ErrorSafe Trojan

ErrorSafe malware description and removal detail
Categories:Trojan,Adware,Downloader,Ransomware
Visible Symptoms:
Files in system folders:
[%APPDATA%]\errorsafenewreleaseinstall[1].exe
[%APPDATA%]\errorsafenewreleaseinstall[2].exe
[%APPDATA%]\errsafer.exe
[%INTERNET_CACHE%]\Content.IE5\B86RQ4HE\ErrorSafeNewReleaseInstall[1].cab
[%INTERNET_CACHE%]\Content.IE5\E9MZUDEF\ErrorSafeNewReleaseInstall[1].exe
[%INTERNET_CACHE%]\Content.IE5\K1YR4LMR\ErrorSafeNewReleaseInstall[1].exe
[%INTERNET_CACHE%]\Content.IE5\QJYRILAJ\ErrorSafeNewReleaseInstall[1].cab
[%PROFILE%]\trace.log
[%PROFILE_TEMP%]\ErrorSafeScannerSetup.exe
[%PROFILE_TEMP%]\ICD1.tmp\UERSY_0001_N68M0602NetInstaller.exe
[%PROFILE_TEMP%]\ICD1.tmp\UERS_9999_N91S2507NetInstaller.exe
[%PROFILE_TEMP%]\ICD1.tmp\UERS_9999_N91S2507NetInstaller.inf
[%PROFILE_TEMP%]\ICD2.tmp\UERSY_0001_N68M0602NetInstaller.exe
[%PROFILE_TEMP%]\ICD2.tmp\UERS_9999_N91S2507NetInstaller.exe
[%PROFILE_TEMP%]\ICD2.tmp\UERS_9999_N91S2507NetInstaller.inf
[%PROFILE_TEMP%]\ICD20.tmp\UERS_9999_N91S2507NetInstaller.inf
[%PROFILE_TEMP%]\ICD28.tmp\UERS_9999_N91S2507NetInstaller.inf
[%PROFILE_TEMP%]\ICD3.tmp\UERS_9999_N91S2507NetInstaller.exe
[%PROFILE_TEMP%]\ICD3.tmp\UERS_9999_N91S2507NetInstaller.inf
[%PROFILE_TEMP%]\ICD37.tmp\UERS_9999_N91S2507NetInstaller.inf
[%PROFILE_TEMP%]\ICD4.tmp\UERS_9999_N91S2507NetInstaller.inf
[%PROFILE_TEMP%]\ICD40.tmp\UERS_9999_N91S2507NetInstaller.inf
[%PROFILE_TEMP%]\ICD45.tmp\UERS_9999_N91S2507NetInstaller.inf
[%PROFILE_TEMP%]\ICD7.tmp\UERS_9999_N91S2507NetInstaller.exe
[%PROFILE_TEMP%]\ICD7.tmp\UERS_9999_N91S2507NetInstaller.inf
[%PROFILE_TEMP%]\ICD9.tmp\UERS_9999_N91S2507NetInstaller.inf
[%PROFILE_TEMP%]\NI.UERS_9999_N91S2507\setup.exe
[%PROGRAM_FILES%]\Error Safe Free\uerscw.exe
[%PROGRAM_FILES%]\ErrorSafe Free\EmtERSF.exe
[%PROGRAM_FILES%]\ErrorSafe Free\UERScw.exe
[%PROGRAM_FILES%]\ErrorSafe Free\Updater.exe
[%PROGRAM_FILES_COMMON%]\ers_startupmon.exe
[%PROGRAM_FILES_COMMON%]\WinAntiVirus Pro 2006\ers_startupmon.exe
[%WINDOWS%]\Downloaded Program Files\UERS_9999_N91S2507NetInstaller.exe
[%WINDOWS%]\Temp\ErrorSafeScannerSetup.exe
[%DESKTOP%]\Error Safe.lnk
[%SYSTEM%]\ERROR
[%WINDOWS%]\Downloaded Program Files\UPRP_0001_D21M1501NetInstaller.exe
[%WINDOWS%]\Downloaded Program Files\UPRP_0001_D21M2103NetInstaller.exe
[%WINDOWS%]\Downloaded Program Files\UWA7P_0001_N91M0809NetInstaller.exe
[%WINDOWS%]\Downloaded Program Files\UWAS7_0001_N99M3108NetInstaller.exe
[%DESKTOP%]\errorsafe.lnk
[%DESKTOP%]\install errorsafe .lnk
[%PROGRAMS%]\errorsafe\contact customer support.lnk
[%PROGRAMS%]\errorsafe\errorsafe deinstallieren.lnk
[%PROGRAMS%]\errorsafe\errorsafe im netz.lnk
[%PROGRAMS%]\errorsafe\errorsafe on the web.lnk
[%PROGRAMS%]\errorsafe\errorsafe.lnk
[%PROGRAMS%]\errorsafe\kundendienst kontaktieren.lnk
[%PROGRAMS%]\errorsafe\uninstall errorsafe.lnk
[%APPDATA%]\errorsafenewreleaseinstall[1].exe
[%APPDATA%]\errorsafenewreleaseinstall[2].exe
[%APPDATA%]\errsafer.exe
[%INTERNET_CACHE%]\Content.IE5\B86RQ4HE\ErrorSafeNewReleaseInstall[1].cab
[%INTERNET_CACHE%]\Content.IE5\E9MZUDEF\ErrorSafeNewReleaseInstall[1].exe
[%INTERNET_CACHE%]\Content.IE5\K1YR4LMR\ErrorSafeNewReleaseInstall[1].exe
[%INTERNET_CACHE%]\Content.IE5\QJYRILAJ\ErrorSafeNewReleaseInstall[1].cab
[%PROFILE%]\trace.log
[%PROFILE_TEMP%]\ErrorSafeScannerSetup.exe
[%PROFILE_TEMP%]\ICD1.tmp\UERSY_0001_N68M0602NetInstaller.exe
[%PROFILE_TEMP%]\ICD1.tmp\UERS_9999_N91S2507NetInstaller.exe
[%PROFILE_TEMP%]\ICD1.tmp\UERS_9999_N91S2507NetInstaller.inf
[%PROFILE_TEMP%]\ICD2.tmp\UERSY_0001_N68M0602NetInstaller.exe
[%PROFILE_TEMP%]\ICD2.tmp\UERS_9999_N91S2507NetInstaller.exe
[%PROFILE_TEMP%]\ICD2.tmp\UERS_9999_N91S2507NetInstaller.inf
[%PROFILE_TEMP%]\ICD20.tmp\UERS_9999_N91S2507NetInstaller.inf
[%PROFILE_TEMP%]\ICD28.tmp\UERS_9999_N91S2507NetInstaller.inf
[%PROFILE_TEMP%]\ICD3.tmp\UERS_9999_N91S2507NetInstaller.exe
[%PROFILE_TEMP%]\ICD3.tmp\UERS_9999_N91S2507NetInstaller.inf
[%PROFILE_TEMP%]\ICD37.tmp\UERS_9999_N91S2507NetInstaller.inf
[%PROFILE_TEMP%]\ICD4.tmp\UERS_9999_N91S2507NetInstaller.inf
[%PROFILE_TEMP%]\ICD40.tmp\UERS_9999_N91S2507NetInstaller.inf
[%PROFILE_TEMP%]\ICD45.tmp\UERS_9999_N91S2507NetInstaller.inf
[%PROFILE_TEMP%]\ICD7.tmp\UERS_9999_N91S2507NetInstaller.exe
[%PROFILE_TEMP%]\ICD7.tmp\UERS_9999_N91S2507NetInstaller.inf
[%PROFILE_TEMP%]\ICD9.tmp\UERS_9999_N91S2507NetInstaller.inf
[%PROFILE_TEMP%]\NI.UERS_9999_N91S2507\setup.exe
[%PROGRAM_FILES%]\Error Safe Free\uerscw.exe
[%PROGRAM_FILES%]\ErrorSafe Free\EmtERSF.exe
[%PROGRAM_FILES%]\ErrorSafe Free\UERScw.exe
[%PROGRAM_FILES%]\ErrorSafe Free\Updater.exe
[%PROGRAM_FILES_COMMON%]\ers_startupmon.exe
[%PROGRAM_FILES_COMMON%]\WinAntiVirus Pro 2006\ers_startupmon.exe
[%WINDOWS%]\Downloaded Program Files\UERS_9999_N91S2507NetInstaller.exe
[%WINDOWS%]\Temp\ErrorSafeScannerSetup.exe
[%DESKTOP%]\Error Safe.lnk
[%SYSTEM%]\ERROR
[%WINDOWS%]\Downloaded Program Files\UPRP_0001_D21M1501NetInstaller.exe
[%WINDOWS%]\Downloaded Program Files\UPRP_0001_D21M2103NetInstaller.exe
[%WINDOWS%]\Downloaded Program Files\UWA7P_0001_N91M0809NetInstaller.exe
[%WINDOWS%]\Downloaded Program Files\UWAS7_0001_N99M3108NetInstaller.exe
[%DESKTOP%]\errorsafe.lnk
[%DESKTOP%]\install errorsafe .lnk
[%PROGRAMS%]\errorsafe\contact customer support.lnk
[%PROGRAMS%]\errorsafe\errorsafe deinstallieren.lnk
[%PROGRAMS%]\errorsafe\errorsafe im netz.lnk
[%PROGRAMS%]\errorsafe\errorsafe on the web.lnk
[%PROGRAMS%]\errorsafe\errorsafe.lnk
[%PROGRAMS%]\errorsafe\kundendienst kontaktieren.lnk
[%PROGRAMS%]\errorsafe\uninstall errorsafe.lnk

In order to ensure that the ErrorSafe is launched automatically each time the system is booted, the ErrorSafe adds a link to its executable file in the system registry:
HKLM\Microsoft\Windows\CurrentVersion\Run
[%APPDATA%]\errorsafenewreleaseinstall[1].exe
[%APPDATA%]\errorsafenewreleaseinstall[2].exe
[%APPDATA%]\errsafer.exe
[%INTERNET_CACHE%]\Content.IE5\E9MZUDEF\ErrorSafeNewReleaseInstall[1].exe
[%INTERNET_CACHE%]\Content.IE5\K1YR4LMR\ErrorSafeNewReleaseInstall[1].exe
[%PROFILE_TEMP%]\ErrorSafeScannerSetup.exe
[%PROFILE_TEMP%]\ICD1.tmp\UERSY_0001_N68M0602NetInstaller.exe
[%PROFILE_TEMP%]\ICD1.tmp\UERS_9999_N91S2507NetInstaller.exe
[%PROFILE_TEMP%]\ICD2.tmp\UERSY_0001_N68M0602NetInstaller.exe
[%PROFILE_TEMP%]\ICD2.tmp\UERS_9999_N91S2507NetInstaller.exe
[%PROFILE_TEMP%]\ICD3.tmp\UERS_9999_N91S2507NetInstaller.exe
[%PROFILE_TEMP%]\ICD7.tmp\UERS_9999_N91S2507NetInstaller.exe
[%PROFILE_TEMP%]\NI.UERS_9999_N91S2507\setup.exe
[%PROGRAM_FILES%]\Error Safe Free\uerscw.exe
[%PROGRAM_FILES%]\ErrorSafe Free\EmtERSF.exe
[%PROGRAM_FILES%]\ErrorSafe Free\UERScw.exe
[%PROGRAM_FILES%]\ErrorSafe Free\Updater.exe
[%PROGRAM_FILES_COMMON%]\ers_startupmon.exe
[%PROGRAM_FILES_COMMON%]\WinAntiVirus Pro 2006\ers_startupmon.exe
[%WINDOWS%]\Downloaded Program Files\UERS_9999_N91S2507NetInstaller.exe
[%WINDOWS%]\Temp\ErrorSafeScannerSetup.exe
[%WINDOWS%]\Downloaded Program Files\UPRP_0001_D21M1501NetInstaller.exe
[%WINDOWS%]\Downloaded Program Files\UPRP_0001_D21M2103NetInstaller.exe
[%WINDOWS%]\Downloaded Program Files\UWA7P_0001_N91M0809NetInstaller.exe
[%WINDOWS%]\Downloaded Program Files\UWAS7_0001_N99M3108NetInstaller.exe

Platforms / OS: Windows 95, Windows 98, Windows 98 SE, Windows NT, Windows ME, Windows 2000, Windows XP, Windows 2003, Windows Vista

Detecting ErrorSafe:

Files:
[%APPDATA%]\errorsafenewreleaseinstall[1].exe
[%APPDATA%]\errorsafenewreleaseinstall[2].exe
[%APPDATA%]\errsafer.exe
[%INTERNET_CACHE%]\Content.IE5\B86RQ4HE\ErrorSafeNewReleaseInstall[1].cab
[%INTERNET_CACHE%]\Content.IE5\E9MZUDEF\ErrorSafeNewReleaseInstall[1].exe
[%INTERNET_CACHE%]\Content.IE5\K1YR4LMR\ErrorSafeNewReleaseInstall[1].exe
[%INTERNET_CACHE%]\Content.IE5\QJYRILAJ\ErrorSafeNewReleaseInstall[1].cab
[%PROFILE%]\trace.log
[%PROFILE_TEMP%]\ErrorSafeScannerSetup.exe
[%PROFILE_TEMP%]\ICD1.tmp\UERSY_0001_N68M0602NetInstaller.exe
[%PROFILE_TEMP%]\ICD1.tmp\UERS_9999_N91S2507NetInstaller.exe
[%PROFILE_TEMP%]\ICD1.tmp\UERS_9999_N91S2507NetInstaller.inf
[%PROFILE_TEMP%]\ICD2.tmp\UERSY_0001_N68M0602NetInstaller.exe
[%PROFILE_TEMP%]\ICD2.tmp\UERS_9999_N91S2507NetInstaller.exe
[%PROFILE_TEMP%]\ICD2.tmp\UERS_9999_N91S2507NetInstaller.inf
[%PROFILE_TEMP%]\ICD20.tmp\UERS_9999_N91S2507NetInstaller.inf
[%PROFILE_TEMP%]\ICD28.tmp\UERS_9999_N91S2507NetInstaller.inf
[%PROFILE_TEMP%]\ICD3.tmp\UERS_9999_N91S2507NetInstaller.exe
[%PROFILE_TEMP%]\ICD3.tmp\UERS_9999_N91S2507NetInstaller.inf
[%PROFILE_TEMP%]\ICD37.tmp\UERS_9999_N91S2507NetInstaller.inf
[%PROFILE_TEMP%]\ICD4.tmp\UERS_9999_N91S2507NetInstaller.inf
[%PROFILE_TEMP%]\ICD40.tmp\UERS_9999_N91S2507NetInstaller.inf
[%PROFILE_TEMP%]\ICD45.tmp\UERS_9999_N91S2507NetInstaller.inf
[%PROFILE_TEMP%]\ICD7.tmp\UERS_9999_N91S2507NetInstaller.exe
[%PROFILE_TEMP%]\ICD7.tmp\UERS_9999_N91S2507NetInstaller.inf
[%PROFILE_TEMP%]\ICD9.tmp\UERS_9999_N91S2507NetInstaller.inf
[%PROFILE_TEMP%]\NI.UERS_9999_N91S2507\setup.exe
[%PROGRAM_FILES%]\Error Safe Free\uerscw.exe
[%PROGRAM_FILES%]\ErrorSafe Free\EmtERSF.exe
[%PROGRAM_FILES%]\ErrorSafe Free\UERScw.exe
[%PROGRAM_FILES%]\ErrorSafe Free\Updater.exe
[%PROGRAM_FILES_COMMON%]\ers_startupmon.exe
[%PROGRAM_FILES_COMMON%]\WinAntiVirus Pro 2006\ers_startupmon.exe
[%WINDOWS%]\Downloaded Program Files\UERS_9999_N91S2507NetInstaller.exe
[%WINDOWS%]\Temp\ErrorSafeScannerSetup.exe
[%DESKTOP%]\Error Safe.lnk
[%SYSTEM%]\ERROR
[%WINDOWS%]\Downloaded Program Files\UPRP_0001_D21M1501NetInstaller.exe
[%WINDOWS%]\Downloaded Program Files\UPRP_0001_D21M2103NetInstaller.exe
[%WINDOWS%]\Downloaded Program Files\UWA7P_0001_N91M0809NetInstaller.exe
[%WINDOWS%]\Downloaded Program Files\UWAS7_0001_N99M3108NetInstaller.exe
[%DESKTOP%]\errorsafe.lnk
[%DESKTOP%]\install errorsafe .lnk
[%PROGRAMS%]\errorsafe\contact customer support.lnk
[%PROGRAMS%]\errorsafe\errorsafe deinstallieren.lnk
[%PROGRAMS%]\errorsafe\errorsafe im netz.lnk
[%PROGRAMS%]\errorsafe\errorsafe on the web.lnk
[%PROGRAMS%]\errorsafe\errorsafe.lnk
[%PROGRAMS%]\errorsafe\kundendienst kontaktieren.lnk
[%PROGRAMS%]\errorsafe\uninstall errorsafe.lnk
[%APPDATA%]\errorsafenewreleaseinstall[1].exe
[%APPDATA%]\errorsafenewreleaseinstall[2].exe
[%APPDATA%]\errsafer.exe
[%INTERNET_CACHE%]\Content.IE5\B86RQ4HE\ErrorSafeNewReleaseInstall[1].cab
[%INTERNET_CACHE%]\Content.IE5\E9MZUDEF\ErrorSafeNewReleaseInstall[1].exe
[%INTERNET_CACHE%]\Content.IE5\K1YR4LMR\ErrorSafeNewReleaseInstall[1].exe
[%INTERNET_CACHE%]\Content.IE5\QJYRILAJ\ErrorSafeNewReleaseInstall[1].cab
[%PROFILE%]\trace.log
[%PROFILE_TEMP%]\ErrorSafeScannerSetup.exe
[%PROFILE_TEMP%]\ICD1.tmp\UERSY_0001_N68M0602NetInstaller.exe
[%PROFILE_TEMP%]\ICD1.tmp\UERS_9999_N91S2507NetInstaller.exe
[%PROFILE_TEMP%]\ICD1.tmp\UERS_9999_N91S2507NetInstaller.inf
[%PROFILE_TEMP%]\ICD2.tmp\UERSY_0001_N68M0602NetInstaller.exe
[%PROFILE_TEMP%]\ICD2.tmp\UERS_9999_N91S2507NetInstaller.exe
[%PROFILE_TEMP%]\ICD2.tmp\UERS_9999_N91S2507NetInstaller.inf
[%PROFILE_TEMP%]\ICD20.tmp\UERS_9999_N91S2507NetInstaller.inf
[%PROFILE_TEMP%]\ICD28.tmp\UERS_9999_N91S2507NetInstaller.inf
[%PROFILE_TEMP%]\ICD3.tmp\UERS_9999_N91S2507NetInstaller.exe
[%PROFILE_TEMP%]\ICD3.tmp\UERS_9999_N91S2507NetInstaller.inf
[%PROFILE_TEMP%]\ICD37.tmp\UERS_9999_N91S2507NetInstaller.inf
[%PROFILE_TEMP%]\ICD4.tmp\UERS_9999_N91S2507NetInstaller.inf
[%PROFILE_TEMP%]\ICD40.tmp\UERS_9999_N91S2507NetInstaller.inf
[%PROFILE_TEMP%]\ICD45.tmp\UERS_9999_N91S2507NetInstaller.inf
[%PROFILE_TEMP%]\ICD7.tmp\UERS_9999_N91S2507NetInstaller.exe
[%PROFILE_TEMP%]\ICD7.tmp\UERS_9999_N91S2507NetInstaller.inf
[%PROFILE_TEMP%]\ICD9.tmp\UERS_9999_N91S2507NetInstaller.inf
[%PROFILE_TEMP%]\NI.UERS_9999_N91S2507\setup.exe
[%PROGRAM_FILES%]\Error Safe Free\uerscw.exe
[%PROGRAM_FILES%]\ErrorSafe Free\EmtERSF.exe
[%PROGRAM_FILES%]\ErrorSafe Free\UERScw.exe
[%PROGRAM_FILES%]\ErrorSafe Free\Updater.exe
[%PROGRAM_FILES_COMMON%]\ers_startupmon.exe
[%PROGRAM_FILES_COMMON%]\WinAntiVirus Pro 2006\ers_startupmon.exe
[%WINDOWS%]\Downloaded Program Files\UERS_9999_N91S2507NetInstaller.exe
[%WINDOWS%]\Temp\ErrorSafeScannerSetup.exe
[%DESKTOP%]\Error Safe.lnk
[%SYSTEM%]\ERROR
[%WINDOWS%]\Downloaded Program Files\UPRP_0001_D21M1501NetInstaller.exe
[%WINDOWS%]\Downloaded Program Files\UPRP_0001_D21M2103NetInstaller.exe
[%WINDOWS%]\Downloaded Program Files\UWA7P_0001_N91M0809NetInstaller.exe
[%WINDOWS%]\Downloaded Program Files\UWAS7_0001_N99M3108NetInstaller.exe
[%DESKTOP%]\errorsafe.lnk
[%DESKTOP%]\install errorsafe .lnk
[%PROGRAMS%]\errorsafe\contact customer support.lnk
[%PROGRAMS%]\errorsafe\errorsafe deinstallieren.lnk
[%PROGRAMS%]\errorsafe\errorsafe im netz.lnk
[%PROGRAMS%]\errorsafe\errorsafe on the web.lnk
[%PROGRAMS%]\errorsafe\errorsafe.lnk
[%PROGRAMS%]\errorsafe\kundendienst kontaktieren.lnk
[%PROGRAMS%]\errorsafe\uninstall errorsafe.lnk

Folders:
[%COMMON_PROGRAMS%]\Error Safe Unregistered Version
[%PROGRAM_FILES%]\errorsafe
[%PROGRAM_FILES%]\ErrorSafe Free
[%APPDATA%]\Error Safe
[%APPDATA%]\Error Safe Free
[%APPDATA%]\ErrorSafe
[%COMMON_PROGRAMS%]\Error Safe
[%PROFILE_TEMP%]\NI.UERS
[%PROFILE_TEMP%]\NI.UERSD_0001_N91M2407
[%PROFILE_TEMP%]\NI.UERSF_0001_N91M2607
[%PROFILE_TEMP%]\NI.UERSG_0001_N91M2908
[%PROFILE_TEMP%]\NI.UERSH_9999_N91S1212
[%PROFILE_TEMP%]\NI.UERSI_0001_LP
[%PROFILE_TEMP%]\NI.UERSJ_0001_N86M0707
[%PROFILE_TEMP%]\NI.UERSL_0001_N91M2407
[%PROFILE_TEMP%]\NI.UERSL_9999_N91S2209
[%PROFILE_TEMP%]\NI.UERSM_0001_N68M1602
[%PROFILE_TEMP%]\NI.UERSM_9999_N91S2009
[%PROFILE_TEMP%]\NI.UERSR_0001_N91M2407
[%PROFILE_TEMP%]\NI.UERSV_0001_N91S2108
[%PROFILE_TEMP%]\NI.UERSV_9999_N91S1912
[%PROFILE_TEMP%]\NI.UERSW_0001_N93M2102
[%PROFILE_TEMP%]\NI.UERS_0001_N68M1801
[%PROFILE_TEMP%]\NI.UERS_0001_N91M1807
[%PROFILE_TEMP%]\NI.UERS_0001_N91M2007
[%PROFILE_TEMP%]\NI.UERS_0001_NI57M1124
[%PROFILE_TEMP%]\NI.UERS_9999_N91S1502
[%PROFILE_TEMP%]\NI.UERS_9999_N91S2507
[%PROFILE_TEMP%]\NI.UERS_9999_N94S0501
[%PROGRAM_FILES%]\Error Safe
[%PROGRAM_FILES%]\Error Safe Free
[%PROGRAM_FILES_COMMON%]\Error Safe
[%PROGRAM_FILES_COMMON%]\ErrorSafe
[%PROGRAM_FILES_COMMON%]\ErrorSafe Free
[%DESKTOP%]\Error Safe.lnk

Registry Keys:
HKEY_CLASSES_ROOT\clsid\{5284ac2a-ef00-4750-9b82-b5b907d26536}
HKEY_CLASSES_ROOT\clsid\{647b8364-79e0-48e2-a4ca-233abada0c2d}
HKEY_CLASSES_ROOT\esspchck.esspchck
HKEY_CLASSES_ROOT\esspchck.esspchck.1
HKEY_CLASSES_ROOT\esspcheck.esspcheck
HKEY_CLASSES_ROOT\esspcheck.esspcheck.1
HKEY_CLASSES_ROOT\interface\{94dbdb63-5f05-4c51-8b14-de0ca12ef4ca}
HKEY_CLASSES_ROOT\typelib\{1b197c22-561f-455f-8511-35b1a45c5c9f}
HKEY_CLASSES_ROOT\typelib\{68bc55e9-4d3e-4c89-89ac-7559763c98b8}
HKEY_CLASSES_ROOT\TypeLib\{F585CB1F-F17D-4007-A573-B663197EF500}
HKEY_CURRENT_USER\software\error safe free
HKEY_CURRENT_USER\software\errorsafe
HKEY_LOCAL_MACHINE\software\error safe free
HKEY_LOCAL_MACHINE\software\errorsafe
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\ers_is1
HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\legacy_erssdd
HKEY_CLASSES_ROOT\CLSID\{06170642-FA65-4FB6-AC79-5F235CB99BC2}
HKEY_CLASSES_ROOT\CLSID\{1640DE0E-75E4-4a83-B5D1-2492BC7EBA8F}
HKEY_CLASSES_ROOT\CLSID\{6EF91405-4FCB-4633-BAB3-FA5B3DC40C3B}
HKEY_CLASSES_ROOT\CLSID\{703BDF83-2C12-4d20-8BB0-106DDAB01B59}
HKEY_CLASSES_ROOT\CLSID\{9E87077C-380C-407d-8DAB-EEDAD95C0A5D}
HKEY_CLASSES_ROOT\CLSID\{B0F4BC0F-EAEA-43B5-8CE6-DAD3CC9B29A2}
HKEY_CLASSES_ROOT\CLSID\{C5531D07-22C2-418B-85B9-D829AF1498B0}
HKEY_CLASSES_ROOT\CLSID\{CCAABCDD-7C16-4215-B12E-150BFB994CF0}
HKEY_CLASSES_ROOT\CLSID\{E0767047-9D25-4a3a-B905-852CDA087E86}
HKEY_CLASSES_ROOT\CLSID\{E7296F98-6668-419c-AE1D-04ED641E7C3E}
HKEY_CLASSES_ROOT\clsid\{f63e3b76-f82f-46eb-851c-8c0a221686bb}
HKEY_CLASSES_ROOT\flfxr15.flfixer15
HKEY_CLASSES_ROOT\FWraper.FFEnginWraper
HKEY_CLASSES_ROOT\FWraper.FFEnginWraper.1
HKEY_CLASSES_ROOT\FxCore.MMFixCore
HKEY_CLASSES_ROOT\FxCore.MMFixCore.1
HKEY_CLASSES_ROOT\Interface\{06170642-FA65-4FB6-AC79-5F235CB99BC2}
HKEY_CLASSES_ROOT\Interface\{06F1503A-4EC3-4F9A-B5FC-366616C9F700}
HKEY_CLASSES_ROOT\Interface\{489B338E-E4AB-489A-91D4-69970A541CF9}
HKEY_CLASSES_ROOT\Interface\{5EED48AA-F20F-4085-B8F8-57724B7C5B08}
HKEY_CLASSES_ROOT\Interface\{610D5C4B-D550-4DC2-AAFA-45C1A8E670CA}
HKEY_CLASSES_ROOT\Interface\{66F7F931-5A11-44AA-B991-E9A9662D4841}
HKEY_CLASSES_ROOT\Interface\{6EF91405-4FCB-4633-BAB3-FA5B3DC40C3B}
HKEY_CLASSES_ROOT\interface\{7f4e63c9-f30c-4424-9baf-b6896f5f56c4}
HKEY_CLASSES_ROOT\Interface\{9607A902-A6A2-43FF-BB1F-01509DEB7110}
HKEY_CLASSES_ROOT\Interface\{AE4026CC-B7BA-48E8-8FB3-2C35099670A1}
HKEY_CLASSES_ROOT\Interface\{B0F4BC0F-EAEA-43B5-8CE6-DAD3CC9B29A2}
HKEY_CLASSES_ROOT\Interface\{C5531D07-22C2-418B-85B9-D829AF1498B0}
HKEY_CLASSES_ROOT\Interface\{C7EFDCDE-A181-41D0-A551-16F73B398040}
HKEY_CLASSES_ROOT\interface\{f5ac8b35-5b15-4e8f-8046-43858973b495}
HKEY_CLASSES_ROOT\MMFxCtrl.CoFixEngine
HKEY_CLASSES_ROOT\MMFxCtrl.CoFixEngine.1
HKEY_CLASSES_ROOT\P.EChecker.111
HKEY_CLASSES_ROOT\TypeLib\{25F43076-32B8-4828-A88C-8288EEE53396}
HKEY_CLASSES_ROOT\TypeLib\{3EB15ED2-15A6-4E1A-B84A-ACFAE64583E1}
HKEY_CLASSES_ROOT\TypeLib\{7300F6AF-78E6-4167-845A-6089879F1DB0}
HKEY_CLASSES_ROOT\TypeLib\{7FA4EC26-6A28-4474-857D-BB05B001C84A}
HKEY_CLASSES_ROOT\TypeLib\{96D58666-8F00-4A9D-9389-C17AAA2407C9}
HKEY_CLASSES_ROOT\TypeLib\{E79D5E54-81C9-41AE-9D7B-03F1E5A7733D}
HKEY_CURRENT_USER\SOFTWARE\Error Safe
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{06170642-FA65-4FB6-AC79-5F235CB99BC2}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1640DE0E-75E4-4a83-B5D1-2492BC7EBA8F}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{647B8364-79E0-48e2-A4CA-233ABADA0C2D}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6EF91405-4FCB-4633-BAB3-FA5B3DC40C3B}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{703BDF83-2C12-4d20-8BB0-106DDAB01B59}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9E87077C-380C-407d-8DAB-EEDAD95C0A5D}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B0F4BC0F-EAEA-43B5-8CE6-DAD3CC9B29A2}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C5531D07-22C2-418B-85B9-D829AF1498B0}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CCAABCDD-7C16-4215-B12E-150BFB994CF0}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E0767047-9D25-4a3a-B905-852CDA087E86}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E7296F98-6668-419c-AE1D-04ED641E7C3E}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F63E3B76-F82F-46EB-851C-8C0A221686BB}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FlFxr15.FlFixer15
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FWraper.FFEnginWraper
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FxCore.MMFixCore
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{06F1503A-4EC3-4F9A-B5FC-366616C9F700}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{610D5C4B-D550-4DC2-AAFA-45C1A8E670CA}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{66F7F931-5A11-44AA-B991-E9A9662D4841}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6EF91405-4FCB-4633-BAB3-FA5B3DC40C3B}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7F4E63C9-F30C-4424-9BAF-B6896F5F56C4}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9607A902-A6A2-43FF-BB1F-01509DEB7110}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C5531D07-22C2-418B-85B9-D829AF1498B0}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F5AC8B35-5B15-4E8F-8046-43858973B495}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MMFxCtrl.CoFixEngine
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\P.EChecker.111
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{25F43076-32B8-4828-A88C-8288EEE53396}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{3EB15ED2-15A6-4E1A-B84A-ACFAE64583E1}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{7300F6AF-78E6-4167-845A-6089879F1DB0}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{F585CB1F-F17D-4007-A573-B663197EF500}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{B64F4A7C-97C9-11DA-8BDE-F66BAD1E3F3A}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\UERS_is1
HKEY_CLASSES_ROOT\clsid\{0ba379c6-0efd-4a28-932c-d20469052fd9}
HKEY_CLASSES_ROOT\clsid\{0bc09fc7-473d-4f9c-b49b-f4e3e244b47a}
HKEY_CLASSES_ROOT\clsid\{196c80cb-20a7-4cf9-9c98-9322fb1e35fb}
HKEY_CLASSES_ROOT\clsid\{356af2e9-8874-4c60-a3d8-0cb516c9e747}
HKEY_CLASSES_ROOT\clsid\{5e19dee2-8d2f-4a9c-a66d-76bbeedd15cb}
HKEY_CLASSES_ROOT\clsid\{77ca442a-0c72-492b-804a-82611e558142}
HKEY_CLASSES_ROOT\clsid\{7e73c9db-69fb-4580-8e8e-194b34a2306c}
HKEY_CLASSES_ROOT\clsid\{965a8d33-ae18-4c17-8011-fe42d81e0758}
HKEY_CLASSES_ROOT\clsid\{c033567c-68fe-419b-bcc4-135db7faf8eb}
HKEY_CLASSES_ROOT\clsid\{c85a4afd-ff76-4661-b76a-3e9bb2ce2dab}
HKEY_CLASSES_ROOT\clsid\{e73e3959-fb15-44d7-acb9-3a75377006fc}
HKEY_CLASSES_ROOT\escompcleancore.esappcleaner
HKEY_CLASSES_ROOT\escompcleancore.esappcleaner.1
HKEY_CLASSES_ROOT\escompcleancore.esccquickscan
HKEY_CLASSES_ROOT\escompcleancore.esccquickscan.1
HKEY_CLASSES_ROOT\escompcleancore.esfilecleaner
HKEY_CLASSES_ROOT\escompcleancore.esfilecleaner.1
HKEY_CLASSES_ROOT\escompcleancore.esinetcleaner
HKEY_CLASSES_ROOT\escompcleancore.esinetcleaner.1
HKEY_CLASSES_ROOT\escompcleancore.esregcleaner
HKEY_CLASSES_ROOT\escompcleancore.esregcleaner.1
HKEY_CLASSES_ROOT\escompcleancore.essystemcleaner
HKEY_CLASSES_ROOT\escompcleancore.essystemcleaner.1
HKEY_CLASSES_ROOT\esdf_fixer.esfixer
HKEY_CLASSES_ROOT\esdf_fixer.esfixer.1
HKEY_CLASSES_ROOT\esdf_proxy.esdrivermanipulate
HKEY_CLASSES_ROOT\esdf_proxy.esdrivermanipulate.1
HKEY_CLASSES_ROOT\esffwraper.esffenginwraper
HKEY_CLASSES_ROOT\esffwraper.esffenginwraper.1
HKEY_CLASSES_ROOT\esfixcore.esmmfixcore
HKEY_CLASSES_ROOT\esfixcore.esmmfixcore.1
HKEY_CLASSES_ROOT\esmmfixctrl.escofixengine
HKEY_CLASSES_ROOT\esmmfixctrl.escofixengine.1
HKEY_CLASSES_ROOT\flfxr5.flfixer5
HKEY_CLASSES_ROOT\typelib\{04392304-5221-4022-9300-be4128fb25b2}
HKEY_CLASSES_ROOT\typelib\{49f9ffb5-514d-4b69-b31d-2ae5a7d30ae6}
HKEY_CLASSES_ROOT\typelib\{692ca430-32c8-470d-ba1f-7e15e21e7043}
HKEY_CLASSES_ROOT\typelib\{6bd7e052-306e-497a-ad23-601bc6bfc305}
HKEY_CLASSES_ROOT\typelib\{77dc6558-60e0-4644-a3df-b31f29d113bd}
HKEY_CLASSES_ROOT\typelib\{9dd86cf2-8ac0-4fe0-b55a-601a302b5fd8}
HKEY_CLASSES_ROOT\typelib\{a73973ab-95a6-4abe-a046-de3bab2be448}
HKEY_CLASSES_ROOT\typelib\{f585cb1f-f17d-4007-a573-b663197ef500}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\ersu_is1
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\erssdd

Registry Values:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\uers_is1
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\uers_is1
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\uers_is1
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\uers_is1
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs
HKEY_CLASSES_ROOT\clsid\{6ef91405-4fcb-4633-bab3-fa5b3dc40c3b}\inprocserver32
HKEY_CLASSES_ROOT\clsid\{703bdf83-2c12-4d20-8bb0-106ddab01b59}\inprocserver32
HKEY_CLASSES_ROOT\clsid\{beb81c03-24d8-4eef-81dc-475c6389cb1b}\inprocserver32
HKEY_CLASSES_ROOT\clsid\{c5531d07-22c2-418b-85b9-d829af1498b0}\inprocserver32
HKEY_CLASSES_ROOT\clsid\{e0767047-9d25-4a3a-b905-852cda087e86}\inprocserver32
HKEY_CLASSES_ROOT\clsid\{e7296f98-6668-419c-ae1d-04ed641e7c3e}\inprocserver32
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shareddlls
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shareddlls
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\uers_is1
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\uers_is1
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\uers_is1
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\uers_is1
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\uers_is1
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\uers_is1
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\uers_is1
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\uers_is1
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\uers_is1
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\uers_is1
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\uers_is1
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\uers_is1
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\uers_is1
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\uers_is1

Removing ErrorSafe:

An up-to-date copy of ExterminateIt should detect and prevent infection from ErrorSafe.

If you do not have ExterminateIt and you are worried that you may have infected computer, you could run trial version of ExterminateIt, or remove ErrorSafe manually.

To completely manually remove ErrorSafe malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with ErrorSafe.

  1. Use Task Manager to terminate the ErrorSafe process.
  2. Delete the original ErrorSafe file and folders.
  3. Delete the system registry key parameters
  4. Update your antivirus databases or buy antivirus software and perform a full scan of the computer.

We recommends that all Internet users back up any important information on their computers, enable maximum protection from network attacks and malicious code on their computers, refrain from executing suspicious programs received from untrustworthy sources.


ExterminateIt effectively and automatically removes ErrorSafe from you computer and is a good solution for those who are seeking easy and effective protection for their computer from Trojan Horses, Rootkits, Backdoors, spyware, botnets, keystroke loggers, dialers and other malicious software(malware).

Download ExterminateIt! to instantly get rid of ErrorSafe!


Also Be Aware of the Following Threats:
Gdufs Backdoor Information
Small.sh Downloader Symptoms
VBS.Generator.50b Worm Information

0 comments:

Post a Comment

Blog Archive