HT Logs. Tips, FAQs, Analyze.

gotnewupdate000.exe is a harmful program.

It is a component of malware or spyware, you should immediately remove it using an antivirus and antispyware program. If that does not help, then ask us for help in the Spyware removal forum.

Name: gotnewupdate000
Filename: gotnewupdate000.exe
Registry key:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run | gotnewupdate000.exe

Command: %APPDATA%\{RANDOM}\gotnewupdate000.exe
Startup Type: HKCU->Run
HijackThis Category: O4
HijackThis Line:

O4 – HKCU\..\Run: [gotnewupdate000.exe] C:\Documents and Settings\user\Application Data\764706A6742683A633F32D25CA727117\gotnewupdate000.exe

DDS Line:

uRun: [gotnewupdate000.exe] C:\Documents and Settings\user\Application Data\764706A6742683A633F32D25CA727117\gotnewupdate000.exe

Combofix/RSIT Line:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
“gotnewupdate000.exe”=C:\Documents and Settings\user\Application Data\764706A6742683A633F32D25CA727117\gotnewupdate000.exe [2010-05-17 726528]

Description: core component of Antimalware Doctor. Antimalware Doctor is a rogue antispyware program.

How to remove: use HijackThis + the Antimalware Doctor removal instructions.

Antispysolution.com is a malicious website

The site was created to spread Antispyware Soft. If your browser is redirected to Antispysolution.com, then you should immediately check your PC using an antivirus and antispyware program. If that does not help, then ask us for help in the Spyware removal forum.

IP Address: 79.135.152.155
Site addess: Antispysolution.com
Description: Antispysolution.com is not related with legit security company and can only be seen on infected computers. The site used to promote the rogue antispyware program called Antispyware Soft.

How to remove: use these Antispyware Soft removal instructions in order to remove this infection.

LiveSS.exe is a harmful program.

It is a component of malware or spyware, you should immediately remove it using an antivirus and antispyware program. If that does not help, then ask us for help in the Spyware removal forum.

Name: LiveSS
Filename: LiveSS.exe
Registry key:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run | Live Security Suite

Command: C:\Program Files\Live Security Suite\LiveSS.exe
Startup Type: HKCU->Run
HijackThis Category: O4
HijackThis Line:

O4 – HKCU\..\Run: [Live Security Suite] “C:\Program Files\Live Security Suite\LiveSS.exe” /s

DDS Line:

uRun: [Live Security Suite] C:\Program Files\Live Security Suite\LiveSS.exe

Combofix/RSIT Line:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
“Live Security Suite”=C:\Program Files\Live Security Suite\LiveSS.exe

Description: core component of Live Security Suite. Live Security Suite is a rogue antispyware program.

How to remove: use these Live Security Suite removal instructions.

Av-special.com is a malicious website

The site was created to spread Antispyware Soft. If your browser is redirected to Av-special.com, then you should immediately check your PC using an antivirus and antispyware program. If that does not help, then ask us for help in the Spyware removal forum.

IP Address: 79.135.152.155
Site addess: Av-special.com
Description: Av-special.com is not related with legitimate security company and can only be seen on infected computers. The site used to promote the rogue antispyware program called Antispyware Soft.

How to remove: use these Antispyware Soft removal instructions in order to remove this infection.

wwwzuc32.exe is a harmful program.

It is a component of malware or spyware, you should immediately remove it using an antivirus and antispyware program. If that does not help, then ask us for help in the Spyware removal forum.

Name: wwwzuc32
Filename: wwwzuc32.exe
Command: %UserProfile%\start menu\programs\startup\wwwzuc32.exe
Startup Type: Startup folder
HijackThis Category: O4
HijackThis Line:

O4 – Startup: wwwzuc32.exe

DDS Line:

StartupFolder: c:\documents and settings\user\start menu\programs\startup\wwwzuc32.exe

Combofix/RSIT Line:

C:\Documents and Settings\user\Start Menu\Programs\Startup
wwwzuc32.exe

Description: trojan downloader

How to remove: use HijackThis + Malwarebytes` Anti-malware + Kaspersky virus removal tool

Antispyfortress.com is a malicious website

The site was created to spread Antispyware Soft. If your browser is redirected to Antispyfortress.com, then you should immediately check your PC using an antivirus and antispyware program. If that does not help, then ask us for help in the Spyware removal forum.

IP Address: 79.135.152.155
Site addess: Antispyfortress.com
Description: Antispyfortress.com is not related with legit security company and can only be seen on infected computers. The site used to promote the rogue antispyware program called Antispyware Soft.

How to remove: use these Antispyware Soft removal instructions in order to remove this infection.

napstatxt.exe is a harmful program.

It is a component of malware or spyware, you should immediately remove it using an antivirus and antispyware program. If that does not help, then ask us for help in the Spyware removal forum.

Name: napstatxt
Filename: napstatxt.exe
Registry key:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run | napstatxt.exe

Command: %Temp%\napstatxt.exe
Startup Type: HKCU->Run
HijackThis Category: O4
HijackThis Line:

O4 – HKCU\..\Run: [napstatxt.exe] C:\DOCUME~1\user\LOCALS~1\Temp\napstatxt.exe

DDS Line:

uRun: [napstatxt.exe] C:\DOCUME~1\user\LOCALS~1\Temp\napstatxt.exe

Combofix/RSIT Line:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
“napstatxt.exe”=C:\DOCUME~1\user\LOCALS~1\Temp\napstatxt.exe

Description: trojan FakeAlert that installed with Data Protection. Data Protection is a rogue antispyware program.

How to remove: use these Data Protection removal instructions.

Antisywaresuite.com is a malicious website

The site was created to spread Antispyware Soft. If your browser is redirected to Antisywaresuite.com, then you should immediately check your PC using an antivirus and antispyware program. If that does not help, then ask us for help in the Spyware removal forum.

IP Address: 79.135.152.155
Site addess: Antisywaresuite.com
Description: Antisywaresuite.com is not related with legit security company and can only be seen on infected computers. The site used to promote the rogue antispyware program called Antispyware Soft.

How to remove: use these Antispyware Soft removal instructions in order to remove this infection.

datprot.exe is a harmful program.

It is a component of malware or spyware, you should immediately remove it using an antivirus and antispyware program. If that does not help, then ask us for help in the Spyware removal forum.

Name: datprot
Filename: datprot.exe
Registry key:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run | Data Protection

Command: C:\Program Files\Data Protection\datprot.exe
Startup Type: HKCU->Run
HijackThis Category: O4
HijackThis Line:

O4 – HKCU\..\Run: [Data Protection] “C:\Program Files\Data Protection\datprot.exe” -noscan

DDS Line:

uRun: [Data Protection] C:\Program Files\Data Protection\datprot.exe

Combofix/RSIT Line:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
“Data Protection”=C:\Program Files\Data Protection\datprot.exe

Description: core component of Data Protection. Data Protection is a rogue antispyware program.

How to remove: use these Data Protection removal instructions.

avtiviruspower.com is a malicious website

The site was created to spread Antispyware Soft. If your browser is redirected to avtiviruspower.com, then you should immediately check your PC using an antivirus and antispyware program. If that does not help, then ask us for help in the Spyware removal forum.

IP Address: 79.135.152.155
Site addess: avtiviruspower.com
Description: avtiviruspower.com is not related with legit security company and can only be seen on infected computers. The site used to promote the rogue antispyware program called Antispyware Soft.

How to remove: use these Antispyware Soft removal instructions in order to remove this infection.