Archive for January, 2010

What is incognito.exe, How to remove incognito.exe

Thursday, January 28th, 2010

incognito.exe is a harmful program.

remove It is a component of malware or spyware, you should immediately remove it using an antivirus and antispyware program.
If that does not help, then ask us for help in the Spyware removal forum.

Name: incognito
Filename: incognito.exe
Registry key:

HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{ADEEAF15-7FE8-DEDD-3FFF-4DF56EBB1DFB}

Command: c:\windows\system32\incognito.exe
CLSID: {ADEEAF15-7FE8-DEDD-3FFF-4DF56EBB1DFB}
Startup Type: Microsoft active setup
DDS Line:

mASetup: {ADEEAF15-7FE8-DEDD-3FFF-4DF56EBB1DFB} – c:\windows\system32\incognito.exe

Combofix/RSIT Line:

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{ADEEAF15-7FE8-DEDD-3FFF-4DF56EBB1DFB}]
c:\windows\system32\incognito.exe

Description: trojan also known as Trojan.Win32.Buzus.dahy [Kaspersky Lab], Mal/Generic-A [Sophos]

How to remove: use Kaspersky virus removal tool or Windows Registry editor

What is av.exe, How to remove av.exe

Thursday, January 28th, 2010

av.exe is a harmful program.

remove It is a component of malware or spyware, you should immediately remove it using an antivirus and antispyware program.
If that does not help, then ask us for help in the Spyware removal forum.

Name: av
Filename: av.exe
Registry key:

HKEY_CURRENT_USER\Software\Classes\.exe
HKEY_CURRENT_USER\Software\Classes\secfile

Command: %Appdata%\av.exe
Startup Type: File associations
Description: core component of XP Internet Security 2010. XP Internet Security 2010 also known as XP Guardian, Antivirus XP 2010 is a rogue antispyware program.

How to remove: use these XP Internet Security 2010, XP Guardian, Antivirus XP 2010 removal instructions.

What is PcSecureNet.exe, How to remove PcSecureNet.exe

Thursday, January 28th, 2010

PcSecureNet.exe is a harmful program.

remove It is a component of malware or spyware, you should immediately remove it using an antivirus and antispyware program.
If that does not help, then ask us for help in the Spyware removal forum.

Name: PcSecureNet
Filename: PcSecureNet.exe
Registry key:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run | PcSecureNet

Command: C:\Program Files\PcSecureNet Software\PcSecureNet\PcSecureNet.exe
Startup Type: HKCU->Run
HijackThis Category: O4
HijackThis Line:

O4 – HKCU\..\Run: [PcSecureNet] C:\Program Files\PcSecureNet Software\PcSecureNet\PcSecureNet.exe -min

DDS Line:

uRun: [PcSecureNet] C:\Program Files\PcSecureNet Software\PcSecureNet\PcSecureNet.exe

Combofix/RSIT Line:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
“PcSecureNet”=C:\Program Files\PcSecureNet Software\PcSecureNet\PcSecureNet.exe

Description: core component of PcSecureNet. PcSecureNet is a rogue antispyware program.

How to remove: use these PcSecureNet removal instructions.

What is IAPro.exe, How to remove IAPro.exe

Wednesday, January 27th, 2010

IAPro.exe is a harmful program.

remove It is a component of malware or spyware, you should immediately remove it using an antivirus and antispyware program.
If that does not help, then ask us for help in the Spyware removal forum.

Name: IAPro
Filename: IAPro.exe
Registry key:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run | Live Enterprise Suite

Command: C:\program files\Internet Antivirus Pro\IAPro.exe
Startup Type: HKCU->Run
HijackThis Category: O4
HijackThis Line:

O4 – HKCU\..\Run: [Live Enterprise Suite] “C:\program files\Internet Antivirus Pro\IAPro.exe” /s

DDS Line:

uRun: [Live Enterprise Suite] “c:\program files\internet antivirus pro\IAPro.exe” /s

Combofix/RSIT Line:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
“Live Enterprise Suite”=C:\program files\Internet Antivirus Pro\IAPro.exe [2010-01-27 1623552]

Description: core component of Live Enterprise Suite. Live Enterprise Suite is a rogue antispyware program.

How to remove: use these Live Enterprise Suite removal instructions.

What is PcsSecure.exe, How to remove PcsSecure.exe

Monday, January 25th, 2010

PcsSecure.exe is a harmful program.

remove It is a component of malware or spyware, you should immediately remove it using an antivirus and antispyware program.
If that does not help, then ask us for help in the Spyware removal forum.

Name: PcsSecure
Filename: PcsSecure.exe
Registry key:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run | PcsSecure

Command: C:\Program Files\PcsSecure Software\PcsSecure\PcsSecure.exe
Startup Type: HKLM->Run
HijackThis Category: O4
HijackThis Line:

O4 – HKLM\..\Run: [PcsSecure] C:\Program Files\PcsSecure Software\PcsSecure\PcsSecure.exe -min

DDS Line:

mRun: [PcsSecure] C:\Program Files\PcsSecure Software\PcsSecure\PcsSecure.exe

Combofix/RSIT Line:

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
“PcsSecure”=C:\Program Files\PcsSecure Software\PcsSecure\PcsSecure.exe

Description: core component of PcsSecure. PcsSecure is a rogue antispyware program.

How to remove: use these PcsSecure removal instructions.

What is livemessenger.exe, How to remove livemessenger.exe

Saturday, January 23rd, 2010

livemessenger.exe is a harmful program.

remove It is a component of malware or spyware, you should immediately remove it using an antivirus and antispyware program.
If that does not help, then ask us for help in the Spyware removal forum.

Name: livemessenger
Filename: livemessenger.exe
Registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run | Microsoft Update
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce | Microsoft Update
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx | Microsoft Update

Startup Type: HKLM->Run
HijackThis Category: O4
HijackThis Line:

O4 – HKLM\..\Run: [Microsoft Update] livemessenger.exe

DDS Line:

mRun: [Microsoft Update] livemessenger.exe

Combofix/RSIT Line:

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
“Microsoft Update”=livemessenger.exe

Description: Backdoor.Win32.Rbot.bll [Kaspersky Lab], W32.IRCBot [Symantec], W32/Sdbot.worm.gen.t [McAfee]

How to remove: use HijackThis + Kaspersky virus removal tool

What is msdrv32.exe, How to remove msdrv32.exe

Saturday, January 23rd, 2010

msdrv32.exe is a harmful program.

remove It is a component of malware or spyware, you should immediately remove it using an antivirus and antispyware program.
If that does not help, then ask us for help in the Spyware removal forum.

Name: msdrv32
Filename: msdrv32.exe
Registry key:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run | Microsoft Driver Setup
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run | Microsoft Driver Setup

Command: %WinDir%\msdrv32.exe
Startup Type: HKLM->Run
HijackThis Category: O4
HijackThis Line:

O4 – HKLM\..\Run: [Microsoft Driver Setup] C:\Windows\msdrv32.exe
O4 – HKLM\..\policies\Explorer\Run: [Microsoft Driver Setup] C:\Windows\msdrv32.exe

DDS Line:

mRun: [Microsoft Driver Setup] C:\Windows\msdrv32.exe

Combofix/RSIT Line:

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
“Microsoft Driver Setup”=C:\Windows\msdrv32.exe
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run]
“Microsoft Driver Setup”=C:\Windows\msdrv32.exe

Description: worm also known as Worm:Win32/Pushbot.gen [Microsoft], Backdoor.Win32.IRCBot.gen [Kaspersky Lab], Exploit-DcomRpc.gen [McAfee], Mal/Behav-134, Mal/IRCBot-B [Sophos]

How to remove: use HijackThis + Kaspersky virus removal tool

What is APcSafe.exe, How to remove APcSafe.exe

Saturday, January 23rd, 2010

APcSafe.exe is a harmful program.

remove It is a component of malware or spyware, you should immediately remove it using an antivirus and antispyware program.
If that does not help, then ask us for help in the Spyware removal forum.

Name: APcSafe
Filename: APcSafe.exe
Registry key:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run | APcSafe

Command: C:\Program Files\APcSafe Software\APcSafe\APcSafe.exe
Startup Type: HKLM->Run
HijackThis Category: O4
HijackThis Line:

O4 – HKLM\..\Run: [APcSafe] C:\Program Files\APcSafe Software\APcSafe\APcSafe.exe -min

DDS Line:

mRun: [APcSafe] C:\Program Files\APcSafe Software\APcSafe\APcSafe.exe

Combofix/RSIT Line:

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
“APcSafe”=C:\Program Files\APcSafe Software\APcSafe\APcSafe.exe

Description: core component of APcSafe. APcSafe is a rogue antispyware program.

How to remove: use these APcSafe removal instructions.

What is securitycenter.exe, How to remove securitycenter.exe

Saturday, January 23rd, 2010

securitycenter.exe is a harmful program.

remove It is a component of malware or spyware, you should immediately remove it using an antivirus and antispyware program.
If that does not help, then ask us for help in the Spyware removal forum.

Name: securitycenter
Filename: securitycenter.exe
Registry key:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run | SecurityCenter

Command: C:\Program Files\Desktop Security 2010\securitycenter.exe
Startup Type: HKLM->Run
HijackThis Category: O4
HijackThis Line:

O4 – HKLM\..\Run: [SecurityCenter] C:\Program Files\Desktop Security 2010\securitycenter.exe

DDS Line:

mRun: [SecurityCenter] C:\Program Files\Desktop Security 2010\securitycenter.exe

Combofix/RSIT Line:

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
“SecurityCenter”=C:\Program Files\Desktop Security 2010\securitycenter.exe

Description: component of Desktop Security 2010. Desktop Security 2010 is a rogue antispyware program.

How to remove: use these Desktop Security 2010 removal instructions.

What is Desktop Security 2010.exe, How to remove Desktop Security 2010.exe

Saturday, January 23rd, 2010

Desktop Security 2010.exe is a harmful program.

remove It is a component of malware or spyware, you should immediately remove it using an antivirus and antispyware program.
If that does not help, then ask us for help in the Spyware removal forum.

Name: Desktop Security 2010
Filename: Desktop Security 2010.exe
Registry key:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run | Desktop Security 2010

Command: C:\Program Files\Desktop Security 2010\Desktop Security 2010.exe
Startup Type: HKLM->Run
HijackThis Category: O4
HijackThis Line:

O4 – HKLM\..\Run: [Desktop Security 2010] C:\Program Files\Desktop Security 2010\Desktop Security 2010.exe

DDS Line:

mRun: [Desktop Security 2010] C:\Program Files\Desktop Security 2010\Desktop Security 2010.exe

Combofix/RSIT Line:

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
“Desktop Security 2010″=C:\Program Files\Desktop Security 2010\Desktop Security 2010.exe

Description: core component of Desktop Security 2010. Desktop Security 2010 is a rogue antispyware program.

How to remove: use these Desktop Security 2010 removal instructions.