Solved! Use NWCWKS.DLL (Trojan Graftor) Removal Guide

I recommend you UnHackMe - Ultimate Malware Killer for fast malware removal:

Free Download
Fully Functional 30-day Trial. No credit card is required.
Reviews
. EULA. Privacy Policy. Uninstall.

NWCWKS.DLL – Trojan Graftor removal

FileMD5Virus Alias
NWCWKS.DLL 560f8147e9bb5a728d8715120d2f7e7f Trojan Graftor
NWCWKS.DLL 560f8147e9bb5a728d8715120d2f7e7f Trojan (Suspicious File)
NWCWKS.DLL 560f8147e9bb5a728d8715120d2f7e7f Trojan Generic
NWCWKS.DLL 560f8147e9bb5a728d8715120d2f7e7f Trojan Vilsel
NWCWKS.DLL 560f8147e9bb5a728d8715120d2f7e7f Trojan Agent
NWCWKS.DLL 560f8147e9bb5a728d8715120d2f7e7f Trojan Crypt

NWCWKS.DLL size: 8192 bytes
NWCWKS.DLL hash: 560F8147E9BB5A728D8715120D2F7E7F

Created files:

%SysDir%\nwcwks.dll

Autostart registry keys:

HKLM\System\CurrentControlSet\Services\6to4\SBIE_Win32ExitCode: 02000000
HKLM\System\CurrentControlSet\Services\NWCWorkstation\Type: 20000000
HKLM\System\CurrentControlSet\Services\NWCWorkstation\Start: 02000000
HKLM\System\CurrentControlSet\Services\NWCWorkstation\ErrorControl: 01000000
HKLM\System\CurrentControlSet\Services\NWCWorkstation\DisplayName: Client Service for NetWare
HKLM\System\CurrentControlSet\Services\NWCWorkstation\ImagePath: %SystemRoot%\System32\svchost.exe -k netsvcs
HKLM\System\CurrentControlSet\Services\NWCWorkstation\Parameters\ServiceDll: 2500530079007300740065006D0052006F006F00740025005C00730079007300740065006D00330032005C006E007700630077006B0073002E0064006C006C000000

Detected by UnHackMe:

NWCWKS.DLL
Default location: %SYSDIR%\NWCWKS.DLL

Dropper information:
MD5: d6672aae883c70c94c436d2436ce5e7e
File size: 49152 bytes

Leave a Reply