Solved! Use KNL.SYS (Backdoor Koutodoor) Removal Guide

I will tell you in this post how to fix the issue manually and how to clean it automatically using a special powerful removal tool. You can download the removal program for free here:

Manual removal instructions:

KNL.SYS – Backdoor Koutodoor removal

File MD5 Virus Alias
KNL.SYS 2c6554ed60af3b5b6f8afa117d77b4bd Backdoor Koutodoor
KNL.SYS 2c6554ed60af3b5b6f8afa117d77b4bd Trojan Generic
KNL.SYS 2c6554ed60af3b5b6f8afa117d77b4bd Trojan Eldorado
KNL.SYS 2c6554ed60af3b5b6f8afa117d77b4bd Trojan Agent
KNL.SYS 2c6554ed60af3b5b6f8afa117d77b4bd Trojan Crypt

KNL.SYS size: 41312 bytes
KNL.SYS hash: 2C6554ED60AF3B5B6F8AFA117D77B4BD

Created files:

%SysDir%\drivers\knl.sys
%SysDir%\pwcory.dll
%Temp%\dgraik.exe

Autostart registry keys:

HKLM\System\CurrentControlSet\Services\knl\Type: 01000000
HKLM\System\CurrentControlSet\Services\knl\ErrorControl: 01000000
HKLM\System\CurrentControlSet\Services\knl\DisplayName: knl
HKLM\System\CurrentControlSet\Services\knl\ImagePath: 730079007300740065006D00330032005C0064007200690076006500720073005C006B006E006C002E007300790073000000

Detected by UnHackMe:

KNL.SYS
Default location: %SYSDIR%\DRIVERS\KNL.SYS

Dropper information:
MD5: 01559d4e682e11c1c0abfd607d6aa17a
File size: 282688 bytes

Leave a Reply