SYSSRC32.EXE – Trojan Comame

I recommend you UnHackMe - Ultimate Malware Killer for fast malware removal:

Free Download
Fully Functional 30-day Trial. No credit card is required.
Reviews
. EULA. Privacy Policy. Uninstall.

SYSSRC32.EXE – Trojan Comame removal

FileMD5Virus Alias
SYSSRC32.EXE 47851547b084d2bdd7a8607ec8bdd6d3 Trojan Comame
SYSSRC32.EXE 47851547b084d2bdd7a8607ec8bdd6d3 Trojan Xema
SYSSRC32.EXE 47851547b084d2bdd7a8607ec8bdd6d3 Trojan PAM
SYSSRC32.EXE 47851547b084d2bdd7a8607ec8bdd6d3 Trojan Agent
SYSSRC32.EXE 47851547b084d2bdd7a8607ec8bdd6d3 Trojan Crypt

SYSSRC32.EXE size: 233066 bytes
SYSSRC32.EXE hash: 47851547B084D2BDD7A8607EC8BDD6D3

Created files:

C:\Windows\Help\intret.cnt
C:\Windows\Syssrc32.exe
C:\Windows\System\applets.exe
C:\Windows\System\Explorer.exe
C:\Windows\System\fndfst32.exe
C:\Windows\System\mplayerw.exe
C:\Windows\System\Sysexp32.exe
%Temp%\163841.dmp

Autostart registry keys:

HKLM\Software\Classes\txtfile\shell\open\command\Explore: %SystemRoot%\System32\NOTEPAD.EXE %1
HKLM\Software\Classes\txtfile\shell\open\command : C:\Windows\System\Sysexp32.exe %1
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\System applets: C:\Windows\System\applets.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Syssrc32: C:\Windows\Syssrc32.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\fndfst32: C:\Windows\System\fndfst32.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Explorer Shell: C:\Windows\System\Explorer.exe

Detected by UnHackMe:

SYSSRC32.EXE
Default location: %WinDir%\SYSSRC32.EXE

Dropper information:
MD5: 0e19a441f357250d6ba5fea5fba35984
File size: 223846 bytes

Leave a Reply