Solved! Use LSPPOA.EXE (Backdoor Nitol) Removal Guide

I recommend you UnHackMe - Ultimate Malware Killer for fast malware removal:

Free Download
Fully Functional 30-day Trial. No credit card is required.
Reviews
. EULA. Privacy Policy. Uninstall.

LSPPOA.EXE – Backdoor Nitol removal

FileMD5Virus Alias
LSPPOA.EXE f3d421043e8286ae544344e680582e78 Backdoor Nitol
LSPPOA.EXE f3d421043e8286ae544344e680582e78 Trojan SuspiciousFile
LSPPOA.EXE f3d421043e8286ae544344e680582e78 Trojan Agent
LSPPOA.EXE f3d421043e8286ae544344e680582e78 Backdoor Zegost
LSPPOA.EXE f3d421043e8286ae544344e680582e78 Backdoor Farfli

LSPPOA.EXE size: 20480 bytes
LSPPOA.EXE hash: F3D421043E8286AE544344E680582E78

Created files:

%WinDir%\lsppoa.exe

Autostart registry keys:

HKLM\System\CurrentControlSet\Services\Pqrstu Wxyabcde Ghi\Type: 10010000
HKLM\System\CurrentControlSet\Services\Pqrstu Wxyabcde Ghi\Start: 02000000
HKLM\System\CurrentControlSet\Services\Pqrstu Wxyabcde Ghi\ErrorControl: 01000000
HKLM\System\CurrentControlSet\Services\Pqrstu Wxyabcde Ghi\DisplayName: Pqrstu Wxyabcde Ghijklmn Pqrs
HKLM\System\CurrentControlSet\Services\Pqrstu Wxyabcde Ghi\ImagePath: %WinDir%\lsppoa.exe
HKLM\System\CurrentControlSet\Services\Pqrstu Wxyabcde Ghi\Description: Pqrstuvw Yabcdefgh Jklmnop Rstuvwxy Bcd

Detected by UnHackMe:

LSPPOA.EXE
Default location: %WinDir%\LSPPOA.EXE

Dropper information:
MD5: f3d421043e8286ae544344e680582e78
File size: 20480 bytes

Leave a Reply