Dmitry Sokolov recommends UnHackMe!

UnHackMe is a powerful tool against malware.

UnHackMe quickly removes rootkits/malware/adware/browser hijack issues!

Alex NightWatcher: Solved! (5 / 5)

not-a-virus:RiskTool.Win32.SProtector.ds also known as TROJ_GEN.R0E3C0OC715, Unwanted-Program ( 0040fa3b1 ), Gen:Variant.Adware.Zusy.122341 (B).

Malware Analysis of not-a-virus:RiskTool.Win32.SProtector.ds – KEEPSBROWSE.DLL

Created files:

%Program Files%\FSymbols Stickers for Facebook\FSymbols Stickers for Facebook.dat
%Program Files%\FSymbols Stickers for Facebook\FSymbols Stickers for Facebook.exe
%Program Files%\keepsbrowse\keepsbrowse.dll
%Program Files%\MyPC Backup\aff.conf
%Program Files%\MyPC Backup\AlphaFS.dll

Autostart registry keys:

HKLM\Software\Classes\CLSID\{a1e07e80-9626-42c4-8ed0-a2d6eaf4527f}\InprocServer32\: “%Program Files%\UniDeals\r5xEJfc0K6M0U5.dll”
HKLM\Software\Classes\CLSID\{bffd218c-6544-4e01-9549-3cba0f78a8e9}\InprocServer32\: “%Program Files%\youtubeadblocker\CyCu4w8ztUToEq.dll”
HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{BB74DE59-BC4C-4172-9AC4-73315F71CFFE}\DisplayName: “WebSearch”
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\D20352A90C039D93DBF6126ECE614057\InstallProperties\UninstallString: “MsiExec.exe /X{9A25302D-30C0-39D9-BD6F-21E6EC160475}”
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\D20352A90C039D93DBF6126ECE614057\InstallProperties\DisplayName: “Microsoft Visual C++ 2008 Redistributable – x86 9.0.30729.17”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\MyPC Backup\DisplayName: “MyPC Backup ”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\MyPC Backup\UninstallString: “%Program Files%\MyPC Backup\uninst.exe”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{11F6D5AB-263F-388E-74DE-E3DECD390E3F}\DisplayName: “UniDeals”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{11F6D5AB-263F-388E-74DE-E3DECD390E3F}\UninstallString: “”%Program Files%\UniDeals\r5xEJfc0K6M0U5.exe” /s /n /i:”ExecuteCommands;UninstallCommands” “””
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}{3286b2be}\UninstallString: “”%SysDir%\RUNDLL32.EXE” “C:\PROGRA~1\KEEPSB~1\KEEPSB~1.DLL”,_uninstall /un”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}{3286b2be}\DisplayName: “ModuleVice”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{4820778D-AB0D-6D18-C316-52A6A0E1D507}\DisplayName: “youtubeadblocker”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{4820778D-AB0D-6D18-C316-52A6A0E1D507}\UninstallString: “”%Program Files%\youtubeadblocker\CyCu4w8ztUToEq.exe” /s /n /i:”ExecuteCommands;UninstallCommands” “””
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{9A25302D-30C0-39D9-BD6F-21E6EC160475}\UninstallString: “MsiExec.exe /X{9A25302D-30C0-39D9-BD6F-21E6EC160475}”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{9A25302D-30C0-39D9-BD6F-21E6EC160475}\DisplayName: “Microsoft Visual C++ 2008 Redistributable – x86 9.0.30729.17”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{AD11DADE-C597-45D9-D8C5-1D2EB0B89613}\DisplayName: “FSymbols Stickers for Facebook”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{AD11DADE-C597-45D9-D8C5-1D2EB0B89613}\UninstallString: “”%Program Files%\FSymbols Stickers for Facebook\FSymbols Stickers for Facebook.exe” /s /n /i:”ExecuteCommands;UninstallCommands” “””
HKLM\System\CurrentControlSet\Services\3286b2be\ImagePath: “”%SysDir%\rundll32.exe” “c:\Program Files\keepsbrowse\keepsbrowse.dll”,serv”
HKLM\System\CurrentControlSet\Services\3286b2be\DisplayName: “keepsbrowse”
HKLM\System\CurrentControlSet\Services\BackupStack\ImagePath: “%Program Files%\MyPC Backup\BackupStack.exe”
HKLM\System\CurrentControlSet\Services\BackupStack\DisplayName: “Computer Backup (MyPC Backup)”
HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{BB74DE59-BC4C-4172-9AC4-73315F71CFFE}\DisplayName: “WebSearch”

Detected by UnHackMe:

KEEPSBROWSE.DLL
Default location: %PROGRAM FILES%\KEEPSBROWSE\KEEPSBROWSE.DLL

Dropper hash(md5): addda63b81a29820d7dcfb7523e0dc4e

Written by NightWatcher

Malware Hunter.
Google+

UnHackMe removes malware invisible for your antivirus!

UnHackMe is compatible with most antivirus software.
UnHackMe is 100% CLEAN, which means it does not contain any form of malware, including adware, spyware, viruses, trojans and backdoors. VirusTotal (0/56).
System Requirements: Windows 2000-Windows 8.1/10. UnHackMe uses minimum of computer resources.