Archive for March, 2010

What is protectedlife.net, How to remove protectedlife.net

Wednesday, March 31st, 2010

protectedlife.net is a malicious website

remove The site was created to spread Antivirus Suite. If your browser is redirected to protectedlife.net, then you should immediately check your PC using an antivirus and antispyware program.
If that does not help, then ask us for help in the Spyware removal forum.

IP Address: 193.33.115.88
Site addess: protectedlife.net
Description: protectedlife.net is not related with legit security company and can only be seen on infected computers. The site used to promote the rogue antispyware program called Antivirus Suite.

How to remove: use these Antivirus Suite removal instructions in order to remove this infection.

What is protectlifesoft.microsoft.com, How to remove protectlifesoft.microsoft.com

Sunday, March 28th, 2010

protectlifesoft.microsoft.com is a malicious website

remove The site was created to spread Antivirus Soft. If your browser is redirected to protectlifesoft.microsoft.com, then you should immediately check your PC using an antivirus and antispyware program.
If that does not help, then ask us for help in the Spyware removal forum.

Site addess: protectlifesoft.microsoft.com
Description: protectlifesoft.microsoft.com is not related with Microsoft company and can only be seen on infected computers. The site used to promote the rogue antispyware program called Antivirus Soft.

How to remove: use these Antivirus Soft removal instructions in order to remove this infection.

What is protectguru.com, How to remove protectguru.com

Sunday, March 28th, 2010

protectguru.com is a malicious website

remove The site was created to spread Antivirus Soft. If your browser is redirected to protectguru.com, then you should immediately check your PC using an antivirus and antispyware program.
If that does not help, then ask us for help in the Spyware removal forum.

IP Address: 79.135.152.5
Site addess: protectguru.com
Description: protectguru.com is not related with legitimate security company and can only be seen on infected computers. The site used to promote the rogue antispyware program called Antivirus Soft.

How to remove: use these Antivirus Soft removal instructions in order to remove this infection.

What is protectlifesoft.com, How to remove protectlifesoft.com

Sunday, March 28th, 2010

protectlifesoft.com is a malicious website

remove The site was created to spread Antivirus Soft. If your browser is redirected to protectlifesoft.com, then you should immediately check your PC using an antivirus and antispyware program.
If that does not help, then ask us for help in the Spyware removal forum.

IP Address: 79.135.152.5
Site addess: protectlifesoft.com
Description: protectlifesoft.com is not related with legit security company and can only be seen on infected computers. The site used to promote the rogue antispyware program called Antivirus Soft.

How to remove: use these Antivirus Soft removal instructions in order to remove this infection.

What is fontviewxp.exe, How to remove fontviewxp.exe

Saturday, March 27th, 2010

fontviewxp.exe is a harmful program.

remove It is a component of malware or spyware, you should immediately remove it using an antivirus and antispyware program.
If that does not help, then ask us for help in the Spyware removal forum.

Name: fontviewxp
Filename: fontviewxp.exe
Registry key:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run | fontviewxp.exe

Command: %Tenp%\fontviewxp.exe
Startup Type: HKCU->Run
HijackThis Category: O4
HijackThis Line:

O4 – HKCU\..\Run: [fontviewxp.exe] C:\DOCUME~1\user\LOCALS~1\Temp\fontviewxp.exe

DDS Line:

uRun: [fontviewxp.exe] C:\DOCUME~1\user\LOCALS~1\Temp\fontviewxp.exe

Combofix/RSIT Line:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
“fontviewxp.exe”=C:\DOCUME~1\user\LOCALS~1\Temp\fontviewxp.exe

Description: a trojan fakeAlert that shows a lot of fake security alerts and installed with User Protection onto your computer. User Protection is a rogue antispyware program.

How to remove: use these User Protection removal instructions.

What is ccagent.exe, How to remove ccagent.exe

Friday, March 26th, 2010

ccagent.exe is a harmful program.

remove It is a component of malware or spyware, you should immediately remove it using an antivirus and antispyware program.
If that does not help, then ask us for help in the Spyware removal forum.

Name: ccagent
Filename: ccagent.exe
Registry key:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run | ccagent.exe

Command: C:\Documents and Settings\user\Application Data\Control Components\ccagent.exe
Startup Type: HKCU->Run
HijackThis Category: O4
HijackThis Line:

O4 – HKCU\..\Run: [ccagent.exe] C:\Documents and Settings\user\Application Data\Control Components\ccagent.exe

DDS Line:

uRun: [ccagent.exe] C:\Documents and Settings\user\Application Data\Control Components\ccagent.exe

Combofix/RSIT Line:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
“ccagent.exe”=C:\Documents and Settings\user\Application Data\Control Components\ccagent.exe

Description: core component of Control Components (also known as Control Center). Control Components is a fake Windows optimization program.

How to remove: use these Control Components removal instructions.

What is bill105.exe, How to remove bill105.exe

Friday, March 26th, 2010

bill105.exe is a harmful program.

remove It is a component of malware or spyware, you should immediately remove it using an antivirus and antispyware program.
If that does not help, then ask us for help in the Spyware removal forum.

Name: bill105
Filename: bill105.exe
Registry key:

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run | sysfbtray

Command: %Windir%\bill105.exe
Startup Type: HKLM->Run
HijackThis Category: O4
HijackThis Line:

O4 – HKLM\..\Run: [sysfbtray] C:\windows\bill105.exe

DDS Line:

mRun: [sysfbtray] C:\windows\bill105.exe

Combofix/RSIT Line:

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
“sysfbtray”=C:\windows\bill105.exe

Description: a component of koobface worm

How to remove: use these koobface removal instructions.

Security Guard – SG[random].exe

Wednesday, March 24th, 2010

Security Guard – SG[random].exe is a harmful program.

remove It is a component of malware or spyware, you should immediately remove it using an antivirus and antispyware program.
If that does not help, then ask us for help in the Spyware removal forum.

Name: SG[random]
Filename: SG[random].exe
Registry key:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run | Security Guard

Command: C:\Documents and Settings\All Users\Application Data\17c1f\SGf9a.exe
Startup Type: HKCU->Run
HijackThis Category: O4
HijackThis Line:

O4 – HKCU\..\Run: [Security Guard] “C:\Documents and Settings\All Users\Application Data\17c1f\SGf9a.exe” /s /d

DDS Line:

uRun: [Security Guard] C:\Documents and Settings\All Users\Application Data\17c1f\SGf9a.exe

Combofix/RSIT Line:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
“Security Guard”=C:\Documents and Settings\All Users\Application Data\17c1f\SGf9a.exe

Description: core component of Security Guard. Security Guard is a rogue antispyware progrm.

How to remove: use these Security Guard removal instructions.

What is nnfj.tqo, How to remove nnfj.tqo

Tuesday, March 23rd, 2010

nnfj.tqo is a harmful program.

remove It is a component of malware or spyware, you should immediately remove it using an antivirus and antispyware program.
If that does not help, then ask us for help in the Spyware removal forum.

Name: nnfj
Filename: nnfj.tqo
Registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon | Shell

Command: Explorer.exe rundll32.exe nnfj.tqo nhemkk
Startup Type: Winlogon->Shell
HijackThis Category: F2
HijackThis Line:

F2 – REG:system.ini: Shell=Explorer.exe rundll32.exe nnfj.tqo nhemkk

Description: trojan also known as Trojan.Win32.Sasfis.ajil [Kaspersky Lab], SpyAgent-br.dll [McAfee], Mal/Oficla-A [Sophos], Trojan:Win32/Oficla.M [Microsoft], Win-Trojan/Xema.variant [AhnLab]

How to remove: use HijackThis + Malwarebytes` Anti-malware

What is Virdef.net, How to remove Virdef.net

Tuesday, March 23rd, 2010

Virdef.net is a malicious website

remove The site was created to spread Antivirus Soft. If your browser is redirected to Virdef.net, then you should immediately check your PC using an antivirus and antispyware program.
If that does not help, then ask us for help in the Spyware removal forum.

IP Address: 193.33.115.89
Site addess: Virdef.net
Description: Virdef.net is not related with legitimate security company and can only be seen on infected computers. The site used to promote the rogue antispyware program called Antivirus Soft.

How to remove: use these Antivirus Soft removal instructions in order to remove this infection.