Dmitry Sokolov recommends UnHackMe!
UnHackMe is a powerful tool against malware.
UnHackMe quickly removes rootkits/malware/adware/browser hijack issues!
(5 / 5)
Suspicious_GEN.F47V0115 also known as Generic PUA NM, Adware/DealPly.A.430, HEUR/QVM41.1.Malware.Gen.
Malware Analysis of Suspicious_GEN.F47V0115 – PFINST_1096.EXE
Created files:
%Temp%\8d3ccdd5-18cf-4b59-b510-89cd42999a33\cloud_backup_setup.exe
%Temp%\BackupSetup.exe
%Temp%\bdb21cab-4538-4bc9-8929-35400a439d7e\pfinst_1096.exe
%Temp%\dd_vcredistMSI64FF.txt
%Temp%\dd_vcredistUI64FF.txt
Autostart registry keys:
HKLM\Software\Classes\Applications\FastPlayer.exe\shell\Play\command\: “”%Program Files%\FastPlayer\FastPlayer.exe” /m “%1″”
HKLM\Software\Classes\Applications\FastPlayer.exe\SupportedTypes\.mp3: “”
HKLM\Software\Classes\Applications\FastPlayer.exe\SupportedTypes\.aac: “”
HKLM\Software\Classes\Applications\FastPlayer.exe\SupportedTypes\.wav: “”
HKLM\Software\Classes\Applications\FastPlayer.exe\SupportedTypes\.aif: “”
HKLM\Software\Classes\Applications\FastPlayer.exe\SupportedTypes\.wma: “”
HKLM\Software\Classes\Applications\FastPlayer.exe\SupportedTypes\.mp4: “”
HKLM\Software\Classes\Applications\FastPlayer.exe\SupportedTypes\.avi: “”
HKLM\Software\Classes\Applications\FastPlayer.exe\SupportedTypes\.mpg: “”
HKLM\Software\Classes\Applications\FastPlayer.exe\SupportedTypes\.mpeg: “”
HKLM\Software\Classes\Applications\FastPlayer.exe\SupportedTypes\.3gp: “”
HKLM\Software\Classes\Applications\FastPlayer.exe\SupportedTypes\.mov: “”
HKLM\Software\Classes\Applications\FastPlayer.exe\SupportedTypes\.wmv: “”
HKLM\Software\Classes\Applications\FastPlayer.exe\SupportedTypes\.divx: “”
HKLM\Software\Classes\Applications\FastPlayer.exe\SupportedTypes\.mkv: “”
HKLM\Software\Classes\Applications\FastPlayer.exe\SupportedTypes\.flv: “”
HKLM\Software\Classes\Applications\FastPlayer.exe\: “”
HKLM\Software\Classes\Applications\FastPlayer.exe\FriendlyAppName: “FastPlayer”
HKLM\Software\Classes\CLSID\{11111111-1111-1111-1111-110611791113}\InprocServer32\: “%Program Files%\MPlayerPlusvideo4\MPlayerPlusvideo4-bho.dll”
HKLM\Software\Classes\CLSID\{11111111-1111-1111-1111-110611991117}\InprocServer32\: “%Program Files%\BrowsersApp+V2.3\BrowsersApp+V2.3-bho.dll”
HKLM\Software\Classes\CLSID\{22222222-2222-2222-2222-220622792213}\InprocServer32\: “%Program Files%\MPlayerPlusvideo4\MPlayerPlusvideo4-bho.dll”
HKLM\Software\Classes\CLSID\{22222222-2222-2222-2222-220622992217}\InprocServer32\: “%Program Files%\BrowsersApp+V2.3\BrowsersApp+V2.3-bho.dll”
HKLM\Software\Classes\CLSID\{b608cc98-54de-4775-96c9-097de398500c}\InProcServer32\: “%Local Appdata%\PriceFountain\PriceFountainIE.dll”
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\D20352A90C039D93DBF6126ECE614057\InstallProperties\UninstallString: “MsiExec.exe /X{9A25302D-30C0-39D9-BD6F-21E6EC160475}”
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\D20352A90C039D93DBF6126ECE614057\InstallProperties\DisplayName: “Microsoft Visual C++ 2008 Redistributable – x86 9.0.30729.17”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\BrowsersApp+V2.3\DisplayName: “BrowsersApp+V2.3”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\BrowsersApp+V2.3\UninstallString: “%Program Files%\BrowsersApp+V2.3\Uninstall.exe /fcp=1 ”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\FastPlayer\DisplayName: “FastPlayer”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\FastPlayer\UninstallString: “%Program Files%\FastPlayer\uninstall.exe”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\MPlayerPlusvideo4\DisplayName: “MPlayerPlusvideo4”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\MPlayerPlusvideo4\UninstallString: “%Program Files%\MPlayerPlusvideo4\Uninstall.exe /fcp=1 ”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\MyPC Backup\DisplayName: “MyPC Backup ”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\MyPC Backup\UninstallString: “%Program Files%\MyPC Backup\uninst.exe”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{9A25302D-30C0-39D9-BD6F-21E6EC160475}\UninstallString: “MsiExec.exe /X{9A25302D-30C0-39D9-BD6F-21E6EC160475}”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{9A25302D-30C0-39D9-BD6F-21E6EC160475}\DisplayName: “Microsoft Visual C++ 2008 Redistributable – x86 9.0.30729.17”
HKLM\System\CurrentControlSet\Services\BackupStack\ImagePath: “%Program Files%\MyPC Backup\BackupStack.exe”
HKLM\System\CurrentControlSet\Services\BackupStack\DisplayName: “Computer Backup (MyPC Backup)”
HKLM\System\CurrentControlSet\Services\FastPlayerUpdaterService\ImagePath: “”%Program Files%\FastPlayer\FastPlayerUpdaterService.exe””
HKLM\System\CurrentControlSet\Services\FastPlayerUpdaterService\DisplayName: “FastPlayer Updater Service”
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\pricefountainw.exe: “%Local Appdata%\PriceFountain\pricefountainw.exe HKEY_CURRENT_USER Software\PriceFountain”
HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\PriceFountain\DisplayName: “PriceFountain (remove only)”
HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\PriceFountain\UninstallString: “”%Local Appdata%\PriceFountain\uninst.exe” /uninstall”
Detected by UnHackMe:
PFINST_1096.EXE
Default location: %TEMP%\BDB21CAB-4538-4BC9-8929-35400A439D7E\PFINST_1096.EXE
Dropper hash(md5): 957986395057b86c11d3d4c10d758855
UnHackMe
removes malware invisible for your antivirus!
UnHackMe is 100% CLEAN, which means it does not contain any form of malware, including adware, spyware, viruses, trojans and backdoors. VirusTotal (0/56).
System Requirements: Windows 2000-Windows 8.1/10. UnHackMe uses minimum of computer resources.