HT Logs. Tips, FAQs, Analyze.

This is a harmful program.

It is a component of malware or spyware, you should immediately remove it using an antivirus and antispyware program. If that does not help, then ask us for help in the Spyware removal forum.

Name: scandisk
Filename: scandisk.dll
Startup Type: Startup folder
HijackThis Category: O4
HijackThis Line:

O4 – Startup: scandisk.dll
O4 – Startup: scandisk.lnk = ?

Combofix/RSIT Line:

C:\Documents and Settings\Chie Cheng\Start Menu\Programs\Startup
scandisk.dll
scandisk.lnk – C:\WINDOWS\system32\rundll32.exe

Description: a trojan also known as Trojan.Win32.Opachki and Trojan.Win32.Scar

How to remove: use HijackThis or use Malwarebytes` Anti-malware or use Kaspersky virus removal tool

mstmdm.dll is a harmful program.

It is a component of malware or spyware, you should immediately remove it using an antivirus and antispyware program. If that does not help, then ask us for help in the Spyware removal forum.

Name: mstmdm
Filename: mstmdm.dll
Registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad | UpdateCheck

Command: C:\WINDOWS\system32\mstmdm.dll
CLSID: {3D232827-DCDB-455D-9B12-8F8C7DE41935}
Startup Type: ShellServiceObjectDelayLoad
HijackThis Category: O21
HijackThis Line:

O21 – SSODL: UpdateCheck – {3D232827-DCDB-455D-9B12-8F8C7DE41935} – C:\WINDOWS\system32\mstmdm.dll

Combofix/RSIT Line:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
UpdateCheck – {3D232827-DCDB-455D-9B12-8F8C7DE41935} – C:\WINDOWS\system32\mstmdm.dll

Description: a trojans also known as Trojan.Win32.Agent.bve

How to remove: use Kaspersky virus removal tool

lsm32.sys is a harmful program.

It is a component of malware or spyware, you should immediately remove it using an antivirus and antispyware program. If that does not help, then ask us for help in the Spyware removal forum.

Name: lsm32
Filename: lsm32.sys
Command: c:\windows\system32\lsm32.sys
Description: trojan agent, installed with FastNetSrv.exe trojan

How to remove: use Malwarebytes` Anti-malware or use SUPERAntiSpyware

BtwSrv is a harmful program.

It is a component of malware or spyware, you should immediately remove it using an antivirus and antispyware program. If that does not help, then ask us for help in the Spyware removal forum.

Name: BtwSrv
Filename: BtwSrv.dll
Registry key:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\btwsrv
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\btwsrv

Startup Type: Service
Combofix/RSIT Line:

R4 BtwSrv;BtwSrv;c:\windows\system32\svchost.exe -k netsvcs [8/4/2004 6:00 AM 14336]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost – NetSvcs
BtwSrv

Description: trojan agent

How to remove: use Malwarebytes` Anti-malware or use SUPERAntiSpyware

FastNetSrv.exe is a harmful program.

It is a component of malware or spyware, you should immediately remove it using an antivirus and antispyware program. If that does not help, then ask us for help in the Spyware removal forum.

Name: FastNetSrv
Filename: FastNetSrv.exe
Command: c:\windows\SYSTEM32\FastNetSrv.exe
Startup Type: Service
HijackThis Category: O23
HijackThis Line:

O23 – Service: fastnetsrv Service (fastnetsrv) – Sigma Designs In – C:\WINDOWS\system32\FastNetSrv.exe

Combofix/RSIT Line:

R2 fastnetsrv;fastnetsrv Service;c:\windows\SYSTEM32\FastNetSrv.exe [8/4/2004 6:00 AM 93696]

Description: trojan agent

How to remove: use Malwarebytes` Anti-malware or use SUPERAntiSpyware

ikowin32.exe is a harmful program.

It is a component of malware or spyware, you should immediately remove it using an antivirus and antispyware program. If that does not help, then ask us for help in the Spyware removal forum.

Name: ikowin32
Filename: ikowin32.exe
Startup Type: Startup folder
HijackThis Category: O4
HijackThis Line:

O4 – Startup: ikowin32.exe

Description: a trojan that installed with a rogue antispyware program (Antivirus Pro 2010 for example)

How to remove: use HijackThis + use Malwarebytes` Anti-malware

restorer64_a.exe is a harmful program.

It is a component of malware or spyware, you should immediately remove it using an antivirus and antispyware program. If that does not help, then ask us for help in the Spyware removal forum.

Name: restorer64_a
Filename: restorer64_a.exe
Registry key:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run | restorer64_a
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run | restorer64_a

Command: C:\Documents and Settings\Nancy\restorer64_a.exe
Startup Type: HKLM->Run, HKCU->Run
HijackThis Category: O4
HijackThis Line:

O4 – HKLM\..\Run: [restorer64_a] C:\WINDOWS\system32\restorer64_a.exe
O4 – HKCU\..\Run: [restorer64_a] C:\Documents and Settings\Nancy\restorer64_a.exe

Combofix/RSIT Line:

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
“restorer64_a” = C:\Documents and Settings\Nancy\restorer64_a.exe
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
“restorer64_a” = C:\Documents and Settings\Nancy\restorer64_a.exe

Description: a trojan that installed with Antivirus Pro 2010 (rogue antispyware program)

How to remove: use HijackThis + use Malwarebytes` Anti-malware

This is a harmful program.

It is a component of malware or spyware, you should immediately remove it using an antivirus and antispyware program. If that does not help, then ask us for help in the Spyware removal forum.

Name: dnsq
Filename: dnsq.dll
Registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows | AppInit_DLLS

Command: C:\WINDOWS\system32\dnsq.dll
Startup Type: AppInit_DLLs
HijackThis Category: O20
HijackThis Line:

O20 – AppInit_DLLs: C:\WINDOWS\system32\dnsq.dll

Combofix/RSIT Line:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
“AppInit_DLLS”=”C:\WINDOWS\system32\dnsq.dll”

Description: trojan, also known as W32.Pagipef, TSPY_ONLINEGA.AE, Trojan-PSW.Agent, Trojan-PSW.Win32.Agent.acp, Virus.Win32.Xorer.ee

How to remove: use Kaspersky virus removal tool

This is a harmful program.

It is a component of malware or spyware, you should immediately remove it using an antivirus and antispyware program. If that does not help, then ask us for help in the Spyware removal forum.

Name: vshost32
Filename: vshost32.exe
Command: C:\DOCUME~1\8E4B~1\LOCALS~1\Temp\vshost32.exe
Startup Type: system.ini
HijackThis Category: F2
HijackThis Line:

F2 – REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\DOCUME~1\8E4B~1\LOCALS~1\Temp\vshost32.exe,

How to remove: use HijackThis + use Malwarebytes` Anti-malware

This is a harmful program.

It is a component of malware or spyware, you should immediately remove it using an antivirus and antispyware program. If that does not help, then ask us for help in the Spyware removal forum.

Name: rise
Filename: rise.exe
Registry key:

HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b8396306-163b-11de-acda-001a4df2dae2}

Command: F:\RESTORE\S-1-5-21-1482476501-1644491937-682003330-1013\rise.exe
CLSID: {b8396306-163b-11de-acda-001a4df2dae2}
Startup Type: autorun.inf
Combofix/RSIT Line:

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b8396306-163b-11de-acda-001a4df2dae2}]
shell\AutoRun\command – F:\RESTORE\S-1-5-21-1482476501-1644491937-682003330-1013\rise.exe
shell\open\command – F:\RESTORE\S-1-5-21-1482476501-1644491937-682003330-1013\rise.exe

Description: a trojan that uses autorun.inf file to spread itself

How to remove: use these autorun.inf trojans removal instructions, after that manually remove rise.exe