Trojan.Generic
Posted: June 4, 2008
Threat Metric
The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to
give every identifiable malware threat. Our Threat Meter includes several criteria based off of
specific malware threats to value their severity, reach and volume. The Threat Meter is able to give
you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count,
Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic
breakdown of how all threats are ranked within our own extensive malware database. The scoring for
each specific malware threat can be easily compared to other emerging threats to draw a contrast in
its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to
remove a threat or pursue additional analytical research for all types of computer users.
The following fields listed on the Threat Meter containing a specific value, are explained in detail below:
Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.
Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.
Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.
Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.
% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.
The following fields listed on the Threat Meter containing a specific value, are explained in detail below:
Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.
Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.
Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.
Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.
% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.
| Ranking: | 156 |
|---|---|
| Threat Level: | 9/10 |
| Infected PCs: | 1,692,645 |
| First Seen: | July 24, 2009 |
|---|---|
| Last Seen: | October 17, 2023 |
| OS(es) Affected: | Windows |
Trojan.Generic is a malicious Trojan parasite. Trojan.Generic is designed to download and install additional parasites onto your machine without your authorization. Once inside your computer, Trojan.Generic will log your keystrokes, connect to the Internet and leak the stolen information via HTTP to a remote attacker. Trojan.Generic is an extremely dangerous threat, since it can steal your sensitive data and derange your security system. It is strongly recommended to eliminate Trojan.Generic from your system upon detection.
Aliases
Generic.A6F [AVG]Adware/Amonetize [Fortinet]PUP/Multitoolbar [Panda]Win32.Application.Agent.ORYHPJ [GData]PUP/Win32.Amonetize [AhnLab-V3]GrayWare[AdWare:not-a-virus]/Win32.Amonetize [Antiy-AVL]Generic PUA GL (PUA) [Sophos]Artemis!PUP [McAfee-GW-Edition]TROJ_GEN.R047C0OK415 [TrendMicro]Trojan.Amonetize.10283 [DrWeb]not-a-virus:AdWare.Win32.Amonetize.btms [Kaspersky]PUA.SwVersionUpdater [Symantec]Artemis!E3B45AB10134 [McAfee]Generic Suspicious [Panda]PSW.Generic12.CIMP [AVG]
More aliases (6924)
More aliases (6924)
Technical Details
File System Modifications
Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.
The following files were created in the system:%ALLUSERSPROFILE%\network.exe
File name: network.exeSize: 298.95 KB (298950 bytes)
MD5: 8e9b90a20a604013e37ebf0806025e06
Detection count: 73
File type: Executable File
Mime Type: unknown/exe
Path: %ALLUSERSPROFILE%\network.exe
Group: Malware file
Last Updated: August 2, 2020
%SYSTEMDRIVE%\Users\<username>\Desktop\compare2\458b8b62a3dea11f18a4ead71770dcba0d18a367955bd4f82413e28f53c3339e
File name: 458b8b62a3dea11f18a4ead71770dcba0d18a367955bd4f82413e28f53c3339eSize: 1.78 MB (1783808 bytes)
MD5: 45aa1d943161c988f7391b0cad4e2b89
Detection count: 21
Path: %SYSTEMDRIVE%\Users\<username>\Desktop\compare2\458b8b62a3dea11f18a4ead71770dcba0d18a367955bd4f82413e28f53c3339e
Group: Malware file
Last Updated: February 2, 2021
%SYSTEMDRIVE%\Users\<username>\Desktop\compare2\87cf63728ccbd48ba914f6f5a95ce0a902c76e5fc74ba4ab3e5218eec403ada4
File name: 87cf63728ccbd48ba914f6f5a95ce0a902c76e5fc74ba4ab3e5218eec403ada4Size: 602.62 KB (602624 bytes)
MD5: 73047a5697ecefcaba722286acc12c2a
Detection count: 21
Path: %SYSTEMDRIVE%\Users\<username>\Desktop\compare2\87cf63728ccbd48ba914f6f5a95ce0a902c76e5fc74ba4ab3e5218eec403ada4
Group: Malware file
Last Updated: February 2, 2021
%SYSTEMDRIVE%\Users\<username>\Desktop\compare2\7518b32bd790d697357b740cd3aa76ca77d5fd3ede391124519dbd55874ce2d0
File name: 7518b32bd790d697357b740cd3aa76ca77d5fd3ede391124519dbd55874ce2d0Size: 1.47 MB (1478656 bytes)
MD5: 2a5a512f3c04262a34762e23daf5c47b
Detection count: 19
Path: %SYSTEMDRIVE%\Users\<username>\Desktop\compare2\7518b32bd790d697357b740cd3aa76ca77d5fd3ede391124519dbd55874ce2d0
Group: Malware file
Last Updated: February 2, 2021
%SYSTEMDRIVE%\Users\<username>\Desktop\m\aee23d72e06c96f0b7fb6ee985bddff6f13986b67918f9bc9997f6c921b4b8e4.exe
File name: aee23d72e06c96f0b7fb6ee985bddff6f13986b67918f9bc9997f6c921b4b8e4.exeSize: 305.15 KB (305152 bytes)
MD5: 9563838c069be84370d547120ed35316
Detection count: 16
File type: Executable File
Mime Type: unknown/exe
Path: %SYSTEMDRIVE%\Users\<username>\Desktop\m\aee23d72e06c96f0b7fb6ee985bddff6f13986b67918f9bc9997f6c921b4b8e4.exe
Group: Malware file
Last Updated: October 18, 2020
%SYSTEMDRIVE%\Users\<username>\AppData\Roaming\DiagnosticsHub.StandardCollector.Service\RemoteAppLifetimeManager.exe
File name: RemoteAppLifetimeManager.exeSize: 1.23 MB (1231880 bytes)
MD5: de1465236e152ea854a10d1cb1f9aa62
Detection count: 12
File type: Executable File
Mime Type: unknown/exe
Path: %SYSTEMDRIVE%\Users\<username>\AppData\Roaming\DiagnosticsHub.StandardCollector.Service\RemoteAppLifetimeManager.exe
Group: Malware file
Last Updated: June 26, 2020
%SYSTEMDRIVE%\Users\<username>\Desktop\m\73010e37fc4f4cd571c70b6e98560bdf342e3ca9364fd699c1d63611fcf4311e.exe
File name: 73010e37fc4f4cd571c70b6e98560bdf342e3ca9364fd699c1d63611fcf4311e.exeSize: 668.67 KB (668672 bytes)
MD5: d126669244f967af96759da5417d4884
Detection count: 12
File type: Executable File
Mime Type: unknown/exe
Path: %SYSTEMDRIVE%\Users\<username>\Desktop\m\73010e37fc4f4cd571c70b6e98560bdf342e3ca9364fd699c1d63611fcf4311e.exe
Group: Malware file
Last Updated: October 18, 2020
%SYSTEMDRIVE%\Users\<username>\Desktop\m\cc883d294c58d5b061c9754bf4c8a69f34609c62a609cd5a3922fdcb90957fcc.exe
File name: cc883d294c58d5b061c9754bf4c8a69f34609c62a609cd5a3922fdcb90957fcc.exeSize: 440.32 KB (440320 bytes)
MD5: 035d53ac51763375f50876494bb80d86
Detection count: 12
File type: Executable File
Mime Type: unknown/exe
Path: %SYSTEMDRIVE%\Users\<username>\Desktop\m\cc883d294c58d5b061c9754bf4c8a69f34609c62a609cd5a3922fdcb90957fcc.exe
Group: Malware file
Last Updated: October 18, 2020
%SYSTEMDRIVE%\Users\<username>\Desktop\m\d16f873e2941fb953e381f4bcf8bcb347bfa1125efa06c71706e02c960717213.exe
File name: d16f873e2941fb953e381f4bcf8bcb347bfa1125efa06c71706e02c960717213.exeSize: 736.76 KB (736768 bytes)
MD5: f8c9cb4c4898e077e4454d510f3bca11
Detection count: 12
File type: Executable File
Mime Type: unknown/exe
Path: %SYSTEMDRIVE%\Users\<username>\Desktop\m\d16f873e2941fb953e381f4bcf8bcb347bfa1125efa06c71706e02c960717213.exe
Group: Malware file
Last Updated: October 18, 2020
%SYSTEMDRIVE%\Users\<username>\Desktop\m\d19e690275e1eec487544552366accd109567893c79b3634cef31515b9a0a19b.exe
File name: d19e690275e1eec487544552366accd109567893c79b3634cef31515b9a0a19b.exeSize: 525.31 KB (525312 bytes)
MD5: 586fa8fea2272a93224d52ea5c32c331
Detection count: 12
File type: Executable File
Mime Type: unknown/exe
Path: %SYSTEMDRIVE%\Users\<username>\Desktop\m\d19e690275e1eec487544552366accd109567893c79b3634cef31515b9a0a19b.exe
Group: Malware file
Last Updated: October 18, 2020
%SYSTEMDRIVE%\Users\<username>\Desktop\m\fa67c0d0bac1f60c00b103773d7dba352956dc4db285f13e266a03ab46796b04.exe
File name: fa67c0d0bac1f60c00b103773d7dba352956dc4db285f13e266a03ab46796b04.exeSize: 1.33 MB (1339904 bytes)
MD5: e60f2ae7d0109364e0a18bb7a5dc4a03
Detection count: 12
File type: Executable File
Mime Type: unknown/exe
Path: %SYSTEMDRIVE%\Users\<username>\Desktop\m\fa67c0d0bac1f60c00b103773d7dba352956dc4db285f13e266a03ab46796b04.exe
Group: Malware file
Last Updated: October 18, 2020
%SYSTEMDRIVE%\Users\<username>\Desktop\m\fafa6767621f62637d1baf9a44c160eecef66481beabde38b2a87bdd0b1b161a.exe
File name: fafa6767621f62637d1baf9a44c160eecef66481beabde38b2a87bdd0b1b161a.exeSize: 429.57 KB (429572 bytes)
MD5: ef2bd3821b7ff576ad7a213d5e819a0d
Detection count: 12
File type: Executable File
Mime Type: unknown/exe
Path: %SYSTEMDRIVE%\Users\<username>\Desktop\m\fafa6767621f62637d1baf9a44c160eecef66481beabde38b2a87bdd0b1b161a.exe
Group: Malware file
Last Updated: October 18, 2020
cfce0479f252d8a37a069a9cb0e514593dea1dba7888d8b81212d2c594b44cba
File name: cfce0479f252d8a37a069a9cb0e514593dea1dba7888d8b81212d2c594b44cbaSize: 432.64 KB (432640 bytes)
MD5: ac4a0fc175f0210e60a9aa04cef7501c
Detection count: 5
Group: Malware file
f15a3417501358c054990f42cc96dd6fc1677fbef3a87d0dc36b18b2f583cfa5
File name: f15a3417501358c054990f42cc96dd6fc1677fbef3a87d0dc36b18b2f583cfa5Size: 315.39 KB (315392 bytes)
MD5: 7b5f22804e53f0ee5dd6f49343253725
Detection count: 5
Group: Malware file
More files
Registry Modifications
The following newly produced Registry Values are:
CLSID{00011268-E188-40DF-A514-835FCD78B1BF}{038cb5c7-48ea-4af9-94e0-a1646542e62b}{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}{9233C3C0-1472-4091-A505-5580A23BB4AC}{AFD4AD01-58C1-47DB-A404-FBE00A6C5486}{BB4C402F-882A-4526-8C08-51278EA437C1}{BB4C402F-882A-8C08-4526-51278EA437C1}File name without path_file_!.tmpAdobe!.exebazoulla.execccam.vbsdowloadx.exeExit To Dos.pififhvvyy.exekissq.exeloader.vbsNYANxCAT.vbsQUALITY PORN.urlQuicTime.EXEsearzar.exesvchost.vbssvchostw.exesvcnosts.exetempsystem32bit.exeTwitchilych.exewindows.gaming.xboxlive.storage.exewinnewsserv.exeworm.vbsRegexp file mask%ALLUSERSPROFILE%\Application Data\Console.exe%allusersprofile%\application data\keygen.bat%ALLUSERSPROFILE%\Application Data\run.exe%ALLUSERSPROFILE%\Application Data\WorkflowAppControl.exe%ALLUSERSPROFILE%\Console.exe%ALLUSERSPROFILE%\cpsvchost.exe%ALLUSERSPROFILE%\des.exe%ALLUSERSPROFILE%\dllhost.exe%ALLUSERSPROFILE%\ggse.exe%allusersprofile%\keygen.bat%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\startup\[RANDOM CHARACTERS].pif%ALLUSERSPROFILE%\NvContainer.exe%allusersprofile%\qspeak.dll%ALLUSERSPROFILE%\run.exe%ALLUSERSPROFILE%\Service.exe%ALLUSERSPROFILE%\start.exe%allusersprofile%\sv[RANDOM CHARACTERS]ost.exe%ALLUSERSPROFILE%\svshost.exe%ALLUSERSPROFILE%\WorkflowAppControl.exe%ALLUSERSPROFILE%\worm.exe%APPDATA%\[NUMBERS].exe%APPDATA%\AMonitor\w{0,1}comspc.exe%APPDATA%\app.exe%appdata%\backdays.exe%APPDATA%\BBCC.exe%APPDATA%\Certificates\sixhost.exe%APPDATA%\Chromm.exe%APPDATA%\Cousins%APPDATA%\csrssw{0,4}.exe%APPDATA%\explorer.exe%APPDATA%\fix.exe%APPDATA%\FolderN\name.exe%APPDATA%\Google Auto Updater.exe%APPDATA%\images.exe%appdata%\images\img.exe%appdata%\jjj.exe%APPDATA%\jusched121.exe%appdata%\kerorerohek.exe%APPDATA%\load[RANDOM CHARACTERS].exe%APPDATA%\loader.exe%APPDATA%\logger.p%APPDATA%\LogMeInUpdService\logmeinusvc.exe%APPDATA%\Media Center Programs\update.exe%APPDATA%\Microsoft\Authawex\dssetLib.exe%APPDATA%\microsoft\security\security helper.exe%APPDATA%\Microsoft\Windows\dwm.exe%APPDATA%\Microsoft\Windows\Sound.exe%APPDATA%\Microsoft\Windows\Start Menu\Programs\app.exe%APPDATA%\microsoft\windows\start menu\programs\startup\111.exe%APPDATA%\microsoft\windows\start menu\programs\startup\[RANDOM CHARACTERS].pif%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\[RANDOM CHARACTERS]ame.vbs%appdata%\microsoft\windows\start menu\programs\startup\[RANDOM CHARACTERS]payload[RANDOM CHARACTERS].exe%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\AdobeDll.exe%appdata%\microsoft\windows\start menu\programs\startup\cwds.exe%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft.exe%appdata%\microsoft\windows\start menu\programs\startup\mscv[NUMBERS].exe%appdata%\microsoft\windows\start menu\programs\startup\runpe.exe%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\scvhost.vbs%appdata%\microsoft\windows\start menu\programs\startup\startab.vbs%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\SystemAutorun.exe%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\usvc32.lnk%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\virus.exe%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\Windows Security Update.exe%APPDATA%\Microsoft\Windows\Stealer.exe%APPDATA%\Microsoft\Windows\Templates\System.Dll.Exe%APPDATA%\MSBUILD.exe%appdata%\netflix.exe%APPDATA%\omsecor.exe%APPDATA%\PR_Updaters_Service.exe%APPDATA%\puddlings.exe%APPDATA%\qop.exe%APPDATA%\RSSCom\SCG.exe%APPDATA%\scvhost.exe%APPDATA%\smss.exe%APPDATA%\sumuel.exe%APPDATA%\taskger.exe%APPDATA%\taskkor.exe%appdata%\tbgrvfcer.exe%APPDATA%\update.exe%APPDATA%\van.exe%APPDATA%\xpsr[RANDOM CHARACTERS].exe%APPDATA%\zero.exe%HOMEDRIVE%\dllhost.exe%HOMEDRIVE%\IMG001.exe%LOCALAPPDATA%\adobe.exe%localappdata%\firefox utility.exe%localappdata%\idlsvcs\idlsvcs.exe%LOCALAPPDATA%\Local Settings.exe%LOCALAPPDATA%\micro\micro.dll%LOCALAPPDATA%\Microsoft\WUDHost.exe%LOCALAPPDATA%\svchost.exe%localappdata%\svx.exe%LOCALAPPDATA%\temp\trojan.exe%localappdata%\temploader.exe%LOCALAPPDATA%\Temptilusorel.exe%localappdata%\winrar.exe%ProgramFiles%\phc?????????\[RANDOM CHARACTERS]%ProgramFiles%\rhc?????????\[RANDOM CHARACTERS]%ProgramFiles%\thc?????????\[RANDOM CHARACTERS]%ProgramFiles%\thc[RANDOM CHARACTERS].[RANDOM CHARACTERS]%ProgramFiles%\whc[RANDOM CHARACTERS].[RANDOM CHARACTERS]%SYSTEMDRIVE%\escaped.exe%SystemRoot%\System32\lphc[RANDOM CHARACTERS].[RANDOM CHARACTERS]%SystemRoot%\System32\phc[RANDOM CHARACTERS].[RANDOM CHARACTERS]%SystemRoot%\System32\rhc[RANDOM CHARACTERS].[RANDOM CHARACTERS]%SystemRoot%\System32\thc[RANDOM CHARACTERS].[RANDOM CHARACTERS]%SystemRoot%\System32\whc[RANDOM CHARACTERS].[RANDOM CHARACTERS]%TEMP%\[NUMBERS].exe%TEMP%\hey.exe%TEMP%\IELOGIN.abc%TEMP%\Microsft.exe%TEMP%\mine.exe%TEMP%\moving.txt%TEMP%\name.exe%TEMP%\server2.exe%TEMP%\systemWow64.exe%TEMP%\test[1].exe%TEMP%\wininetsvc.exe%TEMP%\xxx[RANDOM CHARACTERS].exe%UserProfile%\643f[RANDOM CHARACTERS].[RANDOM CHARACTERS]%USERPROFILE%\Desktop\firefoxe.exe%userprofile%\documents\app.exe%USERPROFILE%\Documents\LeaderTask\ltask.exe%USERPROFILE%\Downloads\KEYS?.exe[RANDOM CHARACTERS]%USERPROFILE%\Downloads\Order[NUMBERS].exe%USERPROFILE%\Downloads\pady.exe%USERPROFILE%\Downloads\scar.exe%USERPROFILE%\Local Settings\Application Data\svchost.exe%USERPROFILE%\Music\Disney\aiming.exe%USERPROFILE%\NVDisplay.Container.exe%UserProfile%\phc[RANDOM CHARACTERS].[RANDOM CHARACTERS]%UserProfile%\rhc[RANDOM CHARACTERS].[RANDOM CHARACTERS]%userprofile%\rrinstaller\RtlUpd64.exe%USERPROFILE%\taswexuahoft.exe%UserProfile%\thc[RANDOM CHARACTERS].[RANDOM CHARACTERS]%USERPROFILE%\Update\Updater[RANDOM CHARACTERS].exe%USERPROFILE%\user.exe%UserProfile%\whc[RANDOM CHARACTERS].[RANDOM CHARACTERS]%USERPROFILE%\windows\svchost.com%WINDIR%\assembly\w{1,15}.exe%WINDIR%\configuration\configuration.exe%WINDIR%\CTS.exe%WINDIR%\debug\cmghost.exe%WINDIR%\debug\item.dat%WINDIR%\debug\ok.dat%WINDIR%\Defender.exe%WINDIR%\Fonts\sqlserver.exe%WINDIR%\Max\maxup.exe%WINDIR%\Max\sammui.exe%WINDIR%\Max\wincore.exe%windir%\svchost.exe.exe%WINDIR%\System32\seth.exe%WINDIR%\System32\Tasks\At1%WINDIR%\System32\Tasks\Peoria%WINDIR%\System32\workout.exe%WINDIR%\SysWOW64\Microsoft\crrcs.exe%WINDIR%\SysWOW64\mqls.exe%WINDIR%\SysWOW64\seth.exe%WINDIR%\Tasks\At1.job%WINDIR%\Tasks\At[NUMBERS].job%WINDIR%\userinit.exe%WINDIR%\windows.bat%WINDIR%\windows.vbs%WINDIR%\Windows\ProgramData\svchost.exe%WINDIR%\Windows\ProgramData\wincore.exeHKEY..\..\..\..{RegistryKeys}Software\Microsoft\Windows\CurrentVersion\##Software\Microsoft\Windows\CurrentVersion\Run\5725c62dbe5ccceaeca7741be17a45b5Software\Microsoft\Windows\CurrentVersion\Run\Google Helper 2SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Regedit32SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System.vbsSoftware\Microsoft\Windows\CurrentVersion\Run\Windows UpdateSOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Windows UpdateSOFTWARE\vítimaSOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\5725c62dbe5ccceaeca7741be17a45b5SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Regedit32Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows UpdateSOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Windows UpdateSYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\{4826EBDF-CA2E-40D0-8CD8-1D7C1603E46F}SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\{7A67B53B-F94B-4D5B-A554-0817C58A3ABA}SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\{4826EBDF-CA2E-40D0-8CD8-1D7C1603E46F}SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\{7A67B53B-F94B-4D5B-A554-0817C58A3ABA}SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\{4826EBDF-CA2E-40D0-8CD8-1D7C1603E46F}SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\{7A67B53B-F94B-4D5B-A554-0817C58A3ABA}Run keysCognacFixCameraSmartMon
CLSID{00011268-E188-40DF-A514-835FCD78B1BF}{038cb5c7-48ea-4af9-94e0-a1646542e62b}{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}{9233C3C0-1472-4091-A505-5580A23BB4AC}{AFD4AD01-58C1-47DB-A404-FBE00A6C5486}{BB4C402F-882A-4526-8C08-51278EA437C1}{BB4C402F-882A-8C08-4526-51278EA437C1}File name without path_file_!.tmpAdobe!.exebazoulla.execccam.vbsdowloadx.exeExit To Dos.pififhvvyy.exekissq.exeloader.vbsNYANxCAT.vbsQUALITY PORN.urlQuicTime.EXEsearzar.exesvchost.vbssvchostw.exesvcnosts.exetempsystem32bit.exeTwitchilych.exewindows.gaming.xboxlive.storage.exewinnewsserv.exeworm.vbsRegexp file mask%ALLUSERSPROFILE%\Application Data\Console.exe%allusersprofile%\application data\keygen.bat%ALLUSERSPROFILE%\Application Data\run.exe%ALLUSERSPROFILE%\Application Data\WorkflowAppControl.exe%ALLUSERSPROFILE%\Console.exe%ALLUSERSPROFILE%\cpsvchost.exe%ALLUSERSPROFILE%\des.exe%ALLUSERSPROFILE%\dllhost.exe%ALLUSERSPROFILE%\ggse.exe%allusersprofile%\keygen.bat%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\startup\[RANDOM CHARACTERS].pif%ALLUSERSPROFILE%\NvContainer.exe%allusersprofile%\qspeak.dll%ALLUSERSPROFILE%\run.exe%ALLUSERSPROFILE%\Service.exe%ALLUSERSPROFILE%\start.exe%allusersprofile%\sv[RANDOM CHARACTERS]ost.exe%ALLUSERSPROFILE%\svshost.exe%ALLUSERSPROFILE%\WorkflowAppControl.exe%ALLUSERSPROFILE%\worm.exe%APPDATA%\[NUMBERS].exe%APPDATA%\AMonitor\w{0,1}comspc.exe%APPDATA%\app.exe%appdata%\backdays.exe%APPDATA%\BBCC.exe%APPDATA%\Certificates\sixhost.exe%APPDATA%\Chromm.exe%APPDATA%\Cousins%APPDATA%\csrssw{0,4}.exe%APPDATA%\explorer.exe%APPDATA%\fix.exe%APPDATA%\FolderN\name.exe%APPDATA%\Google Auto Updater.exe%APPDATA%\images.exe%appdata%\images\img.exe%appdata%\jjj.exe%APPDATA%\jusched121.exe%appdata%\kerorerohek.exe%APPDATA%\load[RANDOM CHARACTERS].exe%APPDATA%\loader.exe%APPDATA%\logger.p%APPDATA%\LogMeInUpdService\logmeinusvc.exe%APPDATA%\Media Center Programs\update.exe%APPDATA%\Microsoft\Authawex\dssetLib.exe%APPDATA%\microsoft\security\security helper.exe%APPDATA%\Microsoft\Windows\dwm.exe%APPDATA%\Microsoft\Windows\Sound.exe%APPDATA%\Microsoft\Windows\Start Menu\Programs\app.exe%APPDATA%\microsoft\windows\start menu\programs\startup\111.exe%APPDATA%\microsoft\windows\start menu\programs\startup\[RANDOM CHARACTERS].pif%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\[RANDOM CHARACTERS]ame.vbs%appdata%\microsoft\windows\start menu\programs\startup\[RANDOM CHARACTERS]payload[RANDOM CHARACTERS].exe%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\AdobeDll.exe%appdata%\microsoft\windows\start menu\programs\startup\cwds.exe%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft.exe%appdata%\microsoft\windows\start menu\programs\startup\mscv[NUMBERS].exe%appdata%\microsoft\windows\start menu\programs\startup\runpe.exe%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\scvhost.vbs%appdata%\microsoft\windows\start menu\programs\startup\startab.vbs%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\SystemAutorun.exe%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\usvc32.lnk%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\virus.exe%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\Windows Security Update.exe%APPDATA%\Microsoft\Windows\Stealer.exe%APPDATA%\Microsoft\Windows\Templates\System.Dll.Exe%APPDATA%\MSBUILD.exe%appdata%\netflix.exe%APPDATA%\omsecor.exe%APPDATA%\PR_Updaters_Service.exe%APPDATA%\puddlings.exe%APPDATA%\qop.exe%APPDATA%\RSSCom\SCG.exe%APPDATA%\scvhost.exe%APPDATA%\smss.exe%APPDATA%\sumuel.exe%APPDATA%\taskger.exe%APPDATA%\taskkor.exe%appdata%\tbgrvfcer.exe%APPDATA%\update.exe%APPDATA%\van.exe%APPDATA%\xpsr[RANDOM CHARACTERS].exe%APPDATA%\zero.exe%HOMEDRIVE%\dllhost.exe%HOMEDRIVE%\IMG001.exe%LOCALAPPDATA%\adobe.exe%localappdata%\firefox utility.exe%localappdata%\idlsvcs\idlsvcs.exe%LOCALAPPDATA%\Local Settings.exe%LOCALAPPDATA%\micro\micro.dll%LOCALAPPDATA%\Microsoft\WUDHost.exe%LOCALAPPDATA%\svchost.exe%localappdata%\svx.exe%LOCALAPPDATA%\temp\trojan.exe%localappdata%\temploader.exe%LOCALAPPDATA%\Temptilusorel.exe%localappdata%\winrar.exe%ProgramFiles%\phc?????????\[RANDOM CHARACTERS]%ProgramFiles%\rhc?????????\[RANDOM CHARACTERS]%ProgramFiles%\thc?????????\[RANDOM CHARACTERS]%ProgramFiles%\thc[RANDOM CHARACTERS].[RANDOM CHARACTERS]%ProgramFiles%\whc[RANDOM CHARACTERS].[RANDOM CHARACTERS]%SYSTEMDRIVE%\escaped.exe%SystemRoot%\System32\lphc[RANDOM CHARACTERS].[RANDOM CHARACTERS]%SystemRoot%\System32\phc[RANDOM CHARACTERS].[RANDOM CHARACTERS]%SystemRoot%\System32\rhc[RANDOM CHARACTERS].[RANDOM CHARACTERS]%SystemRoot%\System32\thc[RANDOM CHARACTERS].[RANDOM CHARACTERS]%SystemRoot%\System32\whc[RANDOM CHARACTERS].[RANDOM CHARACTERS]%TEMP%\[NUMBERS].exe%TEMP%\hey.exe%TEMP%\IELOGIN.abc%TEMP%\Microsft.exe%TEMP%\mine.exe%TEMP%\moving.txt%TEMP%\name.exe%TEMP%\server2.exe%TEMP%\systemWow64.exe%TEMP%\test[1].exe%TEMP%\wininetsvc.exe%TEMP%\xxx[RANDOM CHARACTERS].exe%UserProfile%\643f[RANDOM CHARACTERS].[RANDOM CHARACTERS]%USERPROFILE%\Desktop\firefoxe.exe%userprofile%\documents\app.exe%USERPROFILE%\Documents\LeaderTask\ltask.exe%USERPROFILE%\Downloads\KEYS?.exe[RANDOM CHARACTERS]%USERPROFILE%\Downloads\Order[NUMBERS].exe%USERPROFILE%\Downloads\pady.exe%USERPROFILE%\Downloads\scar.exe%USERPROFILE%\Local Settings\Application Data\svchost.exe%USERPROFILE%\Music\Disney\aiming.exe%USERPROFILE%\NVDisplay.Container.exe%UserProfile%\phc[RANDOM CHARACTERS].[RANDOM CHARACTERS]%UserProfile%\rhc[RANDOM CHARACTERS].[RANDOM CHARACTERS]%userprofile%\rrinstaller\RtlUpd64.exe%USERPROFILE%\taswexuahoft.exe%UserProfile%\thc[RANDOM CHARACTERS].[RANDOM CHARACTERS]%USERPROFILE%\Update\Updater[RANDOM CHARACTERS].exe%USERPROFILE%\user.exe%UserProfile%\whc[RANDOM CHARACTERS].[RANDOM CHARACTERS]%USERPROFILE%\windows\svchost.com%WINDIR%\assembly\w{1,15}.exe%WINDIR%\configuration\configuration.exe%WINDIR%\CTS.exe%WINDIR%\debug\cmghost.exe%WINDIR%\debug\item.dat%WINDIR%\debug\ok.dat%WINDIR%\Defender.exe%WINDIR%\Fonts\sqlserver.exe%WINDIR%\Max\maxup.exe%WINDIR%\Max\sammui.exe%WINDIR%\Max\wincore.exe%windir%\svchost.exe.exe%WINDIR%\System32\seth.exe%WINDIR%\System32\Tasks\At1%WINDIR%\System32\Tasks\Peoria%WINDIR%\System32\workout.exe%WINDIR%\SysWOW64\Microsoft\crrcs.exe%WINDIR%\SysWOW64\mqls.exe%WINDIR%\SysWOW64\seth.exe%WINDIR%\Tasks\At1.job%WINDIR%\Tasks\At[NUMBERS].job%WINDIR%\userinit.exe%WINDIR%\windows.bat%WINDIR%\windows.vbs%WINDIR%\Windows\ProgramData\svchost.exe%WINDIR%\Windows\ProgramData\wincore.exeHKEY..\..\..\..{RegistryKeys}Software\Microsoft\Windows\CurrentVersion\##Software\Microsoft\Windows\CurrentVersion\Run\5725c62dbe5ccceaeca7741be17a45b5Software\Microsoft\Windows\CurrentVersion\Run\Google Helper 2SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Regedit32SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System.vbsSoftware\Microsoft\Windows\CurrentVersion\Run\Windows UpdateSOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Windows UpdateSOFTWARE\vítimaSOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\5725c62dbe5ccceaeca7741be17a45b5SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Regedit32Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows UpdateSOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Windows UpdateSYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\{4826EBDF-CA2E-40D0-8CD8-1D7C1603E46F}SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\{7A67B53B-F94B-4D5B-A554-0817C58A3ABA}SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\{4826EBDF-CA2E-40D0-8CD8-1D7C1603E46F}SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\{7A67B53B-F94B-4D5B-A554-0817C58A3ABA}SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\{4826EBDF-CA2E-40D0-8CD8-1D7C1603E46F}SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\{7A67B53B-F94B-4D5B-A554-0817C58A3ABA}Run keysCognacFixCameraSmartMon
Additional Information
The following directories were created:
%ALLUSERSPROFILE%\Application Data\google helper 2%ALLUSERSPROFILE%\HDD Integrity Checker%ALLUSERSPROFILE%\Java Update Controller%ALLUSERSPROFILE%\Orihoni%ALLUSERSPROFILE%\VagJelr%ALLUSERSPROFILE%\application data\services%ALLUSERSPROFILE%\google helper 2%ALLUSERSPROFILE%\services%ALLUSERSPROFILE%\windows host%ALLUSERSPROFILE%\windows security%APPDATA%\Adobe\SWF Frame Renderer%APPDATA%\Imminent\Logs%APPDATA%\Micrososft\infin%APPDATA%\NvidiaAdapter%APPDATA%\Systemrc%APPDATA%\Windows Updates Files%APPDATA%\XReg32%APPDATA%\ZSmsWin%APPDATA%\abode%APPDATA%\dclogs%APPDATA%\lime%APPDATA%\wnetworkmgmt%COMMONPROGRAMFILES(x86)%\sfbsbvy%HOMEDRIVE%\UsbFixer%HOMEDRIVE%\skycloudtemp%LOCALAPPDATA%\Michael%LOCALAPPDATA%\syshealth%PROGRAMFILES%\CompanyExpertChange%PROGRAMFILES%\acoustic talk%PROGRAMFILES%\data_up%PROGRAMFILES%\labelwoka%PROGRAMFILES%\memory cafe%PROGRAMFILES%\xyrz%PROGRAMFILES(x86)%\CompanyExpertChange%PROGRAMFILES(x86)%\data_up%PROGRAMFILES(x86)%\microsoft games\game%PROGRAMFILES(x86)%\microsoft games\games%PROGRAMFILES(x86)%\subdir%TEMP%\FoldfoerN%TEMP%\MyOtApp%TEMP%\Subvon%TEMP%\avas32%TEMP%\get_away_from_me%USERPROFILE%\videos\captures\news%WINDIR%\System32\System32%allusersprofile%\VkontakateDJ%appdata%\appnt%appdata%\baocv%appdata%\bssvchost%localappdata%\windowssvnc%programfiles%\EyeDetaca%programfiles%\MinuteBapivi%programfiles%\MoneyKigaha%programfiles%\copa%programfiles%\doper%programfiles%\fufo%programfiles(x86)%\copa%programfiles(x86)%\doper%programfiles(x86)%\fufo%temp%\wup%windir%\fonts\xxx
Leave a Reply
Please note that we are not able to assist with billing and support issues regarding SpyHunter or other products. If you're having issues with SpyHunter, please get in touch with SpyHunter customer support through your SpyHunter . If you have SpyHunter billing questions, we recommend you check the Billing FAQ. For general suggestions or feedback, contact us.