Suspicious_GEN.F47V0310

Dmitry Sokolov recommends UnHackMe!

UnHackMe is a powerful tool against malware.

UnHackMe quickly removes rootkits/malware/adware/browser hijack issues!

: Solved! 5 Stars (5 / 5)

Suspicious_GEN.F47V0310 also known as Adware.SearchProtect.W, Trojan ( 004b5c571 ), PUP.Optional.XTab.A.

Malware Analysis of Suspicious_GEN.F47V0310 – PROTECTSERVICE.EXE

Created files:

%Program Files%\XTab\msvcp110.dll
%Program Files%\XTab\msvcr110.dll
%Program Files%\XTab\ProtectService.exe
%Program Files%\XTab\searchProvider.xml
%Program Files%\XTab\skin\about.png

Autostart registry keys:

HKLM\Software\Classes\CLSID\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}\InprocServer32\: “%Program Files%\XTab\SupTab.dll”
HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}\DisplayName: “istartsurf”
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\D20352A90C039D93DBF6126ECE614057\InstallProperties\UninstallString: “MsiExec.exe /X{9A25302D-30C0-39D9-BD6F-21E6EC160475}”
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\D20352A90C039D93DBF6126ECE614057\InstallProperties\DisplayName: “Microsoft Visual C++ 2008 Redistributable – x86 9.0.30729.17”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\CashReminder\UninstallString: “”%Program Files%\CashReminder\uninstall.exe” /S”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\CashReminder\DisplayName: “CashReminder”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\DesProtetor\UninstallString: “”%Program Files%\DesProtetor\uninst.exe” ”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\DesProtetor\DisplayName: “DesProtetor”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\istartsurf uninstall\DisplayName: “istartsurf uninstall”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\istartsurf uninstall\UninstallString: “%Appdata%\istartsurf\UninstallManager.exe -ptid=pcm”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\MyPC Backup\DisplayName: “MyPC Backup ”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\MyPC Backup\UninstallString: “%Program Files%\MyPC Backup\uninst.exe”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{9A25302D-30C0-39D9-BD6F-21E6EC160475}\UninstallString: “MsiExec.exe /X{9A25302D-30C0-39D9-BD6F-21E6EC160475}”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{9A25302D-30C0-39D9-BD6F-21E6EC160475}\DisplayName: “Microsoft Visual C++ 2008 Redistributable – x86 9.0.30729.17”
HKLM\System\CurrentControlSet\Services\BackupStack\ImagePath: “%Program Files%\MyPC Backup\BackupStack.exe”
HKLM\System\CurrentControlSet\Services\BackupStack\DisplayName: “Computer Backup (MyPC Backup)”
HKLM\System\CurrentControlSet\Services\CashReminder\ImagePath: “%Program Files%\CashReminder\CashReminder.exe”
HKLM\System\CurrentControlSet\Services\CashReminder\DisplayName: “CashReminder”
HKLM\System\CurrentControlSet\Services\crfilterdrv\ImagePath: “system32\drivers\crfilterdrv.sys”
HKLM\System\CurrentControlSet\Services\crfilterdrv\DisplayName: “crfilterdrv”
HKLM\System\CurrentControlSet\Services\DesProtetor\ImagePath: “%Program Files%\DesProtetor\DesProtetor.exe”
HKLM\System\CurrentControlSet\Services\DesProtetor\DisplayName: “DesProtetor”
HKLM\System\CurrentControlSet\Services\desprotetordrv\ImagePath: “system32\drivers\desprotetordrv.sys”
HKLM\System\CurrentControlSet\Services\desprotetordrv\DisplayName: “desprotetordrv”
HKLM\System\CurrentControlSet\Services\IHProtect Service\ImagePath: “%Program Files%\XTab\ProtectService.exe”
HKLM\System\CurrentControlSet\Services\IHProtect Service\DisplayName: “IHProtect Service”
HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}\DisplayName: “e”
HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}\DisplayName: “istartsurf”
HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{E733165D-CBCF-4FDA-883E-ADEF965B476C}\DisplayName: “Google”
HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\StormFall\DisplayName: “StormFall”
HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\StormFall\UninstallString: “%Appdata%\StormFall\Uninstaller.exe /Run /ePN:0S2Z1F1C1H0F1T1I1I”
HKLM\Software\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command\: “”%Program Files%\Mozilla Firefox\firefox.exe” http://www.istartsurf.com/?type=sc&ts=1426089791&from=pcm&uid=VMwareXVirtualXIDEXHardXDrive_00000000000000000001″
HKLM\Software\Clients\StartMenuInternet\Google Chrome\shell\open\command\: “”%Program Files%\Google\Chrome\Application\chrome.exe” http://www.istartsurf.com/?type=sc&ts=1426089791&from=pcm&uid=VMwareXVirtualXIDEXHardXDrive_00000000000000000001″
HKLM\Software\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command\: “%Program Files%\Internet Explorer\iexplore.exe http://www.istartsurf.com/?type=sc&ts=1426089791&from=pcm&uid=VMwareXVirtualXIDEXHardXDrive_00000000000000000001”
HKLM\Software\Clients\StartMenuInternet\VMWAREHOSTOPEN.EXE\shell\open\command\: “”%Program Files%\VMware\VMware Tools\VMwareHostOpen.exe” http://www.istartsurf.com/?type=sc&ts=1426089791&from=pcm&uid=VMwareXVirtualXIDEXHardXDrive_00000000000000000001″
HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\DisplayName: “Bing”

Detected by UnHackMe:

PROTECTSERVICE.EXE
Default location: %PROGRAM FILES%\XTAB\PROTECTSERVICE.EXE

Dropper hash(md5): f7bd4d8187ef930ed44d4856bc151e5d

Share This:

Written by 

Malware Hunter.

UnHackMe removes malware invisible for your antivirus!

Free Download

4
UnHackMe is compatible with most antivirus software.
UnHackMe is 100% CLEAN, which means it does not contain any form of malware, including adware, spyware, viruses, trojans and backdoors. VirusTotal (0/56).
System Requirements: Windows 2000-Windows 8.1/10. UnHackMe uses minimum of computer resources.

WordPress SEO fine-tune by Meta SEO Pack from Poradnik Webmastera