Solved! Use ANTIVAR.EXE (Trojan Delf) Removal Guide

I recommend you UnHackMe - Ultimate Malware Killer for fast malware removal:

Free Download
Fully Functional 30-day Trial. No credit card is required.
Reviews
. EULA. Privacy Policy. Uninstall.

ANTIVAR.EXE – Trojan Delf removal

FileMD5Virus Alias
ANTIVAR.EXE de6d6e33ffb9a7873ef11ee938b73ab8 Trojan Delf
ANTIVAR.EXE de6d6e33ffb9a7873ef11ee938b73ab8 Trojan Generic
ANTIVAR.EXE de6d6e33ffb9a7873ef11ee938b73ab8 Trojan Eldorado
ANTIVAR.EXE de6d6e33ffb9a7873ef11ee938b73ab8 Trojan Downloader
ANTIVAR.EXE de6d6e33ffb9a7873ef11ee938b73ab8 Trojan Bancos
ANTIVAR.EXE de6d6e33ffb9a7873ef11ee938b73ab8 Trojan Agent

ANTIVAR.EXE size: 177152 bytes
ANTIVAR.EXE hash: DE6D6E33FFB9A7873EF11EE938B73AB8

Created files:

C:\Documents and Settings\LocalService\Local Settings\Application Data\sLT.exf
%SysDir%\antivar.exe

Autostart registry keys:

HKLM\System\CurrentControlSet\Services\ServerNabs4\Type: 10010000
HKLM\System\CurrentControlSet\Services\ServerNabs4\Start: 02000000
HKLM\System\CurrentControlSet\Services\ServerNabs4\ErrorControl: 01000000
HKLM\System\CurrentControlSet\Services\ServerNabs4\DisplayName: ServerNabs4
HKLM\System\CurrentControlSet\Services\ServerNabs4\ImagePath: %WinDir%\System32\antivar.exe

Detected by UnHackMe:

ANTIVAR.EXE
Default location: %SYSDIR%\ANTIVAR.EXE

Dropper information:
MD5: de6d6e33ffb9a7873ef11ee938b73ab8
File size: 177152 bytes

Leave a Reply