Solved! Use YLNCXP.SYS (Backdoor Koutodoor) Removal Guide

I will tell you in this post how to fix the issue manually and how to clean it automatically using a special powerful removal tool. You can download the removal program for free here:

Manual removal instructions:

YLNCXP.SYS – Backdoor Koutodoor removal

File MD5 Virus Alias
YLNCXP.SYS 3eb1a9514f3f87d0ca67b5af9c22e28c Backdoor Koutodoor
YLNCXP.SYS 3eb1a9514f3f87d0ca67b5af9c22e28c Trojan Generic
YLNCXP.SYS 3eb1a9514f3f87d0ca67b5af9c22e28c Trojan Eldorado
YLNCXP.SYS 3eb1a9514f3f87d0ca67b5af9c22e28c Trojan Agent
YLNCXP.SYS 3eb1a9514f3f87d0ca67b5af9c22e28c Trojan Crypt

YLNCXP.SYS size: 41728 bytes
YLNCXP.SYS hash: 3EB1A9514F3F87D0CA67B5AF9C22E28C

Created files:

%SysDir%\cjlmb.dll
%SysDir%\drivers\ylncxp.sys

Autostart registry keys:

HKLM\System\CurrentControlSet\Services\ylncxp\Type: 01000000
HKLM\System\CurrentControlSet\Services\ylncxp\ErrorControl: 01000000
HKLM\System\CurrentControlSet\Services\ylncxp\DisplayName: ylncxp
HKLM\System\CurrentControlSet\Services\ylncxp\ImagePath: 730079007300740065006D00330032005C0064007200690076006500720073005C0079006C006E006300780070002E007300790073000000

Detected by UnHackMe:

YLNCXP.SYS
Default location: %SYSDIR%\DRIVERS\YLNCXP.SYS

Dropper information:
MD5: d788f556760b36012f024d8fca29f447
File size: 147712 bytes

Leave a Reply