NPF.SYS – Backdoor Bredolab

I recommend you UnHackMe - Ultimate Malware Killer for fast malware removal:

Download UnHackMe
Fully Functional 30-day Trial. No credit card is required. Reviews. EULA. Privacy Policy.

NPF.SYS – Backdoor Bredolab removal

File MD5 Virus Alias
NPF.SYS b9730495e0cf674680121e34bd95a73b Backdoor Bredolab

NPF.SYS size: 50704 bytes
NPF.SYS hash: B9730495E0CF674680121E34BD95A73B

Created files:

%Program Files Common%\Apple\Apple Application Support\lame.exe
%WinDir%\batch.exe
%SysDir%\drivers\npf.sys

Autostart registry keys:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\SonyAgent: %Program Files Common%\Apple\Apple Application Support\lame.exe

Detected by UnHackMe:

NPF.SYS
Default location: %SYSDIR%\DRIVERS\NPF.SYS

Dropper information:
MD5: 167278993f93c3f618c2404da9858c48
File size: 758784 bytes

Leave a Reply