W64.HfsAdware.90C9

Dmitry Sokolov recommends UnHackMe!

UnHackMe is a powerful tool against malware.

UnHackMe quickly removes rootkits/malware/adware/browser hijack issues!

: Solved! 5 Stars (5 / 5)

W64.HfsAdware.90C9 also known as Elex Installer (fs), FraudTool.YAC.

Malware Analysis of W64.HfsAdware.90C9 – IDSKDLLPATCH64.DLL

Created files:

%Program Files%\Elex-tech\YAC\iCommu.dll
%Program Files%\Elex-tech\YAC\iDskDllPatch.dll
%Program Files%\Elex-tech\YAC\iDskDllPatch64.dll
%Program Files%\Elex-tech\YAC\iImportLib.dll
%Program Files%\Elex-tech\YAC\install3.inst

Autostart registry keys:

HKLM\Software\Classes\CLSID\{5411D116-5A37-47D4-B154-5F7FCD9062F0}\InprocServer32\: “%Program Files%\Elex-tech\YAC\iSafeRKScanShell.dll”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\iSafe\DisplayName: “YAC(Yet Another Cleaner!)”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\iSafe\UninstallString: “%Program Files%\Elex-tech\YAC\uninstall.exe”
HKLM\System\CurrentControlSet\Services\iSafeKrnl\ImagePath: “\??\%Program Files%\Elex-tech\YAC\iSafeKrnl.sys”
HKLM\System\CurrentControlSet\Services\iSafeKrnl\DisplayName: “YAC Mini-Filter Driver”
HKLM\System\CurrentControlSet\Services\iSafeKrnlBoot\ImagePath: “system32\DRIVERS\iSafeKrnlBoot.sys”
HKLM\System\CurrentControlSet\Services\iSafeKrnlBoot\DisplayName: “YAC Boot Driver”
HKLM\System\CurrentControlSet\Services\iSafeKrnlKit\ImagePath: “\??\%Program Files%\Elex-tech\YAC\iSafeKrnlKit.sys”
HKLM\System\CurrentControlSet\Services\iSafeKrnlKit\DisplayName: “YAC Kit Driver”
HKLM\System\CurrentControlSet\Services\iSafeKrnlMon\ImagePath: “\??\%Program Files%\Elex-tech\YAC\iSafeKrnlMon.sys”
HKLM\System\CurrentControlSet\Services\iSafeKrnlMon\DisplayName: “YAC Monitor Driver”
HKLM\System\CurrentControlSet\Services\iSafeKrnlR3\ImagePath: “\??\%Program Files%\Elex-tech\YAC\iSafeKrnlR3.sys”
HKLM\System\CurrentControlSet\Services\iSafeKrnlR3\DisplayName: “YAC Ring3 Driver”
HKLM\System\CurrentControlSet\Services\iSafeNetFilter\ImagePath: “system32\DRIVERS\iSafeNetFilter.sys”
HKLM\System\CurrentControlSet\Services\iSafeNetFilter\DisplayName: “YAC NDIS Driver”
HKLM\System\CurrentControlSet\Services\iSafeService\ImagePath: “%Program Files%\Elex-tech\YAC\iSafeSvc.exe”
HKLM\System\CurrentControlSet\Services\iSafeService\DisplayName: “YAC Service”
HKLM\Software\Clients\StartMenuInternet\VMWAREHOSTOPEN.EXE\shell\open\command\: “”c:\program files\vmware\vmware tools\vmwarehostopen.exe””

Detected by UnHackMe:

IDSKDLLPATCH64.DLL
Default location: %PROGRAM FILES%\ELEX-TECH\YAC\IDSKDLLPATCH64.DLL

Dropper hash(md5): 4bc5cf1eaf404fb8bd1c0bb5ba1dcc13

Written by 

Malware Hunter.

UnHackMe removes malware invisible for your antivirus!

Free Download

1
UnHackMe is compatible with most antivirus software.
UnHackMe is 100% CLEAN, which means it does not contain any form of malware, including adware, spyware, viruses, trojans and backdoors. VirusTotal (0/56).
System Requirements: Windows 2000-Windows 8.1/10. UnHackMe uses minimum of computer resources.

WordPress SEO fine-tune by Meta SEO Pack from Poradnik Webmastera