HT Logs. Tips, FAQs, Analyze.

lgou.rlo is a harmful program.

It is a component of malware or spyware, you should immediately remove it using an antivirus and antispyware program. If that does not help, then ask us for help in the Spyware removal forum.

Name: lgou
Filename: lgou.rlo
Registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon | Shell

Command: Explorer.exe rundll32.exe lgou.rlo nhemkk
Startup Type: Winlogon\Shell
HijackThis Category: F2
HijackThis Line:

F2 – REG:system.ini: Shell=Explorer.exe rundll32.exe lgou.rlo nhemkk

Description: component of Bredolab trojan, also known as Trojan-Downloader.Win32.Agent.dkld [Kaspersky Lab], Mal/Oficla-A [Sophos], Trojan:Win32/Oficla.M [Microsoft]

How to remove: use HijackThis + Malwarebytes` Anti-malware

fontviewxp.exe is a harmful program.

It is a component of malware or spyware, you should immediately remove it using an antivirus and antispyware program. If that does not help, then ask us for help in the Spyware removal forum.

Name: fontviewxp
Filename: fontviewxp.exe
Registry key:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run | fontviewxp.exe

Command: %Tenp%\fontviewxp.exe
Startup Type: HKCU->Run
HijackThis Category: O4
HijackThis Line:

O4 – HKCU\..\Run: [fontviewxp.exe] C:\DOCUME~1\user\LOCALS~1\Temp\fontviewxp.exe

DDS Line:

uRun: [fontviewxp.exe] C:\DOCUME~1\user\LOCALS~1\Temp\fontviewxp.exe

Combofix/RSIT Line:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
“fontviewxp.exe”=C:\DOCUME~1\user\LOCALS~1\Temp\fontviewxp.exe

Description: a trojan fakeAlert that shows a lot of fake security alerts and installed with User Protection onto your computer. User Protection is a rogue antispyware program.

How to remove: use these User Protection removal instructions.

ccagent.exe is a harmful program.

It is a component of malware or spyware, you should immediately remove it using an antivirus and antispyware program. If that does not help, then ask us for help in the Spyware removal forum.

Name: ccagent
Filename: ccagent.exe
Registry key:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run | ccagent.exe

Command: C:\Documents and Settings\user\Application Data\Control Components\ccagent.exe
Startup Type: HKCU->Run
HijackThis Category: O4
HijackThis Line:

O4 – HKCU\..\Run: [ccagent.exe] C:\Documents and Settings\user\Application Data\Control Components\ccagent.exe

DDS Line:

uRun: [ccagent.exe] C:\Documents and Settings\user\Application Data\Control Components\ccagent.exe

Combofix/RSIT Line:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
“ccagent.exe”=C:\Documents and Settings\user\Application Data\Control Components\ccagent.exe

Description: core component of Control Components (also known as Control Center). Control Components is a fake Windows optimization program.

How to remove: use these Control Components removal instructions.

bill105.exe is a harmful program.

It is a component of malware or spyware, you should immediately remove it using an antivirus and antispyware program. If that does not help, then ask us for help in the Spyware removal forum.

Name: bill105
Filename: bill105.exe
Registry key:

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run | sysfbtray

Command: %Windir%\bill105.exe
Startup Type: HKLM->Run
HijackThis Category: O4
HijackThis Line:

O4 – HKLM\..\Run: [sysfbtray] C:\windows\bill105.exe

DDS Line:

mRun: [sysfbtray] C:\windows\bill105.exe

Combofix/RSIT Line:

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
“sysfbtray”=C:\windows\bill105.exe

Description: a component of koobface worm

How to remove: use these koobface removal instructions.

Security Guard – SG[random].exe is a harmful program.

It is a component of malware or spyware, you should immediately remove it using an antivirus and antispyware program. If that does not help, then ask us for help in the Spyware removal forum.

Name: SG[random]
Filename: SG[random].exe
Registry key:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run | Security Guard

Command: C:\Documents and Settings\All Users\Application Data\17c1f\SGf9a.exe
Startup Type: HKCU->Run
HijackThis Category: O4
HijackThis Line:

O4 – HKCU\..\Run: [Security Guard] “C:\Documents and Settings\All Users\Application Data\17c1f\SGf9a.exe” /s /d

DDS Line:

uRun: [Security Guard] C:\Documents and Settings\All Users\Application Data\17c1f\SGf9a.exe

Combofix/RSIT Line:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
“Security Guard”=C:\Documents and Settings\All Users\Application Data\17c1f\SGf9a.exe

Description: core component of Security Guard. Security Guard is a rogue antispyware progrm.

How to remove: use these Security Guard removal instructions.

nnfj.tqo is a harmful program.

It is a component of malware or spyware, you should immediately remove it using an antivirus and antispyware program. If that does not help, then ask us for help in the Spyware removal forum.

Name: nnfj
Filename: nnfj.tqo
Registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon | Shell

Command: Explorer.exe rundll32.exe nnfj.tqo nhemkk
Startup Type: Winlogon->Shell
HijackThis Category: F2
HijackThis Line:

F2 – REG:system.ini: Shell=Explorer.exe rundll32.exe nnfj.tqo nhemkk

Description: trojan also known as Trojan.Win32.Sasfis.ajil [Kaspersky Lab], SpyAgent-br.dll [McAfee], Mal/Oficla-A [Sophos], Trojan:Win32/Oficla.M [Microsoft], Win-Trojan/Xema.variant [AhnLab]

How to remove: use HijackThis + Malwarebytes` Anti-malware

Syspck32.exe is a harmful program.

It is a component of malware or spyware, you should immediately remove it using an antivirus and antispyware program. If that does not help, then ask us for help in the Spyware removal forum.

Name: Syspck32
Filename: Syspck32.exe
Command: %UserProfile%\start menu\programs\startup\Syspck32.exe
Startup Type: Startup folder
HijackThis Category: O4
HijackThis Line:

O4 – Startup: syspck32.exe

DDS Line:

StartupFolder: c:\documents and settings\user\start menu\programs\startup\syspck32.exe

Combofix/RSIT Line:

C:\Documents and Settings\user\Start Menu\Programs\Startup
syspck32.exe

Description: trojan

How to remove: use HijackThis + Malwarebytes` Anti-malware

diskperfxp.exe is a harmful program.

It is a component of malware or spyware, you should immediately remove it using an antivirus and antispyware program. If that does not help, then ask us for help in the Spyware removal forum.

Name: diskperfxp
Filename: diskperfxp.exe
Registry key:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run | diskperfxp.exe

Command: %UserProfile%\LOCALS~1\Temp\diskperfxp.exe
Startup Type: HKCU->Run
HijackThis Category: O4
HijackThis Line:

O4 – HKCU\..\Run: [diskperfxp.exe] C:\DOCUME~1\user\LOCALS~1\Temp\diskperfxp.exe

DDS Line:

uRun: [diskperfxp.exe] C:\DOCUME~1\user\LOCALS~1\Temp\diskperfxp.exe

Combofix/RSIT Line:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
“diskperfxp.exe”=C:\DOCUME~1\user\LOCALS~1\Temp\diskperfxp.exe

Description: trojan fakeAlert that displays a lot fake security alerts and downloads and installs User Protection onto your computer. User Protection is a rogue antispyware program.

How to remove: use these User Protection removal instructions.

zipdkg32.exe is a harmful program.

It is a component of malware or spyware, you should immediately remove it using an antivirus and antispyware program. If that does not help, then ask us for help in the Spyware removal forum.

Name: zipdkg32
Filename: zipdkg32.exe
Command: c:\documents and settings\user\start menu\programs\startup\zipdkg32.exe
Startup Type: Startup folder
HijackThis Category: O4
HijackThis Line:

O4 – Startup: zipdkg32.exe

DDS Line:

StartupFolder: c:\documents and settings\user\start menu\programs\startup\zipdkg32.exe

Combofix/RSIT Line:

C:\Documents and Settings\user\Start Menu\Programs\Startup
zipdkg32.exe

Description: trojan

How to remove: use HijackThis + Malwarebytes` Anti-malware

WEK9EMDHI9 is a harmful program.

It is a component of malware or spyware, you should immediately remove it using an antivirus and antispyware program. If that does not help, then ask us for help in the Spyware removal forum.

Name: WEK9EMDHI9
Filename: [ranndom].exe
Registry key:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run | WEK9EMDHI9

Command: C:\WINDOWS\Bhihuc.exe
Startup Type: HKCU->Run
HijackThis Category: O4
HijackThis Line:

O4 – HKCU\..\Run: [WEK9EMDHI9] C:\WINDOWS\Bhihuc.exe

DDS Line:

uRun: [WEK9EMDHI9] C:\WINDOWS\Bhihuc.exe

Combofix/RSIT Line:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
“WEK9EMDHI9″=C:\WINDOWS\Bhihuc.exe [2010-03-15 40448]

Description: trojan FakeAlert

How to remove: use HijackThis + Malwarebytes` Anti-malware