Tech-Forums Community Driven Spyware/Virus Removal Program

[Osiris]

I posted a message earlier last week about a program I was making for this subject. It's still a work in progress but could be sped up with some help from you all, if anyone is interested. Right now I have a HUGE database of files, exe, .dll, filenames, spyware/virus locations, etc. There's a lot more out there that I don't have in my database. I uploaded the txt file with all the info on it. If anyone is interested in helping in their spare time, just download the file, copy it to excel and start searching other forums, etc for files that I don't currently have listed. When you do find some, post in this thread and I will add them to my database. I say copy it to Excel so when you add it, do a search for duplicate entries and if you added an item already on the list, Excel will delete it. Also make sure if you do find some files that they aren't system files, like svchost.exe. Even thou that process can be exploited by spyware/viruses; I don't want to delete that possibly "legit" file. Make sense? I am using this program as a batch file right now and it works the best in safe mode. I have actually infected my system with spyware and was removed successfully, but I was missing a few entries to be a 100% successful deletion of spyware. But for the most part it works. Also if someone could find the cmd to delete a reg entry via a batch file and the command to delete a file on reboot either in the system or delete a reg entry on reboot and also how to kill a process in use via a batch file that would be GREAT. Also what will help is for you to run programs on your system, then open the task manager and see what the process is called so that can be added to the database. When the program is run, I want it to kill all non-essential processes. I'd rather have the program kill the process than the user unless they want to do it manually. Again, simplicity is the goal here.

Having some issues with the file upload so I got to work this out, so give me a few

 

[Osiris]

These are the running processes

explorer
aawservice
aconti
Acrord
Ad-Aware2007
AntispyDeluxe
AntiSpywareMaster
apisa32
avgamsvr
avgcc
avgrssvc
avgupsvc
avD
b128
castlecops[1]
ces005dr
codecaddon1169[1]
colonia
D4D7D6DCDBDFDC
dfnjgvroda
DlDer
Downloader
editpad
EXCEL
!update
AVP0
AVPo
texcrmzs
FASTTOOL
fhfmm
fhfmm-Uninstaller
File
firefox
FRONTPG
gimmygames11
hgztirmm
hoor
ie_32
iexplore
IH
isamntr
istsvc
izqfodax
Keenvalue
keenvalueinstall_99
KillKeenValue
kkcomp
kkcomp$
kkv
kopCFEWV
kwm
lcntqkdn
liqad
liqad$
liqui
liqui-Uninstaller
m3SrchMn
mav_startupmon
mljji
mp3.1
mrofinu1000106
MSACCESS
msfo
msmsgs
msnappau
msnmsgr
msole32
MSPUB
mwsoemon
Nero_Burning_Rom_Ultra_Edition_6.6.0.6_serial_number.txt[1]
nnx22011
NoDNS
nthc32
nusrmgr
nwonknu
oins
OINSetup
OiUninstaller
ortu
Outerinfo-1461[1]
OuterinfoUpdate
Outlook
perfectnavuninstall
perfs
pmmnt
pmsnrr
PnkBstr
poolsv
POWERPNT
ps_install-grokster
ps_uninstaller[1]
PSDream
psdrv
PSHoppe
pskill
PuritySCAN[1]
PuritySCANUninstall
quicken
rasrun
rayiou
refmagsmeal
regw
ribbon_wave_animated
routing
rtasks
RunPF
rwsa
scvhost
sear1
search[2]
seatokeyboard
senduninstallinfo
setup_flowgobar_with_track
setup_incredifind_screensaver_with_track
shex
SpyAxe
Spy-Axe
SpybotSD
spybotsd152
spysheriff
Spyware-Quake
srts
SSCVIIHOST
startupmon
sui
svci
svhjdsah
syspg
TeaTimer
test117
testexe
tipb
Tmksrvu
tmp103515
tmp11750062
tmp11755515
tmp37687
tmp38968
tmp39250
tmp40468
tmp41515
tmp41578
tmp41835
tmp42890
tmp43251265
tmp44109
tmp44515
tmp45484
tmp46546
tmp46609
tmp46859
tmp47468
tmp50328
tmp52484
tmp55390
tmp86456437
tmp98171
uninstall
unknown
updall2m
Update
updater2
updmgr
uwa7pcw
ViewpointService
VirusHeat
VirusHeat 3.9
VirusHeat 4.3
wa7pinst
wapisu
wbta
WinAvXX
Windows_XP_SP2_Professional_Edition_Corporate_serial_number.txt[2]
windowsupd2
winhost
Winipxa
winserv
winservs
Winsrvc
winstall
WinTouch
winuh32
winvnc
WINWOrd
winya
wmplayer
wnscpit
wnscpv
WToolsS
wupdater
wups
xadbrk_
xc42[1]
xpa2008
XPAntivirus
XPAntivirusUpdate
Y12680OA
Y12680U
ypager
z11
z12
z14
z16

 

[Osiris]

These are the known file locations


C:\Documents and Settings\Admin\Application Data\Proxy Spam Sign
C:\Documents and Settings\All Users\Application Data\That Size Part Chin
C:\WINDOWS\aconti.exe
C:\WINDOWS\adbar.dll
C:\WINDOWS\apdqnxp.dll
C:\WINDOWS\atlef.dll
C:\WINDOWS\bokpkov.dll
C:\WINDOWS\cbinst$.exe
C:\WINDOWS\cookies.ini
C:\WINDOWS\daxtime.dll
C:\WINDOWS\dp0.dll
C:\WINDOWS\system32\fool0.dll
C:\WINDOWS\iun6002.exe
C:\WINDOWS\eventlowg.dll
C:\WINDOWS\fhfmm.exe
C:\WINDOWS\fhfmm-Uninstaller.exe
C:\WINDOWS\fkhczqzg.dll
C:\WINDOWS\flt.dll
C:\WINDOWS\Fonts\lsass.exe
C:\WINDOWS\ie_32.exe
C:\WINDOWS\izqfodax.exe
C:\WINDOWS\jd2002.dll
C:\WINDOWS\kkcomp$.exe
C:\WINDOWS\kkcomp.dll
C:\WINDOWS\kkcomp.exe
C:\WINDOWS\liqad$.exe
C:\WINDOWS\liqad.dll
C:\WINDOWS\liqad.exe
C:\WINDOWS\liqui.dll
C:\WINDOWS\liqui.exe
C:\WINDOWS\liqui-Uninstaller.exe
C:\WINDOWS\mrofinu1000106.exe
C:\WINDOWS\mrofinu1000106.exe
C:\WINDOWS\ngd.dll
C:\WINDOWS\nthc32.exe
C:\WINDOWS\pbar.dll
C:\WINDOWS\privacy_danger\index.htm
C:\WINDOWS\Salesmon
C:\WINDOWS\SecurePCCleaner
C:\WINDOWS\spredirect.dll
C:\WINDOWS\svhjdsah.exe
C:\WINDOWS\syspg.exe
C:\WINDOWS\SYSTEM\AIGHKH.DLL
c:\windows\system\Update.exe
C:\WINDOWS\system32\ace16win.dll
C:\WINDOWS\system32\andt.sys
C:\WINDOWS\system32\apisa32.exe
C:\WINDOWS\system32\avicap32c.dll
C:\WINDOWS\system32\components
C:\WINDOWS\system32\comsa32.sys
C:\WINDOWS\system32\D4D7D6DCDBDFDC.exe
C:\WINDOWS\system32\ddccb.dll
C:\WINDOWS\system32\doenafit.dll
C:\WINDOWS\system32\drivers\bg_bg.gif
C:\WINDOWS\system32\drivers\cell_bg.gif
C:\WINDOWS\system32\drivers\cell_footer.gif
C:\WINDOWS\system32\drivers\cell_header_block.gif
C:\WINDOWS\system32\drivers\cell_header_remove.gif
C:\WINDOWS\system32\drivers\cell_header_scan.gif
C:\WINDOWS\system32\drivers\close_ico.gif
C:\Windows\system32\drivers\core.cache.dsk
C:\Windows\system32\drivers\crcdiskk.sys
C:\WINDOWS\system32\drivers\detect.htm
C:\WINDOWS\system32\drivers\download_btn.jpg
C:\WINDOWS\system32\drivers\download_now_btn.gif
C:\Windows\system32\drivers\dxapii.sys
C:\WINDOWS\system32\drivers\fad.sys
C:\Windows\system32\drivers\flpydiskk.sys
C:\WINDOWS\system32\drivers\header_red_bg.gif
C:\WINDOWS\system32\drivers\header_red_free_scan.gif
C:\WINDOWS\system32\drivers\header_red_free_scan_bg.gif
C:\WINDOWS\system32\drivers\header_red_protect_your_pc.gif
C:\Windows\system32\drivers\mountmgrr.sys
C:\WINDOWS\system32\drivers\rating.gif
C:\WINDOWS\system32\drivers\s_detect.htm
C:\WINDOWS\system32\drivers\screenshot.jpg
C:\WINDOWS\system32\drivers\shadow.jpg
C:\WINDOWS\system32\drivers\shadow_bg.gif
C:\Windows\system32\drivers\USBCAMD22.sys
C:\Windows\system32\drivers\usbohcii.sys
C:\Windows\system32\drivers\volmgrr.sys
C:\Windows\system32\drivers\volmgrxx.sys
C:\Windows\system32\drivers\volsnapp.sys
C:\Windows\system32\drmgs.sys
C:\WINDOWS\SYSTEM32\efccyvv.dll
C:\WINDOWS\SYSTEM32\fccaxwt.dll
C:\WINDOWS\SYSTEM32\fcyxyyv.dll
C:\WINDOWS\system32\ftlsk.dll
C:\WINDOWS\system32\fwsvc.sys
C:\WINDOWS\system32\gtlnimvj.dll
C:\WINDOWS\system32\gtv_sd.bin
C:\WINDOWS\SYSTEM32\iifgded.dll
C:\WINDOWS\SYSTEM32\iiifeff.dll
C:\Windows\system32\Indt2.sys
C:\WINDOWS\SYSTEM32\jkkifgh.dll
C:\WINDOWS\SYSTEM32\khfebxv.dll
C:\WINDOWS\system32\lcntqkdn.exe

 

[Osiris]

C:\WINDOWS\system32\mljji.exe
C:\WINDOWS\system32\msole32.exe
C:\WINDOWS\system32\mwykrlns.dll
C:\WINDOWS\SYSTEM32\nnnnljj.dll
C:\windows\system32\npvrudpr.dll
C:\WINDOWS\system32\npvrudpr.dll
C:\WINDOWS\system32\nusrmgr.exe
C:\WINDOWS\SYSTEM32\opnoonm.dll
C:\Windows\system32\perfs.exe
C:\WINDOWS\system32\pmecwsxh.dll
C:\WINDOWS\system32\qopqp.dll
C:\WINDOWS\system32\qtisnxsl.dll
C:\Windows\system32\routing.exe
C:\WINDOWS\SYSTEM32\rqrpnoo.dll
C:\WINDOWS\SYSTEM32\ssqqonk.dll
C:\WINDOWS\system32\sulimo.dat
C:\Windows\system32\tmp0_39906285817.bk
C:\WINDOWS\system32\tvramnuh.dll
C:\WINDOWS\system32\vjuyccfe.dll
C:\WINDOWS\system32\vturr.dll
C:\WINDOWS\system32\waxpnofk.dll
C:\WINDOWS\system32\WinAvXX.exe
C:\WINDOWS\system32\winuh32.exe
C:\WINDOWS\system32\winya.exe
C:\windows\systme32\rodyrvob.ini
C:\WINDOWS\tasks\B15BF7C490E86E1C.jobB15BF7C490E86E1C.job
C:\WINDOWS\TEMP\sp.html
C:\WINDOWS\xadbrk.dll
C:\WINDOWS\xadbrk.exe
C:\WINDOWS\xadbrk_.exe
C:\WINDOWS\msddx.dll
C:\WINDOWS\msqnx.dll
C:\WINDOWS\qnxplugin.dll
C:\WINDOWS\privacy_danger\index.html
C:\WINDOWS\Cursors\services.exe
C:\WINDOWS\SYSTEM32\jkhfg.dll
C:\WINDOWS\system32\kdtha.exe
C:\WINDOWS\system32\drivers\spools.exe
C:\WINDOWS\system32\ntos.exe
C:\WINDOWS\system32\wowfx.dll
C:\WINDOWS\system32\wsnpoem\audio.dll
C:\WINDOWS\system32\wsnpoem\audio.dll.cla
C:\WINDOWS\system32\wsnpoem\video.dll
C:\WINDOWS\system32\drivers\Xkhe30.sys
C:\WINDOWS\system32\atlu.dll
C:\Documents and Settings\All Users\Start Menu\Live Safety Center.lnk
C:\Documents and Settings\All Users\Start Menu\Online Security Guide.lnk
C:\Documents and Settings\NetworkService\Local Settings\Application Data\n.ini
C:\Documents and Settings\Owner\Desktop\Live Safety Center.lnk
C:\Documents and Settings\Owner\Desktop\Online Security Guide.lnk
C:\Documents and Settings\Owner\Favorites\Online Security Guide.lnk
C:\WINDOWS\cookies.ini
C:\WINDOWS\system32\aruwmgty.ini
C:\WINDOWS\system32\ijkmp.bak1
C:\WINDOWS\system32\ijkmp.bak2
C:\WINDOWS\system32\ijkmp.ini
C:\WINDOWS\system32\ijkmp.ini2
C:\WINDOWS\system32\ijkmp.tmp
C:\WINDOWS\system32\ijubedbq.ini
C:\WINDOWS\system32\iobeupyb.dll
C:\WINDOWS\system32\kuombqav.dll
C:\WINDOWS\system32\nhfgwhcx.dllbox
C:\WINDOWS\system32\pac.txt
C:\WINDOWS\system32\pmkji.dll
C:\WINDOWS\system32\qbdebuji.dll
C:\WINDOWS\system32\vaqbmouk.ini
C:\WINDOWS\system32\wnstsisv.exe
C:\WINDOWS\system32\ytgmwura.dll
C:\WINDOWS\system32\nhfgwhcx.dll
C:\WINDOWS\system32\rwopmhif.dll
C:\WINDOWS\system32\wyjituft.ini
C:\WINDOWS\system32\whqclmwl.exe
C:\WINDOWS\system32\oqhtarpj.dll
C:\WINDOWS\system32\byjnpbdm.ini
C:\WINDOWS\system32\mdbpnjyb.dll
C:\WINDOWS\system32\dbabhpmn.exe
C:\WINDOWS\system32\yorrohei.ini
C:\WINDOWS\system32\kpwuxxam.dll
C:\WINDOWS\system32\bigcxmlb.exe
C:\WINDOWS\system32\swleibuf.dll
C:\WINDOWS\system32\xtbfurvd.ini
C:\WINDOWS\system32\dvrufbtx.dll
C:\WINDOWS\system32\kxiulart.exe
C:\WINDOWS\system32\oflgouqa.ini
C:\WINDOWS\system32\mokbjqbg.dll
C:\WINDOWS\system32\focwbpvk.dll
C:\WINDOWS\system32\jaorlyiu.dll
C:\WINDOWS\system32\bqnrgjng.exe
C:\WINDOWS\system32\pmtfdrvo.ini
C:\WINDOWS\system32\ovrdftmp.dll
C:\WINDOWS\system32\ftjtwbgj.dll
C:\WINDOWS\system32\plfayttp.ini
C:\WINDOWS\system32\bjdcyuub.dll
C:\WINDOWS\system32\dycbqndq.ini
C:\WINDOWS\system32\skkxtvas.dll
C:\WINDOWS\system32\rmqigdys.exe
C:\WINDOWS\system32\efnsnebd.ini
C:\WINDOWS\system32\dbensnfe.dll
C:\WINDOWS\system32\wxfwmruq.exe

 

[Osiris]

C:\WINDOWS\system32\dteoqecb.ini
C:\WINDOWS\system32\heqpsxgu.exe
C:\WINDOWS\system32\bnaaqdmn.ini
C:\WINDOWS\system32\selffjxs.exe
C:\WINDOWS\system32\pgbwflaf.exe
C:\WINDOWS\system32\ndddxihn.exe
C:\WINDOWS\system32\rnxendxk.ini
C:\WINDOWS\system32\qmoqupmb.exe
C:\WINDOWS\system32\offvg.ini
C:\WINDOWS\system32\hrxarjah.exe
C:\WINDOWS\system32\gwnlirng.ini
C:\WINDOWS\system32\hduiihjv.ini
C:\WINDOWS\system32\ktpwbkjn.ini
C:\WINDOWS\system32\jbwidlia.ini
C:\WINDOWS\system32\jjpijfpm.ini
C:\WINDOWS\system32\csbbdjbo.tmp
C:\WINDOWS\system32\csbbdjbo.ini
C:\WINDOWS\system32\pcftapvv.ini
C:\WINDOWS\system32\rnkfavcf.dll
C:\WINDOWS\system32\opvxhmas.dll
C:\WINDOWS\system32\wmqjkqft.dll
C:\WINDOWS\system32\cegsthiw.dll
C:\WINDOWS\system32\lyrcmsjh.ini
C:\WINDOWS\system32\taipnbwk.dll
C:\WINDOWS\system32\tfutijyw.dll
C:\WINDOWS\system32\sypphxgk.exe
C:\WINDOWS\system32\aquoglfo.dll
C:\WINDOWS\system32\agxkyqbl.exe
C:\WINDOWS\system32\tregckyl.exe
C:\WINDOWS\system32\abywhpfa.dll
C:\WINDOWS\system32\ajcodoqc.exe
C:\WINDOWS\system32\tvrrwvsq.exe
C:\Documents and Settings\LocalService\Application Data\NetMon\domains.txt
C:\Documents and Settings\LocalService\Application Data\NetMon\log.txt
C:\Temp\1cb\syscheck.log
C:\Temp\0b9\tmpTF.log
C:\Temp\gbRve12\csLioes.log
C:\WINDOWS\system32\svshost.exe
C:\Documents and Settings\Spencer Somerville\lsass.exe
C:\Documents and Settings\LocalService\Application Data\NetMon
C:\WINDOWS\BM1705ac4b.xml
C:\WINDOWS\pskt.ini
C:\WINDOWS\smdat32m.sys
C:\WINDOWS\SYSTEM32\aijcunpk.ini
C:\WINDOWS\system32\aqVreo18
C:\WINDOWS\system32\atkakedw.dll
C:\WINDOWS\system32\bmklqyrb.dll
C:\WINDOWS\SYSTEM32\cJTvyyxx.ini
C:\WINDOWS\SYSTEM32\cJTvyyxx.ini2
C:\WINDOWS\SYSTEM32\dla\ntp2.ini
C:\WINDOWS\system32\ealmshsj.dll
C:\WINDOWS\system32\egfurcyk.dll
C:\WINDOWS\system32\eqnmccde.dll
C:\WINDOWS\system32\etknufby.dll
C:\WINDOWS\system32\fvsciald.dll
C:\WINDOWS\SYSTEM32\ggnlfjel.ini
C:\WINDOWS\system32\gsjlandl.dll
C:\WINDOWS\system32\gwmmarcu.dll
C:\WINDOWS\system32\heuojath.dll
C:\WINDOWS\system32\hlgeaytb.dll
C:\WINDOWS\system32\ibyoujeo.dll
C:\WINDOWS\system32\imkwvbda.dll
C:\WINDOWS\system32\ioqusnsv.dll
C:\WINDOWS\system32\kpnucjia.dll
C:\WINDOWS\system32\lcetwlvl.dll
C:\WINDOWS\system32\lhdnltna.dll
C:\WINDOWS\system32\lqajobcv.dll
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\mkooaano.dll
C:\WINDOWS\SYSTEM32\oejuoybi.ini
C:\WINDOWS\system32\okthxfor.dll
C:\WINDOWS\SYSTEM32\qhndlhdr.ini
C:\WINDOWS\system32\qxqnfuvp.dll
C:\WINDOWS\system32\rihbeldw.dll
C:\WINDOWS\SYSTEM32\rvjfpuci.ini
C:\WINDOWS\system32\T7\icm.exe
C:\WINDOWS\system32\ulhfuxqk.dll
C:\WINDOWS\system32\vbhldukp.dll
C:\WINDOWS\system32\waikpxxw.dll
C:\WINDOWS\system32\wcsriwuv.dll
C:\WINDOWS\system32\xxyyvTJc.dl

 

[Osiris]

C:\WINDOWS\system32\yrmrcgoa.dll
C:\WINDOWS\SYSTEM32\glugeewb.ini
C:\WINDOWS\SYSTEM32\ipsgmxxe.ini
C:\WINDOWS\SYSTEM32\glbfqmuv.ini
C:\WINDOWS\SYSTEM32\fiomgxxu.ini
C:\WINDOWS\SYSTEM32\qkjnxqpw.ini
C:\WINDOWS\SYSTEM32\ebkectoi.ini
C:\WINDOWS\SYSTEM32\slptsmgl.ini
C:\WINDOWS\SYSTEM32\qeaoejmg.ini
C:\gbo.exe
C:\bfgco.exe
C:\WINDOWS\SYSTEM32\MVEffMoq.ini
C:\hlpr.exe
C:\WINDOWS\SYSTEM32\tbqbbfmn.ini
C:\WINDOWS\SYSTEM32\atmtd.dll.tmp
C:\dllhost.exe
C:\WINDOWS\SYSTEM32\vbzip10.dll
C:\WINDOWS\SYSTEM32\xxyvSIaA.dll
C:\WINDOWS\SYSTEM32\klnmp.ini2
C:\WINDOWS\SYSTEM32\klnmp.tmp
C:\WINDOWS\SYSTEM32\klnmp.bak1
C:\WINDOWS\SYSTEM32\klnmp.bak2
C:\WINDOWS\SYSTEM32\schost.exe
C:\Documents and Settings\All Users\Application Data\Rabio
C:\WINDOWS\U3BlbmNlciBTb21lcnZpbGxl
C:\WINDOWS\SYSTEM32\usnv
C:\WINDOWS\SYSTEM32\mdp2
C:\WINDOWS\SYSTEM32\FxTmp
C:\WINDOWS\bobsaver.exe
C:\WINDOWS\bobsaver.scr
C:\WINDOWS\hosts
C:\WINDOWS\secure32.html
C:\WINDOWS\system32\Cache
C:\WINDOWS\system32\dlh9jkd1q8.exe
C:\WINDOWS\system32\paytime.exe
C:\WINDOWS\system32\tavo1.dll
C:\WINDOWS\tool1.exe
C:\WINDOWS\tool2.exe
C:\WINDOWS\tool3.exe
C:\WINDOWS\tool4.exe
C:\WINDOWS\tool5.exe
C:\WINDOWS\system32\kavo0.dll
C:\WINDOWS\system32\kavo1.dll
C:\WINDOWS\system32\tavo0.dll
C:\WINDOWS\system32\kavo.exe
C:\WINDOWS\system32\tavo.exe
C:\windows\admgcx.dll
C:\WINDOWS\fsxloqf.exe
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
C:\WINDOWS\search_res.txt
C:\Program Files\seekmo
C:\Program Files\seekmo\seekmohook.dll
C:\WINDOWS\180ax.exe
C:\WINDOWS\2020search.dll
C:\WINDOWS\2020search2.dll
C:\WINDOWS\bjam.dll
C:\WINDOWS\bokja.exe
C:\WINDOWS\cdsm32.dll
C:\WINDOWS\default.htm
C:\WINDOWS\mspphe.dll
C:\WINDOWS\mssvr.exe
C:\WINDOWS\saiemod.dll
C:\WINDOWS\salm.exe
C:\WINDOWS\stcloader.exe
C:\WINDOWS\stem~1
C:\WINDOWS\stem~1\??stem\
C:\WINDOWS\stem~1\chkntfs.exe
C:\WINDOWS\swin32.dll
C:\WINDOWS\system32\geBqRijG.dll
C:\WINDOWS\system32\MabryObj.dll
C:\WINDOWS\system32\msixu.dll
C:\WINDOWS\system32\wer8274.dll
C:\WINDOWS\TEMP\salm.exe
C:\WINDOWS\updatetc.exe
C:\WINDOWS\voiceip.dll
C:\WINDOWS\FLEOK
C:\QooBox\Quarantine\C\WINDOWS\system32\jgjuharo.exe.vir
C:\System Volume Information\_restore{AA6C8498-140E-441D-9DDE-0826BE9E5F33}\RP38\A0280638.exe
C:\WINDOWS\avifile32.dll
C:\WINDOWS\avisynthex32.dll
C:\WINDOWS\aviwrap32.dll
C:\WINDOWS\browserad.dll
C:\WINDOWS\changeurl_30.dll
C:\WINDOWS\msa64chk.dll
C:\WINDOWS\msapasrc.dll
C:\WINDOWS\123messenger
C:\WINDOWS\ntnut.exe
C:\WINDOWS\shdocpe.dll
C:\WINDOWS\shdocpl.dll
C:\WINDOWS\winsb.dll
C:\WINDOWS\system32\MSNSA32.dll
C:\WINDOWS\system32\shdocpe.dll
C:\WINDOWS\system32\SIPSPI32.dll
C:\WINDOWS\apphelp32.dll
C:\WINDOWS\asferror32.dll
C:\WINDOWS\asycfilt32.dll
C:\WINDOWS\athprxy32.dll
C:\WINDOWS\ati2dvaa32.dll
C:\WINDOWS\ati2dvag32.dll
C:\WINDOWS\audiosrv32.dll
C:\WINDOWS\autodisc32.dll
C:\WINDOWS\licencia.txt
C:\WINDOWS\telefonos.txt
C:\WINDOWS\textos.txt
C:\Documents and Settings\Kevin\Desktopvirii
C:\WINDOWS\a.bat
C:\WINDOWS\base64.tmp

 

[Osiris]

C:\WINDOWS\bdn.com
C:\WINDOWS\dwltqnmx.exe
C:\WINDOWS\fkdnrwsv.dll
C:\WINDOWS\FVProtect.exe
C:\WINDOWS\iTunesMusic.exe
C:\WINDOWS\mslagent
C:\WINDOWS\mslagent\2_mslagent.dll
C:\WINDOWS\mslagent\mslagent.exe
C:\WINDOWS\mslagent\uninstall.exe
C:\WINDOWS\mssecu.exe
C:\WINDOWS\stfngdvw.dll
C:\WINDOWS\svpekgonwdn.dll
C:\WINDOWS\sxfnewqb.dll
C:\WINDOWS\system32\yayaWOEU.dll
C:\WINDOWS\system32akttzn.exe
C:\WINDOWS\system32anticipator.dll
C:\WINDOWS\system32awtoolb.dll
C:\WINDOWS\system32bdn.com
C:\WINDOWS\system32bsva-egihsg52.exe
C:\WINDOWS\system32dpcproxy.exe
C:\WINDOWS\system32emesx.dll
C:\WINDOWS\system32h@tkeysh@@k.dll
C:\WINDOWS\system32hoproxy.dll
C:\WINDOWS\system32hxiwlgpm.dat
C:\WINDOWS\system32hxiwlgpm.exe
C:\WINDOWS\system32medup012.dll
C:\WINDOWS\system32medup020.dll
C:\WINDOWS\system32msgp.exe
C:\WINDOWS\system32msnbho.dll
C:\WINDOWS\system32mssecu.exe
C:\WINDOWS\system32msvchost.exe
C:\WINDOWS\system32mtr2.exe
C:\WINDOWS\system32mwin32.exe
C:\WINDOWS\system32netode.exe
C:\WINDOWS\system32newsd32.exe
C:\WINDOWS\system32ps1.exe
C:\WINDOWS\system32psof1.exe
C:\WINDOWS\system32psoft1.exe
C:\WINDOWS\system32regc64.dll
C:\WINDOWS\system32regm64.dll
C:\WINDOWS\system32Rundl1.exe
C:\WINDOWS\system32smp
C:\WINDOWS\system32smp\msrc.exe
C:\WINDOWS\system32sncntr.exe
C:\WINDOWS\system32ssurf022.dll
C:\WINDOWS\system32ssvchost.com
C:\WINDOWS\system32ssvchost.exe
C:\WINDOWS\system32sysreq.exe
C:\WINDOWS\system32taack.dat
C:\WINDOWS\system32taack.exe
C:\WINDOWS\system32temp#01.exe
C:\WINDOWS\system32thun.dll
C:\WINDOWS\system32thun32.dll
C:\WINDOWS\system32VBIEWER.OCX
C:\WINDOWS\system32vbsys2.dll
C:\WINDOWS\system32vcatchpi.dll
C:\WINDOWS\system32winlogonpc.exe
C:\WINDOWS\system32winsystem.exe
C:\WINDOWS\system32WINWGPX.EXE
C:\WINDOWS\userconfig9x.dll
C:\WINDOWS\Web\def.htm
C:\WINDOWS\winsystem.exe
C:\WINDOWS\zip1.tmp
C:\WINDOWS\zip2.tmp
C:\WINDOWS\zip3.tmp
C:\WINDOWS\zipped.tmp
C:\WINDOWS\system32\exwjutkf.exe
C:\WINDOWS\system32\vmxyrqpq.exe
C:\WINDOWS\system32\nwnajizu.exe
C:\WINDOWS\system32\gzgzqnyh.exe
C:\WINDOWS\system32\wbibefed.exe
C:\WINDOWS\system32\epypcxez.exe
C:\WINDOWS\system32\rcbqxaxo.exe
C:\WINDOWS\system32\bkxanare.exe
C:\WINDOWS\svpekgongpv.dll
C:\WINDOWS\system32\akttzn.exe
C:\WINDOWS\system32\anticipator.dll
C:\WINDOWS\system32\awtoolb.dll
C:\WINDOWS\system32\bdn.com
C:\WINDOWS\system32\bsva-egihsg52.exe
C:\WINDOWS\system32\dpcproxy.exe
C:\WINDOWS\system32\emesx.dll
C:\WINDOWS\system32\h@tkeysh@@k.dll
C:\WINDOWS\system32\hoproxy.dll
C:\WINDOWS\system32\hxiwlgpm.dat
C:\WINDOWS\system32\hxiwlgpm.exe
C:\WINDOWS\system32\medup012.dll
C:\WINDOWS\system32\medup020.dll
C:\WINDOWS\system32\msgp.exe
C:\WINDOWS\system32\msnbho.dll
C:\WINDOWS\system32\mssecu.exe
C:\WINDOWS\system32\msvchost.exe
C:\WINDOWS\system32\mtr2.exe
C:\WINDOWS\system32\mwin32.exe
C:\WINDOWS\system32\netode.exe
C:\WINDOWS\system32\newsd32.exe
C:\WINDOWS\system32\ps1.exe
C:\WINDOWS\system32\psof1.exe
C:\WINDOWS\system32\psoft1.exe
C:\WINDOWS\system32\regc64.dll
C:\WINDOWS\system32\regm64.dll
C:\WINDOWS\system32\Rundl1.exe
C:\WINDOWS\system32\smp\msrc.exe
C:\WINDOWS\system32\sncntr.exe
C:\WINDOWS\system32\ssurf022.dll
C:\WINDOWS\system32\ssvchost.com
C:\WINDOWS\system32\ssvchost.exe
C:\WINDOWS\system32\sysreq.exe
C:\WINDOWS\system32\taack.dat
C:\WINDOWS\system32\taack.exe
C:\WINDOWS\system32\temp#01.exe
C:\WINDOWS\system32\thun.dll
C:\WINDOWS\system32\thun32.dll
C:\WINDOWS\system32\VBIEWER.OCX
C:\WINDOWS\system32\vbsys2.dll
C:\WINDOWS\system32\vcatchpi.dll
C:\WINDOWS\system32\winlogonpc.exe
C:\WINDOWS\system32\winsystem.exe
C:\WINDOWS\system32\WINWGPX.EXE
C:\WINDOWS\SYSTEM32\anibgzgh.exe
C:\WINDOWS\SYSTEM32\pchqdwbg.exe
C:\WINDOWS\SYSTEM32\qxirypgv.exe
C:\WINDOWS\SYSTEM32\smfcore.dll
C:\Documents and Settings\Barney\My Documents\MCROSO~1.NET
C:\Documents and Settings\Barney\My Documents\YSTEM3~1
C:\Documents and Settings\Barney\My Documents\YSTEM3~1\cmd.exe
C:\Program Files\Common Files\{
C:\Program Files\Common Files\{2DEC7~2
C:\Program Files\Common Files\{3DEC7~1
C:\Program Files\Common Files\{3DEC7~1\Bar888.dll
C:\Program Files\Common Files\sstem~1
C:\Program Files\Common Files\ystem3~1
C:\Program Files\ecurit~1
C:\temp\tn3
C:\WINDOWS\b136.exe
C:\WINDOWS\crosof~1
C:\WINDOWS\fnts~1
C:\WINDOWS\ppatch~1
C:\WINDOWS\ppatch~1\??pPatch\
C:\WINDOWS\ppatch~1\dvdplay.exe
C:\WINDOWS\ppatch~2
C:\WINDOWS\system32\_000026_.tmp.dll
C:\WINDOWS\system32\_003132_.tmp.dll
C:\WINDOWS\system32\_003133_.tmp.dll
C:\WINDOWS\system32\_003134_.tmp.dll
C:\WINDOWS\system32\_003135_.tmp.dll
C:\WINDOWS\system32\_003142_.tmp.dll
C:\WINDOWS\system32\_003143_.tmp.dll
C:\WINDOWS\system32\_003144_.tmp.dll
C:\WINDOWS\system32\_003145_.tmp.dll
C:\WINDOWS\system32\_003147_.tmp.dll
C:\WINDOWS\system32\_003148_.tmp.dll
C:\WINDOWS\system32\_003151_.tmp.dll
C:\WINDOWS\system32\_003152_.tmp.dll
C:\WINDOWS\system32\_003154_.tmp.dll
C:\WINDOWS\system32\_003155_.tmp.dll
C:\WINDOWS\system32\_003156_.tmp.dll
C:\WINDOWS\system32\_003158_.tmp.dll
C:\WINDOWS\system32\_003159_.tmp.dll
C:\WINDOWS\system32\_003161_.tmp.dll
C:\WINDOWS\system32\_003165_.tmp.dll
C:\WINDOWS\system32\_003166_.tmp.dll
C:\WINDOWS\system32\_003168_.tmp.dll
C:\WINDOWS\system32\_003171_.tmp.dll
C:\WINDOWS\system32\_003173_.tmp.dll
C:\WINDOWS\system32\_003174_.tmp.dll
C:\WINDOWS\system32\_003175_.tmp.dll
C:\WINDOWS\system32\_003176_.tmp.dll
C:\WINDOWS\system32\_003177_.tmp.dll
C:\WINDOWS\system32\_003180_.tmp.dll
C:\WINDOWS\system32\_003182_.tmp.dll
C:\WINDOWS\system32\_003183_.tmp.dll
C:\WINDOWS\system32\_003184_.tmp.dll
C:\WINDOWS\system32\_003188_.tmp.dll
C:\WINDOWS\system32\_003190_.tmp.dll

 

[Osiris]

C:\WINDOWS\system32\bkhm.dll
C:\WINDOWS\system32\drivers\core.sys
C:\WINDOWS\system32\pppatc~1
C:\WINDOWS\system32\scurit~1
C:\WINDOWS\system32\wtsisvit32.exe
C:\WINDOWS\altvxvm.dll
C:\WINDOWS\system32\ieso0.dll
C:\WINDOWS\system32\kxvo.exe
C:\WINDOWS\system\_sv_CMD_
C:\WINDOWS\system32\gzmrot-uninst.exe
C:\WINDOWS\system32\ninjaext-uninstall.exe
C:\WINDOWS\system32\rightonadz-uninst.exe
C:\WINDOWS\ufdata2000.log
C:\WINDOWS\System32\IE8Lq6cr.exe
C:\WINDOWS\System32\actived.dll
C:\smp.bat
C:\WINDOWS\dsaip32b.dll
C:\WINDOWS\system32\efeec.dll
C:\WINDOWS\system32\sbwltbxa.exe
C:\WINDOWS\system32\winfrun32.bin
C:\WINDOWS\didduid.ini
C:\WINDOWS\system32\L242F.tmp
C:\WINDOWS\system32\L854A.tmp
C:\WINDOWS\system32\LC08E.tmp
C:\WINDOWS\system32\LBD23.tmp
C:\WINDOWS\system32\L7C44.tmp
C:\FOUND.033
C:\FOUND.032
C:\FOUND.031
C:\FOUND.030
C:\FOUND.029
C:\FOUND.028
C:\FOUND.027
C:\FOUND.026
C:\WINDOWS\system32\KeenValueInstall_111.exe
C:\WINDOWS\SYSTEM32\adssite_sidebar.dll
C:\WINDOWS\SYSTEM32\adssite_sidebar_uninstall.exe
C:\WINDOWS\SYSTEM32\rightonadz-uninst.exe
C:\WINDOWS\system32\mskvtns.dll
C:\WINDOWS\system32\bronto.dll
C:\WINDOWS\system32\winter.exe
C:\WINDOWS\system32\proper.exe
C:\WINDOWS\Prefetch\AUTOS.EXE-00EEC60B.pf
C:\WINDOWS\SYSTEM32\WINTER.EXE
C:\WINDOWS\Prefetch\PROPER.EXE-20014A9C.pf
C:\WINDOWS\Prefetch\WINTER.EXE-38A8B44A.pf
C:\WINDOWS\system32\koos.exe
C:\WINDOWS\system32\kprof
C:\WINDOWS\system32\poof
C:\WINDOWS\dcxxygx.exe
C:\WINDOWS\system32\sol698.txt
C:\WINDOWS\Fonts\acrsecI.fon
C:\WINDOWS\system32\_000111_.tmp.dll
C:\WINDOWS\system32\abttabxt.dll
C:\WINDOWS\system32\aifvpipa.dll
C:\WINDOWS\system32\byxwuvw.dll
C:\WINDOWS\system32\ctqnyfoq.dll
C:\WINDOWS\system32\ctqnyfoq.dllbox
C:\WINDOWS\system32\ktrjueal.ini
C:\WINDOWS\system32\laeujrtk.dll
C:\WINDOWS\system32\ssttt.dll
C:\WINDOWS\system32\tttss.ini
C:\WINDOWS\system32\tttss.ini2
C:\WINDOWS\system32\winzlo32.dll
C:\WINDOWS\r-k.exe
C:\WINDOWS\gormet.dll
C:\WINDOWS\hdtip.dll
C:\WINDOWS\monhop.exe
C:\WINDOWS\pmkret.dll
C:\WINDOWS\werbet???.dll
C:\WINDOWS\msettings.ini
C:\Temp\1cb
C:\UGA6P
C:\WINDOWS\Casino.ico
C:\WINDOWS\Free Online Dating.ico
C:\WINDOWS\Spyware Remover.ico
C:\WINDOWS\system32\atmtd.dll
C:\WINDOWS\system32\atmtd.dll._
C:\WINDOWS\system32\f1
C:\WINDOWS\system32\h2
C:\WINDOWS\system32\lanmanwrk.exe
C:\WINDOWS\system32\m1
C:\WINDOWS\system32\qmopt.dll
C:\WINDOWS\system32\r2
C:\WINDOWS\uninstall_nmon.vbs
C:\WINDOWS\system32\ihhkj.bak2
C:\WINDOWS\system32\ihhkj.bak1
C:\WINDOWS\system32\ihhkj.ini
C:\WINDOWS\system32\.exe
C:\WINDOWS\system32\bszip.dll
C:\WINDOWS\system32\ldinfo.ldr
C:\WINDOWS\system32\msnav32.ax
C:\WINDOWS\system32\rtstv.bak1
C:\WINDOWS\system32\rtstv.bak2
C:\WINDOWS\system32\rtstv.ini
C:\WINDOWS\system32\vtstr.dll
C:\WINDOWS\uninst2.htm
C:\WINDOWS\unist1.htm
C:\WINDOWS\system32\kjjlm.ini
C:\WINDOWS\system32\mljjk.dll
C:\WINDOWS\a2V2aWEgZ3JpbWVz
C:\WINDOWS\system32\rtstv.tmp
C:\WINDOWS\system32\sfigdcdx.ini
C:\WINDOWS\system32\pnikvwnw.dll
C:\WINDOWS\system32\ihaqblxy.exe
C:\WINDOWS\system32\qnekbuqu.exe
C:\WINDOWS\system32\xdcdgifs.dll
C:\WINDOWS\system32\vtiukaew.dll
C:\WINDOWS\system32\cjomqgqh.exe
C:\WINDOWS\system32\ygigjgfi.exe
C:\WINDOWS\system32\nvwrdpdg.dll
C:\WINDOWS\system32\cgeprukg.dll
C:\WINDOWS\system32\ctnskqms.dll
C:\WINDOWS\system32\byxvtrq.dll
C:\WINDOWS\hg173.exe
C:\WINDOWS\df87173.e
C:\WINDOWS\io43mvuiw4kj.exe
C:\WINDOWS\system32\kjjlm.ini
C:\WINDOWS\system32\mljjk.dll
C:\WINDOWS\system32\piusiovn.dll
C:\WINDOWS\system32\ptefgoqu.ini
C:\WINDOWS\system32\sfigdcdx.tmp
C:\WINDOWS\system32\bnbenbus.ini
C:\WINDOWS\system32\uqogfetp.dll
C:\Temp\abW9
C:\WINDOWS\monhop.exe
C:\WINDOWS\appatc~1
C:\WINDOWS\b103.exe
C:\WINDOWS\b104.exe
C:\WINDOWS\b111.exe
C:\WINDOWS\b122.exe
C:\WINDOWS\b128.exe
C:\WINDOWS\b138.exe
C:\WINDOWS\b143.exe
C:\WINDOWS\b148.exe
C:\WINDOWS\b999.exe
C:\WINDOWS\crosof~1.net
C:\WINDOWS\ecurit~1
C:\WINDOWS\mcroso~1.net
C:\WINDOWS\rqwk
C:\WINDOWS\rqwk\rqwk.dat
C:\WINDOWS\rqwk\wu.exe
C:\WINDOWS\svchost.exe
C:\WINDOWS\system32\crosof~1.net
C:\WINDOWS\system32\f3PSSavr.scr
C:\WINDOWS\system32\mavnlsui.dll
C:\WINDOWS\system32\racle~1
C:\WINDOWS\system32\rwamvq.dll
C:\WINDOWS\system32\smbols~1
C:\WINDOWS\system32\tsuninst.exe
C:\WINDOWS\system32\version69ie7fix.dll
C:\WINDOWS\system32\winnb58.dll
C:\WINDOWS\system32\ystem3~1
C:\WINDOWS\TWVsYW5pZSBHZXplbC1SYW5nZWw\asappsrv.dll
C:\WINDOWS\TWVsYW5pZSBHZXplbC1SYW5nZWw\command.exe
C:\WINDOWS\wr.txt
C:\WINDOWS\00104run.ini
C:\WINDOWS\system32\sysdivx.dll
C:\Temp\abW9\tPho.log
C:\WINDOWS\dobe~1
C:\WINDOWS\dobe~1\?dobe
C:\WINDOWS\shell.exe
C:\WINDOWS\system32\buxioksj.ini
C:\WINDOWS\system32\c1
C:\WINDOWS\system32\ccnaxxop.exe
C:\WINDOWS\system32\cflfkhaw.dll
C:\WINDOWS\system32\cmiefxmi.dll
C:\WINDOWS\system32\cohxlpyc.exe
C:\WINDOWS\system32\dnpqiphi.exe
C:\WINDOWS\system32\emsfnekk.exe
C:\WINDOWS\system32\eqgdtnni.dll
C:\WINDOWS\system32\esowcgvt.exe
C:\WINDOWS\system32\fjtnvvxp.exe
C:\WINDOWS\system32\gaungwei.ini
C:\WINDOWS\system32\gptytqhv.dll
C:\WINDOWS\system32\hkeopole.dll
C:\WINDOWS\system32\hsdqphuw.exe
C:\WINDOWS\system32\iewgnuag.dll
C:\WINDOWS\system32\iveirjxj.dll
C:\WINDOWS\system32\iyfafcoq.exe
C:\WINDOWS\system32\j2
C:\WINDOWS\system32\j2\ppjup83122.exe
C:\WINDOWS\system32\jjkkj.bak1
C:\WINDOWS\system32\jjkkj.bak2
C:\WINDOWS\system32\jjkkj.ini
C:\WINDOWS\system32\jjkkj.ini2
C:\WINDOWS\system32\jjkkj.tmp
C:\WINDOWS\system32\jkkjj.dll
C:\WINDOWS\system32\jskoixub.dll
C:\WINDOWS\system32\khkuevaq.ini
C:\WINDOWS\system32\kwqwvgfb.dll
C:\WINDOWS\system32\lbbuwweo.dll
C:\WINDOWS\system32\lgiydgmn.dll
C:\WINDOWS\system32\lvixehjt.dll
C:\WINDOWS\system32\m8
C:\WINDOWS\system32\m8\nsts2dll1.exe
C:\WINDOWS\system32\nuiesgif.exe
C:\WINDOWS\system32\nyistnkk.exe
C:\WINDOWS\system32\ovesngnh.exe
C:\WINDOWS\system32\povexsqn.exe
C:\WINDOWS\system32\printer.exe
C:\WINDOWS\system32\qaveukhk.dll
C:\WINDOWS\system32\qushqxgg.exe
C:\WINDOWS\system32\rlojhocl.ex

 

[Osiris]

C:\WINDOWS\system32\rMa02yy
C:\WINDOWS\system32\sohwinsy.dll
C:\WINDOWS\system32\spoolvs.exe
C:\WINDOWS\system32\tjhexivl.ini
C:\WINDOWS\system32\towlhsbu.dll
C:\WINDOWS\system32\tpcwdoia\bg1.gif
C:\WINDOWS\system32\tpcwdoia\bgtop.gif
C:\WINDOWS\system32\tpcwdoia\bottom1.gif
C:\WINDOWS\system32\tpcwdoia\essentials.gif
C:\WINDOWS\system32\tpcwdoia\icon1.ico
C:\WINDOWS\system32\tpcwdoia\install1.gif
C:\WINDOWS\system32\tpcwdoia\left1.gif
C:\WINDOWS\system32\tpcwdoia\li.gif
C:\WINDOWS\system32\tpcwdoia\logo.gif
C:\WINDOWS\system32\tpcwdoia\main.htm
C:\WINDOWS\system32\tpcwdoia\mainframe.htm
C:\WINDOWS\system32\tpcwdoia\reinstall1.gif
C:\WINDOWS\system32\tpcwdoia\right1.gif
C:\WINDOWS\system32\tpcwdoia\s1.htm
C:\WINDOWS\system32\tpcwdoia\s2.htm
C:\WINDOWS\system32\tpcwdoia\s3.htm
C:\WINDOWS\system32\tpcwdoia\SMTop1.gif
C:\WINDOWS\system32\tpcwdoia\SMTop2.gif
C:\WINDOWS\system32\tpcwdoia\SMTop3.gif
C:\WINDOWS\system32\tpcwdoia\SMTop4.gif
C:\WINDOWS\system32\tpcwdoia\soft1_off.gif
C:\WINDOWS\system32\tpcwdoia\soft1_off_ext.gif
C:\WINDOWS\system32\tpcwdoia\soft1_on.gif
C:\WINDOWS\system32\tpcwdoia\soft1_on_ext.gif
C:\WINDOWS\system32\tpcwdoia\soft2_off.gif
C:\WINDOWS\system32\tpcwdoia\soft2_off_ext.gif
C:\WINDOWS\system32\tpcwdoia\soft2_on.gif
C:\WINDOWS\system32\tpcwdoia\soft2_on_ext.gif
C:\WINDOWS\system32\tpcwdoia\soft3_off.gif
C:\WINDOWS\system32\tpcwdoia\soft3_off_ext.gif
C:\WINDOWS\system32\tpcwdoia\soft3_on.gif
C:\WINDOWS\system32\tpcwdoia\soft3_on_ext.gif
C:\WINDOWS\system32\tpcwdoia\softbottom_off.gif
C:\WINDOWS\system32\tpcwdoia\softbottom_on.gif
C:\WINDOWS\system32\tpcwdoia\softleft_off.gif
C:\WINDOWS\system32\tpcwdoia\softleft_on.gif
C:\WINDOWS\system32\tpcwdoia\top1.gif
C:\WINDOWS\system32\tpcwdoia\top2.gif
C:\WINDOWS\system32\tpcwdoia\tpcwdoia1.exe
C:\WINDOWS\system32\tpcwdoia\tpcwdoia2.exe
C:\WINDOWS\system32\tpcwdoia\tpcwdoia3.exe
C:\WINDOWS\system32\tpcwdoia\turnoff1.gif
C:\WINDOWS\system32\tpcwdoia\turnon1.gif
C:\WINDOWS\system32\vawllrvf.dll
C:\WINDOWS\system32\xdbvigdj.dll
C:\WINDOWS\system32\yevcyhlk.exe
C:\WINDOWS\tk58.exe
C:\WINDOWS\TTC-4444.exe
C:\WINDOWS\system32\pbvfehbr.dll
C:\WINDOWS\system32\mxfcjwts.ini
C:\WINDOWS\system32\pjgnrapo.ini
C:\WINDOWS\system32\xmxunpds.ini
C:\WINDOWS\system32\cfwulrgu.ini
C:\WINDOWS\system32\uwdmlncc.ini
C:\WINDOWS\system32\DRWSJLAD.ocx
C:\WINDOWS\LJRGKDD9.ocx
C:\WINDOWS\tosOBEX.INI
C:\WINDOWS\df87173.exe
C:\WINDOWS\TWFydGluIE1pbm5pY2s\nqIVx35RKHYDvAcDsZP.vbs
C:\WINDOWS\system32\hgcessog.dll
C:\WINDOWS\system32\mpqss.ini
C:\WINDOWS\system32\mpqss.ini2
C:\WINDOWS\system32\qangazli.dllbox
C:\WINDOWS\system32\ssqpm.dll
C:\WINDOWS\system32\winrvc32.dll
C:\WINDOWS\system32\jmiloyjy.dll
C:\WINDOWS\system32\ccagoooy.ini
C:\WINDOWS\system32\qangazli.dll
C:\WINDOWS\system32\kckgeakb.dll
C:\WINDOWS\system32\mawyqoxj.dll
C:\WINDOWS\system32\nqgirmjw.ini
C:\WINDOWS\system32\qbxoqjvc.dll
C:\WINDOWS\system32\snjplmnm.dll
C:\WINDOWS\system32\glrxealt.dll
C:\WINDOWS\system32\aucweyxr.ini
C:\WINDOWS\system32\ltxpljfv.dll
C:\WINDOWS\system32\efhkkomb.dll
C:\WINDOWS\system32\fccyxuv.dll
C:\WINDOWS\system32\yooogacc.dll
C:\WINDOWS\system32\wjmrigqn.dll
C:\WINDOWS\system32\trrqrvfw.dll
C:\WINDOWS\system32\yayxvts.dll
C:\WINDOWS\system32\devenv.exe
C:\windows\system32\gebbaww.dll
C:\windows\system32\ljjkhge.dll
C:\WINDOWS\system32\tuvutst.dll
C:\WINDOWS\system32\npflmnvw.dll
C:\WINDOWS\system32\geedd.dll
C:\WINDOWS\17PHolmes572.exe
C:\WINDOWS\17PHolmes77.exe
C:\WINDOWS\system32\ddeeg.ini2
C:\WINDOWS\system32\snugnjtp.dll
C:\WINDOWS\system32\opilfasu.dll
C:\WINDOWS\system32\msanton.exe
C:\WINDOWS\xlracrx.exe
C:\Program Files\mbols~1
C:\WINDOWS\setup.exe
C:\WINDOWS\SYSTEM32\gjjlm.ini
C:\WINDOWS\system32\mljjg.dll
C:\WINDOWS\d3??.dll
C:\WINDOWS\ieyi.dll
C:\WINDOWS\System32\ijftc.dll

 

[Osiris]

These are known Program File locations

C:\Program Files\Need2Find\
C:\Program Files\RXToolBar\
C:\Program Files\Instafinder\
C:\Program Files\Qdr\
C:\Program Files\QdModule\
C:\Program Files\ISM\
C:\Program Files\SpyMaxx\
C:\Program Files\Files-Secure\
C:\Program Files\PC-Cleaner\
C:\Program Files\amsys\
C:\Program Files\e-zshopper\
C:\Program Files\p2pnetworks\
C:\Program Files\ISM2\
C:\Program Files\akl\
C:\Program Files\Common Files\WinAntiVirus Pro 2005\
C:\Program Files\Common Files\WinAntiVirus Pro 2006\
C:\Program Files\Common Files\WinAntiVirus Pro 2007\
C:\Program Files\Common Files\WinAntiVirus Pro 2008\
C:\Program Files\Common Files\WinAntiVirus Pro 2009\
C:\Programme\Common Files\WinAntiVirus Pro 2005\
C:\Programme\Common Files\WinAntiVirus Pro 2006\
C:\Programme\Common Files\WinAntiVirus Pro 2007\
C:\Programme\Common Files\WinAntiVirus Pro 2009\
C:\Program Files\WinAntiVirus Pro 2005\
C:\Program Files\WinAntiVirus Pro 2006\
C:\Program Files\WinAntiVirus Pro 2007\
C:\Program Files\WinAntiVirus Pro 2008\
C:\Program Files\WinAntiVirus Pro 2009\
c:\Programmer\WinAntivirus Pro 2005\
c:\Programmer\WinAntivirus Pro 2006\
c:\Programmer\WinAntivirus Pro 2007\
c:\Programmer\WinAntivirus Pro 2008\
c:\Programmer\WinAntivirus Pro 2009\
c:\Programme\WinAntivirus Pro 2005\
c:\Programme\WinAntivirus Pro 2006\
c:\Programme\WinAntivirus Pro 2007\
c:\Programme\WinAntivirus Pro 2008\
c:\Programme\WinAntivirus Pro 2009\
C:\Programme\Gemeinsame Dateien\WinAntiVirus Pro 2005\
C:\Programme\Gemeinsame Dateien\WinAntiVirus Pro 2006\
C:\Programme\Gemeinsame Dateien\WinAntiVirus Pro 2007\
C:\Programme\Gemeinsame Dateien\WinAntiVirus Pro 2008\
C:\Programme\Gemeinsame Dateien\WinAntiVirus Pro 2009\
C:\Program Files\MyWebSearch\
C:\Program Files\iSecurity\
C:\Program Files\Network Monitor\
C:\Program Files\Common Files\Real\
C:\Program Files\zango\
C:\Program Files\180searchassistant\
C:\Program Files\180search assistant\
C:\Program Files\stc\
C:\Program Files\180solutions\
C:\Program Files\Sysmnt\
C:\Program Files\Qdrive\
C:\Program Files\akl\
C:\Program Files\Inet Delivery\
C:\Program Files\AntiSpywareShield\
C:\Program Files\VirusRanger\
C:\Program Files\AdvancedCleaner\
C:\Program Files\Xingtone Ringtone Maker\
C:\Program Files\Morpheus\
C:\Program Files\ContextTool\
C:\Program Files\Bat\
C:\Program Files\QdrPack\
C:\Program Files\QdrModule\
C:\Program Files\Repair And Block\
C:\Program Files\SpyLocked 4.1\
C:\Program Files\Cool\
C:\Program Files\RichVideoCodec\
C:\965df19204e2947df33f38895dc965\
C:\cabf560512693b0cd2edc7\
C:\Program Files\Psdjvtoc\
C:\Program Files\AxBx\
C:\Program Files\video activex access\
C:\WINDOWS\system32\rMa02yy\
C:\Temp\abW9\
C:\WINDOWS\system32\Mz17r\
C:\Temp\mZOr\
C:\WINDOWS\system32\o09PrEz\
C:\WINDOWS\system32\tpcwdoia\
C:\WINDOWS\system32\smp\
C:\WINDOWS\system32\T3\
C:\WINDOWS\system32\T4\
C:\WINDOWS\system32\T6\
C:\WINDOWS\system32\T7\
C:\Program File\SystemDefender\
C:\Program Files\Video Add-on\
C:\ProgramData\ZangoSA\
C:\ProgramData\hmbetmli\