Dmitry Sokolov recommends UnHackMe!

UnHackMe is a powerful tool against malware.

UnHackMe quickly removes rootkits/malware/adware/browser hijack issues!

Alex NightWatcher: Solved! (5 / 5)

TROJ_GEN.R08NH09BN15 also known as BehavesLike.Win32.BadFile.dm, Gen:Variant.Graftor.174409, BHO.YHZ.

Malware Analysis of TROJ_GEN.R08NH09BN15 – FOGXTVC6BLJKAQ.EXE

Created files:

%Program Files%\youtubeadblocker\FOGXTVC6BlJKAQ.dat
%Program Files%\youtubeadblocker\FOGXTVC6BlJKAQ.dll
%Program Files%\youtubeadblocker\FOGXTVC6BlJKAQ.exe
%Program Files%\youtubeadblocker\FOGXTVC6BlJKAQ.tlb

Autostart registry keys:

HKLM\Software\Classes\CLSID\{501d8940-8f11-46f4-8221-9c6287a3e6d6}\InprocServer32\: “%Program Files%\UniDeals\gNR3UIvZbFx3Ew.dll”
HKLM\Software\Classes\CLSID\{573a97ce-9e28-4010-83cc-4975d728b3c2}\InprocServer32\: “%Program Files%\youtubeadblocker\FOGXTVC6BlJKAQ.dll”
HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}\DisplayName: “mystartsearch”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{11F6D5AB-263F-388E-74DE-E3DECD390E3F}\DisplayName: “UniDeals”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{11F6D5AB-263F-388E-74DE-E3DECD390E3F}\UninstallString: “”%Program Files%\UniDeals\gNR3UIvZbFx3Ew.exe” /s /n /i:”ExecuteCommands;UninstallCommands” “””
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}{305c2e03}\UninstallString: “”%SysDir%\RUNDLL32.EXE” “C:\PROGRA~1\INCLUD~1\INCLUD~1.DLL”,_uninstall /un”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}{305c2e03}\DisplayName: “PhraseModulator”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{4820778D-AB0D-6D18-C316-52A6A0E1D507}\DisplayName: “youtubeadblocker”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{4820778D-AB0D-6D18-C316-52A6A0E1D507}\UninstallString: “”%Program Files%\youtubeadblocker\FOGXTVC6BlJKAQ.exe” /s /n /i:”ExecuteCommands;UninstallCommands” “””
HKLM\System\CurrentControlSet\Services\305c2e03\ImagePath: “”%SysDir%\rundll32.exe” “c:\Program Files\IncludeSystem\IncludeSystem.dll”,serv”
HKLM\System\CurrentControlSet\Services\305c2e03\DisplayName: “IncludeSystem”
HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}\DisplayName: “mystartsearch”

Detected by UnHackMe:

FOGXTVC6BLJKAQ.EXE
Default location: %PROGRAM FILES%\YOUTUBEADBLOCKER\FOGXTVC6BLJKAQ.EXE

Dropper hash(md5): 756449c2009738a56c672b7d464ce046

Written by NightWatcher

Malware Hunter.
Google+

UnHackMe removes malware invisible for your antivirus!

UnHackMe is compatible with most antivirus software.
UnHackMe is 100% CLEAN, which means it does not contain any form of malware, including adware, spyware, viruses, trojans and backdoors. VirusTotal (0/56).
System Requirements: Windows 2000-Windows 8.1/10. UnHackMe uses minimum of computer resources.