Solved! Use VMHVMO.EXE (Backdoor Nitol) Removal Guide

I recommend you UnHackMe - Ultimate Malware Killer for fast malware removal:

Download UnHackMe
Fully Functional 30-day Trial. No credit card is required. Reviews. EULA. Privacy Policy.

VMHVMO.EXE – Backdoor Nitol removal

File MD5 Virus Alias
VMHVMO.EXE bca321fb75761e034f82afbf0c3fb6e1 Backdoor Nitol
VMHVMO.EXE bca321fb75761e034f82afbf0c3fb6e1 Trojan DLOADER
VMHVMO.EXE bca321fb75761e034f82afbf0c3fb6e1 Trojan SuspiciousFile
VMHVMO.EXE bca321fb75761e034f82afbf0c3fb6e1 Trojan Eldorado
VMHVMO.EXE bca321fb75761e034f82afbf0c3fb6e1 Backdoor RBot
VMHVMO.EXE bca321fb75761e034f82afbf0c3fb6e1 Trojan Downloader

VMHVMO.EXE size: 31744 bytes
VMHVMO.EXE hash: BCA321FB75761E034F82AFBF0C3FB6E1

Created files:

%SysDir%\hra8.dll
%SysDir%\vmhvmo.exe

Autostart registry keys:

HKLM\System\CurrentControlSet\Services\Defghi Klmnopqr Tuv\Type: 10000000
HKLM\System\CurrentControlSet\Services\Defghi Klmnopqr Tuv\Start: 02000000
HKLM\System\CurrentControlSet\Services\Defghi Klmnopqr Tuv\DisplayName: Defghi Klmnopqr Tuvwxyab Defg
HKLM\System\CurrentControlSet\Services\Defghi Klmnopqr Tuv\ImagePath: %WinDir%\System32\vmhvmo.exe
HKLM\System\CurrentControlSet\Services\Defghi Klmnopqr Tuv\Description: Defghijk Mnopqrstu Wxyabcd Fghijklm Opq

Detected by UnHackMe:

VMHVMO.EXE
Default location: %SYSDIR%\VMHVMO.EXE

Dropper information:
MD5: bca321fb75761e034f82afbf0c3fb6e1
File size: 31744 bytes

Leave a Reply