Dmitry Sokolov recommends UnHackMe!

UnHackMe is a powerful tool against malware.

UnHackMe quickly removes rootkits/malware/adware/browser hijack issues!

Alex NightWatcher: Solved! (5 / 5)

Backdoor.Httpbot!8.4843-fr8Rr3OaIxN (Cloud) also known as Backdoor.Win32.Httpbot.che, Backdoor.Httpbot.d.

Malware Analysis of Backdoor.Httpbot!8.4843-fr8Rr3OaIxN (Cloud) – TGSDK.DLL

Created files:

%SYSTEMDRIVE%\TEXTGRABSDK\EXAMPLES\DEMO_VBNET\TEXTGRABDEMO_VBNET.VBPROJ
%SYSTEMDRIVE%\TEXTGRABSDK\LICENSE.TXT
%SYSTEMDRIVE%\TEXTGRABSDK\TGSDK.DLL
%SYSTEMDRIVE%\TEXTGRABSDK\TGSDK64.DLL
%SYSTEMDRIVE%\TEXTGRABSDK\TGSDKPW64.BIN

Autostart registry keys:

HKLM\SOFTWARE\CLASSES\CLSID\{0DBEDBD6-5561-4AA6-BF71-96A6BF2864F5}\INPROCSERVER32\: “%SYSTEMDRIVE%\TEXTGRABSDK\TGSDKX.DLL”
HKLM\SOFTWARE\CLASSES\CLSID\{15CED018-EA43-4CC0-AE44-5E8F413E5578}\INPROCSERVER32\: “%SYSTEMDRIVE%\TEXTGRABSDK\TGSDKX.DLL”
HKLM\SOFTWARE\CLASSES\CLSID\{1FDF1F25-6E7E-4E0B-9697-8D14377C6B0E}\INPROCSERVER32\: “%SYSTEMDRIVE%\TEXTGRABSDK\TGSDKX.DLL”
HKLM\SOFTWARE\CLASSES\CLSID\{A05BBABC-5EE2-43F8-96F2-1B581613E8A4}\INPROCSERVER32\: “%SYSTEMDRIVE%\TEXTGRABSDK\TGSDKX.DLL”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\TGSDK\DisplayName: “TextGRAB SDK 3.2”
HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\TGSDK\UNINSTALLSTRING: “”%SYSTEMDRIVE%\TEXTGRABSDK\UNINSTALL.EXE””

Detected by UnHackMe:

TGSDK.DLL
DEFAULT LOCATION: %SYSTEMDRIVE%\TEXTGRABSDK\TGSDK.DLL

Dropper hash(md5): fb40f010388285c5914d1193a3b7f2f9

Written by NightWatcher

Malware Hunter.
Google+

UnHackMe removes malware invisible for your antivirus!

UnHackMe is compatible with most antivirus software.
UnHackMe is 100% CLEAN, which means it does not contain any form of malware, including adware, spyware, viruses, trojans and backdoors. VirusTotal (0/56).
System Requirements: Windows 2000-Windows 8.1/10. UnHackMe uses minimum of computer resources.