Dmitry Sokolov recommends UnHackMe!

UnHackMe is a powerful tool against malware.

UnHackMe quickly removes rootkits/malware/adware/browser hijack issues!

Alex NightWatcher: Solved! (5 / 5)

Adware.Agent.vwm also known as Application.GenericKD.3619489, Adware.Softcnapp.20, GrayWare[AdWare:not-a-virus,HEUR]/Win32.Agent.

Malware Analysis of Adware.Agent.vwm – VAST.DLL

Created files:

%Program Files%\luoshenli\SoftUpd.exe
%Program Files%\luoshenli\uninst.exe
%Program Files%\luoshenli\vast.dll
%Program Files%\luoshenli\????.url
%Program Files%\MoonXY\lander.ini

Autostart registry keys:

HKLM\Software\Classes\Applications\QQLiveUninstaller.exe\NoStartPage: “”
HKLM\SOFTWARE\CLASSES\CLSID\{1DABF8D5-8430-4985-9B7F-A30E53D709B3}\INPROCSERVER32\: “%SYSDIR%\MMINSTALLER.DLL”
HKLM\Software\Classes\CLSID\{4A8FD414-1EBF-4EBD-A158-0D09B005A17F}\InprocServer32\: “%Program Files%\Tencent\QQLive\9.16.1664.0\LiveAPI.dll”
HKLM\Software\Classes\CLSID\{5EF7B131-C278-4034-BC88-2CE28B128681}\InprocServer32\: “%Program Files%\Tencent\QQLive\9.16.1664.0\LiveOcx.dll”
HKLM\Software\Classes\CLSID\{828D7162-6DA3-4D67-97D0-E87CEC4C8D0D}\InprocServer32\: “%Program Files%\Tencent\QQLive\9.16.1664.0\LiveAPI.dll”
HKLM\Software\Classes\CLSID\{D9EBCF5D-3F8F-4B6A-89BA-70577BE73C62}\InprocServer32\: “%Program Files%\Tencent\QQLive\9.16.1664.0\LiveAPI.dll”
HKLM\Software\Classes\CLSID\{F7E55BDF-9528-46BA-B550-777859627591}\InprocServer32\: “%Program Files%\Tencent\QQLive\9.16.1664.0\LiveOcx.dll”
HKLM\Software\Classes\qqlive\shell\open\command\: “”%Program Files%\Tencent\QQLive\9.16.1664.0\QQLive.exe” “%1″”
HKLM\Software\Classes\QQLive.qlv\Shell\open\Command\: “”%Program Files%\Tencent\QQLive\9.16.1664.0\QQLive.exe” “qqlive://playlocal/file=%1″”
HKLM\Software\Classes\qqtv\shell\open\command\: “”%Program Files%\Tencent\QQLive\9.16.1664.0\QQLive.exe” “%1″”
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\rlbRunByWindowsStart: “”%Program Files%\luoshenli\lsl.exe” RunDateByStartAuto”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\qqlive\UninstallString: “”%Program Files%\Tencent\QQLive\9.16.1664.0\QQLiveUninstaller.exe””
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\qqlive\DisplayName: “????”
HKLM\System\CurrentControlSet\services\QQLiveService\ImagePath: “%SystemRoot%\system32\svchost -k QQLiveService”
HKLM\System\CurrentControlSet\services\QQLiveService\DisplayName: “QQLiveService”
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\qqlive: “”%Program Files%\Tencent\QQLive\9.16.1664.0\QQLive.exe” -system_startup”

Detected by UnHackMe:

VAST.DLL
Default location: %PROGRAM FILES%\LUOSHENLI\VAST.DLL

Dropper hash(md5): 4579332fa3d69af4d40fe4da62f27d64

Written by NightWatcher

Malware Hunter.
Google+

UnHackMe removes malware invisible for your antivirus!

UnHackMe is compatible with most antivirus software.
UnHackMe is 100% CLEAN, which means it does not contain any form of malware, including adware, spyware, viruses, trojans and backdoors. VirusTotal (0/56).
System Requirements: Windows 2000-Windows 8.1/10. UnHackMe uses minimum of computer resources.