The file FQ6FWO1.EXE can destroy your system, thus making the computer to work abnormally.
FQ6FWO1.EXE is a dangerous file.
RemoveFQ6FWO1.EXE from your computer immediately.
Kill the process FQ6FWO1.EXE and remove FQ6FWO1.EXE from the Windows startup.
Malware Analysis of FQ6FWO1.EXE
Full path on a computer: C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-3456620\fq6fwo1.exe
Detected by UnHackMe:
Item Name: shell
Author: Unknown
Related File: explorer.exe,C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-3456620\fq6fwo1.exe
Type: User Shell
Item Name: taskman
Author: Unknown
Related File: C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-3456620\FQ6FWO1.EXE
Type: Winlogon System
Item Name: fqf6wo1
Author:
Current Setting: C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-3456620\FQ6FWO1.EXE
Type: Registry Run
Removal Results: Success
Number of reboot: 1
FQ6FWO1.EXE is known as:
Trojan.Gurl, W32.Trojan2.NWBR, Ircbrute.GX, Win32.Lethic.THCJaN, Trojan.Injector.XWZZ9oRWCPQ, Trojan.Agent.Gen-Dropper, Troj.Agent-AAXV, TrojWare.Injector.BGJ, BackDoor.Gurl.2, Trojan.Agent.aaxv (v), Backdoor.Azbreg.bqi, Worm[Net].Kolab, Trojan.Lethic.B, Worm.Net-Kolab.68231, W32.Trojan.WLUI-7811, Trojan.HmBlocker, BScope.Backdoor.IRCBot.2122, Win32.Injector.AEJX, Trojan.Ircbrute, W32.Injector.AEJX.tr, Trj.Zbot.M
FQ6FWO1.EXE hash:
- MD5: aef8da99d827178367b56808194f5159
Registry:- HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman: “C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-3456620\fq6fwo1.exe”
- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\fqf6wo1: “C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-3456620\fq6fwo1.exe”
- HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell: “explorer.exe,C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-3456620\fq6fwo1.exe”
Folders:- C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-3456620
Files:- C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-3456620\Desktop.ini
- C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-3456620\fq6fwo1.exe