Adware.Mutabaha.537

Dmitry Sokolov recommends UnHackMe!

UnHackMe is a powerful tool against malware.

UnHackMe quickly removes rootkits/malware/adware/browser hijack issues!

: Solved! 5 Stars (5 / 5)

Adware.Mutabaha.537 also known as FraudTool.YAC, Win32.Application.Elex.O.

Malware Analysis of Adware.Mutabaha.537 – ISAFEENGINEDISP.DLL

Created files:

%Program Files%\Elex-tech\YAC\iSafeDisp.dll
%Program Files%\Elex-tech\YAC\iSafeEngineBase.dll
%Program Files%\Elex-tech\YAC\iSafeEngineDisp.dll
%Program Files%\Elex-tech\YAC\iSafeKrnl.sys
%Program Files%\Elex-tech\YAC\iSafeKrnlBoot.sys

Autostart registry keys:

HKLM\Software\Classes\CLSID\{5411D116-5A37-47D4-B154-5F7FCD9062F0}\InprocServer32\: “%Program Files%\Elex-tech\YAC\iSafeRKScanShell.dll”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\iSafe\DisplayName: “YAC(Yet Another Cleaner!)”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\iSafe\UninstallString: “%Program Files%\Elex-tech\YAC\uninstall.exe”
HKLM\System\CurrentControlSet\Services\iSafeKrnl\ImagePath: “\??\%Program Files%\Elex-tech\YAC\iSafeKrnl.sys”
HKLM\System\CurrentControlSet\Services\iSafeKrnl\DisplayName: “YAC Mini-Filter Driver”
HKLM\System\CurrentControlSet\Services\iSafeKrnlBoot\ImagePath: “system32\DRIVERS\iSafeKrnlBoot.sys”
HKLM\System\CurrentControlSet\Services\iSafeKrnlBoot\DisplayName: “YAC Boot Driver”
HKLM\System\CurrentControlSet\Services\iSafeKrnlKit\ImagePath: “\??\%Program Files%\Elex-tech\YAC\iSafeKrnlKit.sys”
HKLM\System\CurrentControlSet\Services\iSafeKrnlKit\DisplayName: “YAC Kit Driver”
HKLM\System\CurrentControlSet\Services\iSafeKrnlMon\ImagePath: “\??\%Program Files%\Elex-tech\YAC\iSafeKrnlMon.sys”
HKLM\System\CurrentControlSet\Services\iSafeKrnlMon\DisplayName: “YAC Monitor Driver”
HKLM\System\CurrentControlSet\Services\iSafeKrnlR3\ImagePath: “\??\%Program Files%\Elex-tech\YAC\iSafeKrnlR3.sys”
HKLM\System\CurrentControlSet\Services\iSafeKrnlR3\DisplayName: “YAC Ring3 Driver”
HKLM\System\CurrentControlSet\Services\iSafeNetFilter\ImagePath: “system32\DRIVERS\iSafeNetFilter.sys”
HKLM\System\CurrentControlSet\Services\iSafeNetFilter\DisplayName: “YAC NDIS Driver”
HKLM\System\CurrentControlSet\Services\iSafeService\ImagePath: “%Program Files%\Elex-tech\YAC\iSafeSvc.exe”
HKLM\System\CurrentControlSet\Services\iSafeService\DisplayName: “YAC Service”
HKLM\Software\Clients\StartMenuInternet\VMWAREHOSTOPEN.EXE\shell\open\command\: “”c:\program files\vmware\vmware tools\vmwarehostopen.exe””

Detected by UnHackMe:

ISAFEENGINEDISP.DLL
Default location: %PROGRAM FILES%\ELEX-TECH\YAC\ISAFEENGINEDISP.DLL

Dropper hash(md5): 4bc5cf1eaf404fb8bd1c0bb5ba1dcc13

Written by 

Malware Hunter.

UnHackMe removes malware invisible for your antivirus!

Free Download

1
UnHackMe is compatible with most antivirus software.
UnHackMe is 100% CLEAN, which means it does not contain any form of malware, including adware, spyware, viruses, trojans and backdoors. VirusTotal (0/56).
System Requirements: Windows 2000-Windows 8.1/10. UnHackMe uses minimum of computer resources.

WordPress SEO fine-tune by Meta SEO Pack from Poradnik Webmastera