Solved! Use MSNMESSENGER.EXE (Trojan Artemis) Removal Guide

I recommend you UnHackMe - Ultimate Malware Killer for fast malware removal:

Download UnHackMe
Fully Functional 30-day Trial. No credit card is required. Reviews. EULA. Privacy Policy.

MSNMESSENGER.EXE – Trojan Artemis removal

File MD5 Virus Alias
MSNMESSENGER.EXE aeedc43bdef3da4382a7aaacc38d9996 Trojan Artemis
MSNMESSENGER.EXE aeedc43bdef3da4382a7aaacc38d9996 Trojan SuspiciousFile
MSNMESSENGER.EXE aeedc43bdef3da4382a7aaacc38d9996 Trojan Generic
MSNMESSENGER.EXE aeedc43bdef3da4382a7aaacc38d9996 Trojan Downloader
MSNMESSENGER.EXE aeedc43bdef3da4382a7aaacc38d9996 Trojan CI
MSNMESSENGER.EXE aeedc43bdef3da4382a7aaacc38d9996 Worm Autorun

MSNMESSENGER.EXE size: 136192 bytes
MSNMESSENGER.EXE hash: AEEDC43BDEF3DA4382A7AAACC38D9996

Created files:

%WinDir%\75667605_1615523703836_1108627876_1685566_1395009_n.jpg.exe
%SysDir%\Windows Live Messenger Hizmetleri\msnmessenger.exe

Autostart registry keys:

HKLM\Software\Microsoft\Active Setup\Installed Components\{B76SWI38-7BYS-MHK6-4I30-00VXCRRB16GD}\StubPath: 43003A005C00570049004E0044004F00570053005C00730079007300740065006D00330032005C00570069006E0064006F007700730020004C0069007600650020004D0065007300730065006E006700650072002000480069007A006D00650074006C006500720069005C006D0073006E006D0065007300730065006E006700650072002E006500780065000000
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\HKLM: 43003A005C00570049004E0044004F00570053005C00730079007300740065006D00330032005C00570069006E0064006F007700730020004C0069007600650020004D0065007300730065006E006700650072002000480069007A006D00650074006C006500720069005C006D0073006E006D0065007300730065006E006700650072002E006500780065000000
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\HKCU: 43003A005C00570049004E0044004F00570053005C00730079007300740065006D00330032005C00570069006E0064006F007700730020004C0069007600650020004D0065007300730065006E006700650072002000480069007A006D00650074006C006500720069005C006D0073006E006D0065007300730065006E006700650072002E006500780065000000

Detected by UnHackMe:

MSNMESSENGER.EXE
Default location: %SYSDIR%\WINDOWS LIVE MESSENGER HIZMETLERI\MSNMESSENGER.EXE

Dropper information:
MD5: aeedc43bdef3da4382a7aaacc38d9996
File size: 136192 bytes

Leave a Reply