Remove Malware and Viruses

Zaratustra malware description and removal detail
Categories:Trojan,Backdoor
Also known as:

[Eset]Win32/Zaratustra trojan;
[Computer Associates]Win32.Zaratustra

Platforms / OS: Windows 95, Windows 98, Windows 98 SE, Windows NT, Windows ME, Windows 2000, Windows XP, Windows 2003, Windows Vista

Removing Zaratustra:

An up-to-date copy of ExterminateIt should detect and prevent infection from Zaratustra.

If you do not have ExterminateIt and you are worried that you may have infected computer, you could run trial version of ExterminateIt, or remove Zaratustra manually.

To completely manually remove Zaratustra malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Zaratustra.

1. Use Task Manager to terminate the Zaratustra process.
2. Delete the original Zaratustra file and folders.
3. Delete the system registry key parameters
4. Update your antivirus databases or buy antivirus software and perform a full scan of the computer.

We recommends that all Internet users back up any important information on their computers, enable maximum protection from network attacks and malicious code on their computers, refrain from executing suspicious programs received from untrustworthy sources.

Also Be Aware of the Following Threats:
SillyDl.CQE Trojan Removal instruction

SillyDl.CYD malware description and removal detail
Categories:Trojan

Platforms / OS: Windows 95, Windows 98, Windows 98 SE, Windows NT, Windows ME, Windows 2000, Windows XP, Windows 2003, Windows Vista

Removing SillyDl.CYD:

An up-to-date copy of ExterminateIt should detect and prevent infection from SillyDl.CYD.

If you do not have ExterminateIt and you are worried that you may have infected computer, you could run trial version of ExterminateIt, or remove SillyDl.CYD manually.

To completely manually remove SillyDl.CYD malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with SillyDl.CYD.

1. Use Task Manager to terminate the SillyDl.CYD process.
2. Delete the original SillyDl.CYD file and folders.
3. Delete the system registry key parameters
4. Update your antivirus databases or buy antivirus software and perform a full scan of the computer.

We recommends that all Internet users back up any important information on their computers, enable maximum protection from network attacks and malicious code on their computers, refrain from executing suspicious programs received from untrustworthy sources.

Also Be Aware of the Following Threats:
BloisDialer Trojan Information
Removing ClickToSearch Adware
TrojanSpy.Win32.Sincom.bg Trojan Cleaner
MiniKeyLog Trojan Removal

ICQ.Spy malware description and removal detail
Categories:Trojan,Spyware
Also known as:

[Kaspersky]Trojan.Win32.Aname;
[McAfee]ICQ-Spy;
[F-Prot]destructive program;
[Panda]Trojan Horse
Visible Symptoms:
Files in system folders:
[%PROFILE_TEMP%]\Rar$DR03.047\workdir\PasControls\Jedi\jvcl\examples\RaLib\RaInterpreterMDI\mdiapp.res
[%PROFILE_TEMP%]\Rar$DR03.047\workdir\PasControls\Jedi\jvcl\examples\RaLib\RaInterpreterMDI\mdiapp.res

Platforms / OS: Windows 95, Windows 98, Windows 98 SE, Windows NT, Windows ME, Windows 2000, Windows XP, Windows 2003, Windows Vista

Detecting ICQ.Spy:

Files:
[%PROFILE_TEMP%]\Rar$DR03.047\workdir\PasControls\Jedi\jvcl\examples\RaLib\RaInterpreterMDI\mdiapp.res
[%PROFILE_TEMP%]\Rar$DR03.047\workdir\PasControls\Jedi\jvcl\examples\RaLib\RaInterpreterMDI\mdiapp.res

Removing ICQ.Spy:

An up-to-date copy of ExterminateIt should detect and prevent infection from ICQ.Spy.

If you do not have ExterminateIt and you are worried that you may have infected computer, you could run trial version of ExterminateIt, or remove ICQ.Spy manually.

To completely manually remove ICQ.Spy malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with ICQ.Spy.

1. Use Task Manager to terminate the ICQ.Spy process.
2. Delete the original ICQ.Spy file and folders.
3. Delete the system registry key parameters
4. Update your antivirus databases or buy antivirus software and perform a full scan of the computer.

We recommends that all Internet users back up any important information on their computers, enable maximum protection from network attacks and malicious code on their computers, refrain from executing suspicious programs received from untrustworthy sources.

Also Be Aware of the Following Threats:
Remove Backdoor.Voodoo.6!dropper Trojan
Mut.int Trojan Cleaner
Removing mIRC.Logare Trojan

Ginger malware description and removal detail
Categories:Trojan,Backdoor,Downloader,DoS
Also known as:

[Kaspersky]Ginger.2247;
[Panda]Gingerbread.2274;
[Computer Associates]Gingerbread

Platforms / OS: Windows 95, Windows 98, Windows 98 SE, Windows NT, Windows ME, Windows 2000, Windows XP, Windows 2003, Windows Vista

Removing Ginger:

An up-to-date copy of ExterminateIt should detect and prevent infection from Ginger.

If you do not have ExterminateIt and you are worried that you may have infected computer, you could run trial version of ExterminateIt, or remove Ginger manually.

To completely manually remove Ginger malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Ginger.

1. Use Task Manager to terminate the Ginger process.
2. Delete the original Ginger file and folders.
3. Delete the system registry key parameters
4. Update your antivirus databases or buy antivirus software and perform a full scan of the computer.

We recommends that all Internet users back up any important information on their computers, enable maximum protection from network attacks and malicious code on their computers, refrain from executing suspicious programs received from untrustworthy sources.

Also Be Aware of the Following Threats:
Sybuex Trojan Symptoms
Zlob.cc Downloader Information
Pigeon.AVJP Trojan Removal instruction
artpc.com Tracking Cookie Removal instruction
Zlob.Fam.VideoKeyCodec Trojan Symptoms

lovehappens.com malware description and removal detail
Categories:Tracking Cookie

Platforms / OS: Windows 95, Windows 98, Windows 98 SE, Windows NT, Windows ME, Windows 2000, Windows XP, Windows 2003, Windows Vista

Removing lovehappens.com:

An up-to-date copy of ExterminateIt should detect and prevent infection from lovehappens.com.

If you do not have ExterminateIt and you are worried that you may have infected computer, you could run trial version of ExterminateIt, or remove lovehappens.com manually.

To completely manually remove lovehappens.com malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with lovehappens.com.

1. Use Task Manager to terminate the lovehappens.com process.
2. Delete the original lovehappens.com file and folders.
3. Delete the system registry key parameters
4. Update your antivirus databases or buy antivirus software and perform a full scan of the computer.

We recommends that all Internet users back up any important information on their computers, enable maximum protection from network attacks and malicious code on their computers, refrain from executing suspicious programs received from untrustworthy sources.

Also Be Aware of the Following Threats:
Sin.Cyn Backdoor Cleaner
Remove Pigeon.AXS Trojan
Bancos.FZK Trojan Symptoms

Pazus malware description and removal detail
Categories:Trojan,Backdoor
Also known as:

[Kaspersky]Backdoor.Pazus.20,Backdoor.Win32.Pazus.19;
[Eset]Win32/Pazus.20 trojan;
[Panda]Backdoor Program;
[Other]remote shell

Platforms / OS: Windows 95, Windows 98, Windows 98 SE, Windows NT, Windows ME, Windows 2000, Windows XP, Windows 2003, Windows Vista

Removing Pazus:

An up-to-date copy of ExterminateIt should detect and prevent infection from Pazus.

If you do not have ExterminateIt and you are worried that you may have infected computer, you could run trial version of ExterminateIt, or remove Pazus manually.

To completely manually remove Pazus malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Pazus.

1. Use Task Manager to terminate the Pazus process.
2. Delete the original Pazus file and folders.
3. Delete the system registry key parameters
4. Update your antivirus databases or buy antivirus software and perform a full scan of the computer.

We recommends that all Internet users back up any important information on their computers, enable maximum protection from network attacks and malicious code on their computers, refrain from executing suspicious programs received from untrustworthy sources.

Also Be Aware of the Following Threats:
SillyDl.AHX Trojan Cleaner
PStopper Adware Information

W95.Bonk malware description and removal detail
Categories:Trojan,Backdoor,Downloader,DoS
Also known as:

[Kaspersky]Win95.Bonk.1243;
[McAfee]W95/Bonk;
[F-Prot]W32/CIH_Hybrid.1268;
[Panda]W32/Bonk.1243;
[Computer Associates]Win95.Bonk.B

Platforms / OS: Windows 95, Windows 98, Windows 98 SE, Windows NT, Windows ME, Windows 2000, Windows XP, Windows 2003, Windows Vista

Removing W95.Bonk:

An up-to-date copy of ExterminateIt should detect and prevent infection from W95.Bonk.

If you do not have ExterminateIt and you are worried that you may have infected computer, you could run trial version of ExterminateIt, or remove W95.Bonk manually.

To completely manually remove W95.Bonk malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with W95.Bonk.

1. Use Task Manager to terminate the W95.Bonk process.
2. Delete the original W95.Bonk file and folders.
3. Delete the system registry key parameters
4. Update your antivirus databases or buy antivirus software and perform a full scan of the computer.

We recommends that all Internet users back up any important information on their computers, enable maximum protection from network attacks and malicious code on their computers, refrain from executing suspicious programs received from untrustworthy sources.

Also Be Aware of the Following Threats:
WebLookUp Adware Removal
SillyDl.CIQ Trojan Information
Remove Iron.Maiden Backdoor

WordMacro.MWVCK malware description and removal detail
Categories:Trojan,Backdoor,Downloader,DoS
Also known as:

[Panda]WM/MWVCK.A;
[Computer Associates]WordMacro/MWVCK.A

Platforms / OS: Windows 95, Windows 98, Windows 98 SE, Windows NT, Windows ME, Windows 2000, Windows XP, Windows 2003, Windows Vista

Removing WordMacro.MWVCK:

An up-to-date copy of ExterminateIt should detect and prevent infection from WordMacro.MWVCK.

If you do not have ExterminateIt and you are worried that you may have infected computer, you could run trial version of ExterminateIt, or remove WordMacro.MWVCK manually.

To completely manually remove WordMacro.MWVCK malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with WordMacro.MWVCK.

1. Use Task Manager to terminate the WordMacro.MWVCK process.
2. Delete the original WordMacro.MWVCK file and folders.
3. Delete the system registry key parameters
4. Update your antivirus databases or buy antivirus software and perform a full scan of the computer.

We recommends that all Internet users back up any important information on their computers, enable maximum protection from network attacks and malicious code on their computers, refrain from executing suspicious programs received from untrustworthy sources.

Also Be Aware of the Following Threats:
Remove CDA Trojan

Mansund malware description and removal detail
Categories:Trojan

Platforms / OS: Windows 95, Windows 98, Windows 98 SE, Windows NT, Windows ME, Windows 2000, Windows XP, Windows 2003, Windows Vista

Removing Mansund:

An up-to-date copy of ExterminateIt should detect and prevent infection from Mansund.

If you do not have ExterminateIt and you are worried that you may have infected computer, you could run trial version of ExterminateIt, or remove Mansund manually.

To completely manually remove Mansund malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Mansund.

1. Use Task Manager to terminate the Mansund process.
2. Delete the original Mansund file and folders.
3. Delete the system registry key parameters
4. Update your antivirus databases or buy antivirus software and perform a full scan of the computer.

We recommends that all Internet users back up any important information on their computers, enable maximum protection from network attacks and malicious code on their computers, refrain from executing suspicious programs received from untrustworthy sources.

Also Be Aware of the Following Threats:
Fumble Trojan Symptoms
Zlob.Fam.Gold Codec Trojan Symptoms
Peper Trojan Removal instruction
Zlob.Fam.PornoPlayer Trojan Cleaner
Delf Trojan Symptoms

mailgex malware description and removal detail
Categories:Trojan,DoS
Also known as:

[Panda]Joke/MailGex

Platforms / OS: Windows 95, Windows 98, Windows 98 SE, Windows NT, Windows ME, Windows 2000, Windows XP, Windows 2003, Windows Vista

Removing mailgex:

An up-to-date copy of ExterminateIt should detect and prevent infection from mailgex.

If you do not have ExterminateIt and you are worried that you may have infected computer, you could run trial version of ExterminateIt, or remove mailgex manually.

To completely manually remove mailgex malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with mailgex.

1. Use Task Manager to terminate the mailgex process.
2. Delete the original mailgex file and folders.
3. Delete the system registry key parameters
4. Update your antivirus databases or buy antivirus software and perform a full scan of the computer.

We recommends that all Internet users back up any important information on their computers, enable maximum protection from network attacks and malicious code on their computers, refrain from executing suspicious programs received from untrustworthy sources.

Also Be Aware of the Following Threats:
QQCat Backdoor Symptoms
Win32.Webber Backdoor Cleaner
Nacluv Trojan Symptoms
Remove TheBugger Trojan
Temairg Trojan Removal

PSW.QQpass.am malware description and removal detail
Categories:Trojan,Hacker Tool
Also known as:

[Panda]Trojan Horse.LC

Platforms / OS: Windows 95, Windows 98, Windows 98 SE, Windows NT, Windows ME, Windows 2000, Windows XP, Windows 2003, Windows Vista

Removing PSW.QQpass.am:

An up-to-date copy of ExterminateIt should detect and prevent infection from PSW.QQpass.am.

If you do not have ExterminateIt and you are worried that you may have infected computer, you could run trial version of ExterminateIt, or remove PSW.QQpass.am manually.

To completely manually remove PSW.QQpass.am malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with PSW.QQpass.am.

1. Use Task Manager to terminate the PSW.QQpass.am process.
2. Delete the original PSW.QQpass.am file and folders.
3. Delete the system registry key parameters
4. Update your antivirus databases or buy antivirus software and perform a full scan of the computer.

We recommends that all Internet users back up any important information on their computers, enable maximum protection from network attacks and malicious code on their computers, refrain from executing suspicious programs received from untrustworthy sources.

Also Be Aware of the Following Threats:
CWS.Keymgrldr Hijacker Information
Ads.dbforums Tracking Cookie Information
Brocat Trojan Information
EliteMedia Adware Information
Caterpillar Trojan Information

Pigeon.EUN malware description and removal detail
Categories:Trojan

Platforms / OS: Windows 95, Windows 98, Windows 98 SE, Windows NT, Windows ME, Windows 2000, Windows XP, Windows 2003, Windows Vista

Removing Pigeon.EUN:

An up-to-date copy of ExterminateIt should detect and prevent infection from Pigeon.EUN.

If you do not have ExterminateIt and you are worried that you may have infected computer, you could run trial version of ExterminateIt, or remove Pigeon.EUN manually.

To completely manually remove Pigeon.EUN malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Pigeon.EUN.

1. Use Task Manager to terminate the Pigeon.EUN process.
2. Delete the original Pigeon.EUN file and folders.
3. Delete the system registry key parameters
4. Update your antivirus databases or buy antivirus software and perform a full scan of the computer.

We recommends that all Internet users back up any important information on their computers, enable maximum protection from network attacks and malicious code on their computers, refrain from executing suspicious programs received from untrustworthy sources.

Also Be Aware of the Following Threats:
SubSeven.Server.family Backdoor Symptoms
Pigeon.AFL Trojan Symptoms
Motd Backdoor Removal
NJStar.Asian.Explorer BHO Information
AceNotes.Free Adware Information

HKLove malware description and removal detail
Categories:Trojan
Also known as:

[Panda]Trj/Hklove

Platforms / OS: Windows 95, Windows 98, Windows 98 SE, Windows NT, Windows ME, Windows 2000, Windows XP, Windows 2003, Windows Vista

Removing HKLove:

An up-to-date copy of ExterminateIt should detect and prevent infection from HKLove.

If you do not have ExterminateIt and you are worried that you may have infected computer, you could run trial version of ExterminateIt, or remove HKLove manually.

To completely manually remove HKLove malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with HKLove.

1. Use Task Manager to terminate the HKLove process.
2. Delete the original HKLove file and folders.
3. Delete the system registry key parameters
4. Update your antivirus databases or buy antivirus software and perform a full scan of the computer.

We recommends that all Internet users back up any important information on their computers, enable maximum protection from network attacks and malicious code on their computers, refrain from executing suspicious programs received from untrustworthy sources.

Also Be Aware of the Following Threats:
Super.Dial Adware Removal instruction
Dan.Tiny.Wildthng Trojan Information
Pigeon.AKX Trojan Information
Removing Bancos.HLQ Trojan
ICQ.version.and.UDP.portion.details Trojan Information

Bancos.GHQ malware description and removal detail
Categories:Trojan

Platforms / OS: Windows 95, Windows 98, Windows 98 SE, Windows NT, Windows ME, Windows 2000, Windows XP, Windows 2003, Windows Vista

Removing Bancos.GHQ:

An up-to-date copy of ExterminateIt should detect and prevent infection from Bancos.GHQ.

If you do not have ExterminateIt and you are worried that you may have infected computer, you could run trial version of ExterminateIt, or remove Bancos.GHQ manually.

To completely manually remove Bancos.GHQ malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Bancos.GHQ.

1. Use Task Manager to terminate the Bancos.GHQ process.
2. Delete the original Bancos.GHQ file and folders.
3. Delete the system registry key parameters
4. Update your antivirus databases or buy antivirus software and perform a full scan of the computer.

We recommends that all Internet users back up any important information on their computers, enable maximum protection from network attacks and malicious code on their computers, refrain from executing suspicious programs received from untrustworthy sources.

Also Be Aware of the Following Threats:
Buschtrommel.Alpha Trojan Removal instruction
Bancos.HVE Trojan Information
BO Trojan Removal

Bancos.HOK malware description and removal detail
Categories:Trojan

Platforms / OS: Windows 95, Windows 98, Windows 98 SE, Windows NT, Windows ME, Windows 2000, Windows XP, Windows 2003, Windows Vista

Removing Bancos.HOK:

An up-to-date copy of ExterminateIt should detect and prevent infection from Bancos.HOK.

If you do not have ExterminateIt and you are worried that you may have infected computer, you could run trial version of ExterminateIt, or remove Bancos.HOK manually.

To completely manually remove Bancos.HOK malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Bancos.HOK.

1. Use Task Manager to terminate the Bancos.HOK process.
2. Delete the original Bancos.HOK file and folders.
3. Delete the system registry key parameters
4. Update your antivirus databases or buy antivirus software and perform a full scan of the computer.

We recommends that all Internet users back up any important information on their computers, enable maximum protection from network attacks and malicious code on their computers, refrain from executing suspicious programs received from untrustworthy sources.

Also Be Aware of the Following Threats:
Win32.Lioten Trojan Removal
Pigeon.AVMO Trojan Cleaner
Trojan.Spy.Win32.Sters Trojan Cleaner

Agent.li malware description and removal detail
Categories:Downloader

Platforms / OS: Windows 95, Windows 98, Windows 98 SE, Windows NT, Windows ME, Windows 2000, Windows XP, Windows 2003, Windows Vista

Detecting Agent.li:

Registry Keys:
HKEY_LOCAL_MACHINE\software\ptssa

Removing Agent.li:

An up-to-date copy of ExterminateIt should detect and prevent infection from Agent.li.

If you do not have ExterminateIt and you are worried that you may have infected computer, you could run trial version of ExterminateIt, or remove Agent.li manually.

To completely manually remove Agent.li malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Agent.li.

1. Use Task Manager to terminate the Agent.li process.
2. Delete the original Agent.li file and folders.
3. Delete the system registry key parameters
4. Update your antivirus databases or buy antivirus software and perform a full scan of the computer.

We recommends that all Internet users back up any important information on their computers, enable maximum protection from network attacks and malicious code on their computers, refrain from executing suspicious programs received from untrustworthy sources.

Also Be Aware of the Following Threats:
Delf.ir Backdoor Cleaner
SH.Over Trojan Information

webdex.click.tracks.com malware description and removal detail
Categories:Tracking Cookie

Platforms / OS: Windows 95, Windows 98, Windows 98 SE, Windows NT, Windows ME, Windows 2000, Windows XP, Windows 2003, Windows Vista

Removing webdex.click.tracks.com:

An up-to-date copy of ExterminateIt should detect and prevent infection from webdex.click.tracks.com.

If you do not have ExterminateIt and you are worried that you may have infected computer, you could run trial version of ExterminateIt, or remove webdex.click.tracks.com manually.

To completely manually remove webdex.click.tracks.com malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with webdex.click.tracks.com.

1. Use Task Manager to terminate the webdex.click.tracks.com process.
2. Delete the original webdex.click.tracks.com file and folders.
3. Delete the system registry key parameters
4. Update your antivirus databases or buy antivirus software and perform a full scan of the computer.

We recommends that all Internet users back up any important information on their computers, enable maximum protection from network attacks and malicious code on their computers, refrain from executing suspicious programs received from untrustworthy sources.

Also Be Aware of the Following Threats:
Apropo Downloader Symptoms
AdGoblin.plathping Hijacker Symptoms

PhotoPaul.Server malware description and removal detail
Categories:Backdoor
Also known as:

[Computer Associates]Backdoor/PhotoPaul.Server

Platforms / OS: Windows 95, Windows 98, Windows 98 SE, Windows NT, Windows ME, Windows 2000, Windows XP, Windows 2003, Windows Vista

Removing PhotoPaul.Server:

An up-to-date copy of ExterminateIt should detect and prevent infection from PhotoPaul.Server.

If you do not have ExterminateIt and you are worried that you may have infected computer, you could run trial version of ExterminateIt, or remove PhotoPaul.Server manually.

To completely manually remove PhotoPaul.Server malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with PhotoPaul.Server.

1. Use Task Manager to terminate the PhotoPaul.Server process.
2. Delete the original PhotoPaul.Server file and folders.
3. Delete the system registry key parameters
4. Update your antivirus databases or buy antivirus software and perform a full scan of the computer.

We recommends that all Internet users back up any important information on their computers, enable maximum protection from network attacks and malicious code on their computers, refrain from executing suspicious programs received from untrustworthy sources.

Also Be Aware of the Following Threats:
Remove IStartHere Trojan
Lineage.AAK Trojan Removal
LetsSearch.IE.Lookup BHO Removal instruction

Bangsnif malware description and removal detail
Categories:Trojan

Platforms / OS: Windows 95, Windows 98, Windows 98 SE, Windows NT, Windows ME, Windows 2000, Windows XP, Windows 2003, Windows Vista

Removing Bangsnif:

An up-to-date copy of ExterminateIt should detect and prevent infection from Bangsnif.

If you do not have ExterminateIt and you are worried that you may have infected computer, you could run trial version of ExterminateIt, or remove Bangsnif manually.

To completely manually remove Bangsnif malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Bangsnif.

1. Use Task Manager to terminate the Bangsnif process.
2. Delete the original Bangsnif file and folders.
3. Delete the system registry key parameters
4. Update your antivirus databases or buy antivirus software and perform a full scan of the computer.

We recommends that all Internet users back up any important information on their computers, enable maximum protection from network attacks and malicious code on their computers, refrain from executing suspicious programs received from untrustworthy sources.

Also Be Aware of the Following Threats:
Remove Russian.Tiny Trojan

Banker.CIY malware description and removal detail
Categories:Trojan
Also known as:

[Kaspersky]Trojan-Spy.Win32.Banker.cgi;
[McAfee]PWS-Banker.gen.g;
[Panda]Trj/Banbra.DPS;
[Other]W32/Banker.BDQL,TrojanSpy:Win32/Banker!92B2,Infostealer.Banpaes
Visible Symptoms:
Files in system folders:
[%COMMON_STARTUP%]\cica.scr
[%SYSTEM%]\cica.scr
[%COMMON_STARTUP%]\cica.scr
[%SYSTEM%]\cica.scr

Platforms / OS: Windows 95, Windows 98, Windows 98 SE, Windows NT, Windows ME, Windows 2000, Windows XP, Windows 2003, Windows Vista

Detecting Banker.CIY:

Files:
[%COMMON_STARTUP%]\cica.scr
[%SYSTEM%]\cica.scr
[%COMMON_STARTUP%]\cica.scr
[%SYSTEM%]\cica.scr

Registry Values:
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run

Removing Banker.CIY:

An up-to-date copy of ExterminateIt should detect and prevent infection from Banker.CIY.

If you do not have ExterminateIt and you are worried that you may have infected computer, you could run trial version of ExterminateIt, or remove Banker.CIY manually.

To completely manually remove Banker.CIY malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Banker.CIY.

1. Use Task Manager to terminate the Banker.CIY process.
2. Delete the original Banker.CIY file and folders.
3. Delete the system registry key parameters
4. Update your antivirus databases or buy antivirus software and perform a full scan of the computer.

We recommends that all Internet users back up any important information on their computers, enable maximum protection from network attacks and malicious code on their computers, refrain from executing suspicious programs received from untrustworthy sources.

Also Be Aware of the Following Threats:
Vxidl.AXB Trojan Cleaner
Troia RAT Symptoms

Cadux malware description and removal detail
Categories:Trojan,Downloader
Also known as:

[Kaspersky]Trojan-Downloader.Win32.VB.aan,Hoax.Win32.Renos.dk,Trojan-downloader.Win32.Vb.avf,Hoax.Win32.Renos.fn,Trojan-Downloader.Win32.VB.att,Trojan.Win32.VB.azo,Trojan.Win32.BHO.he,Hoax.Win32.Renos.kj,Trojan-Downloader.Win32.VB.asx;
[McAfee]TFactory,FakeAlert-J,Generic AdClciker.h,Puper;
[Other]Trojan-Downloader.Win32.VB.aeq,cashdeluxe,DesktopScam,Win32/Cadux.BA,Win32/Cadux.AR,Win32/Cadux.BI,Win32/Cadux.BL,Win32/Cadux.BM,Win32/Cadux.BO,WIn32/Cadux.BN,Win32/Cadux.BS,TROJ_VB.FFB,W32/DLoader.CYBX
Visible Symptoms:
Files in system folders:
[%LOCAL_APPDATA%]\Temp\laf4.exe
[%PROFILE_TEMP%]\laf1.exe
[%PROFILE_TEMP%]\laf2.exe
[%SYSTEM%]\TMRSRV32.EXE
[%SYSTEM%]\adobepnl.dll
[%SYSTEM%]\ctqkqitc.exe
[%SYSTEM%]\ftxshflh.exe
[%SYSTEM%]\glhzhftb.exe
[%SYSTEM%]\hlydrdsd.exe
[%SYSTEM%]\ieffse32.dll
[%SYSTEM%]\iucnkhpw.exe
[%SYSTEM%]\kvpaibjs.exe
[%SYSTEM%]\lnfdacmb.exe
[%SYSTEM%]\miszjogw.exe
[%SYSTEM%]\orthihug.exe
[%SYSTEM%]\qjrkvy.exe
[%SYSTEM%]\questmod.dll
[%SYSTEM%]\rduawmpi.exe
[%SYSTEM%]\regmod.exe
[%SYSTEM%]\repigsp.exe
[%SYSTEM%]\runsrv32.dll
[%SYSTEM%]\runsrv32.exe
[%SYSTEM%]\tmrsrv32.exe
[%SYSTEM%]\udpmod.dll
[%SYSTEM%]\users32.exe
[%SYSTEM%]\wbycpxwc.exe
[%SYSTEM%]\winapi32.dll
[%SYSTEM%]\winbl32.dll
[%SYSTEM%]\winflash.dll
[%SYSTEM%]\wqjbaztr.exe
[%SYSTEM%]\ymjepyzw.exe
[%SYSTEM%]\ythrdjut.exe
[%SYSTEM%]\zddipbsu.exe
[%SYSTEM%]\zdphsuuy.exe
[%WINDOWS%]\about_spyware_bg.gif
[%WINDOWS%]\about_spyware_bottom.gif
[%WINDOWS%]\alexaie.dll
[%WINDOWS%]\alxie328.dll
[%WINDOWS%]\alxtb1.dll
[%WINDOWS%]\as.gif
[%WINDOWS%]\as_header.gif
[%WINDOWS%]\bg.gif
[%WINDOWS%]\box_1.gif
[%WINDOWS%]\box_2.gif
[%WINDOWS%]\box_3.gif
[%WINDOWS%]\button_buynow.gif
[%WINDOWS%]\button_freescan.gif
[%WINDOWS%]\close-bar.gif
[%WINDOWS%]\dlmax.dll
[%WINDOWS%]\download_box.gif
[%WINDOWS%]\features.gif
[%WINDOWS%]\fkwggshm.exe
[%WINDOWS%]\footer_back.gif
[%WINDOWS%]\footer_back.jpg
[%WINDOWS%]\header_1.gif
[%WINDOWS%]\header_2.gif
[%WINDOWS%]\header_3.gif
[%WINDOWS%]\header_4.gif
[%WINDOWS%]\infected.gif
[%WINDOWS%]\main_back.gif
[%WINDOWS%]\rf.gif
[%WINDOWS%]\rf_header.gif
[%WINDOWS%]\scan_btn.gif
[%WINDOWS%]\security-center-bg.gif
[%WINDOWS%]\security-center-logo.gif
[%WINDOWS%]\security_center_caption.gif
[%WINDOWS%]\sep_hor.gif
[%WINDOWS%]\sep_vert.gif
[%WINDOWS%]\spacer.gif'
[%WINDOWS%]\spyware-detected.gif
[%WINDOWS%]\star.gif
[%WINDOWS%]\star_gray.gif
[%WINDOWS%]\star_gray_small.gif
[%WINDOWS%]\star_small.gif
[%WINDOWS%]\susp.exe
[%WINDOWS%]\sysrlb32.exe
[%WINDOWS%]\ts.gif
[%WINDOWS%]\ts_header.gif
[%WINDOWS%]\v.gif
[%WINDOWS%]\warning-bar-ico.gif
[%WINDOWS%]\warning_icon.gif
[%WINDOWS%]\winh32.exe
[%WINDOWS%]\win_logo.gif
[%WINDOWS%]\x.gif
[%SYSTEM%]\kjdylhup.exe
[%SYSTEM%]\msdn_lib.dll
[%SYSTEM%]\SCCVHOST.exe
[%SYSTEM%]\SCCVHOSThk.dll
[%SYSTEM%]\SCCVHOSTr.exe
[%SYSTEM%]\SCCVHOSTwb.dll
[%LOCAL_APPDATA%]\Temp\laf4.exe
[%PROFILE_TEMP%]\laf1.exe
[%PROFILE_TEMP%]\laf2.exe
[%SYSTEM%]\TMRSRV32.EXE
[%SYSTEM%]\adobepnl.dll
[%SYSTEM%]\ctqkqitc.exe
[%SYSTEM%]\ftxshflh.exe
[%SYSTEM%]\glhzhftb.exe
[%SYSTEM%]\hlydrdsd.exe
[%SYSTEM%]\ieffse32.dll
[%SYSTEM%]\iucnkhpw.exe
[%SYSTEM%]\kvpaibjs.exe
[%SYSTEM%]\lnfdacmb.exe
[%SYSTEM%]\miszjogw.exe
[%SYSTEM%]\orthihug.exe
[%SYSTEM%]\qjrkvy.exe
[%SYSTEM%]\questmod.dll
[%SYSTEM%]\rduawmpi.exe
[%SYSTEM%]\regmod.exe
[%SYSTEM%]\repigsp.exe
[%SYSTEM%]\runsrv32.dll
[%SYSTEM%]\runsrv32.exe
[%SYSTEM%]\tmrsrv32.exe
[%SYSTEM%]\udpmod.dll
[%SYSTEM%]\users32.exe
[%SYSTEM%]\wbycpxwc.exe
[%SYSTEM%]\winapi32.dll
[%SYSTEM%]\winbl32.dll
[%SYSTEM%]\winflash.dll
[%SYSTEM%]\wqjbaztr.exe
[%SYSTEM%]\ymjepyzw.exe
[%SYSTEM%]\ythrdjut.exe
[%SYSTEM%]\zddipbsu.exe
[%SYSTEM%]\zdphsuuy.exe
[%WINDOWS%]\about_spyware_bg.gif
[%WINDOWS%]\about_spyware_bottom.gif
[%WINDOWS%]\alexaie.dll
[%WINDOWS%]\alxie328.dll
[%WINDOWS%]\alxtb1.dll
[%WINDOWS%]\as.gif
[%WINDOWS%]\as_header.gif
[%WINDOWS%]\bg.gif
[%WINDOWS%]\box_1.gif
[%WINDOWS%]\box_2.gif
[%WINDOWS%]\box_3.gif
[%WINDOWS%]\button_buynow.gif
[%WINDOWS%]\button_freescan.gif
[%WINDOWS%]\close-bar.gif
[%WINDOWS%]\dlmax.dll
[%WINDOWS%]\download_box.gif
[%WINDOWS%]\features.gif
[%WINDOWS%]\fkwggshm.exe
[%WINDOWS%]\footer_back.gif
[%WINDOWS%]\footer_back.jpg
[%WINDOWS%]\header_1.gif
[%WINDOWS%]\header_2.gif
[%WINDOWS%]\header_3.gif
[%WINDOWS%]\header_4.gif
[%WINDOWS%]\infected.gif
[%WINDOWS%]\main_back.gif
[%WINDOWS%]\rf.gif
[%WINDOWS%]\rf_header.gif
[%WINDOWS%]\scan_btn.gif
[%WINDOWS%]\security-center-bg.gif
[%WINDOWS%]\security-center-logo.gif
[%WINDOWS%]\security_center_caption.gif
[%WINDOWS%]\sep_hor.gif
[%WINDOWS%]\sep_vert.gif
[%WINDOWS%]\spacer.gif'
[%WINDOWS%]\spyware-detected.gif
[%WINDOWS%]\star.gif
[%WINDOWS%]\star_gray.gif
[%WINDOWS%]\star_gray_small.gif
[%WINDOWS%]\star_small.gif
[%WINDOWS%]\susp.exe
[%WINDOWS%]\sysrlb32.exe
[%WINDOWS%]\ts.gif
[%WINDOWS%]\ts_header.gif
[%WINDOWS%]\v.gif
[%WINDOWS%]\warning-bar-ico.gif
[%WINDOWS%]\warning_icon.gif
[%WINDOWS%]\winh32.exe
[%WINDOWS%]\win_logo.gif
[%WINDOWS%]\x.gif
[%SYSTEM%]\kjdylhup.exe
[%SYSTEM%]\msdn_lib.dll
[%SYSTEM%]\SCCVHOST.exe
[%SYSTEM%]\SCCVHOSThk.dll
[%SYSTEM%]\SCCVHOSTr.exe
[%SYSTEM%]\SCCVHOSTwb.dll

In order to ensure that the Cadux is launched automatically each time the system is booted, the Cadux adds a link to its executable file in the system registry:
HKLM\Microsoft\Windows\CurrentVersion\Run
[%LOCAL_APPDATA%]\Temp\laf4.exe
[%PROFILE_TEMP%]\laf1.exe
[%PROFILE_TEMP%]\laf2.exe
[%SYSTEM%]\ctqkqitc.exe
[%SYSTEM%]\ftxshflh.exe
[%SYSTEM%]\glhzhftb.exe
[%SYSTEM%]\hlydrdsd.exe
[%SYSTEM%]\iucnkhpw.exe
[%SYSTEM%]\kvpaibjs.exe
[%SYSTEM%]\lnfdacmb.exe
[%SYSTEM%]\miszjogw.exe
[%SYSTEM%]\orthihug.exe
[%SYSTEM%]\qjrkvy.exe
[%SYSTEM%]\rduawmpi.exe
[%SYSTEM%]\regmod.exe
[%SYSTEM%]\repigsp.exe
[%SYSTEM%]\runsrv32.exe
[%SYSTEM%]\tmrsrv32.exe
[%SYSTEM%]\users32.exe
[%SYSTEM%]\wbycpxwc.exe
[%SYSTEM%]\wqjbaztr.exe
[%SYSTEM%]\ymjepyzw.exe
[%SYSTEM%]\ythrdjut.exe
[%SYSTEM%]\zddipbsu.exe
[%SYSTEM%]\zdphsuuy.exe
[%WINDOWS%]\fkwggshm.exe
[%WINDOWS%]\susp.exe
[%WINDOWS%]\sysrlb32.exe
[%WINDOWS%]\winh32.exe
[%SYSTEM%]\kjdylhup.exe
[%SYSTEM%]\SCCVHOST.exe
[%SYSTEM%]\SCCVHOSTr.exe

Platforms / OS: Windows 95, Windows 98, Windows 98 SE, Windows NT, Windows ME, Windows 2000, Windows XP, Windows 2003, Windows Vista