Solved! Use FTPDLL.DLL (Trojan Downloader) Removal Guide

I recommend you UnHackMe - Ultimate Malware Killer for fast malware removal:

Download UnHackMe
Fully Functional 30-day Trial. No credit card is required. Reviews. EULA. Privacy Policy.

FTPDLL.DLL – Trojan Downloader removal

File MD5 Virus Alias
FTPDLL.DLL d807aa04480d1d149f7a4cac22984188 Trojan Downloader
FTPDLL.DLL d807aa04480d1d149f7a4cac22984188 Trojan Generic
FTPDLL.DLL d807aa04480d1d149f7a4cac22984188 Trojan Eldorado
FTPDLL.DLL d807aa04480d1d149f7a4cac22984188 Trojan Agent
FTPDLL.DLL d807aa04480d1d149f7a4cac22984188 Trojan Small

FTPDLL.DLL size: 5120 bytes
FTPDLL.DLL hash: D807AA04480D1D149F7A4CAC22984188

Created files:

%SysDir%\drivers\spools.exe
%SysDir%\ftpdll.dll
%UserProfile%\ftpdll.dll
%Local AppData%\cftmon.exe

Autostart registry keys:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ntuser: %WinDir%\System32\drivers\spools.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\autoload: %Local AppData%\cftmon.exe
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell: Explorer.exe
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit: %WinDir%\System32\userinit.exe,
HKLM\System\CurrentControlSet\Services\Schedule\ImagePath: 43003A005C00570049004E0044004F00570053005C00730079007300740065006D00330032005C0064007200690076006500720073005C00730070006F006F006C0073002E006500780065000000
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ntuser: %WinDir%\System32\drivers\spools.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\autoload: %Local AppData%\cftmon.exe

Detected by UnHackMe:

FTPDLL.DLL
Default location: %SYSDIR%\FTPDLL.DLL

Dropper information:
MD5: fd0fb147bf87ea22cfddd17011180fb0
File size: 8334810 bytes

Leave a Reply