RCFLYE.EXE – Backdoor Nitol

I recommend you UnHackMe - Ultimate Malware Killer for fast malware removal:

Free Download
Fully Functional 30-day Trial. No credit card is required.
Reviews
. EULA. Privacy Policy. Uninstall.

RCFLYE.EXE – Backdoor Nitol removal

FileMD5Virus Alias
RCFLYE.EXE 09d19ceb8a6c9843a4556995c75fbb12 Backdoor Nitol
RCFLYE.EXE 09d19ceb8a6c9843a4556995c75fbb12 Trojan PAK_Generic
RCFLYE.EXE 09d19ceb8a6c9843a4556995c75fbb12 Trojan SuspiciousFile
RCFLYE.EXE 09d19ceb8a6c9843a4556995c75fbb12 Trojan Downloader
RCFLYE.EXE 09d19ceb8a6c9843a4556995c75fbb12 Trojan DNAScan
RCFLYE.EXE 09d19ceb8a6c9843a4556995c75fbb12 Trojan Agent

RCFLYE.EXE size: 69128 bytes
RCFLYE.EXE hash: 09D19CEB8A6C9843A4556995C75FBB12

Created files:

%SysDir%\rcflye.exe

Autostart registry keys:

HKLM\System\CurrentControlSet\Services\DSLserverjwl\Type: 10000000
HKLM\System\CurrentControlSet\Services\DSLserverjwl\Start: 02000000
HKLM\System\CurrentControlSet\Services\DSLserverjwl\DisplayName: DCOM Serverbul Process Launcher.
HKLM\System\CurrentControlSet\Services\DSLserverjwl\ImagePath: %WinDir%\System32\rcflye.exe
HKLM\System\CurrentControlSet\Services\DSLserverjwl\Description: DCOM Serverpur Process Launcher..

Detected by UnHackMe:

RCFLYE.EXE
Default location: %SYSDIR%\RCFLYE.EXE

Dropper information:
MD5: 09d19ceb8a6c9843a4556995c75fbb12
File size: 69128 bytes

Leave a Reply