Dmitry Sokolov recommends UnHackMe!

UnHackMe is a powerful tool against malware.

UnHackMe quickly removes rootkits/malware/adware/browser hijack issues!

Alex NightWatcher: Solved! (5 / 5)

Generic PUA DJ also known as Win32:Adware-gen [Adw], MultiPlug, Adware/Agent.afoj.

Malware Analysis of Generic PUA DJ – S3H_N9CEZS.DLL

Created files:

C:\Documents and Settings\All Users\ntuser.pol
%Program Files%\SaveClicker\s3h_n9cEZS.dat
%Program Files%\SaveClicker\s3h_n9cEZS.dll
%Program Files%\SaveClicker\s3h_n9cEZS.tlb
%Program Files%\SaveClicker\s3h_n9cEZS.x64.dll

Autostart registry keys:

HKLM\Software\Classes\CLSID\{22D3EE3A-CD8F-F119-DACE-2236B08ED158}\InprocServer32\: “%Program Files%\SaveClicker\s3h_n9cEZS.dll”
HKLM\Software\Microsoft\Windows\CurrentVersion\Group Policy\History\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}\0\DisplayName: “Local Group Policy”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{E96338DC-1468-4918-8EC2-8454BFFC5025}\UninstallString: “”%Common Appdata%\SaveClicker\4Hyd1SJ85lK.exe” /s /n /i:”ExecuteCommands;UninstallCommands” “””
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{E96338DC-1468-4918-8EC2-8454BFFC5025}\DisplayName: “SaveClicker”

Detected by UnHackMe:

S3H_N9CEZS.DLL
Default location: %PROGRAM FILES%\SAVECLICKER\S3H_N9CEZS.DLL

Dropper hash(md5): 5f58a70d99af2b8886643b820eb91e14

Written by NightWatcher

Malware Hunter.
Google+

UnHackMe removes malware invisible for your antivirus!

UnHackMe is compatible with most antivirus software.
UnHackMe is 100% CLEAN, which means it does not contain any form of malware, including adware, spyware, viruses, trojans and backdoors. VirusTotal (0/56).
System Requirements: Windows 2000-Windows 8.1/10. UnHackMe uses minimum of computer resources.