About wincup.exe and aukld.exe

I analyzed C: WINDOWSwincupwincup.exe a few days ago... two days later, I ran a folder with the same name .. the path is C: WINDOWSTempwincupwincup.exe and C: WINDOWSTempaukldaukld.exe. Kabbah reported two days ago .. rising seems to have reported it yesterday .. virus name: Trojan. DL. adload. io and Trojan. DL. adload. ip...
There are more people asking for help in the past two days. Today, we will analyze the samples ..

Run wincup.exe... to release the files aucup and extern. ini... and ~ De5.tmp (the numbers in the file name are different) .. create the O23-NT Service: aucup-Unknown owner-C: WINDOWSTempwincupwincup.exe... access the network ..

Run aukld.exe .. to release the inskld and ~ files ~ De5.tmp (the numbers in the file will be different)... create the O23-NT Service: aukld-Unknown owner-C: WINDOWSTempaukldaukld.exe... access the network ..

After accessing the network... download the 021 item of WinKalendar... HijackThis will be reflected... O21-SSODL: SysTime-{724C75F1-B757-408D-A50A-4CF99DA35D73}-C: PROGRA ~ 1WinKldWinKld. dll... this item may or may not appear...

[Solution]
End Process
C: WINDOWSwincupwincup.exe (this may occur in both of my tests ..)

Start-control panel-add and delete programs
Uninstall WinKalendar, winwrcup, vision communicate... (some will not ..)

Start-control panel-management tools-Service
Disable the aucup, aukld, WinWrCup, and JMediaService services. (Some services do not exist ..)

Start-run-regedit
Registry
Expand
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServices
HKEY_LOCAL_MACHINESYSTEMControlSet001Services
HKEY_LOCAL_MACHINESYSTEMControlSet002Services
Delete the Four folders aucup, aukld, JMediaService, and WinWrCup... (check these three folders carefully... some of them do not ..)

Expand
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetEnumRoot
HKEY_LOCAL_MACHINESYSTEMControlSet001EnumRoot
HKEY_LOCAL_MACHINESYSTEMControlSet002EnumRoot
Delete the Four folders LEGACY_AUKLD, LEGACY_AUCUP, LEGACY_JMEDIASERVICE, and LEGACY_WINWRCUP... (same as above... you must use Icesword to delete it ..)

Expand
HKEY_CLASSES_ROOTCLSID
Delete the {724C75F1-B757-408D-A50A-4CF99DA35D73} folder... (this may not exist ..)

Delete after restart ..
C: WINDOWSTempwincup
C: WINDOWSTempaukld
C: PROGRA ~ 1 WinKld
C: windowstempinskld(the folder contains a. EXE file that is stored at the same time)
C: windowstempinscup(the folder contains a. EXE file that is stored at the same time)
C: WINDOWSwincup
------------------------------------------------------------------------
You must use Icesword to delete the registry ..
: Http://forum.ikaka.com/topic.asp? Board = 28 & artid = 6979213 (second floor)
------------------------------------------------------------------------

When these two files access the network, the C: PROGRA ~ will not be generated if the firewall is blocked ~ 1 WinKld ..

------------------------------------------------------------------------
These two files are related to C: WINDOWSwincupwincup.exe... and MMS assistant...
We recommend that you uninstall it in Super Rabbit Cleanup mode after processing...
Super Rabbit: http://www.pctutu.com/srmsdown.asp

C: WINDOWSwincupwincup.exe for details: http://forum.ikaka.com/topic.asp? Board = 28 & artid = 8120559
-------------------------------------------------------------------------
Thank you for adding newcenturymoon ..
Add: C: PROGRA ~ 1. WinKld is Microsoft's calendar. If you need a friend, You Don't Have To uninstall it...