DTLUPG.EXE – Unclassified Malware removal

DTLUPG.EXE size: 512000 bytes
DTLUPG.EXE hash: 1A0EEF71D128A239C41FCD39F22AD700

Created files:

%Program Files%\wanyixia\accelerator.dll
%Program Files%\wanyixia\detoured.dll
%Program Files%\wanyixia\dtlupdater\CheckUpdate.dll
%Program Files%\wanyixia\dtlupdater\DTLUpg.exe
%Program Files%\wanyixia\htmlctrlhook.dll
%Program Files%\wanyixia\loading.mht
%Program Files%\wanyixia\pcid.dll
%Program Files%\wanyixia\skinface.dll
%Program Files%\wanyixia\sound.dll
%Program Files%\wanyixia\substat.dll
%Program Files%\wanyixia\tips\tips.exe
%Program Files%\wanyixia\tips\tipsdll.dll
%Program Files%\wanyixia\udp.dll
%Program Files%\wanyixia\Uninstall.dar0
%Program Files%\wanyixia\Uninstall.dar1
%Program Files%\wanyixia\uninstall.dll
%Program Files%\wanyixia\Uninstall.exe
%Program Files%\wanyixia\utility.dll
%Program Files%\wanyixia\wanyixia.exe
%Program Files%\wanyixia\webpath\InitNetworkFailRight.mht
%Program Files%\wanyixia\webpath\Navigate404Right.mht
%Program Files%\wanyixia\webpath\NavigateErrorRight.mht
%Program Files%\wanyixia\webpath\NavigateTimeoutRight.mht

Autostart registry keys:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\wanyixia: “%Program Files%\wanyixia\wanyixia.exe” /start

Detected by UnHackMe:

DTLUPG.EXE
Default location: %PROGRAM FILES%\WANYIXIA\DTLUPDATER\DTLUPG.EXE

Dropper information:
MD5: e8dba0618bc756ae3918faff619084d4
File size: 1546632 bytes