Home Articles Spyware Research Support Scan Now Purchase F.A.Q.

Top 25 Spyware:

1.Zlob Trojan
2.Vundo Trojan
3.AntiSpyCheck
4.homesecurepage.com
5.safepageplace.com
6.safebrowsenow.com
7.VirusProtect
8.protectstartpage.com
9.VirusHeat
10.Webcry
11.Virus Bursters
12.Win32.Netsky
13.W32.ExpDwnldr
14.Virus Burst
15.ProtectionBar
16.WinAntiVirus
17.AntiviralGolden
18.System Doctor
19.SpyHeal
20.DNS Changer
21.Virus Blast
22.Trojan.Win32.CP4000
23.onlinestability.com
24.Trojan.FakeAlert
25.Troj.SystemAlert
About Spyware
Glossary

Latest Detections

Adware/BHO/Toolbar/Comet

Alias: Xupiter.Orbitexplorer, Adware/Comet, TrojanDownloader.Win32.Comet

Description: Adware/BHO/Toolbar/Comet consists of an Internet Explorer toolbar containing link buttons to the search engine at xupiter.com and a task run at Windows startup which downloads updates to the software and may launch pop-ups. It also contains functionality to periodically hijack your home page and search settings to point to xupiter.com, and add links pointing to xupiter.com to your bookmarks. Apart from the hijacking and added links, Adware/BHO/Toolbar/Comet will show pop-under advertisements when its controlling servers direct it to.

Threat type:

Adware - Adware is a software application which displays advertisements on your computer. Advertisements can be displayed through pop-up / pop-under windows, additional bars or toolbars, underlined links or buttons that appear on a computer screen. Adware applications include additional code that delivers the ads. Adware authors earn money when users click on those ads. Occasionally, adware includes code that tracks user's site visits and passes it to third parties without the user's permission or knowledge.

BHO - A Browser Helper Object (BHO) is a software application that runs automatically whenever you start Internet Explorer. Browser Helper Objects are typically installed by other programs such as toolbar accessories and can track internet usage, create popup windows, display additional information on a viewed page and collect information that is transmitted by you over the internet. Malicious software that exploits this technology can replace banner advertisements with other ads, monitor your actions, change your home page, etc.

Homepage Hijacker - A Homepage Hijacker is a software application that takes control over your browser's settings. Usually it changes your home page and redirects it to some other site or modifies your search settings. It prevents you to change browser's settings. In such hijacks, your browser may operate normally, but be much slower.

Search Hijacker - A Search Hijacker is a software application that takes control of your browser's default search engine. The search results may not necessarily be the best fit as those usually come from paid advertisements, as issued to you by the Hijacker authors. Search hijackers prevent you from changing your browser's default search engine, and they tend to slow down PC performance.

Toolbar - A Toolbar is a group of buttons that performs different tasks. Unwanted toolbars are usually installed by adware programs that try to send users to their paying advertisers.


Advice: Remove This is a very high risk threat and should be removed immediately as to prevent harm to your computer or your privacy.

Detection:
SpyNoMore detects Adware/BHO/Toolbar/Comet: Yes

Threat risk: Medium Risk
SpyNoMore AntiSpyware: Remove Comet, Comet Remover
Potentially dangerous malware. May collect sensitive user information and broadcast data back to a server with "opt-out" permission. Category includes most adware programs.

Symptoms:

Adware/BHO/Toolbar/Comet changes browser settings.

Adware/BHO/Toolbar/Comet connects itself to the internet.

Adware/BHO/Toolbar/Comet displays commercial advertisements.



Adware/BHO/Toolbar/Comet Signature Details: The following information includes some of the standard signatures associated with this spyware threat. Please do not attempt to manually remove these items from your computer; Removing these items incorrectly or partially can cause your computer to experience critical errors, prevent your computer from restarting or cause loss of Internet connectivity. Should you be infected with Adware/BHO/Toolbar/Comet, you can clean your computer by downloading SpyNoMore now.

Running Process Signatures:
N/A

File Signatures:
%WINDOWS%\bobsaver.scr
%WINDOWS%\system32\redirector.dll
%WINDOWS%\downloaded program files\oeloader.exe
%WINDOWS%\downloaded program files\conflict.1\oeloader.exe
%WINDOWS%\system\redirector.dll
%WINDOWS%\bobsaver.exe
%WINDOWS%\downloaded program files\oeloader.inf
%WINDOWS%\downloaded program files\conflict.1\oeloader.dll

Registered Dll (Dynamic Link Library) Signatures:
N/A

Folder Signatures:
%PROGRAM_FILES%\common files\oe
%PROGRAM_FILES%\oe
%PROGRAM_FILES%\orbit

Registry Signatures:
HKLM\software\classes\clsid\{1678f7e1-c422-11d0-ad7d-00400515caaa}
HKLM\software\classes\clsid\{edc4193f-34ad-4d07-aa87-e3fdb89e3e76}
HKLM\software\classes\clsid\{37d026c3-84d7-4ac5-a026-c08b7907cacf}
HKLM\software\classes\interface\{899be974-d575-48bb-a9c7-1d24e8042be4}
HKLM\software\classes\interface\{cbe7d5e8-90a2-11d3-80d1-00500487b1c5}
HKLM\software\classes\csip.cscollection.1
HKLM\software\classes\clsid\{7f0f5da7-84cb-11d4-8137-00500487b1c5}
HKLM\software\classes\bho.csbho.1
HKLM\software\classes\cssecurity.htmlsecurity
HKCR\software\microsoft\windows\currentversion\explorer\browser helper objects\{d48f2e28-68e2-4920-9848-d6e6c7ab3eb7}
HKLM\software\classes\interface\{0e429271-96d8-11d3-80d5-00500487b1c5}
HKLM\software\classes\clsid\{39e01e09-2b45-11d4-810d-00500487b1c5}
HKLM\software\classes\interface\{2fcfb3fd-7184-4c42-aed3-30fff0119964}
HKLM\software\microsoft\code store database\distribution units\{d7b3e460-9968-4191-bd6f-beed1bc18482}
HKLM\software\classes\cseng.csengine
HKLM\software\classes\interface\{c2e56e18-2f04-4ab9-9333-b2db3c350956}
HKLM\software\classes\clsid\{a335d52f-d489-472d-9eaa-d72a40aaf7ca}
HKLM\software\classes\cometietoolbar.comettoolbar.1
HKLM\software\classes\clsid\{edee4ccb-0913-4cc9-8ea9-3ddd87ab8bde}
HKLM\software\classes\typelib\{07fa131e-2eb2-446f-93d2-9f877320010b}
HKLM\software\classes\skinui.webbrowsersink
HKLM\software\classes\typelib\{74232635-a013-49f2-b869-1b1ab932d944}
HKLM\software\classes\clsid\{0e429272-96d8-11d3-80d5-00500487b1c5}
HKLM\software\classes\cometapputil.cometuievents
HKLM\software\classes\dmproxy.dmproxyctl
HKLM\software\classes\typelib\{bfa2c963-fc24-4770-8c19-0d5a1cd58df9}
HKCR\typelib\{c3e17d0d-593a-457b-a1da-6d082e29323a}
HKLM\software\classes\cseng.evhandler.1
HKLM\software\classes\interface\{50d7c4ab-3c82-11d4-8111-00500487b1c5}
HKLM\software\classes\contextparser.csregexp.1
HKLM\software\classes\cometapputil.cometuievents.1
HKLM\software\classes\interface\{a9e67cbe-7a42-47be-962a-c07e73c34fba}
HKLM\software\classes\interface\{0922ec19-9ec7-11d3-80b9-00500487bdba}
HKLM\software\classes\clsid\{941228b3-3ad1-4633-a9f5-59154cb362d4}
HKLM\software\classes\csband.horizontalieband.1
HKLM\software\classes\clsid\{eb07a6d4-8e36-11d4-8138-00500487b1c5}
HKLM\software\classes\interface\{e28fcb53-8c8e-11d3-80d1-00500487b1c5}
HKLM\software\microsoft\windows\currentversion\moduleusage\c:/windows/downloaded program files/conflict.1/oeloader.exe
HKLM\software\classes\core.bho1
HKLM\software\classes\interface\{8bee173b-c006-4f0e-acd2-84a882bebcff}
HKLM\software\classes\interface\{1348e05a-21c7-4134-b4a4-3c12234fca3f}
HKLM\software\classes\core.cometframe
HKLM\software\classes\typelib\{32ba13af-001c-456e-8825-8d53077460ac}
HKLM\software\classes\clsid\{64726b8a-0cbe-4f80-90b7-1ca1bc69fcfb}
HKLM\software\classes\dmserver.dmnotify.1
HKLM\software\classes\interface\{7f0f5da6-84cb-11d4-8137-00500487b1c5}
HKLM\software\classes\interface\{ffe56921-248b-4c75-9eee-01706310e371}
HKLM\software\classes\csip.csipdispatch.1
HKLM\software\classes\core.cometcursor
HKLM\software\classes\core.httpcomm.1
HKLM\software\classes\puk.pukbho.1
HKLM\software\classes\clsid\{7be4e188-dd04-47e4-8c1b-4aa330b18d9f}
HKLM\software\classes\clsid\{e28fcb54-8c8e-11d3-80d1-00500487b1c5}
HKLM\software\classes\interface\{29089b98-af05-4769-b627-86a745d4b672}
HKLM\software\classes\csbrange.byterange
HKLM\software\classes\core.selfupdater
HKLM\software\classes\core.cometwindow.1
HKLM\software\classes\core.windowproxy.1
HKLM\software\microsoft\windows\currentversion\moduleusage\c:/windows/downloaded program files/oeloader.exe
HKLM\software\classes\clsid\{15940f5d-d8bd-49bc-851d-29dcfb166950}
HKLM\software\classes\typelib\{8fcd3b3f-6f3e-4bb2-9c37-b03b27f71857}
HKLM\software\classes\contextparser.urlcontextparser
HKLM\software\classes\comutil.fcparam.1
HKLM\software\classes\contextparser.contextproxymgr
HKLM\software\classes\interface\{cd74b15b-a1d3-11d3-80bc-00500487bdba}
HKLM\software\classes\comutil.fctcall.1
HKLM\software\classes\typelib\{d14d6786-9b65-11d3-80b6-00500487bdba}
HKLM\software\classes\typelib\{062efa78-8bbb-11d3-80d0-00500487b1c5}
HKLM\software\classes\csip.csippacket
HKLM\software\classes\skinui.activewindow
HKLM\software\classes\interface\{9dbdd71c-0a7f-48ac-9ffa-e102b3750b9d}
HKLM\software\classes\core.system
HKLM\software\classes\contextparser.urlcontextparser.1
HKLM\software\classes\interface\{0e42926f-96d8-11d3-80d5-00500487b1c5}
HKLM\software\classes\core.fileinfo
HKLM\software\classes\cssecurity.htmlsecurity.1
HKLM\software\classes\cseng.cshost
HKLM\software\classes\comutil.fctcall
HKLM\software\classes\interface\{b0e9399e-fe6f-43b0-98d3-2f47080dde4a}
HKLM\software\classes\core.mybrowser1.1
HKLM\software\classes\typelib\{3f4386e5-2fbe-44a8-81cf-4b792490605f}
HKLM\software\classes\interface\{d14d6792-9b65-11d3-80b6-00500487bdba}
HKLM\software\classes\clsid\{ea5bb125-a227-40a7-bcaa-652d497c2f65}
HKLM\software\classes\clsid\{dfa771a5-2138-48ee-a58e-f782c879af8e}
HKLM\software\classes\clsid\{f147ae85-1855-4182-be3a-174160995a40}
HKLM\software\classes\clsid\{4aa5d526-44d5-4af6-ac53-5ce1534cc40b}
HKLM\software\classes\interface\{a0ca55a1-a112-11d3-80d6-00500487b1c5}
HKLM\software\classes\interface\{a4b977f5-1efc-4da0-b9c2-67c53cba140f}
HKLM\software\classes\clsid\{04fc63f8-ee34-4283-8941-4a11bf17c447}
HKLM\software\classes\interface\{bfcbf73b-6eb2-49c1-adca-cf0cd589b140}
HKLM\software\classes\interface\{c4d86dc8-b73b-4470-9914-3dac14ee6f95}
HKLM\software\classes\interface\{c0cad17e-00a3-4f40-9015-d569c3114ba3}
HKLM\software\classes\csip.csipdispatch
HKLM\software\classes\csband.verticalieband
HKLM\software\classes\interface\{062efa84-8bbb-11d3-80d0-00500487b1c5}
HKLM\software\classes\clsid\{cd74b159-a1d3-11d3-80bc-00500487bdba}
HKLM\software\classes\interface\{34fdd882-5530-4a90-89cd-416612c8855e}
HKLM\software\classes\clsid\{0922ec1a-9ec7-11d3-80b9-00500487bdba}
HKCR\software\microsoft\windows\currentversion\explorer\browser helper objects\{702ad576-fddb-4d0f-9811-a43252064684}
HKLM\software\classes\typelib\{bf986691-7f7b-4f94-85e0-20e75350701f}
HKLM\software\classes\clsid\{702ad576-fddb-4d0f-9811-a43252064684}
HKLM\software\classes\cometietoolbar.comettoolbar
HKLM\software\classes\interface\{4a0f42b7-a61b-4131-bf41-bf05a2635bfd}
HKLM\software\classes\interface\{97284959-a553-4576-859c-b3b3ff283de0}
HKLM\software\classes\interface\{665abe65-2c16-4341-b4b8-01ff799e8f4c}
HKLM\software\classes\clsid\{212b99a1-9cf6-11d3-80b7-00500487bdba}
HKLM\software\classes\clsid\{197ab1d7-a7dd-4c86-a938-1fcc0db21b85}
HKLM\software\classes\clsid\{e5c39db9-9dcc-11d3-80d6-00500487b1c5}
HKLM\software\classes\core.fileinfo.1
HKLM\software\classes\interface\{eb07a6d3-8e36-11d4-8138-00500487b1c5}
HKLM\software\classes\clsid\{fe6bc4ef-5676-484b-88ae-883323913256}
HKLM\software\classes\core.system.1
HKLM\software\classes\interface\{f8c5ea77-7d72-405c-b90a-093655b0f544}
HKLM\software\classes\skinui.cskinui.1
HKLM\software\classes\clsid\{0e42926e-96d8-11d3-80d5-00500487b1c5}
HKLM\software\classes\core.cs15cursor
HKLM\software\classes\clsid\{a5ea242a-442e-4ecb-9cac-97037ccd6ec6}
HKLM\software\classes\interface\{e9cbbeed-20b6-456c-8589-cf364d9d2370}
HKLM\software\classes\contextparser.csregexp
HKLM\software\classes\interface\{dc86768f-5adf-4d84-9de8-fd047b1fe8f5}
HKLM\software\classes\interface\{ce2eab19-e31d-43ca-a860-f95a2ca50040}
HKLM\software\classes\typelib\{7f0f5d9a-84cb-11d4-8137-00500487b1c5}
HKLM\software\classes\cseng.cshost.1
HKLM\software\classes\clsid\{f59c663d-e891-492c-86e3-0758c71885c2}
HKLM\software\classes\core.mybrowser1
HKLM\software\classes\interface\{b0db6360-8d7f-11d4-8137-00500487b1c5}
HKLM\software\classes\interface\{a0ca55a0-a112-11d3-80d6-00500487b1c5}
HKLM\software\classes\skinui.windowshelper
HKLM\software\classes\core.cometwindow
HKLM\software\classes\bho.csbho
HKLM\software\classes\comutil.fcparam
HKLM\software\classes\typelib\{5d2d50f6-6be2-41a0-b827-1accd3e2e2f7}
HKLM\software\classes\csip.cscollection
HKLM\software\classes\csbrange.byterange.1
HKLM\software\classes\clsid\{6f2d6a5e-e3e7-4f18-887c-c777650def57}
HKLM\software\classes\interface\{c7291310-3c8c-11d4-8111-00500487b1c5}
HKLM\software\classes\interface\{7aa7d1c3-f0f8-460c-936d-b5886d0928eb}
HKLM\software\classes\clsid\{4320aeeb-2f2a-4f97-b573-232c6576aa3a}
HKLM\software\classes\clsid\{d14d6793-9b65-11d3-80b6-00500487bdba}
HKLM\software\classes\clsid\{da0882fb-49a3-4a9e-bb09-5e15347b5647}
HKLM\software\classes\interface\{ddd1e8ca-678d-4c9a-a472-ce9578b14dc5}
HKLM\software\classes\typelib\{844c39ec-7ea4-4f11-bce6-28404fd768e3}
HKLM\software\microsoft\windows\currentversion\explorer\browser helper objects\{d48f2e28-68e2-4920-9848-d6e6c7ab3eb7}
HKLM\software\classes\contextparser.contextproxymgr.1
HKLM\software\classes\core.windowproxy
HKLM\software\classes\core.httpcomm
HKLM\software\classes\interface\{cbe7d5e6-90a2-11d3-80d1-00500487b1c5}
HKLM\software\classes\clsid\{c38fc998-3b1b-4f59-a710-5a6c9cf8bd92}
HKLM\software\classes\clsid\{90c61707-c8f8-43db-a25c-c1f4b18ee41e}
HKLM\software\classes\skinui.webbrowsersink.1
HKLM\software\classes\cseng.evhandler
HKLM\software\classes\core.cometframe.1
HKLM\software\microsoft\windows\currentversion\explorer\browser helper objects\{702ad576-fddb-4d0f-9811-a43252064684}
HKLM\software\classes\appid\{bac984c9-78c8-4105-9e97-1675a4052686}
HKLM\software\classes\interface\{910e67a6-bd53-46df-8434-41498b7d22f7}
HKLM\software\classes\clsid\{e3a6e4b2-16b4-4f56-a98a-5f4de04ca2be}
HKLM\software\classes\interface\{012b0571-2cd6-11d4-810d-00500487b1c5}
HKLM\software\classes\core.bho1.1
HKLM\software\classes\clsid\{16bc6464-196a-4bab-a14b-f69f8a0a60f7}
HKLM\software\classes\core.browserappproxy
HKCR\clsid\{d48f2e28-68e2-4920-9848-d6e6c7ab3eb7}
HKLM\software\classes\clsid\{8ae68b04-d492-4474-a6e2-fd5fe884f4b1}
HKLM\software\classes\typelib\{878ace1b-8db0-4d75-9034-504756ad4215}
HKLM\software\classes\csband.horizontalieband
HKLM\software\classes\interface\{ea3b6c62-70a6-11d1-b69e-444553540000}
HKLM\software\classes\clsid\{cbe7d5e7-90a2-11d3-80d1-00500487b1c5}
HKLM\software\classes\dmproxy.dmproxyctl.1
HKLM\software\classes\clsid\{d48f2e28-68e2-4920-9848-d6e6c7ab3eb7}
HKLM\software\classes\core.cometcursor.1
HKLM\software\classes\interface\{212b99a0-9cf6-11d3-80b7-00500487bdba}
HKCR\clsid\{702ad576-fddb-4d0f-9811-a43252064684}
HKLM\software\classes\skinui.activewindow.1
HKLM\software\classes\interface\{c81b4b57-b06b-409d-aed0-028051683796}
HKLM\software\classes\interface\{43f1b4ad-92ef-4db3-bda9-12335b012dd0}
HKLM\software\classes\interface\{9464c98e-b5f1-4c6a-bd3f-9696e3bd081e}
HKLM\software\classes\cseng.csengine.1
HKLM\software\classes\interface\{788e0d0e-caf7-473b-9183-76be6d30dc9a}
HKLM\software\classes\clsid\{062efa85-8bbb-11d3-80d0-00500487b1c5}
HKLM\software\classes\interface\{2da93e50-9d08-11d3-80d5-00500487b1c5}
HKLM\software\classes\contextparser.contextproxy
HKLM\software\classes\core.cs15cursor.1
HKLM\software\classes\core.selfupdater.1
HKLM\software\classes\skinui.windowshelper.1
HKLM\software\classes\core.browserappproxy.1
HKCU\clsid\{0fda4d2b-7975-405d-8d7c-f5e2247eae80}
HKLM\software\classes\typelib\{c09fb84d-b9ed-43eb-afed-f145c26cb839}
HKLM\software\classes\clsid\{827a2ece-d76f-4bcc-82ed-d6a287c11211}
HKLM\software\classes\csip.csippacket.1
HKLM\software\classes\interface\{832786ec-9632-4919-8972-59f79d621c87}
HKLM\software\classes\contextparser.contextproxy.1
HKLM\software\classes\interface\{58c59f56-ca66-4b5d-9132-ecea5193be5a}
HKLM\software\classes\dmserver.dmnotify
HKLM\software\classes\csband.verticalieband.1
HKLM\software\classes\skinui.cskinui
HKLM\software\classes\puk.pukbho
HKLM\software\classes\interface\{1e587528-41aa-4f19-97e8-bb75acc3035c}
HKLM\software\classes\interface\{aeb17fc4-2a52-4945-9866-81cc343a59e3}


SpyNoMore Collected Residual File Signatures:
N/A


See Also:
BHO/Stoolbar
Adware/Surfairy
Adware/AUpdate
P2P/Morpheus 3.1
BHO/Search Hijacker/Exploit/Alexa
BHO/Hijacker/GoHip.Browserenh
Adware/BHO/INetSpeak.eBoom
Search Hijacker/CnsMin variant
Adware/SaveNow/Download
Adware/Micro Net Utilities

Spyware Removal Home | Support | F.A.Q. | Contact Us | Spyware Removal Database | Privacy Policy | Site Map
Copyright © 2005-2008 Illysoft LLC