Solved! Use WATERMARK.EXE (Worm AMN) Removal Guide

I recommend you UnHackMe - Ultimate Malware Killer for fast malware removal:

Download UnHackMe
Fully Functional 30-day Trial. No credit card is required. Reviews. EULA. Privacy Policy.

WATERMARK.EXE – Worm AMN removal

File MD5 Virus Alias
WATERMARK.EXE f6736faa3126f64ed4a7109e40c47806 Worm AMN
WATERMARK.EXE f6736faa3126f64ed4a7109e40c47806 Backdoor IRCNite
WATERMARK.EXE f6736faa3126f64ed4a7109e40c47806 Trojan Generic
WATERMARK.EXE f6736faa3126f64ed4a7109e40c47806 Trojan Siggen
WATERMARK.EXE f6736faa3126f64ed4a7109e40c47806 Trojan Agent
WATERMARK.EXE f6736faa3126f64ed4a7109e40c47806 Trojan Kryptik

WATERMARK.EXE size: 96768 bytes
WATERMARK.EXE hash: F6736FAA3126F64ED4A7109E40C47806

Created files:

%Program Files%\Microsoft\WaterMark.exe
%Common AppData%\Apple Computer\Installer Cache\Safari 5.34.52.7\SetupAdmin.exe
%Local AppData%\Google\Chrome\Application\17.0.963.79\avcodec-53.dll
%Local AppData%\Google\Chrome\Application\17.0.963.79\avformat-53.dll
%Local AppData%\Google\Chrome\Application\17.0.963.79\avutil-51.dll

Autostart registry keys:

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit: c:\windows\System32\userinit.exe,,c:\program files\Microsoft\watermark.exe

Detected by UnHackMe:

WATERMARK.EXE
Default location: %PROGRAM FILES%\MICROSOFT\WATERMARK.EXE

Dropper information:
MD5: b42821af81f5a2bc5032c169481b679f
File size: 155136 bytes

Leave a Reply