Dmitry Sokolov recommends UnHackMe!
UnHackMe is a powerful tool against malware.
UnHackMe quickly removes rootkits/malware/adware/browser hijack issues!
(5 / 5)
Adware.Mutabaha.1273 also known as Win32.Trojan.WisdomEyes.151026.9950.9975.
Malware Analysis of Adware.Mutabaha.1273 – COOLLEVALALYCONFIGURATIONTASK.EXE
Created files:
%WINDIR%\SVCPACK.LOG
%Program Files%\Coollevalaly\coollevalalyconfigurationService.html5
%Program Files%\Coollevalaly\coollevalalyconfigurationTask.exe
%Program Files%\Esuyjojeght\esysystem.dll
%Program Files%\Opera\38.0.2220.29\blink_deprecated_test_plugin.dll
Autostart registry keys:
HKLM\Software\Classes\Applications\opera.exe\shell\open\command\: “”%Program Files%\Opera\Launcher.exe” “%1″”
HKLM\Software\Classes\CLSID\{B89F5C49-51DB-4974-AB5A-E25901AA339C}\InprocServer32\: “%Program Files%\PC Speed Up\PCSUHelper.dll”
HKLM\Software\Classes\CLSID\{E9B5B0D2-D08A-49FC-8B5C-159B60BAA268}\InprocServer32\: “%Program Files%\PC Speed Up\PCSUHelper.dll”
HKLM\Software\Classes\OperaStable\shell\open\command\: “”%Program Files%\Opera\Launcher.exe” -noautoupdate — “%1″”
HKLM\Software\Clients\StartMenuInternet\OperaStable\shell\open\command\: “”%Program Files%\Opera\Launcher.exe””
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Opera 38.0.2220.29\DisplayName: “Opera Stable 38.0.2220.29”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Opera 38.0.2220.29\UninstallString: “”%Program Files%\Opera\Launcher.exe” /uninstall”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\PCSU-SL_is1\DisplayName: “PC Speed Up”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\PCSU-SL_is1\UninstallString: “”%Program Files%\PC Speed Up\unins000.exe””
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{28D0E562-CD9E-47A5-B50E-5D3F367F4F54}\UninstallString: “rundll32.exe “%Program Files%\Esuyjojeght\esysystem.dll”,u “/k={28D0E562-CD9E-47A5-B50E-5D3F367F4F54}””
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{28D0E562-CD9E-47A5-B50E-5D3F367F4F54}\DisplayName: “yessearches – Uninstall”
HKLM\System\CurrentControlSet\services\coollevalalyconfigurationService\ImagePath: “”%Program Files%\Coollevalaly\coollevalalyconfigurationService.html5″ {79740E79-A383-47A7-B513-3DF6563D007F} {8C4CE252-7DB2-4F8E-8E76-BAD0E5826A83}”
HKLM\System\CurrentControlSet\services\coollevalalyconfigurationService\DisplayName: “Coollevalaly Configuration”
HKLM\System\CurrentControlSet\services\PCSUService\ImagePath: “%Program Files%\PC Speed Up\PCSUService.exe”
HKLM\System\CurrentControlSet\services\PCSUService\DisplayName: “PC Speed Up Service”
HKLM\System\CurrentControlSet\services\SCService\ImagePath: “”%Program Files%\PC Speed Up\SpeedCheckerService.exe””
HKLM\System\CurrentControlSet\services\SCService\DisplayName: “SpeedChecker Service”
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\PCSpeedUp: “%Program Files%\PC Speed Up\PCSUNotifier.exe”
HKLM\Software\Classes\ftp\shell\open\command\: “”%Program Files%\Opera\launcher.exe” -noautoupdate — “%1″”
HKLM\Software\Classes\http\shell\open\command\: “”%Program Files%\Opera\launcher.exe” -noautoupdate — “%1″”
HKLM\Software\Classes\https\shell\open\command\: “”%Program Files%\Opera\launcher.exe” -noautoupdate — “%1″”
Detected by UnHackMe:
COOLLEVALALYCONFIGURATIONTASK.EXE
Default location: %PROGRAM FILES%\COOLLEVALALY\COOLLEVALALYCONFIGURATIONTASK.EXE
Dropper hash(md5): ee7f52549765fe952b754b951e7dc1e6
UnHackMe
removes malware invisible for your antivirus!
UnHackMe is 100% CLEAN, which means it does not contain any form of malware, including adware, spyware, viruses, trojans and backdoors. VirusTotal (0/56).
System Requirements: Windows 2000-Windows 8.1/10. UnHackMe uses minimum of computer resources.