Remove Malware and Viruses

This summary is not available. Please click here to view the post.

StartPage.iy malware description and removal detail
Categories:Hijacker

Platforms / OS: Windows 95, Windows 98, Windows 98 SE, Windows NT, Windows ME, Windows 2000, Windows XP, Windows 2003, Windows Vista

Removing StartPage.iy:

An up-to-date copy of ExterminateIt should detect and prevent infection from StartPage.iy.

If you do not have ExterminateIt and you are worried that you may have infected computer, you could run trial version of ExterminateIt, or remove StartPage.iy manually.

To completely manually remove StartPage.iy malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with StartPage.iy.

1. Use Task Manager to terminate the StartPage.iy process.
2. Delete the original StartPage.iy file and folders.
3. Delete the system registry key parameters
4. Update your antivirus databases or buy antivirus software and perform a full scan of the computer.

We recommends that all Internet users back up any important information on their computers, enable maximum protection from network attacks and malicious code on their computers, refrain from executing suspicious programs received from untrustworthy sources.

Also Be Aware of the Following Threats:
Pigeon.AVNH Trojan Cleaner
Remove KazaaLite.com Tracking Cookie
Reboot.Cab Hostile Code Cleaner
SmartMoney.com Tracking Cookie Removal instruction

Ini.Killer malware description and removal detail
Categories:Trojan,Backdoor,RAT,Hacker Tool
Also known as:

[Kaspersky]Backdoor.IniKill.12,Backdoor.IniKill.30.b,Backdoor.IniKill.40,Backdoor.IniKill.30,Backdoor.Win32.IniKill.30;
[Eset]Win32/IniKill.40 trojan;
[McAfee]Generic,IniKILL,BackDoor-BK;
[F-Prot]security risk or a "backdoor" program,W32/Backdoor.Inikill;
[Panda]Bck/IniKill.12,Bck/Inikill.30.b,Bck/IniKill.40,Trj/Inikill.A,Trj/Inikill.B;
[Computer Associates]Backdoor/IniKill.12,Backdoor/IniKiller.1_2!Server,Win32.IniKill.12,Backdoor/Explorer!Server,Backdoor/Inikill.40,Backdoor/IniKiller,Win32.IniKill

Platforms / OS: Windows 95, Windows 98, Windows 98 SE, Windows NT, Windows ME, Windows 2000, Windows XP, Windows 2003, Windows Vista

Removing Ini.Killer:

An up-to-date copy of ExterminateIt should detect and prevent infection from Ini.Killer.

If you do not have ExterminateIt and you are worried that you may have infected computer, you could run trial version of ExterminateIt, or remove Ini.Killer manually.

To completely manually remove Ini.Killer malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Ini.Killer.

1. Use Task Manager to terminate the Ini.Killer process.
2. Delete the original Ini.Killer file and folders.
3. Delete the system registry key parameters
4. Update your antivirus databases or buy antivirus software and perform a full scan of the computer.

We recommends that all Internet users back up any important information on their computers, enable maximum protection from network attacks and malicious code on their computers, refrain from executing suspicious programs received from untrustworthy sources.

Also Be Aware of the Following Threats:
newzealand Adware Removal
Typer704 Trojan Information

Keenval malware description and removal detail
Categories:Downloader
Visible Symptoms:
Files in system folders:
[%PROGRAM_FILES%]\powers~1\toolbar\pwrs0108.dll
[%PROGRAM_FILES%]\powers~1\toolbar\pwrs0108.dll

Platforms / OS: Windows 95, Windows 98, Windows 98 SE, Windows NT, Windows ME, Windows 2000, Windows XP, Windows 2003, Windows Vista

Detecting Keenval:

Files:
[%PROGRAM_FILES%]\powers~1\toolbar\pwrs0108.dll
[%PROGRAM_FILES%]\powers~1\toolbar\pwrs0108.dll

Removing Keenval:

An up-to-date copy of ExterminateIt should detect and prevent infection from Keenval.

If you do not have ExterminateIt and you are worried that you may have infected computer, you could run trial version of ExterminateIt, or remove Keenval manually.

To completely manually remove Keenval malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Keenval.

1. Use Task Manager to terminate the Keenval process.
2. Delete the original Keenval file and folders.
3. Delete the system registry key parameters
4. Update your antivirus databases or buy antivirus software and perform a full scan of the computer.

We recommends that all Internet users back up any important information on their computers, enable maximum protection from network attacks and malicious code on their computers, refrain from executing suspicious programs received from untrustworthy sources.

Also Be Aware of the Following Threats:
Muquest Trojan Information
SSBY.com Tracking Cookie Cleaner
BAT.FF23 Trojan Cleaner
Remove Resourcer Trojan
Rbot Trojan Removal instruction

webstat.com malware description and removal detail
Categories:Tracking Cookie

Platforms / OS: Windows 95, Windows 98, Windows 98 SE, Windows NT, Windows ME, Windows 2000, Windows XP, Windows 2003, Windows Vista

Removing webstat.com:

An up-to-date copy of ExterminateIt should detect and prevent infection from webstat.com.

If you do not have ExterminateIt and you are worried that you may have infected computer, you could run trial version of ExterminateIt, or remove webstat.com manually.

To completely manually remove webstat.com malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with webstat.com.

1. Use Task Manager to terminate the webstat.com process.
2. Delete the original webstat.com file and folders.
3. Delete the system registry key parameters
4. Update your antivirus databases or buy antivirus software and perform a full scan of the computer.

We recommends that all Internet users back up any important information on their computers, enable maximum protection from network attacks and malicious code on their computers, refrain from executing suspicious programs received from untrustworthy sources.

Also Be Aware of the Following Threats:
Bancos.GZC Trojan Cleaner
Pardillo Backdoor Information

Bancos.GXU malware description and removal detail
Categories:Trojan

Platforms / OS: Windows 95, Windows 98, Windows 98 SE, Windows NT, Windows ME, Windows 2000, Windows XP, Windows 2003, Windows Vista

Removing Bancos.GXU:

An up-to-date copy of ExterminateIt should detect and prevent infection from Bancos.GXU.

If you do not have ExterminateIt and you are worried that you may have infected computer, you could run trial version of ExterminateIt, or remove Bancos.GXU manually.

To completely manually remove Bancos.GXU malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Bancos.GXU.

1. Use Task Manager to terminate the Bancos.GXU process.
2. Delete the original Bancos.GXU file and folders.
3. Delete the system registry key parameters
4. Update your antivirus databases or buy antivirus software and perform a full scan of the computer.

We recommends that all Internet users back up any important information on their computers, enable maximum protection from network attacks and malicious code on their computers, refrain from executing suspicious programs received from untrustworthy sources.

Also Be Aware of the Following Threats:
Removing Revenger Backdoor
Remove Generic.PUP Trojan
AntiMIT Trojan Removal instruction
ASP.Ace Trojan Removal instruction
Delf.ah Backdoor Removal

Sepfet malware description and removal detail
Categories:Adware

Platforms / OS: Windows 95, Windows 98, Windows 98 SE, Windows NT, Windows ME, Windows 2000, Windows XP, Windows 2003, Windows Vista

Removing Sepfet:

An up-to-date copy of ExterminateIt should detect and prevent infection from Sepfet.

If you do not have ExterminateIt and you are worried that you may have infected computer, you could run trial version of ExterminateIt, or remove Sepfet manually.

To completely manually remove Sepfet malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Sepfet.

1. Use Task Manager to terminate the Sepfet process.
2. Delete the original Sepfet file and folders.
3. Delete the system registry key parameters
4. Update your antivirus databases or buy antivirus software and perform a full scan of the computer.

We recommends that all Internet users back up any important information on their computers, enable maximum protection from network attacks and malicious code on their computers, refrain from executing suspicious programs received from untrustworthy sources.

Also Be Aware of the Following Threats:
Remove SillyDl.CXR Trojan
FVHS Trojan Symptoms
SillyDl.CMC Trojan Symptoms
Removing PurpleCum Trojan
Lixy.Server Trojan Symptoms

Troll!downloader malware description and removal detail
Categories:Trojan

Platforms / OS: Windows 95, Windows 98, Windows 98 SE, Windows NT, Windows ME, Windows 2000, Windows XP, Windows 2003, Windows Vista

Removing Troll!downloader:

An up-to-date copy of ExterminateIt should detect and prevent infection from Troll!downloader.

If you do not have ExterminateIt and you are worried that you may have infected computer, you could run trial version of ExterminateIt, or remove Troll!downloader manually.

To completely manually remove Troll!downloader malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Troll!downloader.

1. Use Task Manager to terminate the Troll!downloader process.
2. Delete the original Troll!downloader file and folders.
3. Delete the system registry key parameters
4. Update your antivirus databases or buy antivirus software and perform a full scan of the computer.

We recommends that all Internet users back up any important information on their computers, enable maximum protection from network attacks and malicious code on their computers, refrain from executing suspicious programs received from untrustworthy sources.

Also Be Aware of the Following Threats:
Bancos.GIR Trojan Removal
Removing WorldAntiSpy Adware
SillyDl.CUW Trojan Cleaner

JScript.GodMessage malware description and removal detail
Categories:Worm,Hacker Tool
Also known as:

[Kaspersky]VBS.GMWC,VBS.GMWC.c;
[Panda]VBS/GMW.A,VBS/TheThing,VBS/GMWC.C;
[Computer Associates]JScript/GodMessage!Worm

Platforms / OS: Windows 95, Windows 98, Windows 98 SE, Windows NT, Windows ME, Windows 2000, Windows XP, Windows 2003, Windows Vista

Removing JScript.GodMessage:

An up-to-date copy of ExterminateIt should detect and prevent infection from JScript.GodMessage.

If you do not have ExterminateIt and you are worried that you may have infected computer, you could run trial version of ExterminateIt, or remove JScript.GodMessage manually.

To completely manually remove JScript.GodMessage malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with JScript.GodMessage.

1. Use Task Manager to terminate the JScript.GodMessage process.
2. Delete the original JScript.GodMessage file and folders.
3. Delete the system registry key parameters
4. Update your antivirus databases or buy antivirus software and perform a full scan of the computer.

We recommends that all Internet users back up any important information on their computers, enable maximum protection from network attacks and malicious code on their computers, refrain from executing suspicious programs received from untrustworthy sources.

Also Be Aware of the Following Threats:
EUniverse.IncrediFind Hijacker Information
Annoymail Trojan Information

Agent.bd malware description and removal detail
Categories:Trojan

Platforms / OS: Windows 95, Windows 98, Windows 98 SE, Windows NT, Windows ME, Windows 2000, Windows XP, Windows 2003, Windows Vista

Removing Agent.bd:

An up-to-date copy of ExterminateIt should detect and prevent infection from Agent.bd.

If you do not have ExterminateIt and you are worried that you may have infected computer, you could run trial version of ExterminateIt, or remove Agent.bd manually.

To completely manually remove Agent.bd malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Agent.bd.

1. Use Task Manager to terminate the Agent.bd process.
2. Delete the original Agent.bd file and folders.
3. Delete the system registry key parameters
4. Update your antivirus databases or buy antivirus software and perform a full scan of the computer.

We recommends that all Internet users back up any important information on their computers, enable maximum protection from network attacks and malicious code on their computers, refrain from executing suspicious programs received from untrustworthy sources.

Also Be Aware of the Following Threats:
Pigeon.ESE Trojan Symptoms

Poptiobot malware description and removal detail
Categories:Trojan

Platforms / OS: Windows 95, Windows 98, Windows 98 SE, Windows NT, Windows ME, Windows 2000, Windows XP, Windows 2003, Windows Vista

Removing Poptiobot:

An up-to-date copy of ExterminateIt should detect and prevent infection from Poptiobot.

If you do not have ExterminateIt and you are worried that you may have infected computer, you could run trial version of ExterminateIt, or remove Poptiobot manually.

To completely manually remove Poptiobot malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Poptiobot.

1. Use Task Manager to terminate the Poptiobot process.
2. Delete the original Poptiobot file and folders.
3. Delete the system registry key parameters
4. Update your antivirus databases or buy antivirus software and perform a full scan of the computer.

We recommends that all Internet users back up any important information on their computers, enable maximum protection from network attacks and malicious code on their computers, refrain from executing suspicious programs received from untrustworthy sources.

Also Be Aware of the Following Threats:
Asylum.File Trojan Cleaner
Removing Spectre Spyware
Windir.SXS Trojan Information
Removing SillyDl.CTR Trojan
Remove Ms.evils Trojan

Win32.Watch!HookDLL!Trojan malware description and removal detail
Categories:Trojan,Adware

Platforms / OS: Windows 95, Windows 98, Windows 98 SE, Windows NT, Windows ME, Windows 2000, Windows XP, Windows 2003, Windows Vista

Removing Win32.Watch!HookDLL!Trojan:

An up-to-date copy of ExterminateIt should detect and prevent infection from Win32.Watch!HookDLL!Trojan.

If you do not have ExterminateIt and you are worried that you may have infected computer, you could run trial version of ExterminateIt, or remove Win32.Watch!HookDLL!Trojan manually.

To completely manually remove Win32.Watch!HookDLL!Trojan malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Win32.Watch!HookDLL!Trojan.

1. Use Task Manager to terminate the Win32.Watch!HookDLL!Trojan process.
2. Delete the original Win32.Watch!HookDLL!Trojan file and folders.
3. Delete the system registry key parameters
4. Update your antivirus databases or buy antivirus software and perform a full scan of the computer.

We recommends that all Internet users back up any important information on their computers, enable maximum protection from network attacks and malicious code on their computers, refrain from executing suspicious programs received from untrustworthy sources.

Also Be Aware of the Following Threats:
QZap115 Trojan Cleaner
Removing Mas.Mail.Bomber Trojan
Vxidl.ACI Trojan Symptoms

AOL.Casey malware description and removal detail
Categories:Trojan

Platforms / OS: Windows 95, Windows 98, Windows 98 SE, Windows NT, Windows ME, Windows 2000, Windows XP, Windows 2003, Windows Vista

Removing AOL.Casey:

An up-to-date copy of ExterminateIt should detect and prevent infection from AOL.Casey.

If you do not have ExterminateIt and you are worried that you may have infected computer, you could run trial version of ExterminateIt, or remove AOL.Casey manually.

To completely manually remove AOL.Casey malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with AOL.Casey.

1. Use Task Manager to terminate the AOL.Casey process.
2. Delete the original AOL.Casey file and folders.
3. Delete the system registry key parameters
4. Update your antivirus databases or buy antivirus software and perform a full scan of the computer.

We recommends that all Internet users back up any important information on their computers, enable maximum protection from network attacks and malicious code on their computers, refrain from executing suspicious programs received from untrustworthy sources.

Also Be Aware of the Following Threats:
Nuke.ICQNuker Trojan Cleaner
Remove Pigeon.EIP Trojan
Redkod Backdoor Symptoms
elliance.com Tracking Cookie Removal
Microsoft.Media.Server.Denial.of.Service.Attack DoS Removal instruction

Bancos.IGP malware description and removal detail
Categories:Trojan

Platforms / OS: Windows 95, Windows 98, Windows 98 SE, Windows NT, Windows ME, Windows 2000, Windows XP, Windows 2003, Windows Vista

Removing Bancos.IGP:

An up-to-date copy of ExterminateIt should detect and prevent infection from Bancos.IGP.

If you do not have ExterminateIt and you are worried that you may have infected computer, you could run trial version of ExterminateIt, or remove Bancos.IGP manually.

To completely manually remove Bancos.IGP malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Bancos.IGP.

1. Use Task Manager to terminate the Bancos.IGP process.
2. Delete the original Bancos.IGP file and folders.
3. Delete the system registry key parameters
4. Update your antivirus databases or buy antivirus software and perform a full scan of the computer.

We recommends that all Internet users back up any important information on their computers, enable maximum protection from network attacks and malicious code on their computers, refrain from executing suspicious programs received from untrustworthy sources.

Also Be Aware of the Following Threats:
HDOpt Trojan Removal instruction

MagicAds malware description and removal detail
Categories:Adware,BHO
Visible Symptoms:
Files in system folders:
[%SYSTEM%]\madise.dll
[%WINDOWS%]\system\madise.dll
[%SYSTEM%]\madise.dll
[%WINDOWS%]\system\madise.dll

Platforms / OS: Windows 95, Windows 98, Windows 98 SE, Windows NT, Windows ME, Windows 2000, Windows XP, Windows 2003, Windows Vista

Detecting MagicAds:

Files:
[%SYSTEM%]\madise.dll
[%WINDOWS%]\system\madise.dll
[%SYSTEM%]\madise.dll
[%WINDOWS%]\system\madise.dll

Registry Keys:
HKEY_CLASSES_ROOT\clsid\{f760cb9e-c60f-4a89-890e-fae8b849493e}
HKEY_CLASSES_ROOT\software\microsoft\windows\currentversion\explorer\browser helper objects\{f760cb9e-c60f-4a89-890e-fae8b849493e}
HKEY_LOCAL_MACHINE\software\classes\clsid\{f760cb9e-c60f-4a89-890e-fae8b849493e}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{f760cb9e-c60f-4a89-890e-fae8b849493e}

Removing MagicAds:

An up-to-date copy of ExterminateIt should detect and prevent infection from MagicAds.

If you do not have ExterminateIt and you are worried that you may have infected computer, you could run trial version of ExterminateIt, or remove MagicAds manually.

To completely manually remove MagicAds malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with MagicAds.

1. Use Task Manager to terminate the MagicAds process.
2. Delete the original MagicAds file and folders.
3. Delete the system registry key parameters
4. Update your antivirus databases or buy antivirus software and perform a full scan of the computer.

We recommends that all Internet users back up any important information on their computers, enable maximum protection from network attacks and malicious code on their computers, refrain from executing suspicious programs received from untrustworthy sources.

Also Be Aware of the Following Threats:
Avstral Backdoor Symptoms
Removing Win95.Vip Trojan
Remove PWS.Xilon Trojan
Remove BAT.Deltree Trojan

Ducalbill malware description and removal detail
Categories:Trojan

Platforms / OS: Windows 95, Windows 98, Windows 98 SE, Windows NT, Windows ME, Windows 2000, Windows XP, Windows 2003, Windows Vista

Removing Ducalbill:

An up-to-date copy of ExterminateIt should detect and prevent infection from Ducalbill.

If you do not have ExterminateIt and you are worried that you may have infected computer, you could run trial version of ExterminateIt, or remove Ducalbill manually.

To completely manually remove Ducalbill malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Ducalbill.

1. Use Task Manager to terminate the Ducalbill process.
2. Delete the original Ducalbill file and folders.
3. Delete the system registry key parameters
4. Update your antivirus databases or buy antivirus software and perform a full scan of the computer.

We recommends that all Internet users back up any important information on their computers, enable maximum protection from network attacks and malicious code on their computers, refrain from executing suspicious programs received from untrustworthy sources.

Also Be Aware of the Following Threats:
MediaLoads.Enhanced BHO Removal
Remove checkeffect.at Tracking Cookie
Remove Vxidl.AMH Trojan

Theinf.plugin malware description and removal detail
Categories:Backdoor
Also known as:

[Panda]Bck/Incommander.B;
[Computer Associates]Win32.Theinf.19.plugin

Platforms / OS: Windows 95, Windows 98, Windows 98 SE, Windows NT, Windows ME, Windows 2000, Windows XP, Windows 2003, Windows Vista

Removing Theinf.plugin:

An up-to-date copy of ExterminateIt should detect and prevent infection from Theinf.plugin.

If you do not have ExterminateIt and you are worried that you may have infected computer, you could run trial version of ExterminateIt, or remove Theinf.plugin manually.

To completely manually remove Theinf.plugin malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Theinf.plugin.

1. Use Task Manager to terminate the Theinf.plugin process.
2. Delete the original Theinf.plugin file and folders.
3. Delete the system registry key parameters
4. Update your antivirus databases or buy antivirus software and perform a full scan of the computer.

We recommends that all Internet users back up any important information on their computers, enable maximum protection from network attacks and malicious code on their computers, refrain from executing suspicious programs received from untrustworthy sources.

Also Be Aware of the Following Threats:
Bancos.FVN Trojan Symptoms
WWW2.SkooBiDoo Tracking Cookie Cleaner
Best Trojan Removal instruction
thegeoguide.com Tracking Cookie Removal
Ehg.nike.hitbox Tracking Cookie Information

SillyDl.CRR malware description and removal detail
Categories:Trojan

Platforms / OS: Windows 95, Windows 98, Windows 98 SE, Windows NT, Windows ME, Windows 2000, Windows XP, Windows 2003, Windows Vista

Removing SillyDl.CRR:

An up-to-date copy of ExterminateIt should detect and prevent infection from SillyDl.CRR.

If you do not have ExterminateIt and you are worried that you may have infected computer, you could run trial version of ExterminateIt, or remove SillyDl.CRR manually.

To completely manually remove SillyDl.CRR malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with SillyDl.CRR.

1. Use Task Manager to terminate the SillyDl.CRR process.
2. Delete the original SillyDl.CRR file and folders.
3. Delete the system registry key parameters
4. Update your antivirus databases or buy antivirus software and perform a full scan of the computer.

We recommends that all Internet users back up any important information on their computers, enable maximum protection from network attacks and malicious code on their computers, refrain from executing suspicious programs received from untrustworthy sources.

Also Be Aware of the Following Threats:
TrojanSpy.Win32.SpyWin Trojan Removal

VB.dx malware description and removal detail
Categories:Backdoor

Platforms / OS: Windows 95, Windows 98, Windows 98 SE, Windows NT, Windows ME, Windows 2000, Windows XP, Windows 2003, Windows Vista

Removing VB.dx:

An up-to-date copy of ExterminateIt should detect and prevent infection from VB.dx.

If you do not have ExterminateIt and you are worried that you may have infected computer, you could run trial version of ExterminateIt, or remove VB.dx manually.

To completely manually remove VB.dx malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with VB.dx.

1. Use Task Manager to terminate the VB.dx process.
2. Delete the original VB.dx file and folders.
3. Delete the system registry key parameters
4. Update your antivirus databases or buy antivirus software and perform a full scan of the computer.

We recommends that all Internet users back up any important information on their computers, enable maximum protection from network attacks and malicious code on their computers, refrain from executing suspicious programs received from untrustworthy sources.

Also Be Aware of the Following Threats:
MiniLD Trojan Removal
servexploit143 RAT Symptoms
Removing Demon Trojan

Pigeon.DZQ malware description and removal detail
Categories:Trojan

Platforms / OS: Windows 95, Windows 98, Windows 98 SE, Windows NT, Windows ME, Windows 2000, Windows XP, Windows 2003, Windows Vista

Removing Pigeon.DZQ:

An up-to-date copy of ExterminateIt should detect and prevent infection from Pigeon.DZQ.

If you do not have ExterminateIt and you are worried that you may have infected computer, you could run trial version of ExterminateIt, or remove Pigeon.DZQ manually.

To completely manually remove Pigeon.DZQ malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with Pigeon.DZQ.

1. Use Task Manager to terminate the Pigeon.DZQ process.
2. Delete the original Pigeon.DZQ file and folders.
3. Delete the system registry key parameters
4. Update your antivirus databases or buy antivirus software and perform a full scan of the computer.

We recommends that all Internet users back up any important information on their computers, enable maximum protection from network attacks and malicious code on their computers, refrain from executing suspicious programs received from untrustworthy sources.

Also Be Aware of the Following Threats:
Remove Sensive.10b Backdoor
Envolo Downloader Removal

MidAddle malware description and removal detail
Categories:Trojan,Adware,BHO
Also known as:

[Kaspersky]Trojan.Win32.Agent.az;
[Panda]Adware/StatBlaster;
[Computer Associates]Win32.SillyDl.EM,Win32/SillyDL.StBlaster!Trojan
Visible Symptoms:
Files in system folders:
[%FAVORITES%]\advance your career.url
[%FAVORITES%]\get out of debt!.url
[%FAVORITES%]\meet someone special.url
[%FAVORITES%]\you're approved!!.url
[%PROFILE_TEMP%]\b.dll
[%PROFILE_TEMP%]\clicks.dll
[%PROFILE_TEMP%]\esyndicateinst.exe
[%PROFILE_TEMP%]\motoin.exe
[%PROFILE_TEMP%]\~wmvtmp1\index.html
[%PROGRAM_FILES_COMMON%]\midaddle\midaddle.dll
[%PROGRAM_FILES_COMMON%]\midaddle\uninst.exe
[%SYSTEM%]\activeds.exe
[%SYSTEM%]\adsldpc6.exe
[%SYSTEM%]\catsrvut.exe
[%SYSTEM%]\data.~
[%SYSTEM%]\datastore.dll
[%SYSTEM%]\exact2.dll
[%SYSTEM%]\inscatex.exe
[%SYSTEM%]\ippppcmp.exe
[%SYSTEM%]\lmdv.bin
[%SYSTEM%]\lmf32v.dll
[%SYSTEM%]\preuninstall.exe
[%WINDOWS%]\ecfg.bin
[%WINDOWS%]\excl.bin
[%WINDOWS%]\systb.exe
[%WINDOWS%]\wupdsnff.exe
[%PROFILE_TEMP%]\7si.dll
[%PROFILE_TEMP%]\9frxinfrt.dll
[%PROFILE_TEMP%]\cmdkvu.dll
[%PROFILE_TEMP%]\dit99.dll
[%PROFILE_TEMP%]\eqgq2sha.dll
[%PROFILE_TEMP%]\gg1yk81.dll
[%PROFILE_TEMP%]\gg1yk81.exe
[%PROFILE_TEMP%]\gwfamcvar.dll
[%PROFILE_TEMP%]\hi.dll
[%PROFILE_TEMP%]\middadleinst10017.exe
[%PROFILE_TEMP%]\nr4ubm.dll
[%PROFILE_TEMP%]\phtqy.dll
[%PROFILE_TEMP%]\uppicsvr.exe
[%PROFILE_TEMP%]\wa7nfowpo.dll
[%PROGRAM_FILES%]\common files\midaddle\midaddle.dll
[%PROGRAM_FILES%]\common files\midaddle\uninst.exe
[%PROGRAM_FILES_COMMON%]\uninstall information\removedisplayutility.exe
[%SYSTEM%]\advapi32.exe
[%SYSTEM%]\appmgr48.exe
[%SYSTEM%]\atkctrs7.exe
[%SYSTEM%]\atrace38.exe
[%SYSTEM%]\cabview7.exe
[%SYSTEM%]\cabview8.exe
[%SYSTEM%]\cbjovg8a.dll
[%SYSTEM%]\cbjovg8a.exe
[%SYSTEM%]\certmgr7.exe
[%SYSTEM%]\clb83310.exe
[%SYSTEM%]\clbcatq1.exe
[%SYSTEM%]\cmutil32.exe
[%SYSTEM%]\cnbjmon6.exe
[%SYSTEM%]\cnetcfg1.exe
[%SYSTEM%]\comaddin.exe
[%SYSTEM%]\cvrry0ko.exe
[%SYSTEM%]\dqcgh.exe
[%SYSTEM%]\dqk5z.exe
[%SYSTEM%]\fhhzqpw3.dll
[%SYSTEM%]\fhhzqpw3.exe
[%SYSTEM%]\fym442mi.exe
[%SYSTEM%]\hdzv.dll
[%SYSTEM%]\hdzv.exe
[%SYSTEM%]\hyperlinker2.exe
[%SYSTEM%]\jdqadis.exe
[%SYSTEM%]\kjyfi.dll
[%SYSTEM%]\kjyfi.exe
[%SYSTEM%]\lufga0.exe
[%SYSTEM%]\oduytkt.exe
[%SYSTEM%]\rbdk.exe
[%WINDOWS%]\temp\clicks.dll
[%WINDOWS%]\temp\midaddle.exe
[%FAVORITES%]\advance your career.url
[%FAVORITES%]\get out of debt!.url
[%FAVORITES%]\meet someone special.url
[%FAVORITES%]\you're approved!!.url
[%PROFILE_TEMP%]\b.dll
[%PROFILE_TEMP%]\clicks.dll
[%PROFILE_TEMP%]\esyndicateinst.exe
[%PROFILE_TEMP%]\motoin.exe
[%PROFILE_TEMP%]\~wmvtmp1\index.html
[%PROGRAM_FILES_COMMON%]\midaddle\midaddle.dll
[%PROGRAM_FILES_COMMON%]\midaddle\uninst.exe
[%SYSTEM%]\activeds.exe
[%SYSTEM%]\adsldpc6.exe
[%SYSTEM%]\catsrvut.exe
[%SYSTEM%]\data.~
[%SYSTEM%]\datastore.dll
[%SYSTEM%]\exact2.dll
[%SYSTEM%]\inscatex.exe
[%SYSTEM%]\ippppcmp.exe
[%SYSTEM%]\lmdv.bin
[%SYSTEM%]\lmf32v.dll
[%SYSTEM%]\preuninstall.exe
[%WINDOWS%]\ecfg.bin
[%WINDOWS%]\excl.bin
[%WINDOWS%]\systb.exe
[%WINDOWS%]\wupdsnff.exe
[%PROFILE_TEMP%]\7si.dll
[%PROFILE_TEMP%]\9frxinfrt.dll
[%PROFILE_TEMP%]\cmdkvu.dll
[%PROFILE_TEMP%]\dit99.dll
[%PROFILE_TEMP%]\eqgq2sha.dll
[%PROFILE_TEMP%]\gg1yk81.dll
[%PROFILE_TEMP%]\gg1yk81.exe
[%PROFILE_TEMP%]\gwfamcvar.dll
[%PROFILE_TEMP%]\hi.dll
[%PROFILE_TEMP%]\middadleinst10017.exe
[%PROFILE_TEMP%]\nr4ubm.dll
[%PROFILE_TEMP%]\phtqy.dll
[%PROFILE_TEMP%]\uppicsvr.exe
[%PROFILE_TEMP%]\wa7nfowpo.dll
[%PROGRAM_FILES%]\common files\midaddle\midaddle.dll
[%PROGRAM_FILES%]\common files\midaddle\uninst.exe
[%PROGRAM_FILES_COMMON%]\uninstall information\removedisplayutility.exe
[%SYSTEM%]\advapi32.exe
[%SYSTEM%]\appmgr48.exe
[%SYSTEM%]\atkctrs7.exe
[%SYSTEM%]\atrace38.exe
[%SYSTEM%]\cabview7.exe
[%SYSTEM%]\cabview8.exe
[%SYSTEM%]\cbjovg8a.dll
[%SYSTEM%]\cbjovg8a.exe
[%SYSTEM%]\certmgr7.exe
[%SYSTEM%]\clb83310.exe
[%SYSTEM%]\clbcatq1.exe
[%SYSTEM%]\cmutil32.exe
[%SYSTEM%]\cnbjmon6.exe
[%SYSTEM%]\cnetcfg1.exe
[%SYSTEM%]\comaddin.exe
[%SYSTEM%]\cvrry0ko.exe
[%SYSTEM%]\dqcgh.exe
[%SYSTEM%]\dqk5z.exe
[%SYSTEM%]\fhhzqpw3.dll
[%SYSTEM%]\fhhzqpw3.exe
[%SYSTEM%]\fym442mi.exe
[%SYSTEM%]\hdzv.dll
[%SYSTEM%]\hdzv.exe
[%SYSTEM%]\hyperlinker2.exe
[%SYSTEM%]\jdqadis.exe
[%SYSTEM%]\kjyfi.dll
[%SYSTEM%]\kjyfi.exe
[%SYSTEM%]\lufga0.exe
[%SYSTEM%]\oduytkt.exe
[%SYSTEM%]\rbdk.exe
[%WINDOWS%]\temp\clicks.dll
[%WINDOWS%]\temp\midaddle.exe

In order to ensure that the MidAddle is launched automatically each time the system is booted, the MidAddle adds a link to its executable file in the system registry:
HKLM\Microsoft\Windows\CurrentVersion\Run
[%PROFILE_TEMP%]\esyndicateinst.exe
[%PROFILE_TEMP%]\motoin.exe
[%PROGRAM_FILES_COMMON%]\midaddle\uninst.exe
[%SYSTEM%]\activeds.exe
[%SYSTEM%]\adsldpc6.exe
[%SYSTEM%]\catsrvut.exe
[%SYSTEM%]\inscatex.exe
[%SYSTEM%]\ippppcmp.exe
[%SYSTEM%]\preuninstall.exe
[%WINDOWS%]\systb.exe
[%WINDOWS%]\wupdsnff.exe
[%PROFILE_TEMP%]\gg1yk81.exe
[%PROFILE_TEMP%]\middadleinst10017.exe
[%PROFILE_TEMP%]\uppicsvr.exe
[%PROGRAM_FILES%]\common files\midaddle\uninst.exe
[%PROGRAM_FILES_COMMON%]\uninstall information\removedisplayutility.exe
[%SYSTEM%]\advapi32.exe
[%SYSTEM%]\appmgr48.exe
[%SYSTEM%]\atkctrs7.exe
[%SYSTEM%]\atrace38.exe
[%SYSTEM%]\cabview7.exe
[%SYSTEM%]\cabview8.exe
[%SYSTEM%]\cbjovg8a.exe
[%SYSTEM%]\certmgr7.exe
[%SYSTEM%]\clb83310.exe
[%SYSTEM%]\clbcatq1.exe
[%SYSTEM%]\cmutil32.exe
[%SYSTEM%]\cnbjmon6.exe
[%SYSTEM%]\cnetcfg1.exe
[%SYSTEM%]\comaddin.exe
[%SYSTEM%]\cvrry0ko.exe
[%SYSTEM%]\dqcgh.exe
[%SYSTEM%]\dqk5z.exe
[%SYSTEM%]\fhhzqpw3.exe
[%SYSTEM%]\fym442mi.exe
[%SYSTEM%]\hdzv.exe
[%SYSTEM%]\hyperlinker2.exe
[%SYSTEM%]\jdqadis.exe
[%SYSTEM%]\kjyfi.exe
[%SYSTEM%]\lufga0.exe
[%SYSTEM%]\oduytkt.exe
[%SYSTEM%]\rbdk.exe
[%WINDOWS%]\temp\midaddle.exe

Platforms / OS: Windows 95, Windows 98, Windows 98 SE, Windows NT, Windows ME, Windows 2000, Windows XP, Windows 2003, Windows Vista