WATERMARK.EXE – Trojan ZBot

I recommend you UnHackMe - Ultimate Malware Killer for fast malware removal:

Download UnHackMe
Fully Functional 30-day Trial. No credit card is required. Reviews. EULA. Privacy Policy.

WATERMARK.EXE – Trojan ZBot removal

File MD5 Virus Alias
WATERMARK.EXE 00dc4d984105ca7a22b67249184e82f5 Trojan ZBot
WATERMARK.EXE 00dc4d984105ca7a22b67249184e82f5 Suspicious File
WATERMARK.EXE 00dc4d984105ca7a22b67249184e82f5 Trojan Generic
WATERMARK.EXE 00dc4d984105ca7a22b67249184e82f5 Trojan Eldorado
WATERMARK.EXE 00dc4d984105ca7a22b67249184e82f5 Trojan Panda
WATERMARK.EXE 00dc4d984105ca7a22b67249184e82f5 Worm AMN

WATERMARK.EXE size: 123392 bytes
WATERMARK.EXE hash: 00DC4D984105CA7A22B67249184E82F5

Created files:

%Program Files%\Microsoft\WaterMark.exe
%Common AppData%\Apple Computer\Installer Cache\Safari 5.34.52.7\SetupAdmin.exe
%UserProfile%\Local Settings\Application Data\Google\Chrome\Application\17.0.963.56\avcodec-53.dll
%UserProfile%\Local Settings\Application Data\Google\Chrome\Application\17.0.963.56\avformat-53.dll
%UserProfile%\Local Settings\Application Data\Google\Chrome\Application\17.0.963.56\avutil-51.dll
%UserProfile%\Local Settings\Application Data\Google\Chrome\Application\17.0.963.56\chrome.dll

Autostart registry keys:

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit: c:\windows\System32\userinit.exe,,c:\program files\Microsoft\watermark.exe

Detected by UnHackMe:

WATERMARK.EXE
Default location: %PROGRAM FILES%\MICROSOFT\WATERMARK.EXE

Dropper information:
MD5: 00dc4d984105ca7a22b67249184e82f5
File size: 123392 bytes

Leave a Reply