HT Logs. Tips, FAQs, Analyze. » O20

What is cryptnet32.dll, How to remove cryptnet32.dll

admin — Thu, 09 Dec 2010 17:51:31 +0000

This is a harmful program.

It is a component of malware or spyware, you should immediately remove it using an antivirus and antispyware program.
If that does not help, then ask us for help in the Spyware removal forum.

Name: cryptnet32
Filename: cryptnet32.dll
Registry key:

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cryptnet32

Command: C:\WINDOWS\SYSTEM32\cryptnet32.dll
Startup Type: Winlogon->Notify
HijackThis Category: O20
HijackThis Line:

O20 – Winlogon Notify: cryptnet32 – C:\WINDOWS\SYSTEM32\cryptnet32.dll

Combofix/RSIT Line:

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cryptnet32]
2010-12-08 17:31 48128 —-a-w- C:\WINDOWS\SYSTEM32\cryptnet32.dll

Description: Trojan:Win32/Lukicsel.H [Microsoft]

How to remove: use HijackThis + SUPERAntiSpyware

What is app_dll.dll, How to remove app_dll.dll

admin — Mon, 19 Apr 2010 14:26:43 +0000

app_dll.dll is a harmful program.

It is a component of malware or spyware, you should immediately remove it using an antivirus and antispyware program.
If that does not help, then ask us for help in the Spyware removal forum.

Name: app_dll
Filename: C:\Windows\System32\app_dll.dll
Registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows | AppInit_DLLS

Command: command
Startup Type: AppInit DLLs
HijackThis Category: O20
HijackThis Line:

O20 – AppInit_DLLs: app_dll.dll

DDS Line:

AppInit_DLLs: app_dll.dll

Combofix/RSIT Line:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
“AppInit_DLLS”=”C:\WINDOWS\system32\app_dll.dll”

Description: a trojan that also known as Trojan.Win32.Vilsel.rqn [Kaspersky Lab], Mal/Generic-A [Sophos]

How to remove: use HijackThis + Malwarebytes` Anti-malware

What is 0021.DLL, How to remove 0021.DLL

admin — Fri, 29 Jan 2010 19:03:04 +0000

0021.DLL is a harmful program.

It is a component of malware or spyware, you should immediately remove it using an antivirus and antispyware program.
If that does not help, then ask us for help in the Spyware removal forum.

Name: 0021
Filename: 0021.DLL
Registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows | AppInit_DLLS
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows | CrntDLL

Command: C:\WINDOWS\system32\0021.DLL
Startup Type: AppInit_DLLs + CrntDLL
HijackThis Category: O20
HijackThis Line:

O20 – AppInit_DLLs: C:\WINDOWS\system32\0021.DLL

DDS Line:

AppInit_DLLs: C:\WINDOWS\system32\0021.DLL

Combofix/RSIT Line:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
“AppInit_DLLS”=”C:\WINDOWS\system32\0021.DLL”

Description: trojan also known as Trojan-Spy.Win32.Delf.hvj [Kaspersky Lab], BackDoor-BAC [McAfee], Troj/Bckdr-RAP [Sophos], Trojan:Win32/Witkinat.A [Microsoft]

How to remove: use HijackThis + Malwarebytes` Anti-malware + Kaspersky virus removal tool

What is 0020.DLL, How to remove 0020.DLL

admin — Fri, 29 Jan 2010 18:56:44 +0000

0020.DLL is a harmful program.

It is a component of malware or spyware, you should immediately remove it using an antivirus and antispyware program.
If that does not help, then ask us for help in the Spyware removal forum.

Name: 0020
Filename: 0020.DLL
Registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows | AppInit_DLLS
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows | CrntDLL

Command: C:\WINDOWS\system32\0020.DLL
Startup Type: AppInit_DLLs + CrntDLL
HijackThis Category: O20
HijackThis Line:

O20 – AppInit_DLLs: C:\WINDOWS\system32\0020.DLL

DDS Line:

AppInit_DLLs: C:\WINDOWS\system32\0020.DLL

Combofix/RSIT Line:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
“AppInit_DLLS”=”C:\WINDOWS\system32\0020.DLL”

Description: trojan also known as Trojan-Spy.Win32.Delf.hvj [Kaspersky Lab], BackDoor-BAC [McAfee], Troj/Bckdr-RAP [Sophos], Trojan:Win32/Witkinat.A [Microsoft]

How to remove: use HijackThis + Malwarebytes` Anti-malware + Kaspersky virus removal tool

What is 0019.DLL, How to remove 0019.DLL

admin — Fri, 29 Jan 2010 18:45:46 +0000

0019.DLL is a harmful program.

It is a component of malware or spyware, you should immediately remove it using an antivirus and antispyware program.
If that does not help, then ask us for help in the Spyware removal forum.

Name: 0019
Filename: 0019.DLL
Registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows | AppInit_DLLS

Command: C:\WINDOWS\system32\0019.DLL
Startup Type: AppInit_DLLs
HijackThis Category: O20
HijackThis Line:

O20 – AppInit_DLLs: C:\WINDOWS\system32\0019.DLL

DDS Line:

AppInit_DLLs: C:\WINDOWS\system32\0019.DLL

Combofix/RSIT Line:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
“AppInit_DLLS”=”C:\WINDOWS\system32\0019.DLL”

Description: trojan agent

How to remove: use HijackThis + Malwarebytes` Anti-malware + Kaspersky virus removal tool

What is PR15.DLL, How to remove PR15.DLL

admin — Sat, 09 Jan 2010 16:03:40 +0000

PR15.DLL is a harmful program.

It is a component of malware or spyware, you should immediately remove it using an antivirus and antispyware program.
If that does not help, then ask us for help in the Spyware removal forum.

Name: PR15
Filename: PR15.DLL
Registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows | AppInit_DLLS

Command: C:\WINDOWS\system32\PR15.DLL
Startup Type: AppInit Dlls
HijackThis Category: O20
HijackThis Line:

O20 – AppInit_DLLs: C:\WINDOWS\system32\PR15.DLL

DDS Line:

AppInit_DLLs: C:\WINDOWS\system32\PR15.DLL

Combofix/RSIT Line:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
“AppInit_DLLS”=”C:\WINDOWS\system32\PR15.DLL”

Description: trojan that installed with adobemedia.exe trojan.

How to remove: use HijackThis + Kaspersky virus removal tool

What is csrss1.dll, How to remove csrss1.dll

admin — Wed, 04 Nov 2009 15:39:37 +0000

csrss1.dll is a harmful program.

It is a component of malware or spyware, you should immediately remove it using an antivirus and antispyware program.
If that does not help, then ask us for help in the Spyware removal forum.

Name: csrss1
Filename: csrss1.dll
Registry key:

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Csrss

Command: c:\windows\system32\csrss1.dll
Startup Type: Winlogon Notify
HijackThis Category: O20
HijackThis Line:

O20 – Winlogon Notify: Csrss – c:\windows\system32\csrss1.dll

Combofix/RSIT Line:

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Csrss]
2009-10-20 17:31 139264 —-a-w- c:\windows\system32\csrss1.dll

Description: unknown trojan

How to remove: use HijackThis + Malwarebytes` Anti-malware

What is dnsq.dll, How to remove dnsq.dll

admin — Fri, 23 Oct 2009 11:48:56 +0000

This is a harmful program.

It is a component of malware or spyware, you should immediately remove it using an antivirus and antispyware program.
If that does not help, then ask us for help in the Spyware removal forum.

Name: dnsq
Filename: dnsq.dll
Registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows | AppInit_DLLS

Command: C:\WINDOWS\system32\dnsq.dll
Startup Type: AppInit_DLLs
HijackThis Category: O20
HijackThis Line:

O20 – AppInit_DLLs: C:\WINDOWS\system32\dnsq.dll

Combofix/RSIT Line:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
“AppInit_DLLS”=”C:\WINDOWS\system32\dnsq.dll”

Description: trojan, also known as W32.Pagipef, TSPY_ONLINEGA.AE, Trojan-PSW.Agent, Trojan-PSW.Win32.Agent.acp, Virus.Win32.Xorer.ee

How to remove: use Kaspersky virus removal tool

cru629.dat is a component of braviax trojan

admin — Sun, 16 Aug 2009 13:07:52 +0000

This is a harmful program.

It is a component of malware or spyware, you should immediately remove it using an antivirus and antispyware program.
If that does not help, then ask us for help in the Spyware removal forum.

Name: cru629
Filename: cru629.dat
Registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows | AppInit_DLLS

Startup Type: AppInit DLLs
HijackThis Category: O20
HijackThis Line:

O20 – AppInit_DLLs: cru629.dat

Description: component of braviax trojan

How to remove: use these braviax trojan removal instructions.

liser.dll is a trojan

admin — Sun, 28 Jun 2009 03:14:14 +0000

This is a harmful program.

It is a component of malware or spyware, you should immediately remove it using an antivirus and antispyware program.
If that does not help, then ask us for help in the Spyware removal forum.

Name: liser
Filename: liser.dll
Registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows | AppInit_DLLS

Command: c:\progra~1\Manson\liser.dll
Startup Type: AppInit DLL
HijackThis Category: O20
HijackThis Line:

O20 – AppInit_DLLs: c:\progra~1\Manson\liser.dll

Combofix/RSIT Line:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
“AppInit_DLLS”=”c:\progra~1\Manson\liser.dll”

Description: trojan agent [Malwarebytes Anti-malware]

How to remove: use Malwarebytes Antimalware