XtraTank Trojan

Removing XtraTank
Categories: Trojan
This category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

---

XtraTank Also known as:

[Kaspersky]Trojan.Xtratank;
[F-Prot]destructive program;
[Panda]Trj/Xtratank;
[Computer Associates]Xtratank!Trojan

---

Visible Symptoms:
Files in system folders:
[%DESKTOP%]\ipscan.exe
[%DESKTOP%]\ipscan.exe

How to detect XtraTank:

Files:
[%DESKTOP%]\ipscan.exe
[%DESKTOP%]\ipscan.exe

Registry Keys:
HKEY_CURRENT_USER\software\angryziber

Removing XtraTank:

You can download trial version of "Exterminate-It" antivirus software here, to check your computer instantly.

Or buy it to remove ALL viruses from your computer.

---

Also Be Aware of the Following Threats:
Surveiller.Common.Components Spyware Information
Remove Mostrar Adware
Removing Applets Trojan
SillyDl.CTQ Trojan Information
Removing Arcvvir Trojan

Perfips Trojan

Removing Perfips
Categories: Trojan
This category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

---

Perfips Also known as:

[Kaspersky]Trojan-Proxy.win32.Agent.gj;
[Other]Win32/Perfips.J

---

Visible Symptoms:
Files in system folders:
[%SYSTEM%]\perflibs__
[%SYSTEM%]\winserv.dat
[%SYSTEM%]\winserv.dll
[%SYSTEM%]\winserv.ini
[%SYSTEM%]\winserv32.dll
[%SYSTEM%]\perflibs__
[%SYSTEM%]\winserv.dat
[%SYSTEM%]\winserv.dll
[%SYSTEM%]\winserv.ini
[%SYSTEM%]\winserv32.dll

How to detect Perfips:

Files:
[%SYSTEM%]\perflibs__
[%SYSTEM%]\winserv.dat
[%SYSTEM%]\winserv.dll
[%SYSTEM%]\winserv.ini
[%SYSTEM%]\winserv32.dll
[%SYSTEM%]\perflibs__
[%SYSTEM%]\winserv.dat
[%SYSTEM%]\winserv.dll
[%SYSTEM%]\winserv.ini
[%SYSTEM%]\winserv32.dll

Removing Perfips:

You can download trial version of "Exterminate-It" antivirus software here, to check your computer instantly.

Or buy it to remove ALL viruses from your computer.

---

Also Be Aware of the Following Threats:
Yeam Trojan Cleaner
Remove TightVNC RAT
Remove Pigeon.EEW Trojan

SpyBlast Adware

Removing SpyBlast
Categories: Adware
Adware are programs that facilitate delivery for advertising content
to the user and in some cases gather information from the user's computer,
including information related to Internet browser usage or other computer habits

How to detect SpyBlast:

Folders:
[%PROGRAM_FILES%]\spyblast

Registry Keys:
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{e6d5237d-a6c7-4c83-a67f-f9f15586fa62}

Registry Values:
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run

Removing SpyBlast:

You can download trial version of "Exterminate-It" antivirus software here, to check your computer instantly.

Or buy it to remove ALL viruses from your computer.

---

Also Be Aware of the Following Threats:
Remove QuestionMarket.com Tracking Cookie
ImIServer.IEPlugin Adware Cleaner
SentryPC Spyware Symptoms

PWS.Iyus Trojan

Removing PWS.Iyus
Categories: Trojan,Backdoor,Hacker Tool
This loose category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

Multi-purpose Trojans are also included in this group, as some virus writers
create multi-functional Trojans rather than Trojan packs.
Backdoors are the most dangerous type of Trojans and the most popular.
Backdoors open infected machines to external control via Internet.
They function in the same way as legal remote administration programs used by system administrators.
This makes them difficult to detect.

Backdoors are installed and launched without the consent of the user of computer.
Often the backdoor will not be visible in the log of active programs.

Once a backdoor has been successfully launched, the computer is wide open.
Backdoor functions can include:

• Launching/ deleting files


• Sending/ receiving files


• Deleting data


• Displaying notification


• Rebooting the machine


• Executing files

Backdoors are used by virus writers to detect and download confidential information,
execute malicious code, destroy data, include the machine in bot networks and so forth.
Backdoors combine the functionality of most other types of in one package.

Backdoors have one especially dangerous sub-class: variants that can propagate like worms.
Exploits use vulnerabilities in operating systems and applications to achieve the same result.

---

PWS.Iyus Also known as:

[Computer Associates]Win32/PWS.Iyus.Dropper,Win32/PWS.Iyus.Trojan

---

Visible Symptoms:
Files in system folders:
[%PROFILE_TEMP%]\edpdbheajpjf.exe
[%PROFILE_TEMP%]\feinbmabdqoh.exe
[%PROFILE_TEMP%]\fmeoojnofbjn.exe
[%PROFILE_TEMP%]\inpqihidkjkf.exe
[%PROFILE_TEMP%]\kckpgoobphfg.exe
[%PROFILE_TEMP%]\ohfnchbfdpob.exe
[%PROFILE_TEMP%]\ojieggnmakpe.exe
[%PROFILE_TEMP%]\ppdakbdpocon.exe
[%SYSTEM%]\iyus\hkhackpn.exe
[%PROFILE_TEMP%]\edpdbheajpjf.exe
[%PROFILE_TEMP%]\feinbmabdqoh.exe
[%PROFILE_TEMP%]\fmeoojnofbjn.exe
[%PROFILE_TEMP%]\inpqihidkjkf.exe
[%PROFILE_TEMP%]\kckpgoobphfg.exe
[%PROFILE_TEMP%]\ohfnchbfdpob.exe
[%PROFILE_TEMP%]\ojieggnmakpe.exe
[%PROFILE_TEMP%]\ppdakbdpocon.exe
[%SYSTEM%]\iyus\hkhackpn.exe

How to detect PWS.Iyus:

Files:
[%PROFILE_TEMP%]\edpdbheajpjf.exe
[%PROFILE_TEMP%]\feinbmabdqoh.exe
[%PROFILE_TEMP%]\fmeoojnofbjn.exe
[%PROFILE_TEMP%]\inpqihidkjkf.exe
[%PROFILE_TEMP%]\kckpgoobphfg.exe
[%PROFILE_TEMP%]\ohfnchbfdpob.exe
[%PROFILE_TEMP%]\ojieggnmakpe.exe
[%PROFILE_TEMP%]\ppdakbdpocon.exe
[%SYSTEM%]\iyus\hkhackpn.exe
[%PROFILE_TEMP%]\edpdbheajpjf.exe
[%PROFILE_TEMP%]\feinbmabdqoh.exe
[%PROFILE_TEMP%]\fmeoojnofbjn.exe
[%PROFILE_TEMP%]\inpqihidkjkf.exe
[%PROFILE_TEMP%]\kckpgoobphfg.exe
[%PROFILE_TEMP%]\ohfnchbfdpob.exe
[%PROFILE_TEMP%]\ojieggnmakpe.exe
[%PROFILE_TEMP%]\ppdakbdpocon.exe
[%SYSTEM%]\iyus\hkhackpn.exe

Removing PWS.Iyus:

You can download trial version of "Exterminate-It" antivirus software here, to check your computer instantly.

Or buy it to remove ALL viruses from your computer.

---

Also Be Aware of the Following Threats:
Removing Comodo.Trust BHO
FastSearch Toolbar Information
TribuneInteractive Tracking Cookie Symptoms
Desktop.Personal Spyware Information
Tool.AVExp Trojan Cleaner

LinkReplacer Trojan

Removing LinkReplacer
Categories: Trojan,BHO
This category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.
As this information is entered by the user, it is captured by the BHO (Browser Helper Object) and
sent back to the attacker.
Typically, keyloggers of this type will send the stolen information back to the attacker via email
or HTTP POST, which can appear suspicious.

---

LinkReplacer Also known as:

[Computer Associates]Win32/LinkReplacer.A!Trojan,Win32.LinkReplacer

How to detect LinkReplacer:

Registry Keys:
HKEY_CLASSES_ROOT\CLSID\{4E7BD74F-2B8D-469E-DCF7-F96DA086B434}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4E7BD74F-2B8D-469E-DCF7-F96DA086B434}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6A6E50DC-BFA8-4B40-AB1B-159E03E829FD}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\hyperlinker
HKEY_CLASSES_ROOT\clsid\{4e7bd74f-2b8d-469e-dcf7-f96da086b434}
HKEY_CLASSES_ROOT\clsid\{66993893-61b8-47dc-b10d-21e0c86dd9c8}
HKEY_CLASSES_ROOT\instafin.instafin
HKEY_CLASSES_ROOT\software\microsoft\windows\currentversion\explorer\browser helper objects\{66993893-61b8-47dc-b10d-21e0c86dd9c8}
HKEY_CLASSES_ROOT\typelib\{66993893-61b8-47dc-b10d-21e0c86dd9c8}
HKEY_LOCAL_MACHINE\software\classes\clsid\{66993893-61b8-47dc-b10d-21e0c86dd9c8}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{4e7bd74f-2b8d-469e-dcf7-f96da086b434}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{66993893-61b8-47dc-b10d-21e0c86dd9c8}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{6a6e50dc-bfa8-4b40-ab1b-159e03e829fd}

Removing LinkReplacer:

You can download trial version of "Exterminate-It" antivirus software here, to check your computer instantly.

Or buy it to remove ALL viruses from your computer.

---

Also Be Aware of the Following Threats:
CodeZero BHO Information
Remove HLLP.Venta Trojan
SecondPower.Multimedia.Speedbar BHO Removal instruction
Removing MegaToolbar BHO
Abetear Trojan Removal instruction

Storark Trojan

Removing Storark
Categories: Trojan
This loose category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

Multi-purpose Trojans are also included in this group, as some virus writers
create multi-functional Trojans rather than Trojan packs.

---

Storark Also known as:

[Kaspersky]Trojan-Spy.Win32.Delf.uv,Trojan-PSW.Win32.OnLineGames.aqn,Trojan-PSW.Win32.OnLineGames.dfs,Trojan-Spy.Win32.Delf.bci,Trojan-PSW.Win32.OnLineGames.dgw,Trojan-Spy.Win32.Delf.aji,Trojan-PSW.Win32.OnLineGames.dsj,Trojan-PSW.Win32.OnLineGames.deg,Trojan-PSW:Win32.OnLineGames.fwv,Trojan-PSW.Win32.OnLineGames.fqm,Trojan-PSW.Win32.OnLineGames.dzp,Trojan-PSW.Win32.OnLineGames.fyp,Trojan-PSW.Win32.OnLineGames.ggn,Trojan-PSW.Win32.OnLineGames.enm,Trojan-PSW.Win32.OnLineGames.giv,Trojan-PWS.Win32.OnLineGames.ggm,Trojan-PSW.Win32.OnLineGames.get,Trojan-PSW.Win32.OnLineGames.fpx,Trojan-PSW.Win32.OnLineGames.fqb,Trojan-PSW.Win32.OnLineGames.fef,Trojan-PSW.Win32.OnLineGames.fpw,Trojan-PSW.Win32o.OnLineGames.ebw,Trojan-Dropper.Win32.Mudrop.fg,Trojan-PSW.Win32.OnLineGames.eax,Trojan-PSW.Win32.OnLineGames.eav,Trojan-PSW.Win32.OnLineGames.dzq,Trojan-PSW.Win32.OnLineGames.hxg,Trojan-PSW.Win32.OnLineGames.hsy;
[McAfee]PWS-OnlineGames.f,PWS-OnlineGames.a.dll,PWS-OnlineGames.i,New Malware.n,New malware.n,PWS-OnlineGames.k.dll;
[Other]Win32/Storark.C,Win32/Storark.AR,Infostealer.Gampass,Win32/Storark.AS,Win32/Storark.AT,Win32/Storark.AU,Infostealer.Gamepass,Win32/Storark.AV,Infostealer.Menghuan,Win32.Storark.AW,Win32/Storark.BB,Win32/Storark,Win32/Storark.BV,Trojan:Win32/Delf.AT!dll,Win32/Storark.BW,Win32/Storark.BX,TSPY_ONLINEG.IRZ,Mal/Delagen-A,Win32/Storark.BZ,W32/Malware.AVHG,Win32/Storark.CA,Win32/Storark!generic,Trojan:Win32/SystemHijack.gen,W32/Malware,Mal/Behav-152,Win32/Storark.CC,W32/OnLineGames.PLZ,W32/OnLineGames.QCZ,TSPY_ONLINEG.LKC,Win32/Storark.CK,W32/Delf.AYBJ,Win32/Storark.CU,W32/Malare.BCGX,Win32/Storark.CW,Trojan:Win32.Delf.AT!dll,W32/Malware.BCFF,W32/Malware.BBNR,Win32/Storark.CT,W32/Malware.BCFW,Win32/Storark.CN,W32/Malware.AZKA,W32/Malware.BCMD,Win32/Storark.CD,W32/Malware.AZEH,TSPY_ONLINEG.IUX,Win32/Storark.CG,W32/Malware.AZDV,Win32/Storark.CI,W32/Malware.AYNM,OnLineGames.gen34,W32/OnLineGames.VBH

---

Visible Symptoms:
Files in system folders:
[%SYSTEM%]\avzxain.dll
[%SYSTEM%]\htzmf.log
[%SYSTEM%]\kapjacs.dll
[%SYSTEM%]\kawdacs.dll
[%SYSTEM%]\kawdbzy.dll
[%SYSTEM%]\kvdxacf.dll
[%SYSTEM%]\lktgy.txt
[%SYSTEM%]\raqjani.dll
[%SYSTEM%]\rsjzafg.dll
[%SYSTEM%]\rsmyafg.dll
[%WINDOWS%]\knnte.txt
[%WINDOWS%]\nbqdq.txt
[%SYSTEM%]\avwlain.dll
[%SYSTEM%]\avwlamn.dll
[%SYSTEM%]\avwlast.exe
[%SYSTEM%]\avwldin.dll
[%SYSTEM%]\avwldmn.dll
[%SYSTEM%]\avwldst.exe
[%SYSTEM%]\avzxamn.dll
[%SYSTEM%]\avzxast.exe
[%SYSTEM%]\avzxein.dll
[%SYSTEM%]\avzxemn.dll
[%SYSTEM%]\avzxest.exe
[%SYSTEM%]\caomsnima.dll
[%SYSTEM%]\dhdini.dll
[%SYSTEM%]\dheins.exe
[%SYSTEM%]\dhepri.dll
[%SYSTEM%]\kapjaaz.exe
[%SYSTEM%]\kapjazy.dll
[%SYSTEM%]\kapjdaz.exe
[%SYSTEM%]\kapjdcs.dll
[%SYSTEM%]\kapjdzy.dll
[%SYSTEM%]\kaqhacs.dll
[%SYSTEM%]\kaqhcaz.exe
[%SYSTEM%]\kaqhczy.dll
[%SYSTEM%]\kaqhgaz.exe
[%SYSTEM%]\kaqhgcs.dll
[%SYSTEM%]\kaqhgzy.dll
[%SYSTEM%]\kawdbaz.exe
[%SYSTEM%]\kawdcaz.exe
[%SYSTEM%]\kawdccs.dll
[%SYSTEM%]\kawdczy.dll
[%SYSTEM%]\kvdxbis.exe
[%SYSTEM%]\kvdxbma.dll
[%SYSTEM%]\kvdxgcf.dll
[%SYSTEM%]\kvdxgis.exe
[%SYSTEM%]\kvdxgma.dll
[%SYSTEM%]\kvdxsacf.dll
[%SYSTEM%]\kvdxsais.exe
[%SYSTEM%]\kvdxsama.dll
[%SYSTEM%]\kvdxsfcf.dll
[%SYSTEM%]\kvdxsfis.exe
[%SYSTEM%]\kvdxsfma.dll
[%SYSTEM%]\kvmxfcf.dll
[%SYSTEM%]\kvmxfis.exe
[%SYSTEM%]\kvmxfma.dll
[%SYSTEM%]\mxbcfg.dll
[%SYSTEM%]\mxbman.dll
[%SYSTEM%]\mxbset.exe
[%SYSTEM%]\mygini.dll
[%SYSTEM%]\myhins.exe
[%SYSTEM%]\myhpri.dll
[%SYSTEM%]\qjgpri.dll
[%SYSTEM%]\raqjapi.dll
[%SYSTEM%]\raqjatl.exe
[%SYSTEM%]\rarjani.dll
[%SYSTEM%]\rarjbpi.dll
[%SYSTEM%]\rarjbtl.exe
[%SYSTEM%]\ratbani.dll
[%SYSTEM%]\ratbfpi.dll
[%SYSTEM%]\ratbftl.exe
[%SYSTEM%]\rsjzapm.dll
[%SYSTEM%]\rsjzasp.exe
[%SYSTEM%]\rsmyapm.dll
[%SYSTEM%]\rsmyasp.exe
[%SYSTEM%]\rsmyepm.dll
[%SYSTEM%]\rsmyesp.exe
[%SYSTEM%]\rsmyfpm.dll
[%SYSTEM%]\rsmyfsp.exe
[%SYSTEM%]\rsmygfg.dll
[%SYSTEM%]\rsmygpm.dll
[%SYSTEM%]\rsmygsp.exe
[%SYSTEM%]\rsztffg.dll
[%SYSTEM%]\rsztfpm.dll
[%SYSTEM%]\rsztfsp.exe
[%SYSTEM%]\sidjbaz.exe
[%SYSTEM%]\sidjbcs.dll
[%SYSTEM%]\sidjbzy.dll
[%SYSTEM%]\sqmapi32.dll
[%SYSTEM%]\wggini.dll
[%SYSTEM%]\wggins.exe
[%SYSTEM%]\wggpri.dll
[%SYSTEM%]\wlgini.dll
[%SYSTEM%]\wlhins.exe
[%SYSTEM%]\wlhpri.dll
[%SYSTEM%]\avzxain.dll
[%SYSTEM%]\htzmf.log
[%SYSTEM%]\kapjacs.dll
[%SYSTEM%]\kawdacs.dll
[%SYSTEM%]\kawdbzy.dll
[%SYSTEM%]\kvdxacf.dll
[%SYSTEM%]\lktgy.txt
[%SYSTEM%]\raqjani.dll
[%SYSTEM%]\rsjzafg.dll
[%SYSTEM%]\rsmyafg.dll
[%WINDOWS%]\knnte.txt
[%WINDOWS%]\nbqdq.txt
[%SYSTEM%]\avwlain.dll
[%SYSTEM%]\avwlamn.dll
[%SYSTEM%]\avwlast.exe
[%SYSTEM%]\avwldin.dll
[%SYSTEM%]\avwldmn.dll
[%SYSTEM%]\avwldst.exe
[%SYSTEM%]\avzxamn.dll
[%SYSTEM%]\avzxast.exe
[%SYSTEM%]\avzxein.dll
[%SYSTEM%]\avzxemn.dll
[%SYSTEM%]\avzxest.exe
[%SYSTEM%]\caomsnima.dll
[%SYSTEM%]\dhdini.dll
[%SYSTEM%]\dheins.exe
[%SYSTEM%]\dhepri.dll
[%SYSTEM%]\kapjaaz.exe
[%SYSTEM%]\kapjazy.dll
[%SYSTEM%]\kapjdaz.exe
[%SYSTEM%]\kapjdcs.dll
[%SYSTEM%]\kapjdzy.dll
[%SYSTEM%]\kaqhacs.dll
[%SYSTEM%]\kaqhcaz.exe
[%SYSTEM%]\kaqhczy.dll
[%SYSTEM%]\kaqhgaz.exe
[%SYSTEM%]\kaqhgcs.dll
[%SYSTEM%]\kaqhgzy.dll
[%SYSTEM%]\kawdbaz.exe
[%SYSTEM%]\kawdcaz.exe
[%SYSTEM%]\kawdccs.dll
[%SYSTEM%]\kawdczy.dll
[%SYSTEM%]\kvdxbis.exe
[%SYSTEM%]\kvdxbma.dll
[%SYSTEM%]\kvdxgcf.dll
[%SYSTEM%]\kvdxgis.exe
[%SYSTEM%]\kvdxgma.dll
[%SYSTEM%]\kvdxsacf.dll
[%SYSTEM%]\kvdxsais.exe
[%SYSTEM%]\kvdxsama.dll
[%SYSTEM%]\kvdxsfcf.dll
[%SYSTEM%]\kvdxsfis.exe
[%SYSTEM%]\kvdxsfma.dll
[%SYSTEM%]\kvmxfcf.dll
[%SYSTEM%]\kvmxfis.exe
[%SYSTEM%]\kvmxfma.dll
[%SYSTEM%]\mxbcfg.dll
[%SYSTEM%]\mxbman.dll
[%SYSTEM%]\mxbset.exe
[%SYSTEM%]\mygini.dll
[%SYSTEM%]\myhins.exe
[%SYSTEM%]\myhpri.dll
[%SYSTEM%]\qjgpri.dll
[%SYSTEM%]\raqjapi.dll
[%SYSTEM%]\raqjatl.exe
[%SYSTEM%]\rarjani.dll
[%SYSTEM%]\rarjbpi.dll
[%SYSTEM%]\rarjbtl.exe
[%SYSTEM%]\ratbani.dll
[%SYSTEM%]\ratbfpi.dll
[%SYSTEM%]\ratbftl.exe
[%SYSTEM%]\rsjzapm.dll
[%SYSTEM%]\rsjzasp.exe
[%SYSTEM%]\rsmyapm.dll
[%SYSTEM%]\rsmyasp.exe
[%SYSTEM%]\rsmyepm.dll
[%SYSTEM%]\rsmyesp.exe
[%SYSTEM%]\rsmyfpm.dll
[%SYSTEM%]\rsmyfsp.exe
[%SYSTEM%]\rsmygfg.dll
[%SYSTEM%]\rsmygpm.dll
[%SYSTEM%]\rsmygsp.exe
[%SYSTEM%]\rsztffg.dll
[%SYSTEM%]\rsztfpm.dll
[%SYSTEM%]\rsztfsp.exe
[%SYSTEM%]\sidjbaz.exe
[%SYSTEM%]\sidjbcs.dll
[%SYSTEM%]\sidjbzy.dll
[%SYSTEM%]\sqmapi32.dll
[%SYSTEM%]\wggini.dll
[%SYSTEM%]\wggins.exe
[%SYSTEM%]\wggpri.dll
[%SYSTEM%]\wlgini.dll
[%SYSTEM%]\wlhins.exe
[%SYSTEM%]\wlhpri.dll

How to detect Storark:

Files:
[%SYSTEM%]\avzxain.dll
[%SYSTEM%]\htzmf.log
[%SYSTEM%]\kapjacs.dll
[%SYSTEM%]\kawdacs.dll
[%SYSTEM%]\kawdbzy.dll
[%SYSTEM%]\kvdxacf.dll
[%SYSTEM%]\lktgy.txt
[%SYSTEM%]\raqjani.dll
[%SYSTEM%]\rsjzafg.dll
[%SYSTEM%]\rsmyafg.dll
[%WINDOWS%]\knnte.txt
[%WINDOWS%]\nbqdq.txt
[%SYSTEM%]\avwlain.dll
[%SYSTEM%]\avwlamn.dll
[%SYSTEM%]\avwlast.exe
[%SYSTEM%]\avwldin.dll
[%SYSTEM%]\avwldmn.dll
[%SYSTEM%]\avwldst.exe
[%SYSTEM%]\avzxamn.dll
[%SYSTEM%]\avzxast.exe
[%SYSTEM%]\avzxein.dll
[%SYSTEM%]\avzxemn.dll
[%SYSTEM%]\avzxest.exe
[%SYSTEM%]\caomsnima.dll
[%SYSTEM%]\dhdini.dll
[%SYSTEM%]\dheins.exe
[%SYSTEM%]\dhepri.dll
[%SYSTEM%]\kapjaaz.exe
[%SYSTEM%]\kapjazy.dll
[%SYSTEM%]\kapjdaz.exe
[%SYSTEM%]\kapjdcs.dll
[%SYSTEM%]\kapjdzy.dll
[%SYSTEM%]\kaqhacs.dll
[%SYSTEM%]\kaqhcaz.exe
[%SYSTEM%]\kaqhczy.dll
[%SYSTEM%]\kaqhgaz.exe
[%SYSTEM%]\kaqhgcs.dll
[%SYSTEM%]\kaqhgzy.dll
[%SYSTEM%]\kawdbaz.exe
[%SYSTEM%]\kawdcaz.exe
[%SYSTEM%]\kawdccs.dll
[%SYSTEM%]\kawdczy.dll
[%SYSTEM%]\kvdxbis.exe
[%SYSTEM%]\kvdxbma.dll
[%SYSTEM%]\kvdxgcf.dll
[%SYSTEM%]\kvdxgis.exe
[%SYSTEM%]\kvdxgma.dll
[%SYSTEM%]\kvdxsacf.dll
[%SYSTEM%]\kvdxsais.exe
[%SYSTEM%]\kvdxsama.dll
[%SYSTEM%]\kvdxsfcf.dll
[%SYSTEM%]\kvdxsfis.exe
[%SYSTEM%]\kvdxsfma.dll
[%SYSTEM%]\kvmxfcf.dll
[%SYSTEM%]\kvmxfis.exe
[%SYSTEM%]\kvmxfma.dll
[%SYSTEM%]\mxbcfg.dll
[%SYSTEM%]\mxbman.dll
[%SYSTEM%]\mxbset.exe
[%SYSTEM%]\mygini.dll
[%SYSTEM%]\myhins.exe
[%SYSTEM%]\myhpri.dll
[%SYSTEM%]\qjgpri.dll
[%SYSTEM%]\raqjapi.dll
[%SYSTEM%]\raqjatl.exe
[%SYSTEM%]\rarjani.dll
[%SYSTEM%]\rarjbpi.dll
[%SYSTEM%]\rarjbtl.exe
[%SYSTEM%]\ratbani.dll
[%SYSTEM%]\ratbfpi.dll
[%SYSTEM%]\ratbftl.exe
[%SYSTEM%]\rsjzapm.dll
[%SYSTEM%]\rsjzasp.exe
[%SYSTEM%]\rsmyapm.dll
[%SYSTEM%]\rsmyasp.exe
[%SYSTEM%]\rsmyepm.dll
[%SYSTEM%]\rsmyesp.exe
[%SYSTEM%]\rsmyfpm.dll
[%SYSTEM%]\rsmyfsp.exe
[%SYSTEM%]\rsmygfg.dll
[%SYSTEM%]\rsmygpm.dll
[%SYSTEM%]\rsmygsp.exe
[%SYSTEM%]\rsztffg.dll
[%SYSTEM%]\rsztfpm.dll
[%SYSTEM%]\rsztfsp.exe
[%SYSTEM%]\sidjbaz.exe
[%SYSTEM%]\sidjbcs.dll
[%SYSTEM%]\sidjbzy.dll
[%SYSTEM%]\sqmapi32.dll
[%SYSTEM%]\wggini.dll
[%SYSTEM%]\wggins.exe
[%SYSTEM%]\wggpri.dll
[%SYSTEM%]\wlgini.dll
[%SYSTEM%]\wlhins.exe
[%SYSTEM%]\wlhpri.dll
[%SYSTEM%]\avzxain.dll
[%SYSTEM%]\htzmf.log
[%SYSTEM%]\kapjacs.dll
[%SYSTEM%]\kawdacs.dll
[%SYSTEM%]\kawdbzy.dll
[%SYSTEM%]\kvdxacf.dll
[%SYSTEM%]\lktgy.txt
[%SYSTEM%]\raqjani.dll
[%SYSTEM%]\rsjzafg.dll
[%SYSTEM%]\rsmyafg.dll
[%WINDOWS%]\knnte.txt
[%WINDOWS%]\nbqdq.txt
[%SYSTEM%]\avwlain.dll
[%SYSTEM%]\avwlamn.dll
[%SYSTEM%]\avwlast.exe
[%SYSTEM%]\avwldin.dll
[%SYSTEM%]\avwldmn.dll
[%SYSTEM%]\avwldst.exe
[%SYSTEM%]\avzxamn.dll
[%SYSTEM%]\avzxast.exe
[%SYSTEM%]\avzxein.dll
[%SYSTEM%]\avzxemn.dll
[%SYSTEM%]\avzxest.exe
[%SYSTEM%]\caomsnima.dll
[%SYSTEM%]\dhdini.dll
[%SYSTEM%]\dheins.exe
[%SYSTEM%]\dhepri.dll
[%SYSTEM%]\kapjaaz.exe
[%SYSTEM%]\kapjazy.dll
[%SYSTEM%]\kapjdaz.exe
[%SYSTEM%]\kapjdcs.dll
[%SYSTEM%]\kapjdzy.dll
[%SYSTEM%]\kaqhacs.dll
[%SYSTEM%]\kaqhcaz.exe
[%SYSTEM%]\kaqhczy.dll
[%SYSTEM%]\kaqhgaz.exe
[%SYSTEM%]\kaqhgcs.dll
[%SYSTEM%]\kaqhgzy.dll
[%SYSTEM%]\kawdbaz.exe
[%SYSTEM%]\kawdcaz.exe
[%SYSTEM%]\kawdccs.dll
[%SYSTEM%]\kawdczy.dll
[%SYSTEM%]\kvdxbis.exe
[%SYSTEM%]\kvdxbma.dll
[%SYSTEM%]\kvdxgcf.dll
[%SYSTEM%]\kvdxgis.exe
[%SYSTEM%]\kvdxgma.dll
[%SYSTEM%]\kvdxsacf.dll
[%SYSTEM%]\kvdxsais.exe
[%SYSTEM%]\kvdxsama.dll
[%SYSTEM%]\kvdxsfcf.dll
[%SYSTEM%]\kvdxsfis.exe
[%SYSTEM%]\kvdxsfma.dll
[%SYSTEM%]\kvmxfcf.dll
[%SYSTEM%]\kvmxfis.exe
[%SYSTEM%]\kvmxfma.dll
[%SYSTEM%]\mxbcfg.dll
[%SYSTEM%]\mxbman.dll
[%SYSTEM%]\mxbset.exe
[%SYSTEM%]\mygini.dll
[%SYSTEM%]\myhins.exe
[%SYSTEM%]\myhpri.dll
[%SYSTEM%]\qjgpri.dll
[%SYSTEM%]\raqjapi.dll
[%SYSTEM%]\raqjatl.exe
[%SYSTEM%]\rarjani.dll
[%SYSTEM%]\rarjbpi.dll
[%SYSTEM%]\rarjbtl.exe
[%SYSTEM%]\ratbani.dll
[%SYSTEM%]\ratbfpi.dll
[%SYSTEM%]\ratbftl.exe
[%SYSTEM%]\rsjzapm.dll
[%SYSTEM%]\rsjzasp.exe
[%SYSTEM%]\rsmyapm.dll
[%SYSTEM%]\rsmyasp.exe
[%SYSTEM%]\rsmyepm.dll
[%SYSTEM%]\rsmyesp.exe
[%SYSTEM%]\rsmyfpm.dll
[%SYSTEM%]\rsmyfsp.exe
[%SYSTEM%]\rsmygfg.dll
[%SYSTEM%]\rsmygpm.dll
[%SYSTEM%]\rsmygsp.exe
[%SYSTEM%]\rsztffg.dll
[%SYSTEM%]\rsztfpm.dll
[%SYSTEM%]\rsztfsp.exe
[%SYSTEM%]\sidjbaz.exe
[%SYSTEM%]\sidjbcs.dll
[%SYSTEM%]\sidjbzy.dll
[%SYSTEM%]\sqmapi32.dll
[%SYSTEM%]\wggini.dll
[%SYSTEM%]\wggins.exe
[%SYSTEM%]\wggpri.dll
[%SYSTEM%]\wlgini.dll
[%SYSTEM%]\wlhins.exe
[%SYSTEM%]\wlhpri.dll

Registry Keys:
HKEY_CLASSES_ROOT\clsid\{28907901-1416-3389-9981-372178569982}
HKEY_CLASSES_ROOT\clsid\{e3a77057-d10b-b02a-d823-22e020c583b5}
HKEY_CLASSES_ROOT\clsid\{12faacde-34da-ccd4-ab4d-da34485a3421}
HKEY_CLASSES_ROOT\clsid\{131ab311-16f1-f13b-1e43-11a24b51afd1}
HKEY_CLASSES_ROOT\clsid\{14783410-4f90-34a0-7820-3230acd05f41}
HKEY_CLASSES_ROOT\clsid\{1859245f-345d-bc13-ac4f-145d47da34f1}
HKEY_CLASSES_ROOT\clsid\{18847374-8323-fadc-b443-4732abcd3781}
HKEY_CLASSES_ROOT\clsid\{1960356a-458e-de24-bd50-268f589a56a1}
HKEY_CLASSES_ROOT\clsid\{1a321487-4977-d98a-c8d5-6488257545a1}
HKEY_CLASSES_ROOT\clsid\{1d561258-45f3-a451-f908-a258458226d1}
HKEY_CLASSES_ROOT\clsid\{1e32fa58-3453-fa2d-bc49-f340348acce1}
HKEY_CLASSES_ROOT\clsid\{2231a43a-1642-641a-64fd-146adab223b2}
HKEY_CLASSES_ROOT\clsid\{22faacde-34da-ccd4-ab4d-da34485a3422}
HKEY_CLASSES_ROOT\clsid\{24783410-4f90-34a0-7820-3230acd05f42}
HKEY_CLASSES_ROOT\clsid\{2598ff45-da60-f48a-bc43-10ac47853d52}
HKEY_CLASSES_ROOT\clsid\{28847374-8323-fadc-b443-4732abcd3782}
HKEY_CLASSES_ROOT\clsid\{2960356a-458e-de24-bd50-268f589a56a2}
HKEY_CLASSES_ROOT\clsid\{2a321487-4977-d98a-c8d5-6488257545a2}
HKEY_CLASSES_ROOT\clsid\{2c87a354-abc3-dede-ff33-3213fd7447c2}
HKEY_CLASSES_ROOT\clsid\{37d81718-1314-5200-2597-587901018073}
HKEY_CLASSES_ROOT\clsid\{38907901-1416-3389-9981-372178569983}
HKEY_CLASSES_ROOT\clsid\{3960356a-458e-de24-bd50-268f589a56a3}
HKEY_CLASSES_ROOT\clsid\{3c87a354-abc3-dede-ff33-3213fd7447c3}
HKEY_CLASSES_ROOT\clsid\{3d561258-45f3-a451-f908-a258458226d3}
HKEY_CLASSES_ROOT\clsid\{434345f1-dacf-3452-cb7d-4620f34a1534}
HKEY_CLASSES_ROOT\clsid\{4960356a-458e-de24-bd50-268f589a56a4}
HKEY_CLASSES_ROOT\clsid\{4a321487-4977-d98a-c8d5-6488257545a4}
HKEY_CLASSES_ROOT\clsid\{5182c1eb-375c-573d-1f5e-234552345215}
HKEY_CLASSES_ROOT\clsid\{52311a42-ac1b-158f-fd32-5674345f23a5}
HKEY_CLASSES_ROOT\clsid\{5859245f-345d-bc13-ac4f-145d47da34f5}
HKEY_CLASSES_ROOT\clsid\{5bd41097-3693-4133-820e-fdac57af00e2}
HKEY_CLASSES_ROOT\clsid\{5c87a354-abc3-dede-ff33-3213fd7447c5}
HKEY_CLASSES_ROOT\clsid\{5e32fa58-3453-fa2d-bc49-f340348acce5}
HKEY_CLASSES_ROOT\clsid\{634345f1-dacf-3452-cb7d-4620f34a1536}
HKEY_CLASSES_ROOT\clsid\{66650011-3344-6688-4899-345fabcd1566}
HKEY_CLASSES_ROOT\clsid\{6d47b341-43df-4563-753f-345ffa3157d6}
HKEY_CLASSES_ROOT\clsid\{6d561258-45f3-a451-f908-a258458226d6}
HKEY_CLASSES_ROOT\clsid\{6e32fa58-3453-fa2d-bc49-f340348acce6}
HKEY_CLASSES_ROOT\clsid\{725ab2f3-234a-7469-2f43-e341713abfa7}
HKEY_CLASSES_ROOT\clsid\{74123ff1-8371-9834-9021-184518451fa7}
HKEY_CLASSES_ROOT\clsid\{77d81718-1314-5200-2597-587901018077}
HKEY_CLASSES_ROOT\clsid\{7c87a354-abc3-dede-ff33-3213fd7447c7}
HKEY_CLASSES_ROOT\clsid\{7e32fa58-3453-fa2d-bc49-f340348acce7}
HKEY_CLASSES_ROOT\clsid\{8562452f-fa36-ba4f-892a-ff5fbbac5318}

Registry Values:
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows\appinit_dlls
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run

Removing Storark:

You can download trial version of "Exterminate-It" antivirus software here, to check your computer instantly.

Or buy it to remove ALL viruses from your computer.

---

Also Be Aware of the Following Threats:
Removing KD Adware
Removing BackDoor.CYL Trojan

Agent.AWW Trojan

Removing Agent.AWW
Categories: Trojan,Downloader
This category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.
The downloader either launches the new malware or registers it to enable autorun
according to the local operating system requirements.

---

Agent.AWW Also known as:

[Kaspersky]Trojan-Downloader.Win32.Agent.aww;
[McAfee]Generic Downloader.q

---

Visible Symptoms:
Files in system folders:
[%PROFILE_TEMP%]\sna.exe
[%SYSTEM%]\sholl32.dll
[%PROFILE_TEMP%]\sna.exe
[%SYSTEM%]\sholl32.dll

How to detect Agent.AWW:

Files:
[%PROFILE_TEMP%]\sna.exe
[%SYSTEM%]\sholl32.dll
[%PROFILE_TEMP%]\sna.exe
[%SYSTEM%]\sholl32.dll

Removing Agent.AWW:

You can download trial version of "Exterminate-It" antivirus software here, to check your computer instantly.

Or buy it to remove ALL viruses from your computer.

---

Also Be Aware of the Following Threats:
Remove Starware BHO
Dluca Trojan Removal
RemotanZ.Clone Backdoor Cleaner

Seckof Trojan

Removing Seckof
Categories: Trojan
This loose category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

Multi-purpose Trojans are also included in this group, as some virus writers
create multi-functional Trojans rather than Trojan packs.

---

Seckof Also known as:

[Other]Win32/Seckof,Win32/Seckof.C,Win32/Seckof.E

---

Visible Symptoms:
Files in system folders:
[%SYSTEM%]\963329495.exe
[%SYSTEM%]\sysc.exe
[%WINDOWS%]\batserv2.exe
[%SYSTEM%]\963329495.exe
[%SYSTEM%]\sysc.exe
[%WINDOWS%]\batserv2.exe

How to detect Seckof:

Files:
[%SYSTEM%]\963329495.exe
[%SYSTEM%]\sysc.exe
[%WINDOWS%]\batserv2.exe
[%SYSTEM%]\963329495.exe
[%SYSTEM%]\sysc.exe
[%WINDOWS%]\batserv2.exe

Registry Values:
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run

Removing Seckof:

You can download trial version of "Exterminate-It" antivirus software here, to check your computer instantly.

Or buy it to remove ALL viruses from your computer.

---

Also Be Aware of the Following Threats:
Zserv Trojan Information

Agent.AWB Trojan

Removing Agent.AWB
Categories: Trojan,Adware,Downloader
This category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.
Adware are programs that facilitate delivery for advertising content
to the user and in some cases gather information from the user's computer.

The downloader either launches the new malware or registers it to enable autorun
according to the local operating system requirements.

---

Agent.AWB Also known as:

[Kaspersky]Trojan-Downloader.Win32.Small.dts;
[Other]W32/Downloader.BJSH,Downloader,Trojan.Dropper.Agent.AWB

---

Visible Symptoms:
Files in system folders:
[%PROGRAM_FILES_COMMON%]\ODBC\OB.exe
[%WINDOWS%]\realupdate.exe
[%PROGRAM_FILES_COMMON%]\ODBC\OB.exe
[%WINDOWS%]\realupdate.exe

How to detect Agent.AWB:

Files:
[%PROGRAM_FILES_COMMON%]\ODBC\OB.exe
[%WINDOWS%]\realupdate.exe
[%PROGRAM_FILES_COMMON%]\ODBC\OB.exe
[%WINDOWS%]\realupdate.exe

Folders:
[%SYSTEM%]\{pchome}

Registry Keys:
HKEY_CLASSES_ROOT\clsid\{b8a170a8-7ad3-4678-b2fe-f2d7381cc1b5}
HKEY_CLASSES_ROOT\clsid\{de7c3cf0-4b15-11d1-abed-709549c10000}
HKEY_CLASSES_ROOT\interface\{de7c3cef-4b15-11d1-abed-709549c10000}
HKEY_CLASSES_ROOT\typelib\{de7c3ce2-4b15-11d1-abed-709549c10000}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{de7c3cf0-4b15-11d1-abed-709549c10000}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\.setupd

Registry Values:
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\run
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run

Removing Agent.AWB:

You can download trial version of "Exterminate-It" antivirus software here, to check your computer instantly.

Or buy it to remove ALL viruses from your computer.

---

Also Be Aware of the Following Threats:
Shinwow Trojan Cleaner
Removing Remote.Control Backdoor
Removing BearShare Worm
Avclose Trojan Removal

Fishdown Trojan

Removing Fishdown
Categories: Trojan,Downloader
This loose category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

Multi-purpose Trojans are also included in this group, as some virus writers
create multi-functional Trojans rather than Trojan packs.
This family of Trojans downloads and installs new malware or adware on the computer.
The downloader then either launches the new malware or registers it to enable autorun
according to the local operating system requirements.

The names and locations of malware to be downloaded are either coded into the
Trojan or downloaded from a specified website.

---

Fishdown Also known as:

[Kaspersky]Trojan-Downloader.Win32.Vb.awj,Trojan-Downloader.Win32.Vb.bgd,Trojan-Downloader.Win32.VB.bnq,Trojan-Dropper.Win32.FriJoiner.bg;
[F-Prot]W32/Pws.XZC (exact);
[Other]Win32/SillyDl.DGC,TrojanDownloader.Win32/VB.AAF,TrojanDownloader:Win32/VB.AAF,W32/DLoader.DWPY,Troj/Dloadr-BDY,Trojan Horse,Malware.BGLA,Mal/Generic-A

---

Visible Symptoms:
Files in system folders:
[%APPDATA%]\NetMon\domains.txt
[%APPDATA%]\NetMon\log.txt
[%SYSTEM%]\e2\caws83122.exe
[%SYSTEM%]\i8\taldrvr11.exe
[%SYSTEM%]\pac.txt
[%SYSTEM%]\x22\c124wvr.exe
[%WINDOWS%]\mrofinu1000106.exe
[%APPDATA%]\NetMon\domains.txt
[%APPDATA%]\NetMon\log.txt
[%SYSTEM%]\e2\caws83122.exe
[%SYSTEM%]\i8\taldrvr11.exe
[%SYSTEM%]\pac.txt
[%SYSTEM%]\x22\c124wvr.exe
[%WINDOWS%]\mrofinu1000106.exe

How to detect Fishdown:

Files:
[%APPDATA%]\NetMon\domains.txt
[%APPDATA%]\NetMon\log.txt
[%SYSTEM%]\e2\caws83122.exe
[%SYSTEM%]\i8\taldrvr11.exe
[%SYSTEM%]\pac.txt
[%SYSTEM%]\x22\c124wvr.exe
[%WINDOWS%]\mrofinu1000106.exe
[%APPDATA%]\NetMon\domains.txt
[%APPDATA%]\NetMon\log.txt
[%SYSTEM%]\e2\caws83122.exe
[%SYSTEM%]\i8\taldrvr11.exe
[%SYSTEM%]\pac.txt
[%SYSTEM%]\x22\c124wvr.exe
[%WINDOWS%]\mrofinu1000106.exe

Folders:
[%SYSTEM%]\oTt11e

Registry Values:
HKEY_CURRENT_USER\software\microsoft\windows\shellnoroam\muicache
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows

Removing Fishdown:

You can download trial version of "Exterminate-It" antivirus software here, to check your computer instantly.

Or buy it to remove ALL viruses from your computer.

---

Also Be Aware of the Following Threats:
Remove Trojan.Proxy.Win32.Lager.aq Trojan
CrocoPop Adware Cleaner
Eclipse Backdoor Cleaner
SpyHeal Trojan Removal
Ticmion Trojan Cleaner

Small.jf Trojan

Removing Small.jf
Categories: Trojan,Downloader
This loose category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

Multi-purpose Trojans are also included in this group, as some virus writers
create multi-functional Trojans rather than Trojan packs.
Trojans-downloaders downloads and installs new malware or adware on the computer.

---

Visible Symptoms:
Files in system folders:
[%WINDOWS%]\dh.ini
[%WINDOWS%]\DHU.exe
[%WINDOWS%]\dh.dll
[%WINDOWS%]\dh.ini
[%WINDOWS%]\DHU.exe
[%WINDOWS%]\dh.dll

How to detect Small.jf:

Files:
[%WINDOWS%]\dh.ini
[%WINDOWS%]\DHU.exe
[%WINDOWS%]\dh.dll
[%WINDOWS%]\dh.ini
[%WINDOWS%]\DHU.exe
[%WINDOWS%]\dh.dll

Registry Keys:
HKEY_CLASSES_ROOT\clsid\{6001cdf7-6f45-471b-a203-0225615e35a7}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{6001cdf7-6f45-471b-a203-0225615e35a7}

Removing Small.jf:

You can download trial version of "Exterminate-It" antivirus software here, to check your computer instantly.

Or buy it to remove ALL viruses from your computer.

---

Also Be Aware of the Following Threats:
ClipGenie Adware Symptoms
Zlob.Fam.Internet Explorer Secure Plug-in Trojan Information
Search.Exe Adware Removal
Illusion Trojan Information
Remove Beyond.telecom Adware

Messenger.Detect Spyware

Removing Messenger.Detect
Categories: Spyware
Spyware is computer software that is installed surreptitiously on a personal computer
to intercept or take partial control over the user's interaction
with the computer, without the user's informed consent.

While the term spyware suggests software that secretly monitors the user's behavior,
the functions of spyware extend well beyond simple monitoring.

Spyware programs can collect various types of personal information,
such as Internet surfing habit, sites that have been visited,
but can also interfere with user control of the computer in other ways,
such as installing additional software, redirecting Web browser activity,
accessing websites blindly that will cause more harmful viruses,
or diverting advertising revenue to a third party.

Spyware can even change computer settings, resulting in slow connection speeds,
different home pages, and loss of Internet or other programs.
In an attempt to increase the understanding of spyware, a more formal classification
of its included software types is captured under the term privacy-invasive software.

---

Visible Symptoms:
Files in system folders:
[%PROFILE%]\Recent\License Agreement - Messenger Detect.txt.lnk
[%PROFILE%]\Recent\Messenger Detect.lnk
[%PROFILE%]\Recent\License Agreement - Messenger Detect.txt.lnk
[%PROFILE%]\Recent\Messenger Detect.lnk

How to detect Messenger.Detect:

Files:
[%PROFILE%]\Recent\License Agreement - Messenger Detect.txt.lnk
[%PROFILE%]\Recent\Messenger Detect.lnk
[%PROFILE%]\Recent\License Agreement - Messenger Detect.txt.lnk
[%PROFILE%]\Recent\Messenger Detect.lnk

Folders:
[%PROGRAM_FILES%]\Messenger Detect
[%PROGRAMS%]\Messenger Detect

Registry Keys:
HKEY_LOCAL_MACHINE\software\digital river\softwarepassport\foryoursoft.com\messenger detect
HKEY_LOCAL_MACHINE\software\messenger detect
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\messenger detect

Removing Messenger.Detect:

You can download trial version of "Exterminate-It" antivirus software here, to check your computer instantly.

Or buy it to remove ALL viruses from your computer.

---

Also Be Aware of the Following Threats:
StorageProtector Ransomware Removal
Removing Infinaeon Backdoor
Pigeon.AVPV Trojan Cleaner

180Solutions Trojan

Removing 180Solutions
Categories: Trojan,Adware,Downloader
This category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.
Adware are programs that facilitate delivery for advertising content
to the user and in some cases gather information from the user's computer.

Trojans-downloaders downloads and installs new malware or adware on the computer.

---

180Solutions Also known as:

[Kaspersky]TrojanDownloader.Win32.IstBar.j,TrojanDownloader.Win32.Small.wj,TrojanDropper.Win32.Small.mr;
[Panda]Adware/AdLogix,Adware/nCase,Spyware/ISTbar

---

Visible Symptoms:
Files in system folders:
[%PROFILE_TEMP%]\msbb_gdf.dat
[%PROFILE_TEMP%]\temp.fr????\zango_gdf.dat
[%PROFILE_TEMP%]\temp.fr????\zango_kyf.dat
[%PROGRAM_FILES%]\180search Assistant Programs\180search Toolbar\180STUninstaller.exe
[%SYSTEM%]\ihquhtcl.exe
[%SYSTEM%]\irkkpury.exe
[%SYSTEM%]\saie_gdf.dat
[%SYSTEM%]\sain_gdf.dat
[%WINDOWS%]\180ax_gdf.dat
[%WINDOWS%]\didduid.ini
[%WINDOWS%]\msbb_gdf.dat
[%WINDOWS%]\saap_gdf.dat
[%WINDOWS%]\salm_gdf.dat
[%DESKTOP%]\installres.dll
[%PROFILE%]\Recent\installres.dll.lnk
[%PROFILE%]\recent\salm.log.lnk
[%PROFILE_TEMP%]\msbb.exe
[%WINDOWS%]\adg.exe
[%WINDOWS%]\avghalsb.exe
[%WINDOWS%]\cjqxe.exe
[%WINDOWS%]\downloaded program files\conflict.1\ncaseinstaller.dll
[%WINDOWS%]\downloaded program files\conflict.1\ncaselib.dll
[%WINDOWS%]\downloaded program files\ncaselib.dll
[%WINDOWS%]\knuzql.exe
[%WINDOWS%]\qhutst.exe
[%WINDOWS%]\vabctqp.exe
[%PROFILE_TEMP%]\msbb_gdf.dat
[%PROFILE_TEMP%]\temp.fr????\zango_gdf.dat
[%PROFILE_TEMP%]\temp.fr????\zango_kyf.dat
[%PROGRAM_FILES%]\180search Assistant Programs\180search Toolbar\180STUninstaller.exe
[%SYSTEM%]\ihquhtcl.exe
[%SYSTEM%]\irkkpury.exe
[%SYSTEM%]\saie_gdf.dat
[%SYSTEM%]\sain_gdf.dat
[%WINDOWS%]\180ax_gdf.dat
[%WINDOWS%]\didduid.ini
[%WINDOWS%]\msbb_gdf.dat
[%WINDOWS%]\saap_gdf.dat
[%WINDOWS%]\salm_gdf.dat
[%DESKTOP%]\installres.dll
[%PROFILE%]\Recent\installres.dll.lnk
[%PROFILE%]\recent\salm.log.lnk
[%PROFILE_TEMP%]\msbb.exe
[%WINDOWS%]\adg.exe
[%WINDOWS%]\avghalsb.exe
[%WINDOWS%]\cjqxe.exe
[%WINDOWS%]\downloaded program files\conflict.1\ncaseinstaller.dll
[%WINDOWS%]\downloaded program files\conflict.1\ncaselib.dll
[%WINDOWS%]\downloaded program files\ncaselib.dll
[%WINDOWS%]\knuzql.exe
[%WINDOWS%]\qhutst.exe
[%WINDOWS%]\vabctqp.exe

How to detect 180Solutions:

Files:
[%PROFILE_TEMP%]\msbb_gdf.dat
[%PROFILE_TEMP%]\temp.fr????\zango_gdf.dat
[%PROFILE_TEMP%]\temp.fr????\zango_kyf.dat
[%PROGRAM_FILES%]\180search Assistant Programs\180search Toolbar\180STUninstaller.exe
[%SYSTEM%]\ihquhtcl.exe
[%SYSTEM%]\irkkpury.exe
[%SYSTEM%]\saie_gdf.dat
[%SYSTEM%]\sain_gdf.dat
[%WINDOWS%]\180ax_gdf.dat
[%WINDOWS%]\didduid.ini
[%WINDOWS%]\msbb_gdf.dat
[%WINDOWS%]\saap_gdf.dat
[%WINDOWS%]\salm_gdf.dat
[%DESKTOP%]\installres.dll
[%PROFILE%]\Recent\installres.dll.lnk
[%PROFILE%]\recent\salm.log.lnk
[%PROFILE_TEMP%]\msbb.exe
[%WINDOWS%]\adg.exe
[%WINDOWS%]\avghalsb.exe
[%WINDOWS%]\cjqxe.exe
[%WINDOWS%]\downloaded program files\conflict.1\ncaseinstaller.dll
[%WINDOWS%]\downloaded program files\conflict.1\ncaselib.dll
[%WINDOWS%]\downloaded program files\ncaselib.dll
[%WINDOWS%]\knuzql.exe
[%WINDOWS%]\qhutst.exe
[%WINDOWS%]\vabctqp.exe
[%PROFILE_TEMP%]\msbb_gdf.dat
[%PROFILE_TEMP%]\temp.fr????\zango_gdf.dat
[%PROFILE_TEMP%]\temp.fr????\zango_kyf.dat
[%PROGRAM_FILES%]\180search Assistant Programs\180search Toolbar\180STUninstaller.exe
[%SYSTEM%]\ihquhtcl.exe
[%SYSTEM%]\irkkpury.exe
[%SYSTEM%]\saie_gdf.dat
[%SYSTEM%]\sain_gdf.dat
[%WINDOWS%]\180ax_gdf.dat
[%WINDOWS%]\didduid.ini
[%WINDOWS%]\msbb_gdf.dat
[%WINDOWS%]\saap_gdf.dat
[%WINDOWS%]\salm_gdf.dat
[%DESKTOP%]\installres.dll
[%PROFILE%]\Recent\installres.dll.lnk
[%PROFILE%]\recent\salm.log.lnk
[%PROFILE_TEMP%]\msbb.exe
[%WINDOWS%]\adg.exe
[%WINDOWS%]\avghalsb.exe
[%WINDOWS%]\cjqxe.exe
[%WINDOWS%]\downloaded program files\conflict.1\ncaseinstaller.dll
[%WINDOWS%]\downloaded program files\conflict.1\ncaselib.dll
[%WINDOWS%]\downloaded program files\ncaselib.dll
[%WINDOWS%]\knuzql.exe
[%WINDOWS%]\qhutst.exe
[%WINDOWS%]\vabctqp.exe

Folders:
[%PROGRAM_FILES%]\180search assistant programs

Registry Keys:
HKEY_CURRENT_USER\software\180solutions
HKEY_CURRENT_USER\software\saie
HKEY_CURRENT_USER\software\salm
HKEY_LOCAL_MACHINE\software\180solutions
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app management\arpcache\ncase
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\moduleusage\c:\windows\downloaded program files\ncaselib.dll
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\180search toolbar
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\salm
HKEY_LOCAL_MACHINE\software\salm
HKEY_CLASSES_ROOT\interface\{8dd50c56-8a07-40b9-98c4-3f169e3ae28e}
HKEY_LOCAL_MACHINE\software\iefeatures
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\moduleusage\[%WINDOWS%]\downloaded program files\conflict.1\ncaseinstaller.dll
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\moduleusage\[%WINDOWS%]\downloaded program files\conflict.1\ncaselib.dll
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\moduleusage\[%WINDOWS%]\downloaded program files\ncaselib.dll
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\msbb
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\ncase

Registry Values:
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shareddlls
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shareddlls
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shareddlls
HKEY_LOCAL_MACHINE\software\motoin
HKEY_LOCAL_MACHINE\software\motoin

Removing 180Solutions:

You can download trial version of "Exterminate-It" antivirus software here, to check your computer instantly.

Or buy it to remove ALL viruses from your computer.

---

Also Be Aware of the Following Threats:
Glieder Trojan Removal
Vxidl.ASS Trojan Information
Banbra.bh Spyware Removal

Director Adware

Removing Director
Categories: Adware
Adware are programs that facilitate delivery for advertising content
to the user and in some cases gather information from the user's computer.

How to detect Director:

Folders:
[%PROGRAM_FILES%]\webhost

Registry Keys:
HKEY_CURRENT_USER\software\director

Removing Director:

You can download trial version of "Exterminate-It" antivirus software here, to check your computer instantly.

Or buy it to remove ALL viruses from your computer.

---

Also Be Aware of the Following Threats:
Downconf Trojan Information

Win32.DennurBot!Trojan Backdoor

Removing Win32.DennurBot!Trojan
Categories: Backdoor
Backdoors are the most dangerous type of Trojans and the most popular.
Backdoors open infected machines to external control via Internet.
They function in the same way as legal remote administration programs used by system administrators.
This makes them difficult to detect.

Backdoors are installed and launched without the consent of the user of computer.
Often the backdoor will not be visible in the log of active programs.

Once a backdoor has been successfully launched, the computer is wide open.
Backdoor functions can include:

• Launching/ deleting files


• Sending/ receiving files


• Deleting data


• Displaying notification


• Rebooting the machine


• Executing files

Backdoors are used by virus writers to detect and download confidential information,
execute malicious code, destroy data, include the machine in bot networks and so forth.
Backdoors combine the functionality of most other types of in one package.

Backdoors have one especially dangerous sub-class: variants that can propagate like worms.

---

Win32.DennurBot!Trojan Also known as:

[Kaspersky]Backdoor.Delf.bk;
[F-Prot]security risk or a "backdoor" program;
[Panda]Backdoor Program;
[Computer Associates]Win32.DennurBot

How to detect Win32.DennurBot!Trojan:

Registry Values:
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run

Removing Win32.DennurBot!Trojan:

You can download trial version of "Exterminate-It" antivirus software here, to check your computer instantly.

Or buy it to remove ALL viruses from your computer.

---

Also Be Aware of the Following Threats:
OneClickNetSearch Trojan Cleaner
smartlog.ru Tracking Cookie Cleaner
W95.CIH.src Trojan Symptoms

WurldMedia BHO

Removing WurldMedia
Categories: BHO,Hijacker
As this information is entered by the user, it is captured by the BHO (Browser Helper Object) and
sent back to the attacker.
Typically, keyloggers of this type will send the stolen information back to the attacker via email
or HTTP POST, which can appear suspicious.A Search hijacker redirects search results to other pages and may
transmit search and browsing data to unknown servers. An error page hijacker directs
the browser to another page, usually an advertising page, instead of the usual error
page when the requested URL is not found.

---

Visible Symptoms:
Files in system folders:
[%SYSTEM%]\m030106shop.dll
[%SYSTEM%]\m030206pohs.dll
[%SYSTEM%]\mdefshop.dll
[%SYSTEM%]\uohiw.dll
[%WINDOWS%]\system\m030106shop.dll
[%WINDOWS%]\system\m030206pohs.dll
[%WINDOWS%]\system\mbho.dll
[%WINDOWS%]\system\mdefshop.dll
[%SYSTEM%]\m030106shop.dll
[%SYSTEM%]\m030206pohs.dll
[%SYSTEM%]\mdefshop.dll
[%SYSTEM%]\uohiw.dll
[%WINDOWS%]\system\m030106shop.dll
[%WINDOWS%]\system\m030206pohs.dll
[%WINDOWS%]\system\mbho.dll
[%WINDOWS%]\system\mdefshop.dll

How to detect WurldMedia:

Files:
[%SYSTEM%]\m030106shop.dll
[%SYSTEM%]\m030206pohs.dll
[%SYSTEM%]\mdefshop.dll
[%SYSTEM%]\uohiw.dll
[%WINDOWS%]\system\m030106shop.dll
[%WINDOWS%]\system\m030206pohs.dll
[%WINDOWS%]\system\mbho.dll
[%WINDOWS%]\system\mdefshop.dll
[%SYSTEM%]\m030106shop.dll
[%SYSTEM%]\m030206pohs.dll
[%SYSTEM%]\mdefshop.dll
[%SYSTEM%]\uohiw.dll
[%WINDOWS%]\system\m030106shop.dll
[%WINDOWS%]\system\m030206pohs.dll
[%WINDOWS%]\system\mbho.dll
[%WINDOWS%]\system\mdefshop.dll

Registry Keys:
HKEY_CLASSES_ROOT\clsid\{7e5da25b-1c13-4b78-837a-b938624eba41}
HKEY_CLASSES_ROOT\interface\{a83e42b1-1ae7-4ce6-b128-ab0f4a126b2c}
HKEY_CLASSES_ROOT\interface\{cd4c3cef-4b15-11d1-abed-709549c10000}
HKEY_CLASSES_ROOT\mobho.iehlprobj
HKEY_CLASSES_ROOT\mobho.iehlprobj.1
HKEY_CLASSES_ROOT\sostatatl.stathtmlctrl
HKEY_CLASSES_ROOT\sostatatl.stathtmlctrl.1
HKEY_CLASSES_ROOT\tchk.tchkbho
HKEY_CLASSES_ROOT\tchk.tchkbho.1
HKEY_CLASSES_ROOT\typelib\{48f35889-7f47-4a93-8876-7ab20324e5d7}
HKEY_CLASSES_ROOT\typelib\{ed15346e-0aec-4b72-b23c-ed6f420fcba7}
HKEY_CURRENT_USER\software\wurld media
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D14641FA-445B-448E-9994-209F7AF15641}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\shopping community
HKEY_LOCAL_MACHINE\software\morp
HKEY_LOCAL_MACHINE\software\mscrp
HKEY_CLASSES_ROOT\bpboh.iehlprobj
HKEY_CLASSES_ROOT\bpboh.iehlprobj.1
HKEY_CLASSES_ROOT\clsid\{1b80440d-b4c0-49d7-8d2f-77f16777629b}
HKEY_CLASSES_ROOT\clsid\{2737a6c0-7e24-11d7-b299-00e0297e0844}
HKEY_CLASSES_ROOT\clsid\{30a2c8eb-da7a-4a78-960b-eec497dcc8e7}
HKEY_CLASSES_ROOT\clsid\{3a279869-c6b6-4410-a041-0435de6ad916}
HKEY_CLASSES_ROOT\clsid\{3cb6def9-1db2-4b5d-9a70-9bf8345ed73c}
HKEY_CLASSES_ROOT\clsid\{4769dd43-4045-405c-945f-752516445e89}
HKEY_CLASSES_ROOT\clsid\{4881d4e2-e44a-11d7-8c28-00104b283dfa}
HKEY_CLASSES_ROOT\clsid\{525bbd23-1863-46c6-86d6-5f9a3715d44e}
HKEY_CLASSES_ROOT\clsid\{5a3a5040-4210-11d7-bd2e-00080e34122f}
HKEY_CLASSES_ROOT\clsid\{5fbbc980-402c-11d7-8c24-00104b283dfa}
HKEY_CLASSES_ROOT\clsid\{6270dfc1-edfb-4bc4-be8c-842740ba290b}
HKEY_CLASSES_ROOT\clsid\{8a880893-e6b2-4c29-b168-181a4ef6b852}
HKEY_CLASSES_ROOT\clsid\{8e9c4f32-bd3f-4c49-9af5-3f4c5d32ebd7}
HKEY_CLASSES_ROOT\clsid\{98d7b53e-b1d2-4755-b0a4-703e18ff91e8}
HKEY_CLASSES_ROOT\clsid\{a48dcf80-2ac5-11d7-9898-00036d10327d}
HKEY_CLASSES_ROOT\clsid\{b2b556bb-4322-4625-8da2-8d1ac1d581c2}
HKEY_CLASSES_ROOT\clsid\{bfbae8da-9920-4166-a5a4-ebd03f59abf5}
HKEY_CLASSES_ROOT\clsid\{cd4c3cef-4b15-11d1-abed-709549c10000}
HKEY_CLASSES_ROOT\clsid\{cdbcfeae-10ba-482c-9f6e-fc67207082d8}
HKEY_CLASSES_ROOT\clsid\{d14641fa-445b-448e-9994-209f7af15641}
HKEY_CLASSES_ROOT\clsid\{f325e940-45ee-11d7-a420-444553540000}
HKEY_CLASSES_ROOT\clsid\{fe044817-b9b4-44af-9d58-298d71810adb}
HKEY_CLASSES_ROOT\interface\{40ac4d2c-491d-11d4-aaf2-0008c75dcd2b}
HKEY_CLASSES_ROOT\software\microsoft\windows\currentversion\explorer\browser helper objects\{2737a6c0-7e24-11d7-b299-00e0297e0844}
HKEY_CLASSES_ROOT\software\microsoft\windows\currentversion\explorer\browser helper objects\{3a279869-c6b6-4410-a041-0435de6ad916}
HKEY_CLASSES_ROOT\software\microsoft\windows\currentversion\explorer\browser helper objects\{525bbd23-1863-46c6-86d6-5f9a3715d44e}
HKEY_CLASSES_ROOT\software\microsoft\windows\currentversion\explorer\browser helper objects\{5a3a5040-4210-11d7-bd2e-00080e34122f}
HKEY_CLASSES_ROOT\software\microsoft\windows\currentversion\explorer\browser helper objects\{8e9c4f32-bd3f-4c49-9af5-3f4c5d32ebd7}
HKEY_CLASSES_ROOT\software\microsoft\windows\currentversion\explorer\browser helper objects\{98d7b53e-b1d2-4755-b0a4-703e18ff91e8}
HKEY_CLASSES_ROOT\software\microsoft\windows\currentversion\explorer\browser helper objects\{cdbcfeae-10ba-482c-9f6e-fc67207082d8}
HKEY_CLASSES_ROOT\software\microsoft\windows\currentversion\explorer\browser helper objects\{d14641fa-445b-448e-9994-209f7af15641}
HKEY_CLASSES_ROOT\software\microsoft\windows\currentversion\explorer\browser helper objects\{f325e940-45ee-11d7-a420-444553540000}
HKEY_CLASSES_ROOT\typelib\{40ac4d20-491d-11d4-aaf2-0008c75dcd2b}
HKEY_CLASSES_ROOT\typelib\{4881d4e3-e44a-11d7-8c28-00104b283dfa}
HKEY_LOCAL_MACHINE\software\classes\clsid\{2737a6c0-7e24-11d7-b299-00e0297e0844}
HKEY_LOCAL_MACHINE\software\classes\clsid\{3a279869-c6b6-4410-a041-0435de6ad916}
HKEY_LOCAL_MACHINE\software\classes\clsid\{525bbd23-1863-46c6-86d6-5f9a3715d44e}
HKEY_LOCAL_MACHINE\software\classes\clsid\{5a3a5040-4210-11d7-bd2e-00080e34122f}
HKEY_LOCAL_MACHINE\software\classes\clsid\{8e9c4f32-bd3f-4c49-9af5-3f4c5d32ebd7}
HKEY_LOCAL_MACHINE\software\classes\clsid\{98d7b53e-b1d2-4755-b0a4-703e18ff91e8}
HKEY_LOCAL_MACHINE\software\classes\clsid\{b2b556bb-4322-4625-8da2-8d1ac1d581c2}
HKEY_LOCAL_MACHINE\software\classes\clsid\{cdbcfeae-10ba-482c-9f6e-fc67207082d8}
HKEY_LOCAL_MACHINE\software\classes\clsid\{d14641fa-445b-448e-9994-209f7af15641}
HKEY_LOCAL_MACHINE\software\classes\clsid\{f325e940-45ee-11d7-a420-444553540000}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{2737a6c0-7e24-11d7-b299-00e0297e0844}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{3a279869-c6b6-4410-a041-0435de6ad916}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{525bbd23-1863-46c6-86d6-5f9a3715d44e}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{5a3a5040-4210-11d7-bd2e-00080e34122f}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{5fbbc980-402c-11d7-8c24-00104b283dfa}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{8e9c4f32-bd3f-4c49-9af5-3f4c5d32ebd7}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{98d7b53e-b1d2-4755-b0a4-703e18ff91e8}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{a48dcf80-2ac5-11d7-9898-00036d10327d}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{b2b556bb-4322-4625-8da2-8d1ac1d581c2}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{cdbcfeae-10ba-482c-9f6e-fc67207082d8}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{d14641fa-445b-448e-9994-209f7af15641}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{f325e940-45ee-11d7-a420-444553540000}
HKEY_LOCAL_MACHINE\software\rdxr

Registry Values:
HKEY_CLASSES_ROOT\clsid\{3c029aa9-c1a1-4881-8ea8-e5c5d13f2dff}\inprocserver32

Removing WurldMedia:

You can download trial version of "Exterminate-It" antivirus software here, to check your computer instantly.

Or buy it to remove ALL viruses from your computer.

---

Also Be Aware of the Following Threats:
CWS.GoogleMS Hijacker Symptoms
Removing Totempole Adware
Zlob Trojan Information
Removing Bancos.GLY Trojan

Zlob.Fam.ProtectionBar Trojan

Removing Zlob.Fam.ProtectionBar
Categories: Trojan,Popups
This category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.
The pop-ups generally will not be stopped by pop-up stoppers, and often are
not dependent on your having Internet Explorer open.

---

Visible Symptoms:
Files in system folders:
[%PROGRAM_FILES%]\Brain Codec\iesplugin.dll
[%PROGRAM_FILES%]\Gold Codec\iesplugin.dll
[%PROGRAM_FILES%]\Gold Codec\isaddon.dll
[%PROGRAM_FILES%]\Image Access ActiveX Object\iesplugin.dll
[%PROGRAM_FILES%]\Image Access ActiveX Object\isadd.dll
[%PROGRAM_FILES%]\Image ActiveX Access\iesplg.dll
[%PROGRAM_FILES%]\Image ActiveX Object\iesplugin.dll
[%PROGRAM_FILES%]\Image ActiveX Object\isadd.dll
[%PROGRAM_FILES%]\Image ActiveX Object\isaddon.dll
[%PROGRAM_FILES%]\Image AX Object\bpvol.dll
[%PROGRAM_FILES%]\Image AX Object\splug.dll
[%PROGRAM_FILES%]\IntCodec\iesplugin.dll
[%PROGRAM_FILES%]\Internet Security\iesplugin.dll
[%PROGRAM_FILES%]\Internet Security\isadd.dll
[%PROGRAM_FILES%]\iVideoCodec\isaddon.dll
[%PROGRAM_FILES%]\Key Generator\iesplugin.dll
[%PROGRAM_FILES%]\Key Generator\isadd.dll
[%PROGRAM_FILES%]\Key Generator\isaddon.dll
[%PROGRAM_FILES%]\Media-Codec\iesplugin.dll
[%PROGRAM_FILES%]\Media-Codec\isaddon.dll
[%PROGRAM_FILES%]\MediaCodec\isaddon.dll
[%PROGRAM_FILES%]\MMediaCodec\iesplugin.dll
[%PROGRAM_FILES%]\MMediaCodec\isaddon.dll
[%PROGRAM_FILES%]\PCODEC\iesplugin.dll
[%PROGRAM_FILES%]\Perfect Codec\iesplugin.dll
[%PROGRAM_FILES%]\Perfect Codec\isaddon.dll
[%PROGRAM_FILES%]\Protection Tools\bpvol.dll
[%PROGRAM_FILES%]\Protection Tools\splug.dll
[%PROGRAM_FILES%]\QualityCodec\iesplugin.dll
[%PROGRAM_FILES%]\QualityCodec\isaddon.dll
[%PROGRAM_FILES%]\Security Tools\iesplg.dll
[%PROGRAM_FILES%]\strCodec\iesplugin.dll
[%PROGRAM_FILES%]\strCodec\isaddon.dll
[%PROGRAM_FILES%]\VidCodecs\isaddon.dll
[%PROGRAM_FILES%]\Video Access ActiveX Object\iesplugin.dll
[%PROGRAM_FILES%]\Video Access ActiveX Object\isadd.dll
[%PROGRAM_FILES%]\Video ActiveX Access\iesbpl.dll
[%PROGRAM_FILES%]\Video ActiveX Access\iesplg.dll
[%PROGRAM_FILES%]\Video ActiveX Object\iesplugin.dll
[%PROGRAM_FILES%]\Video ActiveX Object\isadd.dll
[%PROGRAM_FILES%]\Video ActiveX Object\isaddon.dll
[%PROGRAM_FILES%]\Video AX Object\bpvol.dll
[%PROGRAM_FILES%]\Video AX Object\splug.dll
[%PROGRAM_FILES%]\VideoKeyCodec\isaddon.dll
[%SYSTEM%]\iesplg.dll
[%PROGRAM_FILES%]\Brain Codec\iesplugin.dll
[%PROGRAM_FILES%]\Gold Codec\iesplugin.dll
[%PROGRAM_FILES%]\Gold Codec\isaddon.dll
[%PROGRAM_FILES%]\Image Access ActiveX Object\iesplugin.dll
[%PROGRAM_FILES%]\Image Access ActiveX Object\isadd.dll
[%PROGRAM_FILES%]\Image ActiveX Access\iesplg.dll
[%PROGRAM_FILES%]\Image ActiveX Object\iesplugin.dll
[%PROGRAM_FILES%]\Image ActiveX Object\isadd.dll
[%PROGRAM_FILES%]\Image ActiveX Object\isaddon.dll
[%PROGRAM_FILES%]\Image AX Object\bpvol.dll
[%PROGRAM_FILES%]\Image AX Object\splug.dll
[%PROGRAM_FILES%]\IntCodec\iesplugin.dll
[%PROGRAM_FILES%]\Internet Security\iesplugin.dll
[%PROGRAM_FILES%]\Internet Security\isadd.dll
[%PROGRAM_FILES%]\iVideoCodec\isaddon.dll
[%PROGRAM_FILES%]\Key Generator\iesplugin.dll
[%PROGRAM_FILES%]\Key Generator\isadd.dll
[%PROGRAM_FILES%]\Key Generator\isaddon.dll
[%PROGRAM_FILES%]\Media-Codec\iesplugin.dll
[%PROGRAM_FILES%]\Media-Codec\isaddon.dll
[%PROGRAM_FILES%]\MediaCodec\isaddon.dll
[%PROGRAM_FILES%]\MMediaCodec\iesplugin.dll
[%PROGRAM_FILES%]\MMediaCodec\isaddon.dll
[%PROGRAM_FILES%]\PCODEC\iesplugin.dll
[%PROGRAM_FILES%]\Perfect Codec\iesplugin.dll
[%PROGRAM_FILES%]\Perfect Codec\isaddon.dll
[%PROGRAM_FILES%]\Protection Tools\bpvol.dll
[%PROGRAM_FILES%]\Protection Tools\splug.dll
[%PROGRAM_FILES%]\QualityCodec\iesplugin.dll
[%PROGRAM_FILES%]\QualityCodec\isaddon.dll
[%PROGRAM_FILES%]\Security Tools\iesplg.dll
[%PROGRAM_FILES%]\strCodec\iesplugin.dll
[%PROGRAM_FILES%]\strCodec\isaddon.dll
[%PROGRAM_FILES%]\VidCodecs\isaddon.dll
[%PROGRAM_FILES%]\Video Access ActiveX Object\iesplugin.dll
[%PROGRAM_FILES%]\Video Access ActiveX Object\isadd.dll
[%PROGRAM_FILES%]\Video ActiveX Access\iesbpl.dll
[%PROGRAM_FILES%]\Video ActiveX Access\iesplg.dll
[%PROGRAM_FILES%]\Video ActiveX Object\iesplugin.dll
[%PROGRAM_FILES%]\Video ActiveX Object\isadd.dll
[%PROGRAM_FILES%]\Video ActiveX Object\isaddon.dll
[%PROGRAM_FILES%]\Video AX Object\bpvol.dll
[%PROGRAM_FILES%]\Video AX Object\splug.dll
[%PROGRAM_FILES%]\VideoKeyCodec\isaddon.dll
[%SYSTEM%]\iesplg.dll

How to detect Zlob.Fam.ProtectionBar:

Files:
[%PROGRAM_FILES%]\Brain Codec\iesplugin.dll
[%PROGRAM_FILES%]\Gold Codec\iesplugin.dll
[%PROGRAM_FILES%]\Gold Codec\isaddon.dll
[%PROGRAM_FILES%]\Image Access ActiveX Object\iesplugin.dll
[%PROGRAM_FILES%]\Image Access ActiveX Object\isadd.dll
[%PROGRAM_FILES%]\Image ActiveX Access\iesplg.dll
[%PROGRAM_FILES%]\Image ActiveX Object\iesplugin.dll
[%PROGRAM_FILES%]\Image ActiveX Object\isadd.dll
[%PROGRAM_FILES%]\Image ActiveX Object\isaddon.dll
[%PROGRAM_FILES%]\Image AX Object\bpvol.dll
[%PROGRAM_FILES%]\Image AX Object\splug.dll
[%PROGRAM_FILES%]\IntCodec\iesplugin.dll
[%PROGRAM_FILES%]\Internet Security\iesplugin.dll
[%PROGRAM_FILES%]\Internet Security\isadd.dll
[%PROGRAM_FILES%]\iVideoCodec\isaddon.dll
[%PROGRAM_FILES%]\Key Generator\iesplugin.dll
[%PROGRAM_FILES%]\Key Generator\isadd.dll
[%PROGRAM_FILES%]\Key Generator\isaddon.dll
[%PROGRAM_FILES%]\Media-Codec\iesplugin.dll
[%PROGRAM_FILES%]\Media-Codec\isaddon.dll
[%PROGRAM_FILES%]\MediaCodec\isaddon.dll
[%PROGRAM_FILES%]\MMediaCodec\iesplugin.dll
[%PROGRAM_FILES%]\MMediaCodec\isaddon.dll
[%PROGRAM_FILES%]\PCODEC\iesplugin.dll
[%PROGRAM_FILES%]\Perfect Codec\iesplugin.dll
[%PROGRAM_FILES%]\Perfect Codec\isaddon.dll
[%PROGRAM_FILES%]\Protection Tools\bpvol.dll
[%PROGRAM_FILES%]\Protection Tools\splug.dll
[%PROGRAM_FILES%]\QualityCodec\iesplugin.dll
[%PROGRAM_FILES%]\QualityCodec\isaddon.dll
[%PROGRAM_FILES%]\Security Tools\iesplg.dll
[%PROGRAM_FILES%]\strCodec\iesplugin.dll
[%PROGRAM_FILES%]\strCodec\isaddon.dll
[%PROGRAM_FILES%]\VidCodecs\isaddon.dll
[%PROGRAM_FILES%]\Video Access ActiveX Object\iesplugin.dll
[%PROGRAM_FILES%]\Video Access ActiveX Object\isadd.dll
[%PROGRAM_FILES%]\Video ActiveX Access\iesbpl.dll
[%PROGRAM_FILES%]\Video ActiveX Access\iesplg.dll
[%PROGRAM_FILES%]\Video ActiveX Object\iesplugin.dll
[%PROGRAM_FILES%]\Video ActiveX Object\isadd.dll
[%PROGRAM_FILES%]\Video ActiveX Object\isaddon.dll
[%PROGRAM_FILES%]\Video AX Object\bpvol.dll
[%PROGRAM_FILES%]\Video AX Object\splug.dll
[%PROGRAM_FILES%]\VideoKeyCodec\isaddon.dll
[%SYSTEM%]\iesplg.dll
[%PROGRAM_FILES%]\Brain Codec\iesplugin.dll
[%PROGRAM_FILES%]\Gold Codec\iesplugin.dll
[%PROGRAM_FILES%]\Gold Codec\isaddon.dll
[%PROGRAM_FILES%]\Image Access ActiveX Object\iesplugin.dll
[%PROGRAM_FILES%]\Image Access ActiveX Object\isadd.dll
[%PROGRAM_FILES%]\Image ActiveX Access\iesplg.dll
[%PROGRAM_FILES%]\Image ActiveX Object\iesplugin.dll
[%PROGRAM_FILES%]\Image ActiveX Object\isadd.dll
[%PROGRAM_FILES%]\Image ActiveX Object\isaddon.dll
[%PROGRAM_FILES%]\Image AX Object\bpvol.dll
[%PROGRAM_FILES%]\Image AX Object\splug.dll
[%PROGRAM_FILES%]\IntCodec\iesplugin.dll
[%PROGRAM_FILES%]\Internet Security\iesplugin.dll
[%PROGRAM_FILES%]\Internet Security\isadd.dll
[%PROGRAM_FILES%]\iVideoCodec\isaddon.dll
[%PROGRAM_FILES%]\Key Generator\iesplugin.dll
[%PROGRAM_FILES%]\Key Generator\isadd.dll
[%PROGRAM_FILES%]\Key Generator\isaddon.dll
[%PROGRAM_FILES%]\Media-Codec\iesplugin.dll
[%PROGRAM_FILES%]\Media-Codec\isaddon.dll
[%PROGRAM_FILES%]\MediaCodec\isaddon.dll
[%PROGRAM_FILES%]\MMediaCodec\iesplugin.dll
[%PROGRAM_FILES%]\MMediaCodec\isaddon.dll
[%PROGRAM_FILES%]\PCODEC\iesplugin.dll
[%PROGRAM_FILES%]\Perfect Codec\iesplugin.dll
[%PROGRAM_FILES%]\Perfect Codec\isaddon.dll
[%PROGRAM_FILES%]\Protection Tools\bpvol.dll
[%PROGRAM_FILES%]\Protection Tools\splug.dll
[%PROGRAM_FILES%]\QualityCodec\iesplugin.dll
[%PROGRAM_FILES%]\QualityCodec\isaddon.dll
[%PROGRAM_FILES%]\Security Tools\iesplg.dll
[%PROGRAM_FILES%]\strCodec\iesplugin.dll
[%PROGRAM_FILES%]\strCodec\isaddon.dll
[%PROGRAM_FILES%]\VidCodecs\isaddon.dll
[%PROGRAM_FILES%]\Video Access ActiveX Object\iesplugin.dll
[%PROGRAM_FILES%]\Video Access ActiveX Object\isadd.dll
[%PROGRAM_FILES%]\Video ActiveX Access\iesbpl.dll
[%PROGRAM_FILES%]\Video ActiveX Access\iesplg.dll
[%PROGRAM_FILES%]\Video ActiveX Object\iesplugin.dll
[%PROGRAM_FILES%]\Video ActiveX Object\isadd.dll
[%PROGRAM_FILES%]\Video ActiveX Object\isaddon.dll
[%PROGRAM_FILES%]\Video AX Object\bpvol.dll
[%PROGRAM_FILES%]\Video AX Object\splug.dll
[%PROGRAM_FILES%]\VideoKeyCodec\isaddon.dll
[%SYSTEM%]\iesplg.dll

Registry Keys:
HKEY_CLASSES_ROOT\CLSID\{0D045BAA-4BD3-4C94-BE8B-21536BD6BD9F}
HKEY_CLASSES_ROOT\CLSID\{184746EC-9E9D-4C7D-B9E7-9039EBD801A9}
HKEY_CLASSES_ROOT\CLSID\{192c5b4a-3efd-40c7-9f99-c472deb8efc0}
HKEY_CLASSES_ROOT\CLSID\{1a1ddc19-5893-43ab-a73f-f41a0f34d115}
HKEY_CLASSES_ROOT\CLSID\{1a29a79a-b9c8-44a9-bedf-7fadde3cf33f}
HKEY_CLASSES_ROOT\CLSID\{202a961f-23ae-42b1-9505-ffe3c818d717}
HKEY_CLASSES_ROOT\CLSID\{274c0420-ebe0-4f1d-b473-edd1aa9b85dd}
HKEY_CLASSES_ROOT\CLSID\{2810fba5-55ec-4bee-8263-0e2fa5883768}
HKEY_CLASSES_ROOT\CLSID\{31615D5C-5126-448A-818A-A7CDFEE85A9B}
HKEY_CLASSES_ROOT\CLSID\{36ADA89D-2440-4DC4-820A-3A05E8630935}
HKEY_CLASSES_ROOT\CLSID\{44d22a64-2399-4edf-8b32-f2c729c1e8a7}
HKEY_CLASSES_ROOT\CLSID\{4734044c-7427-43d8-adbe-df942e52bef2}
HKEY_CLASSES_ROOT\CLSID\{479fd0cf-5be9-4c63-8cda-b6d371c67bd5}
HKEY_CLASSES_ROOT\CLSID\{5d4831e0-5a7c-4a46-afd5-a79ab8ce36c2}
HKEY_CLASSES_ROOT\CLSID\{67982BB7-0F95-44C5-92DC-E3AF3DC19D6D}
HKEY_CLASSES_ROOT\CLSID\{74a49269-9779-48b4-a0e6-3a5af2a3ade6}
HKEY_CLASSES_ROOT\CLSID\{7A8F5B7A-A74F-495E-8A33-DF6226D2BAD8}
HKEY_CLASSES_ROOT\CLSID\{7b4d79df-9ef0-429d-a0e9-d9b138c6a53b}
HKEY_CLASSES_ROOT\CLSID\{84938242-5C5B-4A55-B6B9-A1507543B418}
HKEY_CLASSES_ROOT\CLSID\{860c2f6b-ca82-4282-9187-beccbb66f0af}
HKEY_CLASSES_ROOT\CLSID\{8aed5df3-6e0b-4930-b1a5-f8aa8d757497}
HKEY_CLASSES_ROOT\CLSID\{8bf5b8fc-11cb-409f-8c91-4d4ca04a1b6d}
HKEY_CLASSES_ROOT\CLSID\{96ebbe6a-2864-4345-b32b-26ee9be524b5}
HKEY_CLASSES_ROOT\CLSID\{a2595f37-48d0-46a1-9b51-478591a97764}
HKEY_CLASSES_ROOT\CLSID\{A6ACAE64-F798-4930-AD86-BD3FB32038DB}
HKEY_CLASSES_ROOT\CLSID\{ae18da4e-be15-4925-81bb-890c04af0200}
HKEY_CLASSES_ROOT\CLSID\{bf1ced2c-4b3f-4079-a330-864eda5a4cff}
HKEY_CLASSES_ROOT\CLSID\{d1ac752e-883f-4ed8-8828-b618c3a72152}
HKEY_CLASSES_ROOT\CLSID\{D34F5D71-99E4-4D96-91CA-F4104F69B8AE}
HKEY_CLASSES_ROOT\CLSID\{d869742a-e5d2-4624-96c7-aae26170665e}
HKEY_CLASSES_ROOT\CLSID\{F0993251-2512-4710-AF6E-0A13EA199D02}
HKEY_CLASSES_ROOT\CLSID\{f7d40011-29bb-43eb-9c97-875ce89e9e36}
HKEY_CLASSES_ROOT\CLSID\{fe2d25c1-c1db-4b5e-9390-af1cb5302f32}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objecta\{f7d40011-29bb-43eb-9c97-875ce89e9e36}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{184746EC-9E9D-4C7D-B9E7-9039EBD801A9}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{192c5b4a-3efd-40c7-9f99-c472deb8efc0}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1a1ddc19-5893-43ab-a73f-f41a0f34d115}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{202a961f-23ae-42b1-9505-ffe3c818d717}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{274c0420-ebe0-4f1d-b473-edd1aa9b85dd}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2810fba5-55ec-4bee-8263-0e2fa5883768}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{36ADA89D-2440-4DC4-820A-3A05E8630935}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4734044c-7427-43d8-adbe-df942e52bef2}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{479fd0cf-5be9-4c63-8cda-b6d371c67bd5}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{67982BB7-0F95-44C5-92DC-E3AF3DC19D6D}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7A8F5B7A-A74F-495E-8A33-DF6226D2BAD8}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7b4d79df-9ef0-429d-a0e9-d9b138c6a53b}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8bf5b8fc-11cb-409f-8c91-4d4ca04a1b6d}
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{a2595f37-48d0-46a1-9b51-478591a97764}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A6ACAE64-F798-4930-AD86-BD3FB32038DB}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{ae18da4e-be15-4925-81bb-890c04af0200}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D34F5D71-99E4-4D96-91CA-F4104F69B8AE}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{d869742a-e5d2-4624-96c7-aae26170665e}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{f7d40011-29bb-43eb-9c97-875ce89e9e36}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{fe2d25c1-c1db-4b5e-9390-af1cb5302f32}
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Internet Explorer Security Plugin 2006
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Internet Security Add-On
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\PCODEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Public Messenger ver 2.03

Registry Values:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar

Removing Zlob.Fam.ProtectionBar:

You can download trial version of "Exterminate-It" antivirus software here, to check your computer instantly.

Or buy it to remove ALL viruses from your computer.

---

Also Be Aware of the Following Threats:
Removing Agent.jt Downloader
Zlob.Fam.iVideoCodec Trojan Cleaner
Remove FastSearch Toolbar
Removing SearchMiracle.EliteBar Adware

TargetSaver Downloader

Removing TargetSaver
Categories: Downloader
Trojans-downloaders downloads and installs new malware or adware on the computer.

---

TargetSaver Also known as:

[Kaspersky]Trojan-Downloader.Win32.TSUpdate.o,Trojan-Downloader.Win32.TSUpdate.e;
[Other]TargetSaver,Adware.TargetSaver

---

Visible Symptoms:
Files in system folders:
[%PROFILE_TEMP%]\GLF10GLF10.EXE
[%PROFILE_TEMP%]\GLF123GLF123.EXE
[%PROFILE_TEMP%]\GLF12EGLF12E.EXE
[%PROFILE_TEMP%]\GLF25GLF25.EXE
[%PROFILE_TEMP%]\GLF266GLF266.EXE
[%PROFILE_TEMP%]\GLF26GLF26.EXE
[%PROFILE_TEMP%]\GLF2AGLF2A.EXE
[%PROFILE_TEMP%]\GLF35GLF35.EXE
[%PROFILE_TEMP%]\GLF3E3GLF3E3.EXE
[%PROFILE_TEMP%]\GLF42GLF42.EXE
[%PROFILE_TEMP%]\GLF6AGLF6A.EXE
[%PROFILE_TEMP%]\GLF7FGLF7F.EXE
[%PROFILE_TEMP%]\GLF82GLF82.EXE
[%PROFILE_TEMP%]\tsinstall_4_0_3_7.exe
[%PROFILE_TEMP%]\tsinstall_4_0_4_0_b4.exe
[%PROFILE_TEMP%]\tsupdate_4_0_4_1_b3.exe
[%PROGRAM_FILES_COMMON%]\imzk\imzkm.exe
[%PROGRAM_FILES_COMMON%]\kirw\kirwm.exe
[%PROGRAM_FILES_COMMON%]\kkom\kkoma.exe
[%PROGRAM_FILES_COMMON%]\kkom\kkomd\kkomc.dll
[%PROGRAM_FILES_COMMON%]\kkom\kkomm.exe
[%PROGRAM_FILES_COMMON%]\kowu\kowua.exe
[%PROGRAM_FILES_COMMON%]\kowu\kowud\kowuc.dll
[%PROGRAM_FILES_COMMON%]\kowu\kowum.exe
[%PROGRAM_FILES_COMMON%]\krrk\krrkd\class-barrel
[%PROGRAM_FILES_COMMON%]\krrk\krrkd\vocabulary
[%PROGRAM_FILES_COMMON%]\kurq\kurqa.exe
[%PROGRAM_FILES_COMMON%]\kurq\kurqd\kurqc.dll
[%PROGRAM_FILES_COMMON%]\kurq\kurqm.exe
[%PROGRAM_FILES_COMMON%]\misc002\141.exe
[%PROGRAM_FILES_COMMON%]\ommi\ommid\class-barrel
[%PROGRAM_FILES_COMMON%]\ommi\ommid\vocabulary
[%PROGRAM_FILES_COMMON%]\oqqr\oqqra.exe
[%PROGRAM_FILES_COMMON%]\oqqr\oqqrd\oqqrc.dll
[%PROGRAM_FILES_COMMON%]\oqqr\oqqrm.exe
[%PROGRAM_FILES_COMMON%]\qmwf\qmwfm.exe
[%PROGRAM_FILES_COMMON%]\rifq\rifqd\class-barrel
[%PROGRAM_FILES_COMMON%]\rifq\rifqd\vocabulary
[%PROGRAM_FILES_COMMON%]\riwz\riwza.exe
[%PROGRAM_FILES_COMMON%]\riwz\riwzm.exe
[%PROGRAM_FILES_COMMON%]\rmwk\rmwkd\class-barrel
[%PROGRAM_FILES_COMMON%]\rmwk\rmwkd\vocabulary
[%PROGRAM_FILES_COMMON%]\rwof\rwofa.exe
[%PROGRAM_FILES_COMMON%]\rwof\rwofd\rwofc.dll
[%PROGRAM_FILES_COMMON%]\rwof\rwofm.exe
[%PROGRAM_FILES_COMMON%]\ukir\ukira.exe
[%PROGRAM_FILES_COMMON%]\ukir\ukird\class-barrel
[%PROGRAM_FILES_COMMON%]\ukir\ukird\ukirc.dll
[%PROGRAM_FILES_COMMON%]\ukir\ukird\vocabulary
[%PROGRAM_FILES_COMMON%]\ukir\ukirl.exe
[%PROGRAM_FILES_COMMON%]\ukir\ukirp.exe
[%PROGRAM_FILES_COMMON%]\umkk\umkkd\class-barrel
[%PROGRAM_FILES_COMMON%]\umkk\umkkd\vocabulary
[%PROGRAM_FILES_COMMON%]\uuuo\uuuoa.exe
[%PROGRAM_FILES_COMMON%]\uuuo\uuuod\uuuoc.dll
[%PROGRAM_FILES_COMMON%]\uuuo\uuuom.exe
[%PROGRAM_FILES_COMMON%]\wizk\wizkd\class-barrel
[%PROGRAM_FILES_COMMON%]\wizk\wizkd\vocabulary
[%PROGRAM_FILES_COMMON%]\wkqm\wkqma.exe
[%PROGRAM_FILES_COMMON%]\wkqm\wkqmd\wkqmc.dll
[%PROGRAM_FILES_COMMON%]\wkqm\wkqmm.exe
[%PROGRAM_FILES_COMMON%]\wufu\wufud\class-barrel
[%PROGRAM_FILES_COMMON%]\wufu\wufud\vocabulary
[%PROGRAM_FILES_COMMON%]\wuru\wurud\class-barrel
[%PROGRAM_FILES_COMMON%]\wuru\wurud\vocabulary
[%PROGRAM_FILES_COMMON%]\wuru\wurud\wuruc.dll
[%PROGRAM_FILES_COMMON%]\wuru\wurup.exe
[%PROGRAM_FILES_COMMON%]\wwro\wwroa.exe
[%PROGRAM_FILES_COMMON%]\wwro\wwrod\wwroc.dll
[%PROGRAM_FILES_COMMON%]\wwro\wwrom.exe
[%PROGRAM_FILES_COMMON%]\zqkk\zqkka.exe
[%PROGRAM_FILES_COMMON%]\zqkk\zqkkm.exe
[%SYSTEM%]\tsuninst.exe
[%SYSTEM%]\tsuninst.exe.ren
[%WINDOWS%]\stub_113_4_0_4_0.exe
[%WINDOWS%]\Temp\tsinstall_4_0_4_0_b4.exe
[%WINDOWS%]\Temp\tsupdate_4_0_4_1_b3.exe
[%PROFILE_TEMP%]\tsinstall_4_0_3_8_b17.exe
[%PROFILE_TEMP%]\tsupdate_4_0_3_9_b2.exe
[%WINDOWS%]\stub_110_4_0_4_0.exe
[%PROFILE_TEMP%]\GLF10GLF10.EXE
[%PROFILE_TEMP%]\GLF123GLF123.EXE
[%PROFILE_TEMP%]\GLF12EGLF12E.EXE
[%PROFILE_TEMP%]\GLF25GLF25.EXE
[%PROFILE_TEMP%]\GLF266GLF266.EXE
[%PROFILE_TEMP%]\GLF26GLF26.EXE
[%PROFILE_TEMP%]\GLF2AGLF2A.EXE
[%PROFILE_TEMP%]\GLF35GLF35.EXE
[%PROFILE_TEMP%]\GLF3E3GLF3E3.EXE
[%PROFILE_TEMP%]\GLF42GLF42.EXE
[%PROFILE_TEMP%]\GLF6AGLF6A.EXE
[%PROFILE_TEMP%]\GLF7FGLF7F.EXE
[%PROFILE_TEMP%]\GLF82GLF82.EXE
[%PROFILE_TEMP%]\tsinstall_4_0_3_7.exe
[%PROFILE_TEMP%]\tsinstall_4_0_4_0_b4.exe
[%PROFILE_TEMP%]\tsupdate_4_0_4_1_b3.exe
[%PROGRAM_FILES_COMMON%]\imzk\imzkm.exe
[%PROGRAM_FILES_COMMON%]\kirw\kirwm.exe
[%PROGRAM_FILES_COMMON%]\kkom\kkoma.exe
[%PROGRAM_FILES_COMMON%]\kkom\kkomd\kkomc.dll
[%PROGRAM_FILES_COMMON%]\kkom\kkomm.exe
[%PROGRAM_FILES_COMMON%]\kowu\kowua.exe
[%PROGRAM_FILES_COMMON%]\kowu\kowud\kowuc.dll
[%PROGRAM_FILES_COMMON%]\kowu\kowum.exe
[%PROGRAM_FILES_COMMON%]\krrk\krrkd\class-barrel
[%PROGRAM_FILES_COMMON%]\krrk\krrkd\vocabulary
[%PROGRAM_FILES_COMMON%]\kurq\kurqa.exe
[%PROGRAM_FILES_COMMON%]\kurq\kurqd\kurqc.dll
[%PROGRAM_FILES_COMMON%]\kurq\kurqm.exe
[%PROGRAM_FILES_COMMON%]\misc002\141.exe
[%PROGRAM_FILES_COMMON%]\ommi\ommid\class-barrel
[%PROGRAM_FILES_COMMON%]\ommi\ommid\vocabulary
[%PROGRAM_FILES_COMMON%]\oqqr\oqqra.exe
[%PROGRAM_FILES_COMMON%]\oqqr\oqqrd\oqqrc.dll
[%PROGRAM_FILES_COMMON%]\oqqr\oqqrm.exe
[%PROGRAM_FILES_COMMON%]\qmwf\qmwfm.exe
[%PROGRAM_FILES_COMMON%]\rifq\rifqd\class-barrel
[%PROGRAM_FILES_COMMON%]\rifq\rifqd\vocabulary
[%PROGRAM_FILES_COMMON%]\riwz\riwza.exe
[%PROGRAM_FILES_COMMON%]\riwz\riwzm.exe
[%PROGRAM_FILES_COMMON%]\rmwk\rmwkd\class-barrel
[%PROGRAM_FILES_COMMON%]\rmwk\rmwkd\vocabulary
[%PROGRAM_FILES_COMMON%]\rwof\rwofa.exe
[%PROGRAM_FILES_COMMON%]\rwof\rwofd\rwofc.dll
[%PROGRAM_FILES_COMMON%]\rwof\rwofm.exe
[%PROGRAM_FILES_COMMON%]\ukir\ukira.exe
[%PROGRAM_FILES_COMMON%]\ukir\ukird\class-barrel
[%PROGRAM_FILES_COMMON%]\ukir\ukird\ukirc.dll
[%PROGRAM_FILES_COMMON%]\ukir\ukird\vocabulary
[%PROGRAM_FILES_COMMON%]\ukir\ukirl.exe
[%PROGRAM_FILES_COMMON%]\ukir\ukirp.exe
[%PROGRAM_FILES_COMMON%]\umkk\umkkd\class-barrel
[%PROGRAM_FILES_COMMON%]\umkk\umkkd\vocabulary
[%PROGRAM_FILES_COMMON%]\uuuo\uuuoa.exe
[%PROGRAM_FILES_COMMON%]\uuuo\uuuod\uuuoc.dll
[%PROGRAM_FILES_COMMON%]\uuuo\uuuom.exe
[%PROGRAM_FILES_COMMON%]\wizk\wizkd\class-barrel
[%PROGRAM_FILES_COMMON%]\wizk\wizkd\vocabulary
[%PROGRAM_FILES_COMMON%]\wkqm\wkqma.exe
[%PROGRAM_FILES_COMMON%]\wkqm\wkqmd\wkqmc.dll
[%PROGRAM_FILES_COMMON%]\wkqm\wkqmm.exe
[%PROGRAM_FILES_COMMON%]\wufu\wufud\class-barrel
[%PROGRAM_FILES_COMMON%]\wufu\wufud\vocabulary
[%PROGRAM_FILES_COMMON%]\wuru\wurud\class-barrel
[%PROGRAM_FILES_COMMON%]\wuru\wurud\vocabulary
[%PROGRAM_FILES_COMMON%]\wuru\wurud\wuruc.dll
[%PROGRAM_FILES_COMMON%]\wuru\wurup.exe
[%PROGRAM_FILES_COMMON%]\wwro\wwroa.exe
[%PROGRAM_FILES_COMMON%]\wwro\wwrod\wwroc.dll
[%PROGRAM_FILES_COMMON%]\wwro\wwrom.exe
[%PROGRAM_FILES_COMMON%]\zqkk\zqkka.exe
[%PROGRAM_FILES_COMMON%]\zqkk\zqkkm.exe
[%SYSTEM%]\tsuninst.exe
[%SYSTEM%]\tsuninst.exe.ren
[%WINDOWS%]\stub_113_4_0_4_0.exe
[%WINDOWS%]\Temp\tsinstall_4_0_4_0_b4.exe
[%WINDOWS%]\Temp\tsupdate_4_0_4_1_b3.exe
[%PROFILE_TEMP%]\tsinstall_4_0_3_8_b17.exe
[%PROFILE_TEMP%]\tsupdate_4_0_3_9_b2.exe
[%WINDOWS%]\stub_110_4_0_4_0.exe

How to detect TargetSaver:

Files:
[%PROFILE_TEMP%]\GLF10GLF10.EXE
[%PROFILE_TEMP%]\GLF123GLF123.EXE
[%PROFILE_TEMP%]\GLF12EGLF12E.EXE
[%PROFILE_TEMP%]\GLF25GLF25.EXE
[%PROFILE_TEMP%]\GLF266GLF266.EXE
[%PROFILE_TEMP%]\GLF26GLF26.EXE
[%PROFILE_TEMP%]\GLF2AGLF2A.EXE
[%PROFILE_TEMP%]\GLF35GLF35.EXE
[%PROFILE_TEMP%]\GLF3E3GLF3E3.EXE
[%PROFILE_TEMP%]\GLF42GLF42.EXE
[%PROFILE_TEMP%]\GLF6AGLF6A.EXE
[%PROFILE_TEMP%]\GLF7FGLF7F.EXE
[%PROFILE_TEMP%]\GLF82GLF82.EXE
[%PROFILE_TEMP%]\tsinstall_4_0_3_7.exe
[%PROFILE_TEMP%]\tsinstall_4_0_4_0_b4.exe
[%PROFILE_TEMP%]\tsupdate_4_0_4_1_b3.exe
[%PROGRAM_FILES_COMMON%]\imzk\imzkm.exe
[%PROGRAM_FILES_COMMON%]\kirw\kirwm.exe
[%PROGRAM_FILES_COMMON%]\kkom\kkoma.exe
[%PROGRAM_FILES_COMMON%]\kkom\kkomd\kkomc.dll
[%PROGRAM_FILES_COMMON%]\kkom\kkomm.exe
[%PROGRAM_FILES_COMMON%]\kowu\kowua.exe
[%PROGRAM_FILES_COMMON%]\kowu\kowud\kowuc.dll
[%PROGRAM_FILES_COMMON%]\kowu\kowum.exe
[%PROGRAM_FILES_COMMON%]\krrk\krrkd\class-barrel
[%PROGRAM_FILES_COMMON%]\krrk\krrkd\vocabulary
[%PROGRAM_FILES_COMMON%]\kurq\kurqa.exe
[%PROGRAM_FILES_COMMON%]\kurq\kurqd\kurqc.dll
[%PROGRAM_FILES_COMMON%]\kurq\kurqm.exe
[%PROGRAM_FILES_COMMON%]\misc002\141.exe
[%PROGRAM_FILES_COMMON%]\ommi\ommid\class-barrel
[%PROGRAM_FILES_COMMON%]\ommi\ommid\vocabulary
[%PROGRAM_FILES_COMMON%]\oqqr\oqqra.exe
[%PROGRAM_FILES_COMMON%]\oqqr\oqqrd\oqqrc.dll
[%PROGRAM_FILES_COMMON%]\oqqr\oqqrm.exe
[%PROGRAM_FILES_COMMON%]\qmwf\qmwfm.exe
[%PROGRAM_FILES_COMMON%]\rifq\rifqd\class-barrel
[%PROGRAM_FILES_COMMON%]\rifq\rifqd\vocabulary
[%PROGRAM_FILES_COMMON%]\riwz\riwza.exe
[%PROGRAM_FILES_COMMON%]\riwz\riwzm.exe
[%PROGRAM_FILES_COMMON%]\rmwk\rmwkd\class-barrel
[%PROGRAM_FILES_COMMON%]\rmwk\rmwkd\vocabulary
[%PROGRAM_FILES_COMMON%]\rwof\rwofa.exe
[%PROGRAM_FILES_COMMON%]\rwof\rwofd\rwofc.dll
[%PROGRAM_FILES_COMMON%]\rwof\rwofm.exe
[%PROGRAM_FILES_COMMON%]\ukir\ukira.exe
[%PROGRAM_FILES_COMMON%]\ukir\ukird\class-barrel
[%PROGRAM_FILES_COMMON%]\ukir\ukird\ukirc.dll
[%PROGRAM_FILES_COMMON%]\ukir\ukird\vocabulary
[%PROGRAM_FILES_COMMON%]\ukir\ukirl.exe
[%PROGRAM_FILES_COMMON%]\ukir\ukirp.exe
[%PROGRAM_FILES_COMMON%]\umkk\umkkd\class-barrel
[%PROGRAM_FILES_COMMON%]\umkk\umkkd\vocabulary
[%PROGRAM_FILES_COMMON%]\uuuo\uuuoa.exe
[%PROGRAM_FILES_COMMON%]\uuuo\uuuod\uuuoc.dll
[%PROGRAM_FILES_COMMON%]\uuuo\uuuom.exe
[%PROGRAM_FILES_COMMON%]\wizk\wizkd\class-barrel
[%PROGRAM_FILES_COMMON%]\wizk\wizkd\vocabulary
[%PROGRAM_FILES_COMMON%]\wkqm\wkqma.exe
[%PROGRAM_FILES_COMMON%]\wkqm\wkqmd\wkqmc.dll
[%PROGRAM_FILES_COMMON%]\wkqm\wkqmm.exe
[%PROGRAM_FILES_COMMON%]\wufu\wufud\class-barrel
[%PROGRAM_FILES_COMMON%]\wufu\wufud\vocabulary
[%PROGRAM_FILES_COMMON%]\wuru\wurud\class-barrel
[%PROGRAM_FILES_COMMON%]\wuru\wurud\vocabulary
[%PROGRAM_FILES_COMMON%]\wuru\wurud\wuruc.dll
[%PROGRAM_FILES_COMMON%]\wuru\wurup.exe
[%PROGRAM_FILES_COMMON%]\wwro\wwroa.exe
[%PROGRAM_FILES_COMMON%]\wwro\wwrod\wwroc.dll
[%PROGRAM_FILES_COMMON%]\wwro\wwrom.exe
[%PROGRAM_FILES_COMMON%]\zqkk\zqkka.exe
[%PROGRAM_FILES_COMMON%]\zqkk\zqkkm.exe
[%SYSTEM%]\tsuninst.exe
[%SYSTEM%]\tsuninst.exe.ren
[%WINDOWS%]\stub_113_4_0_4_0.exe
[%WINDOWS%]\Temp\tsinstall_4_0_4_0_b4.exe
[%WINDOWS%]\Temp\tsupdate_4_0_4_1_b3.exe
[%PROFILE_TEMP%]\tsinstall_4_0_3_8_b17.exe
[%PROFILE_TEMP%]\tsupdate_4_0_3_9_b2.exe
[%WINDOWS%]\stub_110_4_0_4_0.exe
[%PROFILE_TEMP%]\GLF10GLF10.EXE
[%PROFILE_TEMP%]\GLF123GLF123.EXE
[%PROFILE_TEMP%]\GLF12EGLF12E.EXE
[%PROFILE_TEMP%]\GLF25GLF25.EXE
[%PROFILE_TEMP%]\GLF266GLF266.EXE
[%PROFILE_TEMP%]\GLF26GLF26.EXE
[%PROFILE_TEMP%]\GLF2AGLF2A.EXE
[%PROFILE_TEMP%]\GLF35GLF35.EXE
[%PROFILE_TEMP%]\GLF3E3GLF3E3.EXE
[%PROFILE_TEMP%]\GLF42GLF42.EXE
[%PROFILE_TEMP%]\GLF6AGLF6A.EXE
[%PROFILE_TEMP%]\GLF7FGLF7F.EXE
[%PROFILE_TEMP%]\GLF82GLF82.EXE
[%PROFILE_TEMP%]\tsinstall_4_0_3_7.exe
[%PROFILE_TEMP%]\tsinstall_4_0_4_0_b4.exe
[%PROFILE_TEMP%]\tsupdate_4_0_4_1_b3.exe
[%PROGRAM_FILES_COMMON%]\imzk\imzkm.exe
[%PROGRAM_FILES_COMMON%]\kirw\kirwm.exe
[%PROGRAM_FILES_COMMON%]\kkom\kkoma.exe
[%PROGRAM_FILES_COMMON%]\kkom\kkomd\kkomc.dll
[%PROGRAM_FILES_COMMON%]\kkom\kkomm.exe
[%PROGRAM_FILES_COMMON%]\kowu\kowua.exe
[%PROGRAM_FILES_COMMON%]\kowu\kowud\kowuc.dll
[%PROGRAM_FILES_COMMON%]\kowu\kowum.exe
[%PROGRAM_FILES_COMMON%]\krrk\krrkd\class-barrel
[%PROGRAM_FILES_COMMON%]\krrk\krrkd\vocabulary
[%PROGRAM_FILES_COMMON%]\kurq\kurqa.exe
[%PROGRAM_FILES_COMMON%]\kurq\kurqd\kurqc.dll
[%PROGRAM_FILES_COMMON%]\kurq\kurqm.exe
[%PROGRAM_FILES_COMMON%]\misc002\141.exe
[%PROGRAM_FILES_COMMON%]\ommi\ommid\class-barrel
[%PROGRAM_FILES_COMMON%]\ommi\ommid\vocabulary
[%PROGRAM_FILES_COMMON%]\oqqr\oqqra.exe
[%PROGRAM_FILES_COMMON%]\oqqr\oqqrd\oqqrc.dll
[%PROGRAM_FILES_COMMON%]\oqqr\oqqrm.exe
[%PROGRAM_FILES_COMMON%]\qmwf\qmwfm.exe
[%PROGRAM_FILES_COMMON%]\rifq\rifqd\class-barrel
[%PROGRAM_FILES_COMMON%]\rifq\rifqd\vocabulary
[%PROGRAM_FILES_COMMON%]\riwz\riwza.exe
[%PROGRAM_FILES_COMMON%]\riwz\riwzm.exe
[%PROGRAM_FILES_COMMON%]\rmwk\rmwkd\class-barrel
[%PROGRAM_FILES_COMMON%]\rmwk\rmwkd\vocabulary
[%PROGRAM_FILES_COMMON%]\rwof\rwofa.exe
[%PROGRAM_FILES_COMMON%]\rwof\rwofd\rwofc.dll
[%PROGRAM_FILES_COMMON%]\rwof\rwofm.exe
[%PROGRAM_FILES_COMMON%]\ukir\ukira.exe
[%PROGRAM_FILES_COMMON%]\ukir\ukird\class-barrel
[%PROGRAM_FILES_COMMON%]\ukir\ukird\ukirc.dll
[%PROGRAM_FILES_COMMON%]\ukir\ukird\vocabulary
[%PROGRAM_FILES_COMMON%]\ukir\ukirl.exe
[%PROGRAM_FILES_COMMON%]\ukir\ukirp.exe
[%PROGRAM_FILES_COMMON%]\umkk\umkkd\class-barrel
[%PROGRAM_FILES_COMMON%]\umkk\umkkd\vocabulary
[%PROGRAM_FILES_COMMON%]\uuuo\uuuoa.exe
[%PROGRAM_FILES_COMMON%]\uuuo\uuuod\uuuoc.dll
[%PROGRAM_FILES_COMMON%]\uuuo\uuuom.exe
[%PROGRAM_FILES_COMMON%]\wizk\wizkd\class-barrel
[%PROGRAM_FILES_COMMON%]\wizk\wizkd\vocabulary
[%PROGRAM_FILES_COMMON%]\wkqm\wkqma.exe
[%PROGRAM_FILES_COMMON%]\wkqm\wkqmd\wkqmc.dll
[%PROGRAM_FILES_COMMON%]\wkqm\wkqmm.exe
[%PROGRAM_FILES_COMMON%]\wufu\wufud\class-barrel
[%PROGRAM_FILES_COMMON%]\wufu\wufud\vocabulary
[%PROGRAM_FILES_COMMON%]\wuru\wurud\class-barrel
[%PROGRAM_FILES_COMMON%]\wuru\wurud\vocabulary
[%PROGRAM_FILES_COMMON%]\wuru\wurud\wuruc.dll
[%PROGRAM_FILES_COMMON%]\wuru\wurup.exe
[%PROGRAM_FILES_COMMON%]\wwro\wwroa.exe
[%PROGRAM_FILES_COMMON%]\wwro\wwrod\wwroc.dll
[%PROGRAM_FILES_COMMON%]\wwro\wwrom.exe
[%PROGRAM_FILES_COMMON%]\zqkk\zqkka.exe
[%PROGRAM_FILES_COMMON%]\zqkk\zqkkm.exe
[%SYSTEM%]\tsuninst.exe
[%SYSTEM%]\tsuninst.exe.ren
[%WINDOWS%]\stub_113_4_0_4_0.exe
[%WINDOWS%]\Temp\tsinstall_4_0_4_0_b4.exe
[%WINDOWS%]\Temp\tsupdate_4_0_4_1_b3.exe
[%PROFILE_TEMP%]\tsinstall_4_0_3_8_b17.exe
[%PROFILE_TEMP%]\tsupdate_4_0_3_9_b2.exe
[%WINDOWS%]\stub_110_4_0_4_0.exe

Folders:
[%PROGRAM_FILES_COMMON%]\tsa
[%PROGRAM_FILES_COMMON%]\kmwo
[%PROGRAM_FILES_COMMON%]\roii
[%PROGRAM_FILES_COMMON%]\ruku
[%WINDOWS%]\ruku

Registry Keys:
HKEY_CURRENT_USER\software\tsl2
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\tsa
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\tsl installer
HKEY_LOCAL_MACHINE\software\tsa
HKEY_CURRENT_USER\software\kmwo
HKEY_CURRENT_USER\software\roii
HKEY_CURRENT_USER\software\ruku
HKEY_LOCAL_MACHINE\software\roii
HKEY_LOCAL_MACHINE\software\ruku
HKEY_LOCAL_MACHINE\software\wmkz

Registry Values:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run
HKEY_CURRENT_USER\software\tsa
HKEY_CURRENT_USER\software\tsa
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run

Removing TargetSaver:

You can download trial version of "Exterminate-It" antivirus software here, to check your computer instantly.

Or buy it to remove ALL viruses from your computer.

---

Also Be Aware of the Following Threats:
Removing CWS.Feads Trojan
VNC.CommonComponents RAT Symptoms