Solved! Use WNR5B.EXE (Trojan Hllw) Removal Guide

I recommend you UnHackMe - Ultimate Malware Killer for fast malware removal:

Free Download
Fully Functional 30-day Trial. No credit card is required.
Reviews
. EULA. Privacy Policy. Uninstall.

WNR5B.EXE – Trojan Hllw removal

FileMD5Virus Alias
WNR5B.EXE 3253e713c58f8234ae4b7728b90cb486 Trojan Hllw

WNR5B.EXE size: 79661 bytes
WNR5B.EXE hash: 3253E713C58F8234AE4B7728B90CB486

Created files:

%Program Files%\Internet Explorer\IEXPLORE.zyq
%Program Files%\Mozilla Firefox\firefox.uwe
%Program Files%\MSN Gaming Zone\Windows\bckgzm.exe
%Program Files%\MSN Gaming Zone\Windows\chkrzm.exe
%Program Files%\MSN Gaming Zone\Windows\hrtzzm.exe
%Program Files%\NetMeeting\conf.xqk
%Program Files%\Windows NT\dialer.ibu
%SysDir%\taskmgr.exe
%SysDir%\Winkny.exe
%TEMP%\Coz50.exe
%TEMP%\Jf51.exe
%TEMP%\Rb59.exe
%TEMP%\Rv54.exe
%TEMP%\Rz52.exe
%TEMP%\Rzb53.exe
%TEMP%\Sjb57.exe
%TEMP%\Vk5A.exe
%TEMP%\Wnr5B.exe
%TEMP%\Wst58.exe
%TEMP%\Wt55.exe
%TEMP%\Za56.exe
\\VBOXSVR\in\Xwbb.doc.exe

Autostart registry keys:

HKLM\System\CurrentControlSet\Services\LL54K\Type: 10010000
HKLM\System\CurrentControlSet\Services\LL54K\Start: 03000000
HKLM\System\CurrentControlSet\Services\LL54K\DisplayName: LL54K
HKLM\System\CurrentControlSet\Services\LL54K\ImagePath: \\VBOXSVR\in\Xwbb.doc.exe
HKLM\System\CurrentControlSet\Services\Winkny\Type: 10010000
HKLM\System\CurrentControlSet\Services\Winkny\Start: 02000000
HKLM\System\CurrentControlSet\Services\Winkny\DisplayName: Winkny
HKLM\System\CurrentControlSet\Services\Winkny\ImagePath: %WinDir%\System32\Winkny.exe

Detected by UnHackMe:

WNR5B.EXE
Default location: %TEMP%\WNR5B.EXE

Dropper information:
MD5: ac30df4f1cbba3f9131fa613d2bd65d0
File size: 87898 bytes

Leave a Reply