Trojan Generic Removal Guide

Threat Level:

10/10

Rate this Article:

Comments (0)

Article Views: 1211

Category:	Trojans

Trojan Generic is a computer parasite that was detected in 2008 for the first time, and ever since has been infecting and plaguing numbers of computers worldwide. This Trojan is a rather tricky case of computer security, because its name is also frequently used by rogue antispyware in fake security alert messages that the rogue sends to unsuspecting computer user. So sometimes it can be hard to say whether you are really infected with Trojan Generic or whether it is simply a fake notification from a false antivirus program.

However, Trojan Generic can also be a genuine Trojan that could cause extreme damage to your computer. The warnings that come from your computer system about suspicious activity can be indicating the presence of this Trojan. Also, other symptoms of the infection include browser hijacking and forceful redirection to malware-related sites, and crashing applications, when you are not able to run your programs the way you are used to. Then you should really take notice of Trojan Generic and remove it from your computer at once.

Needless to say, that the way you deal with this infection depends on the type of the infection. If Trojan Generic is only a part of rogue antispyware fake alert notifications, then you need to delete the rogue itself, because in such case Trojan Generic does not exist in your computer. You should take this infection more seriously if you are infected with the real Trojan Generic. The way to know whether you are infected or not is to check for the files associated with this Trojan in your system.

When Trojan Generic is installed and running, it leaves these files in your system:

.tt19AD.tmp.exe
.tt1B5.tmp.exe
.tt1C.tmp.exe
.tt38.tmp.exe

You should also check, whether there are these processes running in your Windows Task Manager mhtiedmsika.exe, MapDrive.exe, kuxuy.exe, kqfrybpdlta.exe. They are associated with Trojan Generic, and that is just a small part of files that the Trojan keeps running in the background of your system. That is also one of the reasons why it is hard to remove Trojan Generic manually – there are many files and processes to kill and delete. Therefore you are advised to acquire a powerful security tool that would be capable of dealing with this Trojan. You need to understand that with this pest in your system, you privacy is breached and you personal information might be leaked over the Internet, so erase Trojan Generic as soon as possible without any trace left.

Download Malware Scanner to detect Trojan Generic

Tested Trojan Generic removal solution for 64/32-bit Windows 7/Vista/XP/2000

*The Spyhunter scanner download on this site is intended to be used as a detection tool. If you want to use its a removal function, you will need to purchase the full version of SpyHunter.

Trojan Generic technical info for manual removal:

Files Modified/Created on the system:

#	File Name	File Size (Bytes)	File Hash
1	aim remote.exe	683520 bytes
2	fozusayo.dll	49152 bytes
3	bdsyslink.dll	86016 bytes
4	iksuy.exe	140151 bytes	MD5: cfc995ef0b0728896b5120c5adf214e0
5	debodoro.dll	71168 bytes
6	idumowapupiy.dll	183296 bytes	MD5: 039e2ad7866d29aa5751b3810fd015fc
7	winmyy32.dll	39424 bytes
8	%UserProfile%\thc?????????
9	asycfil.dll	123904 bytes
10	%SystemRoot%\System32\lphc?????????
11	PowerJa.ask	70777 bytes
12	dijipire.dll	70144 bytes
13	ijusuyanami.dll	266240 bytes	MD5: 39c5f01af18aa97ace2b61ff4040d4e6
14	uvumaxeqa.dll	186368 bytes	MD5: 1d2f7578eeee5cd17d39e57dd6de31b0
15	akuzivazoveraxif.dll	185344 bytes	MD5: 8ccb115f9ae7f00b03e5fe57313915c9
16	ibitolet.dll	189952 bytes	MD5: 233dc9f067988cb5a89f47f62276fc3f
17	fwtrtuqtssd.exe	262144 bytes	MD5: f3992fde36ff8e1ebb24d1e0f3cb95ea
18	ehczrw312.exe	1150976 bytes
19	kozeyizu.dll	89088 bytes
20	%UserProfile%\Application Data\thc?????????
21	nobajanu.dll	81408 bytes
22	mulirowo.dll	50688 bytes
23	lebenesa.dll	78848 bytes
24	dot3cfg32.dll	119808 bytes
25	Stonprvi.dll	73728 bytes	MD5: bbe43ab743aecff93132fc4b42a15f9f
26	kekasika.dll	49664 bytes
27	vubabuku.dll	48128 bytes
28	penipure.dll	50688 bytes
29	asade.exe	133120 bytes	MD5: c5ed7ab3a7f1b367bc77480907a71274
30	%ProgramFiles%\lphc?????????
31	jahasike.dll	48128 bytes
32	rigiwoti.dll	81920 bytes
33	kbdnet.dll	30720 bytes
34	pofolehe.dll	51200 bytes
35	dijanumo.dll	133120 bytes
36	dx8vb32.dll	139264 bytes
37	svcchosst.exe	101376 bytes
38	nevoputo.dll	89600 bytes
39	etomemap.dll	179200 bytes	MD5: 637e74ea2f3f3b948ca58a3f9fa9da53
40	avunazobesitefes.dll	181248 bytes	MD5: 1e26a97cfc935abfd022de88531408ae
41	dowikabu.dll	87552 bytes
42	%SystemRoot%\System32\bpph??????????
43	ClipHelp3xx.dll	86016 bytes	MD5: 0a102507a28680434a8231199c7ac913
44	reqi.exe	116224 bytes	MD5: fb482abc534c45584bfab8e7c621b2e6
45	tipiyipo.dll	89600 bytes
46	kusers.dll	205840 bytes
47	bdaplgini.dll	84992 bytes	MD5: deacbaa2ddf8597cdf1985e2950034d6
48	xydzyh.exe	45056 bytes
49	hepigalo.exe
50	Ffodoa.exe	163840 bytes	MD5: a5690ed0f4f2a3184fd469d5be888072
51	dodohovo.dll	107520 bytes
52	mukejowe.dll	89600 bytes
53	wahayaga.dll	49664 bytes
54	aboheraj.dll	187904 bytes	MD5: f9412fbd4707eca38cb794f439af6294
55	atl7.dll	122368 bytes
56	odbn0.exe	295424 bytes
57	zofowoda.dll	50688 bytes
58	nahatona.dll	106496 bytes
59	nl5.exe	1464320 bytes
60	alivevukov.dll	179712 bytes	MD5: 64b417db53c23d036d2843b44c22bb7c
61	robejaku.dll	88064 bytes
62	pjdeya.exe	597504 bytes	MD5: 5d4743a302e76421c449e8cfc2d8be2f
63	vabofoka.dll	48128 bytes
64	penis.exe	90112 bytes
65	yamanewa.dll	80384 bytes
66	hovebipu.dll	48640 bytes
67	SerialsWorld.exe	1075712 bytes
68	%SystemRoot%\System32\phc?????????
69	muyinepa.dll	80896 bytes
70	kurtapt24@yahoo.com	9458 bytes	MD5: 2e124646bd0fbe6838796bd181df0eef
71	itufijorece.dll	207360 bytes	MD5: 3334de88ae7ce7034ff0b075ec923599
72	zs880000[1].exe	108032 bytes
73	iyupodovujepope.dll	194048 bytes	MD5: 20df5aee46a31774c749f9945b711641
74	uqojanecatevih.dll	182784 bytes	MD5: 8a9effc288c73c50e8ccbd76f29f4f8f
75	uhoyureg.dll	182272 bytes	MD5: e27f0bd6b5d9af43fd35abaa37123f54
76	sekisahi.dll	48128 bytes
77	topapope.dll	80384 bytes
78	RqAds.exe	135168 bytes
79	oyuwopoze.dll	183296 bytes	MD5: d49dfd4cf9dd4128c42423d2809f24dd
80	zelovumi.dll	49152 bytes
81	pivumedo.dll	190976 bytes
82	csrcs.exe	20480 bytes	MD5: fb52692745918a67cbd7e9cc26982627
83	digiwet.dll	17920 bytes
84	juhalobo.dll	109056 bytes
85	rdolib.dll	30720 bytes
86	KBDURsr.dll	62976 bytes	MD5: e3beace9fb53c4ea2a2a5517d76b5b38
87	%SystemRoot%\System32\pphc?????????
88	yovalono.dll	49664 bytes
89	1361163109.exe	991232 bytes	MD5: 9fcf0e8c39b00227ba76a1bdaee25480
90	yatodimi.dll	70144 bytes
91	evejubet.dll	194048 bytes	MD5: 73b599d33ae2f39ef880ac2195ea6ce9
92	uheludeje.dll	173056 bytes	MD5: b34cdd55229d93f43cebd8bac52597e6
93	mivalivo.dll	49664 bytes
94	%UserProfile%\Application Data\643f??????????
95	dmutil32.dll	198656 bytes
96	pujosove.dll	48640 bytes
97	qycu.exe	133632 bytes	MD5: 4f78005695709f8a9b48ec2598301d7d
98	pcpriv.exe	397824 bytes
99	uclyv.exe	100352 bytes	MD5: 904c33d27f3b145fbb9506955049d90b
100	mafuyiha.dll	106496 bytes
101	juriyuyi.dll	50688 bytes
102	pascmgp.exe	438272 bytes	MD5: e18777a913aa00cdf543c89bd3e271cb
103	%SystemRoot%\System32\thc?????????
104	hehoyoze.dll	50688 bytes
105	wujiwibe.dll	88064 bytes
106	zyex.exe	132608 bytes	MD5: 1879ac641af2e71f26905cb048a07857
107	junefare.dll	50688 bytes
108	srenum.sys	36480 bytes
109	kory.exe	92672 bytes	MD5: 0db0abdcf82af6f56402d11cca6ad0dd
110	mivi.exe	171520 bytes	MD5: 947f14f76240dc31ff436dc3ff906114
111	norozuse.dll	69632 bytes
112	emihotepopeg.dll	187392 bytes	MD5: 0df79c59f0e032e5bc995786d5815461
113	tikatabi.dll	80384 bytes
114	unapatax.dll	182272 bytes	MD5: 13c74cdba40b44b226697a503a1efe5f
115	%UserProfile%\rhc?????????
116	%UserProfile%\Application Data
117	nupotuku.dll	48640 bytes
118	onifr.exe	147454 bytes	MD5: 055c5d04c1cb3c4945637d38c7ba9933
119	wisysvi.dll	67072 bytes	MD5: cd5ecd06b63492fbcb6509dc20442631
120	acafojufaneroko.dll	181248 bytes	MD5: c81f3aa068656fa0e426fc3a3faab970
121	kifupiza.dll	50176 bytes
122	%UserProfile%\Application Data\blphc?????????
123	cmdial3.dll	122368 bytes
124	nsx23.dll	1351680 bytes
125	idojapimogudoray.dll	185344 bytes	MD5: 6b08c208052f9e5cc2190d6801ac1b9e
126	pulobuha.dll	109056 bytes
127	itlterad.dll	73216 bytes	MD5: 797b334fc3a2f9e9b69f57e7ea9b93ec
128	%UserProfile%\Application Data\bpph??????????
129	zogonaha.dll	108544 bytes
130	AcroIEHelpe022.dll	216400 bytes	MD5: 417958dc10a28999d539ca25fb35f884
131	ugavisidu.dll	180224 bytes	MD5: 6aa2d902c4637662f7dac98aabf95544
132	ovamudutibofe.dll	195584 bytes	MD5: 636d4967bd46a237f681c8339559688c
133	vybi.exe	115200 bytes	MD5: dbdf452705cb7e45fee3063e1e12f99b
134	icaqx.exe	124414 bytes	MD5: 36547fb1efeb3d949032ab5bf8040c76
135	%UserProfile%\Application Data\phc?????????
136	ijucahalevet.dll	181760 bytes	MD5: a4687240401c1d4ef8e1bead595cbca3
137	relereni.dll	87552 bytes
138	bufezeza.dll	80384 bytes
139	sysrc32.exe	12288 bytes
140	realsvc.exe	143537 bytes
141	bopufeto.dll	50176 bytes
142	luyehije.dll	87552 bytes
143	logomafe.dll	88576 bytes
144	kusewovi.dll	69120 bytes
145	photo_id.exe	27755 bytes
146	ikuhunicapa.dll	184320 bytes	MD5: f89c42bca4a8a96fbbb34207b0a633f4
147	fejolave.dll	50688 bytes
148	omshtup.dll	74752 bytes	MD5: 5c4a9189143898c880c685baefe0949f
149	mejiyolo.dll	88064 bytes
150	nl4.exe	668160 bytes
151	%ProgramFiles%\rhc?????????
152	asvdxl.dll	79872 bytes	MD5: bc2780a2a6d2c21b76c8716975c10813
153	sihosido.dll	108032 bytes
154	eloheseweriquyi.dll	182272 bytes	MD5: 351a14711242221e54e0a1920a82f4de
155	Lxh.exe	169472 bytes	MD5: 9f4ab3be9eaba698dc0e0f7c73a95558
156	eruzurow.dll	180224 bytes	MD5: 63178a01d821357152f686e70909bf3e
157	%UserProfile%\Application Data\pphc?????????
158	mutelupo.dll	69632 bytes
159	%ProgramFiles%\phc?????????
160	afitegef.dll	181248 bytes	MD5: 561281ee46cf4df81d610382a80ec6aa
161	vupesasu.dll	64512 bytes	MD5: b5b5cc712268472c9e92b81f54a385c4
162	kylo.exe	116736 bytes	MD5: 9393917d6f87dadf94d2ccaead23f380
163	yowujeje.dll	48640 bytes
164	%ProgramFiles%\blphc?????????
165	udihozazohec.dll	197632 bytes	MD5: 8e4bd6bf49fa29c52b564f0c3255cfed
166	wehebopa.dll	50176 bytes
167	%UserProfile%\bpph??????????
168	yosineku.dll	89600 bytes
169	ope2314.exe	401920 bytes	MD5: 64e9e281d180395b1f60872930a8d19a
170	kavumefe.dll	81920 bytes
171	bisevona.dll	78848 bytes
172	wirepots.exe	8704 bytes	MD5: 4c1fd02d449c708d7708deb17f9dc6c5
173	%ProgramFiles%\pphc?????????
174	%UserProfile%\pphc?????????
175	%ProgramFiles%
176	itulezibaha.dll	167424 bytes	MD5: 5b8354756720dfe05deb6fafe3c38332
177	vopereso.dll	49152 bytes
178	icocalolacihir.dll	182272 bytes	MD5: a0f9b695b2711007dc5201a98de184f4
179	%SystemRoot%\System32\rhc?????????
180	uqiwaceh.dll	187392 bytes	MD5: d7c17417a83ab2c658cb5c025f8f2500
181	zemupalu.dll	89600 bytes
182	kufefele.dll	50688 bytes
183	vosevodi.dll	89088 bytes
184	zorihali.dll	109281 bytes
185	iwuvokit.dll	188416 bytes	MD5: e64b3d474056f615babfba025797f47d
186	fechme.exe	32768 bytes
187	%UserProfile%\Application Data\lphc?????????
188	eyobupovi.dll	180736 bytes	MD5: 1b985c5b2478f61468953368bb46f1bb
189	%UserProfile%\blphc?????????
190	%UserProfile%\phc?????????
191	usofumakuladoleq.dll	197632 bytes	MD5: c26b9ca0a25340fabff43166fb1c5ada
192	cajiw.exe	557056 bytes	MD5: 6222d185dbfd393c9208e3e19cd3eee1
193	delidubu.dll	89600 bytes
194	winlo.exe	1220215 bytes
195	sumonibe.dll	49152 bytes
196	kulo.exe	118850 bytes	MD5: 8a37ecc0344edbdcff843f01e4db160a
197	zesanido.dll	50176 bytes
198	sgpron.dll	62464 bytes	MD5: 261b36cee988614c50f1d17100409f3d
199	%ProgramFiles%\643f??????????
200	oderobifamaves.dll	181248 bytes	MD5: bcb38a3af170849ed800813980c098c5
201	bawawaza.dll	78848 bytes
202	yopalimi.dll	106496 bytes
203	207163515.exe	892416 bytes	MD5: 695a8155cf64fa91f33241cb825a78c4
204	palowaru.dll	48640 bytes
205	nuviyapi.dll	49152 bytes
206	oviyukebicitaq.dll	189952 bytes	MD5: 26e0901133821a1a844fdf9f376a2220
207	sdasda.exe	66560 bytes
208	uyuhapuhid.dll	195072 bytes	MD5: 5f6b1405d57dc8df91144601b605e3ae
209	evizavohiyesupa.dll	186880 bytes	MD5: 93e22d9b2653be354a9214a8d1915d47
210	xoipk.exe	142848 bytes	MD5: 97c65e1c3df2ea29ceb58b3390bd0b37
211	bupuyafo.dll	89088 bytes
212	ree1.exe	646656 bytes
213	xipr.exe	184848 bytes
214	nl3.exe	1891840 bytes
215	hesudobu.dll	104960 bytes
216	miduyevu.dll	89600 bytes
217	livukafa.dll	49664 bytes
218	irulusasiyuwam.dll	178176 bytes	MD5: 066db90be6f45540e15d1d928ab7f21d
219	lopibeki.dll	70144 bytes
220	uvojigulukacega.dll	181760 bytes	MD5: 8ba96641c0cf6ba391ad8b6081ba36e7
221	lepopoka.dll	50688 bytes
222	zipavagi.dll	50688 bytes
223	%SystemRoot%\System32\blphc?????????
224	%ProgramFiles%\bpph??????????
225	beipq.exe	169472 bytes	MD5: ac12fcef12aec513bd5e8e8fcf389e1f
226	Warn Support.exe	704512 bytes
227	uyefesujoxumu.dll	182784 bytes	MD5: f42cc970e73eaee3d6419c9be9ced491
228	%UserProfile%
229	hnwqrys.exe	368896 bytes	MD5: 3603e534db5178036425c5e6bcca8ee4
230	mokehohi.dll	69120 bytes
231	jimofiji.dll	49152 bytes
232	sujibiwi.dll	50176 bytes
233	ufdsvc.exe	69632 bytes	MD5: 99184adc5b7fab997146971f20afff18
234	dijoromo.dll	50176 bytes
235	%UserProfile%\643f??????????
236	lewiyidi.dll	49664 bytes
237	togojaze.dll	50176 bytes
238	%UserProfile%\Application Data\whc?????????
239	potibubi.dll	50176 bytes
240	hukubuhu.dll	69632 bytes
241	nageduge.dll	50688 bytes
242	ajuquqoqepoqu.dll	179200 bytes	MD5: 101c7b1219b42021916ee9f7b7836b23
243	pokumala.dll	107520 bytes
244	dizubure.dll	66560 bytes
245	fenofaki.dll	87040 bytes
246	idolowun.dll	180736 bytes	MD5: 15689f041fb926413e423597a913f5e2
247	caese.exe	116736 bytes	MD5: a3e5d6733da460ebf9d0c4332bb95f37
248	ree2.exe	748032 bytes
249	tijawani.dll	50688 bytes
250	aztmgyr.exe	503808 bytes	MD5: e681819c3eae6cc1a9c779921b300d82
251	nl2.exe	1918976 bytes
252	sogidona.dll	89088 bytes
253	kalerazo.dll	88064 bytes
254	balomane.dll	80384 bytes
255	papororo.dll	88576 bytes
256	%UserProfile%\Application Data\rhc?????????
257	%ProgramFiles%\whc?????????
258	kafunepi.dll	80384 bytes
259	jelayube.dll	72861 bytes
260	%TEMP%
261	bdsl2.dll	86016 bytes
262	obaluqizevax.dll	182784 bytes	MD5: e18c0753f6729408f93832496a7085be
263	ixelinet.dll	182272 bytes	MD5: a1b569c180afb2dd878a45bba9c078d4
264	verabija.dll	88064 bytes
265	fezahoyu.dll	81920 bytes
266	rexsvc32.exe	1735854 bytes	MD5: 5b0a5c74d78559d8a7367c9719cd40e5
267	%ProgramFiles%\thc?????????
268	%SystemRoot%\System32\643f??????????
269	dxva2C.dll	62464 bytes	MD5: 41cb45cccc9897274d77c847ba946b6d
270	powamahe.dll	109056 bytes
271	uqogumamumuse.dll	183808 bytes	MD5: f9dbaec1d7f298488edd7340029f808d
272	%SystemRoot%\System32\whc?????????
273	icpiob9.dll	78848 bytes	MD5: c4572382faac2486122dfc53cfc40340
274	ofriasc.dll	79360 bytes	MD5: 158568bd1c1926d357b66f18397c4c11
275	hoyuvuki.dll	50176 bytes
276	oqifubeqixi.dll	188416 bytes	MD5: 611049af410f7421a4aa95dfaff83a06
277	poqii.exe	147445 bytes	MD5: 9372599a17d10580496c99fb50c62fdf
278	nl6.exe	1453056 bytes
279	irxoe.exe	116736 bytes	MD5: 4f883bd12740c865a1765183767f979a
280	fahokipa.dll	86528 bytes
281	doriyubi.dll	49152 bytes
282	zezowawi.dll	106496 bytes
283	ufimixefenoy.dll	257536 bytes	MD5: b9407a6531a93d27f4a970f3b849ee9e
284	weluyiki.dll	107520 bytes
285	viyiyini.dll	88064 bytes
286	%UserProfile%\lphc?????????
287	zarebeba.dll	50688 bytes
288	bovekafu.dll	89600 bytes
289	baka6.exe	144384 bytes	MD5: c95ecdad9b7dabf9eb81b4cf50a1aa59
290	kdpini.dll	192528 bytes
291	iqugumamu.dll	183296 bytes	MD5: 3a18d024f36469eed2cc3ef1e6648725
292	stuvwxy.exe
293	%UserProfile%\whc?????????
294	akihovojamaz.dll	180224 bytes	MD5: 859e7381425e73ec2d908216567448e4
295	sonuleme.dll	88064 bytes
296	uzewerilupavid.dll	186368 bytes	MD5: fa537293c1587d408722591ed4020a20
297	barijatu.dll	50176 bytes
298	%SystemRoot%\System32
299	roam five.exe	700416 bytes
300	ptidle.exe	56832 bytes

Files in the following directories were modified:

%UserProfile%
%SystemRoot%\System32
%UserProfile%\Application Data
%ProgramFiles%
%SystemRoot%

Memory Processes Created:

#	Process Name	Process Filename	Main module size
1	aim remote.exe	aim remote.exe	683520 bytes
2	iksuy.exe	iksuy.exe	140151 bytes
3	fwtrtuqtssd.exe	fwtrtuqtssd.exe	262144 bytes
4	ehczrw312.exe	ehczrw312.exe	1150976 bytes
5	asade.exe	asade.exe	133120 bytes
6	svcchosst.exe	svcchosst.exe	101376 bytes
7	reqi.exe	reqi.exe	116224 bytes
8	xydzyh.exe	xydzyh.exe	45056 bytes
9	hepigalo.exe	hepigalo.exe
10	Ffodoa.exe	Ffodoa.exe	163840 bytes
11	odbn0.exe	odbn0.exe	295424 bytes
12	nl5.exe	nl5.exe	1464320 bytes
13	pjdeya.exe	pjdeya.exe	597504 bytes
14	penis.exe	penis.exe	90112 bytes
15	SerialsWorld.exe	SerialsWorld.exe	1075712 bytes
16	zs880000[1].exe	zs880000[1].exe	108032 bytes
17	RqAds.exe	RqAds.exe	135168 bytes
18	csrcs.exe	csrcs.exe	20480 bytes
19	1361163109.exe	1361163109.exe	991232 bytes
20	qycu.exe	qycu.exe	133632 bytes
21	pcpriv.exe	pcpriv.exe	397824 bytes
22	uclyv.exe	uclyv.exe	100352 bytes
23	pascmgp.exe	pascmgp.exe	438272 bytes
24	zyex.exe	zyex.exe	132608 bytes
25	kory.exe	kory.exe	92672 bytes
26	mivi.exe	mivi.exe	171520 bytes
27	onifr.exe	onifr.exe	147454 bytes
28	vybi.exe	vybi.exe	115200 bytes
29	icaqx.exe	icaqx.exe	124414 bytes
30	sysrc32.exe	sysrc32.exe	12288 bytes
31	realsvc.exe	realsvc.exe	143537 bytes
32	photo_id.exe	photo_id.exe	27755 bytes
33	nl4.exe	nl4.exe	668160 bytes
34	Lxh.exe	Lxh.exe	169472 bytes
35	kylo.exe	kylo.exe	116736 bytes
36	ope2314.exe	ope2314.exe	401920 bytes
37	wirepots.exe	wirepots.exe	8704 bytes
38	fechme.exe	fechme.exe	32768 bytes
39	cajiw.exe	cajiw.exe	557056 bytes
40	winlo.exe	winlo.exe	1220215 bytes
41	kulo.exe	kulo.exe	118850 bytes
42	207163515.exe	207163515.exe	892416 bytes
43	sdasda.exe	sdasda.exe	66560 bytes
44	xoipk.exe	xoipk.exe	142848 bytes
45	ree1.exe	ree1.exe	646656 bytes
46	xipr.exe	xipr.exe	184848 bytes
47	nl3.exe	nl3.exe	1891840 bytes
48	beipq.exe	beipq.exe	169472 bytes
49	Warn Support.exe	Warn Support.exe	704512 bytes
50	hnwqrys.exe	hnwqrys.exe	368896 bytes
51	ufdsvc.exe	ufdsvc.exe	69632 bytes
52	caese.exe	caese.exe	116736 bytes
53	ree2.exe	ree2.exe	748032 bytes
54	aztmgyr.exe	aztmgyr.exe	503808 bytes
55	nl2.exe	nl2.exe	1918976 bytes
56	rexsvc32.exe	rexsvc32.exe	1735854 bytes
57	poqii.exe	poqii.exe	147445 bytes
58	nl6.exe	nl6.exe	1453056 bytes
59	irxoe.exe	irxoe.exe	116736 bytes
60	baka6.exe	baka6.exe	144384 bytes
61	stuvwxy.exe	stuvwxy.exe
62	roam five.exe	roam five.exe	700416 bytes
63	ptidle.exe	ptidle.exe	56832 bytes

Registry Modifications:

The following Registry Keys were created:

\YUR8.exe
SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE gi985993737
\YUR12E.exe
software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad tfnslopk
\VIE2F.exe
\YUR130.exe
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run servises
\YUR2B.exe
\YURE.exe
ptidle
Captcha5
\YUR10.exe
\YUR18.exe
SOFTWARE\Microsoft\Internet Explorer\Toolbar {8E21DC20-6E4E-42B3-9796-244EC9385CEF}
\YURC.exe
SOFTWARE\Microsoft\Internet Explorer\Toolbar {57776700-7BC8-47AC-B43E-99C24B015570}
Software\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler {B2BA40A2-74F0-42BD-F434-12345A2C8953}
\YUR12F.exe
Software\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler {0ba3e00d-b660-46e6-a2db-2672ee82dc98}
xydzyh
Somefox
\YUR4.exe
\VIE5.exe
Microsoft\Windows NT\CurrentVersion\Winlogon\Notify ssqPhEVM
\VIE2.exe
%windir%\system32\kdswe.exe
\VIE14.exe
{78B578D7-BCE1-4d83-9CD4-195BC34D8CB3}
\Win12.exe
Software\Microsoft\Windows\CurrentVersion kdid
bone thunk axis copy
SmartMon
lljyn_df
Software\Microsoft\Windows\CurrentVersion kdmsh.exe
Software\Microsoft\Internet Explorer\Explorer Bars {C2EC2654-52F0-3E63-9017-D0FA8FA79271}
SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad fdxbameg
{3BCF8450-D134-427E-AE9C-2A42CE8215CC}
\YUR9.exe
\YUR20.exe
C:\WINDOWS\System32\kdwls.exe
Microsoft\Windows NT\CurrentVersion\Winlogon\Notify cxqmyibm
Sys3.exe
C:\WINDOWS\System32\kdmsh.exe
GetPack21
\YURA.exe
\YUR5.exe
\YUR15.exe
FixCamera
Software\Microsoft\Internet Explorer\Explorer Bars {EB9539EB-598E-BCA7-3D4A-82F4F26E9738}
{0389E53C-62CF-4CD6-9F4E-955A740E4385}
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run andfor
SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad rwlfsdmk
memo site kind that
{157627A6-2A10-4aa1-B97F-90B8DC6F24AC}
Sys2.exe
GetPack19
F5JMWNZTHI
ROAD ITCH AMOK PING
{E4785213-3EFE-4c26-A9B4-332440E31F6F}
hlpproc
\VIE3.exe
Software\Microsoft\Internet Explorer\Explorer Bars {FCDEE81D-95A3-AE8A-D4FB-5A9FB8E32860}
SOFTWARE\Microsoft\Internet Explorer\Toolbar {3B4EFB6A-06FD-40AC-B072-1FB7D1D456E8}
\YUR2.exe
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks {BB4C402F-882A-4526-8C08-51278EA437C1}
Microsoft\Windows NT\CurrentVersion\Winlogon\Notify __c0040F39
\YURD.exe
advap32
C:\WINDOWS\system32\kdswe.exe
515.tmp
Sys1.exe
SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad xrdwbfgn
SerialsWorld
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks {C14E6230-757D-4246-81CE-B34E2940C722}
\YUR2C.exe
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks {D3CCFAF7-DF03-4E73-95EC-E5E139CC2BF2}
software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad xokvrpwg
{4D4DB474-8435-4FA1-8D91-512C0CE1E931}
\YURB.exe
Cognac
SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run xqe6lJLnN1
\Win14.exe
\Win13.exe
\YUR14.exe
Long Internet Team Stupid
Online Alert Manager
Facegame
{09E23F2C-ED1E-43FC-9AA1-1332162A35AE}
Software\Microsoft\Internet Explorer\Explorer Bars {9CDB6E2A-B859-45BB-8F05-AF684301AB41}
SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad fsrpknov
%windir%\System32\kdwls.exe
Sys4.exe
\Win11.exe
\YUR3.exe
Software\Microsoft\Windows\CurrentVersion kdksc.exe
\YUR6.exe
cokx
Microsoft\Windows NT\CurrentVersion\Winlogon\Notify nnnkiGvV
\YUR131.exe
vmdetdhc.exe
\YUR11.exe
\YUR12.exe
\YUR1.exe
\Win10.exe
penis.exe
cont_mxlivemedia
\YUR2A.exe
\YUR2D.exe
\YUR30.exe
\YUR13.exe
BIND SUPPORT SEEK FIRST
%windir%\System32\kdmsh.exe
\YURF.exe

Trojan Generic Removal Guide

Recently Active Threats

New Threats

Recently Active Trojans