Dmitry Sokolov recommends UnHackMe!

UnHackMe is a powerful tool against malware.

UnHackMe quickly removes rootkits/malware/adware/browser hijack issues!

Alex NightWatcher: Solved! (5 / 5)

Win32.Adware.Dealply.Glx also known as Win32:Adware-gen [Adw], Trojan.Win32.Generic!BT, Gen:Variant.Adware.Symmi.

Malware Analysis of Win32.Adware.Dealply.Glx – INSTALLER_243365530.EXE

Created files:

%Temp%\GoMailRu.ico
%Temp%\heu39T.nss
%Temp%\installer_243365530.exe
%Temp%\installer_356901555.exe
%Temp%\logs\myeasylog.log

Autostart registry keys:

HKLM\Software\Classes\CLSID\{14F4B774-7A5C-4DA0-9F38-94F695DC11BF}\LocalServer32\: “%Program Files%\Visual Protect Service\vsprotectproxy.exe”
HKLM\Software\Classes\CLSID\{665FF171-3952-44A4-8ACF-73112F083EBA}\LocalServer32\: “%Program Files%\Visual Protect Service\vsprotectproxy.exe”
HKLM\Software\Classes\CLSID\{8E8F97CD-60B5-456F-A201-73065652D099}\InprocServer32\: “%Local Appdata%\Mail.Ru\Sputnik\IESearchPlugin.dll”
HKLM\Software\Classes\CLSID\{90B76222-AF99-4CEF-A184-A01F910B4B8E}\LocalServer32\: “%Program Files%\Visual Protect Service\vsprotectproxy.exe”
HKLM\Software\Classes\CLSID\{B43ED7B8-FD23-4332-B6EC-ADEF7F217592}\LocalServer32\: “%Program Files%\Visual Protect Service\vsprotectproxy.exe”
HKLM\Software\Classes\CLSID\{b608cc98-54de-4775-96c9-097de398500c}\InProcServer32\: “%Local Appdata%\PriceFountain\PriceFountainIE.dll”
HKLM\Software\Classes\CLSID\{D8379725-3B2F-4283-B754-5EE2DE2ADB86}\LocalServer32\: “%Program Files%\Visual Protect Service\vsprotectproxy.exe”
HKLM\Software\Classes\CLSID\{DD81E8DB-AD66-43C0-8600-F6C26C928A5A}\InprocServer32\: “%Program Files%\Note-up\noteupshell0.dll”
HKLM\Software\Classes\CLSID\{FD15BD60-7777-4E7E-AB46-4AD7BB299BFB}\LocalServer32\: “%Program Files%\Visual Protect Service\vsprotectproxy.exe”
HKLM\Software\Classes\CLSID\{FD2F9534-54A2-4B40-9C0B-35EF21ECAF5A}\LocalServer32\: “%Program Files%\Visual Protect Service\vsprotectproxy.exe”
HKLM\Software\Classes\AmigoHTML.NARYC4MAR452DWMECJZECYNNAA\shell\open\command\: “”%Local Appdata%\Amigo\Application\amigo.exe” — “%1″”
HKLM\Software\Classes\KometaHTM.NARYC4MAR452DWMECJZECYNNAA\shell\open\command\: “”%Local Appdata%\Kometa\Application\kometa.exe” — “%1″”
HKLM\Software\Clients\StartMenuInternet\amigo.exe\shell\open\command\: “”%Local Appdata%\Amigo\Application\amigo.exe””
HKLM\Software\Clients\StartMenuInternet\Amigo.NARYC4MAR452DWMECJZECYNNAA\shell\open\command\: “”%Local Appdata%\Amigo\Application\amigo.exe””
HKLM\Software\Clients\StartMenuInternet\kometa.exe\shell\open\command\: “”%Local Appdata%\Kometa\Application\kometa.exe””
HKLM\Software\Clients\StartMenuInternet\Kometa.NARYC4MAR452DWMECJZECYNNAA\shell\open\command\: “”%Local Appdata%\Kometa\Application\kometa.exe””
HKLM\Software\Google\Chrome\Extensions\nbifdkmdojgmpmopdebnjcobekgdoncn\update_url: “https://clients2.google.com/service/update2/crx”
HKLM\Software\Google\Chrome\Extensions\bpgangmffjcofiknibcmfjionicohfgj\update_url: “https://clients2.google.com/service/update2/crx”
HKLM\Software\Google\Chrome\Extensions\bgbgnhmfbcifpkjofoojfplmfkmaiadn\update_url: “https://clients2.google.com/service/update2/crx”
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ZaxarGameBrowser: “”%Program Files%\Zaxar\ZaxarGameBrowser.exe” -s”
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ZaxarLoader: “”%Program Files%\Zaxar\ZaxarLoader.exe” /verysilent”
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Timestasks: “C:\ProgramData\TimeTasks\timetasks.exe””
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\VSProtector: “%Program Files%\Visual Protect Service\VSProtector.exe /schema=altv /partner=1445256103”
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Note-up: “%Program Files%\Note-up\note-up.exe /watch”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Note-up\DisplayName: “Note-up”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Note-up\UninstallString: “%Program Files%\Note-up\uninstall.exe”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\NUIns\DisplayName: “Note-UP”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\NUIns\UninstallString: “”%Appdata%\NUIns\Uninstall.exe””
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\ZaxarGameBrowser\DisplayName: “ZaxarGameBrowser”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\ZaxarGameBrowser\UninstallString: “”%Program Files%\Zaxar\uninstall.exe””
HKLM\System\CurrentControlSet\Services\gamexpsvc\ImagePath: “”%Program Files%\GameXPService\gamexpsvc.exe””
HKLM\System\CurrentControlSet\Services\gamexpsvc\DisplayName: “GameXP Service”
HKLM\System\CurrentControlSet\Services\Updater.Mail.Ru\ImagePath: “%Program Files%\Mail.Ru\MailRuUpdater\MailRuUpdater.exe –s”
HKLM\System\CurrentControlSet\Services\Updater.Mail.Ru\DisplayName: “Updater.Mail.Ru”
HKLM\System\CurrentControlSet\Services\VSProtectProxy\ImagePath: “%Program Files%\Visual Protect Service\vsprotectproxy.exe”
HKLM\System\CurrentControlSet\Services\VSProtectProxy\DisplayName: “VSProtectProxy”
HKLM\System\CurrentControlSet\Services\VSUpdater\ImagePath: “%Program Files%\VideoDownloader\VSUpdater.exe –service”
HKLM\System\CurrentControlSet\Services\VSUpdater\DisplayName: “Visual Proctect Updater”
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\MailRuUpdater: “%Local Appdata%\Mail.Ru\MailRuUpdater.exe”
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\MyDesktop: “%Appdata%\MyDesktop\linkme.exe /killme_99 /restoreme_99 /url_cis”
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\GameXP AccessPoint: “”C:\GameXP\AccessPoint\accesspoint.exe” -silent”
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\KometaLaunchPanel: “%Local Appdata%\Kometa\Panel\KometaLaunchPanel.exe”
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\amigo: “%Local Appdata%\Amigo\Application\amigo.exe –no-startup-window”
HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\TimeTasks\DisplayName: “Time tasks”
HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\TimeTasks\UninstallString: “”C:\ProgramData\TimeTasks\uninstall.exe””
HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\PriceFountain\DisplayName: “PriceFountain (remove only)”
HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\PriceFountain\UninstallString: “”%Local Appdata%\PriceFountain\uninst.exe” /uninstall”
HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\MailRuUpdater\UninstallString: “%Local Appdata%\Mail.Ru\MailRuUpdater.exe uninstall”
HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\KometaLaunchPanel\UninstallString: “”%Local Appdata%\Kometa\Panel\1.0.0.763\panelremove.exe””
HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Kometa\DisplayName: “Kometa”
HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Kometa\UninstallString: “”%Local Appdata%\Kometa\Application\45.0.2454.101\Installer\setup.exe” –uninstall”
HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Amigo\DisplayName: “Amigo”
HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Amigo\UninstallString: “”%Local Appdata%\Amigo\Application\32.0.1725.115\Installer\setup.exe” –uninstall”
HKCU\Software\Amigo\UninstallString: “%Local Appdata%\Amigo\Application\32.0.1725.115\Installer\setup.exe”
HKCU\Software\NetBox\Kometa\UninstallString: “%Local Appdata%\Kometa\Application\45.0.2454.101\Installer\setup.exe”

Detected by UnHackMe:

INSTALLER_243365530.EXE
Default location: %TEMP%\INSTALLER_243365530.EXE

Dropper hash(md5): 182869ee718819fa2cfcdd020551a14e

Written by NightWatcher

Malware Hunter.
Google+

UnHackMe removes malware invisible for your antivirus!

UnHackMe is compatible with most antivirus software.
UnHackMe is 100% CLEAN, which means it does not contain any form of malware, including adware, spyware, viruses, trojans and backdoors. VirusTotal (0/56).
System Requirements: Windows 2000-Windows 8.1/10. UnHackMe uses minimum of computer resources.