HT Logs. Tips, FAQs, Analyze. » autorun.inf http://htlogs.com HIJACKTHIS ITEMS/REGISTRY ITEMS/HOW TO REMOVE Tue, 07 Sep 2010 14:14:44 +0000 en hourly 1 http://wordpress.org/?v=3.0 What is cgaqyi.exe, How to remove cgaqyi.exe http://htlogs.com/what-is-cgaqyi-exe-how-to-remove-cgaqyi-exe/ http://htlogs.com/what-is-cgaqyi-exe-how-to-remove-cgaqyi-exe/#comments Thu, 24 Jun 2010 12:43:13 +0000 admin http://htlogs.com/?p=1797 cgaqyi.exe is a harmful program.
remove It is a component of malware or spyware, you should immediately remove it using an antivirus and antispyware program.
If that does not help, then ask us for help in the Spyware removal forum.

Name: cgaqyi
Filename: cgaqyi.exe
Command: c:\cgaqyi.exe
Startup Type: autorun.inf
Notes: a trojan that uses autorun.inf file to run itself

How to remove: use the autorun.inf trojan removal instructions

]]> http://htlogs.com/what-is-cgaqyi-exe-how-to-remove-cgaqyi-exe/feed/ 0 What is 9fo3ar0j.exe, How to remove 9fo3ar0j.exe http://htlogs.com/what-is-9fo3ar0j-exe-how-to-remove-9fo3ar0j-exe/ http://htlogs.com/what-is-9fo3ar0j-exe-how-to-remove-9fo3ar0j-exe/#comments Fri, 22 Jan 2010 04:17:02 +0000 admin http://htlogs.com/?p=1348 9fo3ar0j.exe is a harmful program.
remove It is a component of malware or spyware, you should immediately remove it using an antivirus and antispyware program.
If that does not help, then ask us for help in the Spyware removal forum.

Name: 9fo3ar0j
Filename: 9fo3ar0j.exe
Command: c:\9fo3ar0j.exe
Startup Type: autorun.inf
Description: autorun.inf trojan also known as Mal/Generic-A [Sophos], PWS.Win32 [Ikarus], packed with ASPack [Kaspersky Lab]. The trojan is installed with herss.exe trojan.

How to remove: use these autorun.inf trojans removal instructions + run Kaspersky virus removal tool

]]> http://htlogs.com/what-is-9fo3ar0j-exe-how-to-remove-9fo3ar0j-exe/feed/ 0 What is pbudsara.exe, How to remove pbudsara.exe http://htlogs.com/what-is-pbudsara-exe-how-to-remove-pbudsara-exe/ http://htlogs.com/what-is-pbudsara-exe-how-to-remove-pbudsara-exe/#comments Tue, 01 Dec 2009 11:50:40 +0000 admin http://htlogs.com/?p=1080 pbudsara.exe is a harmful program.
remove It is a component of malware or spyware, you should immediately remove it using an antivirus and antispyware program.
If that does not help, then ask us for help in the Spyware removal forum.

Name: pbudsara
Filename: pbudsara.exe
Command: c:\pbudsara.exe
Startup Type: autorun.inf
Description: trojan that using autorun.inf files to spread inself

How to remove: use these autorun.inf trojans removal instructions

]]> http://htlogs.com/what-is-pbudsara-exe-how-to-remove-pbudsara-exe/feed/ 0 What is herss.exe, How to remove herss.exe http://htlogs.com/what-is-herss-exe-how-to-remove-herss-exe/ http://htlogs.com/what-is-herss-exe-how-to-remove-herss-exe/#comments Tue, 01 Dec 2009 11:41:59 +0000 admin http://htlogs.com/?p=1078 Run HijackThis Category: [...]]]> herss.exe is a harmful program.
remove It is a component of malware or spyware, you should immediately remove it using an antivirus and antispyware program.
If that does not help, then ask us for help in the Spyware removal forum.

Name: herss
Filename: herss.exe
Registry key:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run | cdoosoft

Command: %Temp%\herss.exe
Startup Type: HKCU->Run
HijackThis Category: O4
HijackThis Line:

O4 – HKCU\..\Run: [cdoosoft] %Temp%\herss.exe

DDS Line:

uRun: [cdoosoft] %Temp%\herss.exe

Combofix/RSIT Line:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
“cdoosoft”=%Temp%\herss.exe

Description: trojan also known as Trojan-GameThief.Win32.Magania.cmla [Kaspersky Lab], Mal/Taterf-A [Sophos], Worm:Win32/Taterf.B [Microsoft], Trojan.Win32.Inhoo [Ikarus]

How to remove: use HijackThis + these autorun.inf trojans removal instructions.

]]> http://htlogs.com/what-is-herss-exe-how-to-remove-herss-exe/feed/ 0 What is rise.exe, How to remove rise.exe http://htlogs.com/what-is-rise-exe-how-to-remove-rise-exe/ http://htlogs.com/what-is-rise-exe-how-to-remove-rise-exe/#comments Fri, 23 Oct 2009 11:28:13 +0000 admin http://htlogs.com/?p=884 This is a harmful program.
remove It is a component of malware or spyware, you should immediately remove it using an antivirus and antispyware program.
If that does not help, then ask us for help in the Spyware removal forum.

Name: rise
Filename: rise.exe
Registry key:

HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b8396306-163b-11de-acda-001a4df2dae2}

Command: F:\RESTORE\S-1-5-21-1482476501-1644491937-682003330-1013\rise.exe
CLSID: {b8396306-163b-11de-acda-001a4df2dae2}
Startup Type: autorun.inf
Combofix/RSIT Line:

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b8396306-163b-11de-acda-001a4df2dae2}]
shell\AutoRun\command – F:\RESTORE\S-1-5-21-1482476501-1644491937-682003330-1013\rise.exe
shell\open\command – F:\RESTORE\S-1-5-21-1482476501-1644491937-682003330-1013\rise.exe

Description: a trojan that uses autorun.inf file to spread itself

How to remove: use these autorun.inf trojans removal instructions, after that manually remove rise.exe

]]> http://htlogs.com/what-is-rise-exe-how-to-remove-rise-exe/feed/ 0 ise32.exe is autorun.inf trojan http://htlogs.com/ise32-exe-is-autorun-inf-trojan/ http://htlogs.com/ise32-exe-is-autorun-inf-trojan/#comments Mon, 21 Sep 2009 04:23:57 +0000 admin http://htlogs.com/?p=774 ise32.exe is a harmful program.
remove It is a component of malware or spyware, you should immediately remove it using an antivirus and antispyware program.
If that does not help, then ask us for help in the Spyware removal forum.

Name: ise32
Filename: ise32.exe
Registry key:

HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{dac57b3a-30d1-11dd-ad23-0008a1a9244d}

Command: E:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\ise32.exe
CLSID: {dac57b3a-30d1-11dd-ad23-0008a1a9244d}
Startup Type: autorun.inf
Combofix/RSIT Line:

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{dac57b3a-30d1-11dd-ad23-0008a1a9244d}]
shell\AutoRun\command – E:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\ise32.exe
shell\open\command – E:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\ise32.exe

Description: autorun.inf trojan also known as Trojan-DDoS.Win32.Agent

How to remove: use these autorun.inf trojans removal instructions + use Kaspersky virus removal tool

]]> http://htlogs.com/ise32-exe-is-autorun-inf-trojan/feed/ 0 jwgkvsq.vmx is component of Conficker worm http://htlogs.com/jwgkvsq-vmx-is-component-of-conficker-worm/ http://htlogs.com/jwgkvsq-vmx-is-component-of-conficker-worm/#comments Sun, 26 Jul 2009 13:22:44 +0000 admin http://htlogs.com/?p=653 This is a harmful program.
remove It is a component of malware or spyware, you should immediately remove it using an antivirus and antispyware program.
If that does not help, then ask us for help in the Spyware removal forum.

Name: jwgkvsq
Filename: jwgkvsq.vmx
Registry key:

HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{adaa1c54-332e-11de-bf44-001c25045ca7}

Command: F:\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx
CLSID: {adaa1c54-332e-11de-bf44-001c25045ca7}
Startup Type: autorun.inf
Combofix/RSIT Line:

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{adaa1c54-332e-11de-bf44-001c25045ca7}]
shell\AutoRun\command – C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RuNdLl32.EXE .\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx,ahaezedrn

Description: component of Conficker worm also known as Kido worm

How to remove: use these Conficker removal instructions

]]> http://htlogs.com/jwgkvsq-vmx-is-component-of-conficker-worm/feed/ 2 brzycg.exe is an autorun.inf trojan http://htlogs.com/brzycgexe-is-an-autoruninf-trojan/ http://htlogs.com/brzycgexe-is-an-autoruninf-trojan/#comments Sat, 13 Jun 2009 02:14:44 +0000 admin http://htlogs.com/?p=540 This is a harmful program.
remove It is a component of malware or spyware, you should immediately remove it using an antivirus and antispyware program.
If that does not help, then ask us for help in the Spyware removal forum.

Name: brzycg
Filename: brzycg.exe
Registry key:

HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\ {fd700ec2-fc05-11dd-b448-001fd00766ec}

CLSID: {fd700ec2-fc05-11dd-b448-001fd00766ec}
Startup Type: autorun.inf
Combofix/RSIT Line:

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fd700ec2-fc05-11dd-b448-001fd00766ec}]
shell\AutoRun\command – brzycg.exe
shell\explore\command – brzycg.exe
shell\open\command – brzycg.exe

Description: an autorun.inf trojan

How to remove: read the article – How to remove trojans that uses autorun.inf file

]]> http://htlogs.com/brzycgexe-is-an-autoruninf-trojan/feed/ 0 uxdeiect.com is malware, autorun.inf trojan http://htlogs.com/uxdeiectcom-is-malware-autoruninf-trojan/ http://htlogs.com/uxdeiectcom-is-malware-autoruninf-trojan/#comments Mon, 30 Mar 2009 14:24:31 +0000 admin http://htlogs.com/?p=335 This is an harmful program.
remove It is a component of malware or spyware, you should immediately remove it using an antivirus and antispyware program.
If that does not help, then ask us for help in the Spyware removal forum.

Name: uxdeiect
Filename: uxdeiect.com
CLSID: {8e508249-a76f-11dd-8359-001e4cf19625}
Startup Type: autorun.inf
Combofix/RSIT Line:

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8e508249-a76f-11dd-8359-001e4cf19625}]
shell\AutoRun\command – uxdeiect.com
shell\explore\command – uxdeiect.com
shell\open\command – uxdeiect.com

Description: malware (autorun.inf trojan)

How to remove: use the instructions How to remove trojans that uses autorun.inf file + manually remove the file.

]]> http://htlogs.com/uxdeiectcom-is-malware-autoruninf-trojan/feed/ 0 printer.exe is a malware, autorun.inf trojan http://htlogs.com/printerexe-is-a-malware-autoruninf-trojan/ http://htlogs.com/printerexe-is-a-malware-autoruninf-trojan/#comments Mon, 30 Mar 2009 14:20:59 +0000 admin http://htlogs.com/?p=332 This is an harmful program.
remove It is a component of malware or spyware, you should immediately remove it using an antivirus and antispyware program.
If that does not help, then ask us for help in the Spyware removal forum.

Name: printer
Filename: printer.exe
CLSID: {86d2e059-9871-11dd-94d9-001e4cf19625}
Startup Type: autorun.inf

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{86d2e059-9871-11dd-94d9-001e4cf19625}]
shell\Auto\command – F:\printer.exe
shell\AutoRun\command – C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL F:\printer.exe

Description: malware (autorun.inf trojan)

How to remove: use the instructions How to remove trojans that uses autorun.inf file + manually remove the file.

]]> http://htlogs.com/printerexe-is-a-malware-autoruninf-trojan/feed/ 0