Dmitry Sokolov recommends UnHackMe!

UnHackMe is a powerful tool against malware.

UnHackMe quickly removes rootkits/malware/adware/browser hijack issues!

Alex NightWatcher: Solved! (5 / 5)

Variant.Adware.Symmi!c also known as W32.eHeur.Downloader.

Malware Analysis of Variant.Adware.Symmi!c – WPSHOSTHELPER.DLL

Created files:

%Appdata%\IQIYI Video\LStyle\vmPage\vmconfig.ini
%Appdata%\IQIYI Video\LStyle\vmPage\vmPage.ini
%Appdata%\IQIYI Video\LStyle\wpshosthelper.dll
%Appdata%\IQIYI Video\PluginConfig\apk\LStyle_0\iqiyi_985.apk_0
%Appdata%\IQIYI Video\PluginConfig\apk\LStyle_0\iqiyi_985.apk_1

Autostart registry keys:

HKLM\Software\Classes\Applications\anote.exe\NoStartPage: “”
HKLM\Software\Classes\Applications\uninstall.exe\NoStartPage: “”
HKLM\Software\Classes\CLSID\{085CB97F-6D0B-487D-B94C-E11A736C38CE}\InprocServer32\: “%Program Files%\IQIYI Video\LStyle\QYPlugin.dll”
HKLM\Software\Classes\CLSID\{307B3CDB-9EE3-4137-9D18-F9AD6537ECEB}\InprocServer32\: “%Program Files%\IQIYI Video\LStyle\Accelerator\IEHelper.dll”
HKLM\Software\Classes\CLSID\{5E6A8DA1-5731-465B-B036-B9E16EF26CAC}\InprocServer32\: “%Program Files%\IQIYI Video\LStyle\QYPlugin.dll”
HKLM\Software\Classes\CLSID\{CF3CDEFB-31BE-43AE-B064-B9C62C883259}\Shell\Open\Command\: “%Program Files%\IQIYI Video\LStyle\QyClient.exe web_startup_tray”
HKLM\Software\Classes\CLSID\{CF3CDEFB-31BE-43AE-B064-B9C62C883259}\InProcServer32\: “shdocvw.dll”
HKLM\Software\Classes\CLSID\{FB4F6285-4C32-49F2-950F-A5998F9CEC6C}\InprocServer32\: “%Program Files%\IQIYI Video\LStyle\Accelerator\IEHelper.dll”
HKLM\Software\Classes\bdhd\shell\open\command\: 22 43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73 5C 49 51 49 59 49 20 56 69 64 65 6F 5C 4C 53 74 79 6C 65 5C 51 79 43 6C 69 65 6E 74 2E 65 78 65 22 20 2D 70 70 73 74 72 65 61 6D 20 22 25 31 22 00 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 00 00 3F 3F 3F 3F 34 3F 02 00 3F 3F 00
HKLM\Software\Classes\magnet2\shell\open\command\: 22 43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73 5C 49 51 49 59 49 20 56 69 64 65 6F 5C 4C 53 74 79 6C 65 5C 51 79 43 6C 69 65 6E 74 2E 65 78 65 22 20 2D 70 70 73 74 72 65 61 6D 20 22 25 31 22 00 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 00 00 3F 3F 3F 3F 34 3F 02 00 3F 3F 00
HKLM\Software\Classes\pps\shell\open\command\: 22 43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73 5C 49 51 49 59 49 20 56 69 64 65 6F 5C 4C 53 74 79 6C 65 5C 51 79 43 6C 69 65 6E 74 2E 65 78 65 22 20 2D 70 70 73 74 72 65 61 6D 20 22 25 31 22 00 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 00 00 3F 3F 3F 3F 34 3F 02 00 3F 3F 00
HKLM\Software\Classes\ppsrun\shell\open\command\: 22 43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73 5C 49 51 49 59 49 20 56 69 64 65 6F 5C 4C 53 74 79 6C 65 5C 51 79 43 6C 69 65 6E 74 2E 65 78 65 22 20 2D 70 70 73 74 72 65 61 6D 20 22 25 31 22 00 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 00 00 3F 3F 3F 3F 34 3F 02 00 3F 3F 00
HKLM\Software\Classes\ppstream\shell\open\command\: 22 43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73 5C 49 51 49 59 49 20 56 69 64 65 6F 5C 4C 53 74 79 6C 65 5C 51 79 43 6C 69 65 6E 74 2E 65 78 65 22 20 2D 70 70 73 74 72 65 61 6D 20 22 25 31 22 00 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 00 00 3F 3F 3F 3F 34 3F 02 00 3F 3F 00
HKLM\Software\Classes\pps_pfv\shell\open\command\: “”%Program Files%\IQIYI Video\LStyle\QyClient.exe” -runfrom openfile “%1″”
HKLM\Software\Classes\pps_qsv\shell\open\command\: “”%Program Files%\IQIYI Video\LStyle\QyClient.exe” -runfrom openfile “%1″”
HKLM\Software\Classes\qips\shell\open\command\: 22 43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73 5C 49 51 49 59 49 20 56 69 64 65 6F 5C 4C 53 74 79 6C 65 5C 51 79 43 6C 69 65 6E 74 2E 65 78 65 22 20 2D 70 70 73 74 72 65 61 6D 20 22 25 31 22 00 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 00 00 3F 3F 3F 3F 34 3F 02 00 3F 3F 00
HKLM\Software\Classes\qisu\shell\open\command\: 22 43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73 5C 49 51 49 59 49 20 56 69 64 65 6F 5C 4C 53 74 79 6C 65 5C 51 79 43 6C 69 65 6E 74 2E 65 78 65 22 20 2D 70 70 73 74 72 65 61 6D 20 22 25 31 22 00 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 00 00 3F 3F 3F 3F 34 3F 02 00 3F 3F 00
HKLM\Software\Classes\qygameclient\shell\open\command\: “”%Program Files%\IQIYI Video\Common\QyGameClient\QyGameClient.exe” -qygameclient “%1″”
HKLM\Software\Microsoft\Active Setup\Installed Components\{65122CB0-EA0F-47DF-A953-017170ED12F9}\: “UC???”
HKLM\Software\Microsoft\Active Setup\Installed Components\{65122CB0-EA0F-47DF-A953-017170ED12F9}\StubPath: “”%Program Files%\UCBrowser\Application\5.5.10106.5\Installer\chrmstp.exe” –configure-user-settings –verbose-logging –system-level”
HKLM\Software\Microsoft\Active Setup\Installed Components\{65122CB0-EA0F-47DF-A953-017170ED12F9}\Localized Name: “UC???”
HKLM\Software\Microsoft\Active Setup\Installed Components\{65122CB0-EA0F-47DF-A953-017170ED12F9}\IsInstalled: 0x00000001
HKLM\Software\Microsoft\Active Setup\Installed Components\{65122CB0-EA0F-47DF-A953-017170ED12F9}\Version: “43,0,0,0”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\cqss\UninstallString: “%Program Files%\cqss\Uninst.exe”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\IQIYI Video\DisplayName: “???PPS??”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\IQIYI Video\UninstallString: “%Program Files%\IQIYI Video\LStyle\QyUninst.exe”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\PPStream\UninstallString: “%Program Files%\IQIYI Video\LStyle\QyUninst.exe”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\UCBrowser\DisplayName: “UC???”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\UCBrowser\UninstallString: “”%Program Files%\UCBrowser\Application\Uninstall.exe” –uninstall –system-level”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\win7dock_is1\DisplayName: “win7dock 2.0”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\win7dock_is1\UninstallString: “”%Program Files%\win7dock\UninsFiles\unins000.exe””
HKLM\Software\QiYi\QiSu\DisplayName: “?????4.0”
HKLM\Software\UCBrowser\UninstallString: “%Program Files%\UCBrowser\Application\Uninstall.exe”
HKLM\System\CurrentControlSet\Services\Bonjour Service\ImagePath: “%Program Files%\IQIYI Video\LStyle\mDNSResponder.exe”
HKLM\System\CurrentControlSet\Services\Bonjour Service\DisplayName: “Bonjour Service”
HKLM\System\CurrentControlSet\Services\QiyiService\ImagePath: “%Program Files%\IQIYI Video\LStyle\QiyiService.exe”
HKLM\System\CurrentControlSet\Services\QiyiService\DisplayName: “IQIYI Video Platform Service”
HKLM\System\CurrentControlSet\Services\UCBrowserSvc\ImagePath: “”%Program Files%\UCBrowser\Application\UCService.exe””
HKLM\System\CurrentControlSet\Services\UCBrowserSvc\DisplayName: “UC???????”
HKLM\System\CurrentControlSet\Services\UCGuard\ImagePath: “system32\DRIVERS\ucguard.sys”
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\win7dockrun: “”%Program Files%\win7dock\win7dockdesk.exe” apprun”
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\HCDNClient: “”%Program Files%\IQIYI Video\LStyle\QyKernel.exe” -shell_start”
HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{DA4D9024-DC28-49DA-80BF-54D561E3C06F}\DisplayName: “anote (v1.37) ”
HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{DA4D9024-DC28-49DA-80BF-54D561E3C06F}\UninstallString: “”%Program Files%\anote\uninstall.exe” _?=%Program Files%\anote”
HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\UnityWebPlayer\UninstallString: “%Local Appdata%\Unity\WebPlayer\Uninstall.exe /CurrentUser”
HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\UnityWebPlayer\DisplayName: “Unity Web Player”

Detected by UnHackMe:

WPSHOSTHELPER.DLL
Default location: %APPDATA%\IQIYI VIDEO\LSTYLE\WPSHOSTHELPER.DLL

Dropper hash(md5): bd17a759247aced5e4786f890dbd1d6d

Written by NightWatcher

Malware Hunter.
Google+

UnHackMe removes malware invisible for your antivirus!

UnHackMe is compatible with most antivirus software.
UnHackMe is 100% CLEAN, which means it does not contain any form of malware, including adware, spyware, viruses, trojans and backdoors. VirusTotal (0/56).
System Requirements: Windows 2000-Windows 8.1/10. UnHackMe uses minimum of computer resources.