HJTS MDO list

HJTS MDO list

ALL  PP  F0  F1  F2  F3  R0  R1  N1  N2  N3  N4  O1  O2  O3  O4  O5  O6  O7  O8
O9  O10  O11  O12  O13  O14  O15  O16  O17  O18  O19  O20  O21  O22  O23

Showing entries 1 to 25 of 90.
Go directly to page: 1  2  3  4

(X)F2 - REG:system.ini: Shell=%AppData%\CCenter\sp.exe
Rogue, a Control Center clone called Privacy Center
http://www.threatexpert.com/report.aspx?md5=234fad4266e924fdceff5ebbd1e08ec6
Windows: ALL; discoverer: nasdaq (Edit)

(U)F2 - REG:system.ini: Shell=C:\Aston\aston.exe ,svchost.exe
Shell for windows from Gladiators software
http://www.astonshell.com/
Windows: ALL; discoverer: nasdaq (Edit)

(U)F2 - REG:system.ini: Shell=Explorer.exe
Set by user
Windows: ALL; discoverer: nasdaq (Edit)

(X)F2 - REG:system.ini: Shell=explorer.exe "C:\WINDOWS\Fonts\wmsncs.exe"
Added by the TROJ_BBJC.A TROJAN!
Fix using: HJT - Use SDFix under supervision.
http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=TROJ_BBJC.A&VSect=T
Windows: ALL; discoverer: nasdaq (Edit)

(X)F2 - REG:system.ini: Shell=Explorer.exe %WINDIR%\system32\drivers\btwdins.exe
Malware
Fix using: HJT - Use SDFix under supervision.
Windows: ALL; discoverer: nasdaq (Edit)

(X)F2 - REG:system.ini: Shell=Explorer.exe %windir%\system32\drivers\Regv.exe
W32/Sdbot-DOR
Fix using: Delete the file regv.exe
http://www.sophos.com/security/analyses/viruses-and-spyware/w32sdbotdor.html
Windows: ALL; discoverer: nasdaq (Edit)

(X)F2 - REG:system.ini: Shell=Explorer.exe %windir%\system32\drivers\SbCtri.exe
Cloaked Malware
Fix using: Hijackthis
http://www.prevx.com/filenames/2628306822949957253-X1/SBCTRI2EEXE.html
Windows: ALL; discoverer: nasdaq (Edit)

(X)F2 - REG:system.ini: Shell=Explorer.exe %windir%\system32\drivers\SCtri.exe
SCtri.exe identified as TR/Dropper.Gen WORM/SdBot by Avira
Fix using: Hijackthis
Windows: ALL; discoverer: nasdaq (Edit)

(X)F2 - REG:system.ini: Shell=Explorer.exe %WINDIR%\system32\drivers\wuact.exe
Added by the Win32.Worm.Slenfbot.BT
Fix using: HJT - Use SDFix under supervision.
Windows: ALL; discoverer: nasdaq (Edit)

(X)F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Config\csrss.exe
Unidentified malware. The good csrss.exe file should be in C:\WINDOWS\System32\
Fix using: HijackThis
Windows: ALL; discoverer: nasdaq (Edit)

(X)F2 - REG:system.ini: Shell=explorer.exe C:\WINDOWS\system32\ntload.exe.
Advanced Security Tool 2010 rogue anti-spyware program.
Fix using: HijackThis
http://www.bleepingcomputer.com/startups/ntload.exe-26070.html
Windows: ALL; discoverer: nasdaq (Edit)

(X)F2 - REG:system.ini: Shell=Explorer.exe rundll32.exe cpcp.cpo bef0regiiav
Unidentified TROJAN!
Windows: ALL; discoverer: nasdaq (Edit)

(X)F2 - REG:system.ini: Shell=Explorer.exe rundll32.exe jyku.fjo hvttt
Unidentified malware.
Fix using: HijackThis
Windows: ALL; discoverer: nasdaq (Edit)

(X)F2 - REG:system.ini: Shell=Explorer.exe rundll32.exe nnfj.tqo nhemkk
Bredolab.gen.o Trojan!
Fix using: HijackThis
http://vil.nai.com/vil/content/v_253732.htm
Windows: ALL; discoverer: nasdaq (Edit)

(X)F2 - REG:system.ini: Shell=Explorer.exe rundll32.exe tapi.nfo beforeglav
Trojan-Downloader.Win32.Small.alyl
Fix using: HijackThis and delete the file %System%\tapi.nfo
http://www.threatexpert.com/report.aspx?md5=7f67037b73c3acca4d5d415bb6e95d06
Windows: ALL; discoverer: nasdaq (Edit)

(X)F2 - REG:system.ini: Shell=Explorer.exe rundll32.exe tftp.nfo beforegllav
Troj/Frink-Gen
Fix using: Delete te file tftp.nfo
http://www.threatexpert.com/report.aspx?md5=5a4658bd0b2f259c0fbb637b68fd5d6d
Windows: ALL; discoverer: nasdaq (Edit)

(X)F2 - REG:system.ini: Shell=Explorer.exe rundll32.exe utbx.teo ehkjqx
Trojan.Dropper/Win-NV
Fix using: Hijackthis - Delete this file utbx.teo
http://www.superantispyware.com/malwarefiles/UTBX.TEO.html
Windows: ALL; discoverer: nasdaq (Edit)

(X)F2 - REG:system.ini: Shell=explorer.exe Servicess.exe
Worm.IM.Sohanad
Fix using: Use SDFix under supervision
http://www.scanforfree.com/10/worm-im-sohanad-removal.htm
Windows: ALL; discoverer: nasdaq (Edit)

(X)F2 - REG:system.ini: Shell=Explorer.exe svchostw.exe
Trojan/Backdoor
Fix using: HijackThis
http://www.greatis.com/appdata/d/s/svchostw.exe.htm
Windows: ALL; discoverer: nasdaq (Edit)

(X)F2 - REG:system.ini: Shell=Explorer.exe Win-boot.EXE
Worm.Autoit [Ikarus]
Fix using: Hijackthis
http://www.threatexpert.com/report.aspx?md5=0423f26fb871f0ab26e4ee180f0b464b
Windows: ALL; discoverer: nasdaq (Edit)

(L)F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\KUsrInit.exe,
Related to KACE Networks, Inc.
http://www.kace.com/
Windows: ALL; discoverer: nasdaq (Edit)

(L)F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe
Unless modified by malware the userinit.exe file is your boot setup.
Windows: ALL; discoverer: nasdaq (Edit)

(X)F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,"C:\Program Files\Def Group\PC Defender\Antispyware.exe"
PC Defender rogue anti-spyware program
Fix using: Malwarebytes
http://www.bleepingcomputer.com/virus-removal/remove-pc-defender
Windows: ALL; discoverer: nasdaq (Edit)

(L)F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,"C:\Program Files\Softricity\SoftGrid for Windows Desktops\sftdcc.exe"
Related to Microsoft's SoftGrid for Windows Desktops
http://www.microsoft.com/systemcenter/softgrid/default.mspx
Windows: ALL; discoverer: nasdaq (Edit)

(L)F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,,C:\LDCLIENT\SOFTMON.EXE,C:\LDCLIENT\SDISTHK.EXE
Related to LANDesk® Management Agent
http://www.superadblocker.com/S/SOFTMON.EXE-1047.html
Windows: ALL; discoverer: nasdaq (Edit)

This is a list of items that is designed to help with the analysis of HijackThis logs. It is by no means exhaustive (in fact it is being added to all the time), and is not designed to replace any existing list elsewhere on the Internet. Rather, this list is designed to complement those other lists.