Solved! Use NWCWKS.DLL (Trojan Graftor) Removal Guide

I will tell you in this post how to fix the issue manually and how to clean it automatically using a special powerful removal tool. You can download the removal program for free here:

Manual removal instructions:

NWCWKS.DLL – Trojan Graftor removal

File MD5 Virus Alias
NWCWKS.DLL 560f8147e9bb5a728d8715120d2f7e7f Trojan Graftor
NWCWKS.DLL 560f8147e9bb5a728d8715120d2f7e7f Trojan (Suspicious File)
NWCWKS.DLL 560f8147e9bb5a728d8715120d2f7e7f Trojan Generic
NWCWKS.DLL 560f8147e9bb5a728d8715120d2f7e7f Trojan Vilsel
NWCWKS.DLL 560f8147e9bb5a728d8715120d2f7e7f Trojan Agent
NWCWKS.DLL 560f8147e9bb5a728d8715120d2f7e7f Trojan Crypt

NWCWKS.DLL size: 8192 bytes
NWCWKS.DLL hash: 560F8147E9BB5A728D8715120D2F7E7F

Created files:

%SysDir%\nwcwks.dll

Autostart registry keys:

HKLM\System\CurrentControlSet\Services\6to4\SBIE_Win32ExitCode: 02000000
HKLM\System\CurrentControlSet\Services\NWCWorkstation\Type: 20000000
HKLM\System\CurrentControlSet\Services\NWCWorkstation\Start: 02000000
HKLM\System\CurrentControlSet\Services\NWCWorkstation\ErrorControl: 01000000
HKLM\System\CurrentControlSet\Services\NWCWorkstation\DisplayName: Client Service for NetWare
HKLM\System\CurrentControlSet\Services\NWCWorkstation\ImagePath: %SystemRoot%\System32\svchost.exe -k netsvcs
HKLM\System\CurrentControlSet\Services\NWCWorkstation\Parameters\ServiceDll: 2500530079007300740065006D0052006F006F00740025005C00730079007300740065006D00330032005C006E007700630077006B0073002E0064006C006C000000

Detected by UnHackMe:

NWCWKS.DLL
Default location: %SYSDIR%\NWCWKS.DLL

Dropper information:
MD5: d6672aae883c70c94c436d2436ce5e7e
File size: 49152 bytes