Solved! Use LOLSS.EXE (Trojan OnLineGames) Removal Guide

I recommend you UnHackMe - Ultimate Malware Killer for fast malware removal:

Free Download
Fully Functional 30-day Trial. No credit card is required.
Reviews
. EULA. Privacy Policy. Uninstall.

LOLSS.EXE – Trojan OnLineGames removal

FileMD5Virus Alias
LOLSS.EXE 765afd8b1c51871dc60091e177c0cd8a Trojan OnLineGames
LOLSS.EXE 765afd8b1c51871dc60091e177c0cd8a Trojan Artemis
LOLSS.EXE 765afd8b1c51871dc60091e177c0cd8a Trojan XPACK
LOLSS.EXE 765afd8b1c51871dc60091e177c0cd8a Trojan Generic
LOLSS.EXE 765afd8b1c51871dc60091e177c0cd8a Trojan Graftor
LOLSS.EXE 765afd8b1c51871dc60091e177c0cd8a Trojan Agent

LOLSS.EXE size: 90624 bytes
LOLSS.EXE hash: 765AFD8B1C51871DC60091E177C0CD8A

Created files:

%SysDir%\drivers\PCIDump.sys
%SysDir%\gyblack.lst
%SysDir%\lolcc.ss
%SysDir%\lolss.exe
%SysDir%\lolxcs.dll
%SysDir%\NetHelp32.exe
%SysDir%\RRsLol.exe
%SysDir%\WinHelp32.exe
%Temp%\bd.exe
%Temp%\L0L_Login.exe
%Temp%\LOLds.exe
%Temp%\LOL_Update.exe

Autostart registry keys:

HKLM\System\CurrentControlSet\Services\WS2IFSL\Type: 01000000
HKLM\System\CurrentControlSet\Services\WS2IFSL\Start: 01000000
HKLM\System\CurrentControlSet\Services\WS2IFSL\ErrorControl: 01000000
HKLM\System\CurrentControlSet\Services\WS2IFSL\DisplayName: Windows Socket 2.0 Non-IFS Service Provider Support Environment
HKLM\System\CurrentControlSet\Services\WS2IFSL\ImagePath: \SystemRoot\System32\drivers\ws2ifsl.sys

Detected by UnHackMe:

LOLSS.EXE
Default location: %SYSDIR%\LOLSS.EXE

Dropper information:
MD5: d397c60c346a1aaf0814431df307f41a
File size: 1263616 bytes

Leave a Reply