Dmitry Sokolov recommends UnHackMe!

UnHackMe is a powerful tool against malware.

UnHackMe quickly removes rootkits/malware/adware/browser hijack issues!

Alex NightWatcher: Solved! (5 / 5)

Win.Trojan.Agent-1427920 also known as Backdoor.PePatch.Win32.69512, Gen:Variant.Application.Dropper.111, Trojan.Win32.Crossrider.cznobp.

Malware Analysis of Win.Trojan.Agent-1427920 – NRTLWZF5.EXE

Created files:

%COMMON APPDATA%\DOWNLOAD KEEEPER\K46K7NB.TLB
%COMMON APPDATA%\DOWNLOAD KEEEPER\NRTLWZF5.DAT
%COMMON APPDATA%\DOWNLOAD KEEEPER\NRTLWZF5.EXE
%SYSTEMDRIVE%\SAND-BOX\8927528780831284533.LOG
%LOCAL APPDATA%\GOOGLE\CHROME\USER DATA\DEFAULT\EXTENSIONS\IABMNBFGKNIMNNKLCLIEGBIAHPBBPMKO\1.6\BACKGROUND.HTML

Autostart registry keys:

HKLM\SOFTWARE\CLASSES\CLSID\{EB7292CB-D76E-3262-4BAD-9F79BAD1A85C}\INPROCSERVER32\: “%COMMON APPDATA%\DOWNLOAD KEEEPER\K46K7NB.DLL”
HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{C1A27135-69EB-8D44-7358-34727DD7B820}\UNINSTALLSTRING: “”%COMMON APPDATA%\DOWNLOAD KEEEPER\NRTLWZF5.EXE” /S /N /I:”EXECUTECOMMANDS;UNINSTALLCOMMANDS” “””
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{C1A27135-69EB-8D44-7358-34727DD7B820}\DisplayName: “Download keeeper”

Detected by UnHackMe:

NRTLWZF5.EXE
DEFAULT LOCATION: %COMMON APPDATA%\DOWNLOAD KEEEPER\NRTLWZF5.EXE

Dropper hash(md5): 0c7d9bdaaf41af54ca7dc14019159688

Written by NightWatcher

Malware Hunter.
Google+

UnHackMe removes malware invisible for your antivirus!

UnHackMe is compatible with most antivirus software.
UnHackMe is 100% CLEAN, which means it does not contain any form of malware, including adware, spyware, viruses, trojans and backdoors. VirusTotal (0/56).
System Requirements: Windows 2000-Windows 8.1/10. UnHackMe uses minimum of computer resources.