ZIP.EXE – Trojan Banker

I recommend you UnHackMe - Ultimate Malware Killer for fast malware removal:

Free Download
Fully Functional 30-day Trial. No credit card is required.
Reviews
. EULA. Privacy Policy. Uninstall.

ZIP.EXE – Trojan Banker removal

FileMD5Virus Alias
ZIP.EXE db9b1cc34b35136f35e333de520c15f5 Trojan Banker

ZIP.EXE size: 135168 bytes
ZIP.EXE hash: DB9B1CC34B35136F35E333DE520C15F5

Created files:

C:\cleanup.exe
%SysDir%\drivers\pest.sys
C:\zip.exe

Autostart registry keys:

HKLM\Software\Microsoft\Windows\CurrentVersion\RUN\86883916A540B8039D46ED6EB0E64442.EXE: 86883916A540B8039D46ED6EB0E64442.EXE
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce\Cleanup: C:\cleanup.exe
HKLM\System\CurrentControlSet\Services\jcdees\ImagePath: 730079007300740065006D00330032005C0064007200690076006500720073005C0070006500730074002E007300790073000000
HKLM\System\CurrentControlSet\Services\jcdees\Type: 01000000
HKLM\System\CurrentControlSet\Services\jcdees\ErrorControl: 01000000
HKLM\System\CurrentControlSet\Services\jcdees\uceo: \??\%WinDir%\ywaij.txt
HKLM\System\CurrentControlSet\Services\jcdees\rsnjwp: %WinDir%
HKLM\System\CurrentControlSet\Services\jcdees\ncwrlkff: ABB00000
HKLM\System\CurrentControlSet\Services\jcdees\Group: hguvv

Detected by UnHackMe:

ZIP.EXE
Default location: C:\ZIP.EXE

Dropper information:
MD5: 86883916a540b8039d46ed6eb0e64442
File size: 1052672 bytes

Leave a Reply