TEMP2.EXE – Trojan Kryptik

I recommend you UnHackMe - Ultimate Malware Killer for fast malware removal:

Free Download
Fully Functional 30-day Trial. No credit card is required.
Reviews
. EULA. Privacy Policy. Uninstall.

TEMP2.EXE – Trojan Kryptik removal

FileMD5Virus Alias
TEMP2.EXE f677a2aa9fde377d2cfec9f5513e42e6 Trojan Kryptik
TEMP2.EXE f677a2aa9fde377d2cfec9f5513e42e6 Trojan SuspiciousFile
TEMP2.EXE f677a2aa9fde377d2cfec9f5513e42e6 Trojan XPACK
TEMP2.EXE f677a2aa9fde377d2cfec9f5513e42e6 Trojan Generic
TEMP2.EXE f677a2aa9fde377d2cfec9f5513e42e6 Trojan Click
TEMP2.EXE f677a2aa9fde377d2cfec9f5513e42e6 Trojan Eldorado

TEMP2.EXE size: 29184 bytes
TEMP2.EXE hash: F677A2AA9FDE377D2CFEC9F5513E42E6

Created files:

C:\2777100.dll
C:\windows\system32\dllcache\ws2help.dll
C:\windows\system32\drivers\420a0a1f.sys
C:\windows\system32\drivers\xpV3001.sys
C:\windows\system32\ws2helpXP.dll
C:\windows\system32\wshtcpip.dll
C:\windows\Tasks\TespayServer.exe
C:\windows\temp\svohcst.exe
C:\windows\temp\temp1.exe
C:\windows\temp\temp2.exe
C:\windows\temp\temp3.exe
C:\windows\temp\temp4.exe

Autostart registry keys:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Download: C:\windows\temp\svohcst.exe
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit: %WinDir%\System32\userinit.exe,%WinDir%\Tasks\TespayServer.exe|X- |2?`?Detected by UnHackMe:

TEMP2.EXE
Default location: %TEMP%\TEMP2.EXE

Dropper information:
MD5: 288a5cc1a2c387f8f28969df45fc0d30
File size: 456720 bytes

Leave a Reply