Solved! Use KSCAN.EXE (Worm Autorun) Removal Guide

I will tell you in this post how to fix the issue manually and how to clean it automatically using a special powerful removal tool. You can download the removal program for free here:

Manual removal instructions:

KSCAN.EXE – Worm Autorun removal

File MD5 Virus Alias
KSCAN.EXE 07fe8dacd4a26942bf838c9e3e6ef23e Worm Autorun
KSCAN.EXE 07fe8dacd4a26942bf838c9e3e6ef23e Trojan SuspiciousFile
KSCAN.EXE 07fe8dacd4a26942bf838c9e3e6ef23e Trojan Artemis
KSCAN.EXE 07fe8dacd4a26942bf838c9e3e6ef23e Trojan Eldorado
KSCAN.EXE 07fe8dacd4a26942bf838c9e3e6ef23e Trojan Magania
KSCAN.EXE 07fe8dacd4a26942bf838c9e3e6ef23e Trojan Siggen

KSCAN.EXE size: 101376 bytes
KSCAN.EXE hash: 07FE8DACD4A26942BF838C9E3E6EF23E

Created files:

%SysDir%\kscan.exe

Autostart registry keys:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run : %WinDir%\System32\kscan.exe
HKLM\System\CurrentControlSet\Services\Nationaljrq\Type: 10010000
HKLM\System\CurrentControlSet\Services\Nationaljrq\Start: 02000000
HKLM\System\CurrentControlSet\Services\Nationaljrq\DisplayName: Nationalyta Instruments Domain Service
HKLM\System\CurrentControlSet\Services\Nationaljrq\ImagePath: %WinDir%\System32\kscan.exe
HKLM\System\CurrentControlSet\Services\Nationaljrq\Description: Providesmid a domain server for NI security.

Detected by UnHackMe:

KSCAN.EXE
Default location: %SYSDIR%\KSCAN.EXE

Dropper information:
MD5: 07fe8dacd4a26942bf838c9e3e6ef23e
File size: 101376 bytes