Dmitry Sokolov recommends UnHackMe!

UnHackMe is a powerful tool against malware.

UnHackMe quickly removes rootkits/malware/adware/browser hijack issues!

Alex NightWatcher: Solved! (5 / 5)

Riskware/OpenCandy also known as Adware.OpenCandy.1, PUP.Optional.OpenCandy.A, TROJ_GEN.F47V0123.

Malware Analysis of Riskware/OpenCandy

Created files:

%Appdata%\OpenCandy\69E2D73D91E24C87BC6F61D834048A2A\47A647BD-4905-48C7-9539-A95F199019A4
%Appdata%\OpenCandy\69E2D73D91E24C87BC6F61D834048A2A\B8DCC36F-4F05-445F-B1EE-FD8FC38CBBDA
%Appdata%\OpenCandy\69E2D73D91E24C87BC6F61D834048A2A\dlm.exe
%Appdata%\OpenCandy\FC0F6FB5DF814075AA393AF8227719A8\3596.ico
%Appdata%\OpenCandy\FC0F6FB5DF814075AA393AF8227719A8\dlm.exe

Autostart registry keys:

HKLM\Software\Classes\CLSID\{CAF2E5A4-EA3E-4BA4-B622-02860374AF4C}\InprocServer32\: “C:\PROGRA~1\MP3MYM~1.2\asrecmms.ocx”
HKLM\Software\Classes\CLSID\{EC1A33CC-0FB1-4F3A-BDE7-79773690BB28}\InprocServer32\: “C:\PROGRA~1\MP3MYM~1.2\asrecmms.ocx”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\MP3MyMP3_is1\DisplayName: “MP3MyMP3 4.2”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\MP3MyMP3_is1\UninstallString: “”%Program Files%\MP3 My MP3 4.2\unins000.exe””

Detected by UnHackMe:

DLM.EXE
Default location: %APPDATA%\OPENCANDY\69E2D73D91E24C87BC6F61D834048A2A\DLM.EXE

Dropper hash(md5): 57b67602dad25989124ce4bdc58244c5

Written by NightWatcher

Malware Hunter.
Google+

UnHackMe removes malware invisible for your antivirus!

UnHackMe is compatible with most antivirus software.
UnHackMe is 100% CLEAN, which means it does not contain any form of malware, including adware, spyware, viruses, trojans and backdoors. VirusTotal (0/56).
System Requirements: Windows 2000-Windows 8.1/10. UnHackMe uses minimum of computer resources.