Dmitry Sokolov recommends UnHackMe!
UnHackMe is a powerful tool against malware.
UnHackMe quickly removes rootkits/malware/adware/browser hijack issues!
(5 / 5)
PUA.ShandaAdd also known as Trojan.ZusyCRTD.Win32.5117.
Malware Analysis of PUA.ShandaAdd – CONTEXTMENU32.DLL
Created files:
%TEMP%\FFFFA8.TMP.REG
%LOCAL APPDATA%\HAOTUKANKAN\CONFIG.INI
%LOCAL APPDATA%\HAOTUKANKAN\CONTEXTMENU32.DLL
%LOCAL APPDATA%\HAOTUKANKAN\CONTEXTMENU64.DLL
%LOCAL APPDATA%\HAOTUKANKAN\DOODLES\00FB0C3030B5D76FF95EC34C10CE528B6090199110C91-MGENIX_FW658.PNG
Autostart registry keys:
HKLM\SOFTWARE\CLASSES\CLSID\{1A7B0538-FD28-48A0-BB8B-DE3E04DF94C2}\INPROCSERVER32\: “%LOCAL APPDATA%\HAOTUKANKAN\CONTEXTMENU32.DLL”
HKLM\SOFTWARE\CLASSES\CLSID\{79BEF29B-2700-4D41-BE42-6EBA8A889D29}\INPROCSERVER32\: “%LOCAL APPDATA%\HAOTUKANKAN\CONTEXTMENU32.DLL”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.3FR\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.BMP\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.CUT\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.DDS\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.EXR\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.G3\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.GIF\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.HDP\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.HDR\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.ICO\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.IFF\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.J2K\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.JNG\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.JP2\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.JPEG\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.JPG\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.JXR\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.KOA\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.MNG\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.PBM\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.PCD\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.PCT\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.PCX\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.PFM\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.PGM\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.PNG\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.PPM\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.PSD\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.RAS\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.SGI\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.TGA\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.TIF\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.TIFF\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.WAP\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.WEBP\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.XBM\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.XPM\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{01EB3F15-6569-4FCD-A1AA-913E906E2194}\DisplayName: “????”
HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{01EB3F15-6569-4FCD-A1AA-913E906E2194}\UNINSTALLSTRING: “%LOCAL APPDATA%\HAOTUKANKAN\UNINSTALL.EXE”
Detected by UnHackMe:
CONTEXTMENU32.DLL
DEFAULT LOCATION: %LOCAL APPDATA%\HAOTUKANKAN\CONTEXTMENU32.DLL
Dropper hash(md5): ab2529e0a8a399f7b8af6dd2fe638948
UnHackMe
removes malware invisible for your antivirus!
UnHackMe is 100% CLEAN, which means it does not contain any form of malware, including adware, spyware, viruses, trojans and backdoors. VirusTotal (0/56).
System Requirements: Windows 2000-Windows 8.1/10. UnHackMe uses minimum of computer resources.