http://www.castlecops.com/CLSID.html CastleCops - TonyKlein's BHO Collection en-us Paul Laudanski (mailto:paul@computercops.biz) Copyright © 2002-2005 CastleCops® 2008-07-24T01:39:40-05:00 daily 24 2003-01-01T12:00-05:00 \{88E2C28F-80C8-49BA-94A3-A5D4930B4A23 } X BHO TB fdkowvbp.dll Parasite causing false spyware warnings and connecting to fake "security sites" - member of the FakeAlert, http://research.sunbelt-software.com/threatdisplay.aspx?threatid=43521 aka SmitFraud, http://research.sunbelt-software.com/threatdisplay.aspx?threatid=44645 malware family http://www.castlecops.com/clsid-55105.html http://www.castlecops.com/clsid-55105.html \{EF4940D2-F131-4412-BB03-4E40FCE06EC7 } X BHO TB fdkowvbp.dll Parasite causing false spyware warnings and connecting to fake "security sites" - member of the FakeAlert, http://research.sunbelt-software.com/threatdisplay.aspx?threatid=43521 aka SmitFraud, http://research.sunbelt-software.com/threatdisplay.aspx?threatid=44645 malware family http://www.castlecops.com/clsid-55104.html http://www.castlecops.com/clsid-55104.html \{199C2DDE-26C2-4FC7-A847-A28D57CB5A9B} X BHO TB fdkowvbp.dll Parasite causing false spyware warnings and connecting to fake "security sites" - member of the FakeAlert, http://research.sunbelt-software.com/threatdisplay.aspx?threatid=43521 aka SmitFraud, http://research.sunbelt-software.com/threatdisplay.aspx?threatid=44645 malware family http://www.castlecops.com/clsid-55103.html http://www.castlecops.com/clsid-55103.html \{FE0F4B4F-A5A0-4529-BC78-1B04220F45E6} X BHO TB nfavxwdbpgs.dll Adware downloader causing false spyware warnings and connecting to rogue "security sites", a member of the Trojan-Downloader.Zlob.Media-Codec, http://research.sunbelt-software.com/threatdisplay.aspx?threatid=44478 aka NewMediaCodec, http://research.sunbelt-software.com/threatdisplay.aspx?threatid=149335 malware family http://www.castlecops.com/clsid-55102.html http://www.castlecops.com/clsid-55102.html \{0D2C5F57-FA50-4B51-885E-EB4A31D734C3} X BHO TB nfavxwdbqxv.dll Adware downloader causing false spyware warnings and connecting to rogue "security sites", a member of the Trojan-Downloader.Zlob.Media-Codec, http://research.sunbelt-software.com/threatdisplay.aspx?threatid=44478 aka NewMediaCodec, http://research.sunbelt-software.com/threatdisplay.aspx?threatid=149335 malware family http://www.castlecops.com/clsid-55101.html http://www.castlecops.com/clsid-55101.html \{FBE58CC0-D14B-45FE-A717-57BB8247F652} X BHO TB bho2extn.dll, bho_e.dll, bhoext.dll, other semi-random filenames made up from the following fragments: bho, bho2, ie, ext, extn, _e Parasite redirecting to fake security sites, member of the FakeAlert, http://research.sunbelt-software.com/threatdisplay.aspx?threatid=43521 aka SmitFraud, http://research.sunbelt-software.com/threatdisplay.aspx?threatid=44645 malware family - produces IEDefender, http://www.symantec.com/security_response/writeup.jsp?docid=2007-111420-0754-99 , FilesSecure, http://www.symantec.com/security_response/writeup.jsp?docid=2007-122812-3859-99 , MalwareBell, http://www.symantec.com/business/security_response/writeup.jsp?docid=2008-041610-3304-99 , IE_Antivirus, http://www.symantec.com/business/security_response/writeup.jsp?docid=2008-042813-4856-99&tabid=1 or similar popups - also see here, http://www.bleepingcomputer.com/forums/topic114240.html http://www.castlecops.com/clsid-55100.html http://www.castlecops.com/clsid-55100.html \{8E581CE9-8C25-4E5B-9282-564B7DC06ED8} X BHO TB confmsp.ocx Unidentified parasite - should you have any information about this application, such as for example the site where it was downloaded or installed, [xs4] - if you actually have a copy of the file, please attach it to your email for analysis. Thanks! http://www.castlecops.com/clsid-55099.html http://www.castlecops.com/clsid-55099.html \{ED71602F-B2F6-470F-943F-0DA300E034D8} X BHO TB [random filename] ConHook, http://research.sunbelt-software.com/threatdisplay.aspx?threatid=45786 aka Chisyne, http://www3.ca.com/securityadvisor/virusinfo/virus.aspx?id=48117 trojan variant - VirtuMonde/Vundo, http://www.symantec.com/security_response/writeup.jsp?docid=2004-112111-3912-99 adware downloader http://www.castlecops.com/clsid-55098.html http://www.castlecops.com/clsid-55098.html \{A057A204-BACC-4D26-C7D7-6BAD84E32FCB} O BHO TB buySAFEShoppingAdvisor.dll, BUYSAF~1.DLL buySAFE_Shopping_Advisor, http://www.buysafe.com/web/general/shoppingadvisordownload.aspx http://www.castlecops.com/clsid-55097.html http://www.castlecops.com/clsid-55097.html \{EAB15366-0E81-476D-83CC-1052FDF017C8} X BHO TB [random filename] ConHook, http://research.sunbelt-software.com/threatdisplay.aspx?threatid=45786 aka Chisyne, http://www3.ca.com/securityadvisor/virusinfo/virus.aspx?id=48117 trojan variant - VirtuMonde/Vundo, http://www.symantec.com/security_response/writeup.jsp?docid=2004-112111-3912-99 adware downloader http://www.castlecops.com/clsid-55096.html http://www.castlecops.com/clsid-55096.html