ZCRLYA.EXE – Backdoor Nitol

I recommend you UnHackMe - Ultimate Malware Killer for fast malware removal:

Free Download
Fully Functional 30-day Trial. No credit card is required.
Reviews
. EULA. Privacy Policy. Uninstall.

ZCRLYA.EXE – Backdoor Nitol removal

FileMD5Virus Alias
ZCRLYA.EXE e33668c751976bff8a7ef6252fb25fd9 Backdoor Nitol
ZCRLYA.EXE e33668c751976bff8a7ef6252fb25fd9 Trojan SuspiciousFile
ZCRLYA.EXE e33668c751976bff8a7ef6252fb25fd9 Trojan Generic
ZCRLYA.EXE e33668c751976bff8a7ef6252fb25fd9 Trojan Eldorado
ZCRLYA.EXE e33668c751976bff8a7ef6252fb25fd9 Trojan Downloader
ZCRLYA.EXE e33668c751976bff8a7ef6252fb25fd9 Trojan Agent

ZCRLYA.EXE size: 36352 bytes
ZCRLYA.EXE hash: E33668C751976BFF8A7EF6252FB25FD9

Created files:

%SysDir%\zcrlya.exe

Autostart registry keys:

HKLM\System\CurrentControlSet\Services\COMSystemAPP\Type: 10000000
HKLM\System\CurrentControlSet\Services\COMSystemAPP\Start: 02000000
HKLM\System\CurrentControlSet\Services\COMSystemAPP\DisplayName: ???? ????COM++ ?????????ú?????????????
HKLM\System\CurrentControlSet\Services\COMSystemAPP\ImagePath: %WinDir%\System32\zcrlya.exe
HKLM\System\CurrentControlSet\Services\COMSystemAPP\Description: COM+ System Applications

Detected by UnHackMe:

ZCRLYA.EXE
Default location: %SYSDIR%\ZCRLYA.EXE

Dropper information:
MD5: e33668c751976bff8a7ef6252fb25fd9
File size: 36352 bytes

Leave a Reply