Solved! Use SHELL.EXE (Worm Brontok) Removal Guide

I recommend you UnHackMe - Ultimate Malware Killer for fast malware removal:

Free Download
Fully Functional 30-day Trial. No credit card is required.
Reviews
. EULA. Privacy Policy. Uninstall.

SHELL.EXE – Worm Brontok removal

FileMD5Virus Alias
SHELL.EXE c757bae7a6fdafd7029786bc9a898d3b Worm Brontok
SHELL.EXE c757bae7a6fdafd7029786bc9a898d3b Trojan Eldorado
SHELL.EXE c757bae7a6fdafd7029786bc9a898d3b Trojan Agent

SHELL.EXE size: 87061 bytes
SHELL.EXE hash: C757BAE7A6FDAFD7029786BC9A898D3B

Created files:

C:\tiwi.exe
%WinDir%\msvbvm60.dll
%SysDir%\IExplorer.exe
%SysDir%\msvbvm60.dll
%SysDir%\shell.exe
%SysDir%\tiwi.scr
%WinDir%\tiwi.exe
%Common Startmenu%\Programs\Startup\Empty.pif
%Local AppData%\WINDOWS\cute.exe
%Local AppData%\WINDOWS\imoet.exe
%Local AppData%\WINDOWS\lsass.exe
%Local AppData%\WINDOWS\smss.exe
%Local AppData%\WINDOWS\winlogon.exe

Autostart registry keys:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\LogonUSER: %Local AppData%\WINDOWS\imoet.exe
HKCU\Control Panel\Desktop\SCRNSAVE.EXE: %WinDir%\System32\tiwi.SCR
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\tiwi: %WinDir%\tiwi
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS: %Local AppData%\WINDOWS\winlogon.exe

Detected by UnHackMe:

SHELL.EXE
Default location: %SYSDIR%\SHELL.EXE

Dropper information:
MD5: 040207916cd19ad77d263dcdb1f20a00
File size: 87061 bytes

Leave a Reply