NOSAFEMODE.DLL – Trojan SuspiciousFile

I recommend you UnHackMe - Ultimate Malware Killer for fast malware removal:

Free Download
Fully Functional 30-day Trial. No credit card is required.
Reviews
. EULA. Privacy Policy. Uninstall.

NOSAFEMODE.DLL – Trojan SuspiciousFile removal

FileMD5Virus Alias
NOSAFEMODE.DLL 6bb3bca23fdff5b013863d8423267251 Trojan SuspiciousFile
NOSAFEMODE.DLL 6bb3bca23fdff5b013863d8423267251 Trojan Generic
NOSAFEMODE.DLL 6bb3bca23fdff5b013863d8423267251 Trojan Agent

NOSAFEMODE.DLL size: 12800 bytes
NOSAFEMODE.DLL hash: 6BB3BCA23FDFF5B013863D8423267251

Created files:

C:\ProgramData\stppthmain\stppthmain.dll
%SysDir%\cfwin32.dll
%SysDir%\csrss32.dll
%SysDir%\csrss64.dll
%SysDir%\default2.sfx
%SysDir%\NoSafeMode.dll
%SysDir%\nsf.exe
%SysDir%\sdelete.dll
%SysDir%\svchostsv.exe
%SysDir%\svschost.exe

Autostart registry keys:

HKLM\System\CurrentControlSet\Services\fdPHosts\Type: 10000000
HKLM\System\CurrentControlSet\Services\fdPHosts\Start: 02000000
HKLM\System\CurrentControlSet\Services\fdPHosts\ErrorControl: 01000000
HKLM\System\CurrentControlSet\Services\fdPHosts\DisplayName: Wdi Function Discovery Provider Host Records
HKLM\System\CurrentControlSet\Services\fdPHosts\ImagePath: %WinDir%\System32\svschost.exe
HKLM\System\CurrentControlSet\Services\NIaSvc\Type: 10000000
HKLM\System\CurrentControlSet\Services\NIaSvc\Start: 02000000
HKLM\System\CurrentControlSet\Services\NIaSvc\ErrorControl: 01000000
HKLM\System\CurrentControlSet\Services\NIaSvc\DisplayName: Network Locatlon Awareness
HKLM\System\CurrentControlSet\Services\NIaSvc\ImagePath: %WinDir%\System32\svchostsv.exe

Detected by UnHackMe:

NOSAFEMODE.DLL
Default location: %SYSDIR%\NOSAFEMODE.DLL

Dropper information:
MD5: 2bf56d3cf979266de943b5b3fec3c732
File size: 586055 bytes

Leave a Reply