HT Logs. Tips, FAQs, Analyze.

This is a harmful program.

It is a component of malware or spyware, you should immediately remove it using an antivirus and antispyware program. If that does not help, then ask us for help in the Spyware removal forum.

Name: ld08
Filename: ld08.exe
Registry key:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run | sysldtray

Command: c:\windows\ld08.exe
Startup Type: HKLM->Run
HijackThis Category: O4
HijackThis Line:

O4 – HKLM\..\Run: [sysldtray] c:\windows\ld08.exe

Description: worm koobface is a worm that spreads through Myspace and Facebook. Also known as Net-Worm.Win32.Koobface.hn, W32/Koobfa-Gen.

How to remove: use these koobface removal instructions

This is a harmful program.

It is a component of malware or spyware, you should immediately remove it using an antivirus and antispyware program. If that does not help, then ask us for help in the Spyware removal forum.

Name: virusremover
Filename: virusremover.exe
Registry key:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run | Virus Remover Profesional

Command: %ProgramFiles%\Virus Remover Professional\virusremover.exe
Startup Type: HKCU->Run
HijackThis Category: O4
HijackThis Line:

O4 – HKCU\..\Run: [Virus Remover Profesional] C:\Program Files\Virus Remover Professional\virusremover.exe

Description: main file of Virus Remover Profesional (rogue antvirus/antispyware program)

How to remove: use Malwarebytes Antimalware

This is a harmful program.

It is a component of malware or spyware, you should immediately remove it using an antivirus and antispyware program. If that does not help, then ask us for help in the Spyware removal forum.

Name: mediacodec
Filename: mediacodec.exe
Registry key:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run | mediacodec.exe

Command: %UserProfile%\Temp\mediacodec.exe
Startup Type: HKCU->Run
HijackThis Category:O4
HijackThis Line:

O4 – HKCU\..\Run: [mediacodec.exe] %UserProfile%\Temp\mediacodec.exe

Description: main file of VSCodec Pro (fake codec)

How to remove: use SmitFraudFix

This is a harmful program.

It is a component of malware or spyware, you should immediately remove it using an antivirus and antispyware program. If that does not help, then ask us for help in the Spyware removal forum.

Name: psystem
Filename: psystem.exe
Registry key:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run | Protection System

Command: C:\Program Files\Protection System\psystem.exe
Startup Type: HKCU->Run
HijackThis Category: O4
HijackThis Line:

O4 – HKCU\..\Run: [Protection System] C:\Program Files\Protection System\psystem.exe

Description: main file of Protection System (rogue antispyware program)

How to remove: use Malwarebytes Antimalware

This is a harmful program.

It is a component of malware or spyware, you should immediately remove it using an antivirus and antispyware program. If that does not help, then ask us for help in the Spyware removal forum.

Name: wingenocx
Filename: wingenocx.dll
Registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0CB66BA8-5E1F-4963-93D1-E1D6B78FE9A2}

Command: C:\WINDOWS\system32\wingenocx.dll
CLSID: {0CB66BA8-5E1F-4963-93D1-E1D6B78FE9A2}
Startup Type: BHO
HijackThis Category: O2
HijackThis Line:

O2 – BHO: BhoApp – {0CB66BA8-5E1F-4963-93D1-E1D6B78FE9A2} – C:\WINDOWS\system32\wingenocx.dll

Description: trojan BHO that installed with Protection System (rogue antispyware software)

How to remove: use Malwarebytes Antimalware

This is a harmful program.

It is a component of malware or spyware, you should immediately remove it using an antivirus and antispyware program. If that does not help, then ask us for help in the Spyware removal forum.

Name: pp10
Filename: pp10.exe
Registry key:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run | pp

Command: c:\windows\pp10.exe
Startup Type: HKLM->Run
HijackThis Category: O4
HijackThis Line:

O4 – HKLM\..\Run: [pp] c:\windows\pp10.exe

Description: component of worm koobface (spreads through social networking sites)

How to remove: use these koobface removal instructions

This is a harmful program.

It is a component of malware or spyware, you should immediately remove it using an antivirus and antispyware program. If that does not help, then ask us for help in the Spyware removal forum.

Name: ld09
Filename: ld09.exe
Registry key:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run | sysldtray

Command: c:\windows\ld09.exe
Startup Type: HKLM->Run
HijackThis Category: O4
HijackThis Line:

O4 – HKLM\..\Run: [sysldtray] c:\windows\ld09.exe

Description: worm koobface is a worm that spreads through social networking sites (Myspace and Facebook).

How to remove: use these koobface removal instructions

This is a harmful program.

It is a component of malware or spyware, you should immediately remove it using an antivirus and antispyware program. If that does not help, then ask us for help in the Spyware removal forum.

Name: podmena
Filename: podmena.sys
Command: c:\program files\podmena\podmena.sys
Startup Type: driver

R1 podmenadrv;podmenadrv;c:\program files\podmena\podmena.sys [6/8/2009 11:31 AM 9472]
R2 podmena;podmena;c:\windows\system32\svchost.exe -k podmena [8/10/2004 14336]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
podmena REG_MULTI_SZ podmena

Description: Trojan.Downloader

How to remove: use these podmena.sys removal instructions

This is a harmful program.

It is a component of malware or spyware, you should immediately remove it using an antivirus and antispyware program. If that does not help, then ask us for help in the Spyware removal forum.

Name: poswin
Filename: poswin.dll
Registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F60777DA-D6A6-40F6-B665-6F361C1017B6}

Command: C:\WINDOWS\poswin.dll
CLSID: {F60777DA-D6A6-40F6-B665-6F361C1017B6}
Startup Type: BHO
HijackThis Category: O2
HijackThis Line:

O2 – BHO: PLAsim plugin – {F60777DA-D6A6-40F6-B665-6F361C1017B6} – C:\WINDOWS\poswin.dll

Description: trojan FakeAlert

How to remove: use HijackThis + use Malwarebytes Antimalware

This is a harmful program.

It is a component of malware or spyware, you should immediately remove it using an antivirus and antispyware program. If that does not help, then ask us for help in the Spyware removal forum.

Name: rs32net
Filename: rs32net.exe
Registry key:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run | rs32net

Command: C:\WINDOWS\System32\rs32net.exe
Startup Type: HKCU->Run
HijackThis Category: O4
HijackThis Line:

O4 – HKCU\..\Run: [rs32net] C:\WINDOWS\System32\rs32net.exe

Combofix/RSIT Line:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
“rs32net”=C:\WINDOWS\System32\rs32net.exe

Description: rs32net.exe is TrojanDropper, also known as Mal/Pushdo-A [Sophos], Trojan.Pandex [Symantec], FakeAlert-AG.gen.c [McAfee],

How to remove: Use HijackThis