TR/Agent.eopmbp

Dmitry Sokolov recommends UnHackMe!

UnHackMe is a powerful tool against malware.

UnHackMe quickly removes rootkits/malware/adware/browser hijack issues!

: Solved! 5 Stars (5 / 5)

TR/Agent.eopmbp also known as a variant of Win32/Adware.MultiPlug.JY, Gen:Variant.Mikey.11576 (B), W32/S-e2cc49d1!Eldorado.

Malware Analysis of TR/Agent.eopmbp – CDRCGL3NFYAVFU.EXE

Created files:

%Program Files%\bestadblocker\cDRcGl3nfyaVfu.dat
%Program Files%\bestadblocker\cDRcGl3nfyaVfu.dll
%Program Files%\bestadblocker\cDRcGl3nfyaVfu.exe
%Program Files%\bestadblocker\cDRcGl3nfyaVfu.tlb
%Program Files%\PriceMinus\hKhiUjgidwnN3x.dat

Autostart registry keys:

HKLM\Software\Classes\CLSID\{B05F2877-D6B2-46E5-80AF-75A657AE0663}\InprocServer32\: “%Program Files%\PriceMinus\hKhiUjgidwnN3x.dll”
HKLM\Software\Classes\CLSID\{EC53FB14-0DF2-41D8-9710-6F7B9BA3F40B}\InprocServer32\: “%Program Files%\bestadblocker\cDRcGl3nfyaVfu.dll”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{06B99631-BFA2-3B7A-F58B-D067C2BA59B7}\DisplayName: “PriceMinus”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{06B99631-BFA2-3B7A-F58B-D067C2BA59B7}\UninstallString: “”%Program Files%\PriceMinus\hKhiUjgidwnN3x.exe” /s /n /i:”ExecuteCommands;UninstallCommands” “””
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}{f9c5f880}\UninstallString: “”%SysDir%\RUNDLL32.EXE” “C:\PROGRA~1\RELAYD~1\RELAYD~1.DLL”,_uninstall /un”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}{f9c5f880}\DisplayName: “LibraryFunc”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{4820778D-AB0D-6D18-C316-52A6A0E1D507}\DisplayName: “bestadblocker”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{4820778D-AB0D-6D18-C316-52A6A0E1D507}\UninstallString: “”%Program Files%\bestadblocker\cDRcGl3nfyaVfu.exe” /s /n /i:”ExecuteCommands;UninstallCommands” “””
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{AD11DADE-C597-45D9-D8C5-1D2EB0B89613}\DisplayName: “Turntable fm Extended”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{AD11DADE-C597-45D9-D8C5-1D2EB0B89613}\UninstallString: “”%Program Files%\Turntable fm Extended\Turntable fm Extended.exe” /s /n /i:”ExecuteCommands;UninstallCommands” “””
HKLM\System\CurrentControlSet\Services\f9c5f880\ImagePath: “”%SysDir%\rundll32.exe” “c:\Program Files\RelayDouble\RelayDouble.dll”,serv”
HKLM\System\CurrentControlSet\Services\f9c5f880\DisplayName: “RelayDouble”

Detected by UnHackMe:

CDRCGL3NFYAVFU.EXE
Default location: %PROGRAM FILES%\BESTADBLOCKER\CDRCGL3NFYAVFU.EXE

Dropper hash(md5): 3695f1dd348d8d1819e76e6d35a2a6b7

Written by 

Malware Hunter.

UnHackMe removes malware invisible for your antivirus!

Free Download

1
UnHackMe is compatible with most antivirus software.
UnHackMe is 100% CLEAN, which means it does not contain any form of malware, including adware, spyware, viruses, trojans and backdoors. VirusTotal (0/56).
System Requirements: Windows 2000-Windows 8.1/10. UnHackMe uses minimum of computer resources.

WordPress SEO fine-tune by Meta SEO Pack from Poradnik Webmastera