Dmitry Sokolov recommends UnHackMe!

UnHackMe is a powerful tool against malware.

UnHackMe quickly removes rootkits/malware/adware/browser hijack issues!

Alex NightWatcher: Solved! (5 / 5)

MultiPlug-FDJ also known as Trojan.BPlug.920, Gen:Variant.Adware.Zusy.121779, Gen:Variant.Adware.Zusy.121779.

Malware Analysis of MultiPlug-FDJ – EP9AFQA2YMKAKK.DLL

Created files:

%Program Files%\Sinhala Meaning\Sinhala Meaning.exe
%Program Files%\uNisaales\eP9AFqa2YMKakK.dat
%Program Files%\uNisaales\eP9AFqa2YMKakK.dll
%Program Files%\uNisaales\eP9AFqa2YMKakK.exe
%Program Files%\uNisaales\eP9AFqa2YMKakK.tlb

Autostart registry keys:

HKLM\Software\Classes\CLSID\{3026c654-b0a9-4fe3-8f8f-c55f9db74129}\InprocServer32\: “%Program Files%\uNisaales\eP9AFqa2YMKakK.dll”
HKLM\Software\Classes\CLSID\{5123f71b-ba83-4445-8a22-8cf25d24e784}\InprocServer32\: “%Program Files%\youtubeadblocker\fffIK31JD3eQtD.dll”
HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{BB74DE59-BC4C-4172-9AC4-73315F71CFFE}\DisplayName: “WebSearch”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}{c8ea8cd3}\UninstallString: “”%SysDir%\RUNDLL32.EXE” “C:\PROGRA~1\UPGRAD~1\UPGRAD~1.DLL”,_uninstall /un”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}{c8ea8cd3}\DisplayName: “BoxyAide”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{4820778D-AB0D-6D18-C316-52A6A0E1D507}\DisplayName: “youtubeadblocker”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{4820778D-AB0D-6D18-C316-52A6A0E1D507}\UninstallString: “”%Program Files%\youtubeadblocker\fffIK31JD3eQtD.exe” /s /n /i:”ExecuteCommands;UninstallCommands” “””
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{4CEE92A3-9F0C-51AB-ADC0-34EC24AD7B7E}\DisplayName: “uNisaales”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{4CEE92A3-9F0C-51AB-ADC0-34EC24AD7B7E}\UninstallString: “”%Program Files%\uNisaales\eP9AFqa2YMKakK.exe” /s /n /i:”ExecuteCommands;UninstallCommands” “””
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{AD11DADE-C597-45D9-D8C5-1D2EB0B89613}\DisplayName: “Sinhala Meaning”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{AD11DADE-C597-45D9-D8C5-1D2EB0B89613}\UninstallString: “”%Program Files%\Sinhala Meaning\Sinhala Meaning.exe” /s /n /i:”ExecuteCommands;UninstallCommands” “””
HKLM\System\CurrentControlSet\Services\c8ea8cd3\ImagePath: “”%SysDir%\rundll32.exe” “c:\Program Files\UpgradeStance\UpgradeStance.dll”,serv”
HKLM\System\CurrentControlSet\Services\c8ea8cd3\DisplayName: “UpgradeStance”
HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{BB74DE59-BC4C-4172-9AC4-73315F71CFFE}\DisplayName: “WebSearch”

Detected by UnHackMe:

EP9AFQA2YMKAKK.DLL
Default location: %PROGRAM FILES%\UNISAALES\EP9AFQA2YMKAKK.DLL

Dropper hash(md5): bbf7bc379d8d6c66333b894eca34fc52

Written by NightWatcher

Malware Hunter.
Google+

UnHackMe removes malware invisible for your antivirus!

UnHackMe is compatible with most antivirus software.
UnHackMe is 100% CLEAN, which means it does not contain any form of malware, including adware, spyware, viruses, trojans and backdoors. VirusTotal (0/56).
System Requirements: Windows 2000-Windows 8.1/10. UnHackMe uses minimum of computer resources.