Quantcast
Channel: How to Remove Malware
Viewing all articles
Browse latest Browse all 38585

MSWORKS.EXE is Trojan Rincux.AW

$
0
0

The file MSWORKS.EXE is identified as a virus dropper.
The dropper MSWORKS.EXE is used for downloading and installing other malware, Trojans, viruses by the commands received from the Command Center.
The file MSWORKS.EXE loads into the computer memory and tries to connect to the dangerous web site.
Usually the MSWORKS.EXE dropper does not infect the files on the computer and does not replicate itself on other computers.
Kill the MSWORKS.EXE process and delete the file MSWORKS.EXE.

Malware Analysis of MSWORKS.EXE
Full path on a computer: %SysDir%\MSWorks.exe

Detected by UnHackMe:

MSWORKS.EXE
Default location: %SysDir%\MSWorks.exe

Removal Results: Success
Number of reboot: 1

MSWORKS.EXE is known as:

Trojan.Rincux.AW, Trojan.ServStart, RDN.Downloader.a.oe, Posible_Worm32, Trojan ( 0000000c1 ), Trojan.Behav024.cqnath, ServStart.E, Trojan.Rincux.6eTHaLrCGqs, DLOADER.Trojan, BehavesLike.Malware.ssc (mx-v), Mal.Behav-024, Troj.Undef.(kcloud), Trojan.Downloader, W32.GenBl.A1250DC3.Olympus, BScope.Trojan.Inject.2, Trojan.Rozena, Malware_fam.NB, Rozena

MSWORKS.EXE hash:

  • MD5: a1250dc31e01bcf3520b88b253426b58
How to quickly detect MSWORKS.EXE presence?
Registry:
  • HKLM\System\CurrentControlSet\Services\MSMinerWorks64\ImagePath: “%SysDir%\MSWorks.exe”
  • HKLM\System\CurrentControlSet\Services\MSMinerWorks64\DisplayName: “MSMinerWorks Helper System”
  • HKLM\System\CurrentControlSet\Services\MSMinerWorks64\Description: “MSMinerWorks64 Helper System for X64 windows desktop”
Files:
  • %SysDir%\MSWorks.exe


Viewing all articles
Browse latest Browse all 38585

Trending Articles