ICQ.PWS Trojan

Removing ICQ.PWS
Categories: Trojan,Hacker Tool
This loose category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

Multi-purpose Trojans are also included in this group, as some virus writers
create multi-functional Trojans rather than Trojan packs.
These utilities are designed to penetrate remote computers
in order to use them as zombies (by using backdoors) or to download other malicious programs to computer.

Exploits use vulnerabilities in operating systems and applications to achieve the same result.

---

ICQ.PWS Also known as:

[Kaspersky]Trojan.PSW.Coced.226,Trojan.PSW.Coced.227.a,Trojan-PSW.Win32.Coced.226,Trojan-PSW.Win32.Coced.227.a,Trojan.PSW.Coced.231,Trojan-PSW.Win32.Coced.231,Trojan.PSW.Coced.231.b,Trojan.PSW.Coced.233,Trojan.PSW.Coced.234,Trojan.PSW.Icup,Trojan.PSW.Coced.230,Trojan.PSW.Coced.229.b,Trojan.PSW.GOPtrojan.12;
[Eset]Naebi.2_26 trojan,Naebi.227.A trojan,Naebi.2_31.A trojan,Naebi.2_31.B trojan,Naebi.2_33 trojan,Naebi.2_34 trojan,Win32/PSW.Coced.234 trojan,Naebi.2_30 trojan,Naebi.2_29 trojan;
[McAfee]ICQ-PWS,PWS.gen,PWS-CP,PWS-CE;
[F-Prot]Trojan.Coced.227,W32/Trojan.Coced.226,Trojan.Coced.231,W32/Trojan.Coced.231,security risk or a "backdoor" program,destructive program;
[Panda]Trj/Coced.227,Trj/Coced.231,Trj/Coced.232,Trj/Coced.234,Trj/PSW.Coced.234,Trj/PSW.Coced233,Trj/PSW.Icup,Trj/Coced.230,Trj/PSW.Coced.229.b,Trj/PSW.Gop.12,Trojan Horse;
[Computer Associates]Win32.PSW.Coced.227,Win32/Coced.2.2.6!PWS!Trojan,Win32/Coced.227.ASPask!PWS!Troja,Win32.PSW.Coced.231,Win32/Coced.231!PWS!Trojan,Win32/Coced.231.ASPask!PWS!Troja,Win32.PSW.Coced.2321,Win32/Coced!PWS!Trojan,Win32.PSW.Coced.2342,Win32/Coced.233!PWS!Trojan,Win95/Coce2225!Dropper,Win32/Icup!PWS!Trojan,Win32.PSW.Coced.230,Win32/Coced.230!PWS!Trojan,Win32/Coced.230.ASPask!PWS!Troja,Win32/Coced.229.B!PWS!Trojan,Win32.PSW.OICQ2001,Win32/MultiDropper.AF-0!Dropper,Win32/OICQ2001!PWS!Trojan

How to detect ICQ.PWS:

Registry Values:
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\eventlog\application\easymail pop3 object
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\eventlog\application\easymail pop3 object

Removing ICQ.PWS:

You can download trial version of "Exterminate-It" antivirus software here, to check your computer instantly.

Or buy it to remove ALL viruses from your computer.

---

Also Be Aware of the Following Threats:
Remove QZap12 Trojan

Rbot.EGV Trojan

Removing Rbot.EGV
Categories: Trojan
This category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

---

Rbot.EGV Also known as:

[Kaspersky]Backdoor.Win32.Rbot.akq;
[F-Prot]W32/Spybot.OBT;
[Other]W32/Rbot.EGV,W32/Rbot-BCD

---

Visible Symptoms:
Files in system folders:
[%SYSTEM%]\recyclecl.exe
[%SYSTEM%]\aspr_keys.ini
[%SYSTEM%]\recyclecl.exe
[%SYSTEM%]\aspr_keys.ini

How to detect Rbot.EGV:

Files:
[%SYSTEM%]\recyclecl.exe
[%SYSTEM%]\aspr_keys.ini
[%SYSTEM%]\recyclecl.exe
[%SYSTEM%]\aspr_keys.ini

Registry Values:
HKEY_CURRENT_USER\software\microsoft\ole
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\runservices
HKEY_CURRENT_USER\system\currentcontrolset\control\lsa
HKEY_LOCAL_MACHINE\software\microsoft\ole
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runservices
HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa

Removing Rbot.EGV:

You can download trial version of "Exterminate-It" antivirus software here, to check your computer instantly.

Or buy it to remove ALL viruses from your computer.

---

Also Be Aware of the Following Threats:
Phillippines Trojan Symptoms
SillyDL.COP Trojan Information
Ehg.aha.hitbox Tracking Cookie Information
Remove Kenny Backdoor

Applets Trojan

Removing Applets
Categories: Trojan,Backdoor
This loose category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

Multi-purpose Trojans are also included in this group, as some virus writers
create multi-functional Trojans rather than Trojan packs.
Backdoors are used by virus writers to detect and download confidential information,
execute malicious code, destroy data, include the machine in bot networks and so forth.

---

Applets Also known as:

[Kaspersky]Backdoor.NetTerrorist;
[Eset]Win32/NetTerrorist trojan;
[McAfee]BackDoor-LI;
[F-Prot]security risk or a "backdoor" program;
[Panda]Bck/NetTerrorist;
[Computer Associates]Backdoor/NetTerrorist!Client

---

Visible Symptoms:
Files in system folders:
[%PROFILE_TEMP%]\RarSFX0\pwdump2\getpid.c
[%PROFILE_TEMP%]\RarSFX1\pwdump2\getpid.c
[%PROFILE_TEMP%]\RarSFX2\pwdump2\getpid.c
[%PROFILE_TEMP%]\RarSFX0\pwdump2\getpid.c
[%PROFILE_TEMP%]\RarSFX1\pwdump2\getpid.c
[%PROFILE_TEMP%]\RarSFX2\pwdump2\getpid.c

How to detect Applets:

Files:
[%PROFILE_TEMP%]\RarSFX0\pwdump2\getpid.c
[%PROFILE_TEMP%]\RarSFX1\pwdump2\getpid.c
[%PROFILE_TEMP%]\RarSFX2\pwdump2\getpid.c
[%PROFILE_TEMP%]\RarSFX0\pwdump2\getpid.c
[%PROFILE_TEMP%]\RarSFX1\pwdump2\getpid.c
[%PROFILE_TEMP%]\RarSFX2\pwdump2\getpid.c

Removing Applets:

You can download trial version of "Exterminate-It" antivirus software here, to check your computer instantly.

Or buy it to remove ALL viruses from your computer.

---

Also Be Aware of the Following Threats:
The.mstream.distributed.denial.of.service.attack.tool DoS Information
Removing Win32.Swizzor.fg Trojan
Removing Malware Toolbar Toolbar

Romelp Trojan

Removing Romelp
Categories: Trojan
This loose category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

Multi-purpose Trojans are also included in this group, as some virus writers
create multi-functional Trojans rather than Trojan packs.

---

Romelp Also known as:

[Kaspersky]Trojan-PSW.Win32.WOW.pq;
[Other]Win32/Romelp.E

---

Visible Symptoms:
Files in system folders:
[%PROFILE_TEMP%]\Tmp2.tmp.rom
[%PROFILE_TEMP%]\~Tm1.tmp.rom
[%PROFILE_TEMP%]\Tmp2.tmp.rom
[%PROFILE_TEMP%]\~Tm1.tmp.rom

How to detect Romelp:

Files:
[%PROFILE_TEMP%]\Tmp2.tmp.rom
[%PROFILE_TEMP%]\~Tm1.tmp.rom
[%PROFILE_TEMP%]\Tmp2.tmp.rom
[%PROFILE_TEMP%]\~Tm1.tmp.rom

Registry Values:
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run

Removing Romelp:

You can download trial version of "Exterminate-It" antivirus software here, to check your computer instantly.

Or buy it to remove ALL viruses from your computer.

---

Also Be Aware of the Following Threats:
RealMedia.com Tracking Cookie Cleaner

Rotcev Trojan

Removing Rotcev
Categories: Trojan
This category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

---

Visible Symptoms:
Files in system folders:
[%SYSTEM%]\adodbc.exe
[%SYSTEM%]\adodbc.exe

How to detect Rotcev:

Files:
[%SYSTEM%]\adodbc.exe
[%SYSTEM%]\adodbc.exe

Removing Rotcev:

You can download trial version of "Exterminate-It" antivirus software here, to check your computer instantly.

Or buy it to remove ALL viruses from your computer.

---

Also Be Aware of the Following Threats:
Removing TrojanDownloader.Win32.Cmjdown Trojan

Frethog Trojan

Removing Frethog
Categories: Trojan,Hacker Tool
This category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.
Exploits use vulnerabilities in operating systems and applications to achieve the same result.

---

Frethog Also known as:

[Kaspersky]Trojan-PSW.Win32.Agent.iu,Trojan-PWS.Win32.Agent.iu,Trojan-PSW.Win32.OnLineGames.bs,Trojan-PSW.Win32.OnLineGame.bs,Trojan-PSW.Win32.OnLineGames.es,Trojan-PSW.Win32.OnLineGames.gs,Trojan-PWS.Win32.WOW.qf,Trojan-PSW.Win32.OnLineGame.gs,Trojan-PSW.Win32.WOW.qr,Trojan-PSW.Win32.OnLineGames.qp,Trojan-PSW.Win32.OnLineGames.tz,Trojan-PSW.Win32.OnLineGames.uf,Trojan-PSW.Win32.OnLineGames.mp,Trojan.Win32.Qhost.Ip,Trojan-PSW.Win32.OnLineGames.tk,Trojan-PSW.Win32.Nilage.bju,Trojan-Downloader.Win32.Agent.bna,Trojan-PSW.Win32.OnLinesGames.es,Trojan-PSW.Win32.OnLineGames.te,Trojan-PSW.Win32.WOW.qo,Trojan-PSW.WIn32.OnLineGames.xg,Trojan-PSW.Win32.OnLineGames.sc,Trojan-PSW.Win32.OnLineGames.sy,Trojan-PSW.Win32.OnLineGames.ry,Trojan-PSW.Win32.OnLineGames.ox,Trojan-PSW.Win32.OnlineGames.wz,Trojan-PSW.Win32.OnLineGames.tl,Trojan-PSW.Win32.OnLineGames.yn,Trojan-PSW.Win32.Small.cf,Worm.Win32.Agent.aj,Trojan-PSW.Win32.OnLineGames.kw,Trojan-PWS.OnLineGames.aci,Trojan-Downloader.Win32.Agent.bek,Trojan-Downloader.Win32.Agent.dey,Trojan-PSW.Win32.OnLineGames.edt,Trojan-PSW.Win32.Nilage.bty;
[McAfee]PWS-Legmir.dll,PWS-Lineage,New Malware.w,PWS-LegMir.gen.b,PWS-WoW,PWS-Mmorpg.gen,PWS-LegMir,New malware.aj,Generic.PWS;
[F-Prot]W32/PWStealer.AIN,W32/PWStealer,W32/PWStealer.gen1,W32/PWStealer.JBY,W32/PWStealer.GQS,W32/PWStealer.JTI,W32/PWStealer2!Generic;
[Other]Win32/Frethog,win32/Frethog.B,Infostealer,Infostealer.Menghuan,TSPY_AGENT.FUY,Win32/Frethog.H,W32/OnLineGames.FX,Infostealer.Gampass,Win32/Frethog.BT,Win32/Frethog.BH,Win32/Frethog.BI,Win32/Frethog.BD,Win32/Frethog.AX,Win32/Frethog.BU,Infostealer.Perfwo,W32/Blackhole.LN,Mal/Packer,Win32/Frethog.AG,Win32/Frethog.BF,Win32/Frethog.DB,Win32/Frethog.DC,Win32/Frethog.DU,Win32/Frethog.IJ,Win32/Frethog.IG,Win32/Frethog.IM,Win32/Frethog.IO,Win32/Frethog.JG,Win32/Frethog!generic,Win32/Frethog.KQ,Win32/Frethog.KR,Win32/Frethog.KS,Win32/Frethog.KT,Win32/Frethog.KU,Win32/Frethog.KV,Win32/Frethog.JU,Win32/Frethog.OB,Win32/Frethog.OX,Win32/Frethog.ND,VirTool:Win32/Obfuscator.A,OnlineGames.dam,TSPY_ONLINEG.BLG,Trojan.Win32.NSAnti.b,PWS:Win32/Frethog.E,W32/OnLineGames.DDZ,TSPY_ONLINEG.BIF,Troja/PSW-Gen,Trojan-PWS.7BE35CC9,Win32/Frethog.QR,PWS:Win32/Frethog.C,W32/Horst.gen31,Win32/Frethog.QO,TSPY_ONLINEG.AXS,Win32/Frethog.QV,W32/OnLineGames.GJP,Win32/Frethog.SL,Win32/Frethog.SG,Win32/Frethog.SF,Win32/Frethog.SE,Win32/Frethog.SD,Win32/Frethog.SC,Win32/Frethog.SI,Win32/Frethog.SR,Virus:Win32/Detnat.F,W32/Viking.gen4,TROJ_Generic,Mal/EncPk-F,INfostealer.Gampass,Win32/Frethog.TI,Win32/Frethog.TH,Win32/Frethog.SS,Trojan.Packed.NsAnti,Mal/EncPk-I,Infostealer.Wowcraft,Infostealer.Gamepass,Win32/Frethog.UF,Win32/Frethog.UG,Win32/Frethog.UH,Win32/Frethog.VB,PWS:Win32/Frethog.D,W32/Suspicious_U.gen.dropper,TPSY_LEGMIR.AWY,TSPY_FRETHOG.PU,Win32/Frethog WT,Win32/Frethog.WS,Win32/Frethog.XD,Win32/Frethog.WR,PWS:Win32/Frethog.F,PWS:Win32/Frethog.gen!E,TSPY_ONLINEG.HVZ,Mal/Gampass-A,W32/Hupigon.gen67,W32/Lineage.AXZP,TSPY_NILAGE.PY

---

Visible Symptoms:
Files in system folders:
[%PROFILE_TEMP%]\woso.exe
[%PROFILE_TEMP%]\woso0.dll
[%PROFILE_TEMP%]\ztso.exe
[%PROFILE_TEMP%]\ztso0.dll
[%SYSTEM%]\dllhost32.exe
[%SYSTEM%]\mppds.dll
[%SYSTEM%]\NVDispDrv.dll
[%WINDOWS%]\mppds.exe
[%WINDOWS%]\NVDispDrv.exe
[%PROFILE%]\Temp\zts0.dll
[%PROFILE_TEMP%]\mhs0.dll
[%PROFILE_TEMP%]\mhs2.dll
[%PROFILE_TEMP%]\mhs2.exe
[%PROFILE_TEMP%]\mhso.exe
[%PROFILE_TEMP%]\mhso0.dll
[%PROFILE_TEMP%]\RavMonD.exe
[%PROFILE_TEMP%]\wgso.exe
[%PROFILE_TEMP%]\wgso0.dll
[%PROFILE_TEMP%]\wlzs.dll
[%PROFILE_TEMP%]\wlzs.exe
[%PROFILE_TEMP%]\zts2.dll
[%PROFILE_TEMP%]\zts2.exe
[%PROGRAM_FILES%]\Internet Explorer\RAVDHMON.DAT
[%PROGRAM_FILES%]\Internet Explorer\RAVDHMON.exe
[%PROGRAM_FILES%]\Internet Explorer\RAVTLMON.DAT
[%PROGRAM_FILES%]\Internet Explorer\RAVTLMON.exe
[%SYSTEM%]\cmdbcs.dll
[%SYSTEM%]\dh2103.dll
[%SYSTEM%]\DiskMan32.dll
[%SYSTEM%]\Kvsc3.dll
[%SYSTEM%]\mh104.dll
[%SYSTEM%]\MOSOU.dll
[%SYSTEM%]\mosou.exe
[%SYSTEM%]\nmhxy.dll
[%SYSTEM%]\nmhxy.exe
[%SYSTEM%]\nwizdh.exe
[%SYSTEM%]\nwiztlbb.dll
[%SYSTEM%]\nwiztlbu.exe
[%SYSTEM%]\nwizwmgjs.dll
[%SYSTEM%]\nwizwmgjs.exe
[%SYSTEM%]\nwizzhuxians.dll
[%SYSTEM%]\nwizzhuxians.exe
[%SYSTEM%]\RAV00AE.DAT
[%SYSTEM%]\RAV00AE.exe
[%SYSTEM%]\RAVMY623.dll
[%SYSTEM%]\upxdnd.dll
[%SYSTEM%]\vbsdaas2.exe
[%SYSTEM%]\WSVBRS.dll
[%SYSTEM%]\wsvbs.dll
[%SYSTEM%]\wsvbs.exe
[%SYSTEM%]\xk1s0.dll
[%WINDOWS%]\cmdbcs.exe
[%WINDOWS%]\DiskMan32.exe
[%WINDOWS%]\Kvsc3.exe
[%WINDOWS%]\mhs3.exe
[%WINDOWS%]\upxdnd.exe
[%WINDOWS%]\wsvbs.exe
[%WINDOWS%]\zts3.exe
[%PROFILE_TEMP%]\woso.exe
[%PROFILE_TEMP%]\woso0.dll
[%PROFILE_TEMP%]\ztso.exe
[%PROFILE_TEMP%]\ztso0.dll
[%SYSTEM%]\dllhost32.exe
[%SYSTEM%]\mppds.dll
[%SYSTEM%]\NVDispDrv.dll
[%WINDOWS%]\mppds.exe
[%WINDOWS%]\NVDispDrv.exe
[%PROFILE%]\Temp\zts0.dll
[%PROFILE_TEMP%]\mhs0.dll
[%PROFILE_TEMP%]\mhs2.dll
[%PROFILE_TEMP%]\mhs2.exe
[%PROFILE_TEMP%]\mhso.exe
[%PROFILE_TEMP%]\mhso0.dll
[%PROFILE_TEMP%]\RavMonD.exe
[%PROFILE_TEMP%]\wgso.exe
[%PROFILE_TEMP%]\wgso0.dll
[%PROFILE_TEMP%]\wlzs.dll
[%PROFILE_TEMP%]\wlzs.exe
[%PROFILE_TEMP%]\zts2.dll
[%PROFILE_TEMP%]\zts2.exe
[%PROGRAM_FILES%]\Internet Explorer\RAVDHMON.DAT
[%PROGRAM_FILES%]\Internet Explorer\RAVDHMON.exe
[%PROGRAM_FILES%]\Internet Explorer\RAVTLMON.DAT
[%PROGRAM_FILES%]\Internet Explorer\RAVTLMON.exe
[%SYSTEM%]\cmdbcs.dll
[%SYSTEM%]\dh2103.dll
[%SYSTEM%]\DiskMan32.dll
[%SYSTEM%]\Kvsc3.dll
[%SYSTEM%]\mh104.dll
[%SYSTEM%]\MOSOU.dll
[%SYSTEM%]\mosou.exe
[%SYSTEM%]\nmhxy.dll
[%SYSTEM%]\nmhxy.exe
[%SYSTEM%]\nwizdh.exe
[%SYSTEM%]\nwiztlbb.dll
[%SYSTEM%]\nwiztlbu.exe
[%SYSTEM%]\nwizwmgjs.dll
[%SYSTEM%]\nwizwmgjs.exe
[%SYSTEM%]\nwizzhuxians.dll
[%SYSTEM%]\nwizzhuxians.exe
[%SYSTEM%]\RAV00AE.DAT
[%SYSTEM%]\RAV00AE.exe
[%SYSTEM%]\RAVMY623.dll
[%SYSTEM%]\upxdnd.dll
[%SYSTEM%]\vbsdaas2.exe
[%SYSTEM%]\WSVBRS.dll
[%SYSTEM%]\wsvbs.dll
[%SYSTEM%]\wsvbs.exe
[%SYSTEM%]\xk1s0.dll
[%WINDOWS%]\cmdbcs.exe
[%WINDOWS%]\DiskMan32.exe
[%WINDOWS%]\Kvsc3.exe
[%WINDOWS%]\mhs3.exe
[%WINDOWS%]\upxdnd.exe
[%WINDOWS%]\wsvbs.exe
[%WINDOWS%]\zts3.exe

How to detect Frethog:

Files:
[%PROFILE_TEMP%]\woso.exe
[%PROFILE_TEMP%]\woso0.dll
[%PROFILE_TEMP%]\ztso.exe
[%PROFILE_TEMP%]\ztso0.dll
[%SYSTEM%]\dllhost32.exe
[%SYSTEM%]\mppds.dll
[%SYSTEM%]\NVDispDrv.dll
[%WINDOWS%]\mppds.exe
[%WINDOWS%]\NVDispDrv.exe
[%PROFILE%]\Temp\zts0.dll
[%PROFILE_TEMP%]\mhs0.dll
[%PROFILE_TEMP%]\mhs2.dll
[%PROFILE_TEMP%]\mhs2.exe
[%PROFILE_TEMP%]\mhso.exe
[%PROFILE_TEMP%]\mhso0.dll
[%PROFILE_TEMP%]\RavMonD.exe
[%PROFILE_TEMP%]\wgso.exe
[%PROFILE_TEMP%]\wgso0.dll
[%PROFILE_TEMP%]\wlzs.dll
[%PROFILE_TEMP%]\wlzs.exe
[%PROFILE_TEMP%]\zts2.dll
[%PROFILE_TEMP%]\zts2.exe
[%PROGRAM_FILES%]\Internet Explorer\RAVDHMON.DAT
[%PROGRAM_FILES%]\Internet Explorer\RAVDHMON.exe
[%PROGRAM_FILES%]\Internet Explorer\RAVTLMON.DAT
[%PROGRAM_FILES%]\Internet Explorer\RAVTLMON.exe
[%SYSTEM%]\cmdbcs.dll
[%SYSTEM%]\dh2103.dll
[%SYSTEM%]\DiskMan32.dll
[%SYSTEM%]\Kvsc3.dll
[%SYSTEM%]\mh104.dll
[%SYSTEM%]\MOSOU.dll
[%SYSTEM%]\mosou.exe
[%SYSTEM%]\nmhxy.dll
[%SYSTEM%]\nmhxy.exe
[%SYSTEM%]\nwizdh.exe
[%SYSTEM%]\nwiztlbb.dll
[%SYSTEM%]\nwiztlbu.exe
[%SYSTEM%]\nwizwmgjs.dll
[%SYSTEM%]\nwizwmgjs.exe
[%SYSTEM%]\nwizzhuxians.dll
[%SYSTEM%]\nwizzhuxians.exe
[%SYSTEM%]\RAV00AE.DAT
[%SYSTEM%]\RAV00AE.exe
[%SYSTEM%]\RAVMY623.dll
[%SYSTEM%]\upxdnd.dll
[%SYSTEM%]\vbsdaas2.exe
[%SYSTEM%]\WSVBRS.dll
[%SYSTEM%]\wsvbs.dll
[%SYSTEM%]\wsvbs.exe
[%SYSTEM%]\xk1s0.dll
[%WINDOWS%]\cmdbcs.exe
[%WINDOWS%]\DiskMan32.exe
[%WINDOWS%]\Kvsc3.exe
[%WINDOWS%]\mhs3.exe
[%WINDOWS%]\upxdnd.exe
[%WINDOWS%]\wsvbs.exe
[%WINDOWS%]\zts3.exe
[%PROFILE_TEMP%]\woso.exe
[%PROFILE_TEMP%]\woso0.dll
[%PROFILE_TEMP%]\ztso.exe
[%PROFILE_TEMP%]\ztso0.dll
[%SYSTEM%]\dllhost32.exe
[%SYSTEM%]\mppds.dll
[%SYSTEM%]\NVDispDrv.dll
[%WINDOWS%]\mppds.exe
[%WINDOWS%]\NVDispDrv.exe
[%PROFILE%]\Temp\zts0.dll
[%PROFILE_TEMP%]\mhs0.dll
[%PROFILE_TEMP%]\mhs2.dll
[%PROFILE_TEMP%]\mhs2.exe
[%PROFILE_TEMP%]\mhso.exe
[%PROFILE_TEMP%]\mhso0.dll
[%PROFILE_TEMP%]\RavMonD.exe
[%PROFILE_TEMP%]\wgso.exe
[%PROFILE_TEMP%]\wgso0.dll
[%PROFILE_TEMP%]\wlzs.dll
[%PROFILE_TEMP%]\wlzs.exe
[%PROFILE_TEMP%]\zts2.dll
[%PROFILE_TEMP%]\zts2.exe
[%PROGRAM_FILES%]\Internet Explorer\RAVDHMON.DAT
[%PROGRAM_FILES%]\Internet Explorer\RAVDHMON.exe
[%PROGRAM_FILES%]\Internet Explorer\RAVTLMON.DAT
[%PROGRAM_FILES%]\Internet Explorer\RAVTLMON.exe
[%SYSTEM%]\cmdbcs.dll
[%SYSTEM%]\dh2103.dll
[%SYSTEM%]\DiskMan32.dll
[%SYSTEM%]\Kvsc3.dll
[%SYSTEM%]\mh104.dll
[%SYSTEM%]\MOSOU.dll
[%SYSTEM%]\mosou.exe
[%SYSTEM%]\nmhxy.dll
[%SYSTEM%]\nmhxy.exe
[%SYSTEM%]\nwizdh.exe
[%SYSTEM%]\nwiztlbb.dll
[%SYSTEM%]\nwiztlbu.exe
[%SYSTEM%]\nwizwmgjs.dll
[%SYSTEM%]\nwizwmgjs.exe
[%SYSTEM%]\nwizzhuxians.dll
[%SYSTEM%]\nwizzhuxians.exe
[%SYSTEM%]\RAV00AE.DAT
[%SYSTEM%]\RAV00AE.exe
[%SYSTEM%]\RAVMY623.dll
[%SYSTEM%]\upxdnd.dll
[%SYSTEM%]\vbsdaas2.exe
[%SYSTEM%]\WSVBRS.dll
[%SYSTEM%]\wsvbs.dll
[%SYSTEM%]\wsvbs.exe
[%SYSTEM%]\xk1s0.dll
[%WINDOWS%]\cmdbcs.exe
[%WINDOWS%]\DiskMan32.exe
[%WINDOWS%]\Kvsc3.exe
[%WINDOWS%]\mhs3.exe
[%WINDOWS%]\upxdnd.exe
[%WINDOWS%]\wsvbs.exe
[%WINDOWS%]\zts3.exe

Registry Values:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5ff01121-f04d-30cf-64cd-74ff5fe1cf1c}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6a202101-f04d-11cf-64cd-31ff5fe1cf20}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{77709117-a10d-41cf-64cd-51ff5fe1cf41}
HKEY_LOCAL_MACHINE\software\microsoft\currentversion\run
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run

Removing Frethog:

You can download trial version of "Exterminate-It" antivirus software here, to check your computer instantly.

Or buy it to remove ALL viruses from your computer.

---

Also Be Aware of the Following Threats:
Removing Stealth.Redirector Trojan
Removing Doly.Error.Fix RAT

Orifice2K.plugin Trojan

Removing Orifice2K.plugin
Categories: Trojan,Backdoor,Hacker Tool
This category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.
Backdoors combine the functionality of most other types of in one package.
Backdoors have one especially dangerous sub-class: variants that can propagate like worms.

Hacker Tools are designed to penetrate remote computers
in order to use them as zombies or to download other malicious programs to computer.

---

Orifice2K.plugin Also known as:

[Kaspersky]TrojanDropper.Win32.SilkRope.a;
[McAfee]Orifice2k.plugin,Orifice2K.plugin;
[F-Prot]W32/Bo2K.286720;
[Panda]Trj/Runner.SilkRope;
[Other]Win32/Unssell.A

---

Visible Symptoms:
Files in system folders:
[%SYSTEM%]\$333$.exe
[%SYSTEM%]\drivers\$333$.sy
[%SYSTEM%]\$333$.exe
[%SYSTEM%]\drivers\$333$.sy

How to detect Orifice2K.plugin:

Files:
[%SYSTEM%]\$333$.exe
[%SYSTEM%]\drivers\$333$.sy
[%SYSTEM%]\$333$.exe
[%SYSTEM%]\drivers\$333$.sy

Removing Orifice2K.plugin:

You can download trial version of "Exterminate-It" antivirus software here, to check your computer instantly.

Or buy it to remove ALL viruses from your computer.

---

Also Be Aware of the Following Threats:
GoSocks Trojan Information
Sood RAT Removal instruction