buttons_other.res
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\2\email-def-511724-548964.mnu
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\2\email-def-511724-9595.mnu
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\2\icons2.res
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\2\linkpathlegal.txt
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\2\progress.res
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\DownLoad\BtnTrans.xip
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\DownLoad\BtnTrans1.xip
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\DownLoad\d_icons_buttons_1000.xip
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\DownLoad\d_icons_buttons_2000.xip
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\DownLoad\d_icons_buttons_3000.xip
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\DownLoad\d_icons_buttons_bar.xip
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\DownLoad\d_icons_buttons_bbar1.xip
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\DownLoad\d_icons_buttons_logos.xip
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\DownLoad\d_icons_buttons_other.xip
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\DownLoad\icons2.xip
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\DownLoad\linkpathlegal.xip
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\DownLoad\progress.xip
[%DESKTOP%]\Find And Fix Errors.lnk
[%DESKTOP%]\free pc wallpapers.lnk
[%PROFILE_TEMP%]\cdE6.tmp.exe
[%PROGRAM_FILES%]\SpamBlockerUtility\bin\4.7.5.0\dBenderC.dll
[%PROGRAM_FILES%]\SpamBlockerUtility\bin\4.7.5.0\Redemption.dll
[%PROGRAM_FILES%]\SpamBlockerUtility\bin\4.7.5.0\SBClientSinkPS.dll
[%PROGRAM_FILES%]\SpamBlockerUtility\bin\4.7.5.0\SBInst.exe
[%PROGRAM_FILES%]\SpamBlockerUtility\bin\4.7.5.0\SbOEAddOn.exe
[%PROGRAM_FILES%]\SpamBlockerUtility\bin\4.7.5.0\SBOLExp.dll
[%PROGRAM_FILES%]\SpamBlockerUtility\bin\4.7.5.0\SBOLExt.dll
[%PROGRAM_FILES%]\SpamBlockerUtility\bin\4.7.5.0\SBSrvPS.dll
[%PROGRAM_FILES%]\SpamBlockerUtility\bin\4.7.5.0\SBTrayAppPS.dll
[%PROGRAM_FILES%]\SpamBlockerUtility\bin\4.7.5.0\SBUIRes.dll
[%PROGRAM_FILES%]\SpamBlockerUtility\bin\4.7.5.0\SBUISkin.dll
[%PROGRAM_FILES%]\SpamBlockerUtility\bin\4.7.5.0\SpamBlocker.exe
[%PROGRAM_FILES%]\SpamBlockerUtility\bin\4.8.0.0\dBenderC.dll
[%PROGRAM_FILES%]\SpamBlockerUtility\bin\4.8.0.0\Redemption.dll
[%PROGRAM_FILES%]\SpamBlockerUtility\bin\4.8.0.0\SBClientSinkPS.dll
[%PROGRAM_FILES%]\SpamBlockerUtility\bin\4.8.0.0\SBInst.exe
[%PROGRAM_FILES%]\SpamBlockerUtility\bin\4.8.0.0\SBOLExp.dll
[%PROGRAM_FILES%]\SpamBlockerUtility\bin\4.8.0.0\SBOLExt.dll
[%PROGRAM_FILES%]\SpamBlockerUtility\bin\4.8.0.0\SBSrvPS.dll
[%PROGRAM_FILES%]\SpamBlockerUtility\bin\4.8.0.0\SBTrayAppPS.dll
[%PROGRAM_FILES%]\SpamBlockerUtility\bin\4.8.0.0\SBUIRes.dll
[%PROGRAM_FILES%]\SpamBlockerUtility\bin\4.8.0.0\SBUISkin.dll
[%PROGRAM_FILES%]\SpamBlockerUtility\bin\4.8.0.0\SpamBlocker.exe
[%PROGRAM_FILES%]\SPAMBL~1\Bin\480~1.0\SBInst.exe
[%PROGRAM_FILES%]\SPAMBL~1\Bin\480~1.0\SBOLExp.dll
[%PROGRAM_FILES%]\ZangoToolbar\Bin\4.8.2.0\dBenderC.dll
[%SYSTEM%]\dwqvukbf.exe
[%SYSTEM%]\ubsopymh.exe
[%SYSTEM%]\yrztrupg.exe
[%WINDOWS%]\downloaded program files\hbtools.inf
[%WINDOWS%]\downloaded program files\hotbar.inf
[%WINDOWS%]\Downloaded Program Files\SpamBlockerUtility.inf
[%APPDATA%]\HbTools\v3.0\HbTools\static\1\ads.cdf
[%APPDATA%]\HbTools\v3.0\HbTools\static\1\btntrans.idx
[%APPDATA%]\HbTools\v3.0\HbTools\static\1\btntrans1.dat
[%APPDATA%]\HbTools\v3.0\HbTools\static\1\business_promo.htm
[%APPDATA%]\HbTools\v3.0\HbTools\static\1\Default_hotbarcom.mnu
[%APPDATA%]\HbTools\v3.0\HbTools\static\1\Default_Mails.mnu
[%APPDATA%]\HbTools\v3.0\HbTools\static\1\d_icons_buttons_1000.res
[%APPDATA%]\HbTools\v3.0\HbTools\static\1\d_icons_buttons_2000.res
[%APPDATA%]\HbTools\v3.0\HbTools\static\1\d_icons_buttons_3000.res
[%APPDATA%]\HbTools\v3.0\HbTools\static\1\d_icons_buttons_bar.res
[%APPDATA%]\HbTools\v3.0\HbTools\static\1\d_icons_buttons_bbar1.res
[%APPDATA%]\HbTools\v3.0\HbTools\static\1\d_icons_buttons_logos.res
[%APPDATA%]\HbTools\v3.0\HbTools\static\1\d_icons_buttons_other.res
[%APPDATA%]\HbTools\v3.0\HbTools\static\1\d_icons_weather.res
[%APPDATA%]\HbTools\v3.0\HbTools\static\1\email-def-511724-548964.mnu
[%APPDATA%]\HbTools\v3.0\HbTools\static\1\email-def-511724-9595.mnu
[%APPDATA%]\HbTools\v3.0\HbTools\static\1\hotbar-premium-hotbar-premium.mnu
[%APPDATA%]\HbTools\v3.0\HbTools\static\1\hotbar-premium.cdf
[%APPDATA%]\HbTools\v3.0\HbTools\static\1\hotbar_promo.htm
[%APPDATA%]\HbTools\v3.0\HbTools\static\1\icons2.res
[%APPDATA%]\HbTools\v3.0\HbTools\static\1\linkpathlegal.txt
[%APPDATA%]\HbTools\v3.0\HbTools\static\1\progress.res
[%APPDATA%]\HbTools\v3.0\HbTools\static\1\s_icons_buttons.res
[%APPDATA%]\HbTools\v3.0\HbTools\static\1\t2_bg.res
[%APPDATA%]\HbTools\v3.0\HbTools\static\1\tsd_bg.res
[%APPDATA%]\HbTools\v3.0\HbTools\static\2\ads.cdf
[%APPDATA%]\HbTools\v3.0\HbTools\static\2\btntrans.idx
[%APPDATA%]\HbTools\v3.0\HbTools\static\2\btntrans1.dat
[%APPDATA%]\HbTools\v3.0\HbTools\static\2\business_promo.htm
[%APPDATA%]\HbTools\v3.0\HbTools\static\2\Default_hotbarcom.mnu
[%APPDATA%]\HbTools\v3.0\HbTools\static\2\Default_Mails.mnu
[%APPDATA%]\HbTools\v3.0\HbTools\static\2\d_icons_buttons_1000.res
[%APPDATA%]\HbTools\v3.0\HbTools\static\2\d_icons_buttons_2000.res
[%APPDATA%]\HbTools\v3.0\HbTools\static\2\d_icons_buttons_3000.res
[%APPDATA%]\HbTools\v3.0\HbTools\static\2\d_icons_buttons_bar.res
[%APPDATA%]\HbTools\v3.0\HbTools\static\2\d_icons_buttons_bbar1.res
[%APPDATA%]\HbTools\v3.0\HbTools\static\2\d_icons_buttons_logos.res
[%APPDATA%]\HbTools\v3.0\HbTools\static\2\d_icons_buttons_other.res
[%APPDATA%]\HbTools\v3.0\HbTools\static\2\d_icons_weather.res
[%APPDATA%]\HbTools\v3.0\HbTools\static\2\email-def-511724-548964.mnu
[%APPDATA%]\HbTools\v3.0\HbTools\static\2\email-def-511724-9595.mnu
[%APPDATA%]\HbTools\v3.0\HbTools\static\2\hotbar-premium-hotbar-premium.mnu
[%APPDATA%]\HbTools\v3.0\HbTools\static\2\hotbar-premium.cdf
[%APPDATA%]\HbTools\v3.0\HbTools\static\2\hotbar_promo.htm
[%APPDATA%]\HbTools\v3.0\HbTools\static\2\icons2.res
[%APPDATA%]\HbTools\v3.0\HbTools\static\2\linkpathlegal.txt
[%APPDATA%]\HbTools\v3.0\HbTools\static\2\progress.res
[%APPDATA%]\HbTools\v3.0\HbTools\static\2\s_icons_buttons.res
[%APPDATA%]\HbTools\v3.0\HbTools\static\2\t2_bg.res
[%APPDATA%]\HbTools\v3.0\HbTools\static\2\tsd_bg.res
[%APPDATA%]\HbTools\v3.0\HbTools\static\DownLoad\ads.xip
[%APPDATA%]\HbTools\v3.0\HbTools\static\DownLoad\BtnTrans.xip
[%APPDATA%]\HbTools\v3.0\HbTools\static\DownLoad\BtnTrans1.xip
[%APPDATA%]\HbTools\v3.0\HbTools\static\DownLoad\business_promo.xip
[%APPDATA%]\HbTools\v3.0\HbTools\static\DownLoad\d_icons_buttons_1000.xip
[%APPDATA%]\HbTools\v3.0\HbTools\static\DownLoad\d_icons_buttons_2000.xip
[%APPDATA%]\HbTools\v3.0\HbTools\static\DownLoad\d_icons_buttons_3000.xip
[%APPDATA%]\HbTools\v3.0\HbTools\static\DownLoad\d_icons_buttons_bar.xip
[%APPDATA%]\HbTools\v3.0\HbTools\static\DownLoad\d_icons_buttons_bbar1.xip
[%APPDATA%]\HbTools\v3.0\HbTools\static\DownLoad\d_icons_buttons_logos.xip
[%APPDATA%]\HbTools\v3.0\HbTools\static\DownLoad\d_icons_buttons_other.xip
[%APPDATA%]\HbTools\v3.0\HbTools\static\DownLoad\d_icons_weather.xip
[%APPDATA%]\HbTools\v3.0\HbTools\static\DownLoad\hotbar-premium.xip
[%APPDATA%]\HbTools\v3.0\HbTools\static\DownLoad\hotbar_promo.xip
[%APPDATA%]\HbTools\v3.0\HbTools\static\DownLoad\icons2.xip
[%APPDATA%]\HbTools\v3.0\HbTools\static\DownLoad\linkpathlegal.xip
[%APPDATA%]\HbTools\v3.0\HbTools\static\DownLoad\progress.xip
[%APPDATA%]\HbTools\v3.0\HbTools\static\DownLoad\s_icons_buttons.xip
[%APPDATA%]\HbTools\v3.0\HbTools\static\DownLoad\t2_bg.xip
[%APPDATA%]\HbTools\v3.0\HbTools\static\DownLoad\tsd_bg.xip
[%APPDATA%]\HbTools_Icons\games2.ico
[%APPDATA%]\HbTools_Icons\Registryrepair.ico
[%APPDATA%]\HbTools_Icons\wallpapere1.ico
[%APPDATA%]\ShopperReports\cs\report\ag_ShopperReports.xml
[%APPDATA%]\ShopperReports\cs\report\send_ShopperReports.xml.db
[%APPDATA%]\SpamBlockerUtility\v3.0\HostOI\static\1\business_promo.htm
[%APPDATA%]\SpamBlockerUtility\v3.0\HostOI\static\1\email-def-511724-9595.mnu
[%APPDATA%]\SpamBlockerUtility\v3.0\HostOI\static\1\email-def-email-backgrounds.mnu
[%APPDATA%]\SpamBlockerUtility\v3.0\HostOI\static\1\email-premium-email-premium.mnu
[%APPDATA%]\SpamBlockerUtility\v3.0\HostOI\static\1\progress.res
[%APPDATA%]\SpamBlockerUtility\v3.0\HostOI\static\2\business_promo.htm
[%APPDATA%]\SpamBlockerUtility\v3.0\HostOI\static\2\email-def-511724-9595.mnu
[%APPDATA%]\SpamBlockerUtility\v3.0\HostOI\static\2\email-def-email-backgrounds.mnu
[%APPDATA%]\SpamBlockerUtility\v3.0\HostOI\static\2\email-premium-email-premium.mnu
[%APPDATA%]\SpamBlockerUtility\v3.0\HostOI\static\2\progress.res
[%APPDATA%]\SpamBlockerUtility\v3.0\HostOI\static\DownLoad\business_promo.xip
[%APPDATA%]\SpamBlockerUtility\v3.0\HostOI\static\DownLoad\progress.xip
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\1\ads.cdf
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\1\btntrans.idx
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\1\btntrans1.dat
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\1\business_promo.htm
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\1\Default_Mails.mnu
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\1\d_icons_buttons_1000.res
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\1\d_icons_buttons_2000.res
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\1\d_icons_buttons_3000.res
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\1\d_icons_buttons_bar.res
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\1\d_icons_buttons_bbar1.res
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\1\d_icons_buttons_logos.res
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\1\d_icons_buttons_other.res
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\1\d_icons_weather.res
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\1\email-def-511724-9595.mnu
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\1\hotbar-premium-hotbar-premium.mnu
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\1\hotbar-premium.cdf
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\1\linkpathlegal.txt
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\1\progress.res
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\1\tsd_bg.res
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\2\ads.cdf
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\2\btntrans.idx
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\2\btntrans1.dat
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\2\business_promo.htm
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\2\Default_Mails.mnu
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\2\d_icons_buttons_1000.res
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\2\d_icons_buttons_2000.res
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\2\d_icons_buttons_3000.res
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\2\d_icons_buttons_bar.res
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\2\d_icons_buttons_bbar1.res
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\2\d_icons_buttons_logos.res
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\2\d_icons_buttons_other.res
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\2\d_icons_weather.res
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\2\email-def-511724-9595.mnu
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\2\hotbar-premium-hotbar-premium.mnu
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\2\hotbar-premium.cdf
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\2\linkpathlegal.txt
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\2\progress.res
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\2\tsd_bg.res
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\DownLoad\ads.xip
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\DownLoad\BtnTrans.xip
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\DownLoad\BtnTrans1.xip
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\DownLoad\business_promo.xip
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\DownLoad\d_icons_buttons_1000.xip
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\DownLoad\d_icons_buttons_2000.xip
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\DownLoad\d_icons_buttons_3000.xip
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\DownLoad\d_icons_buttons_bar.xip
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\DownLoad\d_icons_buttons_bbar1.xip
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\DownLoad\d_icons_buttons_logos.xip
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\DownLoad\d_icons_buttons_other.xip
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\DownLoad\d_icons_weather.xip
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\DownLoad\hotbar-premium.xip
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\DownLoad\linkpathlegal.xip
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\DownLoad\progress.xip
[%APPDATA%]\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\DownLoad\tsd_bg.xip
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\1\btntrans.idx
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\1\btntrans1.dat
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\1\Default_hotbarcom.mnu
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\1\Default_Mails.mnu
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\1\d_icons_buttons_1000.res
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\1\d_icons_buttons_2000.res
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\1\d_icons_buttons_3000.res
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\1\d_icons_buttons_bar.res
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\1\d_icons_buttons_bbar1.res
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\1\d_icons_buttons_logos.res
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\1\d_icons_buttons_other.res
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\1\email-def-511724-548964.mnu
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\1\email-def-511724-9595.mnu
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\1\icons2.res
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\1\linkpathlegal.txt
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\1\progress.res
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\2\btntrans.idx
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\2\btntrans1.dat
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\2\Default_hotbarcom.mnu
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\2\Default_Mails.mnu
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\2\d_icons_buttons_1000.res
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\2\d_icons_buttons_2000.res
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\2\d_icons_buttons_3000.res
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\2\d_icons_buttons_bar.res
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\2\d_icons_buttons_bbar1.res
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\2\d_icons_buttons_logos.res
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\2\d_icons_buttons_other.res
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\2\email-def-511724-548964.mnu
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\2\email-def-511724-9595.mnu
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\2\icons2.res
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\2\linkpathlegal.txt
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\2\progress.res
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\DownLoad\BtnTrans.xip
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\DownLoad\BtnTrans1.xip
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\DownLoad\d_icons_buttons_1000.xip
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\DownLoad\d_icons_buttons_2000.xip
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\DownLoad\d_icons_buttons_3000.xip
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\DownLoad\d_icons_buttons_bar.xip
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\DownLoad\d_icons_buttons_bbar1.xip
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\DownLoad\d_icons_buttons_logos.xip
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\DownLoad\d_icons_buttons_other.xip
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\DownLoad\icons2.xip
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\DownLoad\linkpathlegal.xip
[%APPDATA%]\ZangoToolbar\v3.0\ZangoToolbar\static\DownLoad\progress.xip
[%DESKTOP%]\Find And Fix Errors.lnk
[%DESKTOP%]\free pc wallpapers.lnk
[%PROFILE_TEMP%]\cdE6.tmp.exe
[%PROGRAM_FILES%]\SpamBlockerUtility\bin\4.7.5.0\dBenderC.dll
[%PROGRAM_FILES%]\SpamBlockerUtility\bin\4.7.5.0\Redemption.dll
[%PROGRAM_FILES%]\SpamBlockerUtility\bin\4.7.5.0\SBClientSinkPS.dll
[%PROGRAM_FILES%]\SpamBlockerUtility\bin\4.7.5.0\SBInst.exe
[%PROGRAM_FILES%]\SpamBlockerUtility\bin\4.7.5.0\SbOEAddOn.exe
[%PROGRAM_FILES%]\SpamBlockerUtility\bin\4.7.5.0\SBOLExp.dll
[%PROGRAM_FILES%]\SpamBlockerUtility\bin\4.7.5.0\SBOLExt.dll
[%PROGRAM_FILES%]\SpamBlockerUtility\bin\4.7.5.0\SBSrvPS.dll
[%PROGRAM_FILES%]\SpamBlockerUtility\bin\4.7.5.0\SBTrayAppPS.dll
[%PROGRAM_FILES%]\SpamBlockerUtility\bin\4.7.5.0\SBUIRes.dll
[%PROGRAM_FILES%]\SpamBlockerUtility\bin\4.7.5.0\SBUISkin.dll
[%PROGRAM_FILES%]\SpamBlockerUtility\bin\4.7.5.0\SpamBlocker.exe
[%PROGRAM_FILES%]\SpamBlockerUtility\bin\4.8.0.0\dBenderC.dll
[%PROGRAM_FILES%]\SpamBlockerUtility\bin\4.8.0.0\Redemption.dll
[%PROGRAM_FILES%]\SpamBlockerUtility\bin\4.8.0.0\SBClientSinkPS.dll
[%PROGRAM_FILES%]\SpamBlockerUtility\bin\4.8.0.0\SBInst.exe
[%PROGRAM_FILES%]\SpamBlockerUtility\bin\4.8.0.0\SBOLExp.dll
[%PROGRAM_FILES%]\SpamBlockerUtility\bin\4.8.0.0\SBOLExt.dll
[%PROGRAM_FILES%]\SpamBlockerUtility\bin\4.8.0.0\SBSrvPS.dll
[%PROGRAM_FILES%]\SpamBlockerUtility\bin\4.8.0.0\SBTrayAppPS.dll
[%PROGRAM_FILES%]\SpamBlockerUtility\bin\4.8.0.0\SBUIRes.dll
[%PROGRAM_FILES%]\SpamBlockerUtility\bin\4.8.0.0\SBUISkin.dll
[%PROGRAM_FILES%]\SpamBlockerUtility\bin\4.8.0.0\SpamBlocker.exe
[%PROGRAM_FILES%]\SPAMBL~1\Bin\480~1.0\SBInst.exe
[%PROGRAM_FILES%]\SPAMBL~1\Bin\480~1.0\SBOLExp.dll
[%PROGRAM_FILES%]\ZangoToolbar\Bin\4.8.2.0\dBenderC.dll
[%SYSTEM%]\dwqvukbf.exe
[%SYSTEM%]\ubsopymh.exe
[%SYSTEM%]\yrztrupg.exe
[%WINDOWS%]\downloaded program files\hbtools.inf
[%WINDOWS%]\downloaded program files\hotbar.inf
[%WINDOWS%]\Downloaded Program Files\SpamBlockerUtility.inf

Folders:
[%APPDATA%]\SpamBlocker
[%APPDATA%]\SpamBlockerUtility
[%PROGRAM_FILES%]\hbtools
[%PROGRAM_FILES%]\hbtools_icons
[%PROGRAM_FILES%]\hotbar
[%PROGRAM_FILES%]\SpamBlockerUtility

Registry Keys:
HKEY_CLASSES_ROOT\appid\weatherontray.exe
HKEY_CLASSES_ROOT\appid\{0507fdde-f3b7-49f5-9e8f-c557e991f39b}
HKEY_CLASSES_ROOT\clsid\{0ab71193-ec19-4d70-85c2-e46e2ff02755}
HKEY_CLASSES_ROOT\clsid\{175652e8-8bcc-47c4-b591-0d630f469c19}
HKEY_CLASSES_ROOT\clsid\{1e0004ec-5df0-48c7-a8f0-fbb0488a3d94}
HKEY_CLASSES_ROOT\clsid\{1e24f8a0-5965-4902-90d4-08534e9adf3b}
HKEY_CLASSES_ROOT\clsid\{31a59636-0fa3-4a56-954d-db7ad02840d8}
HKEY_CLASSES_ROOT\clsid\{3fa917b9-df69-477f-9e4f-b60d929de79f}
HKEY_CLASSES_ROOT\clsid\{40d8240a-e3a0-4d59-ac55-0443120188d1}
HKEY_CLASSES_ROOT\clsid\{420c35c9-e4f2-49f9-bf67-2be1ecf86989}
HKEY_CLASSES_ROOT\clsid\{460ac4db-b0de-4626-a0f0-175dd84dcb9b}
HKEY_CLASSES_ROOT\clsid\{66b90adb-0be3-40ae-8680-84a6f0577ca0}
HKEY_CLASSES_ROOT\CLSID\{74CC49F7-EB32-4A08-B204-948962A6E3DB}
HKEY_CLASSES_ROOT\clsid\{7e66936c-fea0-4984-ad26-7b6661ac5b2e}
HKEY_CLASSES_ROOT\clsid\{8c875948-9c60-4381-9248-0df180542d53}
HKEY_CLASSES_ROOT\clsid\{a14c0d8d-e753-4e73-9e2b-4070791d8940}
HKEY_CLASSES_ROOT\clsid\{c2baa4c9-ae1e-4605-ae2f-a1c49a30d881}
HKEY_CLASSES_ROOT\clsid\{d9882035-7745-47c7-8d5e-c11178f9c553}
HKEY_CLASSES_ROOT\clsid\{ed8525ea-2bfc-4440-bd8a-20efb9d5e541}
HKEY_CLASSES_ROOT\clsid\{fa16bce1-5e36-472a-8466-e0cdd5ce00e6}
HKEY_CLASSES_ROOT\hbcoresrv.dynamicprop
HKEY_CLASSES_ROOT\hbcoresrv.dynamicprop.1
HKEY_CLASSES_ROOT\hbhostol.hbcmndbaresink
HKEY_CLASSES_ROOT\hbhostol.hbcmndbaresink.1
HKEY_CLASSES_ROOT\hbtcoresrv.hbtcoreservices
HKEY_CLASSES_ROOT\hbtcoresrv.hbtcoreservices.1
HKEY_CLASSES_ROOT\hbtcoresrv.lfgax
HKEY_CLASSES_ROOT\hbtcoresrv.lfgax.1
HKEY_CLASSES_ROOT\hbthostie.bho
HKEY_CLASSES_ROOT\hbthostie.bho.1
HKEY_CLASSES_ROOT\hbthostol.hbtmailanim
HKEY_CLASSES_ROOT\hbthostol.hbtmailanim.1
HKEY_CLASSES_ROOT\hbthostol.hbtwebmailsend
HKEY_CLASSES_ROOT\hbthostol.hbtwebmailsend.1
HKEY_CLASSES_ROOT\hbtinstie.hbinstobj
HKEY_CLASSES_ROOT\hbtinstie.hbinstobj.1
HKEY_CLASSES_ROOT\hbtools.hbtcommband
HKEY_CLASSES_ROOT\hbtools.hbtcommband.1
HKEY_CLASSES_ROOT\hbtsrv.hbtcoreservices
HKEY_CLASSES_ROOT\hbtsrv.hbtcoreservices.1
HKEY_CLASSES_ROOT\hbttoolbar.hbthtmlmenuui
HKEY_CLASSES_ROOT\hbttoolbar.hbthtmlmenuui.1
HKEY_CLASSES_ROOT\hbttoolbar.hbttoolbarctl
HKEY_CLASSES_ROOT\hbttoolbar.hbttoolbarctl.1
HKEY_CLASSES_ROOT\hbttools.hbmain
HKEY_CLASSES_ROOT\hbttools.hbmain.1
HKEY_CLASSES_ROOT\interface\{175816a5-219e-4079-b2f9-53c501c409ba}
HKEY_CLASSES_ROOT\interface\{1c1793e0-1034-4cac-837d-aa545f6961bf}
HKEY_CLASSES_ROOT\interface\{20d21e02-8c1c-41fe-9826-dab4c223436c}
HKEY_CLASSES_ROOT\interface\{27c4569f-8728-4958-a920-a607cae8153c}
HKEY_CLASSES_ROOT\interface\{38370864-346f-4afa-8c4b-4fbff518c0bb}
HKEY_CLASSES_ROOT\interface\{397a208b-3d09-4b3e-93e8-ca171886612e}
HKEY_CLASSES_ROOT\interface\{421745e9-16df-4ee4-a758-d51f939c49cb}
HKEY_CLASSES_ROOT\interface\{4331ec56-0aab-499e-8757-dd2ee44ad671}
HKEY_CLASSES_ROOT\interface\{4921db9c-64ea-430a-abd2-d016db5a0ac4}
HKEY_CLASSES_ROOT\interface\{54286c3a-e044-4e65-bd44-528d6ae28a18}
HKEY_CLASSES_ROOT\interface\{5d16197a-1eaa-45af-b29a-69f1aa055e87}
HKEY_CLASSES_ROOT\interface\{5d9c84e7-fa45-49e2-a0b8-b6b5e9a4f6be}
HKEY_CLASSES_ROOT\interface\{5f2b9de7-f878-4762-8cfe-e9c58f082f0e}
HKEY_CLASSES_ROOT\interface\{601a9784-1114-4089-9b3e-cbd70dafc6ad}
HKEY_CLASSES_ROOT\interface\{66291bef-c867-43c0-a7b4-d13393814bcd}
HKEY_CLASSES_ROOT\interface\{8654592e-952a-4e7c-a960-304763b35fa6}
HKEY_CLASSES_ROOT\interface\{8a61a950-c325-4f44-ba64-273180ff3464}
HKEY_CLASSES_ROOT\interface\{8d5c4ec6-af8e-4b85-ba27-64babe410510}
HKEY_CLASSES_ROOT\interface\{8e98faf8-794f-47f9-af90-15305564ed81}
HKEY_CLASSES_ROOT\interface\{af15975b-1498-4740-8e6c-90af78e4198c}
HKEY_CLASSES_ROOT\interface\{b53d4cd4-406d-43cc-8244-7893d72236dd}
HKEY_CLASSES_ROOT\interface\{b671426c-5c1a-48ac-9652-bc9402b1c404}
HKEY_CLASSES_ROOT\interface\{b9bb3219-f84c-4060-966b-4a1e73e24226}
HKEY_CLASSES_ROOT\interface\{bc8c2e5f-d8b4-4997-bce3-8775c3707956}
HKEY_CLASSES_ROOT\interface\{d082721f-4bd4-4b8b-bb82-06753ee6174f}
HKEY_CLASSES_ROOT\interface\{d24f9d3c-5d4c-47f8-9ab7-632b44ad6a0d}
HKEY_CLASSES_ROOT\interface\{ea232a0a-46f8-4d44-a30b-50321518a828}
HKEY_CLASSES_ROOT\interface\{f43ec88b-b6c8-4969-a763-e2bf55602cce}
HKEY_CLASSES_ROOT\interface\{f786cb18-3809-4e49-bc99-9a66da47db8b}
HKEY_CLASSES_ROOT\sbcoresrv.coreservices
HKEY_CLASSES_ROOT\sbcoresrv.lfgax
HKEY_CLASSES_ROOT\sbhostie.bho
HKEY_CLASSES_ROOT\sbhostol.mailanim
HKEY_CLASSES_ROOT\sbhostol.webmailsend
HKEY_CLASSES_ROOT\sbinstie.sbinstobj
HKEY_CLASSES_ROOT\sbsrv.coreservices
HKEY_CLASSES_ROOT\sbtoolbar.htmlmenuui
HKEY_CLASSES_ROOT\sbtoolbar.toolbarctl
HKEY_CLASSES_ROOT\sbwallpaper.wallpapermanager
HKEY_CLASSES_ROOT\spamblockerconfig.application
HKEY_CLASSES_ROOT\spamblockerutility.commband
HKEY_CLASSES_ROOT\spamblockerutility.sbmain
HKEY_CLASSES_ROOT\spamblockerutility.travelcomparebar
HKEY_CLASSES_ROOT\typelib\{45397063-d7d0-47c2-9508-26487608a298}
HKEY_CLASSES_ROOT\typelib\{4cf5a3c1-07a2-4336-9b54-6870452ebde1}
HKEY_CLASSES_ROOT\typelib\{71e9cf40-af72-4b55-bd3f-1fea2a0eaea6}
HKEY_CLASSES_ROOT\typelib\{71efe583-62fe-4419-9918-ca3b683f7b36}
HKEY_CLASSES_ROOT\typelib\{793af621-5cd0-4b92-b765-6712f6aaf48e}
HKEY_CLASSES_ROOT\typelib\{842d315a-7e1e-448b-96e8-9e76d1820be2}
HKEY_CLASSES_ROOT\typelib\{9967a873-40f3-4c7e-9239-6c8760f19f61}
HKEY_CLASSES_ROOT\typelib\{b5901229-25cc-43c9-b604-3bb6ac2b48a5}
HKEY_CLASSES_ROOT\typelib\{b9f51d42-cca0-4408-bb02-d433d1865a3a}
HKEY_CLASSES_ROOT\typelib\{c83daed4-0611-4f7a-978e-7feafcb2f91b}
HKEY_CLASSES_ROOT\typelib\{f8ee014f-b34c-4544-8e45-95a7971d323b}
HKEY_CLASSES_ROOT\wallpaper.wallpapermanager
HKEY_CLASSES_ROOT\wallpaper.wallpapermanager.1
HKEY_CURRENT_USER\software\hbtools
HKEY_CURRENT_USER\software\hotbar
HKEY_CURRENT_USER\software\microsoft\installer\features\10b0642b36134f8f914ea8e11ee5b503
HKEY_CURRENT_USER\software\microsoft\installer\products\d493500bd4a54ea6bc805fc9cda952c5
HKEY_CURRENT_USER\software\microsoft\internet explorer\explorer bars\{66b90adb-0be3-40ae-8680-84a6f0577ca0}
HKEY_CURRENT_USER\software\microsoft\internet explorer\explorer bars\{7e66936c-fea0-4984-ad26-7b6661ac5b2e}
HKEY_CURRENT_USER\software\spam blocker
HKEY_CURRENT_USER\software\spamblockerutility
HKEY_LOCAL_MACHINE\software\classes\appid\{0507fdde-f3b7-49f5-9e8f-c557e991f39b}
HKEY_LOCAL_MACHINE\software\classes\clsid\{175652e8-8bcc-47c4-b591-0d630f469c19}
HKEY_LOCAL_MACHINE\software\classes\clsid\{1e24f8a0-5965-4902-90d4-08534e9adf3b}
HKEY_LOCAL_MACHINE\software\classes\contact.contacts
HKEY_LOCAL_MACHINE\software\classes\contact.contacts.1
HKEY_LOCAL_MACHINE\software\classes\interface\{20d21e02-8c1c-41fe-9826-dab4c223436c}
HKEY_LOCAL_MACHINE\software\classes\interface\{66291bef-c867-43c0-a7b4-d13393814bcd}
HKEY_LOCAL_MACHINE\software\classes\typelib\{5ba32d9e-f1bd-476c-ad42-97c9379a57a4}
HKEY_LOCAL_MACHINE\software\classes\wallpaper.wallpapermanager
HKEY_LOCAL_MACHINE\software\classes\wallpaper.wallpapermanager.1
HKEY_LOCAL_MACHINE\software\hbtools
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8C875948-9C60-4381-9248-0DF180542D53}
HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\explorer bars\{7e66936c-fea0-4984-ad26-7b6661ac5b2e}
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{946B3E9E-E21A-49c8-9F63-900533FAFE14}
HKEY_LOCAL_MACHINE\software\microsoft\office\outlook\addins\hbthostol.hbtmailanim
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{74CC49F7-EB32-4A08-B204-948962A6E3DB}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\hbtoolsoutlooktools
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\hbtoolswebtools
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\spamblockeroutlooktools
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\spamblockerwebtools
HKEY_LOCAL_MACHINE\software\spamblockerutility\hotbar
HKEY_LOCAL_MACHINE\software\spamblockerutility\spamblockerutility

Registry Values:
HKEY_CLASSES_ROOT\interface\{3a6691ea-c844-46f2-9237-1386a85ce119}\typelib
HKEY_CLASSES_ROOT\interface\{3d2e7662-85fb-4cc1-875c-a624b1aa5d96}\typelib
HKEY_CLASSES_ROOT\interface\{72feeb09-bb27-46d3-a06d-930d4d544227}\typelib
HKEY_CLASSES_ROOT\interface\{736918fe-2349-4230-ba9a-1f23649e32ad}\typelib
HKEY_CLASSES_ROOT\interface\{89d36231-6bd9-4e20-bba0-fd28c3a83c40}\typelib
HKEY_CLASSES_ROOT\interface\{972bc913-312c-44b7-aa91-4ae3ec2e264b}\typelib
HKEY_CLASSES_ROOT\interface\{a53762b6-30f7-469f-ba92-13d63cf09a93}\typelib
HKEY_CLASSES_ROOT\interface\{bd31df26-7178-41f4-88dd-f16b82d827ca}\typelib
HKEY_CLASSES_ROOT\interface\{e4662b0a-da6b-4408-a73b-5a2bbb2b0cc8}\typelib
HKEY_CLASSES_ROOT\interface\{e977de7c-34ea-4876-b333-207c4504589e}\typelib
HKEY_CURRENT_USER\software\microsoft\internet explorer\toolbar\shellbrowser
HKEY_CURRENT_USER\software\microsoft\internet explorer\toolbar\shellbrowser
HKEY_CURRENT_USER\software\microsoft\internet explorer\toolbar\webbrowser
HKEY_LOCAL_MACHINE\software\classes\appid\weatherontray.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Removing Marawi:

You can download trial version of "Exterminate-It" antivirus software here, to check your computer instantly.

Or buy it to remove ALL viruses from your computer.

Also Be Aware of the Following Threats:
Pigeon.AVDS Trojan Symptoms
Skyper DoS Cleaner
Bolahone Downloader Removal
SillyDl.CDV Trojan Symptoms
Pokier Trojan Symptoms

Small.ij Downloader

Removing Small.ij
Categories: Downloader
Trojans-downloaders downloads and installs new malware or adware on the computer.


Visible Symptoms:
Files in system folders:
[%SYSTEM%]\msjter35.exe
[%SYSTEM%]\msjter35.exe

How to detect Small.ij:

Files:
[%SYSTEM%]\msjter35.exe
[%SYSTEM%]\msjter35.exe

Removing Small.ij:

You can download trial version of "Exterminate-It" antivirus software here, to check your computer instantly.

Or buy it to remove ALL viruses from your computer.

Also Be Aware of the Following Threats:
Remove Qidion Adware
WinAntiSpyware Adware Cleaner
LaunchAnywhere RAT Removal
Bancos.IEJ Trojan Symptoms

Belio Trojan

Removing Belio
Categories: Trojan,Backdoor,RAT
This category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.
Backdoors are the most dangerous type of Trojans and the most popular.
Backdoors open infected machines to external control via Internet.
They function in the same way as legal remote administration programs used by system administrators.
This makes them difficult to detect.

Backdoors are installed and launched without the consent of the user of computer.
Often the backdoor will not be visible in the log of active programs.

Once a backdoor has been successfully launched, the computer is wide open.
Backdoor functions can include:


  • Launching/ deleting files

  • Sending/ receiving files

  • Deleting data

  • Displaying notification

  • Rebooting the machine

  • Executing files




Backdoors are used by virus writers to detect and download confidential information,
execute malicious code, destroy data, include the machine in bot networks and so forth.
Backdoors combine the functionality of most other types of in one package.

Backdoors have one especially dangerous sub-class: variants that can propagate like worms.
Some RAT trojans are pranks that are most likely being controlled by a friend or enemy on
April Fool's day or a holiday. Prank RATS are generally not harmful, and won't log keystrokes or hack.


Belio Also known as:

[Kaspersky]Backdoor.Belio.09;
[Eset]Win32/Belio.09 trojan;
[McAfee]BackDoor-QN;
[F-Prot]security risk or a "backdoor" program;
[Computer Associates]Backdoor/Belio.0.9.Server,Win32.Belio

How to detect Belio:

Registry Values:
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run

Removing Belio:

You can download trial version of "Exterminate-It" antivirus software here, to check your computer instantly.

Or buy it to remove ALL viruses from your computer.

Also Be Aware of the Following Threats:
Central Adware Removal instruction
Dan Trojan Information

ISearch Adware

Removing ISearch
Categories: Adware,Spyware,BHO,Downloader
Adware are programs that facilitate delivery for advertising content
to the user and in some cases gather information from the user's computer.

Spyware is computer software that is installed surreptitiously on a personal computer
to intercept or take partial control over the user's interaction
with the computer, without the user's informed consent.

While the term spyware suggests software that secretly monitors the user's behavior,
the functions of spyware extend well beyond simple monitoring.

Spyware programs can collect various types of personal information,
such as Internet surfing habit, sites that have been visited,
but can also interfere with user control of the computer in other ways,
such as installing additional software, redirecting Web browser activity,
accessing websites blindly that will cause more harmful viruses,
or diverting advertising revenue to a third party.

Spyware can even change computer settings, resulting in slow connection speeds,
different home pages, and loss of Internet or other programs.
In an attempt to increase the understanding of spyware, a more formal classification
of its included software types is captured under the term privacy-invasive software.
BHO (Browser Helper Object) Trojan.
The BHO waits for the user to post personal information to a monitored website.
As this information is entered by the user, it is captured by the BHO and sent back to the attacker.
The method of network transport used by the attacker makes this Trojan unique.
Typically, keyloggers of this type will send the stolen information back to the attacker via email
or HTTP POST, which can appear suspicious.
Instead, this Trojan encodes the data with a simple XOR algorithm before placing it into
the data section of an ICMP ping packet." explained the company.
Trojans-downloaders downloads and installs new malware or adware on the computer.


ISearch Also known as:

[Kaspersky]Trojan-Dropper.Win32.Agent.ata;
[Panda]Adware/ISearch,Trj/Downloader.NL,Spyware/7r7t;
[Other]Sypare.ISearch,Adware:Win32/iSearch.Toolbar,Agent.CZZD,CommAd Installer,Trojan-Downloader.Small.BUY

Visible Symptoms:
Files in system folders:
[%INTERNET_CACHE%]\Content.IE5\0X27Y3CT\installer[1].exe
[%INTERNET_CACHE%]\Content.IE5\CLUJWDEZ\installer[1].exe
[%INTERNET_CACHE%]\Content.IE5\GFQX01WC\installer[1].exe
[%INTERNET_CACHE%]\content.ie5\UXTUADDS\installer[1].exe
[%PROFILE_TEMP%]\b104.exe
[%PROFILE_TEMP%]\cmdinst.exe
[%PROFILE_TEMP%]\temp.fr????
[%SYSTEM%]\atmtd.dll
[%SYSTEM%]\atmtd.dll._
[%SYSTEM%]\atmtd.dll
[%SYSTEM%]\atmtd.dll._
[%SYSTEM%]\toolbar.dll
[%WINDOWS%]\aQ\asappsrv.dll
[%WINDOWS%]\aQ\command.exe
[%WINDOWS%]\b104.exe
[%WINDOWS%]\cmFj\asappsrv.dll
[%WINDOWS%]\cmFj\command.exe
[%WINDOWS%]\Downloaded Program Files\initial.inf
[%WINDOWS%]\dXRpbGlzYXRldXI\asappsrv.dll
[%WINDOWS%]\dXRpbGlzYXRldXI\command.exe~
[%WINDOWS%]\dXRpbGlzYXRldXI\xrlDv35Wsrl5xrK.vbs
[%WINDOWS%]\IA\asappsrv.dll
[%WINDOWS%]\IA\command.exe
[%WINDOWS%]\IA\KE.vbs
[%WINDOWS%]\idlemg.exe
[%WINDOWS%]\IGRvbg\asappsrv.dll
[%WINDOWS%]\IGRvbg\command.exe
[%WINDOWS%]\Lg\asappsrv.dll
[%WINDOWS%]\Lg\command.exe
[%WINDOWS%]\Q2hyaXN0b3BoZXIgSmV3ZWxscw\kZ1VurhXva1CtrK0mApatqUPwT.vbs
[%WINDOWS%]\QmFyYmFyYSBNIEhhd2tpbnM\asappsrv.dll
[%WINDOWS%]\QmFyYmFyYSBNIEhhd2tpbnM\command.exe
[%WINDOWS%]\QmVuamFtaW4gQm9nYXJkdXM\kApRuAIQuqb0kA6BsrL4xrg.vbs
[%WINDOWS%]\QWFyb25z\asappsrv.dll
[%WINDOWS%]\QWFyb25z\command.exe
[%WINDOWS%]\RGFycmVu\asappsrv.dll
[%WINDOWS%]\RGFycmVu\command.exe
[%WINDOWS%]\RmFtLiBkZSBHcmVlZg\asappsrv.dll
[%WINDOWS%]\RmFtLiBkZSBHcmVlZg\command.exe
[%WINDOWS%]\RWR3YXJkIEZvcnRlc2N1ZQ\asappsrv.dll
[%WINDOWS%]\RWR3YXJkIEZvcnRlc2N1ZQ\command.exe
[%WINDOWS%]\S1VMTEFNQUE\mYpgnHIhkoH.vbs
[%WINDOWS%]\S3Jpc3Rlbg\asappsrv.dll
[%WINDOWS%]\S3Jpc3Rlbg\command.exe
[%WINDOWS%]\SG9tZQ\asappsrv.dll
[%WINDOWS%]\SG9tZQ\command.exe
[%WINDOWS%]\Sm9lIFN0ZXJu\asappsrv.dll
[%WINDOWS%]\SmF5IGN1cnRpcw\asappsrv.dll
[%WINDOWS%]\SmFtYWhs\asappsrv.dll
[%WINDOWS%]\SmFtYWhs\command.exe
[%WINDOWS%]\SmFtZXMgRCBWb3lsZXM\asappsrv.dll
[%WINDOWS%]\SmFtZXMgRCBWb3lsZXM\command.exe
[%WINDOWS%]\SmFtZXMgTGF1cmVuY2UgV2hpdGluZw\asappsrv.dll
[%WINDOWS%]\SmFtZXMgTGF1cmVuY2UgV2hpdGluZw\command.exe
[%WINDOWS%]\SmVhbmV0dGUgTGV1c2luaw\asappsrv.dll
[%WINDOWS%]\SmVhbmV0dGUgTGV1c2luaw\command.exe
[%WINDOWS%]\SmVmZiBNb3JhbGVz\asappsrv.dll
[%WINDOWS%]\SmVmZiBNb3JhbGVz\command.exe
[%WINDOWS%]\SmVmZnJleQ\asappsrv.dll
[%WINDOWS%]\SmVmZnJleQ\command.exe
[%WINDOWS%]\SmVmZnJleQ\mApAtBL5yk.vbs
[%WINDOWS%]\SnVhbiBGIExlemFtYQ\asappsrv.dll
[%WINDOWS%]\SnVhbiBGIExlemFtYQ\command.exe
[%WINDOWS%]\SW5tYW4\asappsrv.dll
[%WINDOWS%]\SW5tYW4\command.exe
[%WINDOWS%]\T0VN\asappsrv.dll
[%WINDOWS%]\T0VN\command.exe
[%WINDOWS%]\TEMP\cmdinst.exe
[%WINDOWS%]\TGFycnkgTWFjaW9jaQ\asappsrv.dll
[%WINDOWS%]\TGFycnkgTWFjaW9jaQ\command.exe
[%WINDOWS%]\TGlhbmUgV2hpdG5leQ\asappsrv.dll
[%WINDOWS%]\TGlhbmUgV2hpdG5leQ\command.exe
[%WINDOWS%]\TW9sbHkgQXJub2xk\asappsrv.dll
[%WINDOWS%]\TW9sbHkgQXJub2xk\command.exe
[%WINDOWS%]\TWF0dCBaZXR6\asappsrv.dll
[%WINDOWS%]\TWF0dCBaZXR6\command.exe
[%WINDOWS%]\TWU\asappsrv.dll
[%WINDOWS%]\TWU\command.exe
[%WINDOWS%]\U2FiaWhhIE1hbGlr\asappsrv.dll
[%WINDOWS%]\U3RhbiBTbWl0aA\asappsrv.dll
[%WINDOWS%]\U3RhbiBTbWl0aA\command.exe
[%WINDOWS%]\U3RlcGhlbiBBcndpbmU\asappsrv.dll
[%WINDOWS%]\U3RlcGhlbiBBcndpbmU\command.exe
[%WINDOWS%]\UE9PUA\oH6joE.vbs
[%WINDOWS%]\UGF0IERlc2hhdw\asappsrv.dll
[%WINDOWS%]\UGF0IERlc2hhdw\command.exe
[%WINDOWS%]\V2lsbCBNaXRjaGVsbA\asappsrv.dll
[%WINDOWS%]\V2lsbCBNaXRjaGVsbA\command.exe
[%WINDOWS%]\VXNlcg\asappsrv.dll
[%WINDOWS%]\VXNlcg\command.exe
[%WINDOWS%]\WGlhb0Jyb3RoZXI\asappsrv.dll
[%WINDOWS%]\WGlhb0Jyb3RoZXI\command.exe
[%WINDOWS%]\Y2hhbmVnbWU\sZ11vApBvqo.vbs
[%WINDOWS%]\YWRtaW4\asappsrv.dll
[%WINDOWS%]\YWRtaW4\command.exe
[%WINDOWS%]\ZHk\asappsrv.dll
[%WINDOWS%]\ZHk\command.exe
[%WINDOWS%]\Zm8\asappsrv.dll
[%WINDOWS%]\Zm8\command.exe
[%WINDOWS%]\Zm8\tAf.vbs
[%WINDOWS%]\ZW5yaXF1ZXRhIGRhaWxleQ\tqcVurIYtrl1K3l1uqU5yk.vbs
[%WINDOWS%]\Buddy.exe
[%WINDOWS%]\ceres.dll
[%WINDOWS%]\inst\3p_1n.exe
[%WINDOWS%]\isrvs\edmond.exe
[%WINDOWS%]\isrvs\icons\spywareavenger.ico
[%WINDOWS%]\isrvs\icons\virushunter.ico
[%WINDOWS%]\isrvs\isearch.xpi
[%WINDOWS%]\isrvs\mfiltis.dll
[%WINDOWS%]\isrvs\msdbhk.dll
[%WINDOWS%]\isrvs\sysupd.dll
[%DESKTOP%]\isearch.com.url
[%PROFILE_TEMP%]\b1\build2.exe
[%PROFILE_TEMP%]\b1\ping2.bat
[%SYSTEM%]\a13\rarndrll2.exe
[%SYSTEM%]\toolbar_.dll
[%SYSTEM%]\winhot32.dll
[%WINDOWS%]\system\toolbar.dll
[%WINDOWS%]\system\toolbar_.dll
[%INTERNET_CACHE%]\Content.IE5\0X27Y3CT\installer[1].exe
[%INTERNET_CACHE%]\Content.IE5\CLUJWDEZ\installer[1].exe
[%INTERNET_CACHE%]\Content.IE5\GFQX01WC\installer[1].exe
[%INTERNET_CACHE%]\content.ie5\UXTUADDS\installer[1].exe
[%PROFILE_TEMP%]\b104.exe
[%PROFILE_TEMP%]\cmdinst.exe
[%PROFILE_TEMP%]\temp.fr????
[%SYSTEM%]\atmtd.dll
[%SYSTEM%]\atmtd.dll._
[%SYSTEM%]\atmtd.dll
[%SYSTEM%]\atmtd.dll._
[%SYSTEM%]\toolbar.dll
[%WINDOWS%]\aQ\asappsrv.dll
[%WINDOWS%]\aQ\command.exe
[%WINDOWS%]\b104.exe
[%WINDOWS%]\cmFj\asappsrv.dll
[%WINDOWS%]\cmFj\command.exe
[%WINDOWS%]\Downloaded Program Files\initial.inf
[%WINDOWS%]\dXRpbGlzYXRldXI\asappsrv.dll
[%WINDOWS%]\dXRpbGlzYXRldXI\command.exe~
[%WINDOWS%]\dXRpbGlzYXRldXI\xrlDv35Wsrl5xrK.vbs
[%WINDOWS%]\IA\asappsrv.dll
[%WINDOWS%]\IA\command.exe
[%WINDOWS%]\IA\KE.vbs
[%WINDOWS%]\idlemg.exe
[%WINDOWS%]\IGRvbg\asappsrv.dll
[%WINDOWS%]\IGRvbg\command.exe
[%WINDOWS%]\Lg\asappsrv.dll
[%WINDOWS%]\Lg\command.exe
[%WINDOWS%]\Q2hyaXN0b3BoZXIgSmV3ZWxscw\kZ1VurhXva1CtrK0mApatqUPwT.vbs
[%WINDOWS%]\QmFyYmFyYSBNIEhhd2tpbnM\asappsrv.dll
[%WINDOWS%]\QmFyYmFyYSBNIEhhd2tpbnM\command.exe
[%WINDOWS%]\QmVuamFtaW4gQm9nYXJkdXM\kApRuAIQuqb0kA6BsrL4xrg.vbs
[%WINDOWS%]\QWFyb25z\asappsrv.dll
[%WINDOWS%]\QWFyb25z\command.exe
[%WINDOWS%]\RGFycmVu\asappsrv.dll
[%WINDOWS%]\RGFycmVu\command.exe
[%WINDOWS%]\RmFtLiBkZSBHcmVlZg\asappsrv.dll
[%WINDOWS%]\RmFtLiBkZSBHcmVlZg\command.exe
[%WINDOWS%]\RWR3YXJkIEZvcnRlc2N1ZQ\asappsrv.dll
[%WINDOWS%]\RWR3YXJkIEZvcnRlc2N1ZQ\command.exe
[%WINDOWS%]\S1VMTEFNQUE\mYpgnHIhkoH.vbs
[%WINDOWS%]\S3Jpc3Rlbg\asappsrv.dll
[%WINDOWS%]\S3Jpc3Rlbg\command.exe
[%WINDOWS%]\SG9tZQ\asappsrv.dll
[%WINDOWS%]\SG9tZQ\command.exe
[%WINDOWS%]\Sm9lIFN0ZXJu\asappsrv.dll
[%WINDOWS%]\SmF5IGN1cnRpcw\asappsrv.dll
[%WINDOWS%]\SmFtYWhs\asappsrv.dll
[%WINDOWS%]\SmFtYWhs\command.exe
[%WINDOWS%]\SmFtZXMgRCBWb3lsZXM\asappsrv.dll
[%WINDOWS%]\SmFtZXMgRCBWb3lsZXM\command.exe
[%WINDOWS%]\SmFtZXMgTGF1cmVuY2UgV2hpdGluZw\asappsrv.dll
[%WINDOWS%]\SmFtZXMgTGF1cmVuY2UgV2hpdGluZw\command.exe
[%WINDOWS%]\SmVhbmV0dGUgTGV1c2luaw\asappsrv.dll
[%WINDOWS%]\SmVhbmV0dGUgTGV1c2luaw\command.exe
[%WINDOWS%]\SmVmZiBNb3JhbGVz\asappsrv.dll
[%WINDOWS%]\SmVmZiBNb3JhbGVz\command.exe
[%WINDOWS%]\SmVmZnJleQ\asappsrv.dll
[%WINDOWS%]\SmVmZnJleQ\command.exe
[%WINDOWS%]\SmVmZnJleQ\mApAtBL5yk.vbs
[%WINDOWS%]\SnVhbiBGIExlemFtYQ\asappsrv.dll
[%WINDOWS%]\SnVhbiBGIExlemFtYQ\command.exe
[%WINDOWS%]\SW5tYW4\asappsrv.dll
[%WINDOWS%]\SW5tYW4\command.exe
[%WINDOWS%]\T0VN\asappsrv.dll
[%WINDOWS%]\T0VN\command.exe
[%WINDOWS%]\TEMP\cmdinst.exe
[%WINDOWS%]\TGFycnkgTWFjaW9jaQ\asappsrv.dll
[%WINDOWS%]\TGFycnkgTWFjaW9jaQ\command.exe
[%WINDOWS%]\TGlhbmUgV2hpdG5leQ\asappsrv.dll
[%WINDOWS%]\TGlhbmUgV2hpdG5leQ\command.exe
[%WINDOWS%]\TW9sbHkgQXJub2xk\asappsrv.dll
[%WINDOWS%]\TW9sbHkgQXJub2xk\command.exe
[%WINDOWS%]\TWF0dCBaZXR6\asappsrv.dll
[%WINDOWS%]\TWF0dCBaZXR6\command.exe
[%WINDOWS%]\TWU\asappsrv.dll
[%WINDOWS%]\TWU\command.exe
[%WINDOWS%]\U2FiaWhhIE1hbGlr\asappsrv.dll
[%WINDOWS%]\U3RhbiBTbWl0aA\asappsrv.dll
[%WINDOWS%]\U3RhbiBTbWl0aA\command.exe
[%WINDOWS%]\U3RlcGhlbiBBcndpbmU\asappsrv.dll
[%WINDOWS%]\U3RlcGhlbiBBcndpbmU\command.exe
[%WINDOWS%]\UE9PUA\oH6joE.vbs
[%WINDOWS%]\UGF0IERlc2hhdw\asappsrv.dll
[%WINDOWS%]\UGF0IERlc2hhdw\command.exe
[%WINDOWS%]\V2lsbCBNaXRjaGVsbA\asappsrv.dll
[%WINDOWS%]\V2lsbCBNaXRjaGVsbA\command.exe
[%WINDOWS%]\VXNlcg\asappsrv.dll
[%WINDOWS%]\VXNlcg\command.exe
[%WINDOWS%]\WGlhb0Jyb3RoZXI\asappsrv.dll
[%WINDOWS%]\WGlhb0Jyb3RoZXI\command.exe
[%WINDOWS%]\Y2hhbmVnbWU\sZ11vApBvqo.vbs
[%WINDOWS%]\YWRtaW4\asappsrv.dll
[%WINDOWS%]\YWRtaW4\command.exe
[%WINDOWS%]\ZHk\asappsrv.dll
[%WINDOWS%]\ZHk\command.exe
[%WINDOWS%]\Zm8\asappsrv.dll
[%WINDOWS%]\Zm8\command.exe
[%WINDOWS%]\Zm8\tAf.vbs
[%WINDOWS%]\ZW5yaXF1ZXRhIGRhaWxleQ\tqcVurIYtrl1K3l1uqU5yk.vbs
[%WINDOWS%]\Buddy.exe
[%WINDOWS%]\ceres.dll
[%WINDOWS%]\inst\3p_1n.exe
[%WINDOWS%]\isrvs\edmond.exe
[%WINDOWS%]\isrvs\icons\spywareavenger.ico
[%WINDOWS%]\isrvs\icons\virushunter.ico
[%WINDOWS%]\isrvs\isearch.xpi
[%WINDOWS%]\isrvs\mfiltis.dll
[%WINDOWS%]\isrvs\msdbhk.dll
[%WINDOWS%]\isrvs\sysupd.dll
[%DESKTOP%]\isearch.com.url
[%PROFILE_TEMP%]\b1\build2.exe
[%PROFILE_TEMP%]\b1\ping2.bat
[%SYSTEM%]\a13\rarndrll2.exe
[%SYSTEM%]\toolbar_.dll
[%SYSTEM%]\winhot32.dll
[%WINDOWS%]\system\toolbar.dll
[%WINDOWS%]\system\toolbar_.dll

How to detect ISearch:

Files:
[%INTERNET_CACHE%]\Content.IE5\0X27Y3CT\installer[1].exe
[%INTERNET_CACHE%]\Content.IE5\CLUJWDEZ\installer[1].exe
[%INTERNET_CACHE%]\Content.IE5\GFQX01WC\installer[1].exe
[%INTERNET_CACHE%]\content.ie5\UXTUADDS\installer[1].exe
[%PROFILE_TEMP%]\b104.exe
[%PROFILE_TEMP%]\cmdinst.exe
[%PROFILE_TEMP%]\temp.fr????
[%SYSTEM%]\atmtd.dll
[%SYSTEM%]\atmtd.dll._
[%SYSTEM%]\atmtd.dll
[%SYSTEM%]\atmtd.dll._
[%SYSTEM%]\toolbar.dll
[%WINDOWS%]\aQ\asappsrv.dll
[%WINDOWS%]\aQ\command.exe
[%WINDOWS%]\b104.exe
[%WINDOWS%]\cmFj\asappsrv.dll
[%WINDOWS%]\cmFj\command.exe
[%WINDOWS%]\Downloaded Program Files\initial.inf
[%WINDOWS%]\dXRpbGlzYXRldXI\asappsrv.dll
[%WINDOWS%]\dXRpbGlzYXRldXI\command.exe~
[%WINDOWS%]\dXRpbGlzYXRldXI\xrlDv35Wsrl5xrK.vbs
[%WINDOWS%]\IA\asappsrv.dll
[%WINDOWS%]\IA\command.exe
[%WINDOWS%]\IA\KE.vbs
[%WINDOWS%]\idlemg.exe
[%WINDOWS%]\IGRvbg\asappsrv.dll
[%WINDOWS%]\IGRvbg\command.exe
[%WINDOWS%]\Lg\asappsrv.dll
[%WINDOWS%]\Lg\command.exe
[%WINDOWS%]\Q2hyaXN0b3BoZXIgSmV3ZWxscw\kZ1VurhXva1CtrK0mApatqUPwT.vbs
[%WINDOWS%]\QmFyYmFyYSBNIEhhd2tpbnM\asappsrv.dll
[%WINDOWS%]\QmFyYmFyYSBNIEhhd2tpbnM\command.exe
[%WINDOWS%]\QmVuamFtaW4gQm9nYXJkdXM\kApRuAIQuqb0kA6BsrL4xrg.vbs
[%WINDOWS%]\QWFyb25z\asappsrv.dll
[%WINDOWS%]\QWFyb25z\command.exe
[%WINDOWS%]\RGFycmVu\asappsrv.dll
[%WINDOWS%]\RGFycmVu\command.exe
[%WINDOWS%]\RmFtLiBkZSBHcmVlZg\asappsrv.dll
[%WINDOWS%]\RmFtLiBkZSBHcmVlZg\command.exe
[%WINDOWS%]\RWR3YXJkIEZvcnRlc2N1ZQ\asappsrv.dll
[%WINDOWS%]\RWR3YXJkIEZvcnRlc2N1ZQ\command.exe
[%WINDOWS%]\S1VMTEFNQUE\mYpgnHIhkoH.vbs
[%WINDOWS%]\S3Jpc3Rlbg\asappsrv.dll
[%WINDOWS%]\S3Jpc3Rlbg\command.exe
[%WINDOWS%]\SG9tZQ\asappsrv.dll
[%WINDOWS%]\SG9tZQ\command.exe
[%WINDOWS%]\Sm9lIFN0ZXJu\asappsrv.dll
[%WINDOWS%]\SmF5IGN1cnRpcw\asappsrv.dll
[%WINDOWS%]\SmFtYWhs\asappsrv.dll
[%WINDOWS%]\SmFtYWhs\command.exe
[%WINDOWS%]\SmFtZXMgRCBWb3lsZXM\asappsrv.dll
[%WINDOWS%]\SmFtZXMgRCBWb3lsZXM\command.exe
[%WINDOWS%]\SmFtZXMgTGF1cmVuY2UgV2hpdGluZw\asappsrv.dll
[%WINDOWS%]\SmFtZXMgTGF1cmVuY2UgV2hpdGluZw\command.exe
[%WINDOWS%]\SmVhbmV0dGUgTGV1c2luaw\asappsrv.dll
[%WINDOWS%]\SmVhbmV0dGUgTGV1c2luaw\command.exe
[%WINDOWS%]\SmVmZiBNb3JhbGVz\asappsrv.dll
[%WINDOWS%]\SmVmZiBNb3JhbGVz\command.exe
[%WINDOWS%]\SmVmZnJleQ\asappsrv.dll
[%WINDOWS%]\SmVmZnJleQ\command.exe
[%WINDOWS%]\SmVmZnJleQ\mApAtBL5yk.vbs
[%WINDOWS%]\SnVhbiBGIExlemFtYQ\asappsrv.dll
[%WINDOWS%]\SnVhbiBGIExlemFtYQ\command.exe
[%WINDOWS%]\SW5tYW4\asappsrv.dll
[%WINDOWS%]\SW5tYW4\command.exe
[%WINDOWS%]\T0VN\asappsrv.dll
[%WINDOWS%]\T0VN\command.exe
[%WINDOWS%]\TEMP\cmdinst.exe
[%WINDOWS%]\TGFycnkgTWFjaW9jaQ\asappsrv.dll
[%WINDOWS%]\TGFycnkgTWFjaW9jaQ\command.exe
[%WINDOWS%]\TGlhbmUgV2hpdG5leQ\asappsrv.dll
[%WINDOWS%]\TGlhbmUgV2hpdG5leQ\command.exe
[%WINDOWS%]\TW9sbHkgQXJub2xk\asappsrv.dll
[%WINDOWS%]\TW9sbHkgQXJub2xk\command.exe
[%WINDOWS%]\TWF0dCBaZXR6\asappsrv.dll
[%WINDOWS%]\TWF0dCBaZXR6\command.exe
[%WINDOWS%]\TWU\asappsrv.dll
[%WINDOWS%]\TWU\command.exe
[%WINDOWS%]\U2FiaWhhIE1hbGlr\asappsrv.dll
[%WINDOWS%]\U3RhbiBTbWl0aA\asappsrv.dll
[%WINDOWS%]\U3RhbiBTbWl0aA\command.exe
[%WINDOWS%]\U3RlcGhlbiBBcndpbmU\asappsrv.dll
[%WINDOWS%]\U3RlcGhlbiBBcndpbmU\command.exe
[%WINDOWS%]\UE9PUA\oH6joE.vbs
[%WINDOWS%]\UGF0IERlc2hhdw\asappsrv.dll
[%WINDOWS%]\UGF0IERlc2hhdw\command.exe
[%WINDOWS%]\V2lsbCBNaXRjaGVsbA\asappsrv.dll
[%WINDOWS%]\V2lsbCBNaXRjaGVsbA\command.exe
[%WINDOWS%]\VXNlcg\asappsrv.dll
[%WINDOWS%]\VXNlcg\command.exe
[%WINDOWS%]\WGlhb0Jyb3RoZXI\asappsrv.dll
[%WINDOWS%]\WGlhb0Jyb3RoZXI\command.exe
[%WINDOWS%]\Y2hhbmVnbWU\sZ11vApBvqo.vbs
[%WINDOWS%]\YWRtaW4\asappsrv.dll
[%WINDOWS%]\YWRtaW4\command.exe
[%WINDOWS%]\ZHk\asappsrv.dll
[%WINDOWS%]\ZHk\command.exe
[%WINDOWS%]\Zm8\asappsrv.dll
[%WINDOWS%]\Zm8\command.exe
[%WINDOWS%]\Zm8\tAf.vbs
[%WINDOWS%]\ZW5yaXF1ZXRhIGRhaWxleQ\tqcVurIYtrl1K3l1uqU5yk.vbs
[%WINDOWS%]\Buddy.exe
[%WINDOWS%]\ceres.dll
[%WINDOWS%]\inst\3p_1n.exe
[%WINDOWS%]\isrvs\edmond.exe
[%WINDOWS%]\isrvs\icons\spywareavenger.ico
[%WINDOWS%]\isrvs\icons\virushunter.ico
[%WINDOWS%]\isrvs\isearch.xpi
[%WINDOWS%]\isrvs\mfiltis.dll
[%WINDOWS%]\isrvs\msdbhk.dll
[%WINDOWS%]\isrvs\sysupd.dll
[%DESKTOP%]\isearch.com.url
[%PROFILE_TEMP%]\b1\build2.exe
[%PROFILE_TEMP%]\b1\ping2.bat
[%SYSTEM%]\a13\rarndrll2.exe
[%SYSTEM%]\toolbar_.dll
[%SYSTEM%]\winhot32.dll
[%WINDOWS%]\system\toolbar.dll
[%WINDOWS%]\system\toolbar_.dll
[%INTERNET_CACHE%]\Content.IE5\0X27Y3CT\installer[1].exe
[%INTERNET_CACHE%]\Content.IE5\CLUJWDEZ\installer[1].exe
[%INTERNET_CACHE%]\Content.IE5\GFQX01WC\installer[1].exe
[%INTERNET_CACHE%]\content.ie5\UXTUADDS\installer[1].exe
[%PROFILE_TEMP%]\b104.exe
[%PROFILE_TEMP%]\cmdinst.exe
[%PROFILE_TEMP%]\temp.fr????
[%SYSTEM%]\atmtd.dll
[%SYSTEM%]\atmtd.dll._
[%SYSTEM%]\atmtd.dll
[%SYSTEM%]\atmtd.dll._
[%SYSTEM%]\toolbar.dll
[%WINDOWS%]\aQ\asappsrv.dll
[%WINDOWS%]\aQ\command.exe
[%WINDOWS%]\b104.exe
[%WINDOWS%]\cmFj\asappsrv.dll
[%WINDOWS%]\cmFj\command.exe
[%WINDOWS%]\Downloaded Program Files\initial.inf
[%WINDOWS%]\dXRpbGlzYXRldXI\asappsrv.dll
[%WINDOWS%]\dXRpbGlzYXRldXI\command.exe~
[%WINDOWS%]\dXRpbGlzYXRldXI\xrlDv35Wsrl5xrK.vbs
[%WINDOWS%]\IA\asappsrv.dll
[%WINDOWS%]\IA\command.exe
[%WINDOWS%]\IA\KE.vbs
[%WINDOWS%]\idlemg.exe
[%WINDOWS%]\IGRvbg\asappsrv.dll
[%WINDOWS%]\IGRvbg\command.exe
[%WINDOWS%]\Lg\asappsrv.dll
[%WINDOWS%]\Lg\command.exe
[%WINDOWS%]\Q2hyaXN0b3BoZXIgSmV3ZWxscw\kZ1VurhXva1CtrK0mApatqUPwT.vbs
[%WINDOWS%]\QmFyYmFyYSBNIEhhd2tpbnM\asappsrv.dll
[%WINDOWS%]\QmFyYmFyYSBNIEhhd2tpbnM\command.exe
[%WINDOWS%]\QmVuamFtaW4gQm9nYXJkdXM\kApRuAIQuqb0kA6BsrL4xrg.vbs
[%WINDOWS%]\QWFyb25z\asappsrv.dll
[%WINDOWS%]\QWFyb25z\command.exe
[%WINDOWS%]\RGFycmVu\asappsrv.dll
[%WINDOWS%]\RGFycmVu\command.exe
[%WINDOWS%]\RmFtLiBkZSBHcmVlZg\asappsrv.dll
[%WINDOWS%]\RmFtLiBkZSBHcmVlZg\command.exe
[%WINDOWS%]\RWR3YXJkIEZvcnRlc2N1ZQ\asappsrv.dll
[%WINDOWS%]\RWR3YXJkIEZvcnRlc2N1ZQ\command.exe
[%WINDOWS%]\S1VMTEFNQUE\mYpgnHIhkoH.vbs
[%WINDOWS%]\S3Jpc3Rlbg\asappsrv.dll
[%WINDOWS%]\S3Jpc3Rlbg\command.exe
[%WINDOWS%]\SG9tZQ\asappsrv.dll
[%WINDOWS%]\SG9tZQ\command.exe
[%WINDOWS%]\Sm9lIFN0ZXJu\asappsrv.dll
[%WINDOWS%]\SmF5IGN1cnRpcw\asappsrv.dll
[%WINDOWS%]\SmFtYWhs\asappsrv.dll
[%WINDOWS%]\SmFtYWhs\command.exe
[%WINDOWS%]\SmFtZXMgRCBWb3lsZXM\asappsrv.dll
[%WINDOWS%]\SmFtZXMgRCBWb3lsZXM\command.exe
[%WINDOWS%]\SmFtZXMgTGF1cmVuY2UgV2hpdGluZw\asappsrv.dll
[%WINDOWS%]\SmFtZXMgTGF1cmVuY2UgV2hpdGluZw\command.exe
[%WINDOWS%]\SmVhbmV0dGUgTGV1c2luaw\asappsrv.dll
[%WINDOWS%]\SmVhbmV0dGUgTGV1c2luaw\command.exe
[%WINDOWS%]\SmVmZiBNb3JhbGVz\asappsrv.dll
[%WINDOWS%]\SmVmZiBNb3JhbGVz\command.exe
[%WINDOWS%]\SmVmZnJleQ\asappsrv.dll
[%WINDOWS%]\SmVmZnJleQ\command.exe
[%WINDOWS%]\SmVmZnJleQ\mApAtBL5yk.vbs
[%WINDOWS%]\SnVhbiBGIExlemFtYQ\asappsrv.dll
[%WINDOWS%]\SnVhbiBGIExlemFtYQ\command.exe
[%WINDOWS%]\SW5tYW4\asappsrv.dll
[%WINDOWS%]\SW5tYW4\command.exe
[%WINDOWS%]\T0VN\asappsrv.dll
[%WINDOWS%]\T0VN\command.exe
[%WINDOWS%]\TEMP\cmdinst.exe
[%WINDOWS%]\TGFycnkgTWFjaW9jaQ\asappsrv.dll
[%WINDOWS%]\TGFycnkgTWFjaW9jaQ\command.exe
[%WINDOWS%]\TGlhbmUgV2hpdG5leQ\asappsrv.dll
[%WINDOWS%]\TGlhbmUgV2hpdG5leQ\command.exe
[%WINDOWS%]\TW9sbHkgQXJub2xk\asappsrv.dll
[%WINDOWS%]\TW9sbHkgQXJub2xk\command.exe
[%WINDOWS%]\TWF0dCBaZXR6\asappsrv.dll
[%WINDOWS%]\TWF0dCBaZXR6\command.exe
[%WINDOWS%]\TWU\asappsrv.dll
[%WINDOWS%]\TWU\command.exe
[%WINDOWS%]\U2FiaWhhIE1hbGlr\asappsrv.dll
[%WINDOWS%]\U3RhbiBTbWl0aA\asappsrv.dll
[%WINDOWS%]\U3RhbiBTbWl0aA\command.exe
[%WINDOWS%]\U3RlcGhlbiBBcndpbmU\asappsrv.dll
[%WINDOWS%]\U3RlcGhlbiBBcndpbmU\command.exe
[%WINDOWS%]\UE9PUA\oH6joE.vbs
[%WINDOWS%]\UGF0IERlc2hhdw\asappsrv.dll
[%WINDOWS%]\UGF0IERlc2hhdw\command.exe
[%WINDOWS%]\V2lsbCBNaXRjaGVsbA\asappsrv.dll
[%WINDOWS%]\V2lsbCBNaXRjaGVsbA\command.exe
[%WINDOWS%]\VXNlcg\asappsrv.dll
[%WINDOWS%]\VXNlcg\command.exe
[%WINDOWS%]\WGlhb0Jyb3RoZXI\asappsrv.dll
[%WINDOWS%]\WGlhb0Jyb3RoZXI\command.exe
[%WINDOWS%]\Y2hhbmVnbWU\sZ11vApBvqo.vbs
[%WINDOWS%]\YWRtaW4\asappsrv.dll
[%WINDOWS%]\YWRtaW4\command.exe
[%WINDOWS%]\ZHk\asappsrv.dll
[%WINDOWS%]\ZHk\command.exe
[%WINDOWS%]\Zm8\asappsrv.dll
[%WINDOWS%]\Zm8\command.exe
[%WINDOWS%]\Zm8\tAf.vbs
[%WINDOWS%]\ZW5yaXF1ZXRhIGRhaWxleQ\tqcVurIYtrl1K3l1uqU5yk.vbs
[%WINDOWS%]\Buddy.exe
[%WINDOWS%]\ceres.dll
[%WINDOWS%]\inst\3p_1n.exe
[%WINDOWS%]\isrvs\edmond.exe
[%WINDOWS%]\isrvs\icons\spywareavenger.ico
[%WINDOWS%]\isrvs\icons\virushunter.ico
[%WINDOWS%]\isrvs\isearch.xpi
[%WINDOWS%]\isrvs\mfiltis.dll
[%WINDOWS%]\isrvs\msdbhk.dll
[%WINDOWS%]\isrvs\sysupd.dll
[%DESKTOP%]\isearch.com.url
[%PROFILE_TEMP%]\b1\build2.exe
[%PROFILE_TEMP%]\b1\ping2.bat
[%SYSTEM%]\a13\rarndrll2.exe
[%SYSTEM%]\toolbar_.dll
[%SYSTEM%]\winhot32.dll
[%WINDOWS%]\system\toolbar.dll
[%WINDOWS%]\system\toolbar_.dll

Folders:
[%SYSTEM%]\cache32_hsrb
[%PROGRAM_FILES%]\isearch firefox installer

Registry Keys:
HKEY_CLASSES_ROOT\clsid\{2490a770-d039-4b60-a94d-ad22f9ac605b}
HKEY_CLASSES_ROOT\clsid\{285b5ccd-c3f0-4eb6-9632-7d0a3c3af824}
HKEY_CLASSES_ROOT\clsid\{76c13acd-b6fd-4cbe-ac7b-46551f360048}
HKEY_CLASSES_ROOT\clsid\{de910060-8efb-44b9-b492-75180696643f}
HKEY_CLASSES_ROOT\isearch.object
HKEY_CLASSES_ROOT\isearch.object.1
HKEY_CLASSES_ROOT\Typelib\{6D3F5DE4-E980-4407-A10F-9AC771ABAAE6}
HKEY_CURRENT_USER\software\isearch
HKEY_CURRENT_USER\software\_hsrb
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1C78AB3F-A857-482E-80C0-3A1E5238A565}
HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\legacy_cmdservice
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\cmdservice
HKEY_CLASSES_ROOT\CeresDll.CeresDllObj
HKEY_CLASSES_ROOT\CeresDll.CeresDllObj.1
HKEY_CLASSES_ROOT\CLSID\{00000049-8F91-4D9C-9573-F016E7626484}
HKEY_CLASSES_ROOT\Interface\{BB0D5ADC-028D-4185-9288-722DDCE2C757}
HKEY_LOCAL_MACHINE\Software\Classes\CeresDll.CeresDllObj
HKEY_LOCAL_MACHINE\Software\Classes\CeresDll.CeresDllObj.1
HKEY_CLASSES_ROOT\clsid\{1c78ab3f-a857-482e-80c0-3a1e5238a565}
HKEY_CLASSES_ROOT\clsid\{60ebe9c3-3f82-407d-acdf-f1a7bd01169a}
HKEY_CLASSES_ROOT\clsid\{8b224779-3b0e-4fea-8ae1-b66c20dd840f}
HKEY_CLASSES_ROOT\clsid\{99802379-7362-40e2-9d28-8a3b9af880b7}
HKEY_CLASSES_ROOT\clsid\{d9d08235-3baa-4271-a2a6-f394c6636e07}
HKEY_CLASSES_ROOT\clsid\{e07b839e-eb50-487f-b102-fb62808ffca8}
HKEY_CLASSES_ROOT\clsid\{f53d87ad-02aa-432c-90fb-f8c912f15369}
HKEY_CLASSES_ROOT\dsktrf.amo
HKEY_CLASSES_ROOT\dsktrf.amo.1
HKEY_CLASSES_ROOT\dsktrf.cmod
HKEY_CLASSES_ROOT\dsktrf.cmod.1
HKEY_CLASSES_ROOT\dsktrf.iiittt
HKEY_CLASSES_ROOT\dsktrf.iiittt.1
HKEY_CLASSES_ROOT\dsktrf.momo
HKEY_CLASSES_ROOT\dsktrf.momo.1
HKEY_CLASSES_ROOT\dsktrf.ohb
HKEY_CLASSES_ROOT\dsktrf.ohb.1
HKEY_CLASSES_ROOT\dsktrf.omoc
HKEY_CLASSES_ROOT\dsktrf.omoc.1
HKEY_CLASSES_ROOT\software\microsoft\windows\currentversion\explorer\browser helper objects\{1c78ab3f-a857-482e-80c0-3a1e5238a565}
HKEY_CLASSES_ROOT\typelib\{6d3f5de4-e980-4407-a10f-9ac771abaae6}
HKEY_CLASSES_ROOT\typelib\{b5921564-ca50-4d36-a088-fca56eb57812}
HKEY_CLASSES_ROOT\typelib\{f177a37f-e8a8-47ad-a7e9-e95fed03d7ee}
HKEY_CLASSES_ROOT\winalot.amo
HKEY_CLASSES_ROOT\winalot.amo.1
HKEY_CLASSES_ROOT\winalot.cmod
HKEY_CLASSES_ROOT\winalot.dbi
HKEY_CLASSES_ROOT\winalot.dbi.1
HKEY_CLASSES_ROOT\winalot.iiittt
HKEY_CLASSES_ROOT\winalot.iiittt.1
HKEY_CLASSES_ROOT\winalot.momo
HKEY_CLASSES_ROOT\winalot.momo.1
HKEY_CLASSES_ROOT\winalot.ohb
HKEY_CLASSES_ROOT\winalot.ohb.1
HKEY_CLASSES_ROOT\winalot.omoc
HKEY_CURRENT_USER\software\hsb
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{1c78ab3f-a857-482e-80c0-3a1e5238a565}

Registry Values:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\toolbar
HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\toolbar
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\isearch toolbar_is1
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\isearch toolbar_is1
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\isearch toolbar_is1
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\isearch toolbar_is1
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\isearch toolbar_is1
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\isearch toolbar_is1
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\isearch toolbar_is1
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\isearch toolbar_is1
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\isearch toolbar_is1
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\isearch toolbar_is1
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\isearch toolbar_is1

Removing ISearch:

You can download trial version of "Exterminate-It" antivirus software here, to check your computer instantly.

Or buy it to remove ALL viruses from your computer.

Also Be Aware of the Following Threats:
Moonpie.Server.family Backdoor Information
TrojanDropper.Win32.VB.bj Trojan Removal instruction
Galorion Trojan Cleaner
Removing CWS.MSConfig Hijacker