Quantcast
Channel: How to Remove Malware
Viewing all articles
Browse latest Browse all 38585

SVC.EXE is Trojan Malpack

$
0
0

The file SVC.EXE is identified as a virus dropper.
The dropper SVC.EXE is used for downloading and installing other malware, Trojans, viruses by the commands received from the Command Center.
The file SVC.EXE loads into the computer memory and tries to connect to the dangerous web site.
Usually the SVC.EXE dropper does not infect the files on the computer and does not replicate itself on other computers.
Kill the SVC.EXE process and delete the file SVC.EXE.

Malware Analysis of SVC.EXE
Full path on a computer: %Appdata%\DataWork\svc.exe

Detected by UnHackMe:

Item Name: sidebar
Author:
Current Setting: %APPDATA%\SAMPLE.LNK
Type: Registry RunOnce

SVC.EXE
Default location: %Appdata%\DataWork\svc.exe

Removal Results: Success
Number of reboot: 1

SVC.EXE is known as:

Trojan.Malpack, Trojan.Agent.afgwc, Tool.MailPassView.225, a variant of MSIL.Injector.CRR

SVC.EXE hash:

  • MD5: 3293d66524af8502e79c72237fc141fb
The file is used for downloading and installing other malware, Trojans, viruses by the commands received from the Command Center.
How to quickly detect SVC.EXE presence?
Registry:
  • HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce\sidebar: “%Appdata%\Sample.lnk”
Folders:
  • %Appdata%\DataWork
  • %Temp%\RarSFX0
Files:
  • %Appdata%\DataWork\svc.exe
  • %Appdata%\Sample.lnk


Viewing all articles
Browse latest Browse all 38585

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>