Solved! Use ODBCUOTA.EXE (Trojan Crypt) Removal Guide

I recommend you UnHackMe - Ultimate Malware Killer for fast malware removal:

Free Download
Fully Functional 30-day Trial. No credit card is required.
Reviews
. EULA. Privacy Policy. Uninstall.

ODBCUOTA.EXE – Trojan Crypt removal

FileMD5Virus Alias
ODBCUOTA.EXE d673c7e475f07f8ac361a293158a9050 Trojan Crypt
ODBCUOTA.EXE d673c7e475f07f8ac361a293158a9050 Trojan XPACK
ODBCUOTA.EXE d673c7e475f07f8ac361a293158a9050 Trojan Agent
ODBCUOTA.EXE d673c7e475f07f8ac361a293158a9050 Trojan Kryptik
ODBCUOTA.EXE d673c7e475f07f8ac361a293158a9050 Trojan FakeAV

ODBCUOTA.EXE size: 350720 bytes
ODBCUOTA.EXE hash: D673C7E475F07F8AC361A293158A9050

Created files:

%SysDir%\odbcuota.exe
%AppData%\asr_nsta\convac32.exe

Autostart registry keys:

HKLM\System\CurrentControlSet\Services\spsrv\Type: 10000000
HKLM\System\CurrentControlSet\Services\spsrv\Start: 02000000
HKLM\System\CurrentControlSet\Services\spsrv\ErrorControl: 01000000
HKLM\System\CurrentControlSet\Services\spsrv\DisplayName: Windows Protection
HKLM\System\CurrentControlSet\Services\spsrv\ImagePath: %WinDir%\System32\odbcuota.exe -k
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\rcimsmss: %AppData%\asr_nsta\convac32.exe

Detected by UnHackMe:

ODBCUOTA.EXE
Default location: %SYSDIR%\ODBCUOTA.EXE

Dropper information:
MD5: d673c7e475f07f8ac361a293158a9050
File size: 350720 bytes

Leave a Reply