Remove from registry
he following registry keys are added in order to load the service after reboot:
– [HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CLIPBOARD]
• "NextInstance"=dword:00000001
– [HKLM\SYSTEM\CurrentControlSet\Services\ClipBoard\Security]
• "Security"=%hex values%
– [HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CLIPBOARD\0000]
• "Service"="ClipBoard"
"Legacy"=dword:00000001
"ConfigFlags"=dword:00000000
"Class"="LegacyDriver"
"ClassGUID"="{8ECC055D-047F-11D1-A537-0000F8753ED1}"
"DeviceDesc"="ClipBoard"
– [HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CLIPBOARD\0000\
Control]
• "*NewlyCreated*"=dword:00000000
"ActiveService"="ClipBoard"
– [HKLM\SYSTEM\CurrentControlSet\Services\ClipBoard]
• "Type"=dword:00000010
"Start"=dword:00000002
"ErrorControl"=dword:00000001
"ImagePath"="%SYSDIR%\LoadPlugin.exe"
"DisplayName"="ClipBoard"
"ObjectName"="LocalSystem"
– [HKLM\SYSTEM\CurrentControlSet\Services\ClipBoard\Enum]
• "0"="Root\\LEGACY_CLIPBOARD\\0000"
"Count"=dword:00000001
"NextInstance"=dword:00000001
Deleted files
– %SYSDIR%\_LoadPlugin.exe Further investigation pointed out that this file is malware, too. Detected as: TR/Delphi.Downloader.Gen
– %SYSDIR%\LoadPlugin.exe Furthermore it gets executed after it was fully created. Further investigation pointed out that this file is malware, too. Detected as: TR/Delphi.Downloader.Gen
