OV72.EXE – Unknown removal

OV72.EXE size: 108544 bytes
OV72.EXE hash: 56C37AAC5B3DA0B7438C4867D04EDAFE

Created files:

%Program Files%\MSN Gaming Zone\Windows\bckgzm.exe
%Program Files%\MSN Gaming Zone\Windows\chkrzm.exe
%Program Files%\NetMeeting\conf.hlk
%Program Files%\Ppu71.exe
%SysDir%\Winkekt.exe
%TEMP%\Ov72.exe
%TEMP%\Vk73.exe
%TEMP%\Wt74.exe
\\VBOXSVR\in\kitty.bak.exe

Autostart registry keys:

HKLM\System\CurrentControlSet\Services\Winkekt\Type: 10010000
HKLM\System\CurrentControlSet\Services\Winkekt\Start: 02000000
HKLM\System\CurrentControlSet\Services\Winkekt\DisplayName: Winkekt
HKLM\System\CurrentControlSet\Services\Winkekt\ImagePath: %WinDir%\System32\Winkekt.exe
HKLM\System\CurrentControlSet\Services\WW7iq\Type: 10010000
HKLM\System\CurrentControlSet\Services\WW7iq\Start: 03000000
HKLM\System\CurrentControlSet\Services\WW7iq\DisplayName: WW7iq
HKLM\System\CurrentControlSet\Services\WW7iq\ImagePath: \\VBOXSVR\in\kitty.bak.exe

Detected by UnHackMe:

OV72.EXE
Default location: %TEMP%\OV72.EXE

Dropper information:
MD5: 0d19af02629ed8cbfe201d20c403ce4f
File size: 89538 bytes