Removal Instructions

If your computer has not been protected with anti-virus software and has been infected with malware, you will need to take the following actions to delete this:

  1. Delete the original trojan file (its location on the infected computer will depend on how it got onto the computer).
  2. Run a full Kaspersky Antivirus scan of the computer with updated antivirus databases (download trial version).

MD5: 0EC41D1575FCD41247ECC2F2B668F90F
SHA1: 70755C21242BA85EC2168206E4D12BD9AEE2001A


After launching, the trojan tries to delete the following files:

C:\Arquivos de Programas\Scpad\Sshib.dll
C:\Arquivos de Programas\Scpad\Scpsssh2.dll
C:\Arquivos de Programas\Scpad\Scpmib.dll
C:\Arquivos de Programas\Scpad\Scplib.dll
C:\Arquivos de Programas\Scpad\Scpibcfg.bin
C:\Arquivos de Programas\GbPlugin\isg.gpc
C:\Arquivos de Programas\GbPlugin\cef.gpc
C:\Arquivos de Programas\GbPlugin\gbieh.dll
C:\Arquivos de Programas\GbPlugin\bb.gpc
C:\Arquivos de Programas\GbPlugin\gbiehcef.dll
C:\Arquivos de Programas\GbPlugin\gbiehisg.dll
C:\Arquivos de Programas\GbPlugin\gbpdist.dll
C:\Arquivos de Programas\GbPlugin\gbieh.gmd
C:\Arquivos de Programas\GbPlugin\gbpsv.exe
C:\Program Files\Scpad\Sshib.dll
C:\Program Files\Scpad\Scpsssh2.dll
C:\Program Files\\Scpad\Scpmib.dll
C:\Program Files\Scpad\Scplib.dll
C:\Program Files\Scpad\Scpibcfg.bin
C:\Program Files\GbPlugin\isg.gpc
C:\Program Files\GbPlugin\cef.gpc
C:\Program Files\GbPlugin\bb.gpc
C:\Program Files\GbPlugin\gbieh.dll
C:\Program Files\GbPlugin\gbiehcef.dll
C:\Program Files\GbPlugin\gbiehisg.dll
C:\Program Files\GbPlugin\gbpdist.dll
C:\Program Files\GbPlugin\gbieh.gmd
C:\Program Files\GbPlugin\gbpsv.exe
C:\Arquivos de Programas\Scpad
C:\Arquivos de Programas\GbPlugin
C:\Program Files\GbPlugin

Technical Details

A trojan program designed to delete components of the security software Gbuster plugin for Internet Explorer. Implemented in the form of an NT kernel mode driver. 5632 bytes. Written in C++.