5 / 5 - (6 votes)

SUSPICIOUS ADWARE (ADWARE)

This program is classified in the category of advertising software (Adware), from the English "ADS" short for the English Advertissement (Promotional poster). Adware usually installs as a program or browser extension and is loaded every time the system starts. They can launch services, start scheduled tasks, and create shortcuts on your Desktop. All these operations are done with or without your consent according to the terms of its user contract. Once installed, adware can modify certain settings of your browsers such as search pages, the start page or even your "404" error page. Adware can collect your browsing habits and communicate them to a server using the tracking method because it is most often a marketing solution aimed at retaining customers.

While browsing, it generally displays ads in the form of coupons and advertising banners in the form of popups. These ads are generally signed with the words "Powered by", "Brought to you by" or "Ads by", followed by the name of the adware. But some adware exaggerates the size and frequency of displaying ads, which can harm the speed of Internet browsing and the visibility of the content of the pages consulted. Please also note that the advertising publisher may decline any responsibility for the content of the links targeted by its advertisements. Ultimately, the goal of these programs is to make money by driving web traffic to sponsored sites. Some adware is installed via packaged software and are not necessarily wanted by the user and antiviruses generally classify them as Potentially Unwanted Software (LPI/PUP).
[the_ad id = "33969"]

Potentially unwanted software (LPI) or Potentialy Unwanted Programs (PUP) are the cause of many infections. The most common example is adware. InstallCore, Crossrider, Graftor ou Boxore which pollute the Registry and your data storage units. They are usually installed without your knowledge by downloading freeware. Indeed some sites use the repackaging method, an operation which consists of redoing the software installation module by adding download options. These options allow you to add other software such as browser toolbars, adware, potentially unwanted software, intrusive advertising software, or even browser hijackers.

Spyware (spyware) and adware (adwares) unwanted files, just like malware, can use the writing flaws of legitimate software or those of operating systems. It is therefore essential to have official software and that it has automatic updating. Likewise, your Windows operating system must be programmed in automatic update mode and activated, so that you can have the latest updates for critical security vulnerabilities.

Features

– It installs an extension program for the Google Chrome (G2) browser,
– It installs an extension program for the Mozilla Firefox (M2) browser,
– It installs a Mozilla Firefox (P2) browser plugin,
– It installs an extension program for the Microsoft Edge (E2) browser,
– It installs a plugin for the Mozilla Firefox (M3) browser,
– Starts a process at system launch (RP),
– Modifies the Registry Base in order to be launched each time the system starts (O4),
– Starts a service each time the system is launched (O23), (SS/SR),
– Executes a scheduled task automatically (O39),
– Installs the software in the Registry Base (O42),
– Created multiple “Software” registry keys,
– Adds additional folders (O43),
– Registration in the Windows prefetcher folder (O45),
– It is installed as a system driver (O58),
– Added multiple user files (O61),

Preview in reports

Recorded on 25/01/2016
O43 – CFD: 19/05/2015 – [0] D — C:\ProgramData\33d727726fb14a2bb86e8f3cce952437
O43 – CFD: 18/05/2015 – [0] D — C:\ProgramData\7c0535b143fc4671b6ebd202fbffe066
Adware:Win32/Putalol [Microsoft]
Adware.PicColor [Reason Heuristics]

Recorded on 05/08/2016
O23 – Service: WindowService (WindowService). (.Copyright © 2016 – WindowService.) – C:\Program Files\Videodriver\WindowService.exe
SR – Auto [25/07/2016] [8192] WindowService (WindowService). (.Copyright © 2016.) – C:\Program Files\Videodriver\WindowService.exe
[MD5.F20A6EB7DDF706F179AEFBC8905D2C4A] – (.Copyright © 2016 – WindowService.) — C:\Program Files\Videodriver\WindowService.exe [8192] [PID.1976]
O43 – CFD: 04/08/2016 – [] D — C:\Program Files\Videodriver

Recorded on 04/09/2016
G2 – GCE: Preference [User Data\Default] [feeilhmlfcpfchpbgoknoeefdkbgionj] Wize Search

Recorded on 02/10/2016
Serial number: 1041C647D876D23C0ACD8A03
O58 – SDL:2016/09/29 20:15:48 A . (.Authors – Lacuna Driver.) — C:\Windows\System32\drivers\f0a7f916baa66f80d98295f782cedb66.sys [79936] {1041C647D876D23C0ACD8A03}

Recorded on 03/10/2016
Serial number: 45E7A7FF326DEE2922A86AAF
O58 – SDL:2016/09/21 16:28:56 A . (.YB5JOV – .) — C:\Windows\System32\drivers\a8f9b6e6f84776bd62bdb3f29a255a52.sys [57256] {45E7A7FF326DEE2922A86AAF}

Recorded on 11/10/2016
O43 – CFD: 23/09/2016 – [0] D — C:\Users\Simo\AppData\Roaming\HMYGSetting

Recorded on 07/11/2016 (Routine)
O23 – Service: Arakosatuhph (Arakosatuhph). (…) – C:\Program Files\Ewelyckik\qonakclecisycln.dll
SR – Auto [04/11/2016] [274944] Arakosatuhph (Arakosatuhph). (…) – C:\Program Files\Ewelyckik\qonakclecisycln.dll
O23 – Service: Drsiyseuch (Drsiyseuch). (…) – C:\Program Files\Nerduthercoizesy\vejuytutainhlp.dll
O23 – Service: Drccult (Drccult). (…) – C:\Program Files (x86)\Anakury\ShezergeDbg.dll
SR – Auto [06/11/2016] [273408] Drccult (Drccult) . (…) – C:\Program Files (x86)\Anakury\ShezergeDbg.dll

Recorded on 07/11/2016 (Routine)
O23 – Service: Zoom Trax (iroductuol). (…) – C:\Users\Coolman\AppData\Local\Iceelectronics.exe
SR – Auto [05/11/2016] [4608] Zoom Trax (iroductuol). (…) – C:\Users\Coolman\AppData\Local\Iceelectronics.exe
[MD5.6913CF5BBBEDB766903C82EEAC4AF746] – (…) — C:\Users\Coolman\AppData\Local\Iceelectronics.exe [4608] [PID.2100]

Recorded on 16/11/2016 (Routine)
O23 – Service: Puqosp (Puqosp). (…) – C:\Program Files (x86)\Atergile\drvulycld.dll
SR – Auto [10/11/2016] [275456] Puqosp (Puqosp). (…) – C:\Program Files (x86)\Atergile\drvulycld.dll
O23 – Service: Pleketherderbotion (Pleketherderbotion). (…) – C:\Program Files\Zojecultdalert\PrvLnc.dll
SR – Auto [15/11/2016] [279040] Pleketherderbotion (Pleketherderbotion) . (…) – C:\Program Files\Zojecultdalert\PrvLnc.dll

Recorded on 18/11/2016
O23 – Service: Microsoft Cache Service (MCSvc). (…) – C:\ProgramData\Microsoft\Blend\14.0\1033\ResourceCacher.dll
SR – Auto [09/11/2016] [352768] Microsoft Cache Service (MCSvc). (…) – C:\ProgramData\Microsoft\Blend\14.0\1033\ResourceCacher.dll
O23 – Service: RemoteMouseService (RemoteMouseService). (.Copyright © 2016 – Remote Mouse Service.) – C:\Program Files (x86)\Remote Mouse\RemoteMouseService.exe

Recorded on 27/11/2016
O4 – HKCU\..\Run: [UltimateServices] . (…) — E:\WINDOWS\system32\ultsvcs.exe
O4 – HKUS\.DEFAULT\..\Run: [UltimateServices] . (…) — C:\WINDOWS\system32\ultsvcs.exe
O4 – HKUS\S-1-5-18\..\Run: [UltimateServices] . (…) — C:\WINDOWS\system32\ultsvcs.exe
O4 – HKUS\S-1-5-20\..\Run: [UltimateServices] . (…) — C:\WINDOWS\system32\ultsvcs.exe
O4 – HKUS\S-1-5-21-2332428090-3974679042-482003331-1004\..\Run: [UltimateServices] . (…) — C:\WINDOWS\system32\ultsvcs.exe

Recorded on 10/12/2016
P2 – EXT FILE: (.Browser Exels – Browser Module.) — C:\Users\Coolman\AppData\Roaming\Mozilla\Firefox\Profiles\default\extensions\browsermodulecorp@browcorporation.org.xpi

Recorded on 13/12/2016
[MD5.88B2F6DCBD765F228976AF5BA10150AC] – (.FoAG Company – FoAG.) — C:\Users\Coolman\AppData\Roaming\Java\JavaUpdtr.exe [151552] [PID.5764]
F3 – REG:win.ini: load=C:\Users\Coolman\AppData\Roaming\Java\JavaUpdtr.exe
P2 – EXT: (.DirectSoundCapture Object – DirectSoundCapture 8.0 Object.) — C:\Users\Coolman\AppData\Roaming\Mozilla\Firefox\Profiles\default\extensions\{E4A77732-F7D5-0DC8-85EA-A8E4CDC5D5FC}

Recorded on 13/12/2016
O43 – CFD: 11/11/2016 – [] D — C:\Program Files (x86)\LDSGameCenter
[MD5.81241B5C6C64294D132A364D2F257561] [APT] [SMW_P] (.Copyright (C) 2016.) — C:\ProgramData\smp2.exe [441344] (.Activate.)
O39 – APT: SMW_P – (.Copyright (C) 2016.) — C:\WINDOWS\System32\Tasks\SMW_P [4270]

Recorded on 25/12/2016
O23 – Service: Game Protection Service (GmSvc). (…) – C:\Program Files (x86)\LDSGameCenter\GmSvc.dll

Recorded on 19/02/2017
O4 – HKCU\..\Run: [SuperEx] . (.Copyright © 2017 – SuperEx.) — C:\Windows\SuperEx\SuperEx\SuperEx.exe
O4 – HKUS\S-1-5-21-50051860-661384414-3684766944-1000\..\Run: [SuperEx] . (.Copyright © 2017 – SuperEx.) — C:\Windows\SuperEx\SuperEx\SuperEx.exe
O42 – Software: SuperEx – (.SuperEx.) [HKLM] — SuperEx

Recorded on 28/02/2017
O23 – Service: Protecultsakt (Protecultsakt). (…) – C:\Program Files (x86)\Ralulychitush\PlpVerfier.dll
[MD5.00000000000000000000000000000000] [APT] [Atijospzenos Verfier] (…) — C:\Program Files (x86)\Ralulychitush\pluca.exe [317400] (.Activate.)
O39 – APT: Atijospzenos Verfier – (…) — C:\WINDOWS\System32\Tasks\Atijospzenos Verfier [317400] (.Orphan.)
O43 – CFD: 30/01/2017 – [] D — C:\Program Files (x86)\Atijospzenos Verfier
O43 – CFD: 03/02/2017 – [0] D — C:\Program Files (x86)\Ralulychitush

Recorded on 02/03/2017
Numéro de série : 2F1FD518E4EB4E94A749E2DBAF73B31B
O61 – LFC: 2017/03/01 16:46:55 A . (.Padaducic.) — C:\Users\Coolman\Downloads\install_ccleaner.exe [1201920]
O61 – LFC: 2017/03/01 16:47:57 A . (..) — C:\Users\Coolman\Downloads\install_ccleaner-win32.exe [1482004]

Alias

CrowdStrike Falcon (ML) malicious_confidence_70% (W) 20170130
Endgame malicious (moderate confidence) 20170208
Win32:PUP-gen
AegisLab Heur.Advml.Gen!c
Baidu Win32.Trojan.WisdomEyes.16070401.9500.9891
Invincea trojanspy.win32.skeeyah.a!rfn
Rising Trojan.Kryptik!1.A6D6 (classic)
Symantec Heur.AdvML.B
Troj/Agent-LGT Trojan.
AegisLab Uds.Dangerousobject.Multi!c 20160804
Kaspersky UDS:DangerousObject.Multi.Generic 20160804