Dmitry Sokolov recommends UnHackMe!
UnHackMe is a powerful tool against malware.UnHackMe quickly removes rootkits/malware/adware/browser hijack issues!
BackDoor.Generic13.GAE also known as Trojan.Win32.Generic.pak!cobra, Riskware ( 0015e4f01 ), Backdoor/IRCNite.ase.
Malware Analysis of BackDoor.Generic13.GAE – RFUSCLIENTSRV.EXE
Created files:
%Program Files%\Remote Manipulator System – Host\Printer\x86\VPDAgent.exe
%Program Files%\Remote Manipulator System – Host\rfusclient.exe
%Program Files%\Remote Manipulator System – Host\rfusclientSrv.exe
%Program Files%\Remote Manipulator System – Host\RIPCServer.dll
%Program Files%\Remote Manipulator System – Host\Russian.lg
Autostart registry keys:
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\F21BB3D03099A4D40A267949D7A24BE4\InstallProperties\UninstallString: “MsiExec.exe /X{0D3BB12F-9903-4D4A-A062-97947D2AB44E}”
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\F21BB3D03099A4D40A267949D7A24BE4\InstallProperties\DisplayName: “Remote Manipulator System – Host”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{0D3BB12F-9903-4D4A-A062-97947D2AB44E}\UninstallString: “MsiExec.exe /X{0D3BB12F-9903-4D4A-A062-97947D2AB44E}”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{0D3BB12F-9903-4D4A-A062-97947D2AB44E}\DisplayName: “Remote Manipulator System – Host”
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\RWLN\DllName: “RWLN.dll”
HKLM\System\CurrentControlSet\Services\RManService\ImagePath: “%Program Files%\Remote Manipulator System – Host\rutserv.exe”
HKLM\System\CurrentControlSet\Services\RManService\DisplayName: “TektonIT – RMS Host”
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit: “c:\windows\system32\userinit.exe,,c:\program files\microsoft\desktoplayer.exe”
Detected by UnHackMe:
RFUSCLIENTSRV.EXE
Default location: %PROGRAM FILES%\REMOTE MANIPULATOR SYSTEM – HOST\RFUSCLIENTSRV.EXE
Dropper hash(md5): ba351f8b5c47b70eee91328f2bc2345b
UnHackMe
removes malware invisible for your antivirus!
UnHackMe is 100% CLEAN, which means it does not contain any form of malware, including adware, spyware, viruses, trojans and backdoors. VirusTotal (0/56).
System Requirements: Windows 2000-Windows 8.1/10. UnHackMe uses minimum of computer resources.