Adware ( 004c148d1 )

Dmitry Sokolov recommends UnHackMe!

UnHackMe is a powerful tool against malware.

UnHackMe quickly removes rootkits/malware/adware/browser hijack issues!

: Solved! 5 Stars (5 / 5)

Adware ( 004c148d1 ) also known as Application.Generic.1502027, Application.Generic.1502027, Application.Generic.1502027.

Malware Analysis of Adware ( 004c148d1 ) – ADAMJS.EXE

Created files:

%Program Files%\AdamYaSuo\Adam7za.exe
%Program Files%\AdamYaSuo\Adamex.exe
%Program Files%\AdamYaSuo\Adamjs.exe
%Program Files%\AdamYaSuo\Adampg.exe
%Program Files%\AdamYaSuo\Adams.dll

Autostart registry keys:

HKLM\Software\Classes\CLSID\{085CB97F-6D0B-487D-B94C-E11A736C38CE}\InprocServer32\: “C:\PROGRA~1\IQIYIV~1\LStyle\QYPlugin.dll”
HKLM\Software\Classes\CLSID\{23170F69-40C1-278A-1000-000100020003}\InprocServer32\: “%Program Files%\AdamYaSuo\Adams.dll”
HKLM\Software\Classes\CLSID\{307B3CDB-9EE3-4137-9D18-F9AD6537ECEB}\InprocServer32\: “%Program Files%\IQIYI Video\LStyle\Accelerator\IEHelper.dll”
HKLM\Software\Classes\CLSID\{5E6A8DA1-5731-465B-B036-B9E16EF26CAC}\InprocServer32\: “C:\PROGRA~1\IQIYIV~1\LStyle\QYPlugin.dll”
HKLM\Software\Classes\CLSID\{CF3CDEFB-31BE-43AE-B064-B9C62C883259}\Shell\Open\Command\: “%Program Files%\IQIYI Video\LStyle\QyClient.exe web_startup_tray”
HKLM\Software\Classes\CLSID\{CF3CDEFB-31BE-43AE-B064-B9C62C883259}\InProcServer32\: “shdocvw.dll”
HKLM\Software\Classes\CLSID\{FB4F6285-4C32-49F2-950F-A5998F9CEC6C}\InprocServer32\: “%Program Files%\IQIYI Video\LStyle\Accelerator\IEHelper.dll”
HKLM\Software\Classes\Adam7za.*\shell\open\command\: “”%Program Files%\AdamYaSuo\Adam7za.exe” “%1″”
HKLM\Software\Classes\bdhd\shell\open\command\: 22 43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73 5C 49 51 49 59 49 20 56 69 64 65 6F 5C 4C 53 74 79 6C 65 5C 51 79 43 6C 69 65 6E 74 2E 65 78 65 22 20 2D 70 70 73 74 72 65 61 6D 20 22 25 31 22 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
HKLM\Software\Classes\magnet2\shell\open\command\: 22 43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73 5C 49 51 49 59 49 20 56 69 64 65 6F 5C 4C 53 74 79 6C 65 5C 51 79 43 6C 69 65 6E 74 2E 65 78 65 22 20 2D 70 70 73 74 72 65 61 6D 20 22 25 31 22 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
HKLM\Software\Classes\pps\shell\open\command\: 22 43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73 5C 49 51 49 59 49 20 56 69 64 65 6F 5C 4C 53 74 79 6C 65 5C 51 79 43 6C 69 65 6E 74 2E 65 78 65 22 20 2D 70 70 73 74 72 65 61 6D 20 22 25 31 22 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
HKLM\Software\Classes\ppsrun\shell\open\command\: 22 43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73 5C 49 51 49 59 49 20 56 69 64 65 6F 5C 4C 53 74 79 6C 65 5C 51 79 43 6C 69 65 6E 74 2E 65 78 65 22 20 2D 70 70 73 74 72 65 61 6D 20 22 25 31 22 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
HKLM\Software\Classes\ppstream\shell\open\command\: 22 43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73 5C 49 51 49 59 49 20 56 69 64 65 6F 5C 4C 53 74 79 6C 65 5C 51 79 43 6C 69 65 6E 74 2E 65 78 65 22 20 2D 70 70 73 74 72 65 61 6D 20 22 25 31 22 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
HKLM\Software\Classes\pps_pfv\shell\open\command\: “”%Program Files%\IQIYI Video\LStyle\QyClient.exe” -runfrom openfile “%1″”
HKLM\Software\Classes\pps_qsv\shell\open\command\: “”%Program Files%\IQIYI Video\LStyle\QyClient.exe” -runfrom openfile “%1″”
HKLM\Software\Classes\qips\shell\open\command\: 22 43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73 5C 49 51 49 59 49 20 56 69 64 65 6F 5C 4C 53 74 79 6C 65 5C 51 79 43 6C 69 65 6E 74 2E 65 78 65 22 20 2D 70 70 73 74 72 65 61 6D 20 22 25 31 22 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
HKLM\Software\Classes\qisu\shell\open\command\: 22 43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73 5C 49 51 49 59 49 20 56 69 64 65 6F 5C 4C 53 74 79 6C 65 5C 51 79 43 6C 69 65 6E 74 2E 65 78 65 22 20 2D 70 70 73 74 72 65 61 6D 20 22 25 31 22 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
HKLM\Software\Classes\qygameclient\shell\open\command\: “”%Program Files%\IQIYI Video\Common\QyGameClient\QyGameClient.exe” -qygameclient “%1″”
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\TocelWuszu: “%Appdata%\TocelWuszu\TocelWuszu.exe /Syboe”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Aiwan\DisplayName: “??????”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Aiwan\UninstallString: “%Appdata%\Aiwan\uninst.exe”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\IQIYI Video\DisplayName: “?????”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\IQIYI Video\UninstallString: “%Program Files%\IQIYI Video\Common\QyUninstaller.exe”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\jmtradio_is1\DisplayName: “jmtradio??5.3.14.25”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\jmtradio_is1\UninstallString: “”%Program Files%\jmtradio\unins000.exe””
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Okyingshi\DisplayName: “Ok??”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Okyingshi\UninstallString: “%Appdata%\Okyingshi\uninst.exe”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\PPStream\UninstallString: “%Program Files%\IQIYI Video\LStyle\QyUninst.exe”
HKLM\System\CurrentControlSet\Services\JMRediosv\ImagePath: “%Program Files%\jmtradio\jmtrsv.exe”
HKLM\System\CurrentControlSet\Services\JMRediosv\DisplayName: “RedioService”
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\adamyasuorun: “%Program Files%\AdamYaSuo\Adampg.exe -insthtml-xiao”
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Okyingshi: “%Appdata%\Okyingshi\1.0.2.5\Okys.exe AutoRun”
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\HCDNClient: “”%Program Files%\IQIYI Video\LStyle\QyKernel.exe” -shell_start”
HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\UnityWebPlayer\UninstallString: “%Local Appdata%\Unity\WebPlayer\Uninstall.exe /CurrentUser”
HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\UnityWebPlayer\DisplayName: “Unity Web Player”

Detected by UnHackMe:

ADAMJS.EXE
Default location: %PROGRAM FILES%\ADAMYASUO\ADAMJS.EXE

Dropper hash(md5): 874c2efe0bf29780537405ef07db03c6

Written by 

Malware Hunter.

UnHackMe removes malware invisible for your antivirus!

Free Download

4
UnHackMe is compatible with most antivirus software.
UnHackMe is 100% CLEAN, which means it does not contain any form of malware, including adware, spyware, viruses, trojans and backdoors. VirusTotal (0/56).
System Requirements: Windows 2000-Windows 8.1/10. UnHackMe uses minimum of computer resources.

WordPress SEO fine-tune by Meta SEO Pack from Poradnik Webmastera