Solved! Use SVCHOST.EXE (Worm Vobfus) Removal Guide

I recommend you UnHackMe - Ultimate Malware Killer for fast malware removal:

Download UnHackMe
Fully Functional 30-day Trial. No credit card is required. Reviews. EULA. Privacy Policy.

SVCHOST.EXE – Worm Vobfus removal

File MD5 Virus Alias
SVCHOST.EXE cb2e58a327b7b196c79608b2f56b77c0 Worm Vobfus
SVCHOST.EXE cb2e58a327b7b196c79608b2f56b77c0 Trojan Hllw
SVCHOST.EXE cb2e58a327b7b196c79608b2f56b77c0 Trojan Agent

SVCHOST.EXE size: 46592 bytes
SVCHOST.EXE hash: CB2E58A327B7B196C79608B2F56B77C0

Created files:

C:\Recycled\CTFMON.EXE
C:\Recycled\SMSS.EXE
C:\Recycled\SPOOLSV.EXE
C:\Recycled\SVCHOST.EXE

Autostart registry keys:

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit: C:\recycled\SVCHOST.exe,
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell: Explorer.exe “C:\recycled\SVCHOST.exe”

Detected by UnHackMe:

SVCHOST.EXE
Default location: C:\RECYCLED\SVCHOST.EXE

Dropper information:
MD5: 6b1a7c59f3f0443eead7d0862c60b901
File size: 46592 bytes

Leave a Reply