Solved! Use RECYCLED.EXE (Worm Vobfus) Removal Guide

I recommend you UnHackMe - Ultimate Malware Killer for fast malware removal:

Free Download
Fully Functional 30-day Trial. No credit card is required.
Reviews
. EULA. Privacy Policy. Uninstall.

RECYCLED.EXE – Worm Vobfus removal

FileMD5Virus Alias
RECYCLED.EXE 724f6ac07e70c802ec319d4885a0895e Worm Vobfus
RECYCLED.EXE 724f6ac07e70c802ec319d4885a0895e Trojan Generic
RECYCLED.EXE 724f6ac07e70c802ec319d4885a0895e Trojan Siggen
RECYCLED.EXE 724f6ac07e70c802ec319d4885a0895e Worm Pronny
RECYCLED.EXE 724f6ac07e70c802ec319d4885a0895e Trojan Crypt

RECYCLED.EXE size: 47494 bytes
RECYCLED.EXE hash: 724F6AC07E70C802EC319D4885A0895E

Created files:

C:\Documents and Settings\Default User\Start Menu\Programs\Startup\ .exe
C:\My Shared Documents.exe
%WinDir%\system\wincirl.com
%SysDir%\SVCH0ST.EXE
D:\Recycled.exe
\\vboxsrv\in\TEST.exe
%Common Startmenu%\Programs\Startup\ .exe
%AppData%\Microsoft\Internet Explorer\Quick Launch\TEST.exe
%Favorites%\Links\www.test.com
%Temp%\TEST.EXE
%Startup%\ .exe

Autostart registry keys:

HKLM\Software\Microsoft\Windows\CurrentVersion\run\Microsoft Agent: %WinDir%\System32\SVCH0ST.EXE
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell: Explorer.exe %WinDir%/System32/SVCH0ST.EXE
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\load: %WinDir%/System/wincirl.com

Detected by UnHackMe:

RECYCLED.EXE
Default location: D:\RECYCLED.EXE

Dropper information:
MD5: d7876030295d0c615efdabe63f97eb20
File size: 47232 bytes

Leave a Reply