Solved! Use DQRHQI.EXE (Backdoor Nitol) Removal Guide

I recommend you UnHackMe - Ultimate Malware Killer for fast malware removal:

Free Download
Fully Functional 30-day Trial. No credit card is required.
Reviews
. EULA. Privacy Policy. Uninstall.

DQRHQI.EXE – Backdoor Nitol removal

FileMD5Virus Alias
DQRHQI.EXE 0174d0b8c85752736ff9ba2e1ea82a6c Backdoor Nitol
DQRHQI.EXE 0174d0b8c85752736ff9ba2e1ea82a6c Trojan SuspiciousFile
DQRHQI.EXE 0174d0b8c85752736ff9ba2e1ea82a6c Trojan ModifiedUPX
DQRHQI.EXE 0174d0b8c85752736ff9ba2e1ea82a6c Trojan Eldorado
DQRHQI.EXE 0174d0b8c85752736ff9ba2e1ea82a6c Backdoor RBot
DQRHQI.EXE 0174d0b8c85752736ff9ba2e1ea82a6c Trojan Downloader

DQRHQI.EXE size: 26112 bytes
DQRHQI.EXE hash: 0174D0B8C85752736FF9BA2E1EA82A6C

Created files:

%SysDir%\dqrhqi.exe

Autostart registry keys:

HKLM\System\CurrentControlSet\Services\DSLserverorm\Type: 10000000
HKLM\System\CurrentControlSet\Services\DSLserverorm\Start: 02000000
HKLM\System\CurrentControlSet\Services\DSLserverorm\DisplayName: DCOM Serverxlp Process Launcher.
HKLM\System\CurrentControlSet\Services\DSLserverorm\ImagePath: %WinDir%\System32\dqrhqi.exe
HKLM\System\CurrentControlSet\Services\DSLserverorm\Description: DCOM Servernia Process Launcher..

Detected by UnHackMe:

DQRHQI.EXE
Default location: %SYSDIR%\DQRHQI.EXE

Dropper information:
MD5: 0174d0b8c85752736ff9ba2e1ea82a6c
File size: 26112 bytes

Leave a Reply