Solved! Use WATERMARKMGRMGR.EXE (Worm AMN) Removal Guide

I recommend you UnHackMe - Ultimate Malware Killer for fast malware removal:

Download UnHackMe
Fully Functional 30-day Trial. No credit card is required. Reviews. EULA. Privacy Policy.

WATERMARKMGRMGR.EXE – Worm AMN removal

File MD5 Virus Alias
WATERMARKMGRMGR.EXE 963056968f712dce49fed780756eafa3 Worm AMN
WATERMARKMGRMGR.EXE 963056968f712dce49fed780756eafa3 Trojan XPACK
WATERMARKMGRMGR.EXE 963056968f712dce49fed780756eafa3 Trojan Generic
WATERMARKMGRMGR.EXE 963056968f712dce49fed780756eafa3 Trojan Eldorado
WATERMARKMGRMGR.EXE 963056968f712dce49fed780756eafa3 Trojan Diple
WATERMARKMGRMGR.EXE 963056968f712dce49fed780756eafa3 Trojan Krap

WATERMARKMGRMGR.EXE size: 146432 bytes
WATERMARKMGRMGR.EXE hash: 963056968F712DCE49FED780756EAFA3

Created files:

%Program Files%\Microsoft\WaterMark.exe
%Program Files%\Microsoft\WaterMarkmgr.exe
%Program Files%\Microsoft\WaterMarkmgrmgr.exe
%SysDir%\rundll32mgr.exe
%SysDir%\rundll32mgrmgr.exe
%SysDir%\rundll32mgrmgrmgr.exe

Autostart registry keys:

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit: c:\windows\System32\userinit.exe,,c:\program files\Microsoft\watermark.exe

Detected by UnHackMe:

WATERMARKMGRMGR.EXE
Default location: %PROGRAM FILES%\MICROSOFT\WATERMARKMGRMGR.EXE

Dropper information:
MD5: c9f50cbde6a811ce39961fee75df6590
File size: 891258 bytes

Leave a Reply