Dmitry Sokolov recommends UnHackMe!
UnHackMe is a powerful tool against malware.
UnHackMe quickly removes rootkits/malware/adware/browser hijack issues!
(5 / 5)
APPL/Wews87.AI also known as Adware.Wews87CRTD.Win32.3633.
Malware Analysis of APPL/Wews87.AI – NPLOG.DLL
Created files:
%APPDATA%\MACROMEDIA\FLASH PLAYER\MACROMEDIA.COM\SUPPORT\FLASHPLAYER\SYS\#IRS01.NET\SETTINGS.SOL
%APPDATA%\MACROMEDIA\FLASH PLAYER\MACROMEDIA.COM\SUPPORT\FLASHPLAYER\SYS\SETTINGS.SOL
%APPDATA%\MOONXY\NPLOG.DLL
%APPDATA%\TENCENT\LOGS\QQLIVESERVICE.TLG
%APPDATA%\TENCENT\LOGS\REGSVR32.TLG
Autostart registry keys:
HKLM\Software\Classes\Applications\QQLiveUninstaller.exe\NoStartPage: “”
HKLM\SOFTWARE\CLASSES\CLSID\{1DABF8D5-8430-4985-9B7F-A30E53D709B3}\INPROCSERVER32\: “%SYSDIR%\MMINSTALLER.DLL”
HKLM\Software\Classes\CLSID\{4A8FD414-1EBF-4EBD-A158-0D09B005A17F}\InprocServer32\: “%Program Files%\Tencent\QQLive\9.16.1664.0\LiveAPI.dll”
HKLM\Software\Classes\CLSID\{5EF7B131-C278-4034-BC88-2CE28B128681}\InprocServer32\: “%Program Files%\Tencent\QQLive\9.16.1664.0\LiveOcx.dll”
HKLM\Software\Classes\CLSID\{828D7162-6DA3-4D67-97D0-E87CEC4C8D0D}\InprocServer32\: “%Program Files%\Tencent\QQLive\9.16.1664.0\LiveAPI.dll”
HKLM\SOFTWARE\CLASSES\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LOCALSERVER32\: “%SYSDIR%\MACROMED\FLASH\FLASHUTIL32_23_0_0_207_ACTIVEX.EXE”
HKLM\SOFTWARE\CLASSES\CLSID\{D27CDB6E-AE6D-11CF-96B8-444553540000}\INPROCSERVER32\: “%SYSDIR%\MACROMED\FLASH\FLASH32_23_0_0_207.OCX”
HKLM\SOFTWARE\CLASSES\CLSID\{D27CDB70-AE6D-11CF-96B8-444553540000}\INPROCSERVER32\: “%SYSDIR%\MACROMED\FLASH\FLASH32_23_0_0_207.OCX”
HKLM\Software\Classes\CLSID\{D9EBCF5D-3F8F-4B6A-89BA-70577BE73C62}\InprocServer32\: “%Program Files%\Tencent\QQLive\9.16.1664.0\LiveAPI.dll”
HKLM\Software\Classes\CLSID\{F7E55BDF-9528-46BA-B550-777859627591}\InprocServer32\: “%Program Files%\Tencent\QQLive\9.16.1664.0\LiveOcx.dll”
HKLM\Software\Classes\MacromediaFlashPaper.MacromediaFlashPaper\shell\open\command\: “”%Program Files%\Mozilla Firefox\firefox.exe” -osint -url “%1″”
HKLM\Software\Classes\qqlive\shell\open\command\: “”%Program Files%\Tencent\QQLive\9.16.1664.0\QQLive.exe” “%1″”
HKLM\Software\Classes\QQLive.qlv\Shell\open\Command\: “”%Program Files%\Tencent\QQLive\9.16.1664.0\QQLive.exe” “qqlive://playlocal/file=%1″”
HKLM\Software\Classes\qqtv\shell\open\command\: “”%Program Files%\Tencent\QQLive\9.16.1664.0\QQLive.exe” “%1″”
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\rlbRunByWindowsStart: “”%Program Files%\meirenli\mrl.exe” RunDateByStartAuto”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Flash Player ActiveX\DisplayName: “Adobe Flash Player 23 ActiveX”
HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER ACTIVEX\UNINSTALLSTRING: “%SYSDIR%\MACROMED\FLASH\FLASHUTIL32_23_0_0_207_ACTIVEX.EXE -MAINTAIN ACTIVEX”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\qqlive\UninstallString: “”%Program Files%\Tencent\QQLive\9.16.1664.0\QQLiveUninstaller.exe””
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\qqlive\DisplayName: “????”
HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\ADOBEFLASHPLAYERUPDATESVC\IMAGEPATH: “%SYSDIR%\MACROMED\FLASH\FLASHPLAYERUPDATESERVICE.EXE”
HKLM\System\CurrentControlSet\services\AdobeFlashPlayerUpdateSvc\DisplayName: “Adobe Flash Player Update Service”
HKLM\System\CurrentControlSet\services\QQLiveService\ImagePath: “%SystemRoot%\system32\svchost -k QQLiveService”
HKLM\System\CurrentControlSet\services\QQLiveService\DisplayName: “QQLiveService”
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\qqlive: “”%Program Files%\Tencent\QQLive\9.16.1664.0\QQLive.exe” -system_startup”
Detected by UnHackMe:
NPLOG.DLL
DEFAULT LOCATION: %APPDATA%\MOONXY\NPLOG.DLL
Dropper hash(md5): f11694e996bfaac70ed19128d6780f68
UnHackMe
removes malware invisible for your antivirus!
UnHackMe is 100% CLEAN, which means it does not contain any form of malware, including adware, spyware, viruses, trojans and backdoors. VirusTotal (0/56).
System Requirements: Windows 2000-Windows 8.1/10. UnHackMe uses minimum of computer resources.