Trojan List 10: February 2009

Wednesday, February 4, 2009

Shabo Backdoor

Shabo description:
Shabo Category:Backdoor
Backdoors are the most dangerous type of Trojans and the most popular.
Backdoors open infected machines to external control via Internet.
Often the backdoor will not be visible in the log of active programs.

Removing Shabo:

you can run trial version of ExterminateIt, or remove Shabo manually.

To completely manually remove Shabo malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Shabo.

Bancos.HDH Trojan

Bancos.HDH description:
Bancos.HDH Category:Trojan
This loose category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

Multi-purpose Trojans are also included in this group, as some virus writers
create multi-functional Trojans rather than Trojan packs.

Removing Bancos.HDH:

you can run trial version of ExterminateIt, or remove Bancos.HDH manually.

To completely manually remove Bancos.HDH malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Bancos.HDH.

Tuesday, February 3, 2009

Let.Me.Rule! Backdoor

Click here to remove Let.Me.Rule! malware

Let.Me.Rule! description:
Let.Me.Rule! Category:Backdoor,RAT
Backdoors are used by virus writers to detect and download confidential information,
execute malicious code, destroy data, include the machine in bot networks and so forth.

Some RAT trojans are pranks that are most likely being controlled by a friend or enemy on
April Fool's day or a holiday. Prank RATS are generally not harmful, and won't log keystrokes or hack.

Removing Let.Me.Rule!:

you can run trial version of ExterminateIt, or remove Let.Me.Rule! manually.

To completely manually remove Let.Me.Rule! malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Let.Me.Rule!.

SentryRemote Spyware

Click here to remove SentryRemote malware

SentryRemote description:
SentryRemote Category:Spyware
Spyware programs can collect various types of personal information,
such as Internet surfing habit, sites that have been visited,
but can also interfere with user control of the computer in other ways,
such as installing additional software, redirecting Web browser activity,
accessing websites blindly that will cause more harmful viruses,
or diverting advertising revenue to a third party.

Detection SentryRemote :

SentryRemote Folders:
[%PROGRAM_FILES%]\SearchHelp

SentryRemote Registry Keys:
HKEY_CURRENT_USER\software\sunisoft\incupdate\sentry remote
HKEY_LOCAL_MACHINE\software\searchhelp

SentryRemote Registry Values:
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shareddlls
HKEY_LOCAL_MACHINE\software\sunisoft\incupdate\sentry remote
HKEY_LOCAL_MACHINE\software\sunisoft\incupdate\sentry remote

Removing SentryRemote:

you can run trial version of ExterminateIt, or remove SentryRemote manually.

To completely manually remove SentryRemote malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with SentryRemote.

WaveWash Trojan

WaveWash description:
WaveWash Category:Trojan
This loose category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

Multi-purpose Trojans are also included in this group, as some virus writers
create multi-functional Trojans rather than Trojan packs.

Removing WaveWash:

you can run trial version of ExterminateIt, or remove WaveWash manually.

To completely manually remove WaveWash malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with WaveWash.

Loper Spyware

Loper description:
Loper Category:Spyware
Spyware is computer software that is installed surreptitiously on a personal computer
to intercept or take partial control over the user's interaction
with the computer, without the user's informed consent.

While the term spyware suggests software that secretly monitors the user's behavior,
the functions of spyware extend well beyond simple monitoring.

Spyware programs can collect various types of personal information,
such as Internet surfing habit, sites that have been visited,
but can also interfere with user control of the computer in other ways,
such as installing additional software, redirecting Web browser activity,
accessing websites blindly that will cause more harmful viruses,
or diverting advertising revenue to a third party.

Spyware can even change computer settings, resulting in slow connection speeds,
different home pages, and loss of Internet or other programs.
In an attempt to increase the understanding of spyware, a more formal classification
of its included software types is captured under the term privacy-invasive software.

Removing Loper:

you can run trial version of ExterminateIt, or remove Loper manually.

To completely manually remove Loper malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Loper.

Afcore.an Backdoor

Afcore.an description:
Afcore.an Category:Backdoor
Backdoors are the most dangerous type of Trojans and the most popular.
Backdoors open infected machines to external control via Internet.
They function in the same way as legal remote administration programs used by system administrators.
This makes them difficult to detect.

Backdoors are installed and launched without the consent of the user of computer.
Often the backdoor will not be visible in the log of active programs.

Once a backdoor has been successfully launched, the computer is wide open.
Backdoor functions can include:

Launching/ deleting files

Sending/ receiving files

Deleting data

Displaying notification

Rebooting the machine

Executing files

Backdoors are used by virus writers to detect and download confidential information,
execute malicious code, destroy data, include the machine in bot networks and so forth.
Backdoors combine the functionality of most other types of in one package.

Backdoors have one especially dangerous sub-class: variants that can propagate like worms.

Detection Afcore.an :

Afcore.an Files:
[%SYSTEM%]\certcgii.dll
[%SYSTEM%]\datioe.dll
[%SYSTEM%]\certcgii.dll
[%SYSTEM%]\datioe.dll

Removing Afcore.an:

you can run trial version of ExterminateIt, or remove Afcore.an manually.

To completely manually remove Afcore.an malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Afcore.an.

Tourniquet.0b2 Backdoor

Click here to remove Tourniquet.0b2 malware

Tourniquet.0b2 description:
Tourniquet.0b2 Category:Backdoor,RAT
Backdoors combine the functionality of most other types of in one package.
Backdoors have one especially dangerous sub-class: variants that can propagate like worms.

Many trojans and backdoors now have remote administration capabilities
allowing an individual to control the victim's computer.
Many times a file called the server must be opened on the victim's computer before
the trojan can have access to it.

These are generally sent through email, P2P file sharing software,
and in internet downloads. They are usually disguised as a legitimate program or file.
Many server files will display a fake error message when opened, to make it seem like it didn't open.
Some will also kill antivirus and firewall software.

Some RAT trojans are pranks that are most likely being controlled by a friend or enemy on
April Fool's day or a holiday. Prank RATS are generally not harmful, and won't log keystrokes or hack.
They usually do whimsical things like flip the screen upside-down, open the CD-ROM tray,
and swap mouse buttons. However, they can be quite hard to remove.

Removing Tourniquet.0b2:

you can run trial version of ExterminateIt, or remove Tourniquet.0b2 manually.

To completely manually remove Tourniquet.0b2 malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Tourniquet.0b2.

Augudor Trojan

Augudor description:
Augudor Category:Trojan,Backdoor,RAT
This loose category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

Multi-purpose Trojans are also included in this group, as some virus writers
create multi-functional Trojans rather than Trojan packs.
Backdoors are the most dangerous type of Trojans and the most popular.
Backdoors open infected machines to external control via Internet.
Often the backdoor will not be visible in the log of active programs.
Many trojans and backdoors now have remote administration capabilities
allowing an individual to control the victim's computer.
Many times a file called the server must be opened on the victim's computer before
the trojan can have access to it.

These are generally sent through email, P2P file sharing software,
and in internet downloads. They are usually disguised as a legitimate program or file.
Many server files will display a fake error message when opened, to make it seem like it didn't open.
Some will also kill antivirus and firewall software.

Some RAT trojans are pranks that are most likely being controlled by a friend or enemy on
April Fool's day or a holiday. Prank RATS are generally not harmful, and won't log keystrokes or hack.
They usually do whimsical things like flip the screen upside-down, open the CD-ROM tray,
and swap mouse buttons. However, they can be quite hard to remove.

Removing Augudor:

you can run trial version of ExterminateIt, or remove Augudor manually.

To completely manually remove Augudor malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Augudor.

Netsphere Trojan

Netsphere description:
Netsphere Category:Trojan,Spyware,Backdoor,RAT
This loose category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

Multi-purpose Trojans are also included in this group, as some virus writers
create multi-functional Trojans rather than Trojan packs.
Spyware programs can collect various types of personal information,
such as Internet surfing habit, sites that have been visited,
but can also interfere with user control of the computer in other ways,
such as installing additional software, redirecting Web browser activity,
accessing websites blindly that will cause more harmful viruses,
or diverting advertising revenue to a third party.
Backdoors are the most dangerous type of Trojans and the most popular.
Backdoors open infected machines to external control via Internet.
They function in the same way as legal remote administration programs used by system administrators.
This makes them difficult to detect.

Backdoors are installed and launched without the consent of the user of computer.
Often the backdoor will not be visible in the log of active programs.

Once a backdoor has been successfully launched, the computer is wide open.
Backdoor functions can include:

Launching/ deleting files

Sending/ receiving files

Deleting data

Displaying notification

Rebooting the machine

Executing files

Backdoors are used by virus writers to detect and download confidential information,
execute malicious code, destroy data, include the machine in bot networks and so forth.
Backdoors combine the functionality of most other types of in one package.

Backdoors have one especially dangerous sub-class: variants that can propagate like worms.
Many trojans and backdoors now have remote administration capabilities
allowing an individual to control the victim's computer.
Many times a file called the server must be opened on the victim's computer before
the trojan can have access to it.

These are generally sent through email, P2P file sharing software,
and in internet downloads. They are usually disguised as a legitimate program or file.
Many server files will display a fake error message when opened, to make it seem like it didn't open.
Some will also kill antivirus and firewall software.

Some RAT trojans are pranks that are most likely being controlled by a friend or enemy on
April Fool's day or a holiday. Prank RATS are generally not harmful, and won't log keystrokes or hack.
They usually do whimsical things like flip the screen upside-down, open the CD-ROM tray,
and swap mouse buttons. However, they can be quite hard to remove.

Detection Netsphere :

Netsphere Files:
[%WINDOWS%]\system\nssx.exe
[%WINDOWS%]\system\nssx.exe

Netsphere Registry Values:
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run

Removing Netsphere:

you can run trial version of ExterminateIt, or remove Netsphere manually.

To completely manually remove Netsphere malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Netsphere.

Satan.Cam.View RAT

Click here to remove Satan.Cam.View malware

Satan.Cam.View description:
Satan.Cam.View Category:RAT
Some RAT trojans are pranks that are most likely being controlled by a friend or enemy on
April Fool's day or a holiday. Prank RATS are generally not harmful, and won't log keystrokes or hack.

Removing Satan.Cam.View:

you can run trial version of ExterminateIt, or remove Satan.Cam.View manually.

To completely manually remove Satan.Cam.View malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Satan.Cam.View.

Kaki Trojan

Kaki description:
Kaki Category:Trojan
This category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

Removing Kaki:

you can run trial version of ExterminateIt, or remove Kaki manually.

To completely manually remove Kaki malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Kaki.

Bancos.BDB Trojan

Bancos.BDB description:
Bancos.BDB Category:Trojan
This loose category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

Multi-purpose Trojans are also included in this group, as some virus writers
create multi-functional Trojans rather than Trojan packs.

Removing Bancos.BDB:

you can run trial version of ExterminateIt, or remove Bancos.BDB manually.

To completely manually remove Bancos.BDB malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Bancos.BDB.

Spanfool Trojan

Spanfool description:
Spanfool Category:Trojan
This loose category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

Multi-purpose Trojans are also included in this group, as some virus writers
create multi-functional Trojans rather than Trojan packs.

Removing Spanfool:

you can run trial version of ExterminateIt, or remove Spanfool manually.

To completely manually remove Spanfool malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Spanfool.

Monday, February 2, 2009

Win32.TRC Trojan

Win32.TRC description:
Win32.TRC Category:Trojan,Backdoor
This category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.
Backdoors are the most dangerous type of Trojans and the most popular.
Backdoors open infected machines to external control via Internet.
Often the backdoor will not be visible in the log of active programs.

Removing Win32.TRC:

you can run trial version of ExterminateIt, or remove Win32.TRC manually.

To completely manually remove Win32.TRC malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Win32.TRC.

Pigeon.EDG Trojan

Pigeon.EDG description:
Pigeon.EDG Category:Trojan
This category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

Removing Pigeon.EDG:

you can run trial version of ExterminateIt, or remove Pigeon.EDG manually.

To completely manually remove Pigeon.EDG malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Pigeon.EDG.

Austr.Para.Lipo Trojan

Click here to remove Austr.Para.Lipo malware

Austr.Para.Lipo description:
Austr.Para.Lipo Category:Trojan,Backdoor,Downloader,DoS
This loose category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

Multi-purpose Trojans are also included in this group, as some virus writers
create multi-functional Trojans rather than Trojan packs.
Backdoors are used by virus writers to detect and download confidential information,
execute malicious code, destroy data, include the machine in bot networks and so forth.

The downloader either launches the new malware or registers it to enable autorun
according to the local operating system requirements.
These programs attack web servers by sending numerous requests to the specified server,
often causing it to crash under an excessive volume of requests.

DoS trojans conduct such attacks from a single computer with the consent of the user.

Worms can carry a DoS procedure as part of their payload.

Removing Austr.Para.Lipo:

you can run trial version of ExterminateIt, or remove Austr.Para.Lipo manually.

To completely manually remove Austr.Para.Lipo malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Austr.Para.Lipo.

AirRaid Trojan

AirRaid description:
AirRaid Category:Trojan,Backdoor,RAT
This category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.
Backdoors are the most dangerous type of Trojans and the most popular.
Backdoors open infected machines to external control via Internet.
Often the backdoor will not be visible in the log of active programs.
Many trojans and backdoors now have remote administration capabilities
allowing an individual to control the victim's computer.
Many times a file called the server must be opened on the victim's computer before
the trojan can have access to it.

These are generally sent through email, P2P file sharing software,
and in internet downloads. They are usually disguised as a legitimate program or file.
Many server files will display a fake error message when opened, to make it seem like it didn't open.
Some will also kill antivirus and firewall software.

Some RAT trojans are pranks that are most likely being controlled by a friend or enemy on
April Fool's day or a holiday. Prank RATS are generally not harmful, and won't log keystrokes or hack.
They usually do whimsical things like flip the screen upside-down, open the CD-ROM tray,
and swap mouse buttons. However, they can be quite hard to remove.

Removing AirRaid:

you can run trial version of ExterminateIt, or remove AirRaid manually.

To completely manually remove AirRaid malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with AirRaid.

Findit.Quick.BrowserAid Adware

Click here to remove Findit.Quick.BrowserAid malware

Findit.Quick.BrowserAid description:
Findit.Quick.BrowserAid Category:Adware,Toolbar
Adware are programs that facilitate delivery for advertising content
to the user and in some cases gather information from the user's computer.

Toolbar presents itself as a helpful add-on for Internet Explorer but it is a real pest.

Detection Findit.Quick.BrowserAid :

Findit.Quick.BrowserAid Files:
[%WINDOWS%]\curdxufku.exe
[%PROGRAM_FILES%]\toolbarsetup.exe\toolbarsetup.exe
[%SYSTEM%]\browseraidtoolbar.dll
[%WINDOWS%]\system\browseraidtoolbar.dll
[%WINDOWS%]\curdxufku.exe
[%PROGRAM_FILES%]\toolbarsetup.exe\toolbarsetup.exe
[%SYSTEM%]\browseraidtoolbar.dll
[%WINDOWS%]\system\browseraidtoolbar.dll

Findit.Quick.BrowserAid Folders:
[%PROGRAM_FILES%]\m i x l i s t e r

Findit.Quick.BrowserAid Registry Keys:
HKEY_LOCAL_MACHINE\software\classes\clsid\{337d0c1d-4053-4fab-af2b-45c2f7b0faa6}
HKEY_LOCAL_MACHINE\software\mixlister

Findit.Quick.BrowserAid Registry Values:
HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\toolbar

Removing Findit.Quick.BrowserAid:

you can run trial version of ExterminateIt, or remove Findit.Quick.BrowserAid manually.

To completely manually remove Findit.Quick.BrowserAid malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Findit.Quick.BrowserAid.

Yadio Adware

Yadio description:
Yadio Category:Adware
Adware are programs that facilitate delivery for advertising content
to the user and in some cases gather information from the user's computer,
including information related to Internet browser usage or other computer habits

Detection Yadio :

Yadio Files:
[%COMMON_DESKTOPDIRECTORY%]\Yadio.lnk
[%COMMON_PROGRAMS%]\Yadio\Yadio Uninstaller.lnk
[%COMMON_PROGRAMS%]\Yadio\Yadio.lnk
[%COMMON_DESKTOPDIRECTORY%]\Yadio.lnk
[%COMMON_PROGRAMS%]\Yadio\Yadio Uninstaller.lnk
[%COMMON_PROGRAMS%]\Yadio\Yadio.lnk

Yadio Folders:
[%PROGRAM_FILES%]\Yadio

Removing Yadio:

you can run trial version of ExterminateIt, or remove Yadio manually.

To completely manually remove Yadio malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Yadio.

AnonimousEmailBomber Trojan

Click here to remove AnonimousEmailBomber malware

AnonimousEmailBomber description:
AnonimousEmailBomber Category:Trojan,Hacker Tool,DoS
This category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.
Exploits use vulnerabilities in operating systems and applications to achieve the same result.
DoS trojans conduct attacks from a single computer with the consent of the user.

Removing AnonimousEmailBomber:

you can run trial version of ExterminateIt, or remove AnonimousEmailBomber manually.

To completely manually remove AnonimousEmailBomber malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with AnonimousEmailBomber.

PSW.Joky Trojan

PSW.Joky description:
PSW.Joky Category:Trojan,Hacker Tool
This loose category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

Multi-purpose Trojans are also included in this group, as some virus writers
create multi-functional Trojans rather than Trojan packs.
Exploits use vulnerabilities in operating systems and applications to achieve the same result.

Removing PSW.Joky:

you can run trial version of ExterminateIt, or remove PSW.Joky manually.

To completely manually remove PSW.Joky malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with PSW.Joky.

Second.Sight Spyware

Click here to remove Second.Sight malware

Second.Sight description:
Second.Sight Category:Spyware
Spyware programs can collect various types of personal information,
such as Internet surfing habit, sites that have been visited,
but can also interfere with user control of the computer in other ways,
such as installing additional software, redirecting Web browser activity,
accessing websites blindly that will cause more harmful viruses,
or diverting advertising revenue to a third party.

Detection Second.Sight :

Second.Sight Files:
[%SYSTEM%]\KMON.OCX
[%SYSTEM%]\KTKBDHK3.DLL
[%SYSTEM%]\KMON.OCX
[%SYSTEM%]\KTKBDHK3.DLL

Removing Second.Sight:

you can run trial version of ExterminateIt, or remove Second.Sight manually.

To completely manually remove Second.Sight malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Second.Sight.

OrbitExplorer Adware

Click here to remove OrbitExplorer malware

OrbitExplorer description:
OrbitExplorer Category:Adware,Toolbar
Adware are programs that facilitate delivery for advertising content
to the user and in some cases gather information from the user's computer.

Toolbar presents itself as a helpful add-on for Internet Explorer but it is a real pest.

Detection OrbitExplorer :

OrbitExplorer Registry Keys:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{197AB1D7-A7DD-4C86-A938-1FCC0DB21B85}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{197ab1d7-a7dd-4c86-a938-1fcc0db21b85}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{cdf2114e-8ff2-49e6-9ea9-10ac826298cf}

Removing OrbitExplorer:

you can run trial version of ExterminateIt, or remove OrbitExplorer manually.

To completely manually remove OrbitExplorer malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with OrbitExplorer.

Frethog.ADZ Trojan

Click here to remove Frethog.ADZ malware

Frethog.ADZ description:
Frethog.ADZ Category:Trojan
This category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

Removing Frethog.ADZ:

you can run trial version of ExterminateIt, or remove Frethog.ADZ manually.

To completely manually remove Frethog.ADZ malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Frethog.ADZ.

ClickTrade.com Tracking Cookie

Click here to remove ClickTrade.com malware

ClickTrade.com description:
ClickTrade.com Category:Tracking Cookie
Tracking cookies, like regular cookies, are small files that get deposited
onto your computer's hard drive as you browse the Internet.
Unlike harmless cookies that normally let you use certain websites more easily,
tracking cookies usually collect and report information about what websites you visit
and what you do at those websites.

Removing ClickTrade.com:

you can run trial version of ExterminateIt, or remove ClickTrade.com manually.

To completely manually remove ClickTrade.com malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with ClickTrade.com.

Casey Trojan

Casey description:
Casey Category:Trojan
This loose category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

Multi-purpose Trojans are also included in this group, as some virus writers
create multi-functional Trojans rather than Trojan packs.

Detection Casey :

Casey Registry Values:
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run

Removing Casey:

you can run trial version of ExterminateIt, or remove Casey manually.

To completely manually remove Casey malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Casey.

Maroot Trojan

Maroot description:
Maroot Category:Trojan
This loose category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

Multi-purpose Trojans are also included in this group, as some virus writers
create multi-functional Trojans rather than Trojan packs.

Removing Maroot:

you can run trial version of ExterminateIt, or remove Maroot manually.

To completely manually remove Maroot malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Maroot.

Sunday, February 1, 2009

Banker.COJ Trojan

Banker.COJ description:
Banker.COJ Category:Trojan
This category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

Detection Banker.COJ :

Banker.COJ Registry Values:
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list

Removing Banker.COJ:

you can run trial version of ExterminateIt, or remove Banker.COJ manually.

To completely manually remove Banker.COJ malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Banker.COJ.

Bancos.GZW Trojan

Bancos.GZW description:
Bancos.GZW Category:Trojan
This category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

Removing Bancos.GZW:

you can run trial version of ExterminateIt, or remove Bancos.GZW manually.

To completely manually remove Bancos.GZW malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Bancos.GZW.

PowerOff Trojan

PowerOff description:
PowerOff Category:Trojan
This category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

Removing PowerOff:

you can run trial version of ExterminateIt, or remove PowerOff manually.

To completely manually remove PowerOff malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with PowerOff.

Agent.ap Downloader

Agent.ap description:
Agent.ap Category:Downloader
Trojans-downloaders downloads and installs new malware or adware on the computer.

Removing Agent.ap:

you can run trial version of ExterminateIt, or remove Agent.ap manually.

To completely manually remove Agent.ap malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Agent.ap.

Bruja Trojan

Bruja description:
Bruja Category:Trojan,Hacker Tool
This category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.
Hacker Tools are designed to penetrate remote computers
in order to use them as zombies or to download other malicious programs to computer.

Removing Bruja:

you can run trial version of ExterminateIt, or remove Bruja manually.

To completely manually remove Bruja malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Bruja.

Basic.Hell Trojan

Basic.Hell description:
Basic.Hell Category:Trojan,Backdoor,RAT
This loose category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

Multi-purpose Trojans are also included in this group, as some virus writers
create multi-functional Trojans rather than Trojan packs.
Backdoors are used by virus writers to detect and download confidential information,
execute malicious code, destroy data, include the machine in bot networks and so forth.

Many trojans and backdoors now have remote administration capabilities
allowing an individual to control the victim's computer.
Many times a file called the server must be opened on the victim's computer before
the trojan can have access to it.

These are generally sent through email, P2P file sharing software,
and in internet downloads. They are usually disguised as a legitimate program or file.
Many server files will display a fake error message when opened, to make it seem like it didn't open.
Some will also kill antivirus and firewall software.

Detection Basic.Hell :

Basic.Hell Files:
[%WINDOWS%]\system\bhs.exe
[%WINDOWS%]\temp\tle13735314.exe
[%WINDOWS%]\system\bhs.exe
[%WINDOWS%]\temp\tle13735314.exe

Basic.Hell Registry Values:
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run

Removing Basic.Hell:

you can run trial version of ExterminateIt, or remove Basic.Hell manually.

To completely manually remove Basic.Hell malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Basic.Hell.

Backdoor.NetBus.Pro Trojan

Click here to remove Backdoor.NetBus.Pro malware

Backdoor.NetBus.Pro description:
Backdoor.NetBus.Pro Category:Trojan,Backdoor
This category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.
Backdoors are the most dangerous type of Trojans and the most popular.
Backdoors open infected machines to external control via Internet.
Often the backdoor will not be visible in the log of active programs.

Removing Backdoor.NetBus.Pro:

you can run trial version of ExterminateIt, or remove Backdoor.NetBus.Pro manually.

To completely manually remove Backdoor.NetBus.Pro malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Backdoor.NetBus.Pro.

TrojanDownloader.Win32.Pitux Trojan

Click here to remove TrojanDownloader.Win32.Pitux malware

TrojanDownloader.Win32.Pitux description:
TrojanDownloader.Win32.Pitux Category:Trojan,Downloader
This loose category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

Multi-purpose Trojans are also included in this group, as some virus writers
create multi-functional Trojans rather than Trojan packs.
This family of Trojans downloads and installs new malware or adware on the computer.
The downloader then either launches the new malware or registers it to enable autorun
according to the local operating system requirements.

The names and locations of malware to be downloaded are either coded into the
Trojan or downloaded from a specified website.

Removing TrojanDownloader.Win32.Pitux:

you can run trial version of ExterminateIt, or remove TrojanDownloader.Win32.Pitux manually.

To completely manually remove TrojanDownloader.Win32.Pitux malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with TrojanDownloader.Win32.Pitux.

Blat DoS

Blat description:
Blat Category:DoS
DoS programs attack web servers by sending numerous requests to the specified server,
often causing it to crash under an excessive volume of requests.

Removing Blat:

you can run trial version of ExterminateIt, or remove Blat manually.

To completely manually remove Blat malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Blat.

Bancos.HCF Trojan

Bancos.HCF description:
Bancos.HCF Category:Trojan
This category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

Removing Bancos.HCF:

you can run trial version of ExterminateIt, or remove Bancos.HCF manually.

To completely manually remove Bancos.HCF malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Bancos.HCF.

Back.Orifice.DES RAT

Click here to remove Back.Orifice.DES malware

Back.Orifice.DES description:
Back.Orifice.DES Category:RAT
Some RAT trojans are pranks that are most likely being controlled by a friend or enemy on
April Fool's day or a holiday. Prank RATS are generally not harmful, and won't log keystrokes or hack.

Removing Back.Orifice.DES:

you can run trial version of ExterminateIt, or remove Back.Orifice.DES manually.

To completely manually remove Back.Orifice.DES malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Back.Orifice.DES.

Bancos.GYI Trojan

Bancos.GYI description:
Bancos.GYI Category:Trojan
This category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

Removing Bancos.GYI:

you can run trial version of ExterminateIt, or remove Bancos.GYI manually.

To completely manually remove Bancos.GYI malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Bancos.GYI.

PowerSpider Trojan

Click here to remove PowerSpider malware

PowerSpider description:
PowerSpider Category:Trojan,Backdoor,RAT
This loose category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

Multi-purpose Trojans are also included in this group, as some virus writers
create multi-functional Trojans rather than Trojan packs.
Backdoors are the most dangerous type of Trojans and the most popular.
Backdoors open infected machines to external control via Internet.
They function in the same way as legal remote administration programs used by system administrators.
This makes them difficult to detect.

Backdoors are installed and launched without the consent of the user of computer.
Often the backdoor will not be visible in the log of active programs.

Once a backdoor has been successfully launched, the computer is wide open.
Backdoor functions can include:

Launching/ deleting files

Sending/ receiving files

Deleting data

Displaying notification

Rebooting the machine

Executing files

Backdoors are used by virus writers to detect and download confidential information,
execute malicious code, destroy data, include the machine in bot networks and so forth.
Backdoors combine the functionality of most other types of in one package.

Backdoors have one especially dangerous sub-class: variants that can propagate like worms.
Some RAT trojans are pranks that are most likely being controlled by a friend or enemy on
April Fool's day or a holiday. Prank RATS are generally not harmful, and won't log keystrokes or hack.

Detection PowerSpider :

PowerSpider Files:
[%SYSTEM%]\mspbhook.dll
[%SYSTEM%]\mspbhook.dll

PowerSpider Registry Keys:
HKEY_CLASSES_ROOT\zpwd_box

PowerSpider Registry Values:
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runservices

Removing PowerSpider:

you can run trial version of ExterminateIt, or remove PowerSpider manually.

To completely manually remove PowerSpider malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with PowerSpider.