Necessary At your option Useless Dangerous Application database
 Startup Programs     Entire site
Startupapps.com recommends you:

Malware Tests - removal of the newest malware.

Detect and remove hidden rootkits using UnHackMe UnHackMe - Rootkit Killer Free fully functional 30-days trial.

RegRun Security Suite = 24 system utilities for protecting your computer. Get it!

Buy Now!

I would like to say that RegRun has helped me on more than 1 occasion when it comes to spyware/adware by letting me know automatically that a piece of it got added to Windows startup. There is so much spyware/addware out there today it's hard to imagine being without RegRun. I like many other features too including the daily registry backups and file protection.

Chris Wagers

Dangerous windowsmedia-kb324290.exe - Dangerous
windowsmedia-kb324290.exe
We suggest you to remove WindowsMedia-KB324290.exe from your computer as soon as possible.
WindowsMedia-KB324290.exe is Trojan/Backdoor.
Kill the process WindowsMedia-KB324290.exe and remove WindowsMedia-KB324290.exe from Windows startup.

File: WindowsMedia-KB324290.exe

Classification:
Antivirus Version Last Update Result
AVG 8.5.0.339 2009.06.23 Win32/Heur
BitDefender 7.2 2009.06.24 -
Comodo 1404 2009.06.24 -
DrWeb 5.0.0.12182 2009.06.24 -
F-Secure 8.0.14470.0 2009.06.24 -
Kaspersky 7.0.0.125 2009.06.24 -
Microsoft 1.4803 2009.06.24 BrowserModifier:Win32/Kerlofost
NOD32 4183 2009.06.24 -
Symantec 1.4.4.12 2009.06.24 -

Additional information
File size: 287438 bytes
MD5 : 3b45ff095aa474f24ba031d8d838ed50
SHA1 : 1ff2ea4803d84da168e84dde1e701d251c4ec4e5

Installation
When the program is executed, it creates the following registry subkeys and values:

----------------------------------
Keys added:47
----------------------------------
HKLM\SOFTWARE\Classes\AppID\rs_adw.DLL
HKLM\SOFTWARE\Classes\AppID\{D96FA298-1BB6-47FC-AD21-72781B744DC3}
HKLM\SOFTWARE\Classes\CLSID\{304EAD7E-2910-4CE6-83F1-554B04D44A0F}
HKLM\SOFTWARE\Classes\CLSID\{304EAD7E-2910-4CE6-83F1-554B04D44A0F}\InprocServer32
HKLM\SOFTWARE\Classes\CLSID\{71E59D37-D7FC-4ED6-BC1D-D13BE02FE6C5}
HKLM\SOFTWARE\Classes\CLSID\{71E59D37-D7FC-4ED6-BC1D-D13BE02FE6C5}\InprocServer32
HKLM\SOFTWARE\Classes\CLSID\{71E59D37-D7FC-4ED6-BC1D-D13BE02FE6C5}\ProgID
HKLM\SOFTWARE\Classes\CLSID\{71E59D37-D7FC-4ED6-BC1D-D13BE02FE6C5}\Programmable
HKLM\SOFTWARE\Classes\CLSID\{71E59D37-D7FC-4ED6-BC1D-D13BE02FE6C5}\TypeLib
HKLM\SOFTWARE\Classes\CLSID\{71E59D37-D7FC-4ED6-BC1D-D13BE02FE6C5}\VersionIndependentProgID
HKLM\SOFTWARE\Classes\CLSID\{FFFFE708-B832-42F1-BAFF-247753B5E452}
HKLM\SOFTWARE\Classes\CLSID\{FFFFE708-B832-42F1-BAFF-247753B5E452}\Implemented Categories
HKLM\SOFTWARE\Classes\CLSID\{FFFFE708-B832-42F1-BAFF-247753B5E452}\Implemented Categories\{00021494-0000-0000-C000-000000000046}
HKLM\SOFTWARE\Classes\CLSID\{FFFFE708-B832-42F1-BAFF-247753B5E452}\InprocServer32
HKLM\SOFTWARE\Classes\CLSID\{FFFFE708-B832-42F1-BAFF-247753B5E452}\Instance
HKLM\SOFTWARE\Classes\CLSID\{FFFFE708-B832-42F1-BAFF-247753B5E452}\Instance\InitPropertyBag
HKLM\SOFTWARE\Classes\CLSID\{FFFFE708-B832-42F1-BAFF-247753B5E452}\ProgID
HKLM\SOFTWARE\Classes\CLSID\{FFFFE708-B832-42F1-BAFF-247753B5E452}\Programmable
HKLM\SOFTWARE\Classes\CLSID\{FFFFE708-B832-42F1-BAFF-247753B5E452}\TypeLib
HKLM\SOFTWARE\Classes\CLSID\{FFFFE708-B832-42F1-BAFF-247753B5E452}\VersionIndependentProgID
HKLM\SOFTWARE\Classes\Interface\{E743CF05-181C-4D72-B4EE-95435ED4B86B}
HKLM\SOFTWARE\Classes\Interface\{E743CF05-181C-4D72-B4EE-95435ED4B86B}\ProxyStubClsid
HKLM\SOFTWARE\Classes\Interface\{E743CF05-181C-4D72-B4EE-95435ED4B86B}\ProxyStubClsid32
HKLM\SOFTWARE\Classes\Interface\{E743CF05-181C-4D72-B4EE-95435ED4B86B}\TypeLib
HKLM\SOFTWARE\Classes\Interface\{F1287389-B2FE-4315-8484-540B2033646D}
HKLM\SOFTWARE\Classes\Interface\{F1287389-B2FE-4315-8484-540B2033646D}\ProxyStubClsid
HKLM\SOFTWARE\Classes\Interface\{F1287389-B2FE-4315-8484-540B2033646D}\ProxyStubClsid32
HKLM\SOFTWARE\Classes\Interface\{F1287389-B2FE-4315-8484-540B2033646D}\TypeLib
HKLM\SOFTWARE\Classes\TypeLib\{2552632F-867D-4052-B836-7F83A5302534}
HKLM\SOFTWARE\Classes\TypeLib\{2552632F-867D-4052-B836-7F83A5302534}\1.0
HKLM\SOFTWARE\Classes\TypeLib\{2552632F-867D-4052-B836-7F83A5302534}\1.0\0
HKLM\SOFTWARE\Classes\TypeLib\{2552632F-867D-4052-B836-7F83A5302534}\1.0\0\win32
HKLM\SOFTWARE\Classes\TypeLib\{2552632F-867D-4052-B836-7F83A5302534}\1.0\FLAGS
HKLM\SOFTWARE\Classes\TypeLib\{2552632F-867D-4052-B836-7F83A5302534}\1.0\HELPDIR
HKLM\SOFTWARE\Classes\reklosoft_adw.Helper_Bar
HKLM\SOFTWARE\Classes\reklosoft_adw.Helper_Bar\CLSID
HKLM\SOFTWARE\Classes\reklosoft_adw.Helper_Bar\CurVer
HKLM\SOFTWARE\Classes\rs_adw.Helper_Bar.1
HKLM\SOFTWARE\Classes\rs_adw.Helper_Bar.1\CLSID
HKLM\SOFTWARE\Classes\rs_adw.Helper_bho
HKLM\SOFTWARE\Classes\rs_adw.Helper_bho\CLSID
HKLM\SOFTWARE\Classes\rs_adw.Helper_bho\CurVer
HKLM\SOFTWARE\Classes\rs_adw.Helper_bho.1
HKLM\SOFTWARE\Classes\rs_adw.Helper_bho.1\CLSID
HKLM\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{FFFFE708-B832-42F1-BAFF-247753B5E452}
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{304EAD7E-2910-4CE6-83F1-554B04D44A0F}
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{71E59D37-D7FC-4ED6-BC1D-D13BE02FE6C5}

----------------------------------
Values added:43
----------------------------------
HKLM\SOFTWARE\Classes\AppID\rs_adw.DLL\AppID: "{D96FA298-1BB6-47FC-AD21-72781B744DC3}"
HKLM\SOFTWARE\Classes\AppID\{D96FA298-1BB6-47FC-AD21-72781B744DC3}\: "rs_adw"
HKLM\SOFTWARE\Classes\CLSID\{304EAD7E-2910-4CE6-83F1-554B04D44A0F}\InprocServer32\: "C:\WINDOWS\system32\j2se.dll"
HKLM\SOFTWARE\Classes\CLSID\{304EAD7E-2910-4CE6-83F1-554B04D44A0F}\InprocServer32\ThreadingModel: "Apartment"
HKLM\SOFTWARE\Classes\CLSID\{71E59D37-D7FC-4ED6-BC1D-D13BE02FE6C5}\VersionIndependentProgID\: "rs_adw.Helper_bho"
HKLM\SOFTWARE\Classes\CLSID\{71E59D37-D7FC-4ED6-BC1D-D13BE02FE6C5}\TypeLib\: "{2552632F-867D-4052-B836-7F83A5302534}"
HKLM\SOFTWARE\Classes\CLSID\{71E59D37-D7FC-4ED6-BC1D-D13BE02FE6C5}\ProgID\: "rs_adw.Helper_bho.1"
HKLM\SOFTWARE\Classes\CLSID\{71E59D37-D7FC-4ED6-BC1D-D13BE02FE6C5}\InprocServer32\: "C:\WINDOWS\system32\2rs23617.dll"
HKLM\SOFTWARE\Classes\CLSID\{71E59D37-D7FC-4ED6-BC1D-D13BE02FE6C5}\InprocServer32\ThreadingModel: "Apartment"
HKLM\SOFTWARE\Classes\CLSID\{71E59D37-D7FC-4ED6-BC1D-D13BE02FE6C5}\: "Helper_bho Class"
HKLM\SOFTWARE\Classes\CLSID\{FFFFE708-B832-42F1-BAFF-247753B5E452}\VersionIndependentProgID\: "rs_adw.Helper_Bar"
HKLM\SOFTWARE\Classes\CLSID\{FFFFE708-B832-42F1-BAFF-247753B5E452}\TypeLib\: "{2552632F-867D-4052-B836-7F83A5302534}"
HKLM\SOFTWARE\Classes\CLSID\{FFFFE708-B832-42F1-BAFF-247753B5E452}\ProgID\: "rs_adw.Helper_Bar.1"
HKLM\SOFTWARE\Classes\CLSID\{FFFFE708-B832-42F1-BAFF-247753B5E452}\InprocServer32\: "C:\WINDOWS\system32\2rs23617.dll"
HKLM\SOFTWARE\Classes\CLSID\{FFFFE708-B832-42F1-BAFF-247753B5E452}\InprocServer32\ThreadingModel: "Apartment"
HKLM\SOFTWARE\Classes\CLSID\{FFFFE708-B832-42F1-BAFF-247753B5E452}\: "rs"
HKLM\SOFTWARE\Classes\Interface\{E743CF05-181C-4D72-B4EE-95435ED4B86B}\TypeLib\: "{2552632F-867D-4052-B836-7F83A5302534}"
HKLM\SOFTWARE\Classes\Interface\{E743CF05-181C-4D72-B4EE-95435ED4B86B}\TypeLib\Version: "1.0"
HKLM\SOFTWARE\Classes\Interface\{E743CF05-181C-4D72-B4EE-95435ED4B86B}\ProxyStubClsid32\: "{00020424-0000-0000-C000-000000000046}"
HKLM\SOFTWARE\Classes\Interface\{E743CF05-181C-4D72-B4EE-95435ED4B86B}\ProxyStubClsid\: "{00020424-0000-0000-C000-000000000046}"
HKLM\SOFTWARE\Classes\Interface\{E743CF05-181C-4D72-B4EE-95435ED4B86B}\: "IHelper_bho"
HKLM\SOFTWARE\Classes\Interface\{F1287389-B2FE-4315-8484-540B2033646D}\TypeLib\: "{2552632F-867D-4052-B836-7F83A5302534}"
HKLM\SOFTWARE\Classes\Interface\{F1287389-B2FE-4315-8484-540B2033646D}\TypeLib\Version: "1.0"
HKLM\SOFTWARE\Classes\Interface\{F1287389-B2FE-4315-8484-540B2033646D}\ProxyStubClsid32\: "{00020424-0000-0000-C000-000000000046}"
HKLM\SOFTWARE\Classes\Interface\{F1287389-B2FE-4315-8484-540B2033646D}\ProxyStubClsid\: "{00020424-0000-0000-C000-000000000046}"
HKLM\SOFTWARE\Classes\Interface\{F1287389-B2FE-4315-8484-540B2033646D}\: "IHelper_Bar"
HKLM\SOFTWARE\Classes\TypeLib\{2552632F-867D-4052-B836-7F83A5302534}\1.0\0\win32\: "C:\WINDOWS\system32\2rs23617.dll"
HKLM\SOFTWARE\Classes\TypeLib\{2552632F-867D-4052-B836-7F83A5302534}\1.0\HELPDIR\: "C:\WINDOWS\system32"
HKLM\SOFTWARE\Classes\TypeLib\{2552632F-867D-4052-B836-7F83A5302534}\1.0\FLAGS\: "0"
HKLM\SOFTWARE\Classes\TypeLib\{2552632F-867D-4052-B836-7F83A5302534}\1.0\: "rs_adw 1.0 Type Library"
HKLM\SOFTWARE\Classes\reklosoft_adw.Helper_Bar\CurVer\: "rs_adw.Helper_Bar.1"
HKLM\SOFTWARE\Classes\reklosoft_adw.Helper_Bar\CLSID\: "{FFFFE708-B832-42F1-BAFF-247753B5E452}"
HKLM\SOFTWARE\Classes\reklosoft_adw.Helper_Bar\: "Helper_Bar Class"
HKLM\SOFTWARE\Classes\rs_adw.Helper_Bar.1\CLSID\: "{FFFFE708-B832-42F1-BAFF-247753B5E452}"
HKLM\SOFTWARE\Classes\rs_adw.Helper_Bar.1\: "Helper_Bar Class"
HKLM\SOFTWARE\Classes\rs_adw.Helper_bho\CurVer\: "rs_adw.Helper_bho.1"
HKLM\SOFTWARE\Classes\rs_adw.Helper_bho\CLSID\: "{71E59D37-D7FC-4ED6-BC1D-D13BE02FE6C5}"
HKLM\SOFTWARE\Classes\rs_adw.Helper_bho\: "Helper_bho Class"
HKLM\SOFTWARE\Classes\rs_adw.Helper_bho.1\CLSID\: "{71E59D37-D7FC-4ED6-BC1D-D13BE02FE6C5}"
HKLM\SOFTWARE\Classes\rs_adw.Helper_bho.1\: "Helper_bho Class"
HKLM\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{FFFFE708-B832-42F1-BAFF-247753B5E452}\: "rs_Bar Class"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{71E59D37-D7FC-4ED6-BC1D-D13BE02FE6C5}\: "Helper_bho"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{71E59D37-D7FC-4ED6-BC1D-D13BE02FE6C5}\NoExplorer: 0x00000001

----------------------------------
Values modified:0
----------------------------------

----------------------------------
Files added:2
----------------------------------
C:\WINDOWS\system32\2rs23617.dll
C:\WINDOWS\system32\j2se.dll

----------------------------------
Files [attributes?] modified:0
----------------------------------

----------------------------------
Folders added:0
----------------------------------

----------------------------------
Folders deleted:0
----------------------------------

----------------------------------
Total changes:92
----------------------------------

-------------------------------------------------------------------------------------
Detected by RegRun Reanimator:

Item Name: {304EAD7E-2910-4CE6-83F1-554B04D44A0F}
Author: Unknown
Related File: C:\WINDOWS\system32\j2se.dll
Type: Browser Helper Objects

Item Name: {71E59D37-D7FC-4ED6-BC1D-D13BE02FE6C5}
Author: Reklosoft.ru
Related File: C:\WINDOWS\system32\2rs23617.dll
Type: Browser Helper Objects

Removal Results: Success
Number of reboot: 1

-------------------------------------------------------------------------------------

Recommended software:
UnHackMe anti-rootkit and anti-malware
http://www.unhackme.com
RegRun Security Suite (Good choice for removal and protection)
http://www.regrun.com

Removal: windowsmedia-kb324290.exe is removed by RegRun.

  Download RegRun Suite. Click here.
 
Unzip downloaded file to any folder on your hard drive.
Open an executable file to start program installation.
Follow the installer instructions.
At the end of installing software on your computer you will be prompted to run "Scan for Viruses".
Wait for a couple seconds to finish scanning.
Click on the "Fix Problems" button.
Is it serious?
 The programs is known as malware.
Item name:
 windowsmedia-kb324290.exe

Click on the "Get it out!" button.

We suggest you to reboot your computer to be sure that your computer is clean now.
Do not hesitate to contact us:
Support center

UnHackMe - Rootkit/Malware killer

Also recommended software:
RegRun Security Suite Platinum - removal and protection.

UnHackMe is a part of RegRun Security Suite Platinum.

RegRun - User's Choice

Vista Programs - full info...

What is hidden in MSDN?
.NET Secrets Revealed

Why software developers prefer Win32.FreeTechSecrets.com?

All Unix Manuals in Alphabetical Order

C# controls for .NET in 3 simple steps.


Constantly updated. Last update: November 16 2009

Interesting information about Vista programs...
Need consultation?

Would you like to add your opinion?

Your Name (Not Required):

Your E-mail to contact (Not Required):

Application Name:

Application Status:
Neccessary
At your option
Useless
Dangerous

Description:


Quick Links
What's new?
RSS Feed
Add to AppDatabase
Ask Experts
Join forum
Links

Articles
Virus or not? SPTD####.sys
What is mc21.tmp, mc22.tmp, mc23.tmp?

Select
Necessary
Useless
At your option
Dangerous
Copyright © 1998-2008 Greatis Software