Dmitry Sokolov recommends UnHackMe!

UnHackMe is a powerful tool against malware.

UnHackMe quickly removes rootkits/malware/adware/browser hijack issues!

Alex NightWatcher: Solved! (5 / 5)

Win32/Somoto.T potentially unwanted also known as GrayWare[AdWare:not-a-virus]/Win32.Agent, Adware ( 004d87f41 ), Riskware.Win32.Agent.dtnfhl.

Malware Analysis of Win32/Somoto.T potentially unwanted – BITOOL.DLL

Created files:

%TEMP%\BINSIS142.XML
%TEMP%\BINSISCHECK654.XML
%TEMP%\BITOOL.DLL
%TEMP%\NS7402FA9C\3D67AAB3.TMP
%TEMP%\NSD97778121171\CSS\IE6_MAIN.CSS

Autostart registry keys:

HKLM\Software\Classes\CLSID\{1BB2CAF7-8881-4CE8-B16A-3CA37C7C6F33}\LocalServer32\: “”%Program Files%\DAEMON Tools Lite\DiscSoftBusServiceLite.exe””
HKLM\Software\Classes\DAEMON.Tools.Lite\shell\open\command\: “”%Program Files%\DAEMON Tools Lite\DTAgent.exe” -shellmount “%1″”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\DAEMON Tools Lite\DisplayName: “DAEMON Tools Lite”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\DAEMON Tools Lite\UninstallString: “%Program Files%\DAEMON Tools Lite\uninst.exe”
HKLM\System\CurrentControlSet\services\Disc Soft Lite Bus Service\ImagePath: “”%Program Files%\DAEMON Tools Lite\DiscSoftBusServiceLite.exe””
HKLM\System\CurrentControlSet\services\Disc Soft Lite Bus Service\DisplayName: “Disc Soft Lite Bus Service”
HKLM\System\CurrentControlSet\services\dtlitescsibus\ImagePath: “system32\DRIVERS\dtlitescsibus.sys”
HKLM\System\CurrentControlSet\services\dtlitescsibus\DisplayName: “DAEMON Tools Lite Virtual SCSI Bus”
HKLM\System\CurrentControlSet\services\dtliteusbbus\ImagePath: “system32\DRIVERS\dtliteusbbus.sys”
HKLM\System\CurrentControlSet\services\dtliteusbbus\DisplayName: “DAEMON Tools Lite Virtual USB Bus”
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\DAEMON Tools Lite Automount: “”%Program Files%\DAEMON Tools Lite\DTAgent.exe” -autorun”
HKLM\System\CurrentControlSet\services\cdrom\ImagePath: “system32\DRIVERS\cdrom.sys”

Detected by UnHackMe:

BITOOL.DLL
DEFAULT LOCATION: %TEMP%\BITOOL.DLL

Dropper hash(md5): ceaa57526f3a0a33d2c61716ddd23c84

Written by NightWatcher

Malware Hunter.
Google+

UnHackMe removes malware invisible for your antivirus!

UnHackMe is compatible with most antivirus software.
UnHackMe is 100% CLEAN, which means it does not contain any form of malware, including adware, spyware, viruses, trojans and backdoors. VirusTotal (0/56).
System Requirements: Windows 2000-Windows 8.1/10. UnHackMe uses minimum of computer resources.