Dmitry Sokolov recommends UnHackMe!

UnHackMe is a powerful tool against malware.

UnHackMe quickly removes rootkits/malware/adware/browser hijack issues!

Alex NightWatcher: Solved! (5 / 5)

Artemis!8B234E634C21 also known as Trojan.Siggen6.30811, Gen:Variant.Graftor.174409, W32/S-a0794798!Eldorado.

Malware Analysis of Artemis!8B234E634C21 – PRICECHOP.EXE

Created files:

%Program Files%\PPriceeChop\67zWOjnD4LKbBY.tlb
%Program Files%\PRiceChop\PRiceChop.dat
%Program Files%\PRiceChop\PRiceChop.exe
%Program Files%\TrimAppend\TrimAppend.dll
%Program Files%\youtubeadblocker\NVkJAi7vMKtr1f.dat

Autostart registry keys:

HKLM\Software\Classes\CLSID\{9baf546a-ac20-4c8c-8eb8-a448bc564153}\InprocServer32\: “%Program Files%\youtubeadblocker\NVkJAi7vMKtr1f.dll”
HKLM\Software\Classes\CLSID\{e03921d7-3d13-48d3-8445-a9ffb5354816}\InprocServer32\: “%Program Files%\PPriceeChop\67zWOjnD4LKbBY.dll”
HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}\DisplayName: “mystartsearch”
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\D20352A90C039D93DBF6126ECE614057\InstallProperties\UninstallString: “MsiExec.exe /X{9A25302D-30C0-39D9-BD6F-21E6EC160475}”
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\D20352A90C039D93DBF6126ECE614057\InstallProperties\DisplayName: “Microsoft Visual C++ 2008 Redistributable – x86 9.0.30729.17”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\MyPC Backup\DisplayName: “MyPC Backup ”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\MyPC Backup\UninstallString: “%Program Files%\MyPC Backup\uninst.exe”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}{f5653603}\UninstallString: “”%SysDir%\RUNDLL32.EXE” “C:\PROGRA~1\TRIMAP~1\TRIMAP~1.DLL”,_uninstall /un”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}{f5653603}\DisplayName: “SustainerPlus”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{4820778D-AB0D-6D18-C316-52A6A0E1D507}\DisplayName: “youtubeadblocker”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{4820778D-AB0D-6D18-C316-52A6A0E1D507}\UninstallString: “”%Program Files%\youtubeadblocker\NVkJAi7vMKtr1f.exe” /s /n /i:”ExecuteCommands;UninstallCommands” “””
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{9A25302D-30C0-39D9-BD6F-21E6EC160475}\UninstallString: “MsiExec.exe /X{9A25302D-30C0-39D9-BD6F-21E6EC160475}”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{9A25302D-30C0-39D9-BD6F-21E6EC160475}\DisplayName: “Microsoft Visual C++ 2008 Redistributable – x86 9.0.30729.17”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{AD11DADE-C597-45D9-D8C5-1D2EB0B89613}\DisplayName: “Context Menu Search”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{AD11DADE-C597-45D9-D8C5-1D2EB0B89613}\UninstallString: “”%Program Files%\Context Menu Search\Context Menu Search.exe” /s /n /i:”ExecuteCommands;UninstallCommands” “””
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{D8A9D3D9-F414-952D-AC93-E5F96D47B5BD}\DisplayName: “PPriceeChop”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{D8A9D3D9-F414-952D-AC93-E5F96D47B5BD}\UninstallString: “”%Program Files%\PPriceeChop\67zWOjnD4LKbBY.exe” /s /n /i:”ExecuteCommands;UninstallCommands” “””
HKLM\System\CurrentControlSet\Services\BackupStack\ImagePath: “%Program Files%\MyPC Backup\BackupStack.exe”
HKLM\System\CurrentControlSet\Services\BackupStack\DisplayName: “Computer Backup (MyPC Backup)”
HKLM\System\CurrentControlSet\Services\f5653603\ImagePath: “”%SysDir%\rundll32.exe” “c:\Program Files\TrimAppend\TrimAppend.dll”,serv”
HKLM\System\CurrentControlSet\Services\f5653603\DisplayName: “TrimAppend”
HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}\DisplayName: “mystartsearch”
HKLM\Software\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command\: “”%Program Files%\Mozilla Firefox\firefox.exe” http://www.mystartsearch.com/?type=sc&ts=1424970328&from=wpc&uid=VMwareXVirtualXIDEXHardXDrive_00000000000000000001″
HKLM\Software\Clients\StartMenuInternet\Google Chrome\shell\open\command\: “”%Program Files%\Google\Chrome\Application\chrome.exe” http://www.mystartsearch.com/?type=sc&ts=1424970328&from=wpc&uid=VMwareXVirtualXIDEXHardXDrive_00000000000000000001″
HKLM\Software\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command\: “%Program Files%\Internet Explorer\iexplore.exe http://www.mystartsearch.com/?type=sc&ts=1424970328&from=wpc&uid=VMwareXVirtualXIDEXHardXDrive_00000000000000000001”
HKLM\Software\Clients\StartMenuInternet\VMWAREHOSTOPEN.EXE\shell\open\command\: “”%Program Files%\VMware\VMware Tools\VMwareHostOpen.exe” http://www.mystartsearch.com/?type=sc&ts=1424970328&from=wpc&uid=VMwareXVirtualXIDEXHardXDrive_00000000000000000001″

Detected by UnHackMe:

PRICECHOP.EXE
Default location: %PROGRAM FILES%\PRICECHOP\PRICECHOP.EXE

Dropper hash(md5): 48522f0e9ecd0300d731790cefe4bdcd

Written by NightWatcher

Malware Hunter.
Google+

UnHackMe removes malware invisible for your antivirus!

UnHackMe is compatible with most antivirus software.
UnHackMe is 100% CLEAN, which means it does not contain any form of malware, including adware, spyware, viruses, trojans and backdoors. VirusTotal (0/56).
System Requirements: Windows 2000-Windows 8.1/10. UnHackMe uses minimum of computer resources.