Dmitry Sokolov recommends UnHackMe!

UnHackMe is a powerful tool against malware.

UnHackMe quickly removes rootkits/malware/adware/browser hijack issues!

Alex NightWatcher: Solved! (5 / 5)

Trojan.Win32.Crossrider1.dvdbzm also known as Adware ( 004c12031 ), Adware ( 004c12031 ), Trj/Genetic.gen.

Malware Analysis of Trojan.Win32.Crossrider1.dvdbzm – IXORUTQ9XASDNN.EXE

Created files:

%Program Files%\bestadblocker\IXORutQ9xaSdnn.dat
%Program Files%\bestadblocker\IXORutQ9xaSdnn.dll
%Program Files%\bestadblocker\IXORutQ9xaSdnn.exe
%Program Files%\bestadblocker\IXORutQ9xaSdnn.tlb
%Program Files%\CutThePrice\L9B5bbswp8T8Lz.dat

Autostart registry keys:

HKLM\Software\Classes\CLSID\{944317C2-E8F9-4855-B45E-7F0A1C5BF2CF}\InprocServer32\: “%Program Files%\bestadblocker\IXORutQ9xaSdnn.dll”
HKLM\Software\Classes\CLSID\{EFF7F777-580E-4F7F-A462-1451335CEA7E}\InprocServer32\: “%Program Files%\CutThePrice\L9B5bbswp8T8Lz.dll”
HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}\DisplayName: “mystartsearch”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}{a40df2d0}\UninstallString: “”%SysDir%\RUNDLL32.EXE” “C:\PROGRA~1\SOFTWA~1\SOFTWA~1.DLL”,_uninstall /un”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}{a40df2d0}\DisplayName: “TampaGeneration”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{4820778D-AB0D-6D18-C316-52A6A0E1D507}\DisplayName: “bestadblocker”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{4820778D-AB0D-6D18-C316-52A6A0E1D507}\UninstallString: “”%Program Files%\bestadblocker\IXORutQ9xaSdnn.exe” /s /n /i:”ExecuteCommands;UninstallCommands” “””
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{A2C98B47-B5F4-94AA-281D-4135416774CF}\DisplayName: “CutThePrice”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{A2C98B47-B5F4-94AA-281D-4135416774CF}\UninstallString: “”%Program Files%\CutThePrice\L9B5bbswp8T8Lz.exe” /s /n /i:”ExecuteCommands;UninstallCommands” “””
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{AD11DADE-C597-45D9-D8C5-1D2EB0B89613}\DisplayName: “Photo Zoom for Twitter”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{AD11DADE-C597-45D9-D8C5-1D2EB0B89613}\UninstallString: “”%Program Files%\Photo Zoom for Twitter\Photo Zoom for Twitter.exe” /s /n /i:”ExecuteCommands;UninstallCommands” “””
HKLM\System\CurrentControlSet\Services\a40df2d0\ImagePath: “”%SysDir%\rundll32.exe” “c:\Program Files\SoftwareBump\SoftwareBump.dll”,serv”
HKLM\System\CurrentControlSet\Services\a40df2d0\DisplayName: “SoftwareBump”
HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}\DisplayName: “mystartsearch”

Detected by UnHackMe:

IXORUTQ9XASDNN.EXE
Default location: %PROGRAM FILES%\BESTADBLOCKER\IXORUTQ9XASDNN.EXE

Dropper hash(md5): 1d7fd14bd0de20be5885cb59ff2436aa

Written by NightWatcher

Malware Hunter.
Google+

UnHackMe removes malware invisible for your antivirus!

UnHackMe is compatible with most antivirus software.
UnHackMe is 100% CLEAN, which means it does not contain any form of malware, including adware, spyware, viruses, trojans and backdoors. VirusTotal (0/56).
System Requirements: Windows 2000-Windows 8.1/10. UnHackMe uses minimum of computer resources.