WEW60.EXE – Trojan SuspiciousFile

I recommend you UnHackMe - Ultimate Malware Killer for fast malware removal:

Free Download
Fully Functional 30-day Trial. No credit card is required.
Reviews
. EULA. Privacy Policy. Uninstall.

WEW60.EXE – Trojan SuspiciousFile removal

FileMD5Virus Alias
WEW60.EXE e54b1c6c010d5a2d4a2312c31105b9dd Trojan SuspiciousFile
WEW60.EXE e54b1c6c010d5a2d4a2312c31105b9dd Trojan Hllw

WEW60.EXE size: 539136 bytes
WEW60.EXE hash: E54B1C6C010D5A2D4A2312C31105B9DD

Created files:

%Program Files%\MSN Gaming Zone\Windows\bckgzm.exe
%Program Files%\MSN Gaming Zone\Windows\chkrzm.exe
%Program Files%\NetMeeting\conf.kyu
%Program Files%\Windows NT\dialer.ucl
%SysDir%\Winkabw.exe
%TEMP%\Ech5B.exe
%TEMP%\Ek5C.exe
%TEMP%\Ibo5E.exe
%TEMP%\Igl5D.exe
%TEMP%\No5A.exe
%TEMP%\Omd5F.exe
%TEMP%\Wew60.exe
\\VBOXSVR\in\Yc.htm.exe

Autostart registry keys:

HKLM\System\CurrentControlSet\Services\I88081R25\Type: 10010000
HKLM\System\CurrentControlSet\Services\I88081R25\Start: 03000000
HKLM\System\CurrentControlSet\Services\I88081R25\DisplayName: I88081R25
HKLM\System\CurrentControlSet\Services\I88081R25\ImagePath: \\VBOXSVR\in\Yc.htm.exe
HKLM\System\CurrentControlSet\Services\Winkabw\Type: 10010000
HKLM\System\CurrentControlSet\Services\Winkabw\Start: 02000000
HKLM\System\CurrentControlSet\Services\Winkabw\DisplayName: Winkabw
HKLM\System\CurrentControlSet\Services\Winkabw\ImagePath: %WinDir%\System32\Winkabw.exe

Detected by UnHackMe:

WEW60.EXE
Default location: %TEMP%\WEW60.EXE

Dropper information:
MD5: 39ddb7a7c07133320f112d8de37119eb
File size: 79972 bytes

Leave a Reply