Solved! Use RDPMLWA.EXE (Trojan Artemis) Removal Guide

I recommend you UnHackMe - Ultimate Malware Killer for fast malware removal:

Free Download
Fully Functional 30-day Trial. No credit card is required.
Reviews
. EULA. Privacy Policy. Uninstall.

RDPMLWA.EXE – Trojan Artemis removal

FileMD5Virus Alias
RDPMLWA.EXE 7953adf71fb2e5c5d956f66823cb8d7e Trojan Artemis
RDPMLWA.EXE 7953adf71fb2e5c5d956f66823cb8d7e Trojan SuspiciousFile
RDPMLWA.EXE 7953adf71fb2e5c5d956f66823cb8d7e Trojan Generic
RDPMLWA.EXE 7953adf71fb2e5c5d956f66823cb8d7e Trojan CI
RDPMLWA.EXE 7953adf71fb2e5c5d956f66823cb8d7e Rootkit TDSS
RDPMLWA.EXE 7953adf71fb2e5c5d956f66823cb8d7e Trojan Agent

RDPMLWA.EXE size: 61440 bytes
RDPMLWA.EXE hash: 7953ADF71FB2E5C5D956F66823CB8D7E

Created files:

%WinDir%\Rdpmlwa.exe

Autostart registry keys:

HKLM\System\CurrentControlSet\Services\Wsykwc ommmsmko\ConnectGroup: ?????????
HKLM\System\CurrentControlSet\Services\Wsykwc ommmsmko\MarkTime: 2014-11-18 07:38
HKLM\System\CurrentControlSet\Services\Wsykwc ommmsmko\Type: 10010000
HKLM\System\CurrentControlSet\Services\Wsykwc ommmsmko\Start: 02000000
HKLM\System\CurrentControlSet\Services\Wsykwc ommmsmko\DisplayName: Jgqtfz rxbyfpwz
HKLM\System\CurrentControlSet\Services\Wsykwc ommmsmko\ImagePath: %WinDir%\Rdpmlwa.exe

Detected by UnHackMe:

RDPMLWA.EXE
Default location: %WinDir%\RDPMLWA.EXE

Dropper information:
MD5: 7953adf71fb2e5c5d956f66823cb8d7e
File size: 61440 bytes

Leave a Reply