Solved! Use SPOOLSV.EXE (Worm Vobfus) Removal Guide

I will tell you in this post how to fix the issue manually and how to clean it automatically using a special powerful removal tool. You can download the removal program for free here:

Manual removal instructions:

SPOOLSV.EXE – Worm Vobfus removal

File MD5 Virus Alias
SPOOLSV.EXE 90ace1dd0d4348e3954d4b3a8331d204 Worm Vobfus
SPOOLSV.EXE 90ace1dd0d4348e3954d4b3a8331d204 Trojan Hllw
SPOOLSV.EXE 90ace1dd0d4348e3954d4b3a8331d204 Trojan Agent

SPOOLSV.EXE size: 46592 bytes
SPOOLSV.EXE hash: 90ACE1DD0D4348E3954D4B3A8331D204

Created files:

C:\Recycled\CTFMON.EXE
C:\Recycled\SMSS.EXE
C:\Recycled\SPOOLSV.EXE
C:\Recycled\SVCHOST.EXE

Autostart registry keys:

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit: C:\recycled\SVCHOST.exe,
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell: Explorer.exe “C:\recycled\SVCHOST.exe”

Detected by UnHackMe:

SPOOLSV.EXE
Default location: C:\RECYCLED\SPOOLSV.EXE

Dropper information:
MD5: 6b1a7c59f3f0443eead7d0862c60b901
File size: 46592 bytes