WINSYSAPP.EXE – Worm Autorun

I recommend you UnHackMe - Ultimate Malware Killer for fast malware removal:

Free Download
Fully Functional 30-day Trial. No credit card is required.
Reviews
. EULA. Privacy Policy. Uninstall.

WINSYSAPP.EXE – Worm Autorun removal

FileMD5Virus Alias
WINSYSAPP.EXE 8de3bc231f271dc813a2847d8662c8e0 Worm Autorun
WINSYSAPP.EXE 8de3bc231f271dc813a2847d8662c8e0 Trojan Generic
WINSYSAPP.EXE 8de3bc231f271dc813a2847d8662c8e0 Trojan Eldorado
WINSYSAPP.EXE 8de3bc231f271dc813a2847d8662c8e0 Trojan Agent
WINSYSAPP.EXE 8de3bc231f271dc813a2847d8662c8e0 Trojan StartPage

WINSYSAPP.EXE size: 163840 bytes
WINSYSAPP.EXE hash: 8DE3BC231F271DC813A2847D8662C8E0

Created files:

C:\Program Files\Windows Alerter\WinAlert.exe
C:\Program Files\Windows Common Files\Commgr.exe
C:\RECYCLER\X-1-5-21-1960408961-725345543-839522115-1003\info
C:\RECYCLER\X-1-5-21-1960408961-725345543-839522115-1003\WinSysApp.exe

Autostart registry keys:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\WindowMessenger: C:\RECYCLER\X-1-5-21-1960408961-725345543-839522115-1003\WinSysApp.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Windows Alerter: C:\Program Files\Windows Alerter\WinAlert.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Windows Common Files Manager: C:\Program Files\Windows Common Files\Commgr.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\WindowMessenger: C:\RECYCLER\X-1-5-21-1960408961-725345543-839522115-1003\WinSysApp.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Windows Alerter: C:\Program Files\Windows Alerter\WinAlert.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Windows Common Files Manager: C:\Program Files\Windows Common Files\Commgr.exe

Detected by UnHackMe:

WINSYSAPP.EXE
Default location: C:\RECYCLER\X-1-5-21-1960408961-725345543-839522115-1003\WINSYSAPP.EXE

Dropper information:
MD5: 8de3bc231f271dc813a2847d8662c8e0
File size: 163840 bytes

Leave a Reply