PATCH.EXE – Trojan WS.Reputation

I recommend you UnHackMe - Ultimate Malware Killer for fast malware removal:

Free Download
Fully Functional 30-day Trial. No credit card is required.
Reviews
. EULA. Privacy Policy. Uninstall.

PATCH.EXE – Trojan WS.Reputation removal

FileMD5Virus Alias
PATCH.EXE 1d4cea0c9a21f70cf1037178680c1aed Trojan WS.Reputation

PATCH.EXE size: 439296 bytes
PATCH.EXE hash: 1D4CEA0C9A21F70CF1037178680C1AED

Created files:

%AppData%\SmsCut\SonicProxy\install\B530764\bash.exe
%AppData%\SmsCut\SonicProxy\install\B530764\cygiconv-2.dll
%AppData%\SmsCut\SonicProxy\install\B530764\cygintl-8.dll
%AppData%\SmsCut\SonicProxy\install\B530764\cygncurses-8.dll
%AppData%\SmsCut\SonicProxy\install\B530764\cygreadline6.dll
%AppData%\SmsCut\SonicProxy\install\B530764\cygwin1.dll
%AppData%\SmsCut\SonicProxy\install\B530764\patch.exe
%AppData%\SmsCut\SonicProxy\install\B530764\rar.exe
%AppData%\SmsCut\SonicProxy\install\B530764\smscut.exe
%AppData%\SmsCut\SonicProxy\install\B530764\sonic.conf
%AppData%\SmsCut\SonicProxy\install\B530764\sonic.exe
%AppData%\SmsCut\SonicProxy\install\B530764\sonic.st
%AppData%\SmsCut\SonicProxy\install\B530764\SonicProxy.exe
%AppData%\SmsCut\SonicProxy\install\B530764\user.sa
%AppData%\SmsCut\SonicProxy\install\B530764\usertb.sa
%AppData%\SmsCut\SonicProxy\install\B530764\WindowsFolder\proxy.pac
%AppData%\SmsCut\SonicProxy\install\B530764\WindowsVolume\proxy.pac
%AppData%\SmsCut\SonicProxy\install\decoder.dll

Autostart registry keys:

HKLM\System\CurrentControlSet\Services\MSIServer\SBIE_CheckPoint: 09000000

Detected by UnHackMe:

PATCH.EXE
Default location: %APPDATA%\SMSCUT\SONICPROXY\INSTALL\B530764\PATCH.EXE

Dropper information:
MD5: b07fc0a81566705297bcb29a2fa8b468
File size: 6279512 bytes

Leave a Reply