Global Search

Not sure what a file is? Sort through the possibilities with a quick search of all of the lists.
Or get more accurate results by browsing and searching by list.
CLSID List Results
BHOs, Toolbars, SHs, Explorer Bars

CLSID Name Filename Description Status
{7FFBBA7A-4237-40A2-9FF0-E600A34AA000}Microsoft.SupportCenter 0Windows-LEIC.SCenter, Windows-****.SCenterKeylogger, detected by Kaspersky antivirus as Trojan-Downloader.Win32.BHO.dw and by AntiVir as TR/Spy.Agen.35328.BX BHO
{0B56B5C3-3D91-4E1D-A234-EB1068624EDA}Microsoft.WirelessNetworks 0Windows-BETE.wirellesn, Windows-****.wirellesnKeylogger, detected by Kaspersky antivirus as Trojan-Downloader.Win32.BHO.dw and by AntiVir as TR/Spy.Agen.35328.BX BHO
{36DBC179-A19F-48F2-B16A-6A3E19B42A87}(no name)systeminfo.dll, rundll32.dll, esentutl.dll, tskill.dll, odbcad32.dll, winver.dll, rasdial.dll, setup.dll, spoolsv.dll, finger.dll, charmap.dll, runonce.dll, scardsvr.dll, winspool.dll, any filename taken at random from the System or System32 folderPassword stealer trojan, detected by Symantec as Infostealer.Bzup.BX BHO
{I1OP5NK3-GKJ1-JP60-6R7Y-Y2Y80P2UWBA3}(no name)windows player.exeInfostealer trojan, see hereX BHO
{051276BF-A27E-4C90-8950-E1C6B1141047}windows sidebarwindows-sidebar.dll, WINDOW~1.DLLParasite of Korean origin hailing from winsidebar.net and detected as Win32.Spyware.windowssidebarX BHO

Startup List Results
Startup Entry

Name Filename Description Status
ctfmonctfmon.exeAdded by the Troj/SDBot-06 Trojan! which allows a remote user to access and control the computer via IRC channels. Note: Located in \%WINDIR%\ Note: Do not confuse with the MS Office file of the same name as described hereX
ctfmonctfmon.exeAdded by the Worm.Win32.AutoRun.ctz Note: Located in \%WINDIR%\ Note: Do not remove the legitimate ctfmon.exe file which is always found in \%WINDIR%\%System%\X
SetUpctfmon.exeAdded by the Trojan.Win32.Pasta.fuw Note: Located in \%Program Files%\Windows NT\X
MsWerrctfmon.dllAdded by the W32.Virut.CF VIRUT! Note: Located in \%WINDIR%\%System%\X
Firewallctfmon.exeAdded by a variant of the IRCBOT Note: Located in \%WINDIR%\ Note: Use SDFix under supervision. Not to be confused by the original file in \%WINDIR%\%SYSTEM%\ folder.X

O20 List Results
AppInit_DLLs & Winlogon Notify

Name Filename Description Status
st3C:\WINDOWS\system32\st3.dllTrojanDownloader.Delf.NBHX Winlogon Notify
sunotifyWINDOWS\SYSTEM32\sunotify.dllShadowUser_Pro - Create a virtual copy of your system for private and safe Web surfing.L Winlogon Notify
(no name)Windows\System32\vsmvhk.dll folder in (XP)ShadowUser_Pro - Create a virtual copy of your system for private and safe Web surfing.L AppInit_DLLs
welcome[random].dll ins System32 directorySpyware.Look2MeX Winlogon Notify
winnt32%SYSDIR%\SYSTEM32\WinNt32.dllW32/Mutant.XE!tr.dldrX Winlogon Notify

O21 List Results
ShellServiceObjectDelayLoad

CLSID Name Filename Description Status
{1DBD6574-D6D0-4782-94C3-69619E719765}(no name)%WINDOWS%\help\B41346EFA848.dllTroj/Lineag-FCX
{BCBCD383-3E06-11D3-91A9-00C04F68105C}AUHookC:\WINDOWS\SYSTEM\AUHOOK.DLLWindows ME Microsoft AutoUpdateL
{********-****-****-****-************}System%SYSDIR%\system32.dllCWS variant (Greatsearch)X
{7849596a-48ea-486e-8937-a2a3009f31a9}PostBootReminder%SystemRoot%\system32\SHELL32.dllMicrosoft WindowsL
{fbeb8a05-beee-4442-804e-409d6c4515e9}CDBurn%SystemRoot%\system32\SHELL32.dllMicrosoft WindowsL
O22 List Results
Shared Task Scheduler

CLSID Name Filename Description Status
{3F143C3A-1457-6CCA-03A7-7AA23B61E40F}(no name)c:\windows\system32\mtwirl32.dllCWSChroniclesX
O23 List Results
Windows Services

Name Filename Description Status
Alternative User Input Services (Ctfmon)ctfmon.exeAdded by the W32/Tilebot-JR WORM! Note: This worm is located in C:\%WINDIR%\ Note: NoteThis is not the cftmon.exe normally found in C:\WINDOWS\System32\X
LPTRDC server (LPTRDCsrv)ctfmon.exeIdentified as TrojanDownloader:Win32/Fourta.A Malware Note: located in \%WINDIR%\ Note: Use SDFix under supervision.X
Windows CTF Loaderctfmon.exeW32/Sdbot-DFSCopies itself to %Windows% directoryX
Microsoft CTF Loaderctfmon.exeCTF LoaderL
WindowsFirewallsystem32.exeAdded by a variant of the IRCBOT Note: Located in \%WINDIR%\ Note: Use SDFix under supervision.X

O16 List Results
ActiveX

CLSID Name Filename Description Status
{CAFEEFAC-0014-0002-0001-ABCDEFFEDCBA}DPFjinstall-142-windows-i586.cabRelated to an old version of Sun Microsystems Java Software. For your Security you are urged to update your version. Sun Java update site?
{CAFEEFAC-0014-0001-0000-ABCDEFFEDCBA}DPFjinstall-14-windows-i586.cabRelated to an old version of Sun Microsystems Java Software. For your Security you are urged to update your version. http://www.java.com/en/download/installed.jsp?
{CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA}Java Plug-in 1.4.2_03jinstall-windows-i586.cabRelated to an old version of Sun Microsystems Java Software. For your Security you are urged to update your version. Sun Java update site?
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}Java Plug-in *.*.*_**jinstall-*_*_*_**-windows-i586.cabCould be related to an old version of Sun Microsystems Java Software. For your Security you are urged to check and update your version if required. Verify Java Version?
{8AD9C840-044E-11D1-B3E9-00805F499D93}DPFjinstall-*_*_*_**-windows-i586.cabCould be related to an old version of Sun Microsystems Java Software. For your Security you are urged to check and update your version if required. Verify Java Version?

SEH List Results
ShellExecuteHook

CLSID Name Filename Description Status
{E60A0B68-AF3A-C1D2-CD09-5A81A136D2BA}(no name)%WINDIR%\SYSTEM32\sonj32drv.dllInfostealer trojan, dropper detected by Kaspersky antivirus as Trojan-GameThief.Win32.OnLineGames.aiky - also see hereX
{091EB208-39DD-417D-A5DD-7E2C2D8FB9CB}Microsoft AntiMalware ShellExecuteHookWindows Defender\MpShHook.dllWindows DefenderL
{AEB6717E-7E19-11d0-97EE-00C04FD91974}(no name)%SYSDIR%\windows.dll, winforms.dllTSPY_ONLINEG.IOT trojanX
{ACC52793-08DC-42BB-99AB-F70FD2A7E244}??- SEApproved%PROGRAMFILES%\Windows???\WinCipShe
ll.dll
Infostealer trojan, see hereX
{56F9679E-7826-4C84-81F3-532071A8BCC5}Windows Desktop Search Namespace Manager%ProgramFiles%\Windows Desktop Search\MSNLNamespaceMgr.dllWindows Desktop SearchL

Drivers List Results
Driver Entry

Name Filename Description Status
System Servicectfmon.exeInfostealer trojan, detected by ESET's Nod32 antivirus as a variant of Win32/PSW.OnLineGames.PSKX
Hp.Skyroom.Windows.ServiceHp.Skyroom.Windows.Service.exeRelated to Hp.Skyroom.Windows.Service.exe HP SkyRoom service from Hewlett-PackardL
Windows RemoteHelp DeskWindows RemoteHelp Desk.DLLAdded by the Windows RemoteHelp Desk.DLL Infostealer trojan, detected by ESET's Nod32 antivirus as a variant of Win32/Korplug.J Note: Located in \%AppData%\X
FF Extensions List Results
Firefox Extension

CLSID Name Filename Description Status
Humanity@WindowsHumanityHumanity@Windows.xpiHumanity from WinTango Patcher - Theme with Humanity Icons. Additional customizations via Humanity Extras extension. See also other WinTango themes.L
web2pdfextension.17@acrobat.adobe.comweb2pdfextension.17@acrobat
.adobe.com
adobe_acrobat-1.0-windows.xpiRelated to adobe.com web2pdfextension.L
Elementary-Extras@WindowsElementary ExtrasElementary-Extras@Windows.xpiElementary Extras - Additional customizations for Elementary theme.L
Gnome-Extras@WindowsGnome ExtrasGnome-Extras@Windows.xpiGnome Extras - Additional customizations for Gnome theme.L
Cheser-Extras@WindowsCheser ExtrasCheser-Extras@Windows.xpiCheser Extras - Additional customizations for Cheser theme.L

Active Setup List Results
Active Setup - Installed Component

CLSID Name Filename Description Status
{003M185M-XA30-WYI2-3PNK-YXN35127018N}(no name)ctfmon.exe Infostealer trojan, see hereX
{7N365172-32M6-8LL2-XRW7-EF733H5H8722}(no name)ctfmon.exeInfostealer trojan, see hereX
{F5776D81-AE53-4935-8E84-B0B284D4BCEF}(no name)ctfmon.exeInfostealer trojan, detected by Sophos as Troj/Insidoor-AX
{7A4Q2V25-7CXG-D2RT-6C77-166PLA7SA7Y7}(no name)ctfmon.exeInfostealer trojan, detected by Kaspersky antivirus as Trojan.Win32.Jorik.Llac.ajd, see this ThreatExpert ReportX
{43GQRV6F-35TO-2VGB-GLJ7-L5LBTK7YQ187}(no name)ctfmon.exe Infostealer trojan, detected by Microsoft as Backdoor:Win32/Xtrat.A - also see hereX

Powered by SystemLookup Engine. © 2008-2018 BrightFort. All Rights Reserved. | Privacy Policy | Terms of Use