Solved! Use EMGOIS.EXE (Trojan Barys) Removal Guide

I recommend you UnHackMe - Ultimate Malware Killer for fast malware removal:

Free Download
Fully Functional 30-day Trial. No credit card is required.
Reviews
. EULA. Privacy Policy. Uninstall.

EMGOIS.EXE – Trojan Barys removal

FileMD5Virus Alias
EMGOIS.EXE 9808ef55c0da699cc0a4cadcffccb0a6 Trojan Barys
EMGOIS.EXE 9808ef55c0da699cc0a4cadcffccb0a6 Trojan Generic
EMGOIS.EXE 9808ef55c0da699cc0a4cadcffccb0a6 Trojan Siggen
EMGOIS.EXE 9808ef55c0da699cc0a4cadcffccb0a6 Trojan Agent
EMGOIS.EXE 9808ef55c0da699cc0a4cadcffccb0a6 Backdoor Zegost
EMGOIS.EXE 9808ef55c0da699cc0a4cadcffccb0a6 Backdoor Farfli

EMGOIS.EXE size: 810510 bytes
EMGOIS.EXE hash: 9808EF55C0DA699CC0A4CADCFFCCB0A6

Created files:

%SysDir%\emgois.exe

Autostart registry keys:

HKLM\System\CurrentControlSet\Services\Defghi Klmnopqr Tuv\Type: 10010000
HKLM\System\CurrentControlSet\Services\Defghi Klmnopqr Tuv\Start: 02000000
HKLM\System\CurrentControlSet\Services\Defghi Klmnopqr Tuv\DisplayName: Defghi Klmnopqr Tuvwxyab Defg
HKLM\System\CurrentControlSet\Services\Defghi Klmnopqr Tuv\ImagePath: %WinDir%\System32\emgois.exe
HKLM\System\CurrentControlSet\Services\Defghi Klmnopqr Tuv\Description: Defghi Klmnopqr Tuvwxyab Defg

Detected by UnHackMe:

EMGOIS.EXE
Default location: %SYSDIR%\EMGOIS.EXE

Dropper information:
MD5: 9808ef55c0da699cc0a4cadcffccb0a6
File size: 810510 bytes

Leave a Reply