Solved! Use EMUKMI.EXE (Backdoor Nitol) Removal Guide

I recommend you UnHackMe - Ultimate Malware Killer for fast malware removal:

Free Download
Fully Functional 30-day Trial. No credit card is required.
Reviews
. EULA. Privacy Policy. Uninstall.

EMUKMI.EXE – Backdoor Nitol removal

FileMD5Virus Alias
EMUKMI.EXE f126750342861c40d64f0d72817677ff Backdoor Nitol
EMUKMI.EXE f126750342861c40d64f0d72817677ff Trojan DLOADER
EMUKMI.EXE f126750342861c40d64f0d72817677ff Trojan SuspiciousFile
EMUKMI.EXE f126750342861c40d64f0d72817677ff Trojan Artemis
EMUKMI.EXE f126750342861c40d64f0d72817677ff Trojan Generic
EMUKMI.EXE f126750342861c40d64f0d72817677ff Backdoor Zegost

EMUKMI.EXE size: 23040 bytes
EMUKMI.EXE hash: F126750342861C40D64F0D72817677FF

Created files:

%WinDir%\emukmi.exe

Autostart registry keys:

HKLM\System\CurrentControlSet\Services\.Net CLR\Type: 10010000
HKLM\System\CurrentControlSet\Services\.Net CLR\Start: 02000000
HKLM\System\CurrentControlSet\Services\.Net CLR\ErrorControl: 01000000
HKLM\System\CurrentControlSet\Services\.Net CLR\DisplayName: Microsoft .Net Framework COM+ Support
HKLM\System\CurrentControlSet\Services\.Net CLR\ImagePath: %WinDir%\emukmi.exe
HKLM\System\CurrentControlSet\Services\.Net CLR\Description: Microsoft .NET COM+ Integration with SOAP

Detected by UnHackMe:

EMUKMI.EXE
Default location: %WinDir%\EMUKMI.EXE

Dropper information:
MD5: f126750342861c40d64f0d72817677ff
File size: 23040 bytes

Leave a Reply