Solved! Use CLR.DLL (Backdoor Koutodoor) Removal Guide

I recommend you UnHackMe - Ultimate Malware Killer for fast malware removal:

Download UnHackMe
Fully Functional 30-day Trial. No credit card is required. Reviews. EULA. Privacy Policy.

CLR.DLL – Backdoor Koutodoor removal

File MD5 Virus Alias
CLR.DLL bb95789399770d8b546082c032eebb66 Backdoor Koutodoor
CLR.DLL bb95789399770d8b546082c032eebb66 Trojan Generic
CLR.DLL bb95789399770d8b546082c032eebb66 Trojan Eldorado
CLR.DLL bb95789399770d8b546082c032eebb66 Trojan Adload
CLR.DLL bb95789399770d8b546082c032eebb66 Trojan Siggen

CLR.DLL size: 61440 bytes
CLR.DLL hash: BB95789399770D8B546082C032EEBB66

Created files:

%SysDir%\clr.dll
%SysDir%\drivers\xei.sys
%Temp%\bjripm.exe

Autostart registry keys:

HKLM\System\CurrentControlSet\Services\xei\Type: 01000000
HKLM\System\CurrentControlSet\Services\xei\ErrorControl: 01000000
HKLM\System\CurrentControlSet\Services\xei\DisplayName: xei
HKLM\System\CurrentControlSet\Services\xei\ImagePath: 730079007300740065006D00330032005C0064007200690076006500720073005C007800650069002E007300790073000000

Detected by UnHackMe:

CLR.DLL
Default location: %SYSDIR%\CLR.DLL

Dropper information:
MD5: 0991a0da54b1fff6ea5de34f6fd5ea20
File size: 200768 bytes

Leave a Reply