Friday
2008-11-30, 14:56
The following instructions have been created to help you to get rid of "iPhox" manually.
Use this guide at your own risk; software should usually be better suited to remove malware, since it is able to look deeper.
If this guide was helpful to you, please consider donating towards this site (http://www.safer-networking.org/index.php?page=donate).
Threat Details:
Categories:
pups
Description:
Link to privacy shows a 404 error although the website works fine and the EULA is delivered with the application --> intentionally no Privacy Policy statement.
Also gets advertised via trojan horses like WarezP2P.
Supposed Functionality:
Appears to be a valid IP-phone application, compareable to Skype
Removal Instructions:
Quicklaunch area:
Please remove the following items from your start quick launch area text to the "Start" button in the taskbar at the bottom.
To check where they are pointing to, right-click them and choose "Properties" from the context menu appearing.
Quicklaunch symbols named "iPhox.lnk" and pointing to "<$PROGRAMFILES>\iPhox\iphox_downloader_p.exe".
Quicklaunch symbols named "iPhox.lnk" and pointing to "<$PROGRAMFILES>\iPhox\iPhox.exe".
Autorun:
Please use Spybot-S&D (http://www.safer-networking.org/index.php?page=spybotsd), RunAlyzer (http://www.safer-networking.org/index.php?page=runalyzer) or msconfig.exe to remove the following autorun entries.
Entries named "iPhox" and pointing to "<$PROGRAMFILES>\iPhox\iPhox.exe".
Installed Software List:
You can try to uninstall products with the names listed below; for items identified by other properties or to avoid malware getting active again on uninstallation, use Spybot-S&D (http://www.safer-networking.org/index.php?page=spybotsd) or RunAlyzer (http://www.safer-networking.org/index.php?page=runalyzer) to locate and get rid of these entries.
Products that have a key or property named "iPhox".
Files:
Please use Windows Explorer or another file manager of your choice to locate and delete these files.
The file at "<$PROGRAMS>\iPhox\iPhox.lnk".
The file at "<$PROGRAMFILES>\iPhox\iphox.ico".
The file at "<$PROGRAMFILES>\iPhox\iphox_downloader_p.exe".
The file at "<$DESKTOP>\iPhox.lnk".
The file at "<$PROGRAMFILES>\iPhox\audio_clips\recording_conversation.wav".
The file at "<$PROGRAMFILES>\iPhox\audio_clips\ring.wav".
The file at "<$PROGRAMFILES>\iPhox\audio_clips\ringback.wav".
The file at "<$PROGRAMFILES>\iPhox\audio_clips\stop_recording_conversation.wav".
The file at "<$PROGRAMFILES>\iPhox\avatars\animal1.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\animal10.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\animal2.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\animal3.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\animal4.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\animal5.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\animal6.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\animal7.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\animal8.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\baby.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\badge.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\basketball_2.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\be_mine.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\bear.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\bird.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\cat_1.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\cat_2.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\cat_3.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\cat_4.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\cat_5.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\cheeseburger.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\cow_1.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\default_female.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\default_male.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\duckling.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\eagle_1.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\elephant.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\eye.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\farside1.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\farside2.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\farside3.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\farside4.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\farside6.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\fish_2.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\flag.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\flower_1.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\flower_3.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\flower_4.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\flower_pot.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\flower1.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\flowew2.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\giraffe.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\goat.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\golf.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\horse.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\japanime1.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\japanime2.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\japanime3.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\japanime4.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\japanime5.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\jl_superman.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\jl_wonderwoman.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\jp_cart1.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\jp_cart2.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\jp_cart4.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\jp_cart5.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\jp_cart6.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\kid1.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\kid10.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\kid11.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\kid12.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\kid13.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\kid14.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\kid15.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\kid2.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\kid3.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\kid4.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\kid5.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\kid6.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\kid7.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\kid8.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\kid9.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\kidsA.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\kidsB.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\kidsC.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\kidsD.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\kidsE.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\kidsF.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\kidsG.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\kidsH.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\kidsJ.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\kidsK.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\kidsL.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\kidsM.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\kidsN.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\kidsO.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\kidsP.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\kidsQ.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\kidsR.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\kidsS.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\ladybug.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\lemmer.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\lips.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\lizard.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\meditation.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\palmtree.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\panda_cart1.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\panda_cart2.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\photo_baseball.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\photo_basketball.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\photo_butterfly.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\photo_butterfly1.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\photo_dog.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\photo_eightball.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\photo_fish.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\photo_flower.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\photo_flower1.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\photo_flower2.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\photo_flower3.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\photo_flower4.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\photo_flower5.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\photo_flower6.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\photo_flower7.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\photo_flower9.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\photo_golf.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\photo_sign_metro.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\photo_sign_phone.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\photo_sign_roundabout.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\photo_sign_yield.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\photo_soccerball.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\pisa.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\pooch.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\pooch_1.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\pooch_2.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\pooch_3.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\pooch_5.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\pooch_6.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\pooch_8.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\popsicle.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\Rose.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\san_fran.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\sandles.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\sign_1.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\sign_2.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\sign_metro.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\sign_walk.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\skiing_1.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\summer_starfish.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\surfing.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\toad.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\trans_1.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\trans2.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\trans3.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\vegas_7.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\vegas_spade.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\vegas3.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\wakeboard.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\watermelon.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\woman_1.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\zanny1.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\zanny2.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\zanny3.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\zanny4.gif".
The file at "<$PROGRAMFILES>\iPhox\hold_music\Classical.wav".
The file at "<$PROGRAMFILES>\iPhox\hold_music\Dance.wav".
The file at "<$PROGRAMFILES>\iPhox\hold_music\Dreamy.wav".
The file at "<$PROGRAMFILES>\iPhox\hold_music\Electric 80's.wav".
The file at "<$PROGRAMFILES>\iPhox\hold_music\Funky 70's.wav".
The file at "<$PROGRAMFILES>\iPhox\hold_music\Metal.wav".
The file at "<$PROGRAMFILES>\iPhox\hold_music\Piano Happy.wav".
The file at "<$PROGRAMFILES>\iPhox\hold_music\Piano Mellow.wav".
The file at "<$PROGRAMFILES>\iPhox\interface_sounds\Call.wav".
The file at "<$PROGRAMFILES>\iPhox\interface_sounds\Hangup.wav".
The file at "<$PROGRAMFILES>\iPhox\interface_sounds\Login.wav".
The file at "<$PROGRAMFILES>\iPhox\interface_sounds\MessageIn.wav".
The file at "<$PROGRAMFILES>\iPhox\interface_sounds\MessageOut.wav".
The file at "<$PROGRAMFILES>\iPhox\interface_sounds\Ring.wav".
The file at "<$PROGRAMFILES>\iPhox\interface_sounds\ToggleDialpad.wav".
The file at "<$PROGRAMFILES>\iPhox\message_styles\h4x0r\Info.plist".
The file at "<$PROGRAMFILES>\iPhox\message_styles\h4x0r\main.css".
The file at "<$PROGRAMFILES>\iPhox\message_styles\h4x0r\msg_admin.html".
The file at "<$PROGRAMFILES>\iPhox\message_styles\h4x0r\msg_in.html".
The file at "<$PROGRAMFILES>\iPhox\message_styles\h4x0r\msg_in_historical.html".
The file at "<$PROGRAMFILES>\iPhox\message_styles\h4x0r\msg_in_next.html".
The file at "<$PROGRAMFILES>\iPhox\message_styles\h4x0r\msg_in_next_historical.html".
The file at "<$PROGRAMFILES>\iPhox\message_styles\h4x0r\msg_out.html".
The file at "<$PROGRAMFILES>\iPhox\message_styles\h4x0r\msg_out_historical.html".
The file at "<$PROGRAMFILES>\iPhox\message_styles\h4x0r\msg_out_next.html".
The file at "<$PROGRAMFILES>\iPhox\message_styles\h4x0r\msg_out_next_historical.html".
The file at "<$PROGRAMFILES>\iPhox\message_styles\h4x0r\images\bg.gif".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\Info.plist".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\main.css".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\msg_admin.html".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\msg_in.html".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\msg_in_historical.html".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\msg_in_next.html".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\msg_in_next_historical.html".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\msg_out.html".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\msg_out_historical.html".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\msg_out_next.html".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\msg_out_next_historical.html".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\images\alert.png".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\images\blueBackground.gif".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\images\blueCurves.gif".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\images\blueIndicator.gif".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\images\blueIndicator.png".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\images\blueIndicatorAlt.gif".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\images\DummyContact.png".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\images\greenBackground.gif".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\images\greenCurves.gif".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\images\greenIndicator.gif".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\images\greenIndicatorAlt.gif".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\images\redBackground.gif".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\images\redCurves.gif".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\images\redIndicator.gif".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\images\redIndicatorAlt.gif".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\images\silverBackground.gif".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\images\silverCurves.gif".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\images\steelBackground.gif".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\images\steelCurves.gif".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\images\steelHeading.jpg".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\images\steelIndicator.gif".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\images\steelIndicatorAlt.gif".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\images\typing-left.png".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\images\typing-right.png".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\images\yellowBackground.gif".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\images\yellowCurves.gif".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\images\yellowHeading.jpg".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\images\yellowIndicator.gif".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\images\yellowIndicatorAlt.gif".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\variants\BlueRed Alternating.css".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\variants\BlueRed.css".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\variants\BlueSteel Alternating.css".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\variants\BlueSteel.css".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\variants\GreenRed Alternating.css".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\variants\GreenRed.css".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\variants\GreenYellow Alternating.css".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\variants\GreenYellow.css".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\variants\RedGreen Alternating.css".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\variants\RedGreen.css".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\variants\RedSteel Alternating.css".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\variants\RedSteel.css".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\variants\SteelBlue Alternating.css".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\variants\SteelBlue.css".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\variants\SteelGreen Alternating.css".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\variants\SteelGreen.css".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\variants\SteelRed Alternating.css".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\variants\SteelRed.css".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\variants\YellowGreen Alternating.css".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\variants\YellowGreen.css".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\variants\YellowRed Alternating.css".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\variants\YellowRed.css".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Simple\Info.plist".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Simple\main.css".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Simple\msg_admin.html".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Simple\msg_in.html".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Simple\msg_in_historical.html".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Simple\msg_in_next.html".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Simple\msg_in_next_historical.html".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Simple\msg_out.html".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Simple\msg_out_historical.html".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Simple\msg_out_next.html".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Simple\msg_out_next_historical.html".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Simple\images\BackdropLogo.png".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Simple\images\BackdropLogoxx.png".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Simple\variants\Green and Blue.css".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Simple\variants\Orange and Blue.css".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Simple\variants\Orange and Green.css".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Simple\variants\Orange and Purple.css".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Simple\variants\Red and Blue.css".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Simple\variants\Red and Green.css".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Simple\variants\Red and Orange.css".
The file at "<$PROGRAMFILES>\iPhox\n3_emoticons\n3_angry.gif".
The file at "<$PROGRAMFILES>\iPhox\n3_emoticons\n3_asleep.gif".
The file at "<$PROGRAMFILES>\iPhox\n3_emoticons\n3_confused.gif".
The file at "<$PROGRAMFILES>\iPhox\n3_emoticons\n3_cool.gif".
The file at "<$PROGRAMFILES>\iPhox\n3_emoticons\n3_crying.gif".
The file at "<$PROGRAMFILES>\iPhox\n3_emoticons\n3_disgusted.gif".
The file at "<$PROGRAMFILES>\iPhox\n3_emoticons\n3_dizzy.gif".
The file at "<$PROGRAMFILES>\iPhox\n3_emoticons\n3_evil.gif".
The file at "<$PROGRAMFILES>\iPhox\n3_emoticons\n3_fear.gif".
The file at "<$PROGRAMFILES>\iPhox\n3_emoticons\n3_glad.gif".
The file at "<$PROGRAMFILES>\iPhox\n3_emoticons\n3_grin.gif".
The file at "<$PROGRAMFILES>\iPhox\n3_emoticons\n3_grumpy.gif".
The file at "<$PROGRAMFILES>\iPhox\n3_emoticons\n3_happy.gif".
The file at "<$PROGRAMFILES>\iPhox\n3_emoticons\n3_horny.gif".
The file at "<$PROGRAMFILES>\iPhox\n3_emoticons\n3_ill.gif".
The file at "<$PROGRAMFILES>\iPhox\n3_emoticons\n3_inlove.gif".
The file at "<$PROGRAMFILES>\iPhox\n3_emoticons\n3_innocent.gif".
The file at "<$PROGRAMFILES>\iPhox\n3_emoticons\n3_ironic.gif".
The file at "<$PROGRAMFILES>\iPhox\n3_emoticons\n3_kiss.gif".
The file at "<$PROGRAMFILES>\iPhox\n3_emoticons\n3_LOL.gif".
The file at "<$PROGRAMFILES>\iPhox\n3_emoticons\n3_okay.gif".
The file at "<$PROGRAMFILES>\iPhox\n3_emoticons\n3_perplex.gif".
The file at "<$PROGRAMFILES>\iPhox\n3_emoticons\n3_sad.gif".
The file at "<$PROGRAMFILES>\iPhox\n3_emoticons\n3_shocked.gif".
The file at "<$PROGRAMFILES>\iPhox\n3_emoticons\n3_shy.gif".
The file at "<$PROGRAMFILES>\iPhox\n3_emoticons\n3_stuart.gif".
The file at "<$PROGRAMFILES>\iPhox\n3_emoticons\n3_tongue.gif".
The file at "<$PROGRAMFILES>\iPhox\n3_emoticons\n3_unsure.gif".
The file at "<$PROGRAMFILES>\iPhox\n3_emoticons\n3_whistling.gif".
The file at "<$PROGRAMFILES>\iPhox\n3_emoticons\n3_wink.gif".
The file at "<$PROGRAMFILES>\iPhox\n3_emoticons\n3_wondering.gif".
The file at "<$PROGRAMFILES>\iPhox\Resources\1028\AppResources.zht.dll".
The file at "<$PROGRAMFILES>\iPhox\Resources\1033\AppResources.dll".
The file at "<$PROGRAMFILES>\iPhox\Resources\1034\AppResources.es.dll".
The file at "<$PROGRAMFILES>\iPhox\Resources\1036\AppResources.fr.dll".
The file at "<$PROGRAMFILES>\iPhox\Resources\1040\AppResources.it.dll".
The file at "<$PROGRAMFILES>\iPhox\Resources\2052\AppResources.zhs.dll".
The file at "<$PROGRAMFILES>\iPhox\sound_emoticons\alarm.wav".
The file at "<$PROGRAMFILES>\iPhox\sound_emoticons\birds.wav".
The file at "<$PROGRAMFILES>\iPhox\sound_emoticons\boing.wav".
The file at "<$PROGRAMFILES>\iPhox\sound_emoticons\boo.wav".
The file at "<$PROGRAMFILES>\iPhox\sound_emoticons\gong.wav".
The file at "<$PROGRAMFILES>\iPhox\sound_emoticons\horse.wav".
The file at "<$PROGRAMFILES>\iPhox\sound_emoticons\laughing.wav".
The file at "<$PROGRAMFILES>\iPhox\sound_emoticons\thunder.wav".
The file at "<$PROGRAMFILES>\iPhox\sound_emoticons\tiger.wav".
The file at "<$PROGRAMFILES>\iPhox\sound_emoticons\tires.wav".
The file at "<$PROGRAMFILES>\iPhox\sound_emoticons\typewriter.wav".
The file at "<$PROGRAMFILES>\iPhox\system_avatars\avatar_conference.gif".
The file at "<$PROGRAMFILES>\iPhox\system_avatars\avatar_echo.gif".
The file at "<$PROGRAMFILES>\iPhox\system_avatars\avatar_echo2.gif".
The file at "<$PROGRAMFILES>\iPhox\system_avatars\avatar_gizmo.gif".
The file at "<$PROGRAMFILES>\iPhox\system_avatars\avatar_info.gif".
The file at "<$PROGRAMFILES>\iPhox\system_avatars\avatar_support.gif".
The file at "<$PROGRAMFILES>\iPhox\system_avatars\avatar_welcome.gif".
The file at "<$PROGRAMFILES>\iPhox\system_avatars\avatar_yahoo2.gif".
The file at "<$PROGRAMFILES>\iPhox\system_avatars\star_star.gif".
The file at "<$LOCALSETTINGS>\Temp\WinIphoxInstall.exe".
The file at "<$PROGRAMS>\iPhox\iPhox Web Page.lnk".
The file at "<$PROGRAMS>\iPhox\Uninstall.lnk".
The file at "<$PROGRAMFILES>\iPhox\AppUpgrade.exe".
The file at "<$PROGRAMFILES>\iPhox\BrandResources.dll".
The file at "<$PROGRAMFILES>\iPhox\dnssd.dll".
The file at "<$PROGRAMFILES>\iPhox\EULA.rtf".
The file at "<$PROGRAMFILES>\iPhox\gdiplus.dll".
The file at "<$PROGRAMFILES>\iPhox\GizmoOpts.Ini".
The file at "<$PROGRAMFILES>\iPhox\IdleHook.dll".
The file at "<$PROGRAMFILES>\iPhox\iPhox.exe".
The file at "<$PROGRAMFILES>\iPhox\libeay32.dll".
The file at "<$PROGRAMFILES>\iPhox\mDNSResponder.exe".
The file at "<$PROGRAMFILES>\iPhox\n3_credits.txt".
The file at "<$PROGRAMFILES>\iPhox\README.txt".
The file at "<$PROGRAMFILES>\iPhox\SipphoneAPI.dll".
The file at "<$PROGRAMFILES>\iPhox\ssleay32.dll".
The file at "<$PROGRAMFILES>\iPhox\TurnOffBonjour.exe".
The file at "<$PROGRAMFILES>\iPhox\uninst.exe".
The file at "<$PROGRAMFILES>\iPhox\uninstall.ico".
The file at "<$DESKTOP>\iPhox.lnk".
The file at "<$PROGRAMS>\iPhox\iPhox.lnk".
Make sure you set your file manager to display hidden and system files. If iPhox uses rootkit technologies, use our RootAlyzer (http://forums.spybot.info/downloads.php?id=8) or our Total Commander anti-rootkit plugins (http://forums.spybot.info/downloads.php?id=3).
You will have to use a global search for files without a name specified. Be extra careful, because just the name might not be enough to identify files!
Folders:
Please use Windows Explorer or another file manager of your choice to locate and delete these folders.
The directory at "<$PROGRAMS>\iPhox".
The directory at "<$PROGRAMFILES>\iPhox".
The directory at "<$PROGRAMFILES>\iPhox\audio_clips".
The directory at "<$PROGRAMFILES>\iPhox\avatars".
The directory at "<$PROGRAMFILES>\iPhox\hold_music".
The directory at "<$PROGRAMFILES>\iPhox\interface_sounds".
The directory at "<$PROGRAMFILES>\iPhox\message_styles".
The directory at "<$PROGRAMFILES>\iPhox\message_styles\h4x0r".
The directory at "<$PROGRAMFILES>\iPhox\message_styles\h4x0r\images".
The directory at "<$PROGRAMFILES>\iPhox\message_styles\h4x0r\variants".
The directory at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo".
The directory at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\images".
The directory at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\variants".
The directory at "<$PROGRAMFILES>\iPhox\message_styles\Simple".
The directory at "<$PROGRAMFILES>\iPhox\message_styles\Simple\images".
The directory at "<$PROGRAMFILES>\iPhox\message_styles\Simple\variants".
The directory at "<$PROGRAMFILES>\iPhox\n3_emoticons".
The directory at "<$PROGRAMFILES>\iPhox\Resources".
The directory at "<$PROGRAMFILES>\iPhox\Resources\1028".
The directory at "<$PROGRAMFILES>\iPhox\Resources\1033".
The directory at "<$PROGRAMFILES>\iPhox\Resources\1034".
The directory at "<$PROGRAMFILES>\iPhox\Resources\1036".
The directory at "<$PROGRAMFILES>\iPhox\Resources\1040".
The directory at "<$PROGRAMFILES>\iPhox\Resources\2052".
The directory at "<$PROGRAMFILES>\iPhox\sound_emoticons".
The directory at "<$PROGRAMFILES>\iPhox\system_avatars".
Make sure you set your file manager to display hidden and system files. If iPhox uses rootkit technologies, use our RootAlyzer (http://forums.spybot.info/downloads.php?id=8) or our Total Commander anti-rootkit plugins (http://forums.spybot.info/downloads.php?id=3).
You will have to use a global search for files without a name specified. Be extra careful, because just the name might not be enough to identify folders!
Registry:
You can use regedit.exe (included in Windows) to locate and delete these registry entries.
Delete the registry key "iPhox" at "HKEY_CURRENT_USER\Software\".
A key in HKEY_CLASSES_ROOT\ named "iphox", plus associated values.
Delete the registry key "iPhox.exe" at "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\".
Delete the registry value "<$PROGRAMFILES>\iPhox\iPhox.exe" at "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\".
Delete the registry value "<$PROGRAMFILES>\iPhox\mDNSResponder.exe" at "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\".
Delete the registry value "<$PROGRAMFILES>\iPhox\iPhox.exe" at "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\".
Delete the registry value "<$PROGRAMFILES>\iPhox\mDNSResponder.exe" at "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\".
Delete the registry value "<$PROGRAMFILES>\iPhox\iPhox.exe" at "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\".
Delete the registry value "<$PROGRAMFILES>\iPhox\mDNSResponder.exe" at "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\".
If iPhox uses rootkit technologies, use our RegAlyzer (http://www.safer-networking.org/index.php?page=regalyzer), RootAlyzer (http://forums.spybot.info/downloads.php?id=8) or our Total Commander anti-rootkit plugins (http://forums.spybot.info/downloads.php?id=3).
Final Words:
If neither Spybot-S&D nor self help did resolve the issue or you would prefer one on one help,
Please read these instructions (http://forums.spybot.info/showthread.php?t=288) before requesting assistance,
Then start your own thread in the Malware Removal Forum (http://forums.spybot.info/forumdisplay.php?f=22) where a volunteer analyst will advise you as soon as available.
Use this guide at your own risk; software should usually be better suited to remove malware, since it is able to look deeper.
If this guide was helpful to you, please consider donating towards this site (http://www.safer-networking.org/index.php?page=donate).
Threat Details:
Categories:
pups
Description:
Link to privacy shows a 404 error although the website works fine and the EULA is delivered with the application --> intentionally no Privacy Policy statement.
Also gets advertised via trojan horses like WarezP2P.
Supposed Functionality:
Appears to be a valid IP-phone application, compareable to Skype
Removal Instructions:
Quicklaunch area:
Please remove the following items from your start quick launch area text to the "Start" button in the taskbar at the bottom.
To check where they are pointing to, right-click them and choose "Properties" from the context menu appearing.
Quicklaunch symbols named "iPhox.lnk" and pointing to "<$PROGRAMFILES>\iPhox\iphox_downloader_p.exe".
Quicklaunch symbols named "iPhox.lnk" and pointing to "<$PROGRAMFILES>\iPhox\iPhox.exe".
Autorun:
Please use Spybot-S&D (http://www.safer-networking.org/index.php?page=spybotsd), RunAlyzer (http://www.safer-networking.org/index.php?page=runalyzer) or msconfig.exe to remove the following autorun entries.
Entries named "iPhox" and pointing to "<$PROGRAMFILES>\iPhox\iPhox.exe".
Installed Software List:
You can try to uninstall products with the names listed below; for items identified by other properties or to avoid malware getting active again on uninstallation, use Spybot-S&D (http://www.safer-networking.org/index.php?page=spybotsd) or RunAlyzer (http://www.safer-networking.org/index.php?page=runalyzer) to locate and get rid of these entries.
Products that have a key or property named "iPhox".
Files:
Please use Windows Explorer or another file manager of your choice to locate and delete these files.
The file at "<$PROGRAMS>\iPhox\iPhox.lnk".
The file at "<$PROGRAMFILES>\iPhox\iphox.ico".
The file at "<$PROGRAMFILES>\iPhox\iphox_downloader_p.exe".
The file at "<$DESKTOP>\iPhox.lnk".
The file at "<$PROGRAMFILES>\iPhox\audio_clips\recording_conversation.wav".
The file at "<$PROGRAMFILES>\iPhox\audio_clips\ring.wav".
The file at "<$PROGRAMFILES>\iPhox\audio_clips\ringback.wav".
The file at "<$PROGRAMFILES>\iPhox\audio_clips\stop_recording_conversation.wav".
The file at "<$PROGRAMFILES>\iPhox\avatars\animal1.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\animal10.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\animal2.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\animal3.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\animal4.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\animal5.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\animal6.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\animal7.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\animal8.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\baby.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\badge.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\basketball_2.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\be_mine.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\bear.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\bird.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\cat_1.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\cat_2.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\cat_3.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\cat_4.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\cat_5.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\cheeseburger.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\cow_1.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\default_female.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\default_male.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\duckling.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\eagle_1.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\elephant.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\eye.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\farside1.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\farside2.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\farside3.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\farside4.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\farside6.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\fish_2.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\flag.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\flower_1.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\flower_3.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\flower_4.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\flower_pot.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\flower1.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\flowew2.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\giraffe.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\goat.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\golf.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\horse.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\japanime1.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\japanime2.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\japanime3.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\japanime4.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\japanime5.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\jl_superman.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\jl_wonderwoman.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\jp_cart1.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\jp_cart2.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\jp_cart4.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\jp_cart5.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\jp_cart6.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\kid1.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\kid10.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\kid11.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\kid12.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\kid13.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\kid14.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\kid15.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\kid2.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\kid3.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\kid4.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\kid5.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\kid6.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\kid7.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\kid8.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\kid9.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\kidsA.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\kidsB.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\kidsC.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\kidsD.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\kidsE.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\kidsF.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\kidsG.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\kidsH.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\kidsJ.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\kidsK.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\kidsL.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\kidsM.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\kidsN.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\kidsO.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\kidsP.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\kidsQ.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\kidsR.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\kidsS.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\ladybug.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\lemmer.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\lips.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\lizard.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\meditation.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\palmtree.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\panda_cart1.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\panda_cart2.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\photo_baseball.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\photo_basketball.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\photo_butterfly.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\photo_butterfly1.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\photo_dog.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\photo_eightball.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\photo_fish.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\photo_flower.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\photo_flower1.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\photo_flower2.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\photo_flower3.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\photo_flower4.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\photo_flower5.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\photo_flower6.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\photo_flower7.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\photo_flower9.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\photo_golf.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\photo_sign_metro.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\photo_sign_phone.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\photo_sign_roundabout.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\photo_sign_yield.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\photo_soccerball.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\pisa.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\pooch.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\pooch_1.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\pooch_2.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\pooch_3.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\pooch_5.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\pooch_6.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\pooch_8.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\popsicle.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\Rose.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\san_fran.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\sandles.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\sign_1.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\sign_2.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\sign_metro.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\sign_walk.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\skiing_1.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\summer_starfish.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\surfing.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\toad.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\trans_1.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\trans2.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\trans3.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\vegas_7.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\vegas_spade.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\vegas3.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\wakeboard.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\watermelon.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\woman_1.jpg".
The file at "<$PROGRAMFILES>\iPhox\avatars\zanny1.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\zanny2.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\zanny3.gif".
The file at "<$PROGRAMFILES>\iPhox\avatars\zanny4.gif".
The file at "<$PROGRAMFILES>\iPhox\hold_music\Classical.wav".
The file at "<$PROGRAMFILES>\iPhox\hold_music\Dance.wav".
The file at "<$PROGRAMFILES>\iPhox\hold_music\Dreamy.wav".
The file at "<$PROGRAMFILES>\iPhox\hold_music\Electric 80's.wav".
The file at "<$PROGRAMFILES>\iPhox\hold_music\Funky 70's.wav".
The file at "<$PROGRAMFILES>\iPhox\hold_music\Metal.wav".
The file at "<$PROGRAMFILES>\iPhox\hold_music\Piano Happy.wav".
The file at "<$PROGRAMFILES>\iPhox\hold_music\Piano Mellow.wav".
The file at "<$PROGRAMFILES>\iPhox\interface_sounds\Call.wav".
The file at "<$PROGRAMFILES>\iPhox\interface_sounds\Hangup.wav".
The file at "<$PROGRAMFILES>\iPhox\interface_sounds\Login.wav".
The file at "<$PROGRAMFILES>\iPhox\interface_sounds\MessageIn.wav".
The file at "<$PROGRAMFILES>\iPhox\interface_sounds\MessageOut.wav".
The file at "<$PROGRAMFILES>\iPhox\interface_sounds\Ring.wav".
The file at "<$PROGRAMFILES>\iPhox\interface_sounds\ToggleDialpad.wav".
The file at "<$PROGRAMFILES>\iPhox\message_styles\h4x0r\Info.plist".
The file at "<$PROGRAMFILES>\iPhox\message_styles\h4x0r\main.css".
The file at "<$PROGRAMFILES>\iPhox\message_styles\h4x0r\msg_admin.html".
The file at "<$PROGRAMFILES>\iPhox\message_styles\h4x0r\msg_in.html".
The file at "<$PROGRAMFILES>\iPhox\message_styles\h4x0r\msg_in_historical.html".
The file at "<$PROGRAMFILES>\iPhox\message_styles\h4x0r\msg_in_next.html".
The file at "<$PROGRAMFILES>\iPhox\message_styles\h4x0r\msg_in_next_historical.html".
The file at "<$PROGRAMFILES>\iPhox\message_styles\h4x0r\msg_out.html".
The file at "<$PROGRAMFILES>\iPhox\message_styles\h4x0r\msg_out_historical.html".
The file at "<$PROGRAMFILES>\iPhox\message_styles\h4x0r\msg_out_next.html".
The file at "<$PROGRAMFILES>\iPhox\message_styles\h4x0r\msg_out_next_historical.html".
The file at "<$PROGRAMFILES>\iPhox\message_styles\h4x0r\images\bg.gif".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\Info.plist".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\main.css".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\msg_admin.html".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\msg_in.html".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\msg_in_historical.html".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\msg_in_next.html".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\msg_in_next_historical.html".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\msg_out.html".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\msg_out_historical.html".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\msg_out_next.html".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\msg_out_next_historical.html".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\images\alert.png".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\images\blueBackground.gif".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\images\blueCurves.gif".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\images\blueIndicator.gif".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\images\blueIndicator.png".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\images\blueIndicatorAlt.gif".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\images\DummyContact.png".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\images\greenBackground.gif".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\images\greenCurves.gif".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\images\greenIndicator.gif".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\images\greenIndicatorAlt.gif".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\images\redBackground.gif".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\images\redCurves.gif".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\images\redIndicator.gif".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\images\redIndicatorAlt.gif".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\images\silverBackground.gif".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\images\silverCurves.gif".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\images\steelBackground.gif".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\images\steelCurves.gif".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\images\steelHeading.jpg".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\images\steelIndicator.gif".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\images\steelIndicatorAlt.gif".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\images\typing-left.png".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\images\typing-right.png".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\images\yellowBackground.gif".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\images\yellowCurves.gif".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\images\yellowHeading.jpg".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\images\yellowIndicator.gif".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\images\yellowIndicatorAlt.gif".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\variants\BlueRed Alternating.css".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\variants\BlueRed.css".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\variants\BlueSteel Alternating.css".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\variants\BlueSteel.css".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\variants\GreenRed Alternating.css".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\variants\GreenRed.css".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\variants\GreenYellow Alternating.css".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\variants\GreenYellow.css".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\variants\RedGreen Alternating.css".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\variants\RedGreen.css".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\variants\RedSteel Alternating.css".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\variants\RedSteel.css".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\variants\SteelBlue Alternating.css".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\variants\SteelBlue.css".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\variants\SteelGreen Alternating.css".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\variants\SteelGreen.css".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\variants\SteelRed Alternating.css".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\variants\SteelRed.css".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\variants\YellowGreen Alternating.css".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\variants\YellowGreen.css".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\variants\YellowRed Alternating.css".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\variants\YellowRed.css".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Simple\Info.plist".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Simple\main.css".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Simple\msg_admin.html".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Simple\msg_in.html".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Simple\msg_in_historical.html".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Simple\msg_in_next.html".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Simple\msg_in_next_historical.html".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Simple\msg_out.html".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Simple\msg_out_historical.html".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Simple\msg_out_next.html".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Simple\msg_out_next_historical.html".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Simple\images\BackdropLogo.png".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Simple\images\BackdropLogoxx.png".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Simple\variants\Green and Blue.css".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Simple\variants\Orange and Blue.css".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Simple\variants\Orange and Green.css".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Simple\variants\Orange and Purple.css".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Simple\variants\Red and Blue.css".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Simple\variants\Red and Green.css".
The file at "<$PROGRAMFILES>\iPhox\message_styles\Simple\variants\Red and Orange.css".
The file at "<$PROGRAMFILES>\iPhox\n3_emoticons\n3_angry.gif".
The file at "<$PROGRAMFILES>\iPhox\n3_emoticons\n3_asleep.gif".
The file at "<$PROGRAMFILES>\iPhox\n3_emoticons\n3_confused.gif".
The file at "<$PROGRAMFILES>\iPhox\n3_emoticons\n3_cool.gif".
The file at "<$PROGRAMFILES>\iPhox\n3_emoticons\n3_crying.gif".
The file at "<$PROGRAMFILES>\iPhox\n3_emoticons\n3_disgusted.gif".
The file at "<$PROGRAMFILES>\iPhox\n3_emoticons\n3_dizzy.gif".
The file at "<$PROGRAMFILES>\iPhox\n3_emoticons\n3_evil.gif".
The file at "<$PROGRAMFILES>\iPhox\n3_emoticons\n3_fear.gif".
The file at "<$PROGRAMFILES>\iPhox\n3_emoticons\n3_glad.gif".
The file at "<$PROGRAMFILES>\iPhox\n3_emoticons\n3_grin.gif".
The file at "<$PROGRAMFILES>\iPhox\n3_emoticons\n3_grumpy.gif".
The file at "<$PROGRAMFILES>\iPhox\n3_emoticons\n3_happy.gif".
The file at "<$PROGRAMFILES>\iPhox\n3_emoticons\n3_horny.gif".
The file at "<$PROGRAMFILES>\iPhox\n3_emoticons\n3_ill.gif".
The file at "<$PROGRAMFILES>\iPhox\n3_emoticons\n3_inlove.gif".
The file at "<$PROGRAMFILES>\iPhox\n3_emoticons\n3_innocent.gif".
The file at "<$PROGRAMFILES>\iPhox\n3_emoticons\n3_ironic.gif".
The file at "<$PROGRAMFILES>\iPhox\n3_emoticons\n3_kiss.gif".
The file at "<$PROGRAMFILES>\iPhox\n3_emoticons\n3_LOL.gif".
The file at "<$PROGRAMFILES>\iPhox\n3_emoticons\n3_okay.gif".
The file at "<$PROGRAMFILES>\iPhox\n3_emoticons\n3_perplex.gif".
The file at "<$PROGRAMFILES>\iPhox\n3_emoticons\n3_sad.gif".
The file at "<$PROGRAMFILES>\iPhox\n3_emoticons\n3_shocked.gif".
The file at "<$PROGRAMFILES>\iPhox\n3_emoticons\n3_shy.gif".
The file at "<$PROGRAMFILES>\iPhox\n3_emoticons\n3_stuart.gif".
The file at "<$PROGRAMFILES>\iPhox\n3_emoticons\n3_tongue.gif".
The file at "<$PROGRAMFILES>\iPhox\n3_emoticons\n3_unsure.gif".
The file at "<$PROGRAMFILES>\iPhox\n3_emoticons\n3_whistling.gif".
The file at "<$PROGRAMFILES>\iPhox\n3_emoticons\n3_wink.gif".
The file at "<$PROGRAMFILES>\iPhox\n3_emoticons\n3_wondering.gif".
The file at "<$PROGRAMFILES>\iPhox\Resources\1028\AppResources.zht.dll".
The file at "<$PROGRAMFILES>\iPhox\Resources\1033\AppResources.dll".
The file at "<$PROGRAMFILES>\iPhox\Resources\1034\AppResources.es.dll".
The file at "<$PROGRAMFILES>\iPhox\Resources\1036\AppResources.fr.dll".
The file at "<$PROGRAMFILES>\iPhox\Resources\1040\AppResources.it.dll".
The file at "<$PROGRAMFILES>\iPhox\Resources\2052\AppResources.zhs.dll".
The file at "<$PROGRAMFILES>\iPhox\sound_emoticons\alarm.wav".
The file at "<$PROGRAMFILES>\iPhox\sound_emoticons\birds.wav".
The file at "<$PROGRAMFILES>\iPhox\sound_emoticons\boing.wav".
The file at "<$PROGRAMFILES>\iPhox\sound_emoticons\boo.wav".
The file at "<$PROGRAMFILES>\iPhox\sound_emoticons\gong.wav".
The file at "<$PROGRAMFILES>\iPhox\sound_emoticons\horse.wav".
The file at "<$PROGRAMFILES>\iPhox\sound_emoticons\laughing.wav".
The file at "<$PROGRAMFILES>\iPhox\sound_emoticons\thunder.wav".
The file at "<$PROGRAMFILES>\iPhox\sound_emoticons\tiger.wav".
The file at "<$PROGRAMFILES>\iPhox\sound_emoticons\tires.wav".
The file at "<$PROGRAMFILES>\iPhox\sound_emoticons\typewriter.wav".
The file at "<$PROGRAMFILES>\iPhox\system_avatars\avatar_conference.gif".
The file at "<$PROGRAMFILES>\iPhox\system_avatars\avatar_echo.gif".
The file at "<$PROGRAMFILES>\iPhox\system_avatars\avatar_echo2.gif".
The file at "<$PROGRAMFILES>\iPhox\system_avatars\avatar_gizmo.gif".
The file at "<$PROGRAMFILES>\iPhox\system_avatars\avatar_info.gif".
The file at "<$PROGRAMFILES>\iPhox\system_avatars\avatar_support.gif".
The file at "<$PROGRAMFILES>\iPhox\system_avatars\avatar_welcome.gif".
The file at "<$PROGRAMFILES>\iPhox\system_avatars\avatar_yahoo2.gif".
The file at "<$PROGRAMFILES>\iPhox\system_avatars\star_star.gif".
The file at "<$LOCALSETTINGS>\Temp\WinIphoxInstall.exe".
The file at "<$PROGRAMS>\iPhox\iPhox Web Page.lnk".
The file at "<$PROGRAMS>\iPhox\Uninstall.lnk".
The file at "<$PROGRAMFILES>\iPhox\AppUpgrade.exe".
The file at "<$PROGRAMFILES>\iPhox\BrandResources.dll".
The file at "<$PROGRAMFILES>\iPhox\dnssd.dll".
The file at "<$PROGRAMFILES>\iPhox\EULA.rtf".
The file at "<$PROGRAMFILES>\iPhox\gdiplus.dll".
The file at "<$PROGRAMFILES>\iPhox\GizmoOpts.Ini".
The file at "<$PROGRAMFILES>\iPhox\IdleHook.dll".
The file at "<$PROGRAMFILES>\iPhox\iPhox.exe".
The file at "<$PROGRAMFILES>\iPhox\libeay32.dll".
The file at "<$PROGRAMFILES>\iPhox\mDNSResponder.exe".
The file at "<$PROGRAMFILES>\iPhox\n3_credits.txt".
The file at "<$PROGRAMFILES>\iPhox\README.txt".
The file at "<$PROGRAMFILES>\iPhox\SipphoneAPI.dll".
The file at "<$PROGRAMFILES>\iPhox\ssleay32.dll".
The file at "<$PROGRAMFILES>\iPhox\TurnOffBonjour.exe".
The file at "<$PROGRAMFILES>\iPhox\uninst.exe".
The file at "<$PROGRAMFILES>\iPhox\uninstall.ico".
The file at "<$DESKTOP>\iPhox.lnk".
The file at "<$PROGRAMS>\iPhox\iPhox.lnk".
Make sure you set your file manager to display hidden and system files. If iPhox uses rootkit technologies, use our RootAlyzer (http://forums.spybot.info/downloads.php?id=8) or our Total Commander anti-rootkit plugins (http://forums.spybot.info/downloads.php?id=3).
You will have to use a global search for files without a name specified. Be extra careful, because just the name might not be enough to identify files!
Folders:
Please use Windows Explorer or another file manager of your choice to locate and delete these folders.
The directory at "<$PROGRAMS>\iPhox".
The directory at "<$PROGRAMFILES>\iPhox".
The directory at "<$PROGRAMFILES>\iPhox\audio_clips".
The directory at "<$PROGRAMFILES>\iPhox\avatars".
The directory at "<$PROGRAMFILES>\iPhox\hold_music".
The directory at "<$PROGRAMFILES>\iPhox\interface_sounds".
The directory at "<$PROGRAMFILES>\iPhox\message_styles".
The directory at "<$PROGRAMFILES>\iPhox\message_styles\h4x0r".
The directory at "<$PROGRAMFILES>\iPhox\message_styles\h4x0r\images".
The directory at "<$PROGRAMFILES>\iPhox\message_styles\h4x0r\variants".
The directory at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo".
The directory at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\images".
The directory at "<$PROGRAMFILES>\iPhox\message_styles\Renkoo\variants".
The directory at "<$PROGRAMFILES>\iPhox\message_styles\Simple".
The directory at "<$PROGRAMFILES>\iPhox\message_styles\Simple\images".
The directory at "<$PROGRAMFILES>\iPhox\message_styles\Simple\variants".
The directory at "<$PROGRAMFILES>\iPhox\n3_emoticons".
The directory at "<$PROGRAMFILES>\iPhox\Resources".
The directory at "<$PROGRAMFILES>\iPhox\Resources\1028".
The directory at "<$PROGRAMFILES>\iPhox\Resources\1033".
The directory at "<$PROGRAMFILES>\iPhox\Resources\1034".
The directory at "<$PROGRAMFILES>\iPhox\Resources\1036".
The directory at "<$PROGRAMFILES>\iPhox\Resources\1040".
The directory at "<$PROGRAMFILES>\iPhox\Resources\2052".
The directory at "<$PROGRAMFILES>\iPhox\sound_emoticons".
The directory at "<$PROGRAMFILES>\iPhox\system_avatars".
Make sure you set your file manager to display hidden and system files. If iPhox uses rootkit technologies, use our RootAlyzer (http://forums.spybot.info/downloads.php?id=8) or our Total Commander anti-rootkit plugins (http://forums.spybot.info/downloads.php?id=3).
You will have to use a global search for files without a name specified. Be extra careful, because just the name might not be enough to identify folders!
Registry:
You can use regedit.exe (included in Windows) to locate and delete these registry entries.
Delete the registry key "iPhox" at "HKEY_CURRENT_USER\Software\".
A key in HKEY_CLASSES_ROOT\ named "iphox", plus associated values.
Delete the registry key "iPhox.exe" at "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\".
Delete the registry value "<$PROGRAMFILES>\iPhox\iPhox.exe" at "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\".
Delete the registry value "<$PROGRAMFILES>\iPhox\mDNSResponder.exe" at "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\".
Delete the registry value "<$PROGRAMFILES>\iPhox\iPhox.exe" at "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\".
Delete the registry value "<$PROGRAMFILES>\iPhox\mDNSResponder.exe" at "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\".
Delete the registry value "<$PROGRAMFILES>\iPhox\iPhox.exe" at "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\".
Delete the registry value "<$PROGRAMFILES>\iPhox\mDNSResponder.exe" at "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\".
If iPhox uses rootkit technologies, use our RegAlyzer (http://www.safer-networking.org/index.php?page=regalyzer), RootAlyzer (http://forums.spybot.info/downloads.php?id=8) or our Total Commander anti-rootkit plugins (http://forums.spybot.info/downloads.php?id=3).
Final Words:
If neither Spybot-S&D nor self help did resolve the issue or you would prefer one on one help,
Please read these instructions (http://forums.spybot.info/showthread.php?t=288) before requesting assistance,
Then start your own thread in the Malware Removal Forum (http://forums.spybot.info/forumdisplay.php?f=22) where a volunteer analyst will advise you as soon as available.