Critical
System
Warning


Critical System Warning

rogue - de.wikipedia.org
Die Infektion erfolgt in der Regel per Drive-by-Download, anschließend wird eine Meldung ausgegeben, der Computer sei infiziert. Oft imitiert Rogueware dabei eine Warnmeldung von Windows täuschend echt, wobei die Meldung allerdings häufig englischsprachig ist. Diese Meldung ist aber unabhängig von der Existenz eines Schadprogramms, wobei in den meisten Fällen von Spyware die Rede ist. Außerdem ist keine Datei angegeben, in der sich der angebliche Schädling verstecken soll. Mitunter hat die „kostenpflichtige Vollversion“ keine oder aber sogar eine tatsächlich bösartige Funktion, Rogueware kann also ein Trojanisches Pferd im fachsprachlichen Sinn sein. Zudem kann der Inhalt der Internetseite eines solchen Programms fragwürdig sein. Rogue-Software wird in der Regel von seriösen Antivirenprogrammen erkannt. rogue

VirusBurst- Varianten - roque anti spyware

Zitat: Da war eine Nachricht, die sagte, dass mein WindowsMediaPlayer einen neuen Codec braucht bzw. nicht neu genug ist.

VirusBurst

Critical System Warning!
Your system is probably infected with latest version of Spyware.CyberLog-X.
Type: Spyware
Ingection Length: 266, 129 bytes
Risk: High
Systems Affected: Windwows 95, 98, 2000, NT, 2003 Server, Windows XP
Behavior: Spyware.CyperLog-X is a spyware program that monitors user
activity, logs keystrokes, and tracks Web sites visited.
Symptoms: Low Internet commection speed
Low system performance
Security center alerts
Strange pop up windows
Prptection: Click OK to download antispyware software.

weiter HijackThis

O4 - HKLM\..\Run: [VirusBurst] C:\Programme\VirusBurst\VirusBurst.exe /h
O4 - HKLM\..\Run: [Virus-Burst] C:\Programme\Virus-Burst\Virus-Burst.exe /h
O4 - HKLM\..\Run: [VirusBurster] C:\Programme\VirusBurster\virusburster.exe /h
O4 - HKLM\..\Run: [VirusBursters] C:\Programme\VirusBursters\virusbursters.exe /h
O4 - HKLM\..\Run: [Virus-Bursters] C:\Programme\Virus-Bursters\virus-bursters.exe /h

O4 - HKLM\..\Run: [VirusRescue] C:\Programme\VirusRescue\VirusRescue.exe /s
O4 - HKLM\..\Run: [AntiVermins] "C:\Programme\AntiVermins\AntiVermins.exe" /h
O4 - HKLM\..\Run: [AntiVerminsPro] C:\Programme\AntiVerminsPro\AntiVerminsPro.exe /h

O4 - HKLM\..\Run: [SpyDawn] C:\Programme\SpyDawn\SpyDawn.exe /h
O4 - HKLM\..\Run: [SpyDawn] C:\Programme\SpyCrush\SpyCrush.exe /h

O4 - HKLM\..\Run: [SpywareLocked 3.3] "C:\Programme\SpywareLocked 3.3\Spy-Locked.exe" /h

O21 - SSODL: gorgonian - {e944d14a-03aa-43e3-9d0e-4f50c4d1b005} - C:\WINDOWS\system32\eowygj.dll
O21 - SSODL: imputable - {6570b782-1a41-4053-b2c9-12c7fcf0d84d} - C:\WINDOWS\system32\duxzj.dll
O21 - SSODL: died - {7fa55359-7223-410f-bc82-efb3e3ded07f} - C:\WINDOWS\system32\gtpbx.dll
O21 - SSODL: campy - {168cf174-6dab-461c-a761-a7adfa5a5719} - C:\WINDOWS\system32\wuwbxp.dll
O21 - SSODL: considerateness - {4d993022-0899-4599-b4b6-0f887d0802e6} - C:\WINDOWS\system32\oqabf.dll
O21 - SSODL: hemadynamometer - {6076d2b1-634c-4685-843b-f826045ea5dc} - C:\WINDOWS\system32\syycum.dll
O21 - SSODL: astrogeology - {2be26361-58a2-4836-be57-b838f02fec3f} - C:\WINDOWS\system32\qxfgcg.dll
O21 - SSODL: eeler - {1559e6c1-7e5e-4461-9457-6a2dea85eb9f} - C:\WINDOWS\system32\titiau.dll
O21 - SSODL: cholecyst - {ee2975b6-e8d5-405e-8448-8fe9590f6cfb} - C:\WINDOWS\system32\mzoeut.dll
O21 - SSODL: equestre - {70305bc2-b289-4209-a344-be21f22bc930} - C:\WINDOWS\system32\zphnok.dll

O21 - SSODL: hydrodictyon - {b166be07-30a4-4d38-b781-44528a630706} - C:\WINDOWS\system32\gqagksr.dll
O21 - SSODL: horologium - {7be183d2-a42d-4915-bf60-ec86fbf002cf} - C:\WINDOWS\system32\httge.dll
O21 - SSODL: breakneck - {06fe8138-6c67-484f-ab1f-42abddd2cbb6} - C:\WINDOWS\system32\qnusjji.dll

O21 - SSODL: gaonic - {f31aee4a-1530-4fef-8537-79c6973bff9a} - C:\WINDOWS\system32\tazth.dll
O21 - SSODL: contrabandists - {dfa61db1-388e-4c87-8d56-540fa229bcb4} - C:\WINDOWS\system32\dpfwu.dll
O21 - SSODL: heteropodous - {18c3fa26-192e-4c17-9c0f-76dc9b56c0c2} - C:\WINDOWS\system32\ficqv.dll
O21 - SSODL: ferrateen - {27321538-5739-4aa1-b84c-7d18e4383f1f} - C:\WINDOWS\system32\rrtcany.dll
O21 - SSODL: clamoring - {0d9eb558-0666-479e-868a-21b1d1a53bd1} - C:\WINDOWS\system32\veklo.dll
O21 - SSODL: bonspells - {11853d5f-f894-4cc7-bbc3-fc7a9dcfd896} - C:\WINDOWS\system32\okkmtv.dll
O21 - SSODL: detachments - {01d8d081-0f76-4ab5-b5e4-9b23a709670e} - C:\WINDOWS\system32\sacskza.dll
O21 - SSODL: archenteric - {d7bdd42a-7e69-4bb8-aac3-d76ff65a3aa3} - C:\WINDOWS\system32\impgsje.dll
O21 - SSODL: coursings - {f8d02387-789a-4c0f-a1d8-8a93f33ee4df} - C:\WINDOWS\system32\yephk.dll

O21 - SSODL: featherweed - {ab340860-fd81-4a65-b345-82eb77a66b5e} - C:\WINDOWS\system32\jbtazy.dll
O21 - SSODL: cussers - {ff170564-36c8-43f7-9100-559e166405cf} - C:\WINDOWS\system32\cfltygd.dll
O21 - SSODL: anatolian - {b28b396b-b9e8-44f5-aa04-ed4f383d79ad} - C:\WINDOWS\system32\yosdjh.dll
O21 - SSODL: incestuously - {03413bf7-e34c-445b-bfc0-a2b127255871} - C:\WINDOWS\system32\urroxtl.dll

O21 - SSODL: gimmicks - {40dcff6e-af8d-4183-8ebe-a82270ac449e} - C:\WINDOWS\system32\dcvwaah.dll
O21 - SSODL: amaranthaceous - {4fc003c3-87a0-489c-85cd-878246eb2d18} - C:\WINDOWS\system32\oebxpba.dll
O21 - SSODL: boucicault - {0bad5052-665d-40d4-a9bd-a2891eaafb42} - C:\WINDOWS\system32\fmrmhc.dll
O21 - SSODL: died - {7fa55359-7223-410f-bc82-efb3e3ded07f} - C:\WINDOWS\system32\gtpbx.dll
O21 - SSODL: ecosystems - {af3fd9a8-1287-4159-9212-9a5b4494af70} - C:\WINDOWS\system32\guxxa.dl
O21 - SSODL: emptins - {588599f4-de26-4c28-ba14-f4eb17e33481} - C:\WINDOWS\system32\xxfgmy.dll
O21 - SSODL: expatriates - {1a01a98c-4f25-42e1-971a-185cf63569b2} - C:\WINDOWS\system32\tpedvf.dll
O21 - SSODL: benumbment - {af4fd984-a939-4c32-82b2-8bae7abe9aec} - C:\WINDOWS\system32\dbqlrij.dll
O21 - SSODL: cinnamomum - {93ac7c30-3878-4eaa-9420-7977285df5b1} - C:\WINDOWS\system32\pmnqguh.dll

O21 - SSODL: flammei - {9d635a36-6b3c-4146-8625-f3aaf507bbf8} - C:\WINDOWS\system32\vcehaeb.dll
O21 - SSODL: gloomily - {9cc1c589-4b22-4dae-8e12-4c3b5fa12b3f} - C:\WINDOWS\system32\mlraakb.dll
O21 - SSODL: blippers - {f2efa195-4785-4db1-9316-b48c64bb71da} - C:\WINDOWS\System32\xqpauzx.dll

O21 - SSODL: impasse - {bb720bab-2f75-456b-a850-04d77b20f6b8} - C:\WINDOWS\System32\rosdzop.dll
O21 - SSODL: boob - {01b55afa-f451-474b-9e91-c35b24d02641} - C:\WINDOWS\system32\qrzsyr.dll
O21 - SSODL: astral - {5f938c17-fbc7-4a3c-8526-85e5b1a1f762} - C:\WINDOWS\system32\olnohdw.dll
O21 - SSODL: articulation - {8dc1f789-e073-4363-b40d-07376bc5ecc5} - C:\WINDOWS\system32\hzclqhc.dll

O21 - SSODL: haematobia - {3c767c6b-602d-4b9b-829d-a3dc5b2d89dd} - C:\WINDOWS\system32\hjpprpu.dll
O21 - SSODL: hydrodictyon - {b166be07-30a4-4d38-b781-44528a630706} - C:\WINDOWS\system32\gqagksr.dll
O21 - SSODL: discriminable - {4fbbdfd6-2ca9-4bba-93e4-aadf75321bca} - C:\WINDOWS\system32\kuhmk.dll
O21 - SSODL: beeper - {951a98d0-dad6-4a77-8280-a494279a884b} - C:\WINDOWS\system32\vwfps.dll
O21 - SSODL: buprestidae - {b59f3ba4-98da-4b5f-8a2d-7b56fb11140b} - C:\WINDOWS\system32\cthkpcv.dll
O21 - SSODL: gutturalness - {fe288882-f661-4522-88f3-20cfb7866fa4} - C:\WINDOWS\system32\cvnzie.dll
O21 - SSODL: carbinyl - {8d8c2387-7f80-4022-9be6-43630a969558} - C:\WINDOWS\system32\gwquvw.dll
O21 - SSODL: eupeptic - {8670ee50-01f9-47da-ac1e-cf8549e9e521} - C:\WINDOWS\SYSTEM32\axlet.dll
O21 - SSODL: breadthes - {5c4f2cbc-f32d-4a03-9812-86f39379811b} - C:\WINDOWS\System32\oksrqqu.dll
O21 - SSODL: hirtellous - {fa19bd7e-50bc-4203-80ac-c4edc81ca9a3} - C:\WINDOWS\system32\nbbrhbd.dll
O21 - SSODL: exemplars - {2acf3add-34a1-4f2f-99cf-cc69785d1e90} - C:\WINDOWS\system32\cwgppb.dll
O21 - SSODL: eitheror - {2016a466-91a2-43c6-97d8-2fd380f065ef} - C:\WINDOWS\system32\higehsg.dll
O21 - SSODL: didynamia - {8329660f-e248-4872-98cc-fb9c4fec7ba8} - C:\Windows\System32\xkrdk.dll
O21 - SSODL: apathies - {aed6f6a3-183c-488d-9f90-23db99f56e7f} - C:\WINDOWS\system32\geplxss.dll
O21 - SSODL: characterizing - {b292ec9f-a074-4115-8342-1f459702d8d2} - C:\WINDOWS\system32\fyxkaah.dll
O21 - SSODL: excreted - {b0ded443-5e68-4001-a81b-0a0001621ab8} - C:\WINDOWS\SYSTEM32\pkgvyg.dll

weiter datfindbat

C:\WINDOWS\system32

02.09.2006 176.128 eowygj.dll
05.09.2006 176.128 duxzj.dll
06.09.2006 176.128 gtpbx.dll
10.09.2006 176.128 wuwbxp.dll
10.09.2006 176.128 oqabf.dll
14.09.2006 176.128 syycum.dll
16.09.2006 176.128 qxfgcg.dll
20.09.2006 176.128 titiau.dll
21.09.2006 176.128 mzoeut.dll
24.09.2006 176.128 zphnok.dll

30.09.2006 147.456 gqagksr.dll
01.10.2006 147.456 httge.dll
09.10.2006 143.360 qnusjji.dll

10.10.2006 106.496 tazth.dll
14.10.2006 106.496 dpfwu.dll
19.10.2006 106.496 rrtcany.dll
22.10.2006 106.496 ficqv.dll
29.10.2006 106.496 veklo.dll
03.11.2006 106.496 okkmtv.dll
04.11.2006 106.496 sacskza.dll
05.11.2006 106.496 impgsje.dll
08.11.2006 106.496 yephk.dll
08.11.2006 106.496 urroxtl.dll

13.11.2006 77.824 jbtazy.dll
14.11.2006 77.824 cfltygd.dll
15.11.2006 77.824 yosdjh.dll
19.11.2006 77.824 dcvwaah.dll
20.11.2006 77.824 oebxpba.dll
20.11.2006 77.824 fmrmhc.dll
22.11.2006 77,824 guxxa.dll
27.11.2006 77,824 xxfgmy.dll
27.11.2006 77,824 tpedvf.dll
27.11.2006 77,824 dbqlrij.dll
29.11.2006 77,824 pmnqguh.dll

04.12.2006 17.920 vcehaeb.dll

04.12.2006 18.432 mlraakb.dll
05.12.2006 18.432 xqpauzx.dll

13.12.2006 19.456 rosdzop.dll
13.12.2006 19.456 qrzsyr.dll
13.12.2006 19.456 olnohdw.dll
13.12.2006 19.456 hzclqhc.dll

17.12.2006 20.992 - hjpprpu.dll

17.12.2006 22.541 - gqagksr.dll
17.12.2006 22.541 - cvnzie.dll

17.12.2006 20.992 - kuhmk.dll
18.12.2006 20.992 - tpedvf.dll
22.12.2006 20.992 - vwfps.dll
25.12.2006 20.992 - cthkpcv.dll
05.01.2007 20.992 - gwquvw.dll
06.01.2007 20.992 - axlet.dll
16.01.2007 20.992 - oksrqqu.dll
20.01.2007 20.992 - nbbrhbd.dll
04.02.2007 20.992 - cwgppb.dll
16.02.2007 20.992 - higehsg.dll
16.02.2007 20.992 - xkrdk.dll

- 11.776 - geplxss.dll
- 11.776 - tvomnc.dll

20.03.2007 - 7.168 - fyxkaah.dll
03.04.2007 - 7.680 - pkgvyg.dll


Registry values to delete:

eowygj.dll
HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad|gorgonian
HKLM\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler|{e944d14a-03aa-43e3-9d0e-4f50c4d1b005}
HKLM\SOFTWARE\Classes\CLSID\{e944d14a-03aa-43e3-9d0e-4f50c4d1b005}

duxzj.dll
HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad|imputable
HKLM\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler|{6570b782-1a41-4053-b2c9-12c7fcf0d84d}
HKLM\SOFTWARE\Classes\CLSID\{6570b782-1a41-4053-b2c9-12c7fcf0d84d}

gtpbx.dll
HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad|died
HKLM\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler|{7fa55359-7223-410f-bc82-efb3e3ded07f}
HKLM\SOFTWARE\Classes\CLSID\{7fa55359-7223-410f-bc82-efb3e3ded07f}

wuwbxp.dll
HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad|campy
HKLM\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler|{168cf174-6dab-461c-a761-a7adfa5a5719}
HKLM\SOFTWARE\Classes\CLSID\{168cf174-6dab-461c-a761-a7adfa5a5719}

oqabf.dll
HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad|considerateness
HKLM\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler|{4d993022-0899-4599-b4b6-0f887d0802e6}
HKLM\SOFTWARE\Classes\CLSID\{4d993022-0899-4599-b4b6-0f887d0802e6}

syycum.dll
HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad|hemadynamometer
HKLM\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler|{6076d2b1-634c-4685-843b-f826045ea5dc}
HKLM\SOFTWARE\Classes\CLSID\{6076d2b1-634c-4685-843b-f826045ea5dc}

qxfgcg.dll
HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad|astrogeology
HKLM\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler|{2be26361-58a2-4836-be57-b838f02fec3f}
HKLM\SOFTWARE\Classes\CLSID\{2be26361-58a2-4836-be57-b838f02fec3f}

titiau.dll
HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad|eeler
HKLM\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler|{1559e6c1-7e5e-4461-9457-6a2dea85eb9f}
HKLM\SOFTWARE\Classes\CLSID\{1559e6c1-7e5e-4461-9457-6a2dea85eb9f}

mzoeut.dll
HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad|cholecyst
HKLM\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler|{ee2975b6-e8d5-405e-8448-8fe9590f6cfb}
HKLM\SOFTWARE\Classes\CLSID\{ee2975b6-e8d5-405e-8448-8fe9590f6cfb}

zphnok.dll
HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad|equestre
HKLM\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler|{70305bc2-b289-4209-a344-be21f22bc930}
HKLM\SOFTWARE\Classes\CLSID\{70305bc2-b289-4209-a344-be21f22bc930}

gqagksr.dll
HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad|hydrodictyon
HKLM\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler|{b166be07-30a4-4d38-b781-44528a630706}
HKLM\SOFTWARE\Classes\CLSID\{b166be07-30a4-4d38-b781-44528a630706}

httge.dll
HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad|horologium
HKLM\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler|{7be183d2-a42d-4915-bf60-ec86fbf002cf}
HKLM\SOFTWARE\Classes\CLSID\{7be183d2-a42d-4915-bf60-ec86fbf002cf}

qnusjji.dll
HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad|breakneck
HKLM\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler|{06fe8138-6c67-484f-ab1f-42abddd2cbb6}
HKLM\SOFTWARE\Classes\CLSID\{06fe8138-6c67-484f-ab1f-42abddd2cbb6}

tazth.dll
HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad|gaonic
HKLM\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler|{f31aee4a-1530-4fef-8537-79c6973bff9a}
HKLM\SOFTWARE\Classes\CLSID\{f31aee4a-1530-4fef-8537-79c6973bff9a}

dpfwu.dll
HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad|contrabandists
HKLM\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler|{dfa61db1-388e-4c87-8d56-540fa229bcb4}
HKLM\SOFTWARE\Classes\CLSID\{dfa61db1-388e-4c87-8d56-540fa229bcb4}

ficqv.dll
HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad|heteropodous
HKLM\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler|{18c3fa26-192e-4c17-9c0f-76dc9b56c0c2}
HKLM\SOFTWARE\Classes\CLSID\{18c3fa26-192e-4c17-9c0f-76dc9b56c0c2}

rrtcany.dll
HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad|ferrateen
HKLM\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler|{27321538-5739-4aa1-b84c-7d18e4383f1f}
HKLM\SOFTWARE\Classes\CLSID\{27321538-5739-4aa1-b84c-7d18e4383f1f}

veklo.dll
HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad|clamoring
HKLM\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler|{0d9eb558-0666-479e-868a-21b1d1a53bd1}
HKLM\SOFTWARE\Classes\CLSID\{0d9eb558-0666-479e-868a-21b1d1a53bd1}

okkmtv.dll
HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad|bonspells
HKLM\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler|{11853d5f-f894-4cc7-bbc3-fc7a9dcfd896}
HKLM\SOFTWARE\Classes\CLSID\{11853d5f-f894-4cc7-bbc3-fc7a9dcfd896}

sacskza.dll
HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad|detachments
HKLM\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler|{01d8d081-0f76-4ab5-b5e4-9b23a709670e}
HKLM\SOFTWARE\Classes\CLSID\{01d8d081-0f76-4ab5-b5e4-9b23a709670e}

impgsje.dll
HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad|archenteric
HKLM\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler|{d7bdd42a-7e69-4bb8-aac3-d76ff65a3aa3}
HKLM\SOFTWARE\Classes\CLSID\{d7bdd42a-7e69-4bb8-aac3-d76ff65a3aa3}

yephk.dll
HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad|coursings
HKLM\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler|{f8d02387-789a-4c0f-a1d8-8a93f33ee4df}
HKLM\SOFTWARE\Classes\CLSID\{f8d02387-789a-4c0f-a1d8-8a93f33ee4df}

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"coursings"="{f8d02387-789a-4c0f-a1d8-8a93f33ee4df}"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"coursings"="{f8d02387-789a-4c0f-a1d8-8a93f33ee4df}"

jbtazy.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"featherweed"="{ab340860-fd81-4a65-b345-82eb77a66b5e}"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{ab340860-fd81-4a65-b345-82eb77a66b5e}"="featherweed"

HKLM\software\microsoft\windows\currentversion\shellserviceobjectdelayload|featherweed
HKLM\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler|{ab340860-fd81-4a65-b345-82eb77a66b5e}
HKLM\SOFTWARE\Classes\CLSID\{ab340860-fd81-4a65-b345-82eb77a66b5e}

cfltygd.dll
HKLM\software\microsoft\windows\currentversion\shellserviceobjectdelayload|cussers
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler|{ff170564-36c8-43f7-9100-559e166405cf}
HKEY_CLASSES_ROOT\CLSID\{ff170564-36c8-43f7-9100-559e166405cf}
HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{ff170564-36c8-43f7-9100-559e166405cf}

yosdjh.dll
HKLM\software\microsoft\windows\currentversion\shellserviceobjectdelayload|anatolian
HKLM\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler|{b28b396b-b9e8-44f5-aa04-ed4f383d79ad}
HKLM\SOFTWARE\Classes\CLSID\{b28b396b-b9e8-44f5-aa04-ed4f383d79ad}

urroxtl.dll
HKLM\software\microsoft\windows\currentversion\shellserviceobjectdelayload|incestuously
HKLM\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler|{03413bf7-e34c-445b-bfc0-a2b127255871}
HKLM\SOFTWARE\Classes\CLSID\{03413bf7-e34c-445b-bfc0-a2b127255871}

dcvwaah.dll
HKLM\software\microsoft\windows\currentversion\shellserviceobjectdelayload|gimmicks
HKLM\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler|{40dcff6e-af8d-4183-8ebe-a82270ac449e}
HKLM\SOFTWARE\Classes\CLSID\{40dcff6e-af8d-4183-8ebe-a82270ac449e}

oebxpba.dll
HKLM\software\microsoft\windows\currentversion\shellserviceobjectdelayload|amaranthaceous
HKLM\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler|{4fc003c3-87a0-489c-85cd-878246eb2d18}
HKLM\SOFTWARE\Classes\CLSID\{4fc003c3-87a0-489c-85cd-878246eb2d18}

fmrmhc.dll
HKLM\software\microsoft\windows\currentversion\shellserviceobjectdelayload|boucicault
HKLM\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler|{0bad5052-665d-40d4-a9bd-a2891eaafb42}
HKLM\SOFTWARE\Classes\CLSID\{0bad5052-665d-40d4-a9bd-a2891eaafb42}

guxxa.dll
HKLM\software\microsoft\windows\currentversion\shellserviceobjectdelayload|ecosystems
HKLM\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler|{af3fd9a8-1287-4159-9212-9a5b4494af70}
HKLM\SOFTWARE\Classes\CLSID\{af3fd9a8-1287-4159-9212-9a5b4494af70}

gtpbx.dll
HKLM\software\microsoft\windows\currentversion\shellserviceobjectdelayload|died
HKLM\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler|{7fa55359-7223-410f-bc82-efb3e3ded07f}
HKLM\SOFTWARE\Classes\CLSID\{7fa55359-7223-410f-bc82-efb3e3ded07f}

xxfgmy.dll
HKLM\software\microsoft\windows\currentversion\shellserviceobjectdelayload|emptins
HKLM\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler|{588599f4-de26-4c28-ba14-f4eb17e33481}
HKLM\SOFTWARE\Classes\CLSID\{588599f4-de26-4c28-ba14-f4eb17e33481}

tpedvf.dll
HKLM\software\microsoft\windows\currentversion\shellserviceobjectdelayload|expatriates
HKLM\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler|{1a01a98c-4f25-42e1-971a-185cf63569b2}
HKLM\SOFTWARE\Classes\CLSID\{1a01a98c-4f25-42e1-971a-185cf63569b2}

dbqlrij.dll
HKLM\software\microsoft\windows\currentversion\shellserviceobjectdelayload|benumbment
HKLM\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler|{af4fd984-a939-4c32-82b2-8bae7abe9aec}
HKLM\SOFTWARE\Classes\CLSID\{af4fd984-a939-4c32-82b2-8bae7abe9aec}

pmnqguh.dll
HKLM\software\microsoft\windows\currentversion\shellserviceobjectdelayload|cinnamomum
HKLM\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler|{93ac7c30-3878-4eaa-9420-7977285df5b1}
HKLM\SOFTWARE\Classes\CLSID\{93ac7c30-3878-4eaa-9420-7977285df5b1}

vcehaeb.dll
HKLM\software\microsoft\windows\currentversion\shellserviceobjectdelayload|flammei
HKLM\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler|{9d635a36-6b3c-4146-8625-f3aaf507bbf8}
HKLM\SOFTWARE\Classes\CLSID\{9d635a36-6b3c-4146-8625-f3aaf507bbf8}

mlraakb.dll
HKLM\software\microsoft\windows\currentversion\shellserviceobjectdelayload|gloomily
HKLM\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler|{9cc1c589-4b22-4dae-8e12-4c3b5fa12b3f}
HKLM\SOFTWARE\Classes\CLSID\{9cc1c589-4b22-4dae-8e12-4c3b5fa12b3f}

xqpauzx.dll
HKLM\software\microsoft\windows\currentversion\shellserviceobjectdelayload|blippers
HKLM\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler|{f2efa195-4785-4db1-9316-b48c64bb71da}
HKLM\SOFTWARE\Classes\CLSID\{f2efa195-4785-4db1-9316-b48c64bb71da}

rosdzop.dll
HKLM\software\microsoft\windows\currentversion\shellserviceobjectdelayload|impasse
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler|{bb720bab-2f75-456b-a850-04d77b20f6b8}
HKLM\Software\Classes\CLSID\{bb720bab-2f75-456b-a850-04d77b20f6b8}

qrzsyr.dll
HKLM\software\microsoft\windows\currentversion\shellserviceobjectdelayload|boob
HKLM\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler|{01b55afa-f451-474b-9e91-c35b24d02641}
HKLM\SOFTWARE\Classes\CLSID\{01b55afa-f451-474b-9e91-c35b24d02641}

olnohdw.dll
HKLM\software\microsoft\windows\currentversion\shellserviceobjectdelayload|astral
HKLM\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler|{5f938c17-fbc7-4a3c-8526-85e5b1a1f762}
HKLM\SOFTWARE\Classes\CLSID\{5f938c17-fbc7-4a3c-8526-85e5b1a1f762}

hzclqhc.dll
HKLM\software\microsoft\windows\currentversion\shellserviceobjectdelayload|articulation
HKLM\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler|{8dc1f789-e073-4363-b40d-07376bc5ecc5}
HKLM\SOFTWARE\Classes\CLSID\{8dc1f789-e073-4363-b40d-07376bc5ecc5}

hjpprpu.dll
HKLM\software\microsoft\windows\currentversion\shellserviceobjectdelayload|haematobia
HKLM\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler|{3c767c6b-602d-4b9b-829d-a3dc5b2d89dd}
HKLM\SOFTWARE\Classes\CLSID\{3c767c6b-602d-4b9b-829d-a3dc5b2d89dd}

gqagksr.dll
HKLM\software\microsoft\windows\currentversion\shellserviceobjectdelayload|hydrodictyon
HKLM\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler|{b166be07-30a4-4d38-b781-44528a630706}
HKLM\SOFTWARE\Classes\CLSID\{b166be07-30a4-4d38-b781-44528a630706}

kuhmk.dll
HKLM\software\microsoft\windows\currentversion\shellserviceobjectdelayload|discriminable
HKLM\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler|{4fbbdfd6-2ca9-4bba-93e4-aadf75321bca}
HKLM\SOFTWARE\Classes\CLSID\{4fbbdfd6-2ca9-4bba-93e4-aadf75321bca}

vwfps.dll
HKLM\software\microsoft\windows\currentversion\shellserviceobjectdelayload|beeper
HKLM\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler|{951a98d0-dad6-4a77-8280-a494279a884b}
HKLM\SOFTWARE\Classes\CLSID\{951a98d0-dad6-4a77-8280-a494279a884b}

cthkpcv.dll
HKLM\software\microsoft\windows\currentversion\shellserviceobjectdelayload|buprestidae
HKLM\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler|{b59f3ba4-98da-4b5f-8a2d-7b56fb11140b}
HKLM\SOFTWARE\Classes\CLSID\{b59f3ba4-98da-4b5f-8a2d-7b56fb11140b}

cvnzie.dll
HKLM\software\microsoft\windows\currentversion\shellserviceobjectdelayload|gutturalness
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler|{fe288882-f661-4522-88f3-20cfb7866fa4}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{fe288882-f661-4522-88f3-20cfb7866fa4}

gwquvw.dll

HKLM\software\microsoft\windows\currentversion\shellserviceobjectdelayload|carbinyl
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler|{8d8c2387-7f80-4022-9be6-43630a969558}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8d8c2387-7f80-4022-9be6-43630a969558}

axlet.dll
HKLM\software\microsoft\windows\currentversion\shellserviceobjectdelayload|eupeptic
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler|{8670ee50-01f9-47da-ac1e-cf8549e9e521}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8670ee50-01f9-47da-ac1e-cf8549e9e521}

oksrqqu.dll
HKLM\software\microsoft\windows\currentversion\shellserviceobjectdelayload|breadthes
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler|{5c4f2cbc-f32d-4a03-9812-86f39379811b}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5c4f2cbc-f32d-4a03-9812-86f39379811b}

nbbrhbd.dll
HKLM\software\microsoft\windows\currentversion\shellserviceobjectdelayload|hirtellous
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler|{fa19bd7e-50bc-4203-80ac-c4edc81ca9a3}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{fa19bd7e-50bc-4203-80ac-c4edc81ca9a3}

cwgppb.dll
HKLM\software\microsoft\windows\currentversion\shellserviceobjectdelayload|exemplars
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler|{2acf3add-34a1-4f2f-99cf-cc69785d1e90}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2acf3add-34a1-4f2f-99cf-cc69785d1e90}

higehsg.dll
HKLM\software\microsoft\windows\currentversion\shellserviceobjectdelayload|eitheror
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler|{2016a466-91a2-43c6-97d8-2fd380f065ef}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2016a466-91a2-43c6-97d8-2fd380f065ef}

xkrdk.dll
HKLM\software\microsoft\windows\currentversion\shellserviceobjectdelayload|didynamia
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler|{8329660f-e248-4872-98cc-fb9c4fec7ba8}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8329660f-e248-4872-98cc-fb9c4fec7ba8}

geplxss.dll
HKLM\software\microsoft\windows\currentversion\shellserviceobjectdelayload|apathies
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler|{aed6f6a3-183c-488d-9f90-23db99f56e7f}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{aed6f6a3-183c-488d-9f90-23db99f56e7f}

tvomnc.dll
HKLM\software\microsoft\windows\currentversion\shellserviceobjectdelayload|cam
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler|{634be415-da12-496b-b89e-329b73c4807f}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{634be415-da12-496b-b89e-329b73c4807f}

fyxkaah.dll
HKLM\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler|{b292ec9f-a074-4115-8342-1f459702d8d2}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b292ec9f-a074-4115-8342-1f459702d8d2}

pkgvyg.dll
HKLM\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler|{b0ded443-5e68-4001-a81b-0a0001621ab8}
HKLM\SOFTWARE\Classes\CLSID\{b0ded443-5e68-4001-a81b-0a0001621ab8}

Files to delete:

C:\WINDOWS\system32\ot.ico
C:\WINDOWS\system32\ts.ico
C:\WINDOWS\system32\ishst.exe
C:\WINDOWS\system32\ismini.exe
C:\WINDOWS\system32\issearch.exe
C:\WINDOWS\system32\ishost.exe
C:\WINDOWS\system32\ishost.exe_tobedeleted
C:\WINDOWS\system32\ixt0.dll
C:\WINDOWS\system32\ISHOST.EXE

C:\WINDOWS\system32\amcompat.tlb
C:\WINDOWS\system32\nscompat.tlb

C:\WINDOWS\system32\eowygj.dll
C:\WINDOWS\system32\duxzj.dll
C:\WINDOWS\system32\gtpbx.dll
C:\WINDOWS\system32\wuwbxp.dll
C:\WINDOWS\system32\oqabf.dll
C:\WINDOWS\system32\syycum.dll
C:\WINDOWS\system32\qxfgcg.dll
C:\WINDOWS\system32\titiau.dll
C:\WINDOWS\system32\mzoeut.dll
C:\WINDOWS\system32\zphnok.dll
C:\WINDOWS\system32\gqagksr.dll
C:\WINDOWS\system32\httge.dll
C:\WINDOWS\system32\qnusjji.dll
C:\WINDOWS\system32\tazth.dll
C:\WINDOWS\system32\dpfwu.dll
C:\WINDOWS\system32\ficqv.dll
C:\WINDOWS\system32\rrtcany.dll
C:\WINDOWS\system32\veklo.dll
C:\WINDOWS\system32\okkmtv.dll
C:\WINDOWS\system32\sacskza.dll
C:\WINDOWS\system32\impgsje.dll
C:\WINDOWS\system32\yephk.dll
C:\WINDOWS\system32\jbtazy.dll
C:\Windows\System32\cfltygd.dll
C:\Windows\System32\yosdjh.dll
C:\Windows\System32\urroxtl.dll
C:\WINDOWS\system32\dcvwaah.dll
C:\WINDOWS\system32\oebxpba.dll
C:\WINDOWS\system32\fmrmhc.dll
C:\WINDOWS\system32\guxxa.dll
C:\WINDOWS\system32\gtpbx.dll
C:\WINDOWS\system32\xxfgmy.dll
C:\WINDOWS\system32\tpedvf.dll
C:\WINDOWS\system32\dbqlrij.dll
C:\WINDOWS\system32\pmnqguh.dll
C:\WINDOWS\system32\vcehaeb.dll
C:\WINDOWS\system32\mlraakb.dll
C:\WINDOWS\System32\xqpauzx.dll
C:\WINDOWS\System32\rosdzop.dll
C:\WINDOWS\system32\qrzsyr.dll
C:\WINDOWS\system32\olnohdw.dll
C:\WINDOWS\system32\hzclqhc.dll
C:\WINDOWS\system32\hjpprpu.dll
C:\WINDOWS\system32\gqagksr.dll
C:\WINDOWS\system32\qomnono.dll
C:\WINDOWS\system32\kuhmk.dll
C:\WINDOWS\system32\vwfps.dll
C:\WINDOWS\system32\cthkpcv.dll
C:\WINDOWS\system32\cvnzie.dll
C:\WINDOWS\system32\gwquvw.dll
C:\WINDOWS\SYSTEM32\axlet.dll
C:\WINDOWS\System32\oksrqqu.dll
C:\WINDOWS\system32\nbbrhbd.dll
C:\WINDOWS\system32\cwgppb.dll
C:\WINDOWS\system32\higehsg.dll
C:\Windows\System32\xkrdk.dll
C:\WINDOWS\system32\geplxss.dll
C:\WINDOWS\system32\tvomnc.dll
C:\WINDOWS\system32\fyxkaah.dll
C:\WINDOWS\system32\pkgvyg.dll








virus-protect.org
startseite Valid HTML 4.01 Ranking-Hits antispam