Dmitry Sokolov recommends UnHackMe!
UnHackMe is a powerful tool against malware.UnHackMe quickly removes rootkits/malware/adware/browser hijack issues!
Win32/Tnega.RFBcUYD also known as Win32:Adware-CIV [PUP], Trj/Genetic.gen, Trojan.Zadved.51.
Malware Analysis of Win32/Tnega.RFBcUYD – 0803151905250.EXE
Created files:
%Temp%\0.exe
%Temp%\8E65510A-DE7E-4791-B5C6-53BA99810ADF.exe
%Temp%\Downloader\0803151905250.exe
%Temp%\GoMailRu.ico
%Temp%\MailRu.ico
Autostart registry keys:
HKLM\Software\Google\Chrome\Extensions\kppacdmmddediahklmcgkgdhhoojemmd\update_url: “https://clients2.google.com/service/update2/crx”
HKLM\Software\Google\Chrome\Extensions\cegdomhocaeoedbdpfolmgjkjaijfomo\update_url: “https://clients2.google.com/service/update2/crx”
HKLM\Software\Google\Chrome\Extensions\bgomnbpelpcdicbnicimghcecemjpbef\update_url: “https://clients2.google.com/service/update2/crx”
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ZaxarLoader: “”%Program Files%\Zaxar\ZaxarLoader.exe” /verysilent”
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Timestasks: “”C:\ProgramData\TimeTasks\TimeTasksSetup.exe” /adv= /S”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\ZaxarGameBrowser\DisplayName: “Zaxar Games Browser”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\ZaxarGameBrowser\UninstallString: “”%Program Files%\Zaxar\uninstall.exe””
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\MailRuUpdater: “%Local Appdata%\Mail.Ru\MailRuUpdater.exe”
HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\MailRuUpdater\UninstallString: “%Local Appdata%\Mail.Ru\MailRuUpdater.exe uninstall”
Detected by UnHackMe:
0803151905250.EXE
Default location: %TEMP%\DOWNLOADER\0803151905250.EXE
Dropper hash(md5): 145bf79070f04f1e23dd790df9c2ac01
UnHackMe
removes malware invisible for your antivirus!
UnHackMe is 100% CLEAN, which means it does not contain any form of malware, including adware, spyware, viruses, trojans and backdoors. VirusTotal (0/56).
System Requirements: Windows 2000-Windows 8.1/10. UnHackMe uses minimum of computer resources.