SHELL32.COM – Trojan Otran

I recommend you UnHackMe - Ultimate Malware Killer for fast malware removal:

Free Download
Fully Functional 30-day Trial. No credit card is required.
Reviews
. EULA. Privacy Policy. Uninstall.

SHELL32.COM – Trojan Otran removal

FileMD5Virus Alias
SHELL32.COM 0c9e5b4a9ac09ed40753215546cf6200 Trojan Otran
SHELL32.COM 0c9e5b4a9ac09ed40753215546cf6200 Trojan VBTrojan
SHELL32.COM 0c9e5b4a9ac09ed40753215546cf6200 Trojan SuspiciousFile
SHELL32.COM 0c9e5b4a9ac09ed40753215546cf6200 Trojan Generic
SHELL32.COM 0c9e5b4a9ac09ed40753215546cf6200 Trojan Downloader
SHELL32.COM 0c9e5b4a9ac09ed40753215546cf6200 Worm Autorun

SHELL32.COM size: 331264 bytes
SHELL32.COM hash: 0C9E5B4A9AC09ED40753215546CF6200

Created files:

C:\Photo-XXX.exe
%SysDir%\4K51K4.exe
%SysDir%\GoldenGhost.exe
%SysDir%\K0L4B0R451.exe
%SysDir%\Kantuk.exe
%SysDir%\Shell32.com
%SysDir%\~A~m~B~u~R~a~D~u~L~\winlogon.exe
C:\WINFILE.exe
%Common Startmenu%\Programs\Startup\Empty.pif

Autostart registry keys:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Winlogon: %WinDir%\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell: Explorer.exe “%WinDir%\System32\K0L4B0R451.exe”
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit: %WinDir%\System32\userinit.exe,%WinDir%\System32\K0L4B0R451.exe
HKCU\Control Panel\Desktop\SCRNSAVE.EXE: %WinDir%\System32\Windows_3D.scr
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Revenger: %WinDir%\System32\K0L4B0R451.exe

Detected by UnHackMe:

SHELL32.COM
Default location: %SYSDIR%\SHELL32.COM

Dropper information:
MD5: 0c9e5b4a9ac09ed40753215546cf6200
File size: 331264 bytes

Leave a Reply