Solved! Use SYSHOST.EXE (Trojan FakeAV) Removal Guide

I recommend you UnHackMe - Ultimate Malware Killer for fast malware removal:

Download UnHackMe
Fully Functional 30-day Trial. No credit card is required. Reviews. EULA. Privacy Policy.

SYSHOST.EXE – Trojan FakeAV removal

File MD5 Virus Alias
SYSHOST.EXE d766a977e566149ab2d081ab649ee3b0 Trojan FakeAV
SYSHOST.EXE d766a977e566149ab2d081ab649ee3b0 Trojan Generic
SYSHOST.EXE d766a977e566149ab2d081ab649ee3b0 Trojan Eldorado
SYSHOST.EXE d766a977e566149ab2d081ab649ee3b0 Fake Antivirus SecurityTool
SYSHOST.EXE d766a977e566149ab2d081ab649ee3b0 Trojan Agent
SYSHOST.EXE d766a977e566149ab2d081ab649ee3b0 Trojan Kryptik

SYSHOST.EXE size: 139264 bytes
SYSHOST.EXE hash: D766A977E566149AB2D081AB649EE3B0

Created files:

%WinDir%\Installer\{AE4D3AB0-7BD4-0A7E-E911-F06CE2F3FA7A}\syshost.exe

Autostart registry keys:

HKLM\System\CurrentControlSet\Services\syshost32\Type: 10000000
HKLM\System\CurrentControlSet\Services\syshost32\Start: 02000000
HKLM\System\CurrentControlSet\Services\syshost32\ImagePath: “%WinDir%\Installer\{AE4D3AB0-7BD4-0A7E-E911-F06CE2F3FA7A}\syshost.exe” /service

Detected by UnHackMe:

SYSHOST.EXE
Default location: %WinDir%\INSTALLER\{AE4D3AB0-7BD4-0A7E-E911-F06CE2F3FA7A}\SYSHOST.EXE

Dropper information:
MD5: d766a977e566149ab2d081ab649ee3b0
File size: 139264 bytes

Leave a Reply