Remove Malware and Viruses

This summary is not available. Please click here to view the post.

nethacker malware description and removal detail
Categories:DoS

Platforms / OS: Windows 95, Windows 98, Windows 98 SE, Windows NT, Windows ME, Windows 2000, Windows XP, Windows 2003, Windows Vista

Removing nethacker:

An up-to-date copy of ExterminateIt should detect and prevent infection from nethacker.

If you do not have ExterminateIt and you are worried that you may have infected computer, you could run trial version of ExterminateIt, or remove nethacker manually.

To completely manually remove nethacker malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with nethacker.

1. Use Task Manager to terminate the nethacker process.
2. Delete the original nethacker file and folders.
3. Delete the system registry key parameters
4. Update your antivirus databases or buy antivirus software and perform a full scan of the computer.

We recommends that all Internet users back up any important information on their computers, enable maximum protection from network attacks and malicious code on their computers, refrain from executing suspicious programs received from untrustworthy sources.

Also Be Aware of the Following Threats:
Remove Afcore.ar Backdoor
PWS.Dnstroj Trojan Cleaner
Remove Vxidl.BBC Trojan
Removing Pigeon.AWKC Trojan
Win32.Spy.VB Spyware Cleaner

Voyager malware description and removal detail
Categories:Trojan,Backdoor
Also known as:

[Eset]Win32/Penrox trojan;
[Computer Associates]Win32/Voyager.Trojan

Platforms / OS: Windows 95, Windows 98, Windows 98 SE, Windows NT, Windows ME, Windows 2000, Windows XP, Windows 2003, Windows Vista

Removing Voyager:

An up-to-date copy of ExterminateIt should detect and prevent infection from Voyager.

If you do not have ExterminateIt and you are worried that you may have infected computer, you could run trial version of ExterminateIt, or remove Voyager manually.

To completely manually remove Voyager malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Voyager.

1. Use Task Manager to terminate the Voyager process.
2. Delete the original Voyager file and folders.
3. Delete the system registry key parameters
4. Update your antivirus databases or buy antivirus software and perform a full scan of the computer.

We recommends that all Internet users back up any important information on their computers, enable maximum protection from network attacks and malicious code on their computers, refrain from executing suspicious programs received from untrustworthy sources.

Also Be Aware of the Following Threats:
Remove Mespin Trojan
Removing Shutup.syslogd.denial.of.service DoS
Remove Vxidl.ARM Trojan
Parvo Trojan Cleaner
INet.Remote RAT Removal

Malware Notification malware description and removal detail
Categories:Trojan

Platforms / OS: Windows 95, Windows 98, Windows 98 SE, Windows NT, Windows ME, Windows 2000, Windows XP, Windows 2003, Windows Vista

Removing Malware Notification:

An up-to-date copy of ExterminateIt should detect and prevent infection from Malware Notification.

If you do not have ExterminateIt and you are worried that you may have infected computer, you could run trial version of ExterminateIt, or remove Malware Notification manually.

To completely manually remove Malware Notification malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Malware Notification.

1. Use Task Manager to terminate the Malware Notification process.
2. Delete the original Malware Notification file and folders.
3. Delete the system registry key parameters
4. Update your antivirus databases or buy antivirus software and perform a full scan of the computer.

We recommends that all Internet users back up any important information on their computers, enable maximum protection from network attacks and malicious code on their computers, refrain from executing suspicious programs received from untrustworthy sources.

Also Be Aware of the Following Threats:
Pigeon.ETP Trojan Removal
Anvil Trojan Symptoms
Remove WinUpdates.MediaGateway Adware
Remove SillyDl.DAC Trojan
ControlTotal.k[2] Backdoor Information

JScript.ModalDZoneBypass malware description and removal detail
Categories:Trojan
Also known as:

[Eset]JS/Psyme.NAD trojan;
[Panda]Exploit/DialogArg;
[Computer Associates]JScript/ModalDZoneBypass.A!Troja,JS.ModalDZoneBypass!exploit

Platforms / OS: Windows 95, Windows 98, Windows 98 SE, Windows NT, Windows ME, Windows 2000, Windows XP, Windows 2003, Windows Vista

Removing JScript.ModalDZoneBypass:

An up-to-date copy of ExterminateIt should detect and prevent infection from JScript.ModalDZoneBypass.

If you do not have ExterminateIt and you are worried that you may have infected computer, you could run trial version of ExterminateIt, or remove JScript.ModalDZoneBypass manually.

To completely manually remove JScript.ModalDZoneBypass malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with JScript.ModalDZoneBypass.

1. Use Task Manager to terminate the JScript.ModalDZoneBypass process.
2. Delete the original JScript.ModalDZoneBypass file and folders.
3. Delete the system registry key parameters
4. Update your antivirus databases or buy antivirus software and perform a full scan of the computer.

We recommends that all Internet users back up any important information on their computers, enable maximum protection from network attacks and malicious code on their computers, refrain from executing suspicious programs received from untrustworthy sources.

Also Be Aware of the Following Threats:
Sockets.de.Troie RAT Removal
Sesyma Trojan Symptoms
Tigre Trojan Cleaner
Remove Win32.Killqq Trojan
Univ.ow Trojan Removal instruction

Vxidl.ARM malware description and removal detail
Categories:Trojan

Platforms / OS: Windows 95, Windows 98, Windows 98 SE, Windows NT, Windows ME, Windows 2000, Windows XP, Windows 2003, Windows Vista

Removing Vxidl.ARM:

An up-to-date copy of ExterminateIt should detect and prevent infection from Vxidl.ARM.

If you do not have ExterminateIt and you are worried that you may have infected computer, you could run trial version of ExterminateIt, or remove Vxidl.ARM manually.

To completely manually remove Vxidl.ARM malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Vxidl.ARM.

1. Use Task Manager to terminate the Vxidl.ARM process.
2. Delete the original Vxidl.ARM file and folders.
3. Delete the system registry key parameters
4. Update your antivirus databases or buy antivirus software and perform a full scan of the computer.

We recommends that all Internet users back up any important information on their computers, enable maximum protection from network attacks and malicious code on their computers, refrain from executing suspicious programs received from untrustworthy sources.

Also Be Aware of the Following Threats:
Remove RSI Trojan
Remove Vxidl.BDE Trojan
Win32.NwsAG.102!Trojan DoS Cleaner
Removing Napster[v0.v1.4].remote.crash DoS
Backdoor.IRCBot.Server Trojan Removal

Bancos.HOC malware description and removal detail
Categories:Trojan

Platforms / OS: Windows 95, Windows 98, Windows 98 SE, Windows NT, Windows ME, Windows 2000, Windows XP, Windows 2003, Windows Vista

Removing Bancos.HOC:

An up-to-date copy of ExterminateIt should detect and prevent infection from Bancos.HOC.

If you do not have ExterminateIt and you are worried that you may have infected computer, you could run trial version of ExterminateIt, or remove Bancos.HOC manually.

To completely manually remove Bancos.HOC malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Bancos.HOC.

1. Use Task Manager to terminate the Bancos.HOC process.
2. Delete the original Bancos.HOC file and folders.
3. Delete the system registry key parameters
4. Update your antivirus databases or buy antivirus software and perform a full scan of the computer.

We recommends that all Internet users back up any important information on their computers, enable maximum protection from network attacks and malicious code on their computers, refrain from executing suspicious programs received from untrustworthy sources.

Also Be Aware of the Following Threats:
Vxidl.AJS Trojan Removal
Tcp.Wrapper Trojan Information
Lefielt Trojan Symptoms
Remove Exploder Backdoor
Bancos.IAU Trojan Cleaner

YourSiteBar malware description and removal detail
Categories:Adware,Toolbar
Also known as:

[Panda]Adware/Envolo
Visible Symptoms:
Files in system folders:
[%PROFILE_TEMP%]\shortcuts.txt
[%PROGRAM_FILES%]\YourSiteBar\imagemap_normal.bmp
[%PROGRAM_FILES%]\YourSiteBar\version.txt
[%PROGRAM_FILES%]\YourSiteBar\yoursitebar.xml
[%PROGRAM_FILES%]\YourSiteBar\ysb.dll
[%PROFILE_TEMP%]\shortcuts.txt
[%PROGRAM_FILES%]\YourSiteBar\imagemap_normal.bmp
[%PROGRAM_FILES%]\YourSiteBar\version.txt
[%PROGRAM_FILES%]\YourSiteBar\yoursitebar.xml
[%PROGRAM_FILES%]\YourSiteBar\ysb.dll

Platforms / OS: Windows 95, Windows 98, Windows 98 SE, Windows NT, Windows ME, Windows 2000, Windows XP, Windows 2003, Windows Vista

Detecting YourSiteBar:

Files:
[%PROFILE_TEMP%]\shortcuts.txt
[%PROGRAM_FILES%]\YourSiteBar\imagemap_normal.bmp
[%PROGRAM_FILES%]\YourSiteBar\version.txt
[%PROGRAM_FILES%]\YourSiteBar\yoursitebar.xml
[%PROGRAM_FILES%]\YourSiteBar\ysb.dll
[%PROFILE_TEMP%]\shortcuts.txt
[%PROGRAM_FILES%]\YourSiteBar\imagemap_normal.bmp
[%PROGRAM_FILES%]\YourSiteBar\version.txt
[%PROGRAM_FILES%]\YourSiteBar\yoursitebar.xml
[%PROGRAM_FILES%]\YourSiteBar\ysb.dll

Folders:
[%COMMON_FAVORITES%]\shop
[%FAVORITES%]\going places
[%FAVORITES%]\living
[%FAVORITES%]\shop
[%FAVORITES%]\technology
[%PROGRAM_FILES%]\yoursitebar

Registry Keys:
HKEY_CLASSES_ROOT\CLSID\{86227D9C-0EFE-4F8A-AA55-30386A3F5686}
HKEY_CLASSES_ROOT\Interface\{03B800F9-2536-4441-8CDA-2A3E6D15B4F8}
HKEY_CLASSES_ROOT\Interface\{DFBCC1EB-B149-487E-80C1-CC1562021542}
HKEY_CLASSES_ROOT\TypeLib\{4EE12B71-AA5E-45EC-8666-2DB3AD3FDF44}
HKEY_CLASSES_ROOT\Ysb.YsbObj
HKEY_CLASSES_ROOT\Ysb.YsbObj.1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{42F2C9BA-614F-47C0-B3E3-ECFD34EED658}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\moduleusage\c:\windows\downloaded program files\ysbactivex.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\YourSiteBar
HKEY_LOCAL_MACHINE\SOFTWARE\YourSiteBar
HKEY_CLASSES_ROOT\Interface\{7B9A715E-9D87-4C21-BF9E-F914F2FA953F}
HKEY_CLASSES_ROOT\Interface\{EAF2CCEE-21A1-4203-9F36-4929FD104D43}
HKEY_CLASSES_ROOT\Typelib\{6D3F5DE4-E980-4407-A10F-9AC771ABAAE6}
HKEY_CLASSES_ROOT\clsid\{7157b9a3-0283-03be-09d8-5474069e934}
HKEY_CLASSES_ROOT\clsid\{76825395-073d-2f38-25f0-8912a7d8f08}
HKEY_CLASSES_ROOT\clsid\{86227d9c-0efe-4f8a-aa55--30386a3f5686}
HKEY_CLASSES_ROOT\clsid\{86227d9c-0efe-4f8a-aa55-30386a3f5686}
HKEY_CLASSES_ROOT\interface\{03b800f9-2536-4441-8cda-2a3e6d15b4f8}
HKEY_CLASSES_ROOT\interface\{dfbcc1eb-b149-487e-80c1-cc1562021542}
HKEY_CLASSES_ROOT\typelib\{4ee12b71-aa5e-45ec-8666-2db3ad3fdf44}
HKEY_CLASSES_ROOT\ysb.ysbobj
HKEY_CLASSES_ROOT\ysb.ysbobj.1
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{42f2c9ba-614f-47c0-b3e3-ecfd34eed658}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\moduleusage\[%WINDOWS%]\downloaded program files\ysbactivex.dll
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\yoursitebar
HKEY_LOCAL_MACHINE\software\yoursitebar

Registry Values:
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser
HKEY_CURRENT_USER\software\microsoft\internet explorer\toolbar\webbrowser
HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\toolbar
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shareddlls

Removing YourSiteBar:

An up-to-date copy of ExterminateIt should detect and prevent infection from YourSiteBar.

If you do not have ExterminateIt and you are worried that you may have infected computer, you could run trial version of ExterminateIt, or remove YourSiteBar manually.

To completely manually remove YourSiteBar malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with YourSiteBar.

1. Use Task Manager to terminate the YourSiteBar process.
2. Delete the original YourSiteBar file and folders.
3. Delete the system registry key parameters
4. Update your antivirus databases or buy antivirus software and perform a full scan of the computer.

We recommends that all Internet users back up any important information on their computers, enable maximum protection from network attacks and malicious code on their computers, refrain from executing suspicious programs received from untrustworthy sources.

Also Be Aware of the Following Threats:
Upchan Trojan Cleaner
SillyDl.CUB Trojan Removal
Removing EventLogClear RAT
Internet.Remote.Control RAT Removal
Remove SillyDl.BZS Trojan

Applet.ActiveXComponent malware description and removal detail
Categories:Trojan

Platforms / OS: Windows 95, Windows 98, Windows 98 SE, Windows NT, Windows ME, Windows 2000, Windows XP, Windows 2003, Windows Vista

Removing Applet.ActiveXComponent:

An up-to-date copy of ExterminateIt should detect and prevent infection from Applet.ActiveXComponent.

If you do not have ExterminateIt and you are worried that you may have infected computer, you could run trial version of ExterminateIt, or remove Applet.ActiveXComponent manually.

To completely manually remove Applet.ActiveXComponent malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Applet.ActiveXComponent.

1. Use Task Manager to terminate the Applet.ActiveXComponent process.
2. Delete the original Applet.ActiveXComponent file and folders.
3. Delete the system registry key parameters
4. Update your antivirus databases or buy antivirus software and perform a full scan of the computer.

We recommends that all Internet users back up any important information on their computers, enable maximum protection from network attacks and malicious code on their computers, refrain from executing suspicious programs received from untrustworthy sources.

Also Be Aware of the Following Threats:
Removing MailSpam.Dmb Hacker Tool
Lefielt Trojan Removal
Netsnake Backdoor Removal
Win32.Psyf Backdoor Information
Killmbr Trojan Information

Win32.ATHO malware description and removal detail
Categories:Trojan,DoS
Also known as:

[Kaspersky]DoS.Win32.ATH0;
[Panda]Trj/DoS.Atho;
[Computer Associates]Win32/DoS.Atho!Trojan

Platforms / OS: Windows 95, Windows 98, Windows 98 SE, Windows NT, Windows ME, Windows 2000, Windows XP, Windows 2003, Windows Vista

Removing Win32.ATHO:

An up-to-date copy of ExterminateIt should detect and prevent infection from Win32.ATHO.

If you do not have ExterminateIt and you are worried that you may have infected computer, you could run trial version of ExterminateIt, or remove Win32.ATHO manually.

To completely manually remove Win32.ATHO malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Win32.ATHO.

1. Use Task Manager to terminate the Win32.ATHO process.
2. Delete the original Win32.ATHO file and folders.
3. Delete the system registry key parameters
4. Update your antivirus databases or buy antivirus software and perform a full scan of the computer.

We recommends that all Internet users back up any important information on their computers, enable maximum protection from network attacks and malicious code on their computers, refrain from executing suspicious programs received from untrustworthy sources.

Also Be Aware of the Following Threats:
Remove Yagoda Backdoor
VB.ia Trojan Removal instruction
Insurector Backdoor Symptoms
Bancos.DIF Trojan Information
asecurityassurance.com Hijacker Cleaner

Vxidl.ABQ malware description and removal detail
Categories:Trojan

Platforms / OS: Windows 95, Windows 98, Windows 98 SE, Windows NT, Windows ME, Windows 2000, Windows XP, Windows 2003, Windows Vista

Removing Vxidl.ABQ:

An up-to-date copy of ExterminateIt should detect and prevent infection from Vxidl.ABQ.

If you do not have ExterminateIt and you are worried that you may have infected computer, you could run trial version of ExterminateIt, or remove Vxidl.ABQ manually.

To completely manually remove Vxidl.ABQ malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Vxidl.ABQ.

1. Use Task Manager to terminate the Vxidl.ABQ process.
2. Delete the original Vxidl.ABQ file and folders.
3. Delete the system registry key parameters
4. Update your antivirus databases or buy antivirus software and perform a full scan of the computer.

We recommends that all Internet users back up any important information on their computers, enable maximum protection from network attacks and malicious code on their computers, refrain from executing suspicious programs received from untrustworthy sources.

Also Be Aware of the Following Threats:
SillyDl.CAK Trojan Removal instruction
Sesyma Trojan Symptoms
Removing SillyDl.CIZ Trojan
Grog.Villino Trojan Information
FSH Trojan Information

IRC.Flood.miRC32 malware description and removal detail
Categories:Backdoor,DoS

Platforms / OS: Windows 95, Windows 98, Windows 98 SE, Windows NT, Windows ME, Windows 2000, Windows XP, Windows 2003, Windows Vista

Removing IRC.Flood.miRC32:

An up-to-date copy of ExterminateIt should detect and prevent infection from IRC.Flood.miRC32.

If you do not have ExterminateIt and you are worried that you may have infected computer, you could run trial version of ExterminateIt, or remove IRC.Flood.miRC32 manually.

To completely manually remove IRC.Flood.miRC32 malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with IRC.Flood.miRC32.

1. Use Task Manager to terminate the IRC.Flood.miRC32 process.
2. Delete the original IRC.Flood.miRC32 file and folders.
3. Delete the system registry key parameters
4. Update your antivirus databases or buy antivirus software and perform a full scan of the computer.

We recommends that all Internet users back up any important information on their computers, enable maximum protection from network attacks and malicious code on their computers, refrain from executing suspicious programs received from untrustworthy sources.

Also Be Aware of the Following Threats:
Remove Affina.com Tracking Cookie
Trojan.Downloader.Win32.Miewer Downloader Removal
Woot RAT Cleaner
Remove Remote.Snap.Shot Trojan
Remove Bancos.GBS Trojan

IROffer.2b22 malware description and removal detail
Categories:Backdoor
Also known as:

[Kaspersky]Backdoor.Iroffer.1221;
[Panda]Bck/Iroffer.E

Platforms / OS: Windows 95, Windows 98, Windows 98 SE, Windows NT, Windows ME, Windows 2000, Windows XP, Windows 2003, Windows Vista

Removing IROffer.2b22:

An up-to-date copy of ExterminateIt should detect and prevent infection from IROffer.2b22.

If you do not have ExterminateIt and you are worried that you may have infected computer, you could run trial version of ExterminateIt, or remove IROffer.2b22 manually.

To completely manually remove IROffer.2b22 malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with IROffer.2b22.

1. Use Task Manager to terminate the IROffer.2b22 process.
2. Delete the original IROffer.2b22 file and folders.
3. Delete the system registry key parameters
4. Update your antivirus databases or buy antivirus software and perform a full scan of the computer.

We recommends that all Internet users back up any important information on their computers, enable maximum protection from network attacks and malicious code on their computers, refrain from executing suspicious programs received from untrustworthy sources.

Also Be Aware of the Following Threats:
Remove SearchExe.cookie Tracking Cookie
Remote.Control.server RAT Symptoms
Switch Trojan Information
Remove Win32.T39424!Trojan Trojan
SillyDl.DAC Trojan Cleaner

Memwatch malware description and removal detail
Categories:Trojan,Adware,Backdoor,Downloader
Also known as:

[Eset]Win32/VB.NB trojan,Win32/VB.NB1 trojan;
[Panda]Adware/MemoryWatcher;
[Computer Associates]Win32.Memwatch.B,Win32/Raquad.B!Trojan,Win32.Memwatch.D,Win32.Memwatch.E,Win32/Memwatch.D!Trojan,Win32/Memwatch.E!Trojan,Win32.Memwatch.C,Win32.Memwatch.A
Visible Symptoms:
Files in system folders:
[%PROFILE_TEMP%]\memorywatcher_b.exe
[%WINDOWS%]\emsw.exe
[%PROGRAM_FILES%]\memorywatcher.exe
[%SYSTEM%]\aaf85h.exe
[%SYSTEM%]\atv0h.exe
[%SYSTEM%]\auhgfah.exe
[%SYSTEM%]\bfu3.exe
[%SYSTEM%]\coub.exe
[%SYSTEM%]\cxe0o.exe
[%SYSTEM%]\dkp0h.exe
[%SYSTEM%]\dmfok.exe
[%SYSTEM%]\dsz3fao2.exe
[%SYSTEM%]\eah1q5.exe
[%SYSTEM%]\ekq0h.exe
[%SYSTEM%]\engpl.exe
[%SYSTEM%]\fdst0kpr.exe
[%SYSTEM%]\fmd2nj.exe
[%SYSTEM%]\gbi1r6.exe
[%SYSTEM%]\gdnhxa.exe
[%SYSTEM%]\hcj2s6.exe
[%SYSTEM%]\hnnygk7f.exe
[%SYSTEM%]\idk277.exe
[%SYSTEM%]\ihkc.exe
[%SYSTEM%]\inl641ww.exe
[%SYSTEM%]\iry3r.exe
[%SYSTEM%]\iux1va1z.exe
[%SYSTEM%]\jqvgne.exe
[%SYSTEM%]\kfmj8u3.exe
[%SYSTEM%]\khcwyng.exe
[%SYSTEM%]\lsxi5g.exe
[%SYSTEM%]\mcl7.exe
[%SYSTEM%]\mhok9w3.exe
[%SYSTEM%]\mxe42m.exe
[%SYSTEM%]\ncisp.exe
[%SYSTEM%]\ngioueb1.exe
[%SYSTEM%]\nipl9x4.exe
[%SYSTEM%]\nuzk63g.exe
[%SYSTEM%]\opulcwn3.exe
[%SYSTEM%]\pnkdb03.exe
[%SYSTEM%]\pnzzd.exe
[%SYSTEM%]\qbk7x.exe
[%SYSTEM%]\qjff4.exe
[%SYSTEM%]\qlso0a55.exe
[%SYSTEM%]\qvsy6.exe
[%SYSTEM%]\rpbbf5.exe
[%SYSTEM%]\rydo84km.exe
[%SYSTEM%]\sdelh.exe
[%SYSTEM%]\sgr88me.exe
[%SYSTEM%]\snd2c.exe
[%SYSTEM%]\subsuq.exe
[%SYSTEM%]\tarv.exe
[%SYSTEM%]\upws.exe
[%SYSTEM%]\vchsyjo.exe
[%SYSTEM%]\vuf23s1.exe
[%SYSTEM%]\vwsi.exe
[%SYSTEM%]\wprx.exe
[%SYSTEM%]\wyrgmw.exe
[%SYSTEM%]\xtgcu7.exe
[%SYSTEM%]\zhrcofz.exe
[%SYSTEM%]\zvbyl.exe
[%SYSTEM%]\zyj35w3.exe
[%WINDOWS%]\system\flsla.exe
[%WINDOWS%]\system\jxzw8.exe
[%WINDOWS%]\system\mxy2.exe
[%WINDOWS%]\system\nauzjgh.exe
[%WINDOWS%]\system\vqxt.exe
[%WINDOWS%]\system\xdkd.exe
[%WINDOWS%]\temp\memorywatcher_b.exe
[%PROFILE_TEMP%]\memorywatcher_b.exe
[%WINDOWS%]\emsw.exe
[%PROGRAM_FILES%]\memorywatcher.exe
[%SYSTEM%]\aaf85h.exe
[%SYSTEM%]\atv0h.exe
[%SYSTEM%]\auhgfah.exe
[%SYSTEM%]\bfu3.exe
[%SYSTEM%]\coub.exe
[%SYSTEM%]\cxe0o.exe
[%SYSTEM%]\dkp0h.exe
[%SYSTEM%]\dmfok.exe
[%SYSTEM%]\dsz3fao2.exe
[%SYSTEM%]\eah1q5.exe
[%SYSTEM%]\ekq0h.exe
[%SYSTEM%]\engpl.exe
[%SYSTEM%]\fdst0kpr.exe
[%SYSTEM%]\fmd2nj.exe
[%SYSTEM%]\gbi1r6.exe
[%SYSTEM%]\gdnhxa.exe
[%SYSTEM%]\hcj2s6.exe
[%SYSTEM%]\hnnygk7f.exe
[%SYSTEM%]\idk277.exe
[%SYSTEM%]\ihkc.exe
[%SYSTEM%]\inl641ww.exe
[%SYSTEM%]\iry3r.exe
[%SYSTEM%]\iux1va1z.exe
[%SYSTEM%]\jqvgne.exe
[%SYSTEM%]\kfmj8u3.exe
[%SYSTEM%]\khcwyng.exe
[%SYSTEM%]\lsxi5g.exe
[%SYSTEM%]\mcl7.exe
[%SYSTEM%]\mhok9w3.exe
[%SYSTEM%]\mxe42m.exe
[%SYSTEM%]\ncisp.exe
[%SYSTEM%]\ngioueb1.exe
[%SYSTEM%]\nipl9x4.exe
[%SYSTEM%]\nuzk63g.exe
[%SYSTEM%]\opulcwn3.exe
[%SYSTEM%]\pnkdb03.exe
[%SYSTEM%]\pnzzd.exe
[%SYSTEM%]\qbk7x.exe
[%SYSTEM%]\qjff4.exe
[%SYSTEM%]\qlso0a55.exe
[%SYSTEM%]\qvsy6.exe
[%SYSTEM%]\rpbbf5.exe
[%SYSTEM%]\rydo84km.exe
[%SYSTEM%]\sdelh.exe
[%SYSTEM%]\sgr88me.exe
[%SYSTEM%]\snd2c.exe
[%SYSTEM%]\subsuq.exe
[%SYSTEM%]\tarv.exe
[%SYSTEM%]\upws.exe
[%SYSTEM%]\vchsyjo.exe
[%SYSTEM%]\vuf23s1.exe
[%SYSTEM%]\vwsi.exe
[%SYSTEM%]\wprx.exe
[%SYSTEM%]\wyrgmw.exe
[%SYSTEM%]\xtgcu7.exe
[%SYSTEM%]\zhrcofz.exe
[%SYSTEM%]\zvbyl.exe
[%SYSTEM%]\zyj35w3.exe
[%WINDOWS%]\system\flsla.exe
[%WINDOWS%]\system\jxzw8.exe
[%WINDOWS%]\system\mxy2.exe
[%WINDOWS%]\system\nauzjgh.exe
[%WINDOWS%]\system\vqxt.exe
[%WINDOWS%]\system\xdkd.exe
[%WINDOWS%]\temp\memorywatcher_b.exe

In order to ensure that the Memwatch is launched automatically each time the system is booted, the Memwatch adds a link to its executable file in the system registry:
HKLM\Microsoft\Windows\CurrentVersion\Run
[%PROFILE_TEMP%]\memorywatcher_b.exe
[%WINDOWS%]\emsw.exe
[%PROGRAM_FILES%]\memorywatcher.exe
[%SYSTEM%]\aaf85h.exe
[%SYSTEM%]\atv0h.exe
[%SYSTEM%]\auhgfah.exe
[%SYSTEM%]\bfu3.exe
[%SYSTEM%]\coub.exe
[%SYSTEM%]\cxe0o.exe
[%SYSTEM%]\dkp0h.exe
[%SYSTEM%]\dmfok.exe
[%SYSTEM%]\dsz3fao2.exe
[%SYSTEM%]\eah1q5.exe
[%SYSTEM%]\ekq0h.exe
[%SYSTEM%]\engpl.exe
[%SYSTEM%]\fdst0kpr.exe
[%SYSTEM%]\fmd2nj.exe
[%SYSTEM%]\gbi1r6.exe
[%SYSTEM%]\gdnhxa.exe
[%SYSTEM%]\hcj2s6.exe
[%SYSTEM%]\hnnygk7f.exe
[%SYSTEM%]\idk277.exe
[%SYSTEM%]\ihkc.exe
[%SYSTEM%]\inl641ww.exe
[%SYSTEM%]\iry3r.exe
[%SYSTEM%]\iux1va1z.exe
[%SYSTEM%]\jqvgne.exe
[%SYSTEM%]\kfmj8u3.exe
[%SYSTEM%]\khcwyng.exe
[%SYSTEM%]\lsxi5g.exe
[%SYSTEM%]\mcl7.exe
[%SYSTEM%]\mhok9w3.exe
[%SYSTEM%]\mxe42m.exe
[%SYSTEM%]\ncisp.exe
[%SYSTEM%]\ngioueb1.exe
[%SYSTEM%]\nipl9x4.exe
[%SYSTEM%]\nuzk63g.exe
[%SYSTEM%]\opulcwn3.exe
[%SYSTEM%]\pnkdb03.exe
[%SYSTEM%]\pnzzd.exe
[%SYSTEM%]\qbk7x.exe
[%SYSTEM%]\qjff4.exe
[%SYSTEM%]\qlso0a55.exe
[%SYSTEM%]\qvsy6.exe
[%SYSTEM%]\rpbbf5.exe
[%SYSTEM%]\rydo84km.exe
[%SYSTEM%]\sdelh.exe
[%SYSTEM%]\sgr88me.exe
[%SYSTEM%]\snd2c.exe
[%SYSTEM%]\subsuq.exe
[%SYSTEM%]\tarv.exe
[%SYSTEM%]\upws.exe
[%SYSTEM%]\vchsyjo.exe
[%SYSTEM%]\vuf23s1.exe
[%SYSTEM%]\vwsi.exe
[%SYSTEM%]\wprx.exe
[%SYSTEM%]\wyrgmw.exe
[%SYSTEM%]\xtgcu7.exe
[%SYSTEM%]\zhrcofz.exe
[%SYSTEM%]\zvbyl.exe
[%SYSTEM%]\zyj35w3.exe
[%WINDOWS%]\system\flsla.exe
[%WINDOWS%]\system\jxzw8.exe
[%WINDOWS%]\system\mxy2.exe
[%WINDOWS%]\system\nauzjgh.exe
[%WINDOWS%]\system\vqxt.exe
[%WINDOWS%]\system\xdkd.exe
[%WINDOWS%]\temp\memorywatcher_b.exe

Platforms / OS: Windows 95, Windows 98, Windows 98 SE, Windows NT, Windows ME, Windows 2000, Windows XP, Windows 2003, Windows Vista