Solved! Use UWKOOC.PIF (Backdoor Zegost) Removal Guide

I recommend you UnHackMe - Ultimate Malware Killer for fast malware removal:

Free Download
Fully Functional 30-day Trial. No credit card is required.
Reviews
. EULA. Privacy Policy. Uninstall.

UWKOOC.PIF – Backdoor Zegost removal

FileMD5Virus Alias
UWKOOC.PIF e22ee64b67113f960e3e359bdbf533bc Backdoor Zegost
UWKOOC.PIF e22ee64b67113f960e3e359bdbf533bc Trojan Generic
UWKOOC.PIF e22ee64b67113f960e3e359bdbf533bc Trojan Siggen
UWKOOC.PIF e22ee64b67113f960e3e359bdbf533bc Trojan Agent
UWKOOC.PIF e22ee64b67113f960e3e359bdbf533bc Trojan Kryptik
UWKOOC.PIF e22ee64b67113f960e3e359bdbf533bc Trojan Crypt

UWKOOC.PIF size: 210944 bytes
UWKOOC.PIF hash: E22EE64B67113F960E3E359BDBF533BC

Created files:

%WinDir%\uwkooc.pif

Autostart registry keys:

HKLM\System\CurrentControlSet\Services\Ghijkl Nopqrstu Wxy\Type: 10010000
HKLM\System\CurrentControlSet\Services\Ghijkl Nopqrstu Wxy\Start: 02000000
HKLM\System\CurrentControlSet\Services\Ghijkl Nopqrstu Wxy\ErrorControl: 01000000
HKLM\System\CurrentControlSet\Services\Ghijkl Nopqrstu Wxy\DisplayName: Ghijkl Nopqrstu Wxyabcde Ghij
HKLM\System\CurrentControlSet\Services\Ghijkl Nopqrstu Wxy\ImagePath: %WinDir%\uwkooc.pif
HKLM\System\CurrentControlSet\Services\Ghijkl Nopqrstu Wxy\SBIE_CheckPoint: 01000000

Detected by UnHackMe:

UWKOOC.PIF
Default location: %WinDir%\UWKOOC.PIF

Dropper information:
MD5: e22ee64b67113f960e3e359bdbf533bc
File size: 210944 bytes

Leave a Reply