SVCHOST.EXE – KeyLogger Ardamax

I will tell you in this post how to fix the issue manually and how to clean it automatically using a special powerful removal tool. You can download the removal program for free here:

Manual removal instructions:

SVCHOST.EXE – KeyLogger Ardamax removal

File MD5 Virus Alias
SVCHOST.EXE 0c7a714b8e1d2ead2afc90dcc43bbe18 KeyLogger Ardamax
SVCHOST.EXE 0c7a714b8e1d2ead2afc90dcc43bbe18 Trojan Generic

SVCHOST.EXE size: 525312 bytes
SVCHOST.EXE hash: 0C7A714B8E1D2EAD2AFC90DCC43BBE18

Created files:

C:\1716b9
%WinDir%\regsvr.exe
%SysDir%\28463\svchost.001
%SysDir%\28463\svchost.exe
%SysDir%\regsvr.exe
%SysDir%\svchost .exe
D:\171ac1
D:\cert\VBoxCertUtil.exe

Autostart registry keys:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\svchost Agent: %WinDir%\System32\28463\svchost.exe
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell: Explorer.exe regsvr.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Msn Messsenger: %WinDir%\System32\regsvr.exe

Detected by UnHackMe:

SVCHOST.EXE
Default location: %SYSDIR%\28463\SVCHOST.EXE

Dropper information:
MD5: ceaf4d9e1f408299144e75d7f29c1810
File size: 997537 bytes