I recommend you UnHackMe - Ultimate Malware Killer for fast malware removal:
Download UnHackMe
Fully Functional 30-day Trial. No credit card is required. Reviews. EULA. Privacy Policy.
SVCHOST.EXE – Backdoor Hupigon removal
| File | MD5 | Virus Alias |
|---|---|---|
| SVCHOST.EXE | ea9127ba9806feb9d6c77bf31f87db0d | Backdoor Hupigon |
| SVCHOST.EXE | ea9127ba9806feb9d6c77bf31f87db0d | Trojan ASPack |
| SVCHOST.EXE | ea9127ba9806feb9d6c77bf31f87db0d | Trojan SuspiciousFile |
SVCHOST.EXE size: 1073664 bytes
SVCHOST.EXE hash: EA9127BA9806FEB9D6C77BF31F87DB0D
Created files:
%SysDir%\drivers\disdn\CDial.dll
%SysDir%\drivers\disdn\iniuser1.exe
%SysDir%\drivers\disdn\ping.exe
%SysDir%\drivers\disdn\regeditfuwu.exe
%SysDir%\drivers\disdn\sql.exe
%SysDir%\drivers\disdn\svchost.exe
%SysDir%\drivers\disdn\tcps.exe
%SysDir%\drivers\disdn\uuid.dll
Autostart registry keys:
HKLM\System\CurrentControlSet\Services\RunAServces\Type: 10000000
HKLM\System\CurrentControlSet\Services\RunAServces\Start: 02000000
HKLM\System\CurrentControlSet\Services\RunAServces\ErrorControl: 01000000
HKLM\System\CurrentControlSet\Services\RunAServces\DisplayName: Remote Procedure Call (RPC) Service
HKLM\System\CurrentControlSet\Services\RunAServces\ImagePath: %WinDir%\System32\drivers\disdn\svchost.exe -service
Detected by UnHackMe:
SVCHOST.EXE
Default location: %SYSDIR%\DRIVERS\DISDN\SVCHOST.EXE
Dropper information:
MD5: 2d12c6fc593e4f2f092a0c6c1ce925ce
File size: 1039020 bytes