Archive for the 'Run' Category

« Previous Entries
Next Entries »

What is SysShield.exe, How to remove SysShield.exe

Tuesday, February 16th, 2010

SysShield.exe is a harmful program.

remove It is a component of malware or spyware, you should immediately remove it using an antivirus and antispyware program.
If that does not help, then ask us for help in the Spyware removal forum.

Name: SysShield
Filename: SysShield.exe
Registry key:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run | Windows applications server

Command: C:\Program Files\Personal Anti Malware\SysShield.exe
Startup Type: HKCU->Run
HijackThis Category: O4
HijackThis Line:

O4 – HKCU\..\Run: [Windows applications server] C:\Program Files\Personal Anti Malware\SysShield.exe

DDS Line:

uRun: [Windows applications server] C:\Program Files\Personal Anti Malware\SysShield.exe

Combofix/RSIT Line:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
“Windows applications server”=C:\Program Files\Personal Anti Malware\SysShield.exe

Description: trojan FakeAlert, component of Personal Anti Malware. Personal Anti Malware is a rogue antispyware program.

How to remove: use these Personal Anti Malware removal inbstructions.

Posted in O4, Rogue Antispyware/Antivirus, Run | No Comments »

What is PAM.exe, How to remove PAM.exe

Tuesday, February 16th, 2010

PAM.exe is a harmful program.

remove It is a component of malware or spyware, you should immediately remove it using an antivirus and antispyware program.
If that does not help, then ask us for help in the Spyware removal forum.

Name: PAM
Filename: PAM.exe
Registry key:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run | Personal Anti Malware

Command: C:\Program Files\Personal Anti Malware\PAM.exe
Startup Type: HKCU->Run
HijackThis Category: O4
HijackThis Line:

O4 – HKCU\..\Run: [Personal Anti Malware] C:\Program Files\Personal Anti Malware\PAM.exe

DDS Line:

uRun: [Personal Anti Malware] C:\Program Files\Personal Anti Malware\PAM.exe

Combofix/RSIT Line:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
“Personal Anti Malware”=C:\Program Files\Personal Anti Malware\PAM.exe

Description: core component of Personal Anti Malware. Personal Anti Malware is a rogue antispyware program.

How to remove: use these Personal Anti Malware removal instructions.

Posted in O4, Rogue Antispyware/Antivirus, Run | No Comments »

What is SE2010.exe, How to remove SE2010.exe

Monday, February 15th, 2010

SE2010.exe is a harmful program.

remove It is a component of malware or spyware, you should immediately remove it using an antivirus and antispyware program.
If that does not help, then ask us for help in the Spyware removal forum.

Name: SE2010
Filename: SE2010.exe
Registry key:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run | Security essentials 2010

Command: C:\Program Files\Securityessentials2010\SE2010.exe
Startup Type: HKCU->Run
HijackThis Category: O4
HijackThis Line:

O4 – HKCU\..\Run: [Security essentials 2010] C:\Program Files\Securityessentials2010\SE2010.exe

DDS Line:

uRun: [Security essentials 2010] C:\Program Files\Securityessentials2010\SE2010.exe

Combofix/RSIT Line:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
“Security essentials 2010″=C:\Program Files\Securityessentials2010\SE2010.exe

Description: core component of Security Essentials 2010. Security Essentials 2010 is a rogue antispyware program.

How to remove: use these Security Essentials 2010 removal instructions.

Posted in O4, Rogue Antispyware/Antivirus, Run | 2 Comments »

My Security Wall – MS176.exe

Friday, February 12th, 2010

MS176.exe is a harmful program.

remove It is a component of malware or spyware, you should immediately remove it using an antivirus and antispyware program.
If that does not help, then ask us for help in the Spyware removal forum.

Name: MS176
Filename: MS176.exe
Registry key:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run | My Security Wall

Command: C:\Documents and Settings\All Users\Application Data\15a2f\MS176.exe
Startup Type: HKCU->Run
HijackThis Category: O4
HijackThis Line:

O4 – HKCU\..\Run: [My Security Wall] “C:\Documents and Settings\All Users\Application Data\15a2f\MS176.exe” /s /d

DDS Line:

uRun: [My Security Wall] C:\Documents and Settings\All Users\Application Data\15a2f\MS176.exe

Combofix/RSIT Line:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
“My Security Wall”=C:\Documents and Settings\All Users\Application Data\15a2f\MS176.exe

Description: core component of My Security Wall. My Security Wall is a rogue antispyware program.

How to remove: use these My Security Wall removal instructions.

Posted in O4, Rogue Antispyware/Antivirus, Run | No Comments »

What is taskmandb.exe, How to remove taskmandb.exe

Friday, February 12th, 2010

taskmandb.exe is a harmful program.

remove It is a component of malware or spyware, you should immediately remove it using an antivirus and antispyware program.
If that does not help, then ask us for help in the Spyware removal forum.

Name: taskmandb
Filename: taskmandb.exe
Registry key:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run | taskmandb.exe

Command: %UserProfile%\LOCALS~1\Temp\taskmandb.exe
Startup Type: HKCU->Run
HijackThis Category: O4
HijackThis Line:

O4 – HKCU\..\Run: [taskmandb.exe] C:\DOCUME~1\comp\LOCALS~1\Temp\taskmandb.exe

DDS Line:

uRun: [taskmandb.exe] C:\DOCUME~1\comp\LOCALS~1\Temp\taskmandb.exe

Combofix/RSIT Line:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
“taskmandb.exe”=C:\DOCUME~1\comp\LOCALS~1\Temp\taskmandb.exe

Description: trojan FakeAlert

How to remove: use HijackThis + Malwarebytes` Anti-malware

Posted in O4, Run, Trojan | No Comments »

What is freddy101.exe, How to remove freddy101.exe

Friday, February 12th, 2010

freddy101.exe is a harmful program.

remove It is a component of malware or spyware, you should immediately remove it using an antivirus and antispyware program.
If that does not help, then ask us for help in the Spyware removal forum.

Name: freddy101
Filename: freddy101.exe
Registry key:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run | sysfbtray

Command: C:\windows\freddy101.exe
Startup Type: HKLM->Run
HijackThis Category: O4
HijackThis Line:

O4 – HKLM\..\Run: [sysfbtray] C:\windows\freddy101.exe

DDS Line:

mRun: [sysfbtray] C:\windows\freddy101.exe

Combofix/RSIT Line:

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
“sysfbtray”=C:\windows\freddy101.exe

Description: component of Koobface worm.

How to remove: use these Koobface removal instructions.

Posted in O4, Run, Worm | No Comments »

What is AvBho.dll, How to remove AvBho.dll

Thursday, February 11th, 2010

AvBho.dll is a harmful program.

remove It is a component of malware or spyware, you should immediately remove it using an antivirus and antispyware program.
If that does not help, then ask us for help in the Spyware removal forum.

Name: AvBho
Filename: AvBho.dll
Registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9d541c6a-573b-4888-b35e-6816e68c3620}

Command: C:\Program Files\Antivirus\AvBho.dll
CLSID: {9d541c6a-573b-4888-b35e-6816e68c3620}
Startup Type: BHO
HijackThis Category: O2
HijackThis Line:

O2 – BHO: BhoApp – {9d541c6a-573b-4888-b35e-6816e68c3620} – C:\Program Files\Antivirus\AvBho.dll

DDS Line:

BHO: BhoApp: {9d541c6a-573b-4888-b35e-6816e68c3620} – C:\Program Files\Antivirus\AvBho.dll

Combofix/RSIT Line:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9d541c6a-573b-4888-b35e-6816e68c3620}]
BhoApp – C:\Program Files\Antivirus\AvBho.dll

Description: malicious BHO module, component of Antivirus. Antivirus is a rogue antispyware program.

How to remove: use these Antivirus removal instructions.

Posted in O2, Rogue Antispyware/Antivirus, Run | No Comments »

What is freddy100.exe, How to remove freddy100.exe

Wednesday, February 10th, 2010

freddy100.exe is a harmful program.

remove It is a component of malware or spyware, you should immediately remove it using an antivirus and antispyware program.
If that does not help, then ask us for help in the Spyware removal forum.

Name: freddy100
Filename: freddy100.exe
Registry key:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run | sysfbtray

Command: C:\windows\freddy100.exe
Startup Type: HKLM->Run
HijackThis Category: O4
HijackThis Line:

O4 – HKLM\..\Run: [sysfbtray] C:\windows\freddy100.exe

DDS Line:

mRun: [sysfbtray] C:\windows\freddy100.exe

Combofix/RSIT Line:

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
“sysfbtray”=C:\windows\freddy100.exe

Description: component of koobface worm

How to remove: use these koobface removal instructions.

Posted in O4, Run, Worm | No Comments »

Security Antivirus – SA[random].exe

Wednesday, February 10th, 2010

SA[random].exe is a harmful program.

remove It is a component of malware or spyware, you should immediately remove it using an antivirus and antispyware program.
If that does not help, then ask us for help in the Spyware removal forum.

Name: SA[random]
Filename: SA[random].exe
Registry key:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run | Security Antivirus

Command: C:\Documents and Settings\All Users\Application Data\[random]\SA[random].exe
Startup Type: HKCU->Run
HijackThis Category: O4
HijackThis Line:

O4 – HKCU\..\Run: [Security Antivirus] “C:\Documents and Settings\All Users\Application Data\27a1f\SAc9a.exe” /s /d

DDS Line:

uRun: [Security Antivirus] C:\Documents and Settings\All Users\Application Data\27a1f\SAc9a.exe

Combofix/RSIT Line:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
“Security Antivirus”=C:\Documents and Settings\All Users\Application Data\27a1f\SAc9a.exe

Description: core component of Security Antivirus. Security Antivirus is a rogue antispyware program.

How to remove: use the Security Antivirus removal instructions.

Posted in O4, Rogue Antispyware/Antivirus, Run | No Comments »

What is ddexpshare.exe, How to remove ddexpshare.exe

Tuesday, February 9th, 2010

ddexpshare.exe is a harmful program.

remove It is a component of malware or spyware, you should immediately remove it using an antivirus and antispyware program.
If that does not help, then ask us for help in the Spyware removal forum.

Name: ddexpshare
Filename: ddexpshare.exe
Registry key:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run | ddexpshare.exe

Command: %UserProfile%\LOCALS~1\Temp\ddexpshare.exe
Startup Type: HKCU->Run
HijackThis Category: O4
HijackThis Line:

O4 – HKCU\..\Run: [ddexpshare.exe] C:\DOCUME~1\user\LOCALS~1\Temp\ddexpshare.exe

DDS Line:

uRun: [ddexpshare.exe] C:\DOCUME~1\user\LOCALS~1\Temp\ddexpshare.exe

Combofix/RSIT Line:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
“ddexpshare.exe”=C:\DOCUME~1\user\LOCALS~1\Temp\ddexpshare.exe [2010-02-09 786432]

Description: trojan FakeAler that uses to promote Paladin Antivirus. Paladin Antivirus is a rogue antispyware program.

How to remove: use these Paladin Antivirus removal instructions.

Posted in O4, Rogue Antispyware/Antivirus, Run | No Comments »

« Previous Entries
Next Entries »