3rd February, 2007
New items - 355
- .nvsvcb - X - smssb.exe
- [3-4 random letters] - X - nslookup.exe
- _mzu_stonedrv7 - X - _mzu_stonedrv7.exe
- {2F-FF-F4-4C-ZN} - X - omdsregk.exe
- 1u7 - X - 1u7.exe
- A Verizon App - U - VERIZO~1.EXE
- acdllib3 - X - bcdlmem.exe
- aDir - X - adirss.exe
- AdobeReaderProfessional - X - msx64.exe
- ADS Adware Remover - N - ADS Adware Remover.exe
- Agent - X - alsys.exe
- agent - X - ppl.exe
- ahost - X - ahost.exe
- ALU Scheduler Service - N - ALUSchedulerSvc.exe
- AntiVerminser - N - AntiVerminser.exe
- AntiVir - X - scvhost.exe
- AntiVir - X - winlog.exe
- Anti-Virus - X - vpms.exe
- Antivirus-Golden - N - Antivirus-Golden.exe
- aol - Y - avp.exe
- ApplicationProtocolRun - X - smsbvl32.exe
- asrupdate.exe - X - asrupdate.exe
- ATI Active Graphics Card Monitor - X - atievx.exe
- ATI Display Driver - X - atixd.exe
- Ati Display Settings - X - atividx.exe
- ATI Video Driver Control - X - atigfx.exe
- au - U - DealioAu.exe
- auloadplx - X - mplprogsm.exe
- AutoSys - U - autosys.exe
- AVFX Engine - U - StartFX.exe
- Avg Antivirus - X - icpldrvx.exe
- avp - Y - avp.exe
- Beawver - X - saqevre.exe
- bikini - X - bikini.exe
- Boot - U - Boot.exe
- BraveSentry - N - BraveSentry.exe
- brwdiag - X - [path to worm]
- Call32 - X - Call32.exe
- Casino Royale - X - jamesbond.exe
- cctray - U - cctray.exe
- CdnCtr - X - cdnup.exe
- clipboard.exe - X - clipboard.exe
- cmonitor - N - startupmon.exe
- CmUCRRun - ? - CmUCReye.exe
- Cn911 - X - ODBCJET.exe
- Compaq Service Drivers - X - winsvc.exe
- ComStart - N - Trojan Guarder.exe
- Configuration - X - explorer32.exe
- control panel software service - X - cprs.exe
- cpanel - X - winlogin32.exe
- CPVHOST Settings - X - cpvhost.exe
- CRCSS - X - crcss.exe
- CreativeTaskScheduler - ? - CTSched.exe
- CRP386 Networking - X - crp386.exe
- CRSSXP SysInfo - X - crssxp.exe
- csvhost.exe - X - csvhost.exe
- ctpmon - X - ctpmon.exe
- CTSched - ? - CTSched.exe
- CTSyncU.exe - N - CTSyncU.exe
- cwingllib - X - atllsimm.exe
- Cyberhawk - U - CHTray.exe
- dabrun - X - rundll32.exe [path] dabapi.dll, Rundll32
- DC6_check - N - dc6_startupmon.exe
- dc6_check - N - dcmon.exe
- DC6_Check - N - uwasdc.exe
- Deko550 - U - Deko550.exe
- DELXP Protocol - X - delxp.exe
- Desktop - X - Run.dll
- Device Manager - X - wfxmgr.exe
- Digisoft AntiDialer - U - AntiDialer.exe
- DISCover - ? - DISCover.exe
- DIVX Video Player - X - DIVXPloyer.exe
- DJSNetCN - ? - DJSNetCN.exe
- DLPSP - U - DLPSP.EXE
- DNHelper32 - X - DNHlp32.exe
- DRam prosessor - X - plscd.exe
- dreams - X - server.exe
- DriveCleaner 2006 Free - N - UDC2006.exe
- dsd - X - zz.exe
- ecko - X - claro.exe
- EDxMC110 - X - Isass.exe
- EMMeter - U - EMMeter.exe
- ERS - X - ers_startupmon.exe
- ERS_check - X - ers_startupmon.exe
- erscw - X - erscw.exe
- ExFilter - X - Rundll32.exe [path] cdnspie.dll, ExecFilter
- Firewall auto setup - X - winlogon.exe
- FKS v2.0 - X - msngr.exe
- ftutil2 - U - rundll32.exe [path] ftutil2.dll, SetWriteCacheMode
- Generic Host Process for Win32 Service - X - svchost.exe
- Generic Host Process for Win32 Service - X - svlhost.exe
- Generic Host Process for Win32 Services - X - lspsvc.exe
- Generic Host Process for Win32 Services - X - SPSVC.EXE
- Generic Host Process for Win32 Services - X - svchost32.exe
- Generic Host Process for Win32 Services - X - svñhîst.exe
- GT - X - GT.EXE
- GURL - X - gurl.exe
- gwiz - X - ntsystem.exe
- hcsystray - N - hc_tray.exe
- hdlpscom - X - [8 random letters].exe
- HornetMonitor - U - MntrHrnt.exe
- hpcmd - X - cmd.exe
- hptools - X - hptools.exe
- hptools - X - microsoft.exe
- HTTP Tunneling Server - X - mstunnel.exe
- icq lite - X - scvhost.exe
- icq lite - X - winlog.exe
- IE-Bar - X - iebar.exe
- IExploer - X - svshosts.exe
- imwinsrvc - X - acpmonsrv.exe
- Instant Access - X - linewsrv.exe
- Instant Access - X - mwsrvacc.exe
- Intec Services Driverrs - X - winrvc.exe
- Intel Driver - X - csrs.exe
- Internet - X - winlogom.exe
- Internet download manager service - X - idman.exe
- InternetSpy - U - InternetSpy.exe
- ItalU - X - italfds.exe
- iTunes Music - X - iTunesHelper32.exe
- itunesff - X - itunesff.exe
- java-plugin - X - javasctp.exe
- JOYTECH USB Neo S Controller - U - JoytechNeoSTrayIcon.exe
- JVM0 - X - JVM0.exe
- JXL Radio - X - jxl.exe
- kav - Y - avp.exe
- KB926239 - Y - rundll32.exe [path] apphelp.dll, ShimFlushCache
- Kernel and Hardware Abstraction Layer - U - KHALMNPR.EXE
- Kgjg - X - rnnypbw.exe
- KIT3 - X - hpprintqueue.exe
- KN_PanelApp - U - PanelApp.exe
- Kryptel Component Start - U - Kicker.exe
- layersldm - X - hostplsrvc.exe
- LEMSRV - X - lemsrv.exe
- Lexmark_X79-55 - X - lsasss.exe
- Ljx - X - rundll32.exe
- LogitechCommunicationsManager - Y - communications_helper.exe
- LogitechQuickCamRibbon - N - quickcam10.exe
- Malware-Wipe - N - Malware-Wipe.exe
- MalwareWiped - N - MalwareWiped.exe
- MalwareWiper - N - MalwareWiper.exe
- Master Card Updaate 32 - X - Mastercard32.exe
- MediaLifeService - U - MediaLifeService.exe
- MedionVFD - ? - MdionLCM.exe
- Micosoft Data Core - X - runservice.exe
- Micrcsoft Certificate Services - X - cflmon.exe
- Micro CRC Protocol - X - scrc32.exe
- Micromedia Flash Update - X - xptxt.exe
- Microsft Security Monitor Process - X - cmh.exe
- Microsft Security Monitor Process - X - mssmppp.exe
- Microsoft - X - guard.exe
- Microsoft - X - lsass.ppf
- Microsoft - X - msvchost.exe
- Microsoft - X - ssmss.exe
- Microsoft - X - wcsntfy.exe
- Microsoft - X - wuauclt.exe
- Microsoft (R) Windows DLL Loader - X - rundll32.exe
- Microsoft (R) Windows Network Latency Controller - X - 1.tmp
- Microsoft (R) Windows Network Latency Controller - X - nlc.exe
- Microsoft (R) Windows Network Latency Controller - X - sp2vc.exe
- Microsoft (R) Windows Update Manager - X - updmgr.exe
- Microsoft ALGXP Protocol - X - alg32.exe
- Microsoft Auto Update - X - WINHLP16.EXE
- Microsoft auto update - X - wuauclt.exe
- Microsoft Configuration 35 - X - microsot1.exe
- Microsoft Corp SQL Certificates - X - sqlcer.exe
- Microsoft Corp TLS Certificates - X - msauth.exe
- Microsoft CPXP Protocol - X - cpxp.exe
- Microsoft Development Services - X - msdevelop.exe
- Microsoft dll Host Service - X - wkssr.exe
- Microsoft DLL Verifier - X - mscon.exe
- Microsoft Lsass Center - X - Isass.exe
- Microsoft Machine Script - X - iexplorersis.exe
- Microsoft Security Center - X - wcsntfy.exe
- Microsoft Security Management - X - bling.exe
- Microsoft Security Management - X - sp2fix.exe
- Microsoft Security Monitor Process - X - mssmp.exe
- Microsoft Server Applacations - X - cli.exe
- Microsoft Sounds - X - soundman.exe
- Microsoft Task32 Protocol - X - taskmgr32.exe
- Microsoft TTL Verifier - X - msttl.exe
- Microsoft Update - X - taskmgr32.exe
- Microsoft Update Machine - X - ntsystem.exe
- Microsoft Update Manager - X - scvideo.exe
- Microsoft Windows Services - X - msw32.exe
- Microsoft Windows Services Edt - X - dllrun32.exe
- Microsoft Windows Services Edt - X - ssvvcchhoosst.exe
- Microsoft Windows Socketx32 Services - X - winsockx32.exe
- Microsoft Windows Tasks Management - X - taskmng.exe
- Microsoft Windows Updata - X - windows.exe
- Microsoft Windows Update - X - srshost.exe
- Microsoft Windows Updates - X - wsap32.exe
- Microsoft WPCEmail - X - [path to trojan]
- MilShieldSlave - U - ShieldWorker.exe
- MP Tcloakss - X - mptclock.exe
- MP Tclockvv - X - mptclock.exe
- ms - X - svhost32.exe
- Ms configsu - X - msconfigsu.exe
- MS System Call Function - X - msscf32.exe
- Ms System Config - X - pcedit.exe
- MS Windows System Alert - X - MSWSA32.exe
- mschkdf.exe - X - mschkdf.exe
- msconfig - X - scvhost.exe
- msconfig - X - winlog.exe
- msiexecs.exe - X - msiexecs.exe
- msnmessenger - X - msnmessenger.exe
- msnnt - X - winampf.exe
- MSNPlus - X - msnplus.exe
- Mstask32driver - X - Mstask32.exe
- msvcc25 - X - salvage.exe
- mvsyswina - X - acsysiom.exe
- mxomssmenu - ? - maxmenumgr.exe
- Mysee Alert - X - Mysee Alert.exe
- mysvcig38 - X - recsl.exe
- ndlhosta - X - uiremsyl.exe
- NeroHomeFirstStart - U - NMFirstStart.exe
- NI.UWA6P_0001_N73M1004 - N - WinAntiVirusPro2006FreeInstall.exe
- NI.UWA6P_0001_N91M1807 - N - winantiviruspro2006freeinstall[1].exe
- NliaClient - U - Netpia.exe
- NMFirstStart - U - NMFirstStart.exe
- Nod32 Service - X - nod64.exe
- Nord - X - nordsys.exe
- np - X - upnp.exe
- ntx32 - X - ntx32.exe
- Numerical Xterm Agent - X - 0x32.exe
- Numerical Xterm Agents - X - 2x32.exe
- Numerical Xtermz Agent - X - 1x32.exe
- nvchost - X - winlogon.exe
- Octoshape Streaming Services - U - OctoshapeClient.exe
- Office Monitor - X - adv32.exe
- only23 - X - SCVHOST.exe
- PAS_Check - N - udcpas.exe
- Password Tracker Deluxe - U - PwTrkr.exe
- PCTVRemote - U - remoterm.exe
- PGQL - X - pgql.exe
- phc700 - U - vphc700.exe
- PHIME2004C - X - CTFMDN.exe
- PhraseExpress - U - phrase.exe
- PrevX - X - prevx.exe
- ProAntiVirus - X - ProAntiVirus.exe
- ProtocolDiskChk - X - svcvlw32.exe
- PSCastor - X - PSCastor.exe
- QQKAV - X - scvhsot.exe
- RavAv - X - AdobeR.exe
- RavAv - X - RavMon.exe
- RavAv - X - RavMonE.exe
- Recoveru systems - X - svchost.exe
- Replicator - U - PTReplicator.exe
- RichMedia - X - rundll32.exe [path] hbcast.dll, WaitWindows
- Roflcopteur - X - seman.exe
- Run Nintendo Wi-Fi USB Connector Registration Tool - U - NintendoWFCReg.exe
- run32 - X - run32dll.exe
- rzt - X - rundll32.exe
- scandskx.exe - X - scandskx.exe
- ScheduIr - X - msexploren.exe
- ScheduIr - X - shch.exe
- ScheduIr - X - svchst.exe
- ScheduIr - X - winagent.exe
- scrss - X - scrss.exe
- SDR6_Check - N - udcsdr.exe
- secure socket layer - X - wins32a.exe
- SecureOnlineAccountNumbers - U - SOAN.exe
- Security - X - WindowsSecurityUpdate.exe
- Service Drivers - X - MSNMEssenger.exe
- Services - X - iexplorer.exe
- Services - X - prosys32.exe
- Services - X - sysamp.exe
- ShadowUser Pro Edition - U - ShadowUser.exe
- ShowIcon_PNY_PNY Attaché - U - shwicon.exe
- SigmaTel Audio - N - setup.exe
- SiteAdvisor - U - SiteAdv.exe
- SkyTel - U - SkyTel.exe
- Slibe.com - U - Sliber.EXE
- Smart Touch - U - STouch.exe
- smodul - U - smodule.exe
- sndmi13 - U - vsndmi13.exe
- snvc - X - snvc.exe
- SoundMam - X - SVOHOST.exe
- SpyQuake2.com - N - Spy-Quake2.exe
- SSL Manager - X - amsnmsgs.exe
- Start Upping - X - spoolnt.exe
- startkey - X - explorer.exe
- startkey - X - furzi.exe
- startkey - X - krnl.exe
- startkey - X - royale.exe
- startkey - X - rtfmsv.exe
- startkey - X - scvhost.exe
- startkey - X - server.exe
- startkey - X - svchost32.exe
- startkey - X - win32i.exe
- startkey - X - winampXP.exe
- startkey - X - winlogin.exe
- Streamload Downloader - N - SlDB.exe
- Streamload Uploader - N - StreamMgr.exe
- svcshare - X - nvscv32.exe
- svcshare - X - spoclsv.exe
- svhoost - X - checksys.exe
- sysmini - X - sysmini.exe
- System - X - kernels1118.exe
- System - X - kernels8.exe
- System - X - kernels88.exe
- system - X - svcr.exe
- SYSTEM - X - windmupdr.exe
- System - X - wsscntfy.exe
- System Efficiency Monitor - X - msedit32.exe
- system spool - X - syspools.exe
- System Update - X - mssetupconf.exe
- System Update Application - X - msbuffer.exe
- system34.exe - X - system34.exe
- system43.exe - X - system43.exe
- System64 - X - inet.exe
- SystemDoctor 2006 Free - N - sd2006.exe
- SystemTools - X - kernels1118.exe
- SystemTools - X - kernels8.exe
- SystemTools - X - kernels88.exe
- systen32.exe - X - systen32.exe
- sysupdate - X - cmman32.exe
- sysvx - X - sysvx_.exe
- TCPServer - X - TCPServer.exe
- Tilerun - X - Tilecom32.com
- timestamp - X - timeapr32.exe
- ToolBoxFX - U - HPTLBXFX.exe
- Trojan Guarder Gold Version - N - Trojan Guarder.exe
- Tsklist - X - tsklist32.exe
- Ttt - X - Ttt.exe
- TURXP Protocol - X - sps32.exe
- UDC6cw - N - UDC6cw.exe
- udzok - X - udzou.exe
- Ultimate Cleaner - N - App.exe
- UltimateBuddy - X - UltimateBuddy.exe
- Updade Windows - X - winlogom.exe
- Update - X - Update.exe
- Update Checker - X - scvhost.exe
- Update Checker - X - winlog.exe
- UpdateService - X - wservice.exe
- updatewin - X - update.exe
- upnp - X - upnp.exe
- VC7Play - N - VC7Play.exe
- VC7Player - N - VC7Play.exe
- VerizonServicepoint.exe - U - VerizonServicepoint.exe
- Video Process - X - MStli32s.exe
- Virtual Protocol - X - vr32.exe
- VirusBurst - N - VirusBurst.exe
- Virus-Burst - N - Virus-Burst.exe
- VSP32 Controls - X - vsp32.exe
- wdfmgr32.exe - X - wdfmgr32.exe
- Webshots - U - WebshotsTray.exe
- wgeax - X - wgeax.exe
- whxpin service - X - ssvsol.exe
- WiFix service - X - [random filename]
- Win INI 32 - X - msrp32.exe
- Win Proxy32 Protocol - X - bsvtem.exe
- WIN_DRIVR32 - X - shchostv.exe
- Win32 - X - msnsrv.exe
- Win32 - X - winnnit.exe
- Win32 Update - X - svchosts.exe
Changed items - 95
- USBHWINFO ([path to trojan]) - Command changed
- .protected (N/A) - Description changed
- Alchem (Alchem.exe) - Description changed
- AlcxMonitor (Alcxmntr.exe) - Description changed
- AlwaysReady Power Message APP (ARPWRMSG.EXE) - Description changed
- Application (mdmsetsp.exe) - Description changed
- ARPWRMSG (ARPWRMSG.EXE) - Description changed
- ATI AS Filter (msnse.exe) - Description changed
- AUNPS2 (RUNDLL32 AUNPS2.DLL, _Run@16) - Description changed
- BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} (NMBgMonitor.exe) - Description changed
- boot (boot.exe) - Description changed
- ControlPanel ([path] cmd32.exe internat.dll, LoadKeyboardProfile) - Description changed
- DNS (mc-110-12-0000079.exe) - Description changed
- DNS (mc-58-12-0000080.exe) - Description changed
- DNS (mc-58-12-0000093.exe) - Description changed
- DNS (mc-58-12-0000120.exe) - Description changed
- DNS (mc-58-12-0000140.exe) - Description changed
- empin (e121307.exe) - Description changed
- empin (e121307.Stub.exe) - Description changed
- internat.exe (internat.exe) - Description changed
- Internat.exe (internat.exe) - Description changed
- laltin (L90112201.Stub.exe) - Description changed
- LinkSys Wireless-G Notebook Adapter driver (Gcc.exe) - Description changed
- Messanger (trillian.exe) - Description changed
- Microsoft Security Management (winamp.exe) - Description changed
- Microsoft Security Manager (winamp.exe) - Description changed
- Microsoft Update (winamp.exe) - Description changed
- MS management console (mms.exe) - Description changed
- My Web Search Bar (MWSBAR.DLL) - Description changed
- mysvcig38 (mysvcc.exe) - Description changed
- nsvcin (n20050308.exe) - Description changed
- ntdll.dll (TrustCleaner.exe) - Description changed
- ntechin (n20050308.exe) - Description changed
- scain (s030109.Stub.exe) - Description changed
- SpybotSD TeaTimer (TeaTimer.exe) - Description changed
- SuperBar.Component (services.exe) - Description changed
- Taskmon driver (winampa.exe) - Description changed
- Trust Cleaner (TrustCleaner.exe) - Description changed
- tsvcin (n20050308.exe) - Description changed
- useful-soft (svchst.exe) - Description changed
- vidmon (VIDMON.EXE) - Description changed
- Win l5oahder (winampa.exe) - Description changed
- Win WinAmp (winamp.exe) - Description changed
- Winamp (winamp.exe) - Description changed
- Winamp (winamp.exe) - Description changed
- Winamp Agent (winamp.exe) - Description changed
- Winampa (WINAMPa.exe) - Description changed
- Winampa (winampa.exe) - Description changed
- Winampa Agent (WINAMPA.EXE) - Description changed
- WinampAgent (WINAMPa.exe) - Description changed
- WindowsRegKey update ([random filename]) - Description changed
- WinDSNX (Win????.exe) - Description changed
- WinFast Schedule (Wfwiz.exe) - Description changed
- WQK (WQK.exe) - Description changed
- abtu (lopsearch.exe) - Hyperlink changed
- Global Startup (WinDash.EXE) - Hyperlink changed
- Microsoft Help (svh0st.exe) - Hyperlink changed
- nTune (nTune.exe) - Hyperlink changed
- NVIDIA nTune (nTune.exe) - Hyperlink changed
- PopUpStopperFreeEdition (PSFREE.EXE) - Hyperlink changed
- RP32 (rp32.exe) - Hyperlink changed
- Systems Restart (Rundll32.exe zolk.dll, DllRegisterServer) - Hyperlink changed
- Error Safe (ers.exe) - Hyperlink and description changed
- microsoft hotmail monitor (mshotmon.exe) - Hyperlink and description changed
- mysvcig38 (mysvcc.exe) - Hyperlink and description changed
- NI.UERSM_0001_N68M1602 (UERSM_0001_N68M1602NetInstaller.exe) - Hyperlink and description changed
- WHVLXD (WHVLXD.exe) - Hyperlink and description changed
- ERUNT AutoBackup (AUTOBACK.EXE) - Name changed
- Microsoft (R) Windows Network Security Management Service (nsms.exe) - Name changed
- Microsoft (R) Windows Protected Content Restoration Service (services.exe) - Name changed
- Microsoft (R) Windows TCP/IP Socket Driver ([path to trojan]) - Name changed
- Microsoft (R) Windows Update Service (wuauclt.exe) - Name changed
- Microsoft (R) Windows Vista/NT Runtime Compatibility Service (nrcs.exe) - Name changed
- wintnl.exe (wintnl.exe) - Name changed
- Microsoft (R) Windows Configuration Backup Service (svchost.exe) - Name, hyperlink and description changed
- BrowseProxy (FindService.exe) - Status (X) changed
- PeerGuardian (PeerGuardian_1.99b_pr14.exe) - Status (U) changed
- Spool (wys.exe) - Status (X) changed
- SSPY (SSYTEM.EXE) - Status (U) changed
- CallBumping (cbpopw.exe) - Status (Y) and description changed
- HPBootOp (HPBootOp.exe) - Status (U) and description changed
- LVCOMSX (LVCOMSX.EXE) - Status (N) and description changed
- NBKeyScan (NBKeyScan.exe) - Status (U) and description changed
- NMBgMonitor (NMBgMonitor.exe) - Status (U) and description changed
- nwiz (nwiz.exe) - Status (U) and description changed
- Spykiller (Spykiller.exe) - Status (U) and description changed
- Spyware Begone (freescan.exe) - Status (U) and description changed
- Spyware Begone (SpywareBeGone.exe) - Status (U) and description changed
- Spyware Vanisher (FreeScanner.exe) - Status (U) and description changed
- TSkrMain (TSkrMain.exe) - Status (U) and description changed
- VC6play (VC6Play.exe) - Status (N) and description changed
- ipTray.exe (iptray.exe) - Status (N), hyperlink and description changed
- Microangelo Desktop (muamgr.exe) - Status (N), hyperlink and description changed
- MOD (muamgr.exe) - Status (N), hyperlink and description changed
- muamgr (muamgr.exe) - Status (N), hyperlink and description changed
Removed - 10
- )Start Service - U - upssrv.exe
- [default] - X - llsass.exe
- Auto updat - X - crsrs.exe
- HP software update - N - HPWuSchd2.exe
- Microsoft Update - X - winamp.exe
- MOD - N - muamger.exe
- mousedrv - X - mousedrv.exe
- MyVitalAgent - U - VtlAgent.exe
- recguard - ? - recguard.exe
- wintnl.exe - X - wintnl.exe
Other
- Revised the keylogger entries
- Corrected hundreds of other "moved" or "broken" links