virus.win32.ramnit.a!remnants

Dmitry Sokolov recommends UnHackMe!

UnHackMe is a powerful tool against malware.

UnHackMe quickly removes rootkits/malware/adware/browser hijack issues!

: Solved! 5 Stars (5 / 5)

virus.win32.ramnit.a!remnants also known as Trojan.Generic-NwUtGGiNRCD (cloud), AdWare.SProtector, ADWARE/Adware.Gen.

Malware Analysis of virus.win32.ramnit.a!remnants – ZIAI.DLL

Created files:

%COMMON APPDATA%\DOWNLOIAD. KEEPUER\GO0YR.EXE
%COMMON APPDATA%\DOWNLOIAD. KEEPUER\ZIAI.DAT
%COMMON APPDATA%\DOWNLOIAD. KEEPUER\ZIAI.DLL
%COMMON APPDATA%\DOWNLOIAD. KEEPUER\ZIAI.TLB
%SYSTEMDRIVE%\SAND-BOX\13381834072549179492.LOG

Autostart registry keys:

HKLM\SOFTWARE\CLASSES\CLSID\{E5FC606E-0022-95C7-AD28-99A2ECAF253C}\INPROCSERVER32\: “%COMMON APPDATA%\DOWNLOIAD. KEEPUER\ZIAI.DLL”
HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{C1A27135-69EB-8D44-7358-34727DD7B820}\UNINSTALLSTRING: “”%COMMON APPDATA%\DOWNLOIAD. KEEPUER\GO0YR.EXE” /S /N /I:”EXECUTECOMMANDS;UNINSTALLCOMMANDS” “””
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{C1A27135-69EB-8D44-7358-34727DD7B820}\DisplayName: “Downloiad. keepuer”

Detected by UnHackMe:

ZIAI.DLL
DEFAULT LOCATION: %COMMON APPDATA%\DOWNLOIAD. KEEPUER\ZIAI.DLL

Dropper hash(md5): d73d06e04d5f1fc51030aab4bd9d8f32

Share This:

Written by 

Malware Hunter.

UnHackMe removes malware invisible for your antivirus!

Free Download

1
UnHackMe is compatible with most antivirus software.
UnHackMe is 100% CLEAN, which means it does not contain any form of malware, including adware, spyware, viruses, trojans and backdoors. VirusTotal (0/56).
System Requirements: Windows 2000-Windows 8.1/10. UnHackMe uses minimum of computer resources.

WordPress SEO fine-tune by Meta SEO Pack from Poradnik Webmastera