UNINSTALL.EXE – Trojan Qhost removal

UNINSTALL.EXE size: 57389 bytes
UNINSTALL.EXE hash: 18146543B88824EC06A6F3CA6C2151A4

Created files:

%Program Files%\Utiloceanzip\COMDLG32.OCX
%Program Files%\Utiloceanzip\Uninstall.exe
%Program Files%\Utiloceanzip\utiloceandn.exe
%Program Files%\Utiloceanzip\utiloceanup.exe
%WinDir%\fileupinst.exe
%Temporary Internet Files%\Content.IE5\1HVEIEYW\background_gradient[1]
%Temporary Internet Files%\Content.IE5\1HVEIEYW\dnserrordiagoff_webOC[1]
%Temporary Internet Files%\Content.IE5\8OZFYSFM\ErrorPageTemplate[1]
%Temporary Internet Files%\Content.IE5\8OZFYSFM\info_48[1]
%Temporary Internet Files%\Content.IE5\9ZXDM8KN\down[1]
%Temporary Internet Files%\Content.IE5\9ZXDM8KN\httpErrorPagesScripts[1]
%Temporary Internet Files%\Content.IE5\M3TXLF4P\bullet[1]
%Temporary Internet Files%\Content.IE5\M3TXLF4P\errorPageStrings[1]
%SysDir%\INETKO.DLL

Autostart registry keys:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\UtilOcean: %Program Files%\Utiloceanzip\utiloceanup.exe

Detected by UnHackMe:

UNINSTALL.EXE
Default location: %PROGRAM FILES%\UTILOCEANZIP\UNINSTALL.EXE

Dropper information:
MD5: 5d3e8bd4c9cfdb8a681f4c6f4658599e
File size: 950152 bytes