Solved! Use XINSTALL248800.DLL (Backdoor Farfli) Removal Guide

I recommend you UnHackMe - Ultimate Malware Killer for fast malware removal:

Download UnHackMe
Fully Functional 30-day Trial. No credit card is required. Reviews. EULA. Privacy Policy.

XINSTALL248800.DLL – Backdoor Farfli removal

File MD5 Virus Alias
XINSTALL248800.DLL e5ef6953061b16ae355ef9bd3027f3f0 Backdoor Farfli
XINSTALL248800.DLL e5ef6953061b16ae355ef9bd3027f3f0 Trojan PcClient
XINSTALL248800.DLL e5ef6953061b16ae355ef9bd3027f3f0 Trojan Eldorado
XINSTALL248800.DLL e5ef6953061b16ae355ef9bd3027f3f0 Trojan Downloader
XINSTALL248800.DLL e5ef6953061b16ae355ef9bd3027f3f0 Trojan Graftor
XINSTALL248800.DLL e5ef6953061b16ae355ef9bd3027f3f0 Rootkit TDSS

XINSTALL248800.DLL size: 224768 bytes
XINSTALL248800.DLL hash: E5EF6953061B16AE355EF9BD3027F3F0

Created files:

C:\windows\xinstall248800.dll
%Common AppData%\Microsoft\Dr Watson\user.dmp

Autostart registry keys:

HKLM\System\CurrentControlSet\Services\RemoteAccess\RouterManagers\Ip\DLLPath: 43003A005C00770069006E0064006F00770073005C00780069006E007300740061006C006C003200340038003800300030002E0064006C006C000000
HKLM\System\CurrentControlSet\Services\Tjrajt Ugyuilry Opk\Type: 10010000
HKLM\System\CurrentControlSet\Services\Tjrajt Ugyuilry Opk\Start: 02000000
HKLM\System\CurrentControlSet\Services\Tjrajt Ugyuilry Opk\DisplayName: Djiaya Jxdhychd Xbpoponn Nkkh
HKLM\System\CurrentControlSet\Services\Tjrajt Ugyuilry Opk\ImagePath: %SystemRoot%\System32\svchost.exe -k sougou

Detected by UnHackMe:

XINSTALL248800.DLL
Default location: %WinDir%\XINSTALL248800.DLL

Dropper information:
MD5: 36837ef1eabda0b5c0cca60c3f8e48c3
File size: 303104 bytes

Leave a Reply