COMMANDPROMPT.SYSM – Trojan Downloader removal

COMMANDPROMPT.SYSM size: 78335 bytes
COMMANDPROMPT.SYSM hash: 3ABAD43E9D37B006470A1BA3060381EF

Created files:

%Program Files%\Messenger\msmsgs.exe
C:\windows\system32\CommandPrompt.Sysm
C:\windows\system32\Desktop.sysm
C:\windows\system32\Windows 3D.scr
C:\windows\system32\~A~m~B~u~R~a~D~u~L~?\csrss.exe
C:\windows\system32\~A~m~B~u~R~a~D~u~L~?\csrss.exe?
C:\windows\system32\~A~m~B~u~R~a~D~u~L~?\lsass.exe
C:\windows\system32\~A~m~B~u~R~a~D~u~L~?\msvbvm60.dll
C:\windows\system32\~A~m~B~u~R~a~D~u~L~?\services.exe
C:\windows\system32\~A~m~B~u~R~a~D~u~L~?\smss.exe
C:\windows\system32\~A~m~B~u~R~a~D~u~L~?\winlogon.exe
C:\windows\system32\~A~m~B~u~R~a~D~u~L~?\~Paraysutki_VM_Community~
%AppData%\Microsoft\2052
%AppData%\Microsoft\ndst.exe

Detected by UnHackMe:

COMMANDPROMPT.SYSM
Default location: %SYSDIR%\COMMANDPROMPT.SYSM

Dropper information:
MD5: 07cec7936077054a9ba6d5c63428b986
File size: 210434 bytes