Top 10 virus alerts

Testimonials

Matt,

Thanks so much for your help. For now, this seemed to have solved the problem and found all the infected files. I'll keep you updated, as I know this virus can be very hard to kill.

Thanks a million.

Jason

More ...

DlWreck

Aliases of DlWreck (AKA):

[Kaspersky] Trojan-Downlaoder.Win32.Agent.aoa, Trojan-Downloader.Win32.Vidlo.y, Trojan.Win32.Pakes, Trojan-Downloader.Win32.Nurech.f, Trojan-Downloader.Win32.Nurech.i, Trojan-Downloader.Win32.Nurech.z, Trojan-Downlaoder.Win32.Nurech.w, Trojan-Downloader.Win32.Agent.ann, Trojan-Downloader.Win32.Agent.bhc, Trojan-Downloader.Win32.Nurech.ar, Trojan-Downloader.Win32.Nurech.az, Trojan-Downloader.Win32.Nurech.bf, Trojan-Downloader.Win32.Nurech.bk, Trojan-Downloader.Win32.Nurech.bt
[McAfee] Downladoer-AAP, Downloader-AAP, Downloader-AAp, Downlaoder-AAP
[Other] Win32/DlWreck.AI, Downlaoder, Backdoor.Trojan, Win32/DlWreck.V, Troj/Vidlo-C, Win32/DlWreck.AD, Win32/DlWreck.AV, Trojan.Schoeberl.D, Win32/DlWreck.AX, Downloader, Win32/DlWreck.BE, Win32/DlWreck.BC, Win32/DlWreck.BG, Trojan.Schoebert.E, Win32/DlWreck.BL, Win32/DlWreck.BM, Win32/DlWreck.BP, Win32/DlWreck.BR, Win32/DlWreck.BU, Win32/DlWreck.CI, Troj/DwnLdr-GWQ

How to Remove DlWreck from Your Computer

To completely purge DlWreck from your computer, you need to delete the files, folders, and Windows registry keys, and registry values associated with DlWreck. These files, folders, and registry keys are respectively listed in the Files, Folders, Registry Keys, and Registry Values sections on this page.

For instructions on deleting the DlWreck registry keys and registry values, see How to Remove DlWreck from the Windows Registry.

For instructions on deleting the DlWreck files and folders,
see How to Delete DlWreck Files (.exe, .dll, etc.)

How to Delete DlWreck Files (.exe, .dll, etc.)

The files and folders associated with DlWreck are listed in the Files and Folders sections on this page.

To delete the DlWreck files and folders:

Using your file explorer, browse to each file and folder listed in the Folders and Files sections.
Note: The paths use certain conventions such as [%PROGRAM_FILES%]. These conventions are explained here.
Select the file or folder and press SHIFT+Delete on the keyboard.
Click Yes in the confirm deletion dialog box.

IMPORTANT: If a file is locked (in use by some application), its deletion will fail (the Windows will display a corresponding message).You can delete such locked files with the RemoveOnReboot utility. To delete a locked file, right-click on the file, select Send To->Remove on Next Reboot on the menu, and restart your computer. You can install the RemoveOnReboot utility from here.

Files:

[%SYSTEM%]\drivers\acge.dt
[%SYSTEM%]\drivers\c656.tx
[%SYSTEM%]\drivers\onud.dat
[%SYSTEM%]\drivers\qas.tx
[%SYSTEM%]\drivers\winut.dat
[%SYSTEM%]\iasx.exe
[%SYSTEM%]\ipcbt.exe
[%SYSTEM%]\ipf.exe
[%SYSTEM%]\iptb.exe
[%SYSTEM%]\isca.exe
[%SYSTEM%]\isxa.exe

view mapping details

Scan your File System for DlWreck

How to Remove DlWreck from the Windows Registry

The Windows registry stores important system information such as system preferences, user settings, and installed programs details as well as the information about the applications that are automatically run at start-up. Because of this, spyware, malware, and adware often store references to their own files in your Windows registry so that they can automatically launch every time you start up your computer.

To effectively remove DlWreck from your Windows registry, you must delete all the registry keys and values associated with DlWreck, which are listed in the Registry Keys and Registry Values sections on this page.

IMPORTANT: Because the registry is a core component of your Windows system, it is strongly recommended that you back up the registry before you begin deleting keys and values. For information about backing up the Windows registry, refer to the Registry Editor online help.

To remove the DlWreck registry keys and values:

On the Windows Start menu, click Run.
In the Open box, type regedit and click OK.
The Registry Editor window opens. This window consists of two panes. The left pane displays folders that represent the registry keys arranged in hierarchical order. The right one lists the registry values of the currently selected registry key.
To delete each registry key listed in the Registry Keys section, do the following:
- Locate the key in the left pane of the Registry Editor window by sequentially expanding the folders according to the path indicated in the Registry Keys section. For example, if the path of a registry key is HKEY_LOCAL_MACHINE\software\FolderA\FolderB\KeyName1, sequentially expand the HKEY_LOCAL_MACHINE, software, FolderA, and FolderB folders.
- Select the key name indicated at the end of the path (KeyName1 in the example above).
- Right-click the key name and select Delete on the menu.
- Click Yes in the Confirm Key Delete dialog box.
To delete each registry value listed in the Registry Values section, do the following:
- Display the value in the right pane of the Registry Editor window by sequentially expanding the folders in the left pane according to the path indicated in the Registry Values section and selecting the specified key name. For example, if the path of a registry value is HKEY_LOCAL_MACHINE\software\FolderA\FolderB\KeyName2\,valueC=, sequentially expand the HKEY_LOCAL_MACHINE, software, FolderA, and FolderB folders and select the KeyName2 key to display the valueC value in the right pane.
- In the right pane, select the value name indicated after a comma at the end of the path (valueC in the example above).
- Right-click the value name and select Delete on the menu.
- Click Yes in the Confirm Value Delete dialog box.

Registry Values:

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\control panel\load, cmpid=[%HEX_ARRAY%]
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\control panel\load, net_insll=1158253529
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\control panel\load, net_insll=1160107174
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\control panel\load, net_insll=1163773656
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\control panel\load, net_insll=1168353637
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\control panel\load, net_insll=1175777376
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\control panel\load, net_insll=1179514233
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\control panel\load, net_insll=1180486284
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\control panel\load, net_insll=1180556011
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\control panel\load, net_insll=1180959052
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\control panel\load, net_insll=1184166715
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\control panel\load, net_insll=1185376216
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\control panel\load, net_insll=1185956208
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\control panel\load, net_insll=1189046310
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\control panel\load, net_insll=1190513409
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\control panel\load, net_insll=1196083312
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\control panel\load, worg=[%HEX_ARRAY%]
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion, xcq=
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\control panel\load, cmpid=108D6287515F15057968253FA69BF3D83467015CD281D055704493ED207AC2F93705C08F546B9CB301A6D609D1DF7DE53424F210D2CE51E1718067AF29B03CB332B846BD
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\control panel\load, cmpid=1ACA060D232D65050114273CD69CF0A33467002CA88BA7540145E79B290AB0854105C0FA566AE6B774A7D70DD4AC7C963459F010A8C05190798512AC22BC3CB237C53CBB
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\control panel\load, cmpid=202DBCD0205C14027666273FA6EDF3D23460002DD2FFD225764992E02779C1F83202B0FA211896B706D4D70DA7D072E53424F36AD2CB53E3038510AA25CB37B846C341B8
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\control panel\load, cmpid=2B9BF9EF265A1C0973605C3DA7EFF5A734197D50A88BD450044393E8210FB2843173C28B541AE5B571D5D400D2AB74E334578018A8CD51E3068710DC25C845B746C341BD
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\control panel\load, cmpid=36A19AAC5258160502122048D59087A33462742BA888A222734691E9567EC1F73303C5FA206D93B479A5A609D2DD72913424F31CD2BC53E5758067DB24B146B145B246BC
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\control panel\load, cmpid=41D78ACF522067730514223BD1E887D23464075DD18CA5537147E2EB207CC1833077B38F256B91C075A7D70FA6DE05903458FD1CA9CD26E3798965AE29B035C231B93CB8
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\control panel\load, cmpid=45754F24532D110804655D4ED29187D93467752CA8FFD2207232E59D2971C7853007BCFB221CE2B270D7D37DA6DC07E73458FD10A8C95DE3748961AA52BA42B534B631CA
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\control panel\load, cmpid=4B1E3BDA555A65770614544BD39AF6D534100159A8FBD6240142E698247BB2F93804C2F0256CE0C602A4DC7BD1DF06933420F46BA8CE53E606F361A129CC46B245C231CF
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\control panel\load, cmpid=534EF800512E670878145C41A19080D03417705DA8FDD528753291EC2708C1F73874B18F521C94B702A9D608A3AD72943452F06BA9C95CE679F316AE56CD45B445B03CBE
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\control panel\load, cmpid=6A0C45842528130076675C4DD29BF6A03415725AA88AA62871429DE9530BC6833577B78F296A93C871A8A108D4D172973422F76AD1C1529274F261AC21BF37B338B534BE
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\control panel\load, cmpid=757B7D70282A15017212553AA69981A03460735DD1F8D6297044E2EC527FC2F43602C08F226895C004D5A77BA1AF7CE43424F218D2CA509706F01DD828B13DC444B533C8
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\control panel\load, cmpid=7EE4D6E4532D66757769534FD6EB81A534607628D289A5287233969C240CB7F14600C5FE266A91C277D2D27FA3AD00983420F611A9BB2790758315A055CC35B341C033CD
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\control panel\load, cmpid=8E6D41FB535A110178692740A2EB85D734637D28A880D0550541E0E1537BC5873607B08A211A9DC770A6A57DA9AB72973423F61AD1CA22E470F413DF21BB3CC546B836C8
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\control panel\load, cmpid=907947CA512A14070561253FA49A81A03460732BD18AD529024293EE290BB1F83172B6FD5118E7C575A5D50FD3D176E53455F019D1BA5694788816A029B13DB042C53CC8
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\control panel\load, cmpid=95C59046512017080112264FA19EF0D734150658A888D55206409D9B530AB1803776BDFC256C90C503A7DC7AA7DC75973452F41CA8BF219502801DDD27C83DB538B747BF
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\control panel\load, cmpid=A0BA375756211C057969504FD390F4A53412002BA88DD7507333919A297DC1F43677C2F0536F90B203A4DC7CA6AF70E43424F31DA9B8279376F761AE22BF31B735B13DB1
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\control panel\load, cmpid=C037150C212E120304145140A49B81D33460705FD28BD521744394EE5671B7F13304C1FE216E91C675A9D50CA3DB029034518068D2CA5092738914DC21C841C344C740CB
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\control panel\load, cmpid=D0D85B8B522D117772615C3AA09EFDA334127359D188D4227343E1EC2178B6F74179C788281F97C274D5DC09A7AB71913458F168D1C15C90048860AB56CA45B132B634B8
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\control panel\load, cmpid=D8F2F462205D14097762564AD49185D93416002AD18ED52875419DE95179B2833677C5FF216190C370A6D77DA4AA73E33422F110A8C055E875F211AA20BB47C238C330B9
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\control panel\load, cmpid=FA84C2A0292065087415533FD391F0D93410022CD28FD428784091EA520AB6853077BCFE216893B272A5DD7FA0D07C913424811DD1BA57E3718712AD26BF3CC339C734BC
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\control panel\load, cmpid=
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\control panel\load, h=
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\control panel\load, net_insll=
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\control panel\load, worg=1FA17969786D50417A7E4B4FA687F6D2350F7551A497D623715ED6F76021F4
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\control panel\load, worg=2BEA2B382229171F71635557A791EAD4340E3A1CE3DC9627755E9CED213BE1B02E31ECB9
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\control panel\load, worg=2F39DE2F786D50417A7E4B41A787F5D0380F7559A097D621795EDAA86526F0A02F22AAB97829
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\control panel\load, worg=31885171786D50417A7E4B4EA287F6D2320F775BBE88D3216F1F8AA97839
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\control panel\load, worg=42EC1AE9786D50417A7E4B17F1CDBE846D4A2547F9D7827E6F428AA97839
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\control panel\load, worg=698D9FDF786D50417A7E4B14F5DDAC807344251BF3D1CA782E17CBF6712EE1AF7425F5E67738D0946FE3CA49F899
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\control panel\load, worg=78203780786D50417A7E4B18F7CCAA956D586A00FEDF8B3E235FD4B160
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\control panel\load, worg=99BCF313786D50417A7E4B0EE7DEEA8C65552C08E3DC856323198AB07E2FEBEE6126E1A76476C7DF30F994
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\control panel\load, worg=9CFAB42D786D50417A7E4B18F7CCAA9564506A0AFFD4CB726E01CCA9
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\control panel\load, worg=BE2722FC777445486E3E161EBFC0AA876F0E2200FA9693742212CBB73E39ECB1
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\control panel\load, worg=C4E36959786D50417A7E4B1CF1DABD877244211FF9DD817E6E12CAF67367F4A970
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\control panel\load, worg=E53F3B16786D50417A7E4B4BA090EAD032126A58A888CA2071408BA77226EAA52F23F6A866368B8230F48757F1936AD16811
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\control panel\load, worg=FB9344CF786D50417A7E4B41A187FDD42E107051BE88D2236F06CBAB7B66B6EE692FE2A63E29CC81
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\control panel\load, worg=FFEB3E99786D50417A7E4B41A887F6D4350F7D59BE8AD03E235FD4B16076
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\control panel\load, worg=
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run, gtydf=
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run, iasx=
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run, ifp=
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run, ipcbt=
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run, ipf=
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run, ipfw=[%SYSTEM%]\ipwf.exe=
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run, iptb=
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run, isxa=
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run, olpr=olpr.exe=
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run, sysldr=
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload, sysldr=

Scan your Windows Registry for DlWreck

DlWreck Categorized as:

Trojan

A trojan is a program that is disguised as legitimate software but is designed to carry out some harmful actions on the infected computer.

Unlike viruses and worms, trojans don’t replicate but they can be just as destructive.

These days trojans are very common. Trojans are divided into a number different categories based on their function or type of damage.

Downloader

A type of trojan. The primary purpose of downloaders is to install malicious code on a user’s computer. However, they can enable other malicious uses. For example, they can be used to continually download new versions of malicious code, adware, or “pornware.” They are also used frequently used to exploit the vulnerabilities of Internet Explorer.

Downloaders are typically written in script languages such as VBS or JavaScript.

How Did My PC Get Infected with DlWreck?

The following are the most likely reasons why your computer got infected with DlWreck:

Your operating system and Web browser's security settings are too lax.
You are not following safe Internet surfing and PC practices.

Downloading and Installing Freeware or Shareware

Small-charge or free software applications may come bundled with spyware, adware, or programs like DlWreck. Sometimes adware is attached to free software to enable the developers to cover the overhead involved in created the software. Spyware frequently piggybacks on free software into your computer to damage it and steal valuable private information.

Using Peer-to-Peer Software

The use of peer-to-peer (P2P) programs or other applications using a shared network exposes your system to the risk of unwittingly downloading infected files, including malicious programs like DlWreck.

Visiting Questionable Web Sites

When you visit sites with dubious or objectionable content, trojans-including DlWreck-, spyware, and adware, may well be automatically downloaded and installed onto your computer.

Detecting DlWreck

The following symptoms signal that your computer is very likely to be infected with DlWreck.

PC is working very slowly
DlWreck can seriously slow down your computer. If your PC takes a lot longer than normal to restart or your Internet connection is extremely slow, your computer may well be infected with DlWreck.

New desktop shortcuts have appeared or the home page has changed
DlWreck can tamper with your Internet settings or redirect your default home page to unwanted web sites. DlWreck may even add new shortcuts to your PC desktop.

Annoying popups keep appearing on your PC
DlWreck may swamp your computer with pestering popup ads, even when you're not connected to the Internet, while secretly tracking your browsing habits and gathering your personal information.

E-mails that you didn't write are being sent from your mailbox
DlWreck may gain complete control of your mailbox to generate and send e-mail with virus attachments, e-mail hoaxes, spam, and other types of unsolicited e-mail to other people.

Check now if your PC is infected with DlWreck

Also Be Aware of the Following Threats:

Downloader

Trojan

Download ExterminateIt!
to instantly get rid of DlWreck!