Solved! Use BREMOTES.EXE (Backdoor Farfli) Removal Guide

I recommend you UnHackMe - Ultimate Malware Killer for fast malware removal:

Download UnHackMe
Fully Functional 30-day Trial. No credit card is required. Reviews. EULA. Privacy Policy.

BREMOTES.EXE – Backdoor Farfli removal

File MD5 Virus Alias
BREMOTES.EXE c241103df0d2591cdefad94b69e4a951 Backdoor Farfli
BREMOTES.EXE c241103df0d2591cdefad94b69e4a951 Trojan SuspiciousFile
BREMOTES.EXE c241103df0d2591cdefad94b69e4a951 Trojan Generic
BREMOTES.EXE c241103df0d2591cdefad94b69e4a951 Trojan Eldorado
BREMOTES.EXE c241103df0d2591cdefad94b69e4a951 Trojan Downloader
BREMOTES.EXE c241103df0d2591cdefad94b69e4a951 Trojan Magania

BREMOTES.EXE size: 42496 bytes
BREMOTES.EXE hash: C241103DF0D2591CDEFAD94B69E4A951

Created files:

%SysDir%\BRemotes.exe

Autostart registry keys:

HKLM\System\CurrentControlSet\Services\ConnectGroup: 6gkIBfkS+qY=
HKLM\System\CurrentControlSet\Services\Vwxyab Defghijk Mno\Type: 10010000
HKLM\System\CurrentControlSet\Services\Vwxyab Defghijk Mno\Start: 02000000
HKLM\System\CurrentControlSet\Services\Vwxyab Defghijk Mno\DisplayName: Vwxyabcd Fghijklmn Pqrstuv Xyabcdef Hij
HKLM\System\CurrentControlSet\Services\Vwxyab Defghijk Mno\ImagePath: %WinDir%\System32\BRemotes.exe
HKLM\System\CurrentControlSet\Services\Vwxyab Defghijk Mno\Description: Vwxyab Defghijk Mnopqrst Vwxy

Detected by UnHackMe:

BREMOTES.EXE
Default location: %SYSDIR%\BREMOTES.EXE

Dropper information:
MD5: c241103df0d2591cdefad94b69e4a951
File size: 42496 bytes

Leave a Reply