Solved! Use WYOCUS.EXE (Backdoor Nitol) Removal Guide

I recommend you UnHackMe - Ultimate Malware Killer for fast malware removal:

Free Download
Fully Functional 30-day Trial. No credit card is required.
Reviews
. EULA. Privacy Policy. Uninstall.

WYOCUS.EXE – Backdoor Nitol removal

FileMD5Virus Alias
WYOCUS.EXE 668dcaedcaaaa96a120be38fadf4b8db Backdoor Nitol
WYOCUS.EXE 668dcaedcaaaa96a120be38fadf4b8db Trojan Eldorado
WYOCUS.EXE 668dcaedcaaaa96a120be38fadf4b8db Trojan Downloader
WYOCUS.EXE 668dcaedcaaaa96a120be38fadf4b8db Trojan OnLineGames
WYOCUS.EXE 668dcaedcaaaa96a120be38fadf4b8db Trojan Agent

WYOCUS.EXE size: 338944 bytes
WYOCUS.EXE hash: 668DCAEDCAAAA96A120BE38FADF4B8DB

Created files:

C:\DelInfo.bin
%SysDir%\gei33.dll
%SysDir%\wyocus.exe
%TEMP%\ReInstall.exe
%TEMP%\wowsub.sys
%Temp%\ReInstall.exe

Autostart registry keys:

HKLM\System\CurrentControlSet\Services\aspnet_statesufo\Type: 10000000
HKLM\System\CurrentControlSet\Services\aspnet_statesufo\Start: 02000000
HKLM\System\CurrentControlSet\Services\aspnet_statesufo\DisplayName: ASP.NET State Serviceslcg Transaction Coordinator Service
HKLM\System\CurrentControlSet\Services\aspnet_statesufo\ImagePath: %WinDir%\System32\wyocus.exe
HKLM\System\CurrentControlSet\Services\aspnet_statesufo\Description: Provides support for out-of-to-processruq Transaction Coordinator Service.
HKLM\System\CurrentControlSet\Services\bits\Start: 02000000
HKLM\System\CurrentControlSet\Services\wowsub\Type: 01000000
HKLM\System\CurrentControlSet\Services\wowsub\Start: 03000000
HKLM\System\CurrentControlSet\Services\wowsub\ErrorControl: 01000000
HKLM\System\CurrentControlSet\Services\wowsub\DisplayName: wowsub
HKLM\System\CurrentControlSet\Services\wowsub\ImagePath: %TEMP%\wowsub.sys

Detected by UnHackMe:

WYOCUS.EXE
Default location: %SYSDIR%\WYOCUS.EXE

Dropper information:
MD5: 668dcaedcaaaa96a120be38fadf4b8db
File size: 338944 bytes

Leave a Reply