Solved! Use VMNHMW.EXE (Backdoor Nitol) Removal Guide

I recommend you UnHackMe - Ultimate Malware Killer for fast malware removal:

Download UnHackMe
Fully Functional 30-day Trial. No credit card is required. Reviews. EULA. Privacy Policy.

VMNHMW.EXE – Backdoor Nitol removal

File MD5 Virus Alias
VMNHMW.EXE b00304e9e0706130310c5ba808f8b9cc Backdoor Nitol
VMNHMW.EXE b00304e9e0706130310c5ba808f8b9cc Trojan SuspiciousFile
VMNHMW.EXE b00304e9e0706130310c5ba808f8b9cc Trojan Generic
VMNHMW.EXE b00304e9e0706130310c5ba808f8b9cc Trojan Eldorado
VMNHMW.EXE b00304e9e0706130310c5ba808f8b9cc Backdoor Hupigon
VMNHMW.EXE b00304e9e0706130310c5ba808f8b9cc Trojan Siggen

VMNHMW.EXE size: 43184 bytes
VMNHMW.EXE hash: B00304E9E0706130310C5BA808F8B9CC

Created files:

%SysDir%\hra33.dll
%WinDir%\vmnhmw.exe

Autostart registry keys:

HKLM\System\CurrentControlSet\Services\Defghi Klmnaopqr Tuv\Type: 10010000
HKLM\System\CurrentControlSet\Services\Defghi Klmnaopqr Tuv\Start: 02000000
HKLM\System\CurrentControlSet\Services\Defghi Klmnaopqr Tuv\ErrorControl: 01000000
HKLM\System\CurrentControlSet\Services\Defghi Klmnaopqr Tuv\DisplayName: Defghi Klmnopaqr Tuvwxyab Defg
HKLM\System\CurrentControlSet\Services\Defghi Klmnaopqr Tuv\ImagePath: %WinDir%\vmnhmw.exe
HKLM\System\CurrentControlSet\Services\Defghi Klmnaopqr Tuv\Description: Defghijk Mnoapqrstu Wxyabcd Fghijklm Opq

Detected by UnHackMe:

VMNHMW.EXE
Default location: %WinDir%\VMNHMW.EXE

Dropper information:
MD5: b00304e9e0706130310c5ba808f8b9cc
File size: 43184 bytes

Leave a Reply