Dmitry Sokolov recommends UnHackMe!

UnHackMe is a powerful tool against malware.

UnHackMe quickly removes rootkits/malware/adware/browser hijack issues!

Alex NightWatcher: Solved! (5 / 5)

Win32/Mallar also known as W32/Rahack.gen.worm, Trojan.Win32.Allaple.bkbmt, Win32.Worm.Allaple.Gen.

Malware Analysis of Win32/Mallar

Created files:

%Program Files Common%\Microsoft Shared\Stationery\brvrjrke.exe
%Program Files Common%\Microsoft Shared\Stationery\bzqlkhrh.exe
%Program Files Common%\Microsoft Shared\Stationery\czjevcet.exe
%Program Files Common%\Microsoft Shared\Stationery\ehbebsrn.exe
%Program Files Common%\Microsoft Shared\Stationery\elwtjnbj.exe

Autostart registry keys:

HKLM\Software\Classes\CLSID\{0BD9D438-2B62-1078-724B-E27EBD7F7A8F}\LocalServer32\: “%Program Files Common%\Microsoft Shared\Stationery\czjevcet.exe”
HKLM\Software\Classes\CLSID\{347B1259-E23B-97AA-90DE-1F87B6B38A33}\LocalServer32\: “%Local Appdata%\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.4.11_0\tlblhqjn.exe”
HKLM\Software\Classes\CLSID\{35349B95-82D3-1178-19ED-0E5D2312F5C0}\LocalServer32\: “%SysDir%\urdvxc.exe”
HKLM\Software\Classes\CLSID\{3CD25E47-575E-7BBC-20A2-27BB6FDBBD22}\LocalServer32\: “c:\sand-box\51d03df9dd3b4705c7343955b7dbefdd.exe”
HKLM\Software\Classes\CLSID\{41B2340A-2DC9-B06E-C6F2-D09099C23FA8}\LocalServer32\: “%Desktop%\Warrior\zhlqjlwk.exe”
HKLM\Software\Classes\CLSID\{4222E084-9879-6354-96E0-20C15ACDC125}\LocalServer32\: “%Program Files Common%\Microsoft Shared\Stationery\qjllsjhl.exe”
HKLM\Software\Classes\CLSID\{4C80FDD5-398A-C978-C78B-16A1293DD4DE}\LocalServer32\: “%Program Files Common%\System\ado\tsektjkj.exe”
HKLM\Software\Classes\CLSID\{541C14FC-A3AA-C18E-DBF1-600A7FA7940B}\LocalServer32\: “%Program Files Common%\Microsoft Shared\Stationery\bhrhnkht.exe”
HKLM\Software\Classes\CLSID\{57B24AA4-B776-3CB3-3A11-725E7736C158}\LocalServer32\: “%Appdata%\Auslogics\Disk Defrag\Reports\tvxshctj.exe”
HKLM\Software\Classes\CLSID\{6455A07B-5629-2D89-9412-B3A2DD705BDE}\LocalServer32\: “%Program Files Common%\Microsoft Shared\Stationery\bcwvzwbh.exe”
HKLM\Software\Classes\CLSID\{76126225-3758-4FE5-19E1-0942B74619EF}\LocalServer32\: “%Program Files Common%\Microsoft Shared\Stationery\bnbtzwxt.exe”
HKLM\Software\Classes\CLSID\{7D2E936C-285C-5A66-3FE8-B76B480783C6}\LocalServer32\: “%Program Files Common%\Microsoft Shared\Stationery\xrljqjzn.exe”
HKLM\Software\Classes\CLSID\{83B5D292-A22F-1B4A-D7F2-07B54755FFF0}\LocalServer32\: “%Program Files Common%\Microsoft Shared\Stationery\bzqlkhrh.exe”
HKLM\Software\Classes\CLSID\{983CB576-F105-8BC6-0DB8-F2C0DD84BEED}\LocalServer32\: “%Program Files Common%\Microsoft Shared\Stationery\ehbebsrn.exe”
HKLM\Software\Classes\CLSID\{9B995423-493C-874A-B498-AF856BE7A7B2}\LocalServer32\: “%Program Files Common%\Microsoft Shared\Stationery\tlcwjrwt.exe”
HKLM\Software\Classes\CLSID\{A18CE63E-6C47-00A5-8688-927B7EB5E2B5}\LocalServer32\: “%Program Files Common%\Microsoft Shared\Stationery\nsqjttkv.exe”
HKLM\Software\Classes\CLSID\{A572761A-8C09-6F81-8A7D-33A5FEE989B9}\LocalServer32\: “%Program Files Common%\Microsoft Shared\Stationery\elwtjnbj.exe”
HKLM\Software\Classes\CLSID\{B7536FB0-4169-89A0-FC6E-26BB21D3DF7C}\LocalServer32\: “%Program Files Common%\Microsoft Shared\Smart Tag\1049\hjeskhbe.exe”
HKLM\Software\Classes\CLSID\{D2498B94-25F7-A0BB-F8CD-F0F9FF4DFDC3}\LocalServer32\: “%Program Files Common%\Microsoft Shared\Stationery\vkjljzrn.exe”
HKLM\Software\Classes\CLSID\{E59D9298-124D-2169-BC13-EA9ED9A48DC0}\LocalServer32\: “%Program Files Common%\Microsoft Shared\Stationery\njbsvtll.exe”
HKLM\Software\Classes\CLSID\{F3D1F763-6168-A4AA-AE26-04F83B3404B0}\LocalServer32\: “%Program Files Common%\Microsoft Shared\Stationery\brvrjrke.exe”
HKLM\System\CurrentControlSet\Services\MSWindows\Security\Security: 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 00 01 02 00 00 00 00 00 05 20 00 00 00 20 02 00 00 00 00 14 00 8D 01 02 00 01 01 00 00 00 00 00 05 0B 00 00 00 00 00 18 00 FD 01 02 00 01 02 00 00 00 00 00 05 20 00 00 00 23 02 00 00 01 01 00 00 00 00 00 05 12 00 00 00 01 01 00 00 00 00 00 05 12 00 00 00
HKLM\System\CurrentControlSet\Services\MSWindows\Type: 0x00000110
HKLM\System\CurrentControlSet\Services\MSWindows\Start: 0x00000002
HKLM\System\CurrentControlSet\Services\MSWindows\ErrorControl: 0x00000000
HKLM\System\CurrentControlSet\Services\MSWindows\ImagePath: “”%SysDir%\urdvxc.exe” /service”
HKLM\System\CurrentControlSet\Services\MSWindows\DisplayName: “Network Windows Service”
HKLM\System\CurrentControlSet\Services\MSWindows\ObjectName: “LocalSystem”
HKLM\System\CurrentControlSet\Services\MSWindows\Description: “Network Windows service management”
HKLM\System\CurrentControlSet\Services\MSWindows\FailureCommand: “%SysDir%\urdvxc.exe”
HKLM\System\CurrentControlSet\Services\MSWindows\FailureActions: 00 10 00 00 00 00 00 00 01 00 00 00 03 00 00 00 57 00 69 00 01 00 00 00 00 06 00 00 03 00 00 00 20 01 00 00 00 00 00 00 20 01 00 00

Detected by UnHackMe:

CZJEVCET.EXE
Default location: %PROGRAM FILES COMMON%\MICROSOFT SHARED\STATIONERY\CZJEVCET.EXE

Written by NightWatcher

Malware Hunter.
Google+

UnHackMe removes malware invisible for your antivirus!

UnHackMe is compatible with most antivirus software.
UnHackMe is 100% CLEAN, which means it does not contain any form of malware, including adware, spyware, viruses, trojans and backdoors. VirusTotal (0/56).
System Requirements: Windows 2000-Windows 8.1/10. UnHackMe uses minimum of computer resources.