Dmitry Sokolov recommends UnHackMe!

UnHackMe is a powerful tool against malware.

UnHackMe quickly removes rootkits/malware/adware/browser hijack issues!

Alex NightWatcher: Solved! (5 / 5)

Malware.Gen!c also known as Trojan.Win32.Swizzor.2!O.

Malware Analysis of Malware.Gen!c – VIDEOVIEWER.EXE

Created files:

C:\tcConference\VideoCall.exe
C:\tcConference\VideoReceiver.exe
C:\tcConference\videoviewer.exe
C:\tcConference\WebConferencePlugin.exe
C:\tcConference\WebConferencePlugin.exe.intermediate.manifest

Autostart registry keys:

HKLM\Software\Classes\CLSID\{25B6AD70-DD2A-4DCE-ACF4-8D837AB2A939}\InprocServer32\: “C:\TCCONF~1\AUDIOC~1.OCX”
HKLM\Software\Classes\CLSID\{CEEE8DF2-338E-4DD5-BE3B-314B03BE82CC}\InprocServer32\: “C:\TCCONF~1\AUDIOC~1.OCX”
HKLM\Software\Classes\tc5\Shell\Open\Command\: “”C:\tcConference\WebConferencePlugin.exe” /url:%1″
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{8EB39AA7-4019-4550-AF6C-BE51BB27B446}\DisplayName: “TC Web Conferencing”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{8EB39AA7-4019-4550-AF6C-BE51BB27B446}\UninstallString: “iwexec.exe /R {8EB39AA7-4019-4550-AF6C-BE51BB27B446}”

Detected by UnHackMe:

VIDEOVIEWER.EXE
Default location: C:\TCCONFERENCE\VIDEOVIEWER.EXE

Dropper hash(md5): 4bc00b18317cab854600acd861a1d129

Written by NightWatcher

Malware Hunter.
Google+

UnHackMe removes malware invisible for your antivirus!

UnHackMe is compatible with most antivirus software.
UnHackMe is 100% CLEAN, which means it does not contain any form of malware, including adware, spyware, viruses, trojans and backdoors. VirusTotal (0/56).
System Requirements: Windows 2000-Windows 8.1/10. UnHackMe uses minimum of computer resources.