The file 1234901.EXE is a computer worm.
The worm 1234901.EXE is a self-replicating malicious program,
which uses a computer network to send copies of itself to other computers.
You must fix the 1234901.EXE problem as soon as possible!
Delete the file 1234901.EXE from all infected computers in your network.
Set up your network firewall against 1234901.EXE intervention.
Malware Analysis of 1234901.EXE
Full path on a computer: C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-12359896\1234901.exe
Detected by UnHackMe:
1234901.EXE
Default location: C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-12359896\1234901.exe
Removal Results: Success
Number of reboot: 1
1234901.EXE is known as:
Worm.Net-Kolab, W32.Trojan.WLUI-7811, BScope.Backdoor.IRCBot.2122, Win32.Lethic.AA, Trojan.Ircbrute, W32.Injector.AEJX.tr, Trj.Zbot.M, Win32.Trojan.29e
1234901.EXE hash:
- MD5: e66b6c307e48dc3541a411f9456108e8
How to quickly detect 1234901.EXE presence?
![]( "Registry")
Registry:
![]( "Folders")
Folders:
![]( "Files")
Files:
Registry:- HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman: “C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-12359896\1234901.exe”
- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\1234901: “C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-12359896\1234901.exe”
- HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell: “explorer.exe,C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-12359896\1234901.exe”
Folders:- C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-12359896
Files:- C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-12359896\1234901.exe
- C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-12359896\Desktop.ini