Solved! Use SVCHOST.EXE (Trojan Artemis) Removal Guide

I recommend you UnHackMe - Ultimate Malware Killer for fast malware removal:

Free Download
Fully Functional 30-day Trial. No credit card is required.
Reviews
. EULA. Privacy Policy. Uninstall.

SVCHOST.EXE – Trojan Artemis removal

FileMD5Virus Alias
SVCHOST.EXE a2eee7dd3e15a6be32179a5ca86dc65a Trojan Artemis
SVCHOST.EXE a2eee7dd3e15a6be32179a5ca86dc65a Trojan Win32-Spy
SVCHOST.EXE a2eee7dd3e15a6be32179a5ca86dc65a Trojan SuspiciousFile
SVCHOST.EXE a2eee7dd3e15a6be32179a5ca86dc65a Trojan Generic
SVCHOST.EXE a2eee7dd3e15a6be32179a5ca86dc65a Trojan Agent
SVCHOST.EXE a2eee7dd3e15a6be32179a5ca86dc65a Trojan Crypt

SVCHOST.EXE size: 547328 bytes
SVCHOST.EXE hash: A2EEE7DD3E15A6BE32179A5CA86DC65A

Created files:

%WinDir%\he1p
%SysDir%\CoreLoad\CoreLoad.sys
%SysDir%\miniie\MiniIE.exe
%SysDir%\miniie\svchost.exe

Autostart registry keys:

HKLM\System\CurrentControlSet\Services\CoreLoad\Type: 01000000
HKLM\System\CurrentControlSet\Services\CoreLoad\Start: 03000000
HKLM\System\CurrentControlSet\Services\CoreLoad\ErrorControl: 01000000
HKLM\System\CurrentControlSet\Services\CoreLoad\Info: 504B0304055852234000000020882CAE7A9F658A0A550DA683839E78199FEBA07F167D81076863E862ADD4151A42CEFFD9B7C501346A333AD7246A53A97662D28679ECEE2BF6A2EFAE7E3FD172442877
HKLM\System\CurrentControlSet\Services\CoreLoad\ImagePath: \??\%WinDir%\System32\CoreLoad\CoreLoad.sys

Detected by UnHackMe:

SVCHOST.EXE
Default location: %SYSDIR%\MINIIE\SVCHOST.EXE

Dropper information:
MD5: 63d001227b322e2036798f00a55aa09c
File size: 1339392 bytes

Leave a Reply