Loki Trojan

Removing Loki
Categories: Trojan,Backdoor,Downloader,DoS
This category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.
Backdoors combine the functionality of most other types of in one package.
Backdoors have one especially dangerous sub-class: variants that can propagate like worms.

The downloader either launches the new malware or registers it to enable autorun
according to the local operating system requirements.
These programs attack web servers by sending numerous requests to the specified server,
often causing it to crash under an excessive volume of requests.

DoS trojans conduct such attacks from a single computer with the consent of the user.

Worms can carry a DoS procedure as part of their payload.

---

Loki Also known as:

[Panda]Loki.1234.1st;
[Computer Associates]Loki

---

Visible Symptoms:
Files in system folders:
[%PROFILE_TEMP%]\EaslME.exe
[%PROFILE_TEMP%]\EFJa7E.exe
[%PROFILE_TEMP%]\OaKDu7.exe
[%PROGRAM_FILES%]\default.skn
[%PROGRAM_FILES%]\skins\default.skn
[%SYSTEM%]\acsproxy.lib
[%SYSTEM%]\bw6mds51.ocx
[%SYSTEM%]\chat.dat
[%SYSTEM%]\ezines.dat
[%SYSTEM%]\home.dat
[%SYSTEM%]\imgconv.dll
[%SYSTEM%]\longtimer.ocx
[%SYSTEM%]\mciwndx.ocx
[%SYSTEM%]\olelib.tlb
[%SYSTEM%]\paysites.dat
[%SYSTEM%]\pics.dat
[%SYSTEM%]\unregister.exe
[%SYSTEM%]\VIC32.DLL
[%SYSTEM%]\videos.dat
[%WINDOWS%]\alchem.ini
[%WINDOWS%]\msbb.exe
[%PROFILE_TEMP%]\EaslME.exe
[%PROFILE_TEMP%]\EFJa7E.exe
[%PROFILE_TEMP%]\OaKDu7.exe
[%PROGRAM_FILES%]\default.skn
[%PROGRAM_FILES%]\skins\default.skn
[%SYSTEM%]\acsproxy.lib
[%SYSTEM%]\bw6mds51.ocx
[%SYSTEM%]\chat.dat
[%SYSTEM%]\ezines.dat
[%SYSTEM%]\home.dat
[%SYSTEM%]\imgconv.dll
[%SYSTEM%]\longtimer.ocx
[%SYSTEM%]\mciwndx.ocx
[%SYSTEM%]\olelib.tlb
[%SYSTEM%]\paysites.dat
[%SYSTEM%]\pics.dat
[%SYSTEM%]\unregister.exe
[%SYSTEM%]\VIC32.DLL
[%SYSTEM%]\videos.dat
[%WINDOWS%]\alchem.ini
[%WINDOWS%]\msbb.exe

How to detect Loki:

Files:
[%PROFILE_TEMP%]\EaslME.exe
[%PROFILE_TEMP%]\EFJa7E.exe
[%PROFILE_TEMP%]\OaKDu7.exe
[%PROGRAM_FILES%]\default.skn
[%PROGRAM_FILES%]\skins\default.skn
[%SYSTEM%]\acsproxy.lib
[%SYSTEM%]\bw6mds51.ocx
[%SYSTEM%]\chat.dat
[%SYSTEM%]\ezines.dat
[%SYSTEM%]\home.dat
[%SYSTEM%]\imgconv.dll
[%SYSTEM%]\longtimer.ocx
[%SYSTEM%]\mciwndx.ocx
[%SYSTEM%]\olelib.tlb
[%SYSTEM%]\paysites.dat
[%SYSTEM%]\pics.dat
[%SYSTEM%]\unregister.exe
[%SYSTEM%]\VIC32.DLL
[%SYSTEM%]\videos.dat
[%WINDOWS%]\alchem.ini
[%WINDOWS%]\msbb.exe
[%PROFILE_TEMP%]\EaslME.exe
[%PROFILE_TEMP%]\EFJa7E.exe
[%PROFILE_TEMP%]\OaKDu7.exe
[%PROGRAM_FILES%]\default.skn
[%PROGRAM_FILES%]\skins\default.skn
[%SYSTEM%]\acsproxy.lib
[%SYSTEM%]\bw6mds51.ocx
[%SYSTEM%]\chat.dat
[%SYSTEM%]\ezines.dat
[%SYSTEM%]\home.dat
[%SYSTEM%]\imgconv.dll
[%SYSTEM%]\longtimer.ocx
[%SYSTEM%]\mciwndx.ocx
[%SYSTEM%]\olelib.tlb
[%SYSTEM%]\paysites.dat
[%SYSTEM%]\pics.dat
[%SYSTEM%]\unregister.exe
[%SYSTEM%]\VIC32.DLL
[%SYSTEM%]\videos.dat
[%WINDOWS%]\alchem.ini
[%WINDOWS%]\msbb.exe

Folders:
[%PROGRAM_FILES_COMMON%]\totem shared
[%PROGRAM_FILES%]\search bar

Registry Keys:
HKEY_CLASSES_ROOT\clsid\{771a1334-6b08-4a6b-aedc-cf994ba2cebe}
HKEY_CLASSES_ROOT\clsid\{dc341f1b-ec77-47be-8f58-96e83861cc5a}
HKEY_CLASSES_ROOT\interface\{90ce74cc-788a-4a00-b38d-cbca08cc9e8f}
HKEY_CLASSES_ROOT\interface\{bf06da8e-2beb-4816-9bbd-f7625246e245}
HKEY_CLASSES_ROOT\istx.installer.2
HKEY_CLASSES_ROOT\typelib\{cc257918-f435-4a33-8231-2b8195990cca}
HKEY_CLASSES_ROOT\typelib\{db447818-96b4-40df-8a55-720da496f514}
HKEY_CURRENT_USER\software\ist
HKEY_LOCAL_MACHINE\software\classes\appid\{11baf79b-530c-4200-a33d-48be83fc75be}
HKEY_LOCAL_MACHINE\software\classes\appid\{5fb747f9-320c-47b4-9ce8-545fb4f3ba81}
HKEY_LOCAL_MACHINE\software\classes\atltoolbar.tbar
HKEY_LOCAL_MACHINE\software\classes\atltoolbar.tbar.1
HKEY_LOCAL_MACHINE\software\classes\bho.bhoobject
HKEY_LOCAL_MACHINE\software\classes\bho.bhoobject.1
HKEY_LOCAL_MACHINE\software\classes\clsid\{68706808-7097-4818-9aec-cb1a0e7aca51}
HKEY_LOCAL_MACHINE\software\classes\clsid\{98a8315e-667a-11d5-87a3-bb213c32b44b}
HKEY_LOCAL_MACHINE\software\classes\clsid\{aa8c93e1-7e5f-497e-b67c-cc8fe2a40d3b}
HKEY_LOCAL_MACHINE\software\classes\clsid\{f3e7ff6d-dca1-11d4-95df-00c0dfe9982c}
HKEY_LOCAL_MACHINE\software\classes\imgconv.clsimgconv
HKEY_LOCAL_MACHINE\software\classes\interface\{2ddd90d6-f153-4ea7-a324-4b2d83d1027e}
HKEY_LOCAL_MACHINE\software\classes\interface\{788bd7b7-fa4f-4fd3-b63e-e3fbc0aa7d0a}
HKEY_LOCAL_MACHINE\software\classes\interface\{79bf9dcd-c52d-4da8-b15e-ac2a88e96b0a}
HKEY_LOCAL_MACHINE\software\classes\interface\{7ed9e9b8-e1d4-4576-aec2-2a70bb3caa1c}
HKEY_LOCAL_MACHINE\software\classes\interface\{98a8315d-667a-11d5-87a3-bb213c32b44b}
HKEY_LOCAL_MACHINE\software\classes\interface\{98a8315f-667a-11d5-87a3-bb213c32b44b}
HKEY_LOCAL_MACHINE\software\classes\interface\{996b33c1-8e19-4f4f-ab6c-52a2c523b7d3}
HKEY_LOCAL_MACHINE\software\classes\interface\{9ce15eb5-6b39-4656-9e1f-2d219ee42e0e}
HKEY_LOCAL_MACHINE\software\classes\typelib\{17ed04b9-6c71-11d4-87a3-daa6b6b40e8f}
HKEY_LOCAL_MACHINE\software\classes\typelib\{7c9e9a74-1922-409e-ab46-e48784336c3a}
HKEY_LOCAL_MACHINE\software\classes\typelib\{b1c5c992-23df-4704-9f7a-155b575ed19a}
HKEY_LOCAL_MACHINE\software\classes\typelib\{d956a47d-73cd-4ee9-bbf7-b06c14100c41}
HKEY_LOCAL_MACHINE\software\classes\typelib\{f3e7ff6b-dca1-11d4-95df-00c0dfe9982c}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{7C559105-9ECF-42B8-B3F7-832E75EDD959}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\internet settings\zonemap\domains\contentmatch.net
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\moduleusage\c:\windows\downloaded program files\istactivex.dll

Registry Values:
HKEY_LOCAL_MACHINE\software\classes\appid\atltoolbar.dll
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer

Removing Loki:

You can download trial version of "Exterminate-It" antivirus software here, to check your computer instantly.

Or buy it to remove ALL viruses from your computer.

---

Also Be Aware of the Following Threats:
Elza Trojan Symptoms
Remove LipGame Adware
Dismember Trojan Removal
Removing Bancos.IEC Trojan
Removing Qomar Trojan

Crusc Trojan

Removing Crusc
Categories: Trojan
This category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

---

Crusc Also known as:

[Kaspersky]Trojan-Proxy.Win32.Horst.be,Trojan-Proxy.Win32.Horst.cm,Trojan-Proxy.win32.Horst.be,Trojan-Proxy.Win32.Horst.bk,Trojan-Downloader.Win32.Agent.amc,Trojan-Proxy.Win32.Horst.z,Trojan-Downloader.Win32.Vivia.y;
[McAfee]Spam-Loot,Spam-loot;
[Other]TROJ_AGENT.CAH,Win32.Crusc.K,Win32/Crusc.H,TROJ_HORST.CM,Win32/Crusc.J,Trojan-Spy.Win32.Agent.nr,Trojan.Webus.G,Win32/Crusc.I,Trojan-Proxy.Win32.Horst.cg,Hacktool.Proxy,Win32/Crusc.Q,Trojan-Proxy.win32.Horst.bu,Win32/Crusc.R,Trojan-Proxy.Win32.Horst.bu,Win32/Crusc.P,trojan-backdoor-medbod,Win32/Crusc.M,Trojan.Zlob,Win32/Crusc.N,Backdoor.DMSpammer,Win32/Crusc.L,Win32/Crusc.O,Win32/Crusc.T,Win32/Crusc.S,TROJ_HORST.BU,Win32/Crusc.E,Win32/Crusc.F

---

Visible Symptoms:
Files in system folders:
[%PROFILE_TEMP%]\14exmodul32e.d.exe
[%PROFILE_TEMP%]\17exmodul32d.1.exe
[%PROFILE_TEMP%]\17exmodul32s.4.exe
[%PROFILE_TEMP%]\18exmodul32d.1.exe
[%PROFILE_TEMP%]\18exmodul32s.4.exe
[%PROFILE_TEMP%]\19exmodul32c.3.exe
[%PROFILE_TEMP%]\1exmodul32d.1.exe
[%PROFILE_TEMP%]\22exmodul32s.4.exe
[%PROFILE_TEMP%]\24exinjs.h.exe
[%PROFILE_TEMP%]\27exmodul32s.4.exe
[%PROFILE_TEMP%]\3.modul32h2.exe
[%PROFILE_TEMP%]\30exmodul32d.1.exe
[%PROFILE_TEMP%]\37exmodul32s.4.exe
[%PROFILE_TEMP%]\41exmodul32d.b.exe
[%PROFILE_TEMP%]\46exmodul32s.4.exe
[%PROFILE_TEMP%]\48exmodul32d.1.exe
[%PROFILE_TEMP%]\49exinjs.h.exe
[%PROFILE_TEMP%]\49exmodul32d.1.exe
[%PROFILE_TEMP%]\5.modul32h2.exe
[%PROFILE_TEMP%]\53exmodul32s.4.exe
[%PROFILE_TEMP%]\54exmodul32e.d.exe
[%PROFILE_TEMP%]\57exmodul32s.4.exe
[%PROFILE_TEMP%]\58exmodul32s.4.exe
[%PROFILE_TEMP%]\6.modul32h2.exe
[%PROFILE_TEMP%]\61exmodul32s.4.exe
[%PROFILE_TEMP%]\62exmodul32d.b.exe
[%PROFILE_TEMP%]\64exmodul32d.4.exe
[%PROFILE_TEMP%]\69exmodul32c.3.exe
[%PROFILE_TEMP%]\69exmodul32e.d.exe
[%PROFILE_TEMP%]\71exmodul32c.3.exe
[%PROFILE_TEMP%]\71exmodul32d.7.exe
[%PROFILE_TEMP%]\72exmodul32d.8.exe
[%PROFILE_TEMP%]\73exmodul32s.4.exe
[%PROFILE_TEMP%]\81exmodul32e.d.exe
[%PROFILE_TEMP%]\82exmodul32d.8.exe
[%PROFILE_TEMP%]\83exinjs.h.exe
[%PROFILE_TEMP%]\86exmodul32d.1.exe
[%PROFILE_TEMP%]\92exinjs.h.exe
[%PROFILE_TEMP%]\94exmodul32e.d.exe
[%PROFILE_TEMP%]\96exmodul32c.3.exe
[%PROFILE_TEMP%]\96exmodul32e.d.exe
[%PROFILE_TEMP%]\98exmodul32d.1.exe
[%PROFILE_TEMP%]\modul32c.3.exe
[%PROFILE_TEMP%]\modul32d.1.exe
[%PROFILE_TEMP%]\modul32d.4.exe
[%PROFILE_TEMP%]\modul32d.7.exe
[%PROFILE_TEMP%]\modul32d.8.exe
[%PROFILE_TEMP%]\modul32d.b.exe
[%PROFILE_TEMP%]\14exmodul32e.d.exe
[%PROFILE_TEMP%]\17exmodul32d.1.exe
[%PROFILE_TEMP%]\17exmodul32s.4.exe
[%PROFILE_TEMP%]\18exmodul32d.1.exe
[%PROFILE_TEMP%]\18exmodul32s.4.exe
[%PROFILE_TEMP%]\19exmodul32c.3.exe
[%PROFILE_TEMP%]\1exmodul32d.1.exe
[%PROFILE_TEMP%]\22exmodul32s.4.exe
[%PROFILE_TEMP%]\24exinjs.h.exe
[%PROFILE_TEMP%]\27exmodul32s.4.exe
[%PROFILE_TEMP%]\3.modul32h2.exe
[%PROFILE_TEMP%]\30exmodul32d.1.exe
[%PROFILE_TEMP%]\37exmodul32s.4.exe
[%PROFILE_TEMP%]\41exmodul32d.b.exe
[%PROFILE_TEMP%]\46exmodul32s.4.exe
[%PROFILE_TEMP%]\48exmodul32d.1.exe
[%PROFILE_TEMP%]\49exinjs.h.exe
[%PROFILE_TEMP%]\49exmodul32d.1.exe
[%PROFILE_TEMP%]\5.modul32h2.exe
[%PROFILE_TEMP%]\53exmodul32s.4.exe
[%PROFILE_TEMP%]\54exmodul32e.d.exe
[%PROFILE_TEMP%]\57exmodul32s.4.exe
[%PROFILE_TEMP%]\58exmodul32s.4.exe
[%PROFILE_TEMP%]\6.modul32h2.exe
[%PROFILE_TEMP%]\61exmodul32s.4.exe
[%PROFILE_TEMP%]\62exmodul32d.b.exe
[%PROFILE_TEMP%]\64exmodul32d.4.exe
[%PROFILE_TEMP%]\69exmodul32c.3.exe
[%PROFILE_TEMP%]\69exmodul32e.d.exe
[%PROFILE_TEMP%]\71exmodul32c.3.exe
[%PROFILE_TEMP%]\71exmodul32d.7.exe
[%PROFILE_TEMP%]\72exmodul32d.8.exe
[%PROFILE_TEMP%]\73exmodul32s.4.exe
[%PROFILE_TEMP%]\81exmodul32e.d.exe
[%PROFILE_TEMP%]\82exmodul32d.8.exe
[%PROFILE_TEMP%]\83exinjs.h.exe
[%PROFILE_TEMP%]\86exmodul32d.1.exe
[%PROFILE_TEMP%]\92exinjs.h.exe
[%PROFILE_TEMP%]\94exmodul32e.d.exe
[%PROFILE_TEMP%]\96exmodul32c.3.exe
[%PROFILE_TEMP%]\96exmodul32e.d.exe
[%PROFILE_TEMP%]\98exmodul32d.1.exe
[%PROFILE_TEMP%]\modul32c.3.exe
[%PROFILE_TEMP%]\modul32d.1.exe
[%PROFILE_TEMP%]\modul32d.4.exe
[%PROFILE_TEMP%]\modul32d.7.exe
[%PROFILE_TEMP%]\modul32d.8.exe
[%PROFILE_TEMP%]\modul32d.b.exe

How to detect Crusc:

Files:
[%PROFILE_TEMP%]\14exmodul32e.d.exe
[%PROFILE_TEMP%]\17exmodul32d.1.exe
[%PROFILE_TEMP%]\17exmodul32s.4.exe
[%PROFILE_TEMP%]\18exmodul32d.1.exe
[%PROFILE_TEMP%]\18exmodul32s.4.exe
[%PROFILE_TEMP%]\19exmodul32c.3.exe
[%PROFILE_TEMP%]\1exmodul32d.1.exe
[%PROFILE_TEMP%]\22exmodul32s.4.exe
[%PROFILE_TEMP%]\24exinjs.h.exe
[%PROFILE_TEMP%]\27exmodul32s.4.exe
[%PROFILE_TEMP%]\3.modul32h2.exe
[%PROFILE_TEMP%]\30exmodul32d.1.exe
[%PROFILE_TEMP%]\37exmodul32s.4.exe
[%PROFILE_TEMP%]\41exmodul32d.b.exe
[%PROFILE_TEMP%]\46exmodul32s.4.exe
[%PROFILE_TEMP%]\48exmodul32d.1.exe
[%PROFILE_TEMP%]\49exinjs.h.exe
[%PROFILE_TEMP%]\49exmodul32d.1.exe
[%PROFILE_TEMP%]\5.modul32h2.exe
[%PROFILE_TEMP%]\53exmodul32s.4.exe
[%PROFILE_TEMP%]\54exmodul32e.d.exe
[%PROFILE_TEMP%]\57exmodul32s.4.exe
[%PROFILE_TEMP%]\58exmodul32s.4.exe
[%PROFILE_TEMP%]\6.modul32h2.exe
[%PROFILE_TEMP%]\61exmodul32s.4.exe
[%PROFILE_TEMP%]\62exmodul32d.b.exe
[%PROFILE_TEMP%]\64exmodul32d.4.exe
[%PROFILE_TEMP%]\69exmodul32c.3.exe
[%PROFILE_TEMP%]\69exmodul32e.d.exe
[%PROFILE_TEMP%]\71exmodul32c.3.exe
[%PROFILE_TEMP%]\71exmodul32d.7.exe
[%PROFILE_TEMP%]\72exmodul32d.8.exe
[%PROFILE_TEMP%]\73exmodul32s.4.exe
[%PROFILE_TEMP%]\81exmodul32e.d.exe
[%PROFILE_TEMP%]\82exmodul32d.8.exe
[%PROFILE_TEMP%]\83exinjs.h.exe
[%PROFILE_TEMP%]\86exmodul32d.1.exe
[%PROFILE_TEMP%]\92exinjs.h.exe
[%PROFILE_TEMP%]\94exmodul32e.d.exe
[%PROFILE_TEMP%]\96exmodul32c.3.exe
[%PROFILE_TEMP%]\96exmodul32e.d.exe
[%PROFILE_TEMP%]\98exmodul32d.1.exe
[%PROFILE_TEMP%]\modul32c.3.exe
[%PROFILE_TEMP%]\modul32d.1.exe
[%PROFILE_TEMP%]\modul32d.4.exe
[%PROFILE_TEMP%]\modul32d.7.exe
[%PROFILE_TEMP%]\modul32d.8.exe
[%PROFILE_TEMP%]\modul32d.b.exe
[%PROFILE_TEMP%]\14exmodul32e.d.exe
[%PROFILE_TEMP%]\17exmodul32d.1.exe
[%PROFILE_TEMP%]\17exmodul32s.4.exe
[%PROFILE_TEMP%]\18exmodul32d.1.exe
[%PROFILE_TEMP%]\18exmodul32s.4.exe
[%PROFILE_TEMP%]\19exmodul32c.3.exe
[%PROFILE_TEMP%]\1exmodul32d.1.exe
[%PROFILE_TEMP%]\22exmodul32s.4.exe
[%PROFILE_TEMP%]\24exinjs.h.exe
[%PROFILE_TEMP%]\27exmodul32s.4.exe
[%PROFILE_TEMP%]\3.modul32h2.exe
[%PROFILE_TEMP%]\30exmodul32d.1.exe
[%PROFILE_TEMP%]\37exmodul32s.4.exe
[%PROFILE_TEMP%]\41exmodul32d.b.exe
[%PROFILE_TEMP%]\46exmodul32s.4.exe
[%PROFILE_TEMP%]\48exmodul32d.1.exe
[%PROFILE_TEMP%]\49exinjs.h.exe
[%PROFILE_TEMP%]\49exmodul32d.1.exe
[%PROFILE_TEMP%]\5.modul32h2.exe
[%PROFILE_TEMP%]\53exmodul32s.4.exe
[%PROFILE_TEMP%]\54exmodul32e.d.exe
[%PROFILE_TEMP%]\57exmodul32s.4.exe
[%PROFILE_TEMP%]\58exmodul32s.4.exe
[%PROFILE_TEMP%]\6.modul32h2.exe
[%PROFILE_TEMP%]\61exmodul32s.4.exe
[%PROFILE_TEMP%]\62exmodul32d.b.exe
[%PROFILE_TEMP%]\64exmodul32d.4.exe
[%PROFILE_TEMP%]\69exmodul32c.3.exe
[%PROFILE_TEMP%]\69exmodul32e.d.exe
[%PROFILE_TEMP%]\71exmodul32c.3.exe
[%PROFILE_TEMP%]\71exmodul32d.7.exe
[%PROFILE_TEMP%]\72exmodul32d.8.exe
[%PROFILE_TEMP%]\73exmodul32s.4.exe
[%PROFILE_TEMP%]\81exmodul32e.d.exe
[%PROFILE_TEMP%]\82exmodul32d.8.exe
[%PROFILE_TEMP%]\83exinjs.h.exe
[%PROFILE_TEMP%]\86exmodul32d.1.exe
[%PROFILE_TEMP%]\92exinjs.h.exe
[%PROFILE_TEMP%]\94exmodul32e.d.exe
[%PROFILE_TEMP%]\96exmodul32c.3.exe
[%PROFILE_TEMP%]\96exmodul32e.d.exe
[%PROFILE_TEMP%]\98exmodul32d.1.exe
[%PROFILE_TEMP%]\modul32c.3.exe
[%PROFILE_TEMP%]\modul32d.1.exe
[%PROFILE_TEMP%]\modul32d.4.exe
[%PROFILE_TEMP%]\modul32d.7.exe
[%PROFILE_TEMP%]\modul32d.8.exe
[%PROFILE_TEMP%]\modul32d.b.exe

Removing Crusc:

You can download trial version of "Exterminate-It" antivirus software here, to check your computer instantly.

Or buy it to remove ALL viruses from your computer.

---

Also Be Aware of the Following Threats:
Remove Win32.NTRootKit Backdoor
Remove Pss Trojan
Lynch0 Trojan Removal instruction

ICMP.Cmd RAT

Removing ICMP.Cmd
Categories: RAT
Some RAT trojans are pranks that are most likely being controlled by a friend or enemy on
April Fool's day or a holiday. Prank RATS are generally not harmful, and won't log keystrokes or hack.

How to detect ICMP.Cmd:

Registry Values:
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runservices

Removing ICMP.Cmd:

You can download trial version of "Exterminate-It" antivirus software here, to check your computer instantly.

Or buy it to remove ALL viruses from your computer.

---

Also Be Aware of the Following Threats:
Remove Neuropath Trojan
TrojanDownloader.Win32.Hatcher Trojan Removal
Serstroy Trojan Cleaner
Remove Spax! Trojan
Remove Inv.Evil Trojan

AccessMembre Adware

Removing AccessMembre
Categories: Adware
Adware are programs that facilitate delivery for advertising content
to the user and in some cases gather information from the user's computer.

How to detect AccessMembre:

Registry Keys:
HKEY_CLASSES_ROOT\clsid\{d1b80ebf-1a26-4fec-b0b9-dcb934c6507e}
HKEY_CLASSES_ROOT\typelib\{a41c6220-6f42-4646-b119-fbe6f4d38e3c}

Removing AccessMembre:

You can download trial version of "Exterminate-It" antivirus software here, to check your computer instantly.

Or buy it to remove ALL viruses from your computer.

---

Also Be Aware of the Following Threats:
Pigeon.EHL Trojan Information
Psaft Trojan Removal instruction
Removing Win32.VB.ew Trojan
Shah.version RAT Information

Dialer.RAS.aj Adware

Removing Dialer.RAS.aj
Categories: Adware,BHO,Hijacker,Toolbar
Adware are programs that facilitate delivery for advertising content
to the user and in some cases gather information from the user's computer,
including information related to Internet browser usage or other computer habits
The BHO (Browser Helper Object) waits for the user to post personal information to a monitored website.
As this information is entered by the user, it is captured by the BHO and sent back to the attacker.
Hijackers are software programs that modify users' default browser home page,
search settings, error page settings, or desktop wallpaper without adequate notice, disclosure,
or user consent.

When the default home page is hijacked, the browser opens to the web page set by the hijacker
instead of the user's designated home page. In some cases, the hijacker may block users from
restoring their desired home page.

A search hijacker redirects search results to other pages and may
transmit search and browsing data to unknown servers. An error page hijacker directs
the browser to another page, usually an advertising page, instead of the usual error
page when the requested URL is not found.

A desktop hijacker replaces the desktop wallpaper with advertising
for products and services on the desktop.

Hijackers take control of various parts of your web browser, including your home page,
search pages, and search bar. They may also redirect you to certain sites should you
mistype an address or prevent you from going to a website they would rather you not,
such as sites that combat malware. Some will even redirect you to their own search engine
when you attempt a search. NB: hijackers almost exclusively target Internet Explorer.
Toolbar presents itself as a helpful add-on for Internet Explorer but it is a real pest.
It replaces your start page, continuosly open a number of pop up windows and so on.

---

Dialer.RAS.aj Also known as:

[McAfee]Dialer-RAS.aj;
[Panda]Adware/Xupiter,Dialer.Gen

---

Visible Symptoms:
Files in system folders:
[%WINDOWS%]\downloaded program files\xupitertoolbarloader.inf
[%WINDOWS%]\temp\xupitertoolbarinstaller.exe
[%PROFILE_TEMP%]\msgc.tmp10703064614618.exe
[%SYSTEM%]\t.dll
[%SYSTEM%]\xtupdate.dll
[%SYSTEM%]\xupitertoolbar.dll
[%WINDOWS%]\system\t.dll
[%WINDOWS%]\system\xtupdate.dll
[%WINDOWS%]\system\xupitertoolbar.dll
[%WINDOWS%]\downloaded program files\xupitertoolbarloader.inf
[%WINDOWS%]\temp\xupitertoolbarinstaller.exe
[%PROFILE_TEMP%]\msgc.tmp10703064614618.exe
[%SYSTEM%]\t.dll
[%SYSTEM%]\xtupdate.dll
[%SYSTEM%]\xupitertoolbar.dll
[%WINDOWS%]\system\t.dll
[%WINDOWS%]\system\xtupdate.dll
[%WINDOWS%]\system\xupitertoolbar.dll

How to detect Dialer.RAS.aj:

Files:
[%WINDOWS%]\downloaded program files\xupitertoolbarloader.inf
[%WINDOWS%]\temp\xupitertoolbarinstaller.exe
[%PROFILE_TEMP%]\msgc.tmp10703064614618.exe
[%SYSTEM%]\t.dll
[%SYSTEM%]\xtupdate.dll
[%SYSTEM%]\xupitertoolbar.dll
[%WINDOWS%]\system\t.dll
[%WINDOWS%]\system\xtupdate.dll
[%WINDOWS%]\system\xupitertoolbar.dll
[%WINDOWS%]\downloaded program files\xupitertoolbarloader.inf
[%WINDOWS%]\temp\xupitertoolbarinstaller.exe
[%PROFILE_TEMP%]\msgc.tmp10703064614618.exe
[%SYSTEM%]\t.dll
[%SYSTEM%]\xtupdate.dll
[%SYSTEM%]\xupitertoolbar.dll
[%WINDOWS%]\system\t.dll
[%WINDOWS%]\system\xtupdate.dll
[%WINDOWS%]\system\xupitertoolbar.dll

Registry Keys:
HKEY_CLASSES_ROOT\clsid\{6e6dd93e-1fc3-4f43-8afb-1b7b90c9d3eb}
HKEY_CLASSES_ROOT\interface\{1a8b567b-bd3f-44a1-8b94-f50d37a1914e}
HKEY_CLASSES_ROOT\interface\{3a021d2f-5f75-47f5-9bab-a137e1fb015f}
HKEY_CLASSES_ROOT\interface\{d686db39-659a-491a-a35c-60b99495c16e}
HKEY_CLASSES_ROOT\typelib\{43732063-1bda-45a0-bbee-13e014cb4041}
HKEY_CLASSES_ROOT\typelib\{909e0059-f545-42de-9d2c-cc4a3e336ec3}
HKEY_CLASSES_ROOT\typelib\{c6c2871f-7467-4a35-90fa-9e9894bc1916}
HKEY_CLASSES_ROOT\xtsearch.xtsearchhook
HKEY_CLASSES_ROOT\xtsearch.xtsearchhook.1
HKEY_CLASSES_ROOT\xtupdate.xt
HKEY_CLASSES_ROOT\xtupdate.xt.1
HKEY_CLASSES_ROOT\xupitertoolbar.band
HKEY_CLASSES_ROOT\xupitertoolbar.band.1
HKEY_CURRENT_USER\software\xupiter
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\sqwire
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\xupiter
HKEY_CLASSES_ROOT\clsid\{26fd5192-a97c-4b48-a5d7-2420cfdcfdf2}
HKEY_CLASSES_ROOT\clsid\{3c5ba506-6c30-4738-9ced-797acadea8dc}
HKEY_CLASSES_ROOT\clsid\{a27cfcae-9351-4d74-bffc-21eb19693d8c}
HKEY_CLASSES_ROOT\clsid\{d7b3e460-9968-4191-bd6f-beed1bc18482}
HKEY_CLASSES_ROOT\software\microsoft\windows\currentversion\explorer\browser helper objects\{2662bdd7-05d6-408f-b241-ff98face6054}
HKEY_CLASSES_ROOT\sqtoolbar.band
HKEY_CLASSES_ROOT\sqtoolbar.band.1
HKEY_CLASSES_ROOT\xtupdate.
HKEY_CLASSES_ROOT\xupitertoolbar
HKEY_CURRENT_USER\software\microsoft\internet explorer\menuext\power search
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{280168bc-76bf-4cd0-b835-3d686efa8ddc}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{a27cfcae-9351-4d74-bffc-21eb19693d8c}

Registry Values:
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\moduleusage\c:/winnt/downloaded program files/wuinst.dll
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\moduleusage\c:/winnt/downloaded program files/wuinst.dll
HKEY_CURRENT_USER\software\microsoft\internetexplorer\main
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\moduleusage\[%WINDOWS%]/downloaded program files/conflict.1/installer.dll
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\moduleusage\[%WINDOWS%]/downloaded program files/conflict.1/installer.dll
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\moduleusage\[%WINDOWS%]/downloaded program files/wuinst.dll
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\moduleusage\[%WINDOWS%]/downloaded program files/wuinst.dll

Removing Dialer.RAS.aj:

You can download trial version of "Exterminate-It" antivirus software here, to check your computer instantly.

Or buy it to remove ALL viruses from your computer.

---

Also Be Aware of the Following Threats:
XDel Trojan Removal instruction
mindfire.com Tracking Cookie Removal

Borlan Trojan

Removing Borlan
Categories: Trojan,Adware
This category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.
Adware are programs that facilitate delivery for advertising content
to the user and in some cases gather information from the user's computer.

---

Borlan Also known as:

[Kaspersky]AdWare.Win32.Boran.c,AdWare.Win32.Boran.i,AdWare.Win32.Boran.e,AdWare.Win32.Borlan.x,AdWare.Win32.Boran.ab,AdWare.Win32.Borlan.ab,AdWare.Win32.Boran.p,AdWare.Win32.Boran.w,AdWare.Win32.Boran.z,AdWare.Win32.Boran.ae,AdWare.Win32.Boran.o,AdWare.Win32.Borlan.aj,AdWare.Win32.Boran.ah,AdWare.Win32.Boran.bh;
[McAfee]Adware-Boran,Adware-Borlan,Adware-Boran-gen,Adware-Boran.gen,Adware-Borlan.gen,Generic PUP.g,Adware-Borlan.dr;
[F-Prot]W32/AdwareX.ADH,W32/OnlineGames.A.gen!Eldorado;
[Other]Adware.Borlan,AdWare.Borlan,Trojan Horse,Trojan.Win32.Agent.zl,Borlan.MMsAssist,W32/Boran.AH.dropper,Program:Win32/MMSAssist,W32/Boran.QI,W32/Borlan.AE.dropper,W32/Agent.CWZQ

---

Visible Symptoms:
Files in system folders:
[%RECENT%]\working.lnk
[%PROFILE%]\Recent\Albus.lnk
[%PROFILE%]\Recent\working.lnk
[%PROFILE_TEMP%]\13_386.exe
[%PROFILE_TEMP%]\DecFile.exe
[%PROFILE_TEMP%]\mms_661.exe
[%PROGRAM_FILES%]\vision\almms.dat
[%PROGRAM_FILES%]\vision\alvsn.dll
[%PROGRAM_FILES%]\vision\updateex.ini
[%PROGRAM_FILES%]\vision\updvsnex.ini
[%PROGRAM_FILES%]\vision\vision.dll
[%PROGRAM_FILES%]\vision\vision.ini
[%PROGRAM_FILES%]\vision\visver.dll
[%PROGRAM_FILES%]\ynxq\crbu.ini
[%PROGRAM_FILES%]\ynxq\etdw.dll
[%PROGRAM_FILES%]\ynxq\odng.lex
[%SYSTEM%]\00005119.DAT
[%SYSTEM%]\ad_2234.exe
[%SYSTEM%]\Albus.DAT
[%SYSTEM%]\albus.dll
[%SYSTEM%]\almms.dat
[%SYSTEM%]\alpst.dat
[%SYSTEM%]\alsmt.exe
[%SYSTEM%]\alstd.dat
[%SYSTEM%]\drivers\00005119.SYS
[%SYSTEM%]\drivers\00006397.SYS
[%SYSTEM%]\drivers\Albus.SYS
[%SYSTEM%]\drivers\iExplorer.exe
[%SYSTEM%]\std.ini
[%SYSTEM%]\stdact.ini
[%SYSTEM%]\stdd.ini
[%SYSTEM%]\stdplay.dll
[%SYSTEM%]\stdstub.dll
[%SYSTEM%]\STDSVER.DLL
[%SYSTEM%]\stdup.dll
[%SYSTEM%]\stdup.uni
[%SYSTEM%]\stdupnet.dll
[%SYSTEM%]\stdvote.dll
[%SYSTEM%]\updadini.ini
[%SYSTEM%]\updstdex.ini
[%SYSTEM%]\updstdup.ini
[%WINDOWS%]\Delrixing.bat
[%WINDOWS%]\Delskynet.bat
[%WINDOWS%]\Help\winmail.chm
[%RECENT%]\working.lnk
[%PROFILE%]\Recent\Albus.lnk
[%PROFILE%]\Recent\working.lnk
[%PROFILE_TEMP%]\13_386.exe
[%PROFILE_TEMP%]\DecFile.exe
[%PROFILE_TEMP%]\mms_661.exe
[%PROGRAM_FILES%]\vision\almms.dat
[%PROGRAM_FILES%]\vision\alvsn.dll
[%PROGRAM_FILES%]\vision\updateex.ini
[%PROGRAM_FILES%]\vision\updvsnex.ini
[%PROGRAM_FILES%]\vision\vision.dll
[%PROGRAM_FILES%]\vision\vision.ini
[%PROGRAM_FILES%]\vision\visver.dll
[%PROGRAM_FILES%]\ynxq\crbu.ini
[%PROGRAM_FILES%]\ynxq\etdw.dll
[%PROGRAM_FILES%]\ynxq\odng.lex
[%SYSTEM%]\00005119.DAT
[%SYSTEM%]\ad_2234.exe
[%SYSTEM%]\Albus.DAT
[%SYSTEM%]\albus.dll
[%SYSTEM%]\almms.dat
[%SYSTEM%]\alpst.dat
[%SYSTEM%]\alsmt.exe
[%SYSTEM%]\alstd.dat
[%SYSTEM%]\drivers\00005119.SYS
[%SYSTEM%]\drivers\00006397.SYS
[%SYSTEM%]\drivers\Albus.SYS
[%SYSTEM%]\drivers\iExplorer.exe
[%SYSTEM%]\std.ini
[%SYSTEM%]\stdact.ini
[%SYSTEM%]\stdd.ini
[%SYSTEM%]\stdplay.dll
[%SYSTEM%]\stdstub.dll
[%SYSTEM%]\STDSVER.DLL
[%SYSTEM%]\stdup.dll
[%SYSTEM%]\stdup.uni
[%SYSTEM%]\stdupnet.dll
[%SYSTEM%]\stdvote.dll
[%SYSTEM%]\updadini.ini
[%SYSTEM%]\updstdex.ini
[%SYSTEM%]\updstdup.ini
[%WINDOWS%]\Delrixing.bat
[%WINDOWS%]\Delskynet.bat
[%WINDOWS%]\Help\winmail.chm

How to detect Borlan:

Files:
[%RECENT%]\working.lnk
[%PROFILE%]\Recent\Albus.lnk
[%PROFILE%]\Recent\working.lnk
[%PROFILE_TEMP%]\13_386.exe
[%PROFILE_TEMP%]\DecFile.exe
[%PROFILE_TEMP%]\mms_661.exe
[%PROGRAM_FILES%]\vision\almms.dat
[%PROGRAM_FILES%]\vision\alvsn.dll
[%PROGRAM_FILES%]\vision\updateex.ini
[%PROGRAM_FILES%]\vision\updvsnex.ini
[%PROGRAM_FILES%]\vision\vision.dll
[%PROGRAM_FILES%]\vision\vision.ini
[%PROGRAM_FILES%]\vision\visver.dll
[%PROGRAM_FILES%]\ynxq\crbu.ini
[%PROGRAM_FILES%]\ynxq\etdw.dll
[%PROGRAM_FILES%]\ynxq\odng.lex
[%SYSTEM%]\00005119.DAT
[%SYSTEM%]\ad_2234.exe
[%SYSTEM%]\Albus.DAT
[%SYSTEM%]\albus.dll
[%SYSTEM%]\almms.dat
[%SYSTEM%]\alpst.dat
[%SYSTEM%]\alsmt.exe
[%SYSTEM%]\alstd.dat
[%SYSTEM%]\drivers\00005119.SYS
[%SYSTEM%]\drivers\00006397.SYS
[%SYSTEM%]\drivers\Albus.SYS
[%SYSTEM%]\drivers\iExplorer.exe
[%SYSTEM%]\std.ini
[%SYSTEM%]\stdact.ini
[%SYSTEM%]\stdd.ini
[%SYSTEM%]\stdplay.dll
[%SYSTEM%]\stdstub.dll
[%SYSTEM%]\STDSVER.DLL
[%SYSTEM%]\stdup.dll
[%SYSTEM%]\stdup.uni
[%SYSTEM%]\stdupnet.dll
[%SYSTEM%]\stdvote.dll
[%SYSTEM%]\updadini.ini
[%SYSTEM%]\updstdex.ini
[%SYSTEM%]\updstdup.ini
[%WINDOWS%]\Delrixing.bat
[%WINDOWS%]\Delskynet.bat
[%WINDOWS%]\Help\winmail.chm
[%RECENT%]\working.lnk
[%PROFILE%]\Recent\Albus.lnk
[%PROFILE%]\Recent\working.lnk
[%PROFILE_TEMP%]\13_386.exe
[%PROFILE_TEMP%]\DecFile.exe
[%PROFILE_TEMP%]\mms_661.exe
[%PROGRAM_FILES%]\vision\almms.dat
[%PROGRAM_FILES%]\vision\alvsn.dll
[%PROGRAM_FILES%]\vision\updateex.ini
[%PROGRAM_FILES%]\vision\updvsnex.ini
[%PROGRAM_FILES%]\vision\vision.dll
[%PROGRAM_FILES%]\vision\vision.ini
[%PROGRAM_FILES%]\vision\visver.dll
[%PROGRAM_FILES%]\ynxq\crbu.ini
[%PROGRAM_FILES%]\ynxq\etdw.dll
[%PROGRAM_FILES%]\ynxq\odng.lex
[%SYSTEM%]\00005119.DAT
[%SYSTEM%]\ad_2234.exe
[%SYSTEM%]\Albus.DAT
[%SYSTEM%]\albus.dll
[%SYSTEM%]\almms.dat
[%SYSTEM%]\alpst.dat
[%SYSTEM%]\alsmt.exe
[%SYSTEM%]\alstd.dat
[%SYSTEM%]\drivers\00005119.SYS
[%SYSTEM%]\drivers\00006397.SYS
[%SYSTEM%]\drivers\Albus.SYS
[%SYSTEM%]\drivers\iExplorer.exe
[%SYSTEM%]\std.ini
[%SYSTEM%]\stdact.ini
[%SYSTEM%]\stdd.ini
[%SYSTEM%]\stdplay.dll
[%SYSTEM%]\stdstub.dll
[%SYSTEM%]\STDSVER.DLL
[%SYSTEM%]\stdup.dll
[%SYSTEM%]\stdup.uni
[%SYSTEM%]\stdupnet.dll
[%SYSTEM%]\stdvote.dll
[%SYSTEM%]\updadini.ini
[%SYSTEM%]\updstdex.ini
[%SYSTEM%]\updstdup.ini
[%WINDOWS%]\Delrixing.bat
[%WINDOWS%]\Delskynet.bat
[%WINDOWS%]\Help\winmail.chm

Folders:
[%PROGRAM_FILES%]\mmsassist
[%PROGRAM_FILES%]\snbr
[%PROGRAM_FILES%]\sswv
[%PROGRAM_FILES%]\vision\updvsn
[%PROGRAM_FILES%]\vision\updvsnex
[%PROGRAM_FILES_COMMON%]\snbr
[%SYSTEM%]\stdcache
[%SYSTEM%]\updadini
[%SYSTEM%]\updstdex
[%SYSTEM%]\updstdup
[%WINDOWS%]\Temp\adgug
[%WINDOWS%]\Temp\inspstb
[%WINDOWS%]\Temp\insshell
[%WINDOWS%]\Temp\invison
[%WINDOWS%]\webwork
[%WINDOWS%]\wincup

Registry Keys:
HKEY_CURRENT_USER\software\rfo
HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\legacy_albus
HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\legacy_winwrcup
HKEY_CLASSES_ROOT\ad.axobj
HKEY_CLASSES_ROOT\ad.axobj.1
HKEY_CLASSES_ROOT\clsid\{0d24de39-9061-4377-881b-ee7b8af81c86}
HKEY_CLASSES_ROOT\clsid\{1978f4be-8d76-42cf-90bd-288ece576296}
HKEY_CLASSES_ROOT\clsid\{1fb890bf-76ff-46c5-848b-e3a11e1af06c}
HKEY_CLASSES_ROOT\clsid\{46d4ba6d-2d37-429e-b4b8-64c543dda7a2}
HKEY_CLASSES_ROOT\clsid\{4c611512-2c1d-44b2-a044-872ad2ad5a61}
HKEY_CLASSES_ROOT\clsid\{535fabd5-adfb-4dba-846e-8d022863089a}
HKEY_CLASSES_ROOT\clsid\{64223f78-e086-4fc0-97dd-d5f3f77928e7}
HKEY_CLASSES_ROOT\clsid\{6671a431-5c3d-463d-a7cf-5587f9b7e191}
HKEY_CLASSES_ROOT\clsid\{6671a432-5c3d-463d-a7cf-5587f9b7e191}
HKEY_CLASSES_ROOT\clsid\{6a512bf7-ec78-4e8d-9841-6c02e8fa9838}
HKEY_CLASSES_ROOT\clsid\{7117fb5e-7571-48e7-a9b0-5288412fe996}
HKEY_CLASSES_ROOT\clsid\{766c79d4-d442-41eb-880d-b0001cdf535e}
HKEY_CLASSES_ROOT\clsid\{8c592122-eacb-4c07-9c91-19974c7555f9}
HKEY_CLASSES_ROOT\clsid\{98ad3238-a23a-421a-8e0b-4bae8194ace8}
HKEY_CLASSES_ROOT\clsid\{98d3c58a-ea4d-4d7f-b03a-20e4bd03d8f6}
HKEY_CLASSES_ROOT\clsid\{9b220093-61bf-4aa6-aa0e-493c3ef2af27}
HKEY_CLASSES_ROOT\clsid\{ee658ba1-5ca4-4081-8934-a12ec93952ea}
HKEY_CLASSES_ROOT\clsid\{f15673f9-78f3-4ee8-b0d7-19575e37624a}
HKEY_CLASSES_ROOT\fbdf84372483f7693f63ff
HKEY_CLASSES_ROOT\insii.brins
HKEY_CLASSES_ROOT\interface\{74289a79-e652-4a57-a6b9-ee64ad532a8d}
HKEY_CLASSES_ROOT\interface\{74289a7a-e652-4a57-a6b9-ee64ad532a8d}
HKEY_CLASSES_ROOT\interface\{ab45ce36-c280-4525-bcf9-1bd01d3e4b57}
HKEY_CLASSES_ROOT\kfwjho.kfwjssist
HKEY_CLASSES_ROOT\kfwjho.kfwjssist.1
HKEY_CLASSES_ROOT\kfwjho.kfwjssistmenu
HKEY_CLASSES_ROOT\kfwjho.kfwjssistmenu.1
HKEY_CLASSES_ROOT\kuoqho.kuoqssist
HKEY_CLASSES_ROOT\kuoqho.kuoqssist.1
HKEY_CLASSES_ROOT\kuoqho.kuoqssistmenu
HKEY_CLASSES_ROOT\kuoqho.kuoqssistmenu.1
HKEY_CLASSES_ROOT\mmsbho.mmsassist
HKEY_CLASSES_ROOT\mmsbho.mmsassist.1
HKEY_CLASSES_ROOT\mmsbho.mmsassistmenu
HKEY_CLASSES_ROOT\mmsbho.mmsassistmenu.1
HKEY_CLASSES_ROOT\typelib\{077525ac-c681-4139-8c3e-b582bdd375c7}
HKEY_CLASSES_ROOT\typelib\{22f87d75-7dd1-4545-94b3-ca80c0f462c6}
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\ext\stats\{6a512bf7-ec78-4e8d-9841-6c02e8fa9838}
HKEY_LOCAL_MACHINE\software\fpjl
HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\extensions\{6671a433-5c3d-463d-a7cf-5587f9b7e191}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{0d24de39-9061-4377-881b-ee7b8af81c86}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{1fb890bf-76ff-46c5-848b-e3a11e1af06c}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{64223f78-e086-4fc0-97dd-d5f3f77928e7}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{6671a431-5c3d-463d-a7cf-5587f9b7e191}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{6a512bf7-ec78-4e8d-9841-6c02e8fa9838}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{766c79d4-d442-41eb-880d-b0001cdf535e}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{98d3c58a-ea4d-4d7f-b03a-20e4bd03d8f6}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{aaeba2c3-e5d5-413f-8a3f-ffe15e431853}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{ee658ba1-5ca4-4081-8934-a12ec93952ea}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{f15673f9-78f3-4ee8-b0d7-19575e37624a}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\mmsassist
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\mwqs
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\vision communicate
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\webwork
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\winwrcup
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{0c5c8e9a-48ba-4d26-aa01-2e1d4dc14718}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{6a512bf7-ec78-4e8d-9841-6c02e8fa9838}
HKEY_LOCAL_MACHINE\software\mmsassist
HKEY_LOCAL_MACHINE\software\stdup
HKEY_LOCAL_MACHINE\system\controlset001\services\stdservice
HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\legacy_jmediaservice
HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\legacy_mhvl
HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\legacy_mwqs
HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\legacy_stdservice
HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\legacy_stdupnet
HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\legacy_visionservice
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\albus
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\jmediaservice
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\mhvl
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\mwqs
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\stdservice
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\stdupnet
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\visionservice
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\winwrcup

Registry Values:
HKEY_CLASSES_ROOT\clsid\{3f264c6c-7a80-44c6-b1ff-e8b4da4d1e9f}\inprocserver32
HKEY_CLASSES_ROOT\clsid\{aaeba2c3-e5d5-413f-8a3f-ffe15e431853}\inprocserver32
HKEY_CURRENT_USER\software\microsoft\internet explorer\extensions\cmdmapping
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonce
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\mhvl
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\mhvl

Removing Borlan:

You can download trial version of "Exterminate-It" antivirus software here, to check your computer instantly.

Or buy it to remove ALL viruses from your computer.

---

Also Be Aware of the Following Threats:
Remove Husrtdo Trojan
Remove Win32.VB.OA.110592!Trojan Trojan
Removing Coreflood.DLL.Troja Trojan

Baigoo Adware

Removing Baigoo
Categories: Adware,Hijacker
Adware are programs that facilitate delivery for advertising content
to the user and in some cases gather information from the user's computer,
including information related to Internet browser usage or other computer habits
When the default home page is hijacked, the browser opens to the web page set by the hijacker
instead of the user's designated home page. In some cases, the hijacker may block users from
restoring their desired home page.

---

Baigoo Also known as:

[Kaspersky]AdWare.Win32.Baigoo.a;
[Other]W32/BHO.H!tr.dldr,Win32/Adware.Toolbar.Baigoo application

---

Visible Symptoms:
Files in system folders:
[%SYSTEM%]\rv40.dll
[%SYSTEM%]\bg50.exe
[%SYSTEM%]\rv40.dll
[%SYSTEM%]\bg50.exe

How to detect Baigoo:

Files:
[%SYSTEM%]\rv40.dll
[%SYSTEM%]\bg50.exe
[%SYSTEM%]\rv40.dll
[%SYSTEM%]\bg50.exe

Folders:
[%PROGRAM_FILES%]\baigoo

Registry Keys:
HKEY_CLASSES_ROOT\appid\{40ef7ccc-71fe-4615-a0ca-d373f8c2ac88}
HKEY_CLASSES_ROOT\bgoobho.status
HKEY_CLASSES_ROOT\bgoobho.status.1
HKEY_CLASSES_ROOT\bgoosrv.htmlpaser
HKEY_CLASSES_ROOT\bgoosrv.htmlpaser.1
HKEY_CLASSES_ROOT\clsid\{18439a22-67a7-4a82-abb6-82977555ac9b}
HKEY_CLASSES_ROOT\interface\{0bfd5815-6072-41d8-bca5-7768ed97a079}
HKEY_CLASSES_ROOT\interface\{32cfa498-08be-4bb7-b362-85ee3bed4617}
HKEY_CLASSES_ROOT\interface\{5cd25f44-7f74-432d-aa30-4031fe28c326}
HKEY_CLASSES_ROOT\typelib\{6b01a4af-1ab1-47fe-bf1b-1d1583d2b2c0}
HKEY_CLASSES_ROOT\baigooex.update
HKEY_CLASSES_ROOT\baigooex.update.1
HKEY_CLASSES_ROOT\baigoopm.bhohelper
HKEY_CLASSES_ROOT\baigoopm.bhohelper.1
HKEY_CLASSES_ROOT\baigoopm.browserobject
HKEY_CLASSES_ROOT\baigoopm.browserobject.1
HKEY_CLASSES_ROOT\clsid\{7905958a-18c2-4139-9957-ae6f2b754818}
HKEY_CLASSES_ROOT\clsid\{7bdaf75a-0d6f-4f50-afe9-333d08df4005}
HKEY_CLASSES_ROOT\clsid\{808eaf87-61b8-4eea-8b85-27480d1bdbee}
HKEY_CLASSES_ROOT\clsid\{8816ea7a-5944-4277-b98e-2c0a46fb36e9}
HKEY_CLASSES_ROOT\interface\{427263c1-fe45-4ef7-8765-318395f7d795}
HKEY_CLASSES_ROOT\interface\{73d898cc-32ae-4c08-a4ba-2142fccdb9ce}
HKEY_CLASSES_ROOT\interface\{a20b50fb-d4b9-4637-83db-72253a2e3d53}
HKEY_CLASSES_ROOT\typelib\{9dc44a38-b772-47f8-a406-054f842ec7c5}
HKEY_CURRENT_USER\software\baigoo
HKEY_LOCAL_MACHINE\software\baigoo
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{7bdaf75a-0d6f-4f50-afe9-333d08df4005}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{8465d755-afe0-40ef-bc5e-2290d2c1f31f}

Registry Values:
HKEY_CLASSES_ROOT\appid\mtsrv.exe
HKEY_CLASSES_ROOT\appid\mtsrv.exe
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonce
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonce
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonce
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonce
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonce
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{6c893032-1e26-4409-ba26-ed6c6007dca6}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{6c893032-1e26-4409-ba26-ed6c6007dca6}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{6c893032-1e26-4409-ba26-ed6c6007dca6}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{6c893032-1e26-4409-ba26-ed6c6007dca6}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{6c893032-1e26-4409-ba26-ed6c6007dca6}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{6c893032-1e26-4409-ba26-ed6c6007dca6}

Removing Baigoo:

You can download trial version of "Exterminate-It" antivirus software here, to check your computer instantly.

Or buy it to remove ALL viruses from your computer.

---

Also Be Aware of the Following Threats:
Dowque.ABK Trojan Removal
Kazaalite.GratisDownloads Adware Removal instruction