Solved! Use ZCLXCA.EXE (Backdoor Nitol) Removal Guide

I recommend you UnHackMe - Ultimate Malware Killer for fast malware removal:

Download UnHackMe
Fully Functional 30-day Trial. No credit card is required. Reviews. EULA. Privacy Policy.

ZCLXCA.EXE – Backdoor Nitol removal

File MD5 Virus Alias
ZCLXCA.EXE d15bd2ee5ecc09285a6cd3b6591fd45e Backdoor Nitol
ZCLXCA.EXE d15bd2ee5ecc09285a6cd3b6591fd45e Trojan Generic
ZCLXCA.EXE d15bd2ee5ecc09285a6cd3b6591fd45e Backdoor RBot
ZCLXCA.EXE d15bd2ee5ecc09285a6cd3b6591fd45e Trojan Buzus
ZCLXCA.EXE d15bd2ee5ecc09285a6cd3b6591fd45e Backdoor Farfli

ZCLXCA.EXE size: 73056 bytes
ZCLXCA.EXE hash: D15BD2EE5ECC09285A6CD3B6591FD45E

Created files:

%WinDir%\zclxca.exe

Autostart registry keys:

HKLM\System\CurrentControlSet\Services\Mnopqr Tuvwxyab Def\Type: 10010000
HKLM\System\CurrentControlSet\Services\Mnopqr Tuvwxyab Def\Start: 02000000
HKLM\System\CurrentControlSet\Services\Mnopqr Tuvwxyab Def\ErrorControl: 01000000
HKLM\System\CurrentControlSet\Services\Mnopqr Tuvwxyab Def\DisplayName: Mnopqr Tuvwxyab Defghijk Mnop
HKLM\System\CurrentControlSet\Services\Mnopqr Tuvwxyab Def\ImagePath: %WinDir%\zclxca.exe
HKLM\System\CurrentControlSet\Services\Mnopqr Tuvwxyab Def\Description: Mnopqrst Vwxyabcde Ghijklm Opqrstuv Xya

Detected by UnHackMe:

ZCLXCA.EXE
Default location: %WinDir%\ZCLXCA.EXE

Dropper information:
MD5: d15bd2ee5ecc09285a6cd3b6591fd45e
File size: 73056 bytes

Leave a Reply