I recommend you UnHackMe - Ultimate Malware Killer for fast malware removal:
Download UnHackMe
Fully Functional 30-day Trial. No credit card is required. Reviews. EULA. Privacy Policy.
PHOTO-XXX.EXE – Trojan Otran removal
| File | MD5 | Virus Alias |
|---|---|---|
| PHOTO-XXX.EXE | 0c9e5b4a9ac09ed40753215546cf6200 | Trojan Otran |
| PHOTO-XXX.EXE | 0c9e5b4a9ac09ed40753215546cf6200 | Trojan VBTrojan |
| PHOTO-XXX.EXE | 0c9e5b4a9ac09ed40753215546cf6200 | Trojan SuspiciousFile |
| PHOTO-XXX.EXE | 0c9e5b4a9ac09ed40753215546cf6200 | Trojan Generic |
| PHOTO-XXX.EXE | 0c9e5b4a9ac09ed40753215546cf6200 | Trojan Downloader |
| PHOTO-XXX.EXE | 0c9e5b4a9ac09ed40753215546cf6200 | Worm Autorun |
PHOTO-XXX.EXE size: 331264 bytes
PHOTO-XXX.EXE hash: 0C9E5B4A9AC09ED40753215546CF6200
Created files:
C:\Photo-XXX.exe
%SysDir%\4K51K4.exe
%SysDir%\GoldenGhost.exe
%SysDir%\K0L4B0R451.exe
%SysDir%\Kantuk.exe
%SysDir%\Shell32.com
%SysDir%\~A~m~B~u~R~a~D~u~L~\winlogon.exe
C:\WINFILE.exe
%Common Startmenu%\Programs\Startup\Empty.pif
Autostart registry keys:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Winlogon: %WinDir%\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell: Explorer.exe “%WinDir%\System32\K0L4B0R451.exe”
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit: %WinDir%\System32\userinit.exe,%WinDir%\System32\K0L4B0R451.exe
HKCU\Control Panel\Desktop\SCRNSAVE.EXE: %WinDir%\System32\Windows_3D.scr
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Revenger: %WinDir%\System32\K0L4B0R451.exe
Detected by UnHackMe:
PHOTO-XXX.EXE
Default location: C:\PHOTO-XXX.EXE
Dropper information:
MD5: 0c9e5b4a9ac09ed40753215546cf6200
File size: 331264 bytes