Solved! Use KSCAN.EXE (Worm Autorun) Removal Guide

I recommend you UnHackMe - Ultimate Malware Killer for fast malware removal:

Download UnHackMe
Fully Functional 30-day Trial. No credit card is required. Reviews. EULA. Privacy Policy.

KSCAN.EXE – Worm Autorun removal

File MD5 Virus Alias
KSCAN.EXE 07fe8dacd4a26942bf838c9e3e6ef23e Worm Autorun
KSCAN.EXE 07fe8dacd4a26942bf838c9e3e6ef23e Trojan SuspiciousFile
KSCAN.EXE 07fe8dacd4a26942bf838c9e3e6ef23e Trojan Artemis
KSCAN.EXE 07fe8dacd4a26942bf838c9e3e6ef23e Trojan Eldorado
KSCAN.EXE 07fe8dacd4a26942bf838c9e3e6ef23e Trojan Magania
KSCAN.EXE 07fe8dacd4a26942bf838c9e3e6ef23e Trojan Siggen

KSCAN.EXE size: 101376 bytes
KSCAN.EXE hash: 07FE8DACD4A26942BF838C9E3E6EF23E

Created files:

%SysDir%\kscan.exe

Autostart registry keys:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run : %WinDir%\System32\kscan.exe
HKLM\System\CurrentControlSet\Services\Nationaljrq\Type: 10010000
HKLM\System\CurrentControlSet\Services\Nationaljrq\Start: 02000000
HKLM\System\CurrentControlSet\Services\Nationaljrq\DisplayName: Nationalyta Instruments Domain Service
HKLM\System\CurrentControlSet\Services\Nationaljrq\ImagePath: %WinDir%\System32\kscan.exe
HKLM\System\CurrentControlSet\Services\Nationaljrq\Description: Providesmid a domain server for NI security.

Detected by UnHackMe:

KSCAN.EXE
Default location: %SYSDIR%\KSCAN.EXE

Dropper information:
MD5: 07fe8dacd4a26942bf838c9e3e6ef23e
File size: 101376 bytes

Leave a Reply