HEUR/QVM11.1.Malware.Gen

Dmitry Sokolov recommends UnHackMe!

UnHackMe is a powerful tool against malware.

UnHackMe quickly removes rootkits/malware/adware/browser hijack issues!

: Solved! 5 Stars (5 / 5)

HEUR/QVM11.1.Malware.Gen also known as Riskware/HideBaid, Trojan.GenericKD.2990236 (B), BehavesLike.Win32.BadFile.cc.

Malware Analysis of HEUR/QVM11.1.Malware.Gen – DOWN2012.EXE

Created files:

%Temp%\cb4a7c06adf1b1d4d95fab8ac75b5809.tpt
%Temp%\chrome_crashes\operation_log.txt
%Temp%\down2012.exe
%Temp%\extns_248843\chrome\ckcmdpmhiekiihmfjffdehhbhgllpapg\2.21_0\background\ade.js
%Temp%\extns_248843\chrome\ckcmdpmhiekiihmfjffdehhbhgllpapg\2.21_0\background\categories.js

Autostart registry keys:

HKLM\Software\Classes\CLSID\{29B6CFD5-0064-411A-8C42-9890C83F9921}\InprocServer32\: “%Program Files%\Tencent\QQPCMgr\11.1.16923.222\npQMExtensionsIE.dll”
HKLM\Software\Classes\CLSID\{4C097DF1-0716-4FA1-84A9-025BC1E7B03F}\LocalServer32\: “”%Program Files%\Tencent\QQPCMgr\11.1.16923.222\TAOFrame.exe””
HKLM\Software\Classes\CLSID\{70DE12EA-79F4-46bc-9812-86DB50A2FD64}\LocalServer32\: “”c:\program files\common files\tencent\qqdownload\130\tencentdl.exe””
HKLM\Software\Classes\CLSID\{88260EA6-BC91-42DF-ABEF-4A683E8A3C23}\LocalServer32\: “”%Program Files%\Tencent\QQPCMgr\11.1.16923.222\TAOFrame.exe””
HKLM\Software\Classes\CLSID\{8E8F97CD-60B5-456F-A201-73065652D099}\InprocServer32\: “%Local Appdata%\Mail.Ru\Sputnik\IESearchPlugin.dll”
HKLM\Software\Classes\CLSID\{920D873D-05AB-4574-AD3A-872DD173658A}\InprocServer32\: “%Program Files%\Tencent\QQPCMgr\11.1.16923.222\UDiskShellExt.dll”
HKLM\Software\Classes\CLSID\{B7667919-3765-4815-A66D-98A09BE662D6}\InprocServer32\: “%Program Files%\Tencent\QQPCMgr\11.1.16923.222\QMGCShellExt.dll”
HKLM\Software\Classes\CLSID\{CBDECEF7-7A29-4cbf-A009-2673D82C7BF9}\InprocServer32\: “%Program Files%\Tencent\QQPCMgr\11.1.16923.222\QMContextUninstall.dll”
HKLM\Software\Classes\CLSID\{D4801E96-E7A1-45F6-B124-7A36DFB40B81}\InProcServer32\: “%Program Files%\Tencent\QQPCMgr\11.1.16923.222\QMContextUninstall.dll”
HKLM\Software\Classes\CLSID\{E52EB753-1F56-4DF7-BE53-2C314AC5F8A1}\InProcServer32\: “%Program Files%\Tencent\QQPCMgr\11.1.16923.222\QMContextScan.dll”
HKLM\Software\Classes\CLSID\{EC0FA563-E0F2-406F-8659-1E728458A91E}\LocalServer32\: “”%Program Files%\Tencent\QQPCMgr\11.1.16923.222\TAOFrame.exe””
HKLM\Software\Classes\AmigoHTML.NARYC4MAR452DWMECJZECYNNAA\shell\open\command\: “”%Local Appdata%\Amigo\Application\amigo.exe” — “%1″”
HKLM\Software\Classes\MTview.bmp\shell\open\command\: “”%Program Files%\MTV20151125\MTView.exe” “%1″”
HKLM\Software\Classes\MTview.dib\shell\open\command\: “”%Program Files%\MTV20151125\MTView.exe” “%1″”
HKLM\Software\Classes\MTview.emf\shell\open\command\: “”%Program Files%\MTV20151125\MTView.exe” “%1″”
HKLM\Software\Classes\MTview.exif\shell\open\command\: “”%Program Files%\MTV20151125\MTView.exe” “%1″”
HKLM\Software\Classes\MTview.gif\shell\open\command\: “”%Program Files%\MTV20151125\MTView.exe” “%1″”
HKLM\Software\Classes\MTview.ico\shell\open\command\: “”%Program Files%\MTV20151125\MTView.exe” “%1″”
HKLM\Software\Classes\MTview.jfif\shell\open\command\: “”%Program Files%\MTV20151125\MTView.exe” “%1″”
HKLM\Software\Classes\MTview.jpe\shell\open\command\: “”%Program Files%\MTV20151125\MTView.exe” “%1″”
HKLM\Software\Classes\MTview.jpeg\shell\open\command\: “”%Program Files%\MTV20151125\MTView.exe” “%1″”
HKLM\Software\Classes\MTview.jpg\shell\open\command\: “”%Program Files%\MTV20151125\MTView.exe” “%1″”
HKLM\Software\Classes\MTview.png\shell\open\command\: “”%Program Files%\MTV20151125\MTView.exe” “%1″”
HKLM\Software\Classes\MTview.tif\shell\open\command\: “”%Program Files%\MTV20151125\MTView.exe” “%1″”
HKLM\Software\Classes\MTview.tiff\shell\open\command\: “”%Program Files%\MTV20151125\MTView.exe” “%1″”
HKLM\Software\Classes\MTview.wmf\shell\open\command\: “”%Program Files%\MTV20151125\MTView.exe” “%1″”
HKLM\Software\Classes\PCMgrRepairIEExtensions\Shell\Open\Command\: “”%Program Files%\Tencent\QQPCMgr\11.1.16923.222\QQPCMgr.exe”%1 ”
HKLM\Software\Classes\qmgcfiles\Shell\open\Command\: “”%Program Files%\Tencent\QQPCMgr\11.1.16923.222\\QMDeskTopGC.exe” /file=”%1″”
HKLM\Software\Clients\StartMenuInternet\amigo.exe\shell\open\command\: “”%Local Appdata%\Amigo\Application\amigo.exe””
HKLM\Software\Google\Chrome\Extensions\ppoilmfkbpckodoifdlkmkepcajfjmhl\update_url: “https://clients2.google.com/service/update2/crx”
HKLM\Software\Google\Chrome\Extensions\iflppbjnpneiigcbdfjpnkebidmkjmoi\update_url: “https://clients2.google.com/service/update2/crx”
HKLM\Software\Google\Chrome\Extensions\eioddfaepdoeifbhjphfefgipcjcdieo\update_url: “https://clients2.google.com/service/update2/crx”
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ZaxarGameBrowser: “”%Program Files%\Zaxar\ZaxarGameBrowser.exe” -s”
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ZaxarLoader: “”%Program Files%\Zaxar\ZaxarLoader.exe” /verysilent”
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Timestasks: “C:\ProgramData\TimeTasks\timetasks.exe””
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\down2012: “C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\down2012.exe /start”
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\MTview: “%Program Files%\MTV20151125\MTView.exe -mini”
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ QQPCTray: “”%Program Files%\Tencent\QQPCMgr\11.1.16923.222\QQPCTRAY.EXE” /regrun /qqrepair”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\AppHelper\DisplayName: “AppHelper”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\AppHelper\UninstallString: “C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\down2012.exe /u”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\ZaxarGameBrowser\DisplayName: “ZaxarGameBrowser”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\ZaxarGameBrowser\UninstallString: “”%Program Files%\Zaxar\uninstall.exe””
HKLM\System\CurrentControlSet\Services\QMIEProtect\ImagePath: “\??\%Program Files%\Tencent\QQPCMgr\11.1.16923.222\QMIEProtect.sys”
HKLM\System\CurrentControlSet\Services\QMIEProtect\DisplayName: “QMIEProtect”
HKLM\System\CurrentControlSet\Services\QMUdisk\ImagePath: “\??\%Program Files%\Tencent\QQPCMgr\11.1.16923.222\QMUdisk.sys”
HKLM\System\CurrentControlSet\Services\QMUdisk\DisplayName: “tencent QMUdisk”
HKLM\System\CurrentControlSet\Services\QQPCRTP\ImagePath: “”%Program Files%\Tencent\QQPCMgr\11.1.16923.222\QQPCRTP.exe” -r”
HKLM\System\CurrentControlSet\Services\QQPCRTP\DisplayName: “QQPCMgr RTP Service”
HKLM\System\CurrentControlSet\Services\QQSysMon\ImagePath: “\??\%Program Files%\Tencent\QQPCMgr\11.1.16923.222\QQSysMon.sys”
HKLM\System\CurrentControlSet\Services\QQSysMon\DisplayName: “QQSysMon”
HKLM\System\CurrentControlSet\Services\softaal\ImagePath: “\??\%Program Files%\Tencent\QQPCMgr\11.1.16923.222\softaal.sys”
HKLM\System\CurrentControlSet\Services\softaal\DisplayName: “softaal”
HKLM\System\CurrentControlSet\Services\TAOAccelerator\ImagePath: “\??\%SysDir%\Drivers\TAOAccelerator.sys”
HKLM\System\CurrentControlSet\Services\TAOAccelerator\DisplayName: “Tencent TAOAccelerator driver.”
HKLM\System\CurrentControlSet\Services\TAOFrame\ImagePath: “”%Program Files%\Tencent\QQPCMgr\11.1.16923.222\TAOFrame.exe””
HKLM\System\CurrentControlSet\Services\TAOFrame\DisplayName: “TAOFrame”
HKLM\System\CurrentControlSet\Services\TAOKernelDriver\ImagePath: “System32\Drivers\TAOKernelXP.sys”
HKLM\System\CurrentControlSet\Services\TAOKernelDriver\DisplayName: “Tencent TAO kernel driver.”
HKLM\System\CurrentControlSet\Services\TFsFlt\ImagePath: “system32\Drivers\TFsFlt.sys”
HKLM\System\CurrentControlSet\Services\TFsFlt\DisplayName: “TFsFlt”
HKLM\System\CurrentControlSet\Services\TSDefenseBt\DisplayName: “TSDefenseBt”
HKLM\System\CurrentControlSet\Services\TSDefenseBt\ImagePath: “system32\DRIVERS\TSDefenseBt.sys”
HKLM\System\CurrentControlSet\Services\TsFltMgr\ImagePath: “system32\drivers\TsFltMgr.sys”
HKLM\System\CurrentControlSet\Services\TsFltMgr\DisplayName: “tencent TsFltMgr”
HKLM\System\CurrentControlSet\Services\TSKSP\ImagePath: “\??\%Program Files%\Tencent\QQPCMgr\11.1.16923.222\TSKsp.sys”
HKLM\System\CurrentControlSet\Services\TSKSP\DisplayName: “TSKSP”
HKLM\System\CurrentControlSet\Services\TSSK\ImagePath: “System32\tssk.sys”
HKLM\System\CurrentControlSet\Services\TSSK\DisplayName: “TSSK”
HKLM\System\CurrentControlSet\Services\TSSysKit\ImagePath: “\??\%Program Files%\Tencent\QQPCMgr\11.1.16923.222\TSSysKit.sys”
HKLM\System\CurrentControlSet\Services\TSSysKit\DisplayName: “TSSysKit”
HKLM\System\CurrentControlSet\Services\Updater.Mail.Ru\ImagePath: “%Program Files%\Mail.Ru\MailRuUpdater\MailRuUpdater.exe –s”
HKLM\System\CurrentControlSet\Services\Updater.Mail.Ru\DisplayName: “Updater.Mail.Ru”
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\amigo: “%Local Appdata%\Amigo\Application\amigo.exe –no-startup-window”
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\MailRuUpdater: “%Local Appdata%\Mail.Ru\MailRuUpdater.exe”
HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\UnityWebPlayer\UninstallString: “%Local Appdata%\Unity\WebPlayer\Uninstall.exe /CurrentUser”
HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\UnityWebPlayer\DisplayName: “Unity Web Player”
HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\TimeTasks\DisplayName: “Time tasks”
HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\TimeTasks\UninstallString: “”C:\ProgramData\TimeTasks\uninstall.exe””
HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\MailRuUpdater\UninstallString: “%Local Appdata%\Mail.Ru\MailRuUpdater.exe uninstall”
HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Amigo\UninstallString: “”%Local Appdata%\Amigo\Application\44.4.2403.3\Installer\setup.exe” –uninstall”
HKCU\Software\Amigo\UninstallString: “%Local Appdata%\Amigo\Application\44.4.2403.3\Installer\setup.exe”

Detected by UnHackMe:

DOWN2012.EXE
Default location: %TEMP%\DOWN2012.EXE

Dropper hash(md5): fdff0a17ae03798e7279f49fb79beb93

Written by 

Malware Hunter.

UnHackMe removes malware invisible for your antivirus!

Free Download

1
UnHackMe is compatible with most antivirus software.
UnHackMe is 100% CLEAN, which means it does not contain any form of malware, including adware, spyware, viruses, trojans and backdoors. VirusTotal (0/56).
System Requirements: Windows 2000-Windows 8.1/10. UnHackMe uses minimum of computer resources.

WordPress SEO fine-tune by Meta SEO Pack from Poradnik Webmastera