Dmitry Sokolov recommends UnHackMe!

UnHackMe is a powerful tool against malware.

UnHackMe quickly removes rootkits/malware/adware/browser hijack issues!

Alex NightWatcher: Solved! (5 / 5)

Downloader.Wajam.rm also known as not-a-virus:HEUR:Downloader.Win32.Wajam.gen.

Malware Analysis of Downloader.Wajam.rm – 115634103EB284B7E79DB6A97B6C185A.EXE

Created files:

%Program Files%\6d6a8ce4ba2d58e7cbdb3e5a6940b53f\107c945f55f2365442e3d92696aa9d70.inf
%Program Files%\6d6a8ce4ba2d58e7cbdb3e5a6940b53f\107c945f55f2365442e3d92696aa9d70.sys
%Program Files%\6d6a8ce4ba2d58e7cbdb3e5a6940b53f\115634103eb284b7e79db6a97b6c185a.exe
%Program Files%\6d6a8ce4ba2d58e7cbdb3e5a6940b53f\1defff5bb7b35190c355a3323ca69e05.ico
%Program Files%\6d6a8ce4ba2d58e7cbdb3e5a6940b53f\2a9e2ea5d674bef56470eea8bbb668fb.exe

Autostart registry keys:

HKLM\Software\Classes\CLSID\{431532BD-0AE1-4ABC-BE8C-919F3D1332E2}\InProcServer32\: “%Program Files%\6d6a8ce4ba2d58e7cbdb3e5a6940b53f\aa88cafd4b9e0b2e4e90ba59e39f7a27.dll”
HKLM\Software\Classes\CLSID\{5D64294B-1341-4FE7-B6D8-7C36828D4DD5}\InprocServer32\: “%Program Files%\6d6a8ce4ba2d58e7cbdb3e5a6940b53f\aa88cafd4b9e0b2e4e90ba59e39f7a27.dll”
HKLM\Software\Classes\CLSID\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C}\InprocServer32\: “%Program Files%\6d6a8ce4ba2d58e7cbdb3e5a6940b53f\aa88cafd4b9e0b2e4e90ba59e39f7a27.dll”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\6d6a8ce4ba2d58e7cbdb3e5a6940b53f\DisplayName: “Wajam”
HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\6D6A8CE4BA2D58E7CBDB3E5A6940B53F\UNINSTALLSTRING: “%WINDIR%\58B5529C7D303214662127CAF2F07FCF.EXE”
HKLM\System\CurrentControlSet\services\107c945f55f2365442e3d92696aa9d70\ImagePath: “system32\DRIVERS\107c945f55f2365442e3d92696aa9d70.sys”
HKLM\System\CurrentControlSet\services\107c945f55f2365442e3d92696aa9d70\DisplayName: “107c945f55f2365442e3d92696aa9d70”
HKLM\System\CurrentControlSet\services\426007ec9c2389f263ce86529ff1c657\ImagePath: “”%Program Files%\6d6a8ce4ba2d58e7cbdb3e5a6940b53f\115634103eb284b7e79db6a97b6c185a.exe””
HKLM\System\CurrentControlSet\services\426007ec9c2389f263ce86529ff1c657\DisplayName: “426007ec9c2389f263ce86529ff1c657”

Detected by UnHackMe:

115634103EB284B7E79DB6A97B6C185A.EXE
Default location: %PROGRAM FILES%\6D6A8CE4BA2D58E7CBDB3E5A6940B53F\115634103EB284B7E79DB6A97B6C185A.EXE

Dropper hash(md5): 33fa9ea189a8df5f588778a423aec4e3

Written by NightWatcher

Malware Hunter.
Google+

UnHackMe removes malware invisible for your antivirus!

UnHackMe is compatible with most antivirus software.
UnHackMe is 100% CLEAN, which means it does not contain any form of malware, including adware, spyware, viruses, trojans and backdoors. VirusTotal (0/56).
System Requirements: Windows 2000-Windows 8.1/10. UnHackMe uses minimum of computer resources.