lame.exe – Trojan Barys removal

Created files:

%Program Files%\Apple Software Update\Plugins\tmp.exe – Trojan Barys
%Program Files%\Apple Software Update\SoftwareUpdate.Resources\da.lproj\tmp.exe – Trojan Barys
%Program Files%\Apple Software Update\SoftwareUpdate.Resources\de.lproj\tmp.exe – Trojan Barys
%Program Files%\Apple Software Update\SoftwareUpdate.Resources\en.lproj\tmp.exe – Trojan Barys
%Program Files%\Apple Software Update\SoftwareUpdate.Resources\es.lproj\tmp.exe – Trojan Barys
%Program Files%\Apple Software Update\SoftwareUpdate.Resources\fi.lproj\tmp.exe – Trojan Barys
%Program Files%\Apple Software Update\SoftwareUpdate.Resources\fr.lproj\tmp.exe – Trojan Barys
%Program Files%\Apple Software Update\SoftwareUpdate.Resources\it.lproj\tmp.exe – Trojan Barys
%Program Files%\Apple Software Update\SoftwareUpdate.Resources\ja.lproj\tmp.exe – Trojan Barys
%Program Files%\Apple Software Update\SoftwareUpdate.Resources\ko.lproj\tmp.exe – Trojan Barys
%Program Files%\Apple Software Update\SoftwareUpdate.Resources\nb.lproj\tmp.exe – Trojan Barys
%Program Files%\Apple Software Update\SoftwareUpdate.Resources\nl.lproj\tmp.exe – Trojan Barys
%Program Files%\Apple Software Update\SoftwareUpdate.Resources\pl.lproj\tmp.exe – Trojan Barys
%Program Files%\Apple Software Update\SoftwareUpdate.Resources\pt.lproj\tmp.exe – Trojan Barys
%Program Files%\Apple Software Update\SoftwareUpdate.Resources\pt_PT.lproj\tmp.exe – Trojan Barys
%Program Files%\Apple Software Update\SoftwareUpdate.Resources\ru.lproj\tmp.exe – Trojan Barys
%Program Files%\Apple Software Update\SoftwareUpdate.Resources\sv.lproj\tmp.exe – Trojan Barys
%Program Files%\Apple Software Update\SoftwareUpdate.Resources\tmp.exe – Trojan Barys
%Program Files%\Apple Software Update\SoftwareUpdate.Resources\zh_CN.lproj\tmp.exe – Trojan Barys
%Program Files%\Apple Software Update\SoftwareUpdate.Resources\zh_TW.lproj\tmp.exe – Trojan Barys
%Program Files%\Apple Software Update\SoftwareUpdateFiles.Resources\da.lproj\tmp.exe – Trojan Barys
%Program Files%\Apple Software Update\SoftwareUpdateFiles.Resources\de.lproj\tmp.exe – Trojan Barys
%Program Files%\Apple Software Update\SoftwareUpdateFiles.Resources\en.lproj\tmp.exe – Trojan Barys
%Program Files%\Apple Software Update\SoftwareUpdateFiles.Resources\es.lproj\tmp.exe – Trojan Barys
%Program Files%\Apple Software Update\SoftwareUpdateFiles.Resources\fi.lproj\tmp.exe – Trojan Barys
%Program Files%\Apple Software Update\SoftwareUpdateFiles.Resources\fr.lproj\tmp.exe – Trojan Barys
%Program Files%\Apple Software Update\SoftwareUpdateFiles.Resources\it.lproj\tmp.exe – Trojan Barys
%Program Files%\Apple Software Update\SoftwareUpdateFiles.Resources\ja.lproj\tmp.exe – Trojan Barys
%Program Files%\Apple Software Update\SoftwareUpdateFiles.Resources\ko.lproj\tmp.exe – Trojan Barys
%Program Files%\Apple Software Update\SoftwareUpdateFiles.Resources\nb.lproj\tmp.exe – Trojan Barys
%Program Files%\Apple Software Update\SoftwareUpdateFiles.Resources\nl.lproj\tmp.exe – Trojan Barys
%Program Files%\Apple Software Update\SoftwareUpdateFiles.Resources\pl.lproj\tmp.exe – Trojan Barys
%Program Files%\Apple Software Update\SoftwareUpdateFiles.Resources\pt.lproj\tmp.exe – Trojan Barys
%Program Files%\Apple Software Update\SoftwareUpdateFiles.Resources\pt_PT.lproj\tmp.exe – Trojan Barys
%Program Files%\Apple Software Update\SoftwareUpdateFiles.Resources\ru.lproj\tmp.exe – Trojan Barys
%Program Files%\Apple Software Update\SoftwareUpdateFiles.Resources\sv.lproj\tmp.exe – Trojan Barys
%Program Files%\Apple Software Update\SoftwareUpdateFiles.Resources\tmp.exe – Trojan Barys
%Program Files%\Apple Software Update\SoftwareUpdateFiles.Resources\zh_CN.lproj\tmp.exe – Trojan Barys
%Program Files%\Apple Software Update\SoftwareUpdateFiles.Resources\zh_TW.lproj\tmp.exe – Trojan Barys
%Program Files%\Apple Software Update\tmp.exe – Trojan Barys
%Program Files Common%\Apple\Apple Application Support\AVFoundationCF.resources\tmp.exe – Trojan Barys
%Program Files Common%\Apple\Apple Application Support\CFNetwork.resources\tmp.exe – Trojan Barys
%Program Files Common%\Apple\Apple Application Support\ColorSync.resources\tmp.exe – Trojan Barys
%Program Files Common%\Apple\Apple Application Support\CoreFoundation.resources\tmp.exe – Trojan Barys
%Program Files Common%\Apple\Apple Application Support\CoreGraphics.resources\tmp.exe – Trojan Barys
%Program Files Common%\Apple\Apple Application Support\Foundation.resources\tmp.exe – Trojan Barys
%Program Files Common%\Apple\Apple Application Support\JavaScriptCore.resources\tmp.exe – Trojan Barys
%Program Files Common%\Apple\Apple Application Support\LinguisticData.resources\tmp.exe – Trojan Barys
%Program Files Common%\Apple\Apple Application Support\MediaToolbox.resources\tmp.exe – Trojan Barys
%Program Files Common%\Apple\Apple Application Support\tmp.exe – Trojan Barys
%Program Files Common%\Apple\Apple Application Support\WebKit.resources\tmp.exe – Trojan Barys
%Program Files Common%\Apple\Apple Application Support\WebKit2WebProcess.resources\tmp.exe – Trojan Barys
%Program Files Common%\Apple\tmp.exe – Trojan Barys
%Program Files Common%\Microsoft Shared\DAO\tmp.exe – Trojan Barys
%Program Files Common%\Microsoft Shared\MSInfo\tmp.exe – Trojan Barys
%Program Files Common%\Microsoft Shared\Speech\1033\tmp.exe – Trojan Barys
%Program Files Common%\Microsoft Shared\Speech\tmp.exe – Trojan Barys
%Program Files Common%\Microsoft Shared\Stationery\tmp.exe – Trojan Barys
%Program Files Common%\Microsoft Shared\TextConv\tmp.exe – Trojan Barys
%Program Files Common%\Microsoft Shared\tmp.exe – Trojan Barys
%Program Files Common%\Microsoft Shared\Triedit\tmp.exe – Trojan Barys
%Program Files Common%\Microsoft Shared\VGX\tmp.exe – Trojan Barys
%Program Files Common%\Microsoft Shared\Web Folders\tmp.exe – Trojan Barys
%Program Files Common%\Microsoft Shared\web server extensions\40\tmp.exe – Trojan Barys
%Program Files Common%\Microsoft Shared\web server extensions\tmp.exe – Trojan Barys
%Program Files Common%\MSSoap\Binaries\Resources\tmp.exe – Trojan Barys
%Program Files Common%\MSSoap\Binaries\tmp.exe – Trojan Barys
%Program Files Common%\MSSoap\tmp.exe – Trojan Barys
%Program Files Common%\ODBC\Data Sources\tmp.exe – Trojan Barys
%Program Files Common%\ODBC\tmp.exe – Trojan Barys
%Program Files Common%\Services\tmp.exe – Trojan Barys
%Program Files Common%\SpeechEngines\Microsoft\Lexicon\tmp.exe – Trojan Barys
%Program Files Common%\SpeechEngines\Microsoft\tmp.exe – Trojan Barys
%Program Files Common%\SpeechEngines\Microsoft\TTS\tmp.exe – Trojan Barys
%Program Files Common%\SpeechEngines\tmp.exe – Trojan Barys
%Program Files Common%\System\ado\tmp.exe – Trojan Barys
%Program Files Common%\System\msadc\tmp.exe – Trojan Barys
%Program Files Common%\System\Ole DB\tmp.exe – Trojan Barys
%Program Files Common%\System\tmp.exe – Trojan Barys
%Program Files Common%\tmp.exe – Trojan Barys
%Program Files%\ComPlus Applications\tmp.exe – Trojan Barys
%Program Files%\Far2\Documentation\eng\tmp.exe – Trojan Barys
%Program Files%\Far2\Documentation\rus\tmp.exe – Trojan Barys
%Program Files%\Far2\Documentation\tmp.exe – Trojan Barys
%Program Files%\Far2\FExcept\tmp.exe – Trojan Barys
%Program Files%\Far2\Plugins\Align\tmp.exe – Trojan Barys
%Program Files%\Far2\Plugins\arclite\tmp.exe – Trojan Barys
%Program Files%\Far2\Plugins\AutoWrap\tmp.exe – Trojan Barys
%Program Files%\Far2\Plugins\Brackets\tmp.exe – Trojan Barys
%Program Files%\Far2\Plugins\Compare\tmp.exe – Trojan Barys
%Program Files%\Far2\Plugins\DrawLine\tmp.exe – Trojan Barys
%Program Files%\Far2\Plugins\EditCase\tmp.exe – Trojan Barys
%Program Files%\Far2\Plugins\EMenu\tmp.exe – Trojan Barys
%Program Files%\Far2\Plugins\FarCmds\tmp.exe – Trojan Barys
%Program Files%\Far2\Plugins\FileCase\tmp.exe – Trojan Barys
%Program Files%\Far2\Plugins\FTP\lib\tmp.exe – Trojan Barys
%Program Files%\Far2\Plugins\FTP\tmp.exe – Trojan Barys
%Program Files%\Far2\Plugins\HlfViewer\tmp.exe – Trojan Barys
%Program Files%\Far2\Plugins\MacroView\tmp.exe – Trojan Barys
%Program Files%\Far2\Plugins\Network\tmp.exe – Trojan Barys
%Program Files%\Far2\Plugins\ProcList\tmp.exe – Trojan Barys
%Program Files%\Far2\Plugins\tmp.exe – Trojan Barys
%Program Files%\Far2\Plugins\TmpPanel\tmp.exe – Trojan Barys
%Program Files%\Far2\tmp.exe – Trojan Barys
%Program Files%\Internet Explorer\Connection Wizard\tmp.exe – Trojan Barys
%Program Files%\Internet Explorer\en-US\tmp.exe – Trojan Barys
%Program Files%\Internet Explorer\SIGNUP\tmp.exe – Trojan Barys
%Program Files%\Internet Explorer\tmp.exe – Trojan Barys
%Program Files%\Messenger\tmp.exe – Trojan Barys
%Program Files%\microsoft frontpage\tmp.exe – Trojan Barys
%Program Files%\microsoft frontpage\version3.0\bin\tmp.exe – Trojan Barys
%Program Files%\microsoft frontpage\version3.0\tmp.exe – Trojan Barys
%Program Files%\Movie Maker\MUI\0409\tmp.exe – Trojan Barys
%Program Files%\Movie Maker\MUI\tmp.exe – Trojan Barys
%Program Files%\Movie Maker\Shared\Profiles\tmp.exe – Trojan Barys
%Program Files%\Movie Maker\Shared\tmp.exe – Trojan Barys
%Program Files%\Movie Maker\tmp.exe – Trojan Barys
%Program Files%\Mozilla Firefox\components\tmp.exe – Trojan Barys
%Program Files%\Mozilla Firefox\defaults\pref\tmp.exe – Trojan Barys
%Program Files%\Mozilla Firefox\defaults\tmp.exe – Trojan Barys
%Program Files%\Mozilla Firefox\dictionaries\tmp.exe – Trojan Barys
%Program Files%\Mozilla Firefox\extensions\tmp.exe – Trojan Barys
%Program Files%\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}\tmp.exe – Trojan Barys
%Program Files%\Mozilla Firefox\jsloader\resource\tmp.exe – Trojan Barys
%Program Files%\Mozilla Firefox\jsloader\tmp.exe – Trojan Barys
%Program Files%\Mozilla Firefox\searchplugins\tmp.exe – Trojan Barys
%Program Files%\Mozilla Firefox\tmp.exe – Trojan Barys
%Program Files%\Mozilla Firefox\uninstall\tmp.exe – Trojan Barys
%Program Files%\MSN\MSNCoreFiles\Install\MSN9Components\tmp.exe – Trojan Barys
%Program Files%\MSN\MSNCoreFiles\Install\tmp.exe – Trojan Barys
%Program Files%\MSN\MSNCoreFiles\OOBE\tmp.exe – Trojan Barys
%Program Files%\MSN\MSNCoreFiles\tmp.exe – Trojan Barys
%Program Files%\MSN\tmp.exe – Trojan Barys
%Program Files%\MSN Gaming Zone\tmp.exe – Trojan Barys
%Program Files%\MSN Gaming Zone\Windows\tmp.exe – Trojan Barys
%Program Files%\NetMeeting\tmp.exe – Trojan Barys
%Program Files%\Online Services\tmp.exe – Trojan Barys
%Program Files%\Opera\defaults\tmp.exe – Trojan Barys
%Program Files%\Opera\extra\tmp.exe – Trojan Barys
%Program Files%\Opera\gstreamer\plugins\tmp.exe – Trojan Barys
%Program Files%\Opera\gstreamer\tmp.exe – Trojan Barys
%Program Files%\Opera\locale\af\tmp.exe – Trojan Barys
%Program Files%\Opera\locale\az\tmp.exe – Trojan Barys
%Program Files%\Opera\locale\be\tmp.exe – Trojan Barys
%Program Files%\Opera\locale\bg\tmp.exe – Trojan Barys
%Program Files%\Opera\locale\bn\tmp.exe – Trojan Barys
%Program Files%\Opera\locale\cs\tmp.exe – Trojan Barys
%Program Files%\Opera\locale\da\tmp.exe – Trojan Barys
%Program Files%\Opera\locale\de\tmp.exe – Trojan Barys
%Program Files%\Opera\locale\el\tmp.exe – Trojan Barys
%Program Files%\Opera\locale\en\tmp.exe – Trojan Barys
%Program Files%\Opera\locale\en-GB\tmp.exe – Trojan Barys
%Program Files%\Opera\locale\es-ES\tmp.exe – Trojan Barys
%Program Files%\Opera\locale\es-LA\tmp.exe – Trojan Barys
%Program Files%\Opera\locale\et\tmp.exe – Trojan Barys
%Program Files%\Opera\locale\fi\tmp.exe – Trojan Barys
%Program Files%\Opera\locale\fr\tmp.exe – Trojan Barys
%Program Files%\Opera\locale\fr-CA\tmp.exe – Trojan Barys
%Program Files%\Opera\locale\fy\tmp.exe – Trojan Barys
%Program Files%\Opera\locale\gd\tmp.exe – Trojan Barys
%Program Files%\Opera\locale\hi\tmp.exe – Trojan Barys
%Program Files%\Opera\locale\hr\tmp.exe – Trojan Barys
%Program Files%\Opera\locale\hu\tmp.exe – Trojan Barys
%Program Files%\Opera\locale\id\tmp.exe – Trojan Barys
%Program Files%\Opera\locale\it\tmp.exe – Trojan Barys
%Program Files%\Opera\locale\ja\tmp.exe – Trojan Barys
%Program Files%\Opera\locale\ka\tmp.exe – Trojan Barys
%Program Files%\Opera\locale\ko\tmp.exe – Trojan Barys
%Program Files%\Opera\locale\lt\tmp.exe – Trojan Barys
%Program Files%\Opera\locale\me\tmp.exe – Trojan Barys
%Program Files%\Opera\locale\mk\tmp.exe – Trojan Barys
%Program Files%\Opera\locale\ms\tmp.exe – Trojan Barys
%Program Files%\Opera\locale\nb\tmp.exe – Trojan Barys
%Program Files%\Opera\locale\nl\tmp.exe – Trojan Barys
%Program Files%\Opera\locale\nn\tmp.exe – Trojan Barys
%Program Files%\Opera\locale\pa\tmp.exe – Trojan Barys
%Program Files%\Opera\locale\pl\tmp.exe – Trojan Barys
%Program Files%\Opera\locale\pt\tmp.exe – Trojan Barys
%Program Files%\Opera\locale\pt-BR\tmp.exe – Trojan Barys
%Program Files%\Opera\locale\ro\tmp.exe – Trojan Barys
%Program Files%\Opera\locale\ru\tmp.exe – Trojan Barys
%Program Files%\Opera\locale\sk\tmp.exe – Trojan Barys
%Program Files%\Opera\locale\sr\tmp.exe – Trojan Barys
%Program Files%\Opera\locale\sv\tmp.exe – Trojan Barys
%Program Files%\Opera\locale\sw\tmp.exe – Trojan Barys
%Program Files%\Opera\locale\ta\tmp.exe – Trojan Barys
%Program Files%\Opera\locale\te\tmp.exe – Trojan Barys
%Program Files%\Opera\locale\th\tmp.exe – Trojan Barys
%Program Files%\Opera\locale\tl\tmp.exe – Trojan Barys
%Program Files%\Opera\locale\tmp.exe – Trojan Barys
%Program Files%\Opera\locale\tr\tmp.exe – Trojan Barys
%Program Files%\Opera\locale\uk\tmp.exe – Trojan Barys
%Program Files%\Opera\locale\uz\tmp.exe – Trojan Barys
%Program Files%\Opera\locale\vi\tmp.exe – Trojan Barys
%Program Files%\Opera\locale\zh-cn\tmp.exe – Trojan Barys
%Program Files%\Opera\locale\zh-tw\tmp.exe – Trojan Barys
%Program Files%\Opera\locale\zu\tmp.exe – Trojan Barys
%Program Files%\Opera\program\plugins\tmp.exe – Trojan Barys
%Program Files%\Opera\program\tmp.exe – Trojan Barys
%Program Files%\Opera\region\cis\en\tmp.exe – Trojan Barys
%Program Files%\Opera\region\cis\ru\tmp.exe – Trojan Barys
%Program Files%\Opera\region\cis\tmp.exe – Trojan Barys
%Program Files%\Opera\region\cn\en\tmp.exe – Trojan Barys
%Program Files%\Opera\region\cn\tmp.exe – Trojan Barys
%Program Files%\Opera\region\gb\tmp.exe – Trojan Barys
%Program Files%\Opera\region\hk\tmp.exe – Trojan Barys
%Program Files%\Opera\region\id\tmp.exe – Trojan Barys
%Program Files%\Opera\region\in\tmp.exe – Trojan Barys
%Program Files%\Opera\region\latin_america\tmp.exe – Trojan Barys
%Program Files%\Opera\region\middle_east\tmp.exe – Trojan Barys
%Program Files%\Opera\region\tmp.exe – Trojan Barys
%Program Files%\Opera\region\tw\tmp.exe – Trojan Barys
%Program Files%\Opera\region\ua\ru\tmp.exe – Trojan Barys
%Program Files%\Opera\region\ua\tmp.exe – Trojan Barys
%Program Files%\Opera\region\us\tmp.exe – Trojan Barys
%Program Files%\Opera\skin\tmp.exe – Trojan Barys
%Program Files%\Opera\styles\images\tmp.exe – Trojan Barys
%Program Files%\Opera\styles\tmp.exe – Trojan Barys
%Program Files%\Opera\styles\user\tmp.exe – Trojan Barys
%Program Files%\Opera\tmp.exe – Trojan Barys
%Program Files%\Opera\ui\tmp.exe – Trojan Barys
%Program Files%\Opera\unite\tmp.exe – Trojan Barys
%Program Files%\Oracle\tmp.exe – Trojan Barys
%Program Files%\Oracle\VirtualBox Guest Additions\tmp.exe – Trojan Barys
%Program Files%\Outlook Express\tmp.exe – Trojan Barys
%Program Files%\Safari\Plugins\tmp.exe – Trojan Barys
%Program Files%\Safari\PubSub.resources\da.lproj\tmp.exe – Trojan Barys
%Program Files%\Safari\PubSub.resources\de.lproj\tmp.exe – Trojan Barys
%Program Files%\Safari\PubSub.resources\English.lproj\tmp.exe – Trojan Barys
%Program Files%\Safari\PubSub.resources\es.lproj\tmp.exe – Trojan Barys
%Program Files%\Safari\PubSub.resources\fi.lproj\tmp.exe – Trojan Barys
%Program Files%\Safari\PubSub.resources\tmp.exe – Trojan Barys
%Program Files%\Safari\tmp.exe – Trojan Barys
%Program Files%\tmp.exe – Trojan Barys
%WinDir%\lame.exe – Trojan Barys
%WinDir%\TEMP\tmp.exe – Trojan Barys
%WinDir%\tmp.exe – Trojan Barys

Autostart registry keys:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\SonyAgent: %WinDir%\lame.exe

Detected by UnHackMe:

lame.exe
Default location: %WinDir%\lame.exe

Dropper information:
SHA256: a840974697986db8e260c0744698b84116860210441fffd0124afe5a77e104e4
SHA1: f0ceea26d7e47e200891af1c1fad17c80c6ae9d8
MD5: c10d0d5b9eba81628a7972291eeb7e90
File size: 891904 bytes