trojan.win32.mupad.a

trojan.win32.mupad.a also known as Adware.Agent, W32/S-38b4d92a!Eldorado, Adware.Agent. Malware Analysis of trojan.win32.mupad.a – WAGVEM.EXE Created files: %TEMP%FOLDER\NORROCHULAG\SSL3.DLL %APPDATA%\XIDKEPBODKUL\NAJDOM.DIN %APPDATA%\XIDKEPBODKUL\WAGVEM.EXE Detected by UnHackMe: WAGVEM.EXE DEFAULT LOCATION: %APPDATA%\XIDKEPBODKUL\WAGVEM.EXE Dropper hash(md5): d85a345db352d1ca9dc43d0398b9f668 UnHackMe removes malware invisible for your antivirus! UnHackMe is compatible with most antivirus software. UnHackMe is 100% CLEAN, which means it does not contain any form of…

Continue reading

PUP.Optional.Solvusoft

PUP.Optional.Solvusoft also known as W32.HfsAdware.D686, Program.Unwanted.952. Malware Analysis of PUP.Optional.Solvusoft – DRIVERDOC.EXE Created files: %Program Files%\Solvusoft\DriverDoc\DPInst32.exe %Program Files%\Solvusoft\DriverDoc\DPInst64.exe %Program Files%\Solvusoft\DriverDoc\DriverDoc.exe %Program Files%\Solvusoft\DriverDoc\DriverHiveEngine.dll %Program Files%\Solvusoft\DriverDoc\Html\about_lightbox.html Autostart registry keys: HKLM\Software\Classes\Applications\DriverDocSetup.exe\IsHostApp: “” HKLM\Software\Classes\Applications\EULA.rtf\NoStartPage: “” HKLM\Software\Classes\Applications\LogFilesCollector.exe\NoStartPage: “” HKLM\Software\Classes\Applications\Setup_DriverDoc_2016.exe\IsHostApp: “” HKLM\Software\Classes\Applications\ShortcutLauncher.exe\NoStartPage: “” HKLM\Software\Classes\Applications\SolvusoftTray.exe\NoStartPage: “” HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\0570A0D4430B8FD479ED621F12A22CFF\InstallProperties\DisplayName: “DriverDoc” HKLM\Software\Microsoft\Windows\CurrentVersion\Run\CommonToolkitTray_Solvusoft: “%Program Files%\Solvusoft\Tray\SolvusoftTray.exe” HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\DriverDoc\DisplayName: “DriverDoc” HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DRIVERDOC\UNINSTALLSTRING: “”%COMMON APPDATA%\{0897014C-63E3-47DF-8A5F-4399CC5D61B9}\DRIVERDOCSETUP.EXE” REMOVE=TRUE MODIFY=FALSE” HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{4D0A0750-B034-4DF8-97DE-26F1212AC2FF}\DisplayName: “DriverDoc” HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{4D0A0750-B034-4DF8-97DE-26F1212AC2FF}\UNINSTALLSTRING: “%COMMON…

Continue reading

Win32/Heim

Win32/Heim also known as Artemis!A0C36E20081B, Win32.SuspectCrc, Suspicious.Cloud.5. Malware Analysis of Win32/Heim – SESSIONSTORE.EXE Created files: %Appdata%\Adobe\Flash Player\AssetCache\sessionstore.exe %Appdata%\Adobe\Flash Player\AssetCache\sessionstore.osv %Appdata%\Adobe\Flash Player\AssetCache\Transfer.tmp %Local Appdata%\Identities\{FD9F837C-5851-47A2-A9B3-B6680CCE76B7}\Microsoft\Outlook Express\Sent Items.dbx Autostart registry keys: HKCU\Software\Microsoft\Windows\CurrentVersion\Run\sessionstore.exe: “”%Appdata%\Adobe\Flash Player\AssetCache\sessionstore.exe”” Detected by UnHackMe: SESSIONSTORE.EXE Default location: %APPDATA%\ADOBE\FLASH PLAYER\ASSETCACHE\SESSIONSTORE.EXE Dropper hash(md5): a0c36e20081babf9440298ea51a87d7b UnHackMe removes malware invisible for your antivirus! UnHackMe is compatible with most antivirus…

Continue reading

Mal/KeyGen-M

Mal/KeyGen-M also known as W32/Risk.OHCW-8559, PSW.Generic7.BWBC. Malware Analysis of Mal/KeyGen-M Created files: %Program Files%\Wkarj\Ueaj\Qrpio.ini %Appdata%\Microsoft\Protect\S-1-5-21-1659004503-1708537768-1801674531-500\2b39c23a-e9aa-4695-bf8e-a733a6e2d532 %Temp%\g81\FinePrint.v6.10.x64.Incl.Keymaker-ZWT.exe %Temp%\g81\jTemp.dat %Temp%\g81\setup.ini Detected by UnHackMe: FINEPRINT.V6.10.X64.INCL.KEYMAKER-ZWT.EXE Default location: %TEMP%\G81\FINEPRINT.V6.10.X64.INCL.KEYMAKER-ZWT.EXE UnHackMe removes malware invisible for your antivirus! UnHackMe is compatible with most antivirus software. UnHackMe is 100% CLEAN, which means it does not contain any form of malware, including adware,…

Continue reading

(Solved!) How to remove GLOBAL_VBA_VBRUNTIME_F0.1E64E430_36E0_11D2_A794_0060089A724B virus FOREVER? Here is your "GLOBAL_VBA_VBRUNTIME_F0.1E64E430_36E0_11D2_A794_0060089A724B" Removal Guide

Solved! Here is GLOBAL_VBA_VBRUNTIME_F0.1E64E430_36E0_11D2_A794_0060089A724B removal guide how to quickly remove (uninstall & cleanup) GLOBAL_VBA_VBRUNTIME_F0.1E64E430_36E0_11D2_A794_0060089A724B from your computer. Follow this instruction to remove GLOBAL_VBA_VBRUNTIME_F0.1E64E430_36E0_11D2_A794_0060089A724B ads, redirect, homepage in the Google Chrome, Mozilla Firefox, Internet Explorer, Microsoft Edge.

WordPress SEO fine-tune by Meta SEO Pack from Poradnik Webmastera