Dmitry Sokolov recommends UnHackMe!

UnHackMe is a powerful tool against malware.

UnHackMe quickly removes rootkits/malware/adware/browser hijack issues!

Alex NightWatcher: Solved! (5 / 5)

Packer.Generic!c also known as PAK_Generic.005, PAK_Generic.005.

Malware Analysis of Packer.Generic!c – INJECTHELPER.EXE

Created files:

%Program Files%\YouKu\YoukuClient\imageformats\qico.dll
%Program Files%\YouKu\YoukuClient\imageformats\qjpeg.dll
%Program Files%\YouKu\YoukuClient\injectHelper.exe
%Program Files%\YouKu\YoukuClient\injectHelper64.exe
%Program Files%\YouKu\YoukuClient\msvcp100.dll

Autostart registry keys:

HKLM\Software\Classes\Applications\anote.exe\NoStartPage: “”
HKLM\Software\Classes\Applications\uninstall.exe\NoStartPage: “”
HKLM\Software\Classes\CLSID\{085CB97F-6D0B-487D-B94C-E11A736C38CE}\InprocServer32\: “%Program Files%\IQIYI Video\LStyle\QYPlugin.dll”
HKLM\Software\Classes\CLSID\{18E158C6-48EE-4411-A26A-B26334E238A2}\Shell\open\command\: “%Appdata%\ytmediacenter\YoukuMediaCenter.exe iku://|vidlib|fromother|”
HKLM\Software\Classes\CLSID\{18E158C6-48EE-4411-A26A-B26334E238A2}\InProcServer32\: “shdocvw.dll”
HKLM\Software\Classes\CLSID\{307B3CDB-9EE3-4137-9D18-F9AD6537ECEB}\InprocServer32\: “%Program Files%\IQIYI Video\LStyle\Accelerator\IEHelper.dll”
HKLM\Software\Classes\CLSID\{32C50D96-7A9E-4F3E-8763-F74D86AFEDC2}\InprocServer32\: “%Appdata%\ytmediacenter\report.dll”
HKLM\Software\Classes\CLSID\{5E6A8DA1-5731-465B-B036-B9E16EF26CAC}\InprocServer32\: “%Program Files%\IQIYI Video\LStyle\QYPlugin.dll”
HKLM\Software\Classes\CLSID\{7DC4B5B6-C122-44C4-825C-B310513A47CB}\InprocServer32\: “%Appdata%\ytmediacenter\ykcool.dll”
HKLM\Software\Classes\CLSID\{9071723E-9F41-4A8C-9CC2-EB6F94BA9B9E}\InprocServer32\: “%Appdata%\ytmediacenter\coreplay.dll”
HKLM\Software\Classes\CLSID\{CF3CDEFB-31BE-43AE-B064-B9C62C883259}\Shell\Open\Command\: “%Program Files%\IQIYI Video\LStyle\QyClient.exe web_startup_tray”
HKLM\Software\Classes\CLSID\{CF3CDEFB-31BE-43AE-B064-B9C62C883259}\InProcServer32\: “shdocvw.dll”
HKLM\Software\Classes\CLSID\{FB4F6285-4C32-49F2-950F-A5998F9CEC6C}\InprocServer32\: “%Program Files%\IQIYI Video\LStyle\Accelerator\IEHelper.dll”
HKLM\Software\Classes\360seURL\shell\open\command\: “”%Appdata%\360se6\Application\360se.exe” — “%1″”
HKLM\Software\Classes\bdhd\shell\open\command\: 22 43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73 5C 49 51 49 59 49 20 56 69 64 65 6F 5C 4C 53 74 79 6C 65 5C 51 79 43 6C 69 65 6E 74 2E 65 78 65 22 20 2D 70 70 73 74 72 65 61 6D 20 22 25 31 22 00 3F 3F 3F 3F 02 00 3F 3F 00 00 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 18 00 00 3F 3F 3F 3F 3F 3F 3F 55 3F 3F 3F 3F 3F 3F 3F 55 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
HKLM\Software\Classes\iKu\Shell\open\command\: “”%Appdata%\ytmediacenter\YoukuMediaCenter.exe” /protocol:”%1″”
HKLM\Software\Classes\magnet2\shell\open\command\: 22 43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73 5C 49 51 49 59 49 20 56 69 64 65 6F 5C 4C 53 74 79 6C 65 5C 51 79 43 6C 69 65 6E 74 2E 65 78 65 22 20 2D 70 70 73 74 72 65 61 6D 20 22 25 31 22 00 3F 3F 3F 3F 02 00 3F 3F 00 00 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 18 00 00 3F 3F 3F 3F 3F 3F 3F 55 3F 3F 3F 3F 3F 3F 3F 55 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
HKLM\Software\Classes\pps\shell\open\command\: 22 43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73 5C 49 51 49 59 49 20 56 69 64 65 6F 5C 4C 53 74 79 6C 65 5C 51 79 43 6C 69 65 6E 74 2E 65 78 65 22 20 2D 70 70 73 74 72 65 61 6D 20 22 25 31 22 00 3F 3F 3F 3F 02 00 3F 3F 00 00 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 18 00 00 3F 3F 3F 3F 3F 3F 3F 55 3F 3F 3F 3F 3F 3F 3F 55 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
HKLM\Software\Classes\ppsrun\shell\open\command\: 22 43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73 5C 49 51 49 59 49 20 56 69 64 65 6F 5C 4C 53 74 79 6C 65 5C 51 79 43 6C 69 65 6E 74 2E 65 78 65 22 20 2D 70 70 73 74 72 65 61 6D 20 22 25 31 22 00 3F 3F 3F 3F 02 00 3F 3F 00 00 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 18 00 00 3F 3F 3F 3F 3F 3F 3F 55 3F 3F 3F 3F 3F 3F 3F 55 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
HKLM\Software\Classes\ppstream\shell\open\command\: 22 43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73 5C 49 51 49 59 49 20 56 69 64 65 6F 5C 4C 53 74 79 6C 65 5C 51 79 43 6C 69 65 6E 74 2E 65 78 65 22 20 2D 70 70 73 74 72 65 61 6D 20 22 25 31 22 00 3F 3F 3F 3F 02 00 3F 3F 00 00 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 18 00 00 3F 3F 3F 3F 3F 3F 3F 55 3F 3F 3F 3F 3F 3F 3F 55 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
HKLM\Software\Classes\pps_pfv\shell\open\command\: “”%Program Files%\IQIYI Video\LStyle\QyClient.exe” -runfrom openfile “%1″”
HKLM\Software\Classes\pps_qsv\shell\open\command\: “”%Program Files%\IQIYI Video\LStyle\QyClient.exe” -runfrom openfile “%1″”
HKLM\Software\Classes\qips\shell\open\command\: 22 43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73 5C 49 51 49 59 49 20 56 69 64 65 6F 5C 4C 53 74 79 6C 65 5C 51 79 43 6C 69 65 6E 74 2E 65 78 65 22 20 2D 70 70 73 74 72 65 61 6D 20 22 25 31 22 00 3F 3F 3F 3F 02 00 3F 3F 00 00 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 18 00 00 3F 3F 3F 3F 3F 3F 3F 55 3F 3F 3F 3F 3F 3F 3F 55 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
HKLM\Software\Classes\qisu\shell\open\command\: 22 43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73 5C 49 51 49 59 49 20 56 69 64 65 6F 5C 4C 53 74 79 6C 65 5C 51 79 43 6C 69 65 6E 74 2E 65 78 65 22 20 2D 70 70 73 74 72 65 61 6D 20 22 25 31 22 00 3F 3F 3F 3F 02 00 3F 3F 00 00 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 18 00 00 3F 3F 3F 3F 3F 3F 3F 55 3F 3F 3F 3F 3F 3F 3F 55 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
HKLM\Software\Classes\qygameclient\shell\open\command\: “”%Program Files%\IQIYI Video\Common\QyGameClient\QyGameClient.exe” -qygameclient “%1″”
HKLM\Software\Classes\Youku.3gp\Shell\Open\Command\: “”%Program Files%\YouKu\YoukuClient\YoukuDesktop.exe” “%1″”
HKLM\Software\Classes\Youku.asf\Shell\Open\Command\: “”%Program Files%\YouKu\YoukuClient\YoukuDesktop.exe” “%1″”
HKLM\Software\Classes\Youku.avi\Shell\Open\Command\: “”%Program Files%\YouKu\YoukuClient\YoukuDesktop.exe” “%1″”
HKLM\Software\Classes\Youku.dat\Shell\Open\Command\: “”%Program Files%\YouKu\YoukuClient\YoukuDesktop.exe” “%1″”
HKLM\Software\Classes\Youku.dv\Shell\Open\Command\: “”%Program Files%\YouKu\YoukuClient\YoukuDesktop.exe” “%1″”
HKLM\Software\Classes\Youku.dvix\Shell\Open\Command\: “”%Program Files%\YouKu\YoukuClient\YoukuDesktop.exe” “%1″”
HKLM\Software\Classes\Youku.f4v\Shell\Open\Command\: “”%Program Files%\YouKu\YoukuClient\YoukuDesktop.exe” “%1″”
HKLM\Software\Classes\Youku.flv\Shell\Open\Command\: “”%Program Files%\YouKu\YoukuClient\YoukuDesktop.exe” “%1″”
HKLM\Software\Classes\Youku.kux\Shell\Open\Command\: “”%Program Files%\YouKu\YoukuClient\YoukuDesktop.exe” “%1″”
HKLM\Software\Classes\Youku.m1v\Shell\Open\Command\: “”%Program Files%\YouKu\YoukuClient\YoukuDesktop.exe” “%1″”
HKLM\Software\Classes\Youku.m2ts\Shell\Open\Command\: “”%Program Files%\YouKu\YoukuClient\YoukuDesktop.exe” “%1″”
HKLM\Software\Classes\Youku.m2v\Shell\Open\Command\: “”%Program Files%\YouKu\YoukuClient\YoukuDesktop.exe” “%1″”
HKLM\Software\Classes\Youku.m4v\Shell\Open\Command\: “”%Program Files%\YouKu\YoukuClient\YoukuDesktop.exe” “%1″”
HKLM\Software\Classes\Youku.mkv\Shell\Open\Command\: “”%Program Files%\YouKu\YoukuClient\YoukuDesktop.exe” “%1″”
HKLM\Software\Classes\Youku.mov\Shell\Open\Command\: “”%Program Files%\YouKu\YoukuClient\YoukuDesktop.exe” “%1″”
HKLM\Software\Classes\Youku.mp2\Shell\Open\Command\: “”%Program Files%\YouKu\YoukuClient\YoukuDesktop.exe” “%1″”
HKLM\Software\Classes\Youku.mp4\Shell\Open\Command\: “”%Program Files%\YouKu\YoukuClient\YoukuDesktop.exe” “%1″”
HKLM\Software\Classes\Youku.mpeg\Shell\Open\Command\: “”%Program Files%\YouKu\YoukuClient\YoukuDesktop.exe” “%1″”
HKLM\Software\Classes\Youku.mpeg1\Shell\Open\Command\: “”%Program Files%\YouKu\YoukuClient\YoukuDesktop.exe” “%1″”
HKLM\Software\Classes\Youku.mpeg2\Shell\Open\Command\: “”%Program Files%\YouKu\YoukuClient\YoukuDesktop.exe” “%1″”
HKLM\Software\Classes\Youku.mpeg4\Shell\Open\Command\: “”%Program Files%\YouKu\YoukuClient\YoukuDesktop.exe” “%1″”
HKLM\Software\Classes\Youku.mpg\Shell\Open\Command\: “”%Program Files%\YouKu\YoukuClient\YoukuDesktop.exe” “%1″”
HKLM\Software\Classes\Youku.mts\Shell\Open\Command\: “”%Program Files%\YouKu\YoukuClient\YoukuDesktop.exe” “%1″”
HKLM\Software\Classes\Youku.mtv\Shell\Open\Command\: “”%Program Files%\YouKu\YoukuClient\YoukuDesktop.exe” “%1″”
HKLM\Software\Classes\Youku.mxf\Shell\Open\Command\: “”%Program Files%\YouKu\YoukuClient\YoukuDesktop.exe” “%1″”
HKLM\Software\Classes\Youku.ogg\Shell\Open\Command\: “”%Program Files%\YouKu\YoukuClient\YoukuDesktop.exe” “%1″”
HKLM\Software\Classes\Youku.ogm\Shell\Open\Command\: “”%Program Files%\YouKu\YoukuClient\YoukuDesktop.exe” “%1″”
HKLM\Software\Classes\Youku.ogv\Shell\Open\Command\: “”%Program Files%\YouKu\YoukuClient\YoukuDesktop.exe” “%1″”
HKLM\Software\Classes\Youku.ogx\Shell\Open\Command\: “”%Program Files%\YouKu\YoukuClient\YoukuDesktop.exe” “%1″”
HKLM\Software\Classes\Youku.rm\Shell\Open\Command\: “”%Program Files%\YouKu\YoukuClient\YoukuDesktop.exe” “%1″”
HKLM\Software\Classes\Youku.rmvb\Shell\Open\Command\: “”%Program Files%\YouKu\YoukuClient\YoukuDesktop.exe” “%1″”
HKLM\Software\Classes\Youku.ts\Shell\Open\Command\: “”%Program Files%\YouKu\YoukuClient\YoukuDesktop.exe” “%1″”
HKLM\Software\Classes\Youku.vob\Shell\Open\Command\: “”%Program Files%\YouKu\YoukuClient\YoukuDesktop.exe” “%1″”
HKLM\Software\Classes\Youku.vro\Shell\Open\Command\: “”%Program Files%\YouKu\YoukuClient\YoukuDesktop.exe” “%1″”
HKLM\Software\Classes\Youku.wmv\Shell\Open\Command\: “”%Program Files%\YouKu\YoukuClient\YoukuDesktop.exe” “%1″”
HKLM\Software\Clients\StartMenuInternet\360se.exe\shell\open\command\: “”%Appdata%\360se6\Application\360se.exe””
HKLM\Software\Clients\StartMenuInternet\360se6\shell\open\command\: “”%Appdata%\360se6\Application\360se.exe””
HKLM\Software\Microsoft\Active Setup\Installed Components\{65122CB0-EA0F-47DF-A953-017170ED12F9}\: “UC???”
HKLM\Software\Microsoft\Active Setup\Installed Components\{65122CB0-EA0F-47DF-A953-017170ED12F9}\StubPath: “”%Program Files%\UCBrowser\Application\5.5.10106.5\Installer\chrmstp.exe” –configure-user-settings –verbose-logging –system-level”
HKLM\Software\Microsoft\Active Setup\Installed Components\{65122CB0-EA0F-47DF-A953-017170ED12F9}\Localized Name: “UC???”
HKLM\Software\Microsoft\Active Setup\Installed Components\{65122CB0-EA0F-47DF-A953-017170ED12F9}\IsInstalled: 0x00000001
HKLM\Software\Microsoft\Active Setup\Installed Components\{65122CB0-EA0F-47DF-A953-017170ED12F9}\Version: “43,0,0,0”
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\YoukuMediaCenter: “”%Appdata%\ytmediacenter\YoukuMediaCenter.exe” iku://|start| –sr=r_hkcu”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\cqss\UninstallString: “%Program Files%\cqss\Uninst.exe”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\IQIYI Video\DisplayName: “???PPS??”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\IQIYI Video\UninstallString: “%Program Files%\IQIYI Video\LStyle\QyUninst.exe”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\PPStream\UninstallString: “%Program Files%\IQIYI Video\LStyle\QyUninst.exe”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\UCBrowser\DisplayName: “UC???”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\UCBrowser\UninstallString: “”%Program Files%\UCBrowser\Application\Uninstall.exe” –uninstall –system-level”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\win7dock_is1\DisplayName: “win7dock 2.0”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\win7dock_is1\UninstallString: “”%Program Files%\win7dock\UninsFiles\unins000.exe””
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\YoukuClient\DisplayName: “??”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\YoukuClient\UninstallString: “”%Program Files%\YouKu\YoukuClient\uninstall.exe””
HKLM\Software\QiYi\QiSu\DisplayName: “?????4.0”
HKLM\Software\UCBrowser\UninstallString: “%Program Files%\UCBrowser\Application\Uninstall.exe”
HKLM\System\CurrentControlSet\Services\Bonjour Service\ImagePath: “%Program Files%\IQIYI Video\LStyle\mDNSResponder.exe”
HKLM\System\CurrentControlSet\Services\Bonjour Service\DisplayName: “Bonjour Service”
HKLM\System\CurrentControlSet\Services\QiyiService\ImagePath: “%Program Files%\IQIYI Video\LStyle\QiyiService.exe”
HKLM\System\CurrentControlSet\Services\QiyiService\DisplayName: “IQIYI Video Platform Service”
HKLM\System\CurrentControlSet\Services\UCBrowserSvc\ImagePath: “”%Program Files%\UCBrowser\Application\UCService.exe””
HKLM\System\CurrentControlSet\Services\UCBrowserSvc\DisplayName: “UC???????”
HKLM\System\CurrentControlSet\Services\UCGuard\ImagePath: “system32\DRIVERS\ucguard.sys”
HKLM\System\CurrentControlSet\Services\WebServe\ImagePath: “%Program Files%\YouKu\YoukuClient\WebServe.exe”
HKLM\System\CurrentControlSet\Services\WebServe\DisplayName: “WebServe”
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\win7dockrun: “”%Program Files%\win7dock\win7dockdesk.exe” apprun”
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\win7dock: “”%Program Files%\win7dock\win7dockdesk.exe” apprun”
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\HCDNClient: “”%Program Files%\IQIYI Video\LStyle\QyKernel.exe” -shell_start”
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\YoukuMediaCenter: “”%Appdata%\ytmediacenter\YoukuMediaCenter.exe” iku://|start| –sr=r_hklm”
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\iKu: “”%Program Files%\YouKu\YoukuClient\YoukuDesktop.exe” iku://|reg|”
HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{090F1267-41F9-41F3-85D7-05ED1CA81410}\DisplayName: “anote (v1.37) ”
HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{090F1267-41F9-41F3-85D7-05ED1CA81410}\UninstallString: “”%Program Files%\anote\uninstall.exe” _?=%Program Files%\anote”
HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\UnityWebPlayer\UninstallString: “%Local Appdata%\Unity\WebPlayer\Uninstall.exe /CurrentUser”
HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\UnityWebPlayer\DisplayName: “Unity Web Player”
HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\360se6\DisplayName: “360?????7”
HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\360se6\UninstallString: “”%Appdata%\360se6\Application\7.1.1.518\Installer\setup.exe” –uninstall”
HKCU\Software\360\360se6\Update\ClientState\{02E720BD-2B50-4404-947C-65DBE64F6970}\UninstallString: “%Appdata%\360se6\Application\7.1.1.518\Installer\setup.exe”
HKLM\Software\Classes\CLSID\{0002DF01-0000-0000-C000-000000000046}\LocalServer32\: “”%Appdata%\360se6\Application\360se.exe””

Detected by UnHackMe:

INJECTHELPER.EXE
Default location: %PROGRAM FILES%\YOUKU\YOUKUCLIENT\INJECTHELPER.EXE

Dropper hash(md5): 335094cdf31906a4732d9a2bcbd21a9f

Written by NightWatcher

Malware Hunter.
Google+

UnHackMe removes malware invisible for your antivirus!

UnHackMe is compatible with most antivirus software.
UnHackMe is 100% CLEAN, which means it does not contain any form of malware, including adware, spyware, viruses, trojans and backdoors. VirusTotal (0/56).
System Requirements: Windows 2000-Windows 8.1/10. UnHackMe uses minimum of computer resources.