MD5: 6bd1a1e178d7a87f297f460aa01af36d
SHA1: 0ff792d9432b7fefecb4568344114309fdd827a1
SHA256: d4a1470980566b928da7201e41e02a53316a226ce4b6d93ba7668c36970251ba
SSDeep: 12288:CuEZSmcuRA5ELAK8pFgvAOW7KIs RDmZhkfa/ezQHfcvfiHh:CusA5ELAKrvAOWn7DQhkS/eM/afiHh
Size: 655360 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: MicrosoftVisualC, NETexecutable, UPolyXv05_v6
Company: no certificate found
Created at: 2018-01-26 21:47:21
Analyzed on: Windows7 SP1 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

csc.exe:2856

The Trojan injects its code into the following process(es):

explorer.exe:820
Explorer.EXE:1440

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process csc.exe:2856 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\adm2.txt (230 bytes)
C:\Windows\System32\Driver\svchost.exe (601 bytes)

Registry activity

The process csc.exe:2856 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
"Policies" = "C:\Windows\system32\Driver\svchost.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run]
"Policies" = "C:\Windows\system32\Driver\svchost.exe"

[HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{2MAU16UC-58A6-4X80-B5C4-46JFH1H51OT8}]
"StubPath" = "C:\Windows\system32\Driver\svchost.exe Restart"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"HKCU" = "C:\Windows\system32\Driver\svchost.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HKLM" = "C:\Windows\system32\Driver\svchost.exe"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name: MyImgur Programming Team.
Product Name: MyImgur
Product Version: 5.11.2.0
Legal Copyright: Copyright (c)MyImgur Programming Team.
Legal Trademarks: MyImgur(tm). All rights reserved.
Original Filename: Gmail Password Hacker.exe
Internal Name: Gmail Password Hacker.exe
File Version: 5.11.2.0
File Description: MyImgur
Comments: An application to upload images directly to Imgur.
Language: Chinese (Simplified, PRC)

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

No activity has been detected.

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Web Traffic was not found.

The Trojan connects to the servers at the folowing location(s):

.text

`.data

.rsrc

@.reloc

ADVAPI32.dll

ntdll.DLL

KERNEL32.dll

GDI32.dll

USER32.dll

msvcrt.dll

SHLWAPI.dll

SHELL32.dll

ole32.dll

OLEAUT32.dll

EXPLORERFRAME.dll

UxTheme.dll

POWRPROF.dll

dwmapi.dll

slc.dll

gdiplus.dll

Secur32.dll

SSPICLI.DLL

RPCRT4.dll

PROPSYS.dll

QSShM

PSSh^

FtPhq

SSSSh

SShxSc

PSSh,

QPSSSShL

t7WSSh

SSShO

tfSSh

Software\Microsoft\Windows\CurrentVersion\Explorer\StartMenu\StartPanel

kernel32.dll

t.It It

taSSSh

explorer.exe

FtPhO

SSShI

F8SSh

tRSSh

PSSh|$h

PSShL$h

t}SShV

tKSSSh

t SSSh

?.ulf

.ue9]

TaskDialogIndirect

TSAppCMP.DLL

SSShT

PSSShA

SSSh?

SSShB

t.Ht%Ht

SSSShD

WINMM.dll

CFGMGR32.dll

WINSTA.dll

OLEACC.dll

WINBRAND.dll

DUI70.dll

SndVolSSO.DLL

netutils.dll

wkscli.dll

NetGetJoinInformation

ntdll.dll

RegCloseKey

RegCreateKeyW

RegOpenKeyExW

RegCreateKeyExW

RegDeleteKeyExW

RegOpenKeyW

RegQueryInfoKeyW

RegEnumKeyExW

CreateIoCompletionPort

GetWindowsDirectoryW

GetProcessHeap

SetProcessShutdownParameters

OffsetViewportOrgEx

GetViewportOrgEx

SetViewportOrgEx

EnumChildWindows

GetKeyboardLayout

ActivateKeyboardLayout

GetProcessWindowStation

UnhookWindowsHookEx

SetWindowsHookExW

MsgWaitForMultipleObjectsEx

TileWindows

CascadeWindows

EnumWindows

UnregisterHotKey

RegisterHotKey

GetAsyncKeyState

GetKeyState

MsgWaitForMultipleObjects

ExitWindowsEx

_amsg_exit

_wcmdln

SHDeleteKeyW

SHQueryInfoKeyW

AssocQueryKeyW

ShellExecuteExW

ShellExecuteW

SHFileOperationW

SLGetWindowsInformationDWORD

GdiplusShutdown

explorer.pdb

name="Microsoft.Windows.Shell.explorer"

version="5.1.0.0"

<description>Windows Shell</description>

name="Microsoft.Windows.Common-Controls"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

<requestedExecutionLevel level="asInvoker" uiAccess="false"/>

<windowsSettings>

<dpiAware xmlns="hXXp://schemas.microsoft.com/SMI/2005/WindowsSettings">true</dpiAware>

</windowsSettings>

{;;;;{;;

I51111111111111.1.1.B

46464444

*,,.,,.,'/'....'/

1888661

A1.<yjjjggbbZYV?=9.=zjjjjgddbabYV>.=||wwwwpggb_a`X.?0......Tmmkj__.<S

k}??F.o

Ja(%F

uz.In

#-.12220 *!

(-12220 

Knmhe.HH

%Mgr.RhY4RfE5Qd:d

2<===@@=

&$%Uooqkezs

['$$#%&(4

5>^666^.>66^6>>>

>>^6^.>^6>

5^66^6>66

6>>6^6^>=>>6>6>

>>^66>6>^6^6^6

>=>>^6>>=

=_>>7>_6_>>>>

>^.>^.6^'

=6^66^66>>

7'''')) 

3'')))33.

.mnnw

4444444444

288888888882

911111111119

,Cÿ>I

..--11///06

%F|aD

%XX^^

%XXX^

%UXXX

!$$$$'$$#$!!"

6****,@=

!!1.WN

!..WKA@?

::8240-)%2/

,-(%(-(%%*%**17

!#)'&4,- 

=$.VP^

0.rJ)I

\.gh.v(sO

W%3UI

0.aT@

%D&PJ

1.JV2

t4%CU

uvm%s|

Ep.SU0

kq.kV

njW%c

 !/.!375

@$@:'&%:

(*),,,0001

!!! ###%%$

n.2.Ýdddddddd

*.UGA

%u}} mtt

&PQMSornurl[

%XR8]

....raK

***.sdR

,-il}

%%%Ìccr`H

./".LMBNmnPPa

.jkL^

45 .WX]n

$$$$!!!!

%%%%$$$$!!!!

&&&&%%%%$$$$!!!!

@6'~@6'~

=4$|=4$|

$$$$""""

%%%%$$$$""""

&&&&%%%%$$$$""""

;2${;2${=4$}

####!!!!

$$$$####!!!!

%%%%$$$$####!!!!

&&&&%%%%$$$$####!!!!

####""""

$$$$####""""

%%%%$$$$####""""

4 4$4(4,4

;#< <8<><]<

; ;(;0;8;

1 1$1(1,1014181<1

3"3)30373>3

70767<7}7

%0,090?0

<$</<8<]<

=0>9>?>[>

5 5&565<5

<&= =4=\=

; ;$;(;,;0;4;8;<;@;

5#5)5:5@5]5

= >(>8>>>

; ;$;(;,;0;4;

323d3m3

3 3%3:3|3

0 1$1(1,10141

9 9$9(9,9

9(:,:0:4:8:<:

1 2$2(2,20242

: :$:(:,:

:(;,;0;4;8;<;

< <$<(<,<

< =$=(=,=0=4=8=<=

2 3$3(3,30343

; ;$;(;,;

;(<,<0<4<8<<<

9":,:^:{:

0$0*01070?0

:$: :1:7:

5"5=5{5=6

UseExecutableForTaskbarGroupIcon

Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced

SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced

Software\Microsoft\Windows\CurrentVersion\Explorer

SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage

{59031a47-3f72-44a7-89c5-5595fe6b30ee}

imageres.dll

::{E44E5D18-0652-4508-A4E2-8A090067BCB0}

::{26EE0668-A00A-44D7-9371-BEB064C98683}\5\::{D20EA4E1-3957-11d2-A40B-0C5020524153}

::{26EE0668-A00A-44D7-9371-BEB064C98683}\0\::{38A98528-6CBF-4CA9-8DC0-B1E1D10F7B1B}

::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}

Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\SearchExtensions

shell:::{e345f35f-9397-435c-8f95-4e922c26259e}

shell:::{daf95313-e44d-46af-be1b-cbacea2c3065}

%s\%s

user.bmp

%s\%s\%s

%s::%s

{A1965210-3A9D-4bca-822B-433645B3F5A2}

%LocalAppData%\Microsoft\Windows\Explorer

Local\ExplorerIsShellMutex

Software\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{EF87B4CB-F2CE-4785-8658-4CA6C63E38C6}\TopViews\{00000000-0000-0000-0000-000000000000}

Software\Policies\Microsoft\Windows\Explorer

Software\Microsoft\Windows\CurrentVersion\RunOnce

Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

Software\Microsoft\Windows\CurrentVersion\Run

DisabledHotkeys

Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\DelayedApps

Software\Microsoft\Windows NT\CurrentVersion\Windows,Load

Software\Microsoft\Windows NT\CurrentVersion\Windows

UserChosenExecuteHandlers\%s

Software\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers

Software\Microsoft\Windows\CurrentVersion\ThemeManager

USER32.DLL

Software\Microsoft\Windows\CurrentVersion\Explorer\Taskband

comctl32.dll

Software\Microsoft\Windows\CurrentVersion\Explorer\ControlPanel

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones

Software\Microsoft\Windows\CurrentVersion\Themes

Software\Microsoft\Windows\CurrentVersion\RunOnceEx

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

system.ini

::{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}

::{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}

::{26EE0668-A00A-44D7-9371-BEB064C98683}\2\::{A8A91A66-3A7D-4424-8D24-04E180695C7A}

{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}

::{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}

{20D04FE0-3AEA-1069-A2D8-08002B30309D}

::{0c39a5cf-1a7a-40c8-ba74-8900e6df5fcd}

Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites

SOFTWARE\Microsoft\Windows\CurrentVersion\Diagnostics\Performance\Shell\ResponseMonitor

Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify

Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

AppEvents\Schemes\Apps\%s\%s\.current

.Default

Software\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\UAS

control.exe

{A4756F80-4AE7-4A1F-A776-F5E9D9B04406}

Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel

Software\Microsoft\Windows\DWM

Microsoft-Windows-DesktopWindowManager-Core-LivePreviewAllowed

Microsoft.Windows.ControlPanel.Taskbar

%systemRoot%\system32\rundll32.exe %systemRoot%\system32\shell32.dll,Options_RunDLL 1

shell32.dll,-40

@explorer.exe,-810

Microsoft.NotificationAreaIcons

timedate.cpl

Software\Microsoft\Windows\CurrentVersion\Policies\System

Software\Microsoft\Windows\CurrentVersion\Explorer\ApplicationDestinations\

HELP_ENTRY_ID_START_MENU_HELP_AND_SUPPORT

WindowsLogon

WindowsLogoff

*PIDx

Windows

SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel

install.exe

@themeui.dll,-853

@themeui.dll,-852

@themeui.dll,-851

@themeui.dll,-850

runonce.exe

NoDataExecutionPrevention

UpdateURL

WindowsUpdate

Software\Microsoft\Windows\CurrentVersion\Explorer\NotificationCustomization

Software\Microsoft\Windows\CurrentVersion\Explorer\Remote\%d

Software\Microsoft\Windows NT\CurrentVersion\Windows,Run

Software\Microsoft\Windows\CurrentVersion\OOBE

Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage\NewShortcuts

shell32.dll

Microsoft.UserAccounts

Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage

NewExeName

desk.cpl

Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\FirstFolder

Software\Microsoft\Windows\CurrentVersion\Explorer\Comdlg32\LastVisitedPidlMRULegacy

Software\Microsoft\Windows\CurrentVersion\Explorer\Comdlg32\LastVisitedPidlMRU

Software\Microsoft\Windows\CurrentVersion\Explorer\Comdlg32\OpenSavePidlMRU

Software\Microsoft\Windows\CurrentVersion\Explorer\Doc Find Spec MRU

Software\Microsoft\Windows\CurrentVersion\Explorer\TypedPaths

Software\Microsoft\Internet Explorer\TypedURLs

mshelp://windows/?id=c45acd5d-98b5-4245-8ce6-1f7bba654767

hSystem.StructuredQueryType.AllBitsSet

System.StructuredQueryType.AnyBitsSet

System.StructuredQueryType.SortKeyDescription

Accessories\Windows PowerShell\Windows PowerShell.lnk

Administrative Tools\Server Manager.lnk

Windows Media Player.lnk

Accessories\Windows Explorer.lnk

Internet Explorer.lnk

Accessories\Notepad.lnk

Accessories\Command Prompt.lnk

Windows Fax and Scan.lnk

XPS Viewer.lnk

Accessories\displayswitch.lnk

Accessories\Wordpad.lnk

Windows Anytime Upgrade.lnk

{00D8862B-6453-4957-A821-3D98D74C76BE}

Accessories\Accessibility\Magnify.lnk

Accessories\Remote Desktop Connection.lnk

Accessories\Paint.lnk

Accessories\Snipping Tool.lnk

Accessories\Sticky Notes.lnk

Accessories\Calculator.lnk

Media Center.lnk

Accessories\Welcome Center.lnk

Microsoft.Windows.ControlPanel

CLSID\%s\ShellExplorerRoot

AlwaysShowMenus

WebView

AltTab_KeyHookWnd

/globalhotkey

"%systemroot%\system32\magnify.exe"

SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system

shell32.dll,WaitForExplorerRestart "

"%systemroot%\system32\rundll32.exe"

%s%d%s

%s, %s, %s

Software\Microsoft\Windows\CurrentVersion\Explorer\NotificationArea\PromotedIcon2

Software\Microsoft\Windows\CurrentVersion\Explorer\NotificationArea\PromotedIcon1

?guid=%s&hwnd=%lu&id=%lu&ecrc=%lu

{00000000-0000-0000-0000-000000000000}

\\?\Volume

mshelp://windows/?id=5de7c31f-1b8b-4431-9d3d-c0994939b186

\\?\UNC\

Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist

taskmgr.exe

ShellExecute

Software\Microsoft\Windows\CurrentVersion\Explorer\AppKey\%d

AppEvents\Schemes\Apps\.Default\%ws\.Current

D:(A;;GA;;;SY)(A;;0x%x;;;%s)

D:(A;;GA;;;SY)(A;;0x%x;;;%s)S:(ML;;1;;;LW)

%s%I64u%s

%s%g%s

%s%I64d%s

RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL ?0x%X?%s

RunDLL32.EXE

SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\ControlPanel\NameSpace\{5ea4f148-308c-46d7-98a9-49041b1dd468}

Software\Microsoft\Windows\CurrentVersion\SMDEn

SOFTWARE\Microsoft\Windows\Tablet PC

OEM%d

%s %s

%SystemRoot%\system32\GettingStarted.exe

Microsoft.Windows.GettingStarted

SBOEM%d

Software\Microsoft\Windows\CurrentVersion\Explorer\TBDEn

Software\Microsoft\Windows\CurrentVersion\Explorer\OEMWC

Accessories\Mobility Center.lnk

@%s,%d

WCOEM%d

Software\Microsoft\Windows\CurrentVersion\Explorer\WCDEn

{00021401-0000-0000-C000-000000000046}

Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU

StartMenuKeyBoard

StartMenuKeyBoardComposited

201ef99a-7fa0-444c-9399-19ba84f12a1a

%WINDOWS_LONG%

mshelp://windows/?id=83f968d5-844e-408c-a7c4-69ff50f0ff54

@tzres.dll,

\tzres.dll

Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}

.\%s.mui

.\%s\%s.mui

%s\%s.mui

%s\%s\%s.mui

guest.bmp

"? %s"

hXXps://

hXXp://

Windows Explorer

6.1.7601.17567 (win7sp1_gdr.110224-1502)

EXPLORER.EXE

Windows

Operating System

6.1.7601.17567

explorer.exe_820_rwx_00060000_00001000:

KERNEL32.DLL

explorer.exe_820_rwx_000A0000_00001000:

KERNEL32.DLL

svchost.exe_3272:

.text

`.data

.rsrc

%f=?0t

SShE/

SShF/

CSSh40

YYSSh>0

VERSION.dll

ADVAPI32.dll

cscomp.dll

USER32.dll

SHLWAPI.dll

OLEAUT32.dll

ole32.dll

mscoree.dll

KERNEL32.dll

MSVCR80.dll

_amsg_exit

_crt_debugger_hook

GetProcessHeap

GetConsoleOutputCP

PathIsURLW

csc.pdb

<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity version="1.0.0.0" processorArchitecture="X86" name="csc" type="win32" publicKeyToken="000000000000000"></assemblyIdentity><dependency><dependentAssembly><assemblyIdentity type="win32" name="Microsoft.VC80.CRT" version="8.0.50608.0" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b"></assemblyIdentity></dependentAssembly></dependency><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">

<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>

(%d,%d)

%s %sd:

bugreport:

bugreport

Unable to find messages file '%s'

cscompui.dll

(%d,%d)-(%d,%d)

csc.rsp

%s\%s

winexe

target:winexe

t:winexe

target:exe

t:exe

0xx

(0xx)

/%s[ |-]

/%s[ |-]:%s

/%s:%s

%s (%s: /%s)

%d.d.d.%d

%d.d.d

mscorlib.dll

Windows NT

Windows 9x

8.0.50727.4927 (NetFXspW7.050727-4900)

csc.exe

8.0.50727.4927

conhost.exe_3492:

.text

`.data

.rsrc

@.reloc

GDI32.dll

USER32.dll

msvcrt.dll

ntdll.dll

API-MS-Win-Core-LocalRegistry-L1-1-0.dll

KERNEL32.dll

IMM32.dll

ole32.dll

OLEAUT32.dll

PutInputInBuffer: EventsWritten != 1 (0x%x), 1 expected

Invalid message 0x%x

InitExtendedEditKeys: Unsupported version number(%d)

Console init failed with status 0x%x

CreateWindowsWindow failed with status 0x%x, gle = 0x%x

InitWindowsStuff failed with status 0x%x (gle = 0x%x)

InitSideBySide failed create an activation context. Error: %d

GetModuleFileNameW requires more than ScratchBufferSize(%d) - 1.

GetModuleFileNameW failed %d.

Invalid EventType: 0x%x

Dup handle failed for %d of %d (Status = 0x%x)

Couldn't grow input buffer, Status == 0x%x

InitializeScrollBuffer failed, Status = 0x%x

CreateWindow failed with gle = 0x%x

Opening Font file failed with error 0x%x

\ega.cpi

NtReplyWaitReceivePort failed with Status 0x%x

ConsoleOpenWaitEvent failed with Status 0x%x

NtCreatePort failed with Status 0x%x

GetCharWidth32 failed with error 0x%x

GetTextMetricsW failed with error 0x%x

GetSystemEUDCRangeW: RegOpenKeyExW(%ws) failed, error = 0x%x

RtlStringCchCopy failed with Status 0x%x

Cannot allocate 0n%d bytes

|%SWj

O.fBf;

ReCreateDbcsScreenBuffer failed. Restoring to CP=%d

Invalid Parameter: 0x%x, 0x%x, 0x%x

ConsoleKeyInfo buffer is full

Invalid screen buffer size (0x%x, 0x%x)

SetROMFontCodePage: failed to memory allocation %d bytes

FONT.NT

Failed to set font image. wc=x, sz=(%x,%x)

Failed to set font image. wc=x sz=(%x, %x).

Failed to set font image. wc=x sz=(%x,%x)

FullscreenControlSetColors failed - Status = 0x%x

FullscreenControlSetPalette failed - Status = 0x%x

WriteCharsFromInput failed 0x%x

WriteCharsFromInput failed %x

RtlStringCchCopyW failed with Status 0x%x

CreateFontCache failed with Status 0x%x

FTPh

\>.Sj

GetKeyboardLayout

MapVirtualKeyW

VkKeyScanW

GetKeyboardState

UnhookWindowsHookEx

SetWindowsHookExW

GetKeyState

ActivateKeyboardLayout

GetKeyboardLayoutNameA

GetKeyboardLayoutNameW

_amsg_exit

_acmdln

ShipAssert

NtReplyWaitReceivePort

NtCreatePort

NtEnumerateValueKey

NtQueryValueKey

NtOpenKey

NtAcceptConnectPort

NtReplyPort

SetProcessShutdownParameters

GetCPInfo

conhost.pdb

%$%a%b%V%U%c%Q%W%]%\%[%

%<%^%_%Z%T%i%f%`%P%l%g%h%d%e%Y%X%R%S%k%j%

version="5.1.0.0"

name="Microsoft.Windows.ConsoleHost"

<requestedExecutionLevel

name="Microsoft.Windows.ConsoleHost.SystemDefault"

publicKeyToken="6595b64144ccf1df"

name="Microsoft.Windows.SystemCompatible"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

< =$>:>@>

2%2X2

%SystemRoot%

\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Console\TrueTypeFont

\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Console\FullScreen

WindowSize

ColorTableu

ExtendedEditkeyCustom

ExtendedEditKey

Software\Microsoft\Windows\CurrentVersion

\ !:=/.<>;|&

%d/%d

cmd.exe

desktop.ini

\console.dll

%d/%d

6.1.7601.17641 (win7sp1_gdr.110623-1503)

CONHOST.EXE

Windows

Operating System

6.1.7601.17641

explorer.exe_820_rwx_00300000_00001000:

KERNEL32.DLL

explorer.exe_820_rwx_00450000_00001000:

KERNEL32.DLL

explorer.exe_820_rwx_00490000_00001000:

KERNEL32.DLL

explorer.exe_820_rwx_004D0000_00001000:

KERNEL32.DLL

explorer.exe_820_rwx_00600000_00001000:

advapi32.dll

explorer.exe_820_rwx_008C0000_00001000:

RegOpenKeyA

explorer.exe_820_rwx_008D0000_00001000:

advapi32.dll

explorer.exe_820_rwx_00900000_00001000:

AVICAP32.DLL

explorer.exe_820_rwx_00980000_00001000:

AVICAP32.DLL

explorer.exe_820_rwx_009E0000_00001000:

gdi32.dll

explorer.exe_820_rwx_00A60000_00001000:

gdi32.dll

explorer.exe_820_rwx_016A0000_00001000:

gdiplus.dll

explorer.exe_820_rwx_016E0000_00001000:

gdiplus.dll

explorer.exe_820_rwx_01710000_00001000:

mpr.dll

explorer.exe_820_rwx_01790000_00001000:

mpr.dll

explorer.exe_820_rwx_017C0000_00001000:

msacm32.dll

explorer.exe_820_rwx_01840000_00001000:

msacm32.dll

explorer.exe_820_rwx_01870000_00001000:

ntdll.dll

explorer.exe_820_rwx_018B0000_00001000:

ntdll.dll

explorer.exe_820_rwx_01920000_00001000:

ole32.dll

explorer.exe_820_rwx_019E0000_00001000:

ole32.dll

explorer.exe_820_rwx_01A10000_00001000:

oleaut32.dll

explorer.exe_820_rwx_01A90000_00001000:

oleaut32.dll

explorer.exe_820_rwx_01B40000_00001000:

powrprof.dll

explorer.exe_820_rwx_01C80000_00001000:

powrprof.dll

explorer.exe_820_rwx_01CB0000_00001000:

shell32.dll

explorer.exe_820_rwx_01CE0000_00001000:

ShellExecuteA

explorer.exe_820_rwx_01CF0000_00001000:

shell32.dll

explorer.exe_820_rwx_01D20000_00001000:

user32.dll

explorer.exe_820_rwx_01D60000_00001000:

user32.dll

explorer.exe_820_rwx_01DD0000_00001000:

wininet.dll

explorer.exe_820_rwx_01E00000_00001000:

FtpOpenFileA

explorer.exe_820_rwx_01E10000_00001000:

wininet.dll

explorer.exe_820_rwx_01EC0000_00001000:

winmm.dll

explorer.exe_820_rwx_01F00000_00001000:

winmm.dll

explorer.exe_820_rwx_01F30000_00001000:

wsock32.dll

explorer.exe_820_rwx_01FB0000_00001000:

wsock32.dll

explorer.exe_820_rwx_10480000_00065000:

`.rsrc

kernel32.dll

Portions Copyright (c) 1999,2003 Avenger by NhT

SHFileOperationA

shell32.dll

URLDownloadToFileA

urlmon.dll

ShellExecuteA

SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

GetWindowsDirectoryA

SOFTWARE\Microsoft\Windows\CurrentVersion

http\shell\open\command

\Internet Explorer\iexplore.exe

####@####

$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)

Portugal

Turkey

Windows 3.1

Windows 95 (Release 2)

Windows 95

Windows 98 SE

Windows 98

Windows ME

Windows 7

Windows Vista

%s %s

Windows XP Professional x64

Windows XP Home

Windows XP Professional

Windows 2000 Professional

Windows NT %d.%d

Windows 2008

%s %s Server

Windows 2003 Server Datacenter

Windows 2003 Server Enterprise

Windows 2003 Server Web Edition

Windows 2003 Server

Windows Home Server

Windows 2003 Server (Release 2)

Windows 2000 Server Datacenter

Windows 2000 Server Enterprise

Windows 2000 Server Web Edition

Windows 2000 Server

Windows NT 4.0 Server Datacenter

Windows NT 4.0 Server Enterprise

Windows NT 4.0 Server Web Edition

Windows NT 4.0 Server

Unknown Platform ID (%d)

%d.%d

%s (Build: %d

- Service Pack: %s

KERNEL32.DLL

teste.vbs

teste.txt

Set objSecurityCenter = GetObject("winmgmts:\\.\root\SecurityCenter")

Set colFirewall = objSecurityCenter.ExecQuery("Select * From FirewallProduct",,48)

Set colAntiVirus = objSecurityCenter.ExecQuery("Select * From AntiVirusProduct",,48)

Set objFileSystem = CreateObject("Scripting.fileSystemObject")

Set objFile = objFileSystem.CreateTextFile("

Info = Info & "F" & CountFw & ") " & objFirewall.displayName & " v" & objFirewall.versionNumber & Enter

Info = Info & "A" & CountAV & ") " & objAntiVirus.displayName & " v" & objAntiVirus.versionNumber & Enter

objFile.WriteLine(Info)

objFile.Close

cscript.exe

AVICAP32.dll

tFtpAccess

v1.07.5

BuildImportTable: can't load library:

BuildImportTable: ReallocMemory failed

BuildImportTable: GetProcAddress failed

BTMemoryLoadLibary: BuildImportTable failed

BTMemoryGetProcAddress: no export table found

BTMemoryGetProcAddress: DLL doesn't export anything

BTMemoryGetProcAddress: exported symbol not found

SetupApi.dll

SetupDiOpenClassRegKey

SetupDiOpenClassRegKeyExA

SetupDiOpenClassRegKeyExW

SetupDiCreateDeviceInterfaceRegKeyA

SetupDiCreateDeviceInterfaceRegKeyW

SetupDiOpenDeviceInterfaceRegKey

SetupDiDeleteDeviceInterfaceRegKey

SetupDiCreateDevRegKeyA

SetupDiCreateDevRegKeyW

SetupDiOpenDevRegKey

SetupDiDeleteDevRegKey

CM_DEVCAP_LOCKSUPPORTED

CM_DEVCAP_EJECTSUPPORTED

PDCAP_D0_SUPPORTED

PDCAP_D1_SUPPORTED

PDCAP_D2_SUPPORTED

PDCAP_D3_SUPPORTED

PDCAP_WAKE_FROM_D0_SUPPORTED

PDCAP_WAKE_FROM_D1_SUPPORTED

PDCAP_WAKE_FROM_D2_SUPPORTED

PDCAP_WAKE_FROM_D3_SUPPORTED

PDCAP_WARM_EJECT_SUPPORTED

HKEY_CLASSES_ROOT

HKEY_CURRENT_CONFIG

HKEY_CURRENT_USER

HKEY_LOCAL_MACHINE

HKEY_USERS

127.0.0.1

iphlpapi.dll

AllocateAndGetTcpExTableFromStack

AllocateAndGetUdpExTableFromStack

SetTcpEntry

GetExtendedTcpTable

GetExtendedUdpTable

Mozilla3_5Password

GetChromePass

StartHttpProxy

1.2.3

keyboardkey

webcaminactive

webcamgetbuffer

webcam

enviarexecnormal

enviarexechidden

openweb

openwebpage

openwebhidden

downexec

sendftp

keylogger

keyloggergetlog

keyloggereraselog

keyloggerativar

keyloggerdesativar

renamekey

windowsfechar

windowsmax

windowsmin

windowsmostrar

windowsocultar

windowsmintodas

windowscaption

listarportas

listarportasdns

finalizarprocessoportas

webcamsettings

chatmsg

getpassword

updateservidorweb

keyloggersearch

urlredirect

urlredirecttrue

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\

PSAPI.dll

\config\SteamAppData.vdf

AutoLoginUser

/ClientRegistry.Blob

\ClientRegistry.blob

\steam.dll

%SYS%

ÞSKTOP%

HKEY_PERFORMANCE_DATA

HKEY_DYN_DATA

FirstExecution

chatmsg|

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

listarjanelas|windowsfechar|

listarjanelas|windowsmax|

listarjanelas|windowsmin|

listarjanelas|windowsmostrar|

listarjanelas|windowsocultar|

listarjanelas|windowsmintodas|

listarjanelas|windowscaption|

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

listarportas|listadeportaspronta|

listarportas|finalizarconexao|

listarportas|finalizarprocessoportas|Y|

listarportas|finalizarprocessoportas|N|

registro|renamekey|

keylogger|keylogger|keyloggerativar|

keylogger|keylogger|keyloggerdesativar|

keylogger|keyloggergetlog|

keylogger|keylogger|keyloggervazio|

keyloggersearchok|

webcam|webcaminactive|

webcam|webcamactive|

SOFTWARE\Mozilla\Mozilla Firefox

getfirefox

getielogin

getiepass

getieweb

getchrome

getpassword|getpasswordlist|

getpassword|getpassworderror|

duac.bat

%windir%\System32\cmd.exe /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f

cmd.exe duac.bat

C:\Windows\System32\drivers\etc\hosts

Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\

Software\Microsoft\Windows\CurrentVersion\RunServicesOnce\

Software\Microsoft\Windows\CurrentVersion\RunServices\

Software\Microsoft\Windows\CurrentVersion\RunOnce\

Software\Microsoft\Windows\CurrentVersion\Run\

temp.vbs

ntdll.dll

log.dat

SQLite3.dll

deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly

inflate 1.2.3 Copyright 1995-2005 Mark Adler

)ju2.iu

KWindows

RegExport

UrlMon

UnitExecutarComandos

uftp

.UnitBytesSize

UnitListarPortasAtivas

UnitWebcam

UnitKeylogger

WinExec

SetNamedPipeHandleState

GetProcessHeap

CreatePipe

RegQueryInfoKeyA

RegOpenKeyExA

RegOpenKeyA

RegEnumKeyExA

RegDeleteKeyA

RegCreateKeyExA

RegCreateKeyA

RegCloseKey

GdiplusShutdown

keybd_event

MsgWaitForMultipleObjects

MapVirtualKeyA

GetKeyboardState

GetKeyboardLayoutNameA

GetKeyState

GetAsyncKeyState

ExitWindowsEx

EnumWindows

FtpGetFileSize

FtpSetCurrentDirectoryA

FtpOpenFileA

%( % & % % % ]

.idata

.reloc

P.rsrc

hbS%S

advapi32.dll

AVICAP32.DLL

gdi32.dll

gdiplus.dll

mpr.dll

msacm32.dll

ole32.dll

oleaut32.dll

powrprof.dll

user32.dll

wininet.dll

winmm.dll

wsock32.dll

Explorer.EXE_1440_rwx_01C20000_00001000:

KERNEL32.DLL

Explorer.EXE_1440_rwx_03AA0000_00001000:

KERNEL32.DLL

Explorer.EXE_1440_rwx_03C80000_00001000:

KERNEL32.DLL

Explorer.EXE_1440_rwx_03D70000_00001000:

KERNEL32.DLL

Explorer.EXE_1440_rwx_03F20000_00001000:

KERNEL32.DLL

Explorer.EXE_1440_rwx_03FE0000_00001000:

KERNEL32.DLL

Explorer.EXE_1440_rwx_04050000_00001000:

advapi32.dll

Explorer.EXE_1440_rwx_04110000_00001000:

RegOpenKeyA

Explorer.EXE_1440_rwx_04120000_00001000:

advapi32.dll

Explorer.EXE_1440_rwx_04150000_00001000:

AVICAP32.DLL

Explorer.EXE_1440_rwx_04210000_00001000:

AVICAP32.DLL

Explorer.EXE_1440_rwx_04660000_00001000:

gdi32.dll

Explorer.EXE_1440_rwx_04730000_00001000:

gdi32.dll

Explorer.EXE_1440_rwx_047A0000_00001000:

gdiplus.dll

Explorer.EXE_1440_rwx_048B0000_00001000:

gdiplus.dll

Explorer.EXE_1440_rwx_04920000_00001000:

mpr.dll

Explorer.EXE_1440_rwx_04960000_00001000:

mpr.dll

Explorer.EXE_1440_rwx_04A10000_00001000:

msacm32.dll

Explorer.EXE_1440_rwx_04A50000_00001000:

msacm32.dll

Explorer.EXE_1440_rwx_04AC0000_00001000:

ntdll.dll

Explorer.EXE_1440_rwx_04B40000_00001000:

ntdll.dll

Explorer.EXE_1440_rwx_04B70000_00001000:

ole32.dll

Explorer.EXE_1440_rwx_04BB0000_00001000:

ole32.dll

Explorer.EXE_1440_rwx_04CF0000_00001000:

oleaut32.dll

Explorer.EXE_1440_rwx_04E30000_00001000:

oleaut32.dll

Explorer.EXE_1440_rwx_04FE0000_00001000:

powrprof.dll

Explorer.EXE_1440_rwx_05020000_00001000:

powrprof.dll

Explorer.EXE_1440_rwx_05050000_00001000:

shell32.dll

Explorer.EXE_1440_rwx_05080000_00001000:

ShellExecuteA

Explorer.EXE_1440_rwx_05090000_00001000:

shell32.dll

Explorer.EXE_1440_rwx_050C0000_00001000:

user32.dll

Explorer.EXE_1440_rwx_05100000_00001000:

user32.dll

Explorer.EXE_1440_rwx_05130000_00001000:

wininet.dll

Explorer.EXE_1440_rwx_051A0000_00001000:

FtpOpenFileA

Explorer.EXE_1440_rwx_051B0000_00001000:

wininet.dll

Explorer.EXE_1440_rwx_05260000_00001000:

winmm.dll

Explorer.EXE_1440_rwx_06640000_00001000:

winmm.dll

Explorer.EXE_1440_rwx_06670000_00001000:

wsock32.dll

Explorer.EXE_1440_rwx_066B0000_00001000:

wsock32.dll

Explorer.EXE_1440_rwx_10410000_00065000:

`.rsrc

kernel32.dll

Portions Copyright (c) 1999,2003 Avenger by NhT

SHFileOperationA

shell32.dll

URLDownloadToFileA

urlmon.dll

ShellExecuteA

SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

GetWindowsDirectoryA

SOFTWARE\Microsoft\Windows\CurrentVersion

http\shell\open\command

\Internet Explorer\iexplore.exe

####@####

$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)

Portugal

Turkey

Windows 3.1

Windows 95 (Release 2)

Windows 95

Windows 98 SE

Windows 98

Windows ME

Windows 7

Windows Vista

%s %s

Windows XP Professional x64

Windows XP Home

Windows XP Professional

Windows 2000 Professional

Windows NT %d.%d

Windows 2008

%s %s Server

Windows 2003 Server Datacenter

Windows 2003 Server Enterprise

Windows 2003 Server Web Edition

Windows 2003 Server

Windows Home Server

Windows 2003 Server (Release 2)

Windows 2000 Server Datacenter

Windows 2000 Server Enterprise

Windows 2000 Server Web Edition

Windows 2000 Server

Windows NT 4.0 Server Datacenter

Windows NT 4.0 Server Enterprise

Windows NT 4.0 Server Web Edition

Windows NT 4.0 Server

Unknown Platform ID (%d)

%d.%d

%s (Build: %d

- Service Pack: %s

KERNEL32.DLL

teste.vbs

teste.txt

Set objSecurityCenter = GetObject("winmgmts:\\.\root\SecurityCenter")

Set colFirewall = objSecurityCenter.ExecQuery("Select * From FirewallProduct",,48)

Set colAntiVirus = objSecurityCenter.ExecQuery("Select * From AntiVirusProduct",,48)

Set objFileSystem = CreateObject("Scripting.fileSystemObject")

Set objFile = objFileSystem.CreateTextFile("

Info = Info & "F" & CountFw & ") " & objFirewall.displayName & " v" & objFirewall.versionNumber & Enter

Info = Info & "A" & CountAV & ") " & objAntiVirus.displayName & " v" & objAntiVirus.versionNumber & Enter

objFile.WriteLine(Info)

objFile.Close

cscript.exe

AVICAP32.dll

tFtpAccess

v1.07.5

BuildImportTable: can't load library:

BuildImportTable: ReallocMemory failed

BuildImportTable: GetProcAddress failed

BTMemoryLoadLibary: BuildImportTable failed

BTMemoryGetProcAddress: no export table found

BTMemoryGetProcAddress: DLL doesn't export anything

BTMemoryGetProcAddress: exported symbol not found

SetupApi.dll

SetupDiOpenClassRegKey

SetupDiOpenClassRegKeyExA

SetupDiOpenClassRegKeyExW

SetupDiCreateDeviceInterfaceRegKeyA

SetupDiCreateDeviceInterfaceRegKeyW

SetupDiOpenDeviceInterfaceRegKey

SetupDiDeleteDeviceInterfaceRegKey

SetupDiCreateDevRegKeyA

SetupDiCreateDevRegKeyW

SetupDiOpenDevRegKey

SetupDiDeleteDevRegKey

CM_DEVCAP_LOCKSUPPORTED

CM_DEVCAP_EJECTSUPPORTED

PDCAP_D0_SUPPORTED

PDCAP_D1_SUPPORTED

PDCAP_D2_SUPPORTED

PDCAP_D3_SUPPORTED

PDCAP_WAKE_FROM_D0_SUPPORTED

PDCAP_WAKE_FROM_D1_SUPPORTED

PDCAP_WAKE_FROM_D2_SUPPORTED

PDCAP_WAKE_FROM_D3_SUPPORTED

PDCAP_WARM_EJECT_SUPPORTED

HKEY_CLASSES_ROOT

HKEY_CURRENT_CONFIG

HKEY_CURRENT_USER

HKEY_LOCAL_MACHINE

HKEY_USERS

127.0.0.1

iphlpapi.dll

AllocateAndGetTcpExTableFromStack

AllocateAndGetUdpExTableFromStack

SetTcpEntry

GetExtendedTcpTable

GetExtendedUdpTable

Mozilla3_5Password

GetChromePass

StartHttpProxy

1.2.3

keyboardkey

webcaminactive

webcamgetbuffer

webcam

enviarexecnormal

enviarexechidden

openweb

openwebpage

openwebhidden

downexec

sendftp

keylogger

keyloggergetlog

keyloggereraselog

keyloggerativar

keyloggerdesativar

renamekey

windowsfechar

windowsmax

windowsmin

windowsmostrar

windowsocultar

windowsmintodas

windowscaption

listarportas

listarportasdns

finalizarprocessoportas

webcamsettings

chatmsg

getpassword

updateservidorweb

keyloggersearch

urlredirect

urlredirecttrue

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\

PSAPI.dll

\config\SteamAppData.vdf

AutoLoginUser

/ClientRegistry.Blob

\ClientRegistry.blob

\steam.dll

%SYS%

ÞSKTOP%

Uhm%D

HKEY_PERFORMANCE_DATA

HKEY_DYN_DATA

FirstExecution

chatmsg|

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

listarjanelas|windowsfechar|

listarjanelas|windowsmax|

listarjanelas|windowsmin|

listarjanelas|windowsmostrar|

listarjanelas|windowsocultar|

listarjanelas|windowsmintodas|

listarjanelas|windowscaption|

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

listarportas|listadeportaspronta|

listarportas|finalizarconexao|

listarportas|finalizarprocessoportas|Y|

listarportas|finalizarprocessoportas|N|

registro|renamekey|

keylogger|keylogger|keyloggerativar|

keylogger|keylogger|keyloggerdesativar|

keylogger|keyloggergetlog|

keylogger|keylogger|keyloggervazio|

keyloggersearchok|

webcam|webcaminactive|

webcam|webcamactive|

SOFTWARE\Mozilla\Mozilla Firefox

getfirefox

getielogin

getiepass

getieweb

getchrome

getpassword|getpasswordlist|

getpassword|getpassworderror|

duac.bat

%windir%\System32\cmd.exe /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f

cmd.exe duac.bat

C:\Windows\System32\drivers\etc\hosts

Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\

Software\Microsoft\Windows\CurrentVersion\RunServicesOnce\

Software\Microsoft\Windows\CurrentVersion\RunServices\

Software\Microsoft\Windows\CurrentVersion\RunOnce\

Software\Microsoft\Windows\CurrentVersion\Run\

temp.vbs

ntdll.dll

log.dat

SQLite3.dll

deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly

inflate 1.2.3 Copyright 1995-2005 Mark Adler

)ju2.iu

KWindows

RegExport

UrlMon

UnitExecutarComandos

uftp

.UnitBytesSize

UnitListarPortasAtivas

UnitWebcam

UnitKeylogger

WinExec

SetNamedPipeHandleState

GetProcessHeap

CreatePipe

RegQueryInfoKeyA

RegOpenKeyExA

RegOpenKeyA

RegEnumKeyExA

RegDeleteKeyA

RegCreateKeyExA

RegCreateKeyA

RegCloseKey

GdiplusShutdown

keybd_event

MsgWaitForMultipleObjects

MapVirtualKeyA

GetKeyboardState

GetKeyboardLayoutNameA

GetKeyState

GetAsyncKeyState

ExitWindowsEx

EnumWindows

FtpGetFileSize

FtpSetCurrentDirectoryA

FtpOpenFileA

%( % & % % % ]

.idata

.reloc

P.rsrc

hbS%S

advapi32.dll

AVICAP32.DLL

gdi32.dll

gdiplus.dll

mpr.dll

msacm32.dll

ole32.dll

oleaut32.dll

powrprof.dll

user32.dll

wininet.dll

winmm.dll

wsock32.dll

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):
   

   csc.exe:2856
   

2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:
   

   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\adm2.txt (230 bytes)
   C:\Windows\System32\Driver\svchost.exe (601 bytes)

4. Delete the following value(s) in the autorun key (How to Work with System Registry):
   

   [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   "HKCU" = "C:\Windows\system32\Driver\svchost.exe"
   
   [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   "HKLM" = "C:\Windows\system32\Driver\svchost.exe"

5. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.