Dmitry Sokolov recommends UnHackMe!
UnHackMe is a powerful tool against malware.UnHackMe quickly removes rootkits/malware/adware/browser hijack issues!
Adware.Mutabaha.793 also known as FraudTool.YAC, Elex Installer (fs).
Malware Analysis of Adware.Mutabaha.793 – ISAFEMOPTV.DLL
Created files:
%Program Files%\Elex-tech\YAC\isafemgc.dll
%Program Files%\Elex-tech\YAC\iSafeMon.dll
%Program Files%\Elex-tech\YAC\isafemoptv.dll
%Program Files%\Elex-tech\YAC\isafemsmv.dll
%Program Files%\Elex-tech\YAC\isafemvsv.dll
Autostart registry keys:
HKLM\Software\Classes\CLSID\{5411D116-5A37-47D4-B154-5F7FCD9062F0}\InprocServer32\: “%Program Files%\Elex-tech\YAC\iSafeRKScanShell.dll”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\iSafe\DisplayName: “YAC(Yet Another Cleaner!)”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\iSafe\UninstallString: “%Program Files%\Elex-tech\YAC\uninstall.exe”
HKLM\System\CurrentControlSet\Services\iSafeKrnl\ImagePath: “\??\%Program Files%\Elex-tech\YAC\iSafeKrnl.sys”
HKLM\System\CurrentControlSet\Services\iSafeKrnl\DisplayName: “YAC Mini-Filter Driver”
HKLM\System\CurrentControlSet\Services\iSafeKrnlBoot\ImagePath: “system32\DRIVERS\iSafeKrnlBoot.sys”
HKLM\System\CurrentControlSet\Services\iSafeKrnlBoot\DisplayName: “YAC Boot Driver”
HKLM\System\CurrentControlSet\Services\iSafeKrnlKit\ImagePath: “\??\%Program Files%\Elex-tech\YAC\iSafeKrnlKit.sys”
HKLM\System\CurrentControlSet\Services\iSafeKrnlKit\DisplayName: “YAC Kit Driver”
HKLM\System\CurrentControlSet\Services\iSafeKrnlMon\ImagePath: “\??\%Program Files%\Elex-tech\YAC\iSafeKrnlMon.sys”
HKLM\System\CurrentControlSet\Services\iSafeKrnlMon\DisplayName: “YAC Monitor Driver”
HKLM\System\CurrentControlSet\Services\iSafeKrnlR3\ImagePath: “\??\%Program Files%\Elex-tech\YAC\iSafeKrnlR3.sys”
HKLM\System\CurrentControlSet\Services\iSafeKrnlR3\DisplayName: “YAC Ring3 Driver”
HKLM\System\CurrentControlSet\Services\iSafeNetFilter\ImagePath: “system32\DRIVERS\iSafeNetFilter.sys”
HKLM\System\CurrentControlSet\Services\iSafeNetFilter\DisplayName: “YAC NDIS Driver”
HKLM\System\CurrentControlSet\Services\iSafeService\ImagePath: “%Program Files%\Elex-tech\YAC\iSafeSvc.exe”
HKLM\System\CurrentControlSet\Services\iSafeService\DisplayName: “YAC Service”
HKLM\Software\Clients\StartMenuInternet\VMWAREHOSTOPEN.EXE\shell\open\command\: “”c:\program files\vmware\vmware tools\vmwarehostopen.exe””
Detected by UnHackMe:
ISAFEMOPTV.DLL
Default location: %PROGRAM FILES%\ELEX-TECH\YAC\ISAFEMOPTV.DLL
Dropper hash(md5): 4bc5cf1eaf404fb8bd1c0bb5ba1dcc13
UnHackMe
removes malware invisible for your antivirus!
UnHackMe is 100% CLEAN, which means it does not contain any form of malware, including adware, spyware, viruses, trojans and backdoors. VirusTotal (0/56).
System Requirements: Windows 2000-Windows 8.1/10. UnHackMe uses minimum of computer resources.