View Single Post
Old 11-17-2011   #5
Skyline-leo
Member
 
Join Date: Nov 2011
Posts: 102
Likes: 2
Liked 5 Times in 5 Posts
Mentioned: 2 Post(s)
Tagged: 0 Thread(s)
This is a crypted file with crypter .net for this use vbc.exe! (famework 2.0)

so, is only a variant..

if you have windows XP

delete file from:
c:\windows\system32\Windir\svchost.exe (this is a trojan installed)

if you have windows 7:
delete file from:
C:\Users\[YOUR NAME]\AppData\Roaming\WinDir\ <<this folder is HIDDEN for user!!!!
Skyline-leo is offline