HT Logs. Tips, FAQs, Analyze.

monnid32.exe is a harmful program.

It is a component of malware or spyware, you should immediately remove it using an antivirus and antispyware program. If that does not help, then ask us for help in the Spyware removal forum.

Name: monnid32
Filename: monnid32.exe
Command: %userProfile%\start menu\programs\startup\monnid32.exe
Startup Type: Startup Folder
HijackThis Category: O4
HijackThis Line:

O4 – S-1-5-18 Startup: monnid32.exe (User ‘SYSTEM’)
O4 – .DEFAULT Startup: monnid32.exe (User ‘Default user’)
O4 – Startup: monnid32.exe

DDS Line:

StartupFolder: c:\documents and settings\user\start menu\programs\startup\monnid32.exe

Combofix/RSIT Line:

C:\Documents and Settings\user\Start Menu\Programs\Startup
monnid32.exe

Description: Trojan.Bredolab

How to remove: use HijackThis + Malwarebytes` Anti-malware

Virus Protector is a harmful program.

It is a component of malware or spyware, you should immediately remove it using an antivirus and antispyware program. If that does not help, then ask us for help in the Spyware removal forum.

Name: [RANDOM]
Filename: [RANDOM].exe
Registry key:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run | Virus Protector

Command: [Path]\[RANDOM].exe
Startup Type: HKCU->Run
HijackThis Category: O4
HijackThis Line:

O4 – HKCU\..\Run: [Virus Protector] [Path]\[RANDOM].exe

DDS Line:

uRun: [Virus Protector] [Path]\[RANDOM].exe

Combofix/RSIT Line:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
“Virus Protector”=[Path]\[RANDOM].exe

Description: component of Virus Protector. Virus Protector is a rogue antispyware program.

How to remove: use these Virus Protector removal instructions.

Antimalware Doctor.exe is a harmful program.

It is a component of malware or spyware, you should immediately remove it using an antivirus and antispyware program. If that does not help, then ask us for help in the Spyware removal forum.

Name: Antimalware Doctor
Filename: Antimalware Doctor.exe
Registry key:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run | Antimalware Doctor.exe

Command: C:\Windows\System32\Antimalware Doctor.exe
Startup Type: HKCU->Run
HijackThis Category: O4
HijackThis Line:

O4 – HKCU\..\Run: [Antimalware Doctor.exe] C:\Windows\System32\Antimalware Doctor.exe

DDS Line:

uRun: [Antimalware Doctor.exe] C:\Windows\System32\Antimalware Doctor.exe

Combofix/RSIT Line:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
“Antimalware Doctor.exe”=C:\Windows\System32\Antimalware Doctor.exe

Description: core component of Antimalware Doctor. Antimalware Doctor is a rogue antispyware program.

How to remove: use these Antimalware Doctor removal instructions.

eventcreatexp.exe is a harmful program.

It is a component of malware or spyware, you should immediately remove it using an antivirus and antispyware program. If that does not help, then ask us for help in the Spyware removal forum.

Name: eventcreatexp
Filename: eventcreatexp.exe
Registry key:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run | eventcreatexp.exe

Command: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\eventcreatexp.exe
Startup Type: HKCU->Run
HijackThis Category: O4
HijackThis Line:

O4 – HKCU\..\Run: [eventcreatexp.exe] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\eventcreatexp.exe

DDS Line:

uRun: [eventcreatexp.exe] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\eventcreatexp.exe

Combofix/RSIT Line:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
“eventcreatexp.exe”=C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\eventcreatexp.exe

Description: trojan FakeAlert that installed with Paladin Antivirus. Paladin Antivirus is a rogue antispyware program.

How to remove: use these Paladin Antivirus removal instructions.

SysShield.exe is a harmful program.

It is a component of malware or spyware, you should immediately remove it using an antivirus and antispyware program. If that does not help, then ask us for help in the Spyware removal forum.

Name: SysShield
Filename: SysShield.exe
Registry key:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run | Windows applications server

Command: C:\Program Files\Personal Anti Malware\SysShield.exe
Startup Type: HKCU->Run
HijackThis Category: O4
HijackThis Line:

O4 – HKCU\..\Run: [Windows applications server] C:\Program Files\Personal Anti Malware\SysShield.exe

DDS Line:

uRun: [Windows applications server] C:\Program Files\Personal Anti Malware\SysShield.exe

Combofix/RSIT Line:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
“Windows applications server”=C:\Program Files\Personal Anti Malware\SysShield.exe

Description: trojan FakeAlert, component of Personal Anti Malware. Personal Anti Malware is a rogue antispyware program.

How to remove: use these Personal Anti Malware removal inbstructions.

PAM.exe is a harmful program.

It is a component of malware or spyware, you should immediately remove it using an antivirus and antispyware program. If that does not help, then ask us for help in the Spyware removal forum.

Name: PAM
Filename: PAM.exe
Registry key:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run | Personal Anti Malware

Command: C:\Program Files\Personal Anti Malware\PAM.exe
Startup Type: HKCU->Run
HijackThis Category: O4
HijackThis Line:

O4 – HKCU\..\Run: [Personal Anti Malware] C:\Program Files\Personal Anti Malware\PAM.exe

DDS Line:

uRun: [Personal Anti Malware] C:\Program Files\Personal Anti Malware\PAM.exe

Combofix/RSIT Line:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
“Personal Anti Malware”=C:\Program Files\Personal Anti Malware\PAM.exe

Description: core component of Personal Anti Malware. Personal Anti Malware is a rogue antispyware program.

How to remove: use these Personal Anti Malware removal instructions.

SE2010.exe is a harmful program.

It is a component of malware or spyware, you should immediately remove it using an antivirus and antispyware program. If that does not help, then ask us for help in the Spyware removal forum.

Name: SE2010
Filename: SE2010.exe
Registry key:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run | Security essentials 2010

Command: C:\Program Files\Securityessentials2010\SE2010.exe
Startup Type: HKCU->Run
HijackThis Category: O4
HijackThis Line:

O4 – HKCU\..\Run: [Security essentials 2010] C:\Program Files\Securityessentials2010\SE2010.exe

DDS Line:

uRun: [Security essentials 2010] C:\Program Files\Securityessentials2010\SE2010.exe

Combofix/RSIT Line:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
“Security essentials 2010″=C:\Program Files\Securityessentials2010\SE2010.exe

Description: core component of Security Essentials 2010. Security Essentials 2010 is a rogue antispyware program.

How to remove: use these Security Essentials 2010 removal instructions.

MS176.exe is a harmful program.

It is a component of malware or spyware, you should immediately remove it using an antivirus and antispyware program. If that does not help, then ask us for help in the Spyware removal forum.

Name: MS176
Filename: MS176.exe
Registry key:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run | My Security Wall

Command: C:\Documents and Settings\All Users\Application Data\15a2f\MS176.exe
Startup Type: HKCU->Run
HijackThis Category: O4
HijackThis Line:

O4 – HKCU\..\Run: [My Security Wall] “C:\Documents and Settings\All Users\Application Data\15a2f\MS176.exe” /s /d

DDS Line:

uRun: [My Security Wall] C:\Documents and Settings\All Users\Application Data\15a2f\MS176.exe

Combofix/RSIT Line:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
“My Security Wall”=C:\Documents and Settings\All Users\Application Data\15a2f\MS176.exe

Description: core component of My Security Wall. My Security Wall is a rogue antispyware program.

How to remove: use these My Security Wall removal instructions.

taskmandb.exe is a harmful program.

It is a component of malware or spyware, you should immediately remove it using an antivirus and antispyware program. If that does not help, then ask us for help in the Spyware removal forum.

Name: taskmandb
Filename: taskmandb.exe
Registry key:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run | taskmandb.exe

Command: %UserProfile%\LOCALS~1\Temp\taskmandb.exe
Startup Type: HKCU->Run
HijackThis Category: O4
HijackThis Line:

O4 – HKCU\..\Run: [taskmandb.exe] C:\DOCUME~1\comp\LOCALS~1\Temp\taskmandb.exe

DDS Line:

uRun: [taskmandb.exe] C:\DOCUME~1\comp\LOCALS~1\Temp\taskmandb.exe

Combofix/RSIT Line:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
“taskmandb.exe”=C:\DOCUME~1\comp\LOCALS~1\Temp\taskmandb.exe

Description: trojan FakeAlert

How to remove: use HijackThis + Malwarebytes` Anti-malware

freddy101.exe is a harmful program.

It is a component of malware or spyware, you should immediately remove it using an antivirus and antispyware program. If that does not help, then ask us for help in the Spyware removal forum.

Name: freddy101
Filename: freddy101.exe
Registry key:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run | sysfbtray

Command: C:\windows\freddy101.exe
Startup Type: HKLM->Run
HijackThis Category: O4
HijackThis Line:

O4 – HKLM\..\Run: [sysfbtray] C:\windows\freddy101.exe

DDS Line:

mRun: [sysfbtray] C:\windows\freddy101.exe

Combofix/RSIT Line:

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
“sysfbtray”=C:\windows\freddy101.exe

Description: component of Koobface worm.

How to remove: use these Koobface removal instructions.