Solved! Use SVHOST.EXE (Backdoor Nitol) Removal Guide

I recommend you UnHackMe - Ultimate Malware Killer for fast malware removal:

Download UnHackMe
Fully Functional 30-day Trial. No credit card is required. Reviews. EULA. Privacy Policy.

SVHOST.EXE – Backdoor Nitol removal

File MD5 Virus Alias
SVHOST.EXE fa84ad7fffc5fe12bafd3c20507c98ef Backdoor Nitol
SVHOST.EXE fa84ad7fffc5fe12bafd3c20507c98ef Trojan SuspiciousFile
SVHOST.EXE fa84ad7fffc5fe12bafd3c20507c98ef Trojan Generic
SVHOST.EXE fa84ad7fffc5fe12bafd3c20507c98ef Trojan CI

SVHOST.EXE size: 57344 bytes
SVHOST.EXE hash: FA84AD7FFFC5FE12BAFD3C20507C98EF

Created files:

%SysDir%\hra33.dll
%SysDir%\svhost.exe

Autostart registry keys:

HKLM\System\CurrentControlSet\Services\Please Input Service Nisb\Type: 10010000
HKLM\System\CurrentControlSet\Services\Please Input Service Nisb\Start: 02000000
HKLM\System\CurrentControlSet\Services\Please Input Service Nisb\DisplayName: Please Input Service Dispgnu Transaction Coordinator Service
HKLM\System\CurrentControlSet\Services\Please Input Service Nisb\ImagePath: %WinDir%\System32//svhost.exe

Detected by UnHackMe:

SVHOST.EXE
Default location: %SYSDIR%\SVHOST.EXE

Dropper information:
MD5: fa84ad7fffc5fe12bafd3c20507c98ef
File size: 57344 bytes

Leave a Reply