Dmitry Sokolov recommends UnHackMe!

UnHackMe is a powerful tool against malware.

UnHackMe quickly removes rootkits/malware/adware/browser hijack issues!

Alex NightWatcher: Solved! (5 / 5)

not-a-virus:AdWare.Win32.Esprot.axlm also known as suspected of Heur.Malware-Cryptor.Multiplug, Trj/Genetic.gen.

Malware Analysis of not-a-virus:AdWare.Win32.Esprot.axlm – BONDEDSUPPORT.XYZ.EXE

Created files:

%Temp%\6000\temp\bg.ca
%Temp%\6000\temp\BondedSupport.xyz
%Temp%\6000\temp\BondedSupport.xyz.exe
%Temp%\6000\temp\task(2).ini
%Temp%\6000\temp\task(3).ini

Autostart registry keys:

HKLM\Software\Classes\CLSID\{109040B5-95F6-4BC0-9391-5DDB6853749F}\InprocServer32\: “%Program Files%\bestadblocker\Z7bfXkoBo67Yg3.dll”
HKLM\Software\Classes\CLSID\{1679A11D-6384-455C-9FC5-845CD7F6D775}\InprocServer32\: “%Program Files%\CutThePrice\SfneUl1Jq0K7XR.dll”
HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}\DisplayName: “mystartsearch”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}{5062bb06}\UninstallString: “”%SysDir%\RUNDLL32.EXE” “C:\PROGRA~1\SYSTEM~1\SYSTEM~1.DLL”,_uninstall /un”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}{5062bb06}\DisplayName: “BondedSupport”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{4820778D-AB0D-6D18-C316-52A6A0E1D507}\DisplayName: “bestadblocker”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{4820778D-AB0D-6D18-C316-52A6A0E1D507}\UninstallString: “”%Program Files%\bestadblocker\Z7bfXkoBo67Yg3.exe” /s /n /i:”ExecuteCommands;UninstallCommands” “””
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{A2C98B47-B5F4-94AA-281D-4135416774CF}\DisplayName: “CutThePrice”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{A2C98B47-B5F4-94AA-281D-4135416774CF}\UninstallString: “”%Program Files%\CutThePrice\SfneUl1Jq0K7XR.exe” /s /n /i:”ExecuteCommands;UninstallCommands” “””
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{AD11DADE-C597-45D9-D8C5-1D2EB0B89613}\DisplayName: “HeroicPlay”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{AD11DADE-C597-45D9-D8C5-1D2EB0B89613}\UninstallString: “”%Program Files%\HeroicPlay\HeroicPlay.exe” /s /n /i:”ExecuteCommands;UninstallCommands” “””
HKLM\System\CurrentControlSet\Services\5062bb06\ImagePath: “”%SysDir%\rundll32.exe” “c:\Program Files\SystemPower\SystemPower.dll”,serv”
HKLM\System\CurrentControlSet\Services\5062bb06\DisplayName: “SystemPower”
HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}\DisplayName: “mystartsearch”

Detected by UnHackMe:

BONDEDSUPPORT.XYZ.EXE
Default location: %TEMP%\6000\TEMP\BONDEDSUPPORT.XYZ.EXE

Dropper hash(md5): 1d7fd14bd0de20be5885cb59ff2436aa

Written by NightWatcher

Malware Hunter.
Google+

UnHackMe removes malware invisible for your antivirus!

UnHackMe is compatible with most antivirus software.
UnHackMe is 100% CLEAN, which means it does not contain any form of malware, including adware, spyware, viruses, trojans and backdoors. VirusTotal (0/56).
System Requirements: Windows 2000-Windows 8.1/10. UnHackMe uses minimum of computer resources.