Dmitry Sokolov recommends UnHackMe!

UnHackMe is a powerful tool against malware.

UnHackMe quickly removes rootkits/malware/adware/browser hijack issues!

Alex NightWatcher: Solved! (5 / 5)

BackDoor.Generic13.GAE also known as Trojan.Win32.Generic.pak!cobra, Riskware ( 0015e4f01 ), Backdoor/IRCNite.ase.

Malware Analysis of BackDoor.Generic13.GAE – RFUSCLIENTSRV.EXE

Created files:

%Program Files%\Remote Manipulator System – Host\Printer\x86\VPDAgent.exe
%Program Files%\Remote Manipulator System – Host\rfusclient.exe
%Program Files%\Remote Manipulator System – Host\rfusclientSrv.exe
%Program Files%\Remote Manipulator System – Host\RIPCServer.dll
%Program Files%\Remote Manipulator System – Host\Russian.lg

Autostart registry keys:

HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\F21BB3D03099A4D40A267949D7A24BE4\InstallProperties\UninstallString: “MsiExec.exe /X{0D3BB12F-9903-4D4A-A062-97947D2AB44E}”
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\F21BB3D03099A4D40A267949D7A24BE4\InstallProperties\DisplayName: “Remote Manipulator System – Host”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{0D3BB12F-9903-4D4A-A062-97947D2AB44E}\UninstallString: “MsiExec.exe /X{0D3BB12F-9903-4D4A-A062-97947D2AB44E}”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{0D3BB12F-9903-4D4A-A062-97947D2AB44E}\DisplayName: “Remote Manipulator System – Host”
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\RWLN\DllName: “RWLN.dll”
HKLM\System\CurrentControlSet\Services\RManService\ImagePath: “%Program Files%\Remote Manipulator System – Host\rutserv.exe”
HKLM\System\CurrentControlSet\Services\RManService\DisplayName: “TektonIT – RMS Host”
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit: “c:\windows\system32\userinit.exe,,c:\program files\microsoft\desktoplayer.exe”

Detected by UnHackMe:

RFUSCLIENTSRV.EXE
Default location: %PROGRAM FILES%\REMOTE MANIPULATOR SYSTEM – HOST\RFUSCLIENTSRV.EXE

Dropper hash(md5): ba351f8b5c47b70eee91328f2bc2345b

Written by NightWatcher

Malware Hunter.
Google+

UnHackMe removes malware invisible for your antivirus!

UnHackMe is compatible with most antivirus software.
UnHackMe is 100% CLEAN, which means it does not contain any form of malware, including adware, spyware, viruses, trojans and backdoors. VirusTotal (0/56).
System Requirements: Windows 2000-Windows 8.1/10. UnHackMe uses minimum of computer resources.