Google Analytics redirect virus or hijacker is but another manifestation of popular rootkit. The infection could be reported also as ZeroAccess rootkit.
The redirect malware is quite widespread rogue. Its payload is not limited to re-routing user’s web-surfing from the Analytics page to advertisement portal the hackers behind the infection are interested in, perhaps on pay per click terms. The rootkit blocks other applications, especially security software. To be able to remove Google Analytics redirect virus, you may need to set your PC into Safe Mode with Networking. Click here to see if the free scanner link is banned by the rogue. If yes, please restart your PC and strike F8 continuously to trigger boot options table. From the list, select the specified mode using arrow keys (Safe Mode with Networking).

Technical Details and screenshots:

• Full name: Google Analytics Redirect Virus
• Type: Ransomware, Trojan Horse
• Origin: Russian Federation, Ukraine

Signs of Google Analytics Redirect Virus Infection:

The infection either presents fabricated Google page full of weird advertisement and providing not a bit of information the visiting webmasters (user) is looking for, or there is a redirection to another pages which may vary from case to case even for a single victimized machine.
Remarkably, victims of the scam are supposed to be rather experienced users as the above Google service targets webmasters, which are certainly quite experienced in using PC. On the other hand, running own site is not too complicated nowadays, and the service is also used by bloggers interested in statistics describing traffic related to their blogs.
Click here to start free scan and get rid of Google Analytics redirect virus, as well as other infections of rootkit and other types. If the link does not work or installation is aborted, please consult the explanation below to bypass the restrictions established by the malware.

Google Analytics Redirect Virus automatical removal:

Deletion of Google Analytics redirect virus implies removal of rootkit class malware, which is extremely dangerous as it can run out of computer system infected. No surprise the rogue often interferes with its removers on the stage of their download, installation and run.
To prevent the adware tricks, get your Windows into Safe Mode with Networking. The mode is available through Advanced Options Boot Menu. In its turn, to enter the menu, restart PC and, while Windows loading is being arranged, continuously press or repeatedly strike F8 key.

Google Analytics Redirect Virus Removal Tool

Manual Removal of Google Analytics Redirect Virus:

It is not recommended to stretch in time the procedure of manual Google Analytics redirect virus. However, haste makes waste, so please run at the middle neither postponing next step for tomorrow afternoon nor deleting the entries without properly verifying whether you have typed the names correctly.

Remove Google Analytics Redirect Virus files and dll’s:

[random].exe

Unregister Google Analytics Redirect Virus registry values:

HKLMSOFTWAREMicrosoftWindowsCurrentVersionexplorerBrowser Helper Objects{c3721e85-f0ac-4b7e-ae4c-3e738011dc9d}

Related posts:

1. Google Redirect Virus
2. Gimmeanswers redirect virus (Gimme answers)
3. Happili.com search redirect virus

West Yorkshire Police ALERT is produced by another variety of UKASH scareware. The popup authors are not residents to the UK, nothing to say they do not represent ant sort of official public security office. Click here to get a free scanner loaded onto your PC as a reliable method to get rid of West Yorkshire Police fake alert.

Technical Details and screenshots:

• Full name: West Yorkshire Police Trojan, Ransomware
• Type: Ransomware, Trojan Horse
• Origin: Russian Federation, Ukraine

Signs of West Yorkshire Police Trojan Infection:

West Yorkshire Police scam is not a brand new way of demanding money by pretending to speak on the behalf of UK governmental bodies involving such names as Scotland Yard, Metropolitan Police etc. That is to say, it has a background of similar popups which have also been made to look like official notifications of the UK government. In those popups, such names as Scotland Yard, Metropolitan Police etc.were misused.
The above fake police alert tends to lock infected PC to the utmost. In the worst case, even desktop items are unavailable.
Click here to launch free scan and and get rid of West Yorkshire Police ransomware that demands GDP 100 referring to your offending the British Law.

West Yorkshire Police Trojan automatical removal:

The ransomware is extremely aggressive. Ignoring that fact is not excused as many security tools are not able to complete their own installation under the conditions set up by the ransomware on infected machine.
The technology recommended and available below is fully viable on any PC infected by the scareware. Do not hesitate following the link below to remove West Yorkshire Police virus.

West Yorkshire Police Trojan Removal Tool

Manual Removal of West Yorkshire Police Trojan:

For some late stages of the ransomware development the manual way of its extermination will not do as the infection, in the long run, manages to protect its essentials from manual removal by user.
Get rid of West Yorkshire Police ransomware manually omitting not a single entry; despite being unable to complete the infection’s payload, any individual component still may cause damage and inconvenience.

Remove West Yorkshire Police Trojan files and dll’s:

[random].exe

Unregister West Yorkshire Police Trojan registry values:

HKLMSOFTWAREMicrosoftWindowsCurrentVersionexplorerBrowser Helper Objects{c3721e85-f0ac-4b7e-ae4c-3e738011dc9d}

Related posts:

1. Metropolitan Police Ukash virus
2. Strathclyde Police UKASH virus
3. Windows Police Pro

Total Anti Malware Protection runs fake scanner and produces alerts on its background. It provides extended comments on threats allegedly detected.
Get rid of Total Anti Malware Protection as a virus under the guise of a program that by its nature must oppose viruses. That is, the rogue fakes a security suite for computer systems.
Failure to free your PC of the rogue enables the parasite to badly annoy you and seriously corrupt host system. In the long run, the malware is deadly for operting systems it infects.  Here you will get a free scan tool to delete the annoying and misleading application.

Technical Details and screenshots:

• Full name: Total Anti Malware Protection, Total AntiMalware Protection, Total Anti-Malware Protection
• Type: Rogue Security Software, Trojan Horse
• Origin: Russian Federation, Ukraine

Signs of Total Anti Malware Protection Infection:

Scarcity of symptoms betraying the rogue is rather unlikely situation for the rogue antispyware upon its installation. However, there are pre-installation symptoms requiring explanations and antivirus treatment.
In particular, where the malware is downloaded through fake online scanner, user may deal with browser hijacker, a part of the infection that may be loaded on its own and represent independent functionality. The hijacker is inside your PC, if you experience recurrent loading of fake online scanners mentioning the above malware name.
Start free scan with antimalware available here to remove Total Anti Malware Protection hijacker or full-featured malware.

Total Anti Malware Protection automatical removal:

A lot of real infections are likely to swarm on your working station as the fake ignores real viruses and trojans palming off misleading infections on you. The remover below is a free scan powered solution to remove Total Anti Malware Protection and real infections at once.

Total Anti Malware Protection Removal Tool

Manual Removal of Total Anti Malware Protection:

The fake, if dropped by special trojan which payload includes loading malicious content, is likely to be just one of the few threats dropped by its installer. Hence, if you get rid of Total Anti Malware Protection only, you are still at risk with your computer safety as other threats may remain.
Even if you prefer deleting the misleading antivirus manually, following the above link makes sense in the light of the above consideration.

Remove Total Anti Malware Protection files and dll’s:

%AllUsersProfile%\Application Data\[SET OF RANDOM CHARACTERS]\[SET OF RANDOM CHARACTERS]
%AppData%\Total Anti Malware Protection\
%AppData%\Microsoft\Internet Explorer\Quick Launch\Total Anti Malware Protection.lnk
%UserProfile%\Desktop\Total Anti Malware Protection\
%UserProfile%\Start Menu\Total Anti Malware Protection\
%UserProfile%\Start Menu\Programs\Total Anti Malware Protection.lnk

Unregister Total Anti Malware Protection registry values:

HKEY_CURRENT_USER\software\Microsoft\Windows\CurrentVersion\Run\Total Anti Malware Protection = “%AllUsersProfile%\Application Data\a2r3fq\FPa1a_7294.exe” /s /d
HKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Image File Execution Options\[RANDOM].exe\Debugger = svchost.exe
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = 01000000
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\[1...15]

Related posts:

1. Total Virus Protection
2. Malware Protection
3. Personal Anti Malware

Data Recovery is a popular feature for computer system. This notion is now serving as a name of rogue antispyware, a variant of advertisement virus known as S.M.A.R.T. malware.
Here you will download and install free scanner to get rid of Date Recovery, if the intrusive parasite has managed to infiltrate into your machine.

Technical Details and screenshots:

• Full name: Data Recovery, S.M.A.R.T. Data Recovery, DataRecovery, Data-Recovery
• Type: Rogue Security Software, Trojan Horse
• Origin: Russian Federation, Ukraine

 
Signs of Data Recovery Infection:

There are plenty of popups clearly indicating the adware’s presence. The two most notable markers for the infection are fake scan windows called S.M.A.R.T. Check and fake fix window called S.M.A.R.T. Repair.
On their background, a number of alerts are popping up in every corner of your monitor.
Click here to detect the parasite technically, i.e. locate its components, and remove Data Recovery as another misleading system optimizer.

Data Recovery automatical removal:

In order to remove Data Recovery malware fake optimizer, as well as to clean your PC of other detected infections, please activate the free scan link below.

Data Recovery Removal Tool

Manual Removal of Data Recovery:

It is not a secret that infections often come bundled with each other, the rogue in question is not something exceptional. In the light of this remark, please remember the manual will rid your PC of Data Recovery adware only.

Remove Data Recovery files and dll’s:

%CommonAppData%\~{random}
%CommonAppData%\{random}
%CommonAppData%\{random}.exe
%AppData%\Microsoft\Internet Explorer\Quick Launch\Data Recovery.lnk
%Desktop%\Data Recovery.lnk
%StartMenu%\Programs\Data Recovery\
%StartMenu%\Programs\Data Recovery\Data Recovery.lnk
%StartMenu%\Programs\System Check\Uninstall Data Recovery.lnk

Unregister Data Recovery registry values:

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main “Use FormSuggest” = ‘Yes’
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings “CertificateRevocation” = ’0′
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings “WarnonBadCertRecving” = ’0′
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop “NoChangingWallPaper” = ’1′
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations “LowRiskFileTypes” = .zip;.rar;.nfo;.txt;.exe;.bat;.com;.cmd;.reg;.msi;.htm;.html;.gif;.bmp;.jpg;.avi;.mpg;.mpeg;.mov;.mp3;.m3u;.wav;.scr;’
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments “SaveZoneInformation” = ’1′
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer “NoDesktop” = ’1′
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System “DisableTaskMgr” = ’1′
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “{random}.exe”
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “{random}”
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system “DisableTaskMgr” = ’1′
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download “CheckExeSignatures” = ‘no’
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced “Hidden” = ’0′
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced “ShowSuperHidden” = ’0′

Related posts:

1. Data Recovery virus
2. System Recovery
3. Windows XP Recovery

Trojan:DOS/Alureon.E represents a family of infections focused on stealing confidential info on your computer system. It is installed as a VBR i.e. the infection is introduced into your boot area. That seriously aggravates its extermination. Here you will find a free scanner to get rid of Trojan:DOS/Alureon.E and thus protect the data private only to you.

Technical Details and screenshots:

• Full name: Trojan:DOS/Alureon.E, Alureon.E,
• Type: Trojan horse, Virus
• Risk: EXTREME
• Trojan:DOS/Alureon.E Manual removal: Possible
• Trojan:DOS/Alureon.E automated removal: Recommended

Signs of being infected with Trojan:DOS/Alureon.E

The rogue is a rootkit protected malware. That is, its components are hidden from operating system. Moreover, the infection does not allow Windows to learn details of digital signatures for drives on your PC.
A typical symptom available for unaided eye associated with rogue is that operating system fails to boot from time to time.
Click here to remove Trojan:DOS/Alureon.E and other members of this and different strains of malware.

Trojan:DOS/Alureon.E automatical removal:

The tool below is a properly armored solution to protect its own components from the aggressive rootkit. Do not hesitate following the link below to delete Trojan:DOS/Alureon.E.

Trojan:DOS/Alureon.E Removal Tool

Manual Removal of Trojan:DOS/Alureon.E:

The guide will walk you through the steps of the rootkit exterminations. Please perform the cleaning action according to the order they are listed below.

Remove Trojan:DOS/Alureon.E files and dll’s:

%AllUsersProfile%\~
%AllUsersProfile%\~r
%AllUsersProfile%\.dll
%AllUsersProfile%\.exe
%AllUsersProfile%\
%AllUsersProfile%\.exe

Unregister Trojan:DOS/Alureon.E registry values:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “.exe”
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “”
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings “CertificateRevocation” = ’0′
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings “WarnonBadCertRecving” = ’0′
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop “NoChangingWallPaper” = ’1′
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations “LowRiskFileTypes” = ‘/{hq:/s`s:/ogn:/uyu:/dyd:/c`u:/bnl:/ble:/sdf:/lrh:/iul:/iulm:/fhg:/clq:/kqf:/`wh:/lqf:/lqdf:/lnw:/lq2:/l2t:/v`w:/rbs:’
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments “SaveZoneInformation” = ’1′
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System “DisableTaskMgr” = ’1′
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system “DisableTaskMgr” = ’1′
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download “CheckExeSignatures” = ‘no’
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main “Use FormSuggest” = ‘yes’
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced “Hidden” = ’0′
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced “ShowSuperHidden” = 0′

Related posts:

1. Trojan:DOS/Alureon
2. Trojan Horse Crypt.AQLW
3. Conflicker.B Spam Trojan

Windows Antivirus 2012 is chiefly known as its online version. To be precise, it is a link of a website and browser hijacker.
The hijacker is dropped by using botnet technologies, exploiting Java runtime vulnerabilities, with spam etc. Its only task is to connect user to the fake online scanner bearing the name of above program.
If you have been scared to, or die to other considerations agreed on, the malware loading, or if you are dealing with the online fake scanner, this free scan here link will remove Windows Antivirus 2012 whether hijacker or fake antispyware is understood.

Technical Details and screenshots:

• Full name: Windows Antivirus 2012, Windows-Antivirus 2012, WindowsAntivirus 2012, Win Antivirus 2012
• Type: Rogue Security Software, Trojan Horse
• Origin: Russian Federation, Ukraine

Windows Antivirus 2012 automatical removal:

The malware in question significantly deteriorates your PC performance. To help the damage caused by the rogue, as well as clean your PC of other threats, many of which have probably managed to enter your PC due to the corrupting impact of the malware in question, please do not hesitate following the link below to remove Windows Antivirus 2012.

Windows Antivirus 2012 Removal Tool

Manual Removal of Windows Antivirus 2012:

In order to remove Windows Antivirus 2012 manually it is of critical importance that you delete the entries exactly as specified below. Please check them properly to avoid mistyping.

Remove Windows Antivirus 2012 files and dll’s:

%CommonAppData%\~[random]
%CommonAppData%\~[random]
%CommonAppData%\~[random]
%CommonAppData%\[random].exe

Unregister Windows Antivirus 2012 registry values:

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main “Use FormSuggest” = ‘Yes’
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings “CertificateRevocation” = ’0′
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings “WarnonBadCertRecving” = ’0′
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop “NoChangingWallPaper” = ’1′

Related posts:

1. Smart Fortress 2012
2. Cloud AV 2012 (Cloud Antivirus 2012)
3. Antivirus Protection 2012

Trojan Horse Crypt.AQLW is hidden from common detecting methods as the infection is hardly coded. On the other hand, its composition reminds that of system executables so that many security solutions simply abandon the infection as they are instructed to treat system items as harmless by default.
Here you will download free scanner for trouble-free detection of the complicated threat so that the security solution could remove Trojan Horse Crypt.AQLW.

Technical Details and screenshots:

• Full name: Trojan Horse Crypt.AQLW
• Type: Trojan horse, Virus
• Risk: EXTREME
• Trojan Horse Crypt.AQLW Manual removal: Possible
• Trojan Horse Crypt.AQLW automated removal: Recommended

Signs of being infected with Trojan Horse Crypt.AQLW

There are plenty of after-effects associated with the infection. However, it listens to remote server, thus is flexible to learn new tasks while staying resident to compromised PC.
Slow computer problem, failure of multiple applications to run, connectivity issues, loss of data are common symptoms of the malware. Naturally these cannot serve as a unique identifier. The only method to ensure the infection is rooted into your PC is to apply advanced free scanner available here. Get rid of Trojan Horse Crypt.AQLW cleaning all the infections as provided by the free scanner.

Trojan Horse Crypt.AQLW automatical removal:

The cleaning solution available below applies alternate extermination routine that offers higher standards of detection and extermination than the one in question. Remove Trojan Horse Crypt.AQLW by deleting the items specified by the detecting utility below.

Trojan Horse Crypt.AQLW Removal Tool

Manual Removal of Trojan Horse Crypt.AQLW:

Manual deletion need to cover all variants of the threat. This results in excessive number of files to check and exterminate and makes the manual way to get rid of Trojan Horse Crypt.AQLW rather impracticable.

Remove Trojan Horse Crypt.AQLW files and dll’s:

%AllUsersProfile%\~
%AllUsersProfile%\~r
%AllUsersProfile%\.dll
%AllUsersProfile%\.exe
%AllUsersProfile%\
%AllUsersProfile%\.exe

Unregister Trojan Horse Crypt.AQLW registry values:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “.exe”
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “”
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings “CertificateRevocation” = ’0′
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings “WarnonBadCertRecving” = ’0′
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop “NoChangingWallPaper” = ’1′
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations “LowRiskFileTypes” = ‘/{hq:/s`s:/ogn:/uyu:/dyd:/c`u:/bnl:/ble:/sdf:/lrh:/iul:/iulm:/fhg:/clq:/kqf:/`wh:/lqf:/lqdf:/lnw:/lq2:/l2t:/v`w:/rbs:’
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments “SaveZoneInformation” = ’1′
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System “DisableTaskMgr” = ’1′
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system “DisableTaskMgr” = ’1′
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download “CheckExeSignatures” = ‘no’
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main “Use FormSuggest” = ‘yes’
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced “Hidden” = ’0′
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced “ShowSuperHidden” = 0′

 

Related posts:

1. Conflicker.B Spam Trojan
2. Trojan-Downloader.Win32.Delf.cgx
3. Trojan:DOS/Alureon

Gimmeanswers.org redirect virus is selective in attracting users to its facilities. For IPs resident to certain countries of the Third World the website is not available, or they are presented with bizarre image like squinting cats on the background of the moon accompanied with the caption running “I have been expecting you”.
IPs located in all other countries make a target audience for the virus, which in that case loads full-featured version of the website. The infection tends to load its sponsored url instead of Google thus interfering with user’s searches. To get rid of Gimmeanswers.org redirect virus and other malicious items as detected by free scanner, follow this link.

Technical Details and screenshots:

• Full name: Gimmeanswers redirection malware, Gimmeanswers.org, Gimme answers, Gimmeanswers.com
• Type: Browser hijacker, Redirect virus, Adware
• Origin: Russian Federation, Ukraine

Signs of being infected with Gimmeanswers redirection malware

Gimmeanswers.org pretends to do a job of Google. Visitors of this website are brought to this url as they are trying to get answers from common search engines. The reason why they see the unexpected substitution is the virus.
In the other words, is clearly and unambiguously detectable by redirects of Google and other websites leading to the same-name page. Free scan routine available here will enable user to remove Gimmeanswers.org redirect virus, as well as other threats to your PC safety and convenience of use.

Gimmeanswers redirection malware automatical removal:

The redirect virus deals with various aspects of computer system. In the long run, it corrupts it badly so that lingering when infected with the virus is not a good tactic to follow. Follow the link below to get rid of Gimmeanswers.org virus in shortest terms, yet covering the entire memory space to ensure ultimate disinfection.

Gimmeanswers redirection malware Removal Tool

Manual Removal of Gimmeanswers redirection malware:

Remove Gimmeanswers.org virus manually to browse the web without annoying redirects. Please note the guide is updated as soon as new data is available on the virus modifications. To ensure complete computer cleanup, please refer to the section above.

Remove Gimmeanswers redirection malware files and dll’s:

%CommonAppData%\<random 33 characters>
%CommonAppData%\<random 33 characters>\<random 33 characters>
%CommonAppData%\<random 33 characters>\<random 33 characters>.exe

Unregister Gimmeanswers redirection malware registry values:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce “<random>”
HKEY_CURRENT_USER\Software\Classes\<random 4 characters>
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\{a2a9545d-a0c2-42b4-9708-a0b2badd77c8}
HKEY_CLASSES_ROOT\<random 4 characters>
HKEY_USERS\S-1-5-21-861567501-152049171-1708537768-1003_Classes\%s “(Default)” = “<random 4 characters>”
HKEY_USERS\S-1-5-21-861567501-152049171-1708537768-1003_Classes\<random 4 characters>\shell\open\command “(Default)” = “%CommonAppData%\<random 33 characters>\<random 33 characters>.exe” -s “%1″ %*
HKEY_CURRENT_USER\Software\Classes\.exe “(Default)” = “<random 4 characters>”
HKEY_CURRENT_USER\Software\Classes\<random 4 characters>\shell\open\command “(Default)” = “%CommonAppData%\<random 33 characters>\<random 33 characters>.exe” -s “%1″ %*

Related posts:

1. Happili.com search redirect virus
2. Searchnu.com redirection virus
3. Google Redirect Virus