Dmitry Sokolov recommends UnHackMe!

UnHackMe is a powerful tool against malware.

UnHackMe quickly removes rootkits/malware/adware/browser hijack issues!

Alex NightWatcher: Solved! (5 / 5)

Adware.Wajam.163 also known as ADWARE/Wajam.ME.4, not-a-virus:HEUR:Downloader.Win32.Wajam.gen, Trj/Genetic.gen.

Malware Analysis of Adware.Wajam.163 – AA88CAFD4B9E0B2E4E90BA59E39F7A27.DLL

Created files:

%Program Files%\6d6a8ce4ba2d58e7cbdb3e5a6940b53f\6d8140ce72ccccf73f0faaaf4eec1bee.json
%Program Files%\6d6a8ce4ba2d58e7cbdb3e5a6940b53f\7a563f31b0713ec816c2b11d40b1ebeb
%Program Files%\6d6a8ce4ba2d58e7cbdb3e5a6940b53f\aa88cafd4b9e0b2e4e90ba59e39f7a27.dll
%Program Files%\6d6a8ce4ba2d58e7cbdb3e5a6940b53f\dc12bff029c9911e663de42d3c59ab56.exe
%Program Files%\6d6a8ce4ba2d58e7cbdb3e5a6940b53f\e72175928f5486845841a85b08b1b466\cpsijb.dll

Autostart registry keys:

HKLM\Software\Classes\CLSID\{431532BD-0AE1-4ABC-BE8C-919F3D1332E2}\InProcServer32\: “%Program Files%\6d6a8ce4ba2d58e7cbdb3e5a6940b53f\aa88cafd4b9e0b2e4e90ba59e39f7a27.dll”
HKLM\Software\Classes\CLSID\{5D64294B-1341-4FE7-B6D8-7C36828D4DD5}\InprocServer32\: “%Program Files%\6d6a8ce4ba2d58e7cbdb3e5a6940b53f\aa88cafd4b9e0b2e4e90ba59e39f7a27.dll”
HKLM\Software\Classes\CLSID\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C}\InprocServer32\: “%Program Files%\6d6a8ce4ba2d58e7cbdb3e5a6940b53f\aa88cafd4b9e0b2e4e90ba59e39f7a27.dll”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\6d6a8ce4ba2d58e7cbdb3e5a6940b53f\DisplayName: “Wajam”
HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\6D6A8CE4BA2D58E7CBDB3E5A6940B53F\UNINSTALLSTRING: “%WINDIR%\58B5529C7D303214662127CAF2F07FCF.EXE”
HKLM\System\CurrentControlSet\services\107c945f55f2365442e3d92696aa9d70\ImagePath: “system32\DRIVERS\107c945f55f2365442e3d92696aa9d70.sys”
HKLM\System\CurrentControlSet\services\107c945f55f2365442e3d92696aa9d70\DisplayName: “107c945f55f2365442e3d92696aa9d70”
HKLM\System\CurrentControlSet\services\426007ec9c2389f263ce86529ff1c657\ImagePath: “”%Program Files%\6d6a8ce4ba2d58e7cbdb3e5a6940b53f\115634103eb284b7e79db6a97b6c185a.exe””
HKLM\System\CurrentControlSet\services\426007ec9c2389f263ce86529ff1c657\DisplayName: “426007ec9c2389f263ce86529ff1c657”

Detected by UnHackMe:

AA88CAFD4B9E0B2E4E90BA59E39F7A27.DLL
Default location: %PROGRAM FILES%\6D6A8CE4BA2D58E7CBDB3E5A6940B53F\AA88CAFD4B9E0B2E4E90BA59E39F7A27.DLL

Dropper hash(md5): 33fa9ea189a8df5f588778a423aec4e3

Written by NightWatcher

Malware Hunter.
Google+

UnHackMe removes malware invisible for your antivirus!

UnHackMe is compatible with most antivirus software.
UnHackMe is 100% CLEAN, which means it does not contain any form of malware, including adware, spyware, viruses, trojans and backdoors. VirusTotal (0/56).
System Requirements: Windows 2000-Windows 8.1/10. UnHackMe uses minimum of computer resources.