Dmitry Sokolov recommends UnHackMe!
UnHackMe is a powerful tool against malware.
UnHackMe quickly removes rootkits/malware/adware/browser hijack issues!
(5 / 5)
BehavesLike.Win32.Klez.tc also known as W32.PasistA.Worm, Worm.Sfone, Win32/Agent.worm.1433370.
Malware Analysis of BehavesLike.Win32.Klez.tc – CUMSHOT HIDDEN 50+ .MPEG.EXE
Created files:
%WinDir%\mssrv.exe
C:\debug.txt
%Appdata%\Adobe\Shockwave Player 11\xtras\download\cumshot hidden 50+ .mpeg.exe
%Appdata%\Macromedia\Flash Player\#SharedObjects\porn big .zip.exe
%Temp%\nude nude [bangbus] .zip.exe
Autostart registry keys:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\mssrv32: 43 3A 5C 57 49 4E 44 4F 57 53 5C 6D 73 73 72 76 2E 65 78 65 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 AE 2C 91 7C 61 2C 91 7C 51 2D 91 7C 58 2D 91 7C 60 00 00 00 08 02 00 00 3F 01 00 00 19 00 1A 00 3F 75 12 00 00 00 00 00 2C 75 12 00 00 00 00 00 6F 6B 14 00 79 79 79 79 58 2D 91 7C 00 00 14 00 01 00 00 00 00 00 14 00 69 75 12 00 79 00 00 00 B0 79 12 00 10 00 01 00 41 00 00 00 64 75 12 00 00 00 00 00 B0 79 12 00 00 65 3F 7C 40 00 91 7C 79 79 79 79 3D 00 91 7C 3F 04 91 7C 00 00 14 00 00 00 00 00 65 4D 14 00 44 75 12 00 62 04 91 7C 65 4D 14 00 31 00 00 00 68 75 12 00 0C B6 88 7C 60 75 12 00 0F 41 40 00 94 79 12 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 79 12 00 61 1A 40 00
Detected by UnHackMe:
CUMSHOT HIDDEN 50+ .MPEG.EXE
Default location: %APPDATA%\ADOBE\SHOCKWAVE PLAYER 11\XTRAS\DOWNLOAD\CUMSHOT HIDDEN 50+ .MPEG.EXE
Dropper hash(md5): 6abb5557a94471d8570ae39fcde1ee30
UnHackMe
removes malware invisible for your antivirus!
UnHackMe is 100% CLEAN, which means it does not contain any form of malware, including adware, spyware, viruses, trojans and backdoors. VirusTotal (0/56).
System Requirements: Windows 2000-Windows 8.1/10. UnHackMe uses minimum of computer resources.