Dmitry Sokolov recommends UnHackMe!

UnHackMe is a powerful tool against malware.

UnHackMe quickly removes rootkits/malware/adware/browser hijack issues!

Alex NightWatcher: Solved! (5 / 5)

Adware.GenericKD.4163570 (B) also known as Adware.GenericKD.4163570, ADWARE/ShandaAdd.pfyzg, Win32:Adware-gen [Adw].

Malware Analysis of Adware.GenericKD.4163570 (B) – HAOTUMODIFY.EXE

Created files:

%LOCAL APPDATA%\HAOTUKANKAN\FREEIMAGE.DLL
%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE
%LOCAL APPDATA%\HAOTUKANKAN\HAOTUMODIFY.EXE
%LOCAL APPDATA%\HAOTUKANKAN\ICONS\BMP.ICO
%LOCAL APPDATA%\HAOTUKANKAN\ICONS\GIF.ICO

Autostart registry keys:

HKLM\SOFTWARE\CLASSES\CLSID\{1A7B0538-FD28-48A0-BB8B-DE3E04DF94C2}\INPROCSERVER32\: “%LOCAL APPDATA%\HAOTUKANKAN\CONTEXTMENU32.DLL”
HKLM\SOFTWARE\CLASSES\CLSID\{79BEF29B-2700-4D41-BE42-6EBA8A889D29}\INPROCSERVER32\: “%LOCAL APPDATA%\HAOTUKANKAN\CONTEXTMENU32.DLL”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.3FR\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.BMP\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.CUT\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.DDS\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.EXR\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.G3\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.GIF\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.HDP\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.HDR\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.ICO\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.IFF\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.J2K\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.JNG\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.JP2\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.JPEG\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.JPG\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.JXR\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.KOA\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.MNG\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.PBM\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.PCD\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.PCT\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.PCX\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.PFM\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.PGM\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.PNG\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.PPM\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.PSD\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.RAS\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.SGI\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.TGA\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.TIF\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.TIFF\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.WAP\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.WEBP\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.XBM\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.XPM\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{01EB3F15-6569-4FCD-A1AA-913E906E2194}\DisplayName: “????”
HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{01EB3F15-6569-4FCD-A1AA-913E906E2194}\UNINSTALLSTRING: “%LOCAL APPDATA%\HAOTUKANKAN\UNINSTALL.EXE”

Detected by UnHackMe:

HAOTUMODIFY.EXE
DEFAULT LOCATION: %LOCAL APPDATA%\HAOTUKANKAN\HAOTUMODIFY.EXE

Dropper hash(md5): ab2529e0a8a399f7b8af6dd2fe638948

Written by NightWatcher

Malware Hunter.
Google+

UnHackMe removes malware invisible for your antivirus!

UnHackMe is compatible with most antivirus software.
UnHackMe is 100% CLEAN, which means it does not contain any form of malware, including adware, spyware, viruses, trojans and backdoors. VirusTotal (0/56).
System Requirements: Windows 2000-Windows 8.1/10. UnHackMe uses minimum of computer resources.