Solved! Use VIDEO.SYS (Trojan Agent) Removal Guide

I recommend you UnHackMe - Ultimate Malware Killer for fast malware removal:

Download UnHackMe
Fully Functional 30-day Trial. No credit card is required. Reviews. EULA. Privacy Policy.

VIDEO.SYS – Trojan Agent removal

File MD5 Virus Alias
VIDEO.SYS 49d5462ceedf1c97a911abc4aefdd3e7 Trojan Agent
VIDEO.SYS 49d5462ceedf1c97a911abc4aefdd3e7 Trojan Artemis
VIDEO.SYS 49d5462ceedf1c97a911abc4aefdd3e7 Trojan Click

VIDEO.SYS size: 30080 bytes
VIDEO.SYS hash: 49D5462CEEDF1C97A911ABC4AEFDD3E7

Created files:

%Program Files%\Mozilla Firefox\extensions\admin@firestarterfox.net\chrome\bor.jar
%SYSDIR%\bootcats.sys
%SYSDIR%\drvhive.ocx
%SYSDIR%\VIDEO.sys
%SYSDIR%\vmmreg32.dll
%SYSDIR%\webmin\VIDEO.bkp
%SYSDIR%\webmin\vmmreg32.bkp

Autostart registry keys:

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\1: %SYSDIR%\winhelp32.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Windows Help Service: %SYSDIR%\winhelp32.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\Windows Help Service: %SYSDIR%\winhelp32.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce\Windows Help Service: %SYSDIR%\winhelp32.exe
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows\load: %SYSDIR%\winhelp32.exe
HKLM\System\CurrentControlSet\Services\VIDEO\Type: 01000000
HKLM\System\CurrentControlSet\Services\VIDEO\Start: 01000000
HKLM\System\CurrentControlSet\Services\VIDEO\DisplayName: VIDEO
HKLM\System\CurrentControlSet\Services\VIDEO\ImagePath: %SYSDIR%\VIDEO.sys
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Windows Help Service: %SYSDIR%\winhelp32.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce\Windows Help Service: %SYSDIR%\winhelp32.exe

Detected by UnHackMe:

VIDEO.SYS
Default location: %SYSDIR%\VIDEO.SYS

Dropper information:
MD5: 07f80bcea04da1af4bb2d52c926c6b57
File size: 164352 bytes

Leave a Reply