suspected of Trojan.Downloader.gen.h

Dmitry Sokolov recommends UnHackMe!

UnHackMe is a powerful tool against malware.

UnHackMe quickly removes rootkits/malware/adware/browser hijack issues!

: Solved! 5 Stars (5 / 5)

suspected of Trojan.Downloader.gen.h also known as Trojan/Generic.ASMalwNS.36AA, Riskware ( 0040eff71 ), Suspicious.Cloud.9.

Malware Analysis of suspected of Trojan.Downloader.gen.h – QC.EXE

Created files:

%Temp%\nsh3.tmp\System.dll
%Temp%\nsy2D.tmp
%Temp%\QC.exe
%Temp%\reg12.tmp
%Temp%\reg14.tmp

Autostart registry keys:

HKLM\Software\Classes\CLSID\{B89F5C49-51DB-4974-AB5A-E25901AA339C}\InprocServer32\: “%Program Files%\PC Speed Up\PCSUHelper.dll”
HKLM\Software\Classes\CLSID\{E9B5B0D2-D08A-49FC-8B5C-159B60BAA268}\InprocServer32\: “%Program Files%\PC Speed Up\PCSUHelper.dll”
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\QualityChecker: “%Program Files%\QualityChecker\QC.exe”
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce\QualityChecker: “%Program Files%\QualityChecker\QC.exe”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\PCSU-SL_is1\DisplayName: “PC Speed Up”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\PCSU-SL_is1\UninstallString: “”%Program Files%\PC Speed Up\unins000.exe””
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Uninstall cos\UninstallString: “”%Program Files%\yessearches_bnd\uninstall.exe” /cf={A16B1AF7-982D-40C3-B5C1-633E1A6A6678}”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Uninstall cos\DisplayName: “yessearches Uninstall”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\VOPackage\DisplayName: “Remote Desktop Access (VuuPC)”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\VOPackage\UninstallString: “”%Appdata%\VOPackage\Uninstall.exe””
HKLM\System\CurrentControlSet\Services\PCSUService\ImagePath: “%Program Files%\PC Speed Up\PCSUService.exe”
HKLM\System\CurrentControlSet\Services\PCSUService\DisplayName: “PC Speed Up Service”
HKLM\System\CurrentControlSet\Services\SCService\ImagePath: “”%Program Files%\PC Speed Up\SpeedCheckerService.exe””
HKLM\System\CurrentControlSet\Services\SCService\DisplayName: “SpeedChecker Service”
HKLM\System\CurrentControlSet\Services\vmserve\ImagePath: “”%Program Files%\Common Update\vmserve Update\vmserve.exe” {79740E79-A383-47A7-B513-3DF6563D007F} {A16B1AF7-982D-40C3-B5C1-633E1A6A6678}”
HKLM\System\CurrentControlSet\Services\vmserve\DisplayName: “vmserve Update”
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\PCSpeedUp: “%Program Files%\PC Speed Up\PCSUNotifier.exe”

Detected by UnHackMe:

QC.EXE
Default location: %TEMP%\QC.EXE

Dropper hash(md5): f8f41a5d2d62241d07a9dd1773e77420

Share This:

Written by 

Malware Hunter.

UnHackMe removes malware invisible for your antivirus!

Free Download

4
UnHackMe is compatible with most antivirus software.
UnHackMe is 100% CLEAN, which means it does not contain any form of malware, including adware, spyware, viruses, trojans and backdoors. VirusTotal (0/56).
System Requirements: Windows 2000-Windows 8.1/10. UnHackMe uses minimum of computer resources.

WordPress SEO fine-tune by Meta SEO Pack from Poradnik Webmastera