SYSHOST.EXE is Trojan Dropper.Necurs
The file SYSHOST.EXE is identified as a virus dropper.
The dropper SYSHOST.EXE is used for downloading and installing other malware, Trojans, viruses by the commands received from the Command Center.
The file SYSHOST.EXE loads into the computer memory and tries to connect to the dangerous web site.
Usually the SYSHOST.EXE dropper does not infect the files on the computer and does not replicate itself on other computers.
Kill the SYSHOST.EXE process and delete the file SYSHOST.EXE.
Malware Analysis of SYSHOST.EXE
Full path on a computer: %WinDir%\Installer\{5D96123B-67DD-98C3-CF93-1743AF6584F0}\syshost.exe
Detected by UnHackMe:
SYSHOST.EXE
Default location: %WinDir%\Installer\{5D96123B-67DD-98C3-CF93-1743AF6584F0}\syshost.exe
Removal Results: Success
Number of reboot: 1
SYSHOST.EXE is known as:
Trojan.Dropper.Necurs
SYSHOST.EXE hash:
- MD5: 41b0324d7733bf523e700e07df67bba7
The file tries to connect to the dangerous web site.
How to quickly detect SYSHOST.EXE presence?
Registry:
Folders:
Files:
Registry:- HKLM\System\CurrentControlSet\Services\876f\ImagePath: “\??\%SysDir%\drivers\876f.sys”
- HKLM\System\CurrentControlSet\Services\876f\DisplayName: “syshost.exe”
- HKLM\System\CurrentControlSet\Services\b365e71cdc6bdb4\ImagePath: “\SystemRoot\System32\Drivers\b365e71cdc6bdb4.sys”
- HKLM\System\CurrentControlSet\Services\b365e71cdc6bdb4\Group: “Boot Bus Extender”
- HKLM\System\CurrentControlSet\Services\b365e71cdc6bdb4\DisplayName: “syshost.exe”
- HKLM\System\CurrentControlSet\Services\syshost32\ImagePath: “”%WinDir%\Installer\{5D96123B-67DD-98C3-CF93-1743AF6584F0}\syshost.exe” /service”
Folders:- %WinDir%\Installer\{5D96123B-67DD-98C3-CF93-1743AF6584F0}
- %WinDir%\pchealth\ERRORREP\UserDumps
- %WinDir%\Minidump
Files:- %WinDir%\Installer\{5D96123B-67DD-98C3-CF93-1743AF6584F0}\syshost.exe
- %WinDir%\pchealth\ERRORREP\UserDumps\csrss.exe.20120829-211354-00.hdmp
- %WinDir%\pchealth\ERRORREP\UserDumps\csrss.exe.20120829-211354-00.mdmp
- %WinDir%\pchealth\ERRORREP\UserDumps\csrss.exe.20120829-211425-00.hdmp
- %WinDir%\pchealth\ERRORREP\UserDumps\csrss.exe.20120829-211425-00.mdmp
- %WinDir%\pchealth\ERRORREP\UserDumps\csrss.exe.20120829-211537-00.hdmp
- %WinDir%\pchealth\ERRORREP\UserDumps\csrss.exe.20120829-211537-00.mdmp
- %WinDir%\pchealth\ERRORREP\UserDumps\csrss.exe.20120829-211612-00.hdmp
- %WinDir%\pchealth\ERRORREP\UserDumps\csrss.exe.20120829-211612-00.mdmp
- %WinDir%\pchealth\ERRORREP\UserDumps\csrss.exe.20120829-211855-00.mdmp
- %SysDir%\drivers\b365e71cdc6bdb4.sys
- %WinDir%\DUMP412f.tmp
- %WinDir%\Minidump\Mini083012-01.dmp
- %WinDir%\Minidump\Mini083012-02.dmp
- %WinDir%\Minidump\Mini083012-03.dmp
- %WinDir%\Minidump\Mini083012-04.dmp
Recommended: UnHackMe anti-rootkit and anti-malware
Premium software: RegRun Security Suite (Good choice for removal and protection)
