CURL.EXE – Unclassified Malware removal

CURL.EXE size: 2525184 bytes
CURL.EXE hash: 5289E22531FC667095F2D3021C9190EF

Created files:

%TEMP%\ir_ext_temp_0\AutoPlay\autorun.cdd
%TEMP%\ir_ext_temp_0\AutoPlay\Buttons\1044_0018.btn
%TEMP%\ir_ext_temp_0\AutoPlay\Buttons\1044_0019.btn
%TEMP%\ir_ext_temp_0\AutoPlay\Buttons\1044_0030.btn
%TEMP%\ir_ext_temp_0\AutoPlay\Buttons\sky1.btn
%TEMP%\ir_ext_temp_0\AutoPlay\Buttons\sky2.btn
%TEMP%\ir_ext_temp_0\AutoPlay\Buttons\sky3.btn
%TEMP%\ir_ext_temp_0\AutoPlay\Buttons\sky4.btn
%TEMP%\ir_ext_temp_0\AutoPlay\Buttons\skyf1.btn
%TEMP%\ir_ext_temp_0\AutoPlay\Buttons\skynews.btn
%TEMP%\ir_ext_temp_0\AutoPlay\Docs\data\curl.exe
%TEMP%\ir_ext_temp_0\AutoPlay\Docs\data\cut.exe
%TEMP%\ir_ext_temp_0\AutoPlay\Docs\data\grep.exe
%TEMP%\ir_ext_temp_0\AutoPlay\Docs\data\libiconv2.dll
%TEMP%\ir_ext_temp_0\AutoPlay\Docs\data\libintl3.dll
%TEMP%\ir_ext_temp_0\AutoPlay\Docs\data\paste.exe
%TEMP%\ir_ext_temp_0\AutoPlay\Docs\data\regex2.dll
%TEMP%\ir_ext_temp_0\AutoPlay\Docs\data\rtmpdump.exe
%TEMP%\ir_ext_temp_0\AutoPlay\Docs\data\sed.exe
%TEMP%\ir_ext_temp_0\AutoPlay\Docs\data\wget.exe

Detected by UnHackMe:

CURL.EXE
Default location: %TEMP%\IR_EXT_TEMP_0\AUTOPLAY\DOCS\DATA\CURL.EXE

Dropper information:
MD5: c92bc37425f3ed0fda2c1fe0a30d5edf
File size: 8281304 bytes