How to easily remove SmartOnes! Get Removal Guide

I recommend you UnHackMe - Ultimate Malware Killer for fast malware removal:

Free Download
Fully Functional 30-day Trial. No credit card is required.
Reviews
. EULA. Privacy Policy. Uninstall.

We received the file PNYSBQWLW38TGJ.DLL and detected thatPNYSBQWLW38TGJ.DLL is not good.
PNYSBQWLW38TGJ.DLL is Adware. You should remove the file PNYSBQWLW38TGJ.DLL.
Kill the process PNYSBQWLW38TGJ.DLL and remove PNYSBQWLW38TGJ.DLL from Windows.

Malware Analysis of SmartOnes
Full path on a computer: %Program Files%\SmartOnes\PnYSbQWlw38tGj.dll

Detected by UnHackMe:

PNYSBQWLW38TGJ.DLL
Default location: %Program Files%\SmartOnes\PnYSbQWlw38tGj.dll

Removal Results: Success
Number of reboot: 1

SmartOnes is known as:

Adware.PUP.MultiPlug

PNYSBQWLW38TGJ.DLL hash:

  • MD5: 9585f4ae0d0a6b6f21e7167dd7726560
How to quickly detect SmartOnes presence?
SmartOnes Adware in FireFox
Registry:
  • HKLM\Software\Classes\CLSID\{2bcb9ecd-0d9c-43dd-a425-81a6e5a87d00}\InprocServer32\: “%Program Files%\SmartOnes\PnYSbQWlw38tGj.dll”
  • HKLM\Software\Microsoft\Windows\CurrentVersion\Group Policy\History\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}\0\DisplayName: “Local Group Policy”
  • HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{D0DBE908-5DE8-3DF3-83C9-01620C65816F}\UninstallString: “”%Common Appdata%\SmartOnes\lFkmgBBicG7Fdoy.exe” !x:1 /s /n /i:”ExecuteCommands;UninstallCommands””
  • HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{D0DBE908-5DE8-3DF3-83C9-01620C65816F}\DisplayName: “SmartOnes”
Folders:
  • %Common Appdata%\SmartOnes
  • %Program Files%\SmartOnes
Files:
  • %Common Appdata%\SmartOnes\lFkmgBBicG7Fdoy.dat
  • %Common Appdata%\SmartOnes\lFkmgBBicG7Fdoy.exe
  • %AllUsersProfile%\ntuser.pol
  • %Program Files%\SmartOnes\PnYSbQWlw38tGj.dat
  • %Program Files%\SmartOnes\PnYSbQWlw38tGj.dll
  • %Program Files%\SmartOnes\PnYSbQWlw38tGj.tlb
  • %Program Files%\SmartOnes\PnYSbQWlw38tGj.x64.dll
  • %SysDir%\GroupPolicy\gpt.ini
  • %SysDir%\GroupPolicy\Machine\Registry.pol

Leave a Reply