Solved! Use IRMA TRIANA.SCR (Trojan Agent) Removal Guide

I recommend you UnHackMe - Ultimate Malware Killer for fast malware removal:

Free Download
Fully Functional 30-day Trial. No credit card is required.
Reviews
. EULA. Privacy Policy. Uninstall.

IRMA TRIANA.SCR – Trojan Agent removal

FileMD5Virus Alias
IRMA TRIANA.SCR 7d1f6d38167f039addd64d89b8d9b723 Trojan Agent
IRMA TRIANA.SCR 7d1f6d38167f039addd64d89b8d9b723 Trojan Hllw
IRMA TRIANA.SCR 7d1f6d38167f039addd64d89b8d9b723 Backdoor RBot

IRMA TRIANA.SCR size: 616885 bytes
IRMA TRIANA.SCR hash: 7D1F6D38167F039ADDD64D89B8D9B723

Created files:

C:\Penylethylamine.scr
%Program Files Common%\Aliciana.Alisa
%Program Files Common%\Emira.Emma
%Program Files%\Irma Triana.scr
%Program Files%\I_Miss_U_MyPrincess.scr
%Program Files%\May be Smansa was wonderful place to us.scr
%Program Files%\Your_Prince_Will_Be_Waiting_For_You.scr
C:\Renova.htt
%WinDir%\services.exe
%SysDir%\3IPA2.SMANSA.PKP.exe
%SysDir%\jd.exe
C:\Xenova.scr
%AppData%\Mr_CF\Renova_Join_Mr_CoolFace.htt
%Desktop%\Message For My Princess.scr
%UserProfile%\Local Settings\AKGNAB_UALUP.exe

Autostart registry keys:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Alumni_Smoensa_Pangkalpinang: Mr_CoolFaceDid You Miss Me… My PrincessThe Prince is Asking a QuestionIrma Trianainf4D2.tmp
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\My_Old_Class: 3IPA2.SMANSA.PKP.exeAlumni_Smoensa_Pangkalpinang\3IPA2.SMANSA.PKP.exeWindowsSecurityServ
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSecurityService: %WinDir%\services.exe2.SMANSA.PKP.exe9b8d9b723.EXE|X- |l?p????U???
HKCU\Control Panel\Desktop\SCRNSAVE.EXE: MR_COO~1.SCR

Detected by UnHackMe:

IRMA TRIANA.SCR
Default location: %PROGRAM FILES%\IRMA TRIANA.SCR

Dropper information:
MD5: 7d1f6d38167f039addd64d89b8d9b723
File size: 616885 bytes

Leave a Reply