Adware/Agent.asar

Dmitry Sokolov recommends UnHackMe!

UnHackMe is a powerful tool against malware.

UnHackMe quickly removes rootkits/malware/adware/browser hijack issues!

: Solved! 5 Stars (5 / 5)

Adware/Agent.asar also known as Gen:Variant.Adware.Graftor.211510, Trojan.Adware.Graftor.D33A36, PE:Packer.Win32.Crypt.ej!1075357707.

Malware Analysis of Adware/Agent.asar – EXKY0NBI7N6ATL.DLL

Created files:

%Common Appdata%\{429e22ba-f152-4140-429e-e22baf158aeb}\8039cc991c7f44c3d8a0b3beb14d7ff5e91a33ea9bde1017238687201f0bcd0b.exe
%Program Files%\bestadblocker\Exky0nBI7n6atl.dat
%Program Files%\bestadblocker\Exky0nBI7n6atl.dll
%Program Files%\bestadblocker\Exky0nBI7n6atl.exe
%Program Files%\bestadblocker\Exky0nBI7n6atl.tlb

Autostart registry keys:

HKLM\Software\Classes\CLSID\{1529CF20-A071-4486-AF8E-FA91FF896DCA}\InprocServer32\: “%Program Files%\bestadblocker\Exky0nBI7n6atl.dll”
HKLM\Software\Classes\CLSID\{FE7CE8CC-153C-4D14-A8B8-291828AA6D81}\InprocServer32\: “%Program Files%\CutThePrice\4ptsdYtwWNfvGu.dll”
HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}\DisplayName: “mystartsearch”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}{7eb8d2f6}\UninstallString: “”%SysDir%\RUNDLL32.EXE” “C:\PROGRA~1\INDEPT~1\INDEPT~1.DLL”,_uninstall /un”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}{7eb8d2f6}\DisplayName: “ZeniTech”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{4820778D-AB0D-6D18-C316-52A6A0E1D507}\DisplayName: “bestadblocker”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{4820778D-AB0D-6D18-C316-52A6A0E1D507}\UninstallString: “”%Program Files%\bestadblocker\Exky0nBI7n6atl.exe” /s /n /i:”ExecuteCommands;UninstallCommands” “””
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{A2C98B47-B5F4-94AA-281D-4135416774CF}\DisplayName: “CutThePrice”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{A2C98B47-B5F4-94AA-281D-4135416774CF}\UninstallString: “”%Program Files%\CutThePrice\4ptsdYtwWNfvGu.exe” /s /n /i:”ExecuteCommands;UninstallCommands” “””
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{AD11DADE-C597-45D9-D8C5-1D2EB0B89613}\DisplayName: “MusixLib”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{AD11DADE-C597-45D9-D8C5-1D2EB0B89613}\UninstallString: “”%Program Files%\MusixLib\MusixLib.exe” /s /n /i:”ExecuteCommands;UninstallCommands” “””
HKLM\System\CurrentControlSet\Services\7eb8d2f6\ImagePath: “”%SysDir%\rundll32.exe” “c:\Program Files\IndepthProc\IndepthProc.dll”,serv”
HKLM\System\CurrentControlSet\Services\7eb8d2f6\DisplayName: “IndepthProc”
HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}\DisplayName: “mystartsearch”

Detected by UnHackMe:

EXKY0NBI7N6ATL.DLL
Default location: %PROGRAM FILES%\BESTADBLOCKER\EXKY0NBI7N6ATL.DLL

Dropper hash(md5): 0785b6518baca9c3c61a28a9e60cae57

Written by 

Malware Hunter.

UnHackMe removes malware invisible for your antivirus!

Free Download

1
UnHackMe is compatible with most antivirus software.
UnHackMe is 100% CLEAN, which means it does not contain any form of malware, including adware, spyware, viruses, trojans and backdoors. VirusTotal (0/56).
System Requirements: Windows 2000-Windows 8.1/10. UnHackMe uses minimum of computer resources.

WordPress SEO fine-tune by Meta SEO Pack from Poradnik Webmastera