Dmitry Sokolov recommends UnHackMe!

UnHackMe is a powerful tool against malware.

UnHackMe quickly removes rootkits/malware/adware/browser hijack issues!

Alex NightWatcher: Solved! (5 / 5)

Trojan.DownLoader12.17853 also known as W32.Pinfi.B, W32/Pate.b, Virus.Win32.Parite.b.

Malware Analysis of Trojan.DownLoader12.17853 – TGVBG.EXE

Created files:

%SysDir%\Serverx.exe
%WinDir%\Temp\ksa3.tmp
%WinDir%\tgvbg.exe
C:\setupx.dll

Autostart registry keys:

HKLM\System\CurrentControlSet\Services\Pqrstu Wxyabcde Ghi\ImagePath: “%WinDir%\tgvbg.exe”
HKLM\System\CurrentControlSet\Services\Pqrstu Wxyabcde Ghi\DisplayName: “Pqrstuvw Yabcdefgh Jklmnop Rstuvwxy Bcd”
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Serverx: 43 3A 5C 57 49 4E 44 4F 57 53 5C 73 79 73 74 65 6D 33 32 5C 53 65 72 76 65 72 78 2E 65 78 65 00 5E 3F 10 7C 41 6F 3F 7C 3F 49 3F 7C B0 59 3F 7C 00 00 14 00 3F 79 12 00 3F 59 3F 7C 44 3F 12 00 00 65 3F 7C 48 6F 3F 7C 79 79 01 00 05 00 00 00 20 79 12 00 00 00 00 00 44 3F 12 00 00 65 3F 7C 40 00 91 7C 79 79 79 79 3D 00 91 7C 3F 04 91 7C 00 00 14 00 00 00 00 00 65 B1 14 00 00 3F 12 00 62 04 91 7C 65 B1 14 00 00 00 00 00 54 3F 12 00 3F 65 59 77 10 69 59 77 78 79 12 00 84 3F 12 00 5C 07 00 00 46 61 40 00 40 3F 12 00 00 00 00 00 00 00 00 00 78 79 12 00 20 3F 12 00 A6 61 40 00 00 00 00 00 00 00 00 00 0C 3F 12 00 5C 3F 12 00 78 3F 12 00 58 17 3F 77 18 69 59 77 79 79 79 79 10 69 59 77 3F 61 40 00 5C 07 00 00 93 61 40 00 00 00 00 00 04 00 00 00 A6 61 40 00 04 00 00 00

Detected by UnHackMe:

TGVBG.EXE
Default location: %WinDir%\TGVBG.EXE

Dropper hash(md5): 1d4e14d7e95ed0d86c211752176a39f9

Written by NightWatcher

Malware Hunter.
Google+

UnHackMe removes malware invisible for your antivirus!

UnHackMe is compatible with most antivirus software.
UnHackMe is 100% CLEAN, which means it does not contain any form of malware, including adware, spyware, viruses, trojans and backdoors. VirusTotal (0/56).
System Requirements: Windows 2000-Windows 8.1/10. UnHackMe uses minimum of computer resources.