Solved! Use OPERA_1161_INT_SETUP.EXE (Trojan Delf) Removal Guide

I recommend you UnHackMe - Ultimate Malware Killer for fast malware removal:

Free Download
Fully Functional 30-day Trial. No credit card is required.
Reviews
. EULA. Privacy Policy. Uninstall.

OPERA_1161_INT_SETUP.EXE – Trojan Delf removal

FileMD5Virus Alias
OPERA_1161_INT_SETUP.EXE b6b7cbaa1acc6fe0145ed04ef8595445 Trojan Delf
OPERA_1161_INT_SETUP.EXE b6b7cbaa1acc6fe0145ed04ef8595445 Trojan Hlux
OPERA_1161_INT_SETUP.EXE b6b7cbaa1acc6fe0145ed04ef8595445 Trojan Eldorado
OPERA_1161_INT_SETUP.EXE b6b7cbaa1acc6fe0145ed04ef8595445 Trojan Delphi
OPERA_1161_INT_SETUP.EXE b6b7cbaa1acc6fe0145ed04ef8595445 Trojan Crypt
OPERA_1161_INT_SETUP.EXE b6b7cbaa1acc6fe0145ed04ef8595445 Backdoor IRCBot

OPERA_1161_INT_SETUP.EXE size: 10625518 bytes
OPERA_1161_INT_SETUP.EXE hash: B6B7CBAA1ACC6FE0145ED04EF8595445

Created files:

%SysDir%\sIRC4.exe
%SysDir%\xdccPrograms\KillOK.exe
%SysDir%\xdccPrograms\Network Setup Wizard.exe
%SysDir%\xdccPrograms\Opera_1161_int_Setup.exe
%SysDir%\xdccPrograms\SafariSetup.exe
%SysDir%\xdccPrograms\SoftwareUpdate.exe
%SysDir%\xdccPrograms\Wireless Network Setup Wizard.exe

Autostart registry keys:

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell: Explorer.exe sIRC4.exe

Detected by UnHackMe:

OPERA_1161_INT_SETUP.EXE
Default location: %SYSDIR%\XDCCPROGRAMS\OPERA_1161_INT_SETUP.EXE

Dropper information:
MD5: 0eb9122714055815b0566af20e22bbd1
File size: 92582 bytes

Leave a Reply