I recommend you UnHackMe - Ultimate Malware Killer for fast malware removal:
Download UnHackMe
Fully Functional 30-day Trial. No credit card is required. Reviews. EULA. Privacy Policy.
MESSENGER.EXE – Trojan Agent removal
| File | MD5 | Virus Alias |
|---|---|---|
| MESSENGER.EXE | 72a6d43a220aff3e2c3afc7ee86f5cad | Trojan Agent |
| MESSENGER.EXE | 72a6d43a220aff3e2c3afc7ee86f5cad | Trojan (Suspicious File) |
| MESSENGER.EXE | 72a6d43a220aff3e2c3afc7ee86f5cad | Trojan Generic |
| MESSENGER.EXE | 72a6d43a220aff3e2c3afc7ee86f5cad | Trojan NSIS |
| MESSENGER.EXE | 72a6d43a220aff3e2c3afc7ee86f5cad | Trojan Downloader |
| MESSENGER.EXE | 72a6d43a220aff3e2c3afc7ee86f5cad | Trojan StartPage |
MESSENGER.EXE size: 93761 bytes
MESSENGER.EXE hash: 72A6D43A220AFF3E2C3AFC7EE86F5CAD
Created files:
C:\messenger.exe
%Program Files Common%\Microsoft Shared\Web Components\messenger.exe
%SysDir%\drivers\rootrepeal.sys
%Temp%\hosts
%Temp%\RootRepeal.exe
%Temp%\svchost.exe
Autostart registry keys:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\messenger.exe: %Program Files Common%\Microsoft Shared\Web Components\messenger.exe
HKLM\System\CurrentControlSet\Services\rootrepeal\Type: 01000000
HKLM\System\CurrentControlSet\Services\rootrepeal\ErrorControl: 01000000
HKLM\System\CurrentControlSet\Services\rootrepeal\Start: 03000000
HKLM\System\CurrentControlSet\Services\rootrepeal\ImagePath: \??\%WinDir%\System32\drivers\rootrepeal.sys
Detected by UnHackMe:
MESSENGER.EXE
Default location: %PROGRAM FILES COMMON%\MICROSOFT SHARED\WEB COMPONENTS\MESSENGER.EXE
Dropper information:
MD5: c5cebe57ec90a09a24db86bcb1bb32d3
File size: 707893 bytes