I recommend you UnHackMe - Ultimate Malware Killer for fast malware removal:
Free Download Fully Functional 30-day Trial. No credit card is required.
Reviews. EULA. Privacy Policy. Uninstall.
We received the file K39KF6OLVBE.EXE and detected thatK39KF6OLVBE.EXE is not good.
K39KF6OLVBE.EXE is Adware. You should remove the file K39KF6OLVBE.EXE.
Kill the process K39KF6OLVBE.EXE and remove K39KF6OLVBE.EXE from Windows.
Malware Analysis of DownloadKeeper
Full path on a computer: %Common Appdata%\DowenloAud keepierr\
Detected by UnHackMe:
K39KF6OLVBE.EXE
Default location: %Common Appdata%\DowenloAud keepierr\
Removal Results: Success
Number of reboot: 1
K39KF6OLVBE.EXE is known as:
Adware.PUP.Optional.MultiPlug.A, JustPlugIt (fs), Adware.MultiPlug.Variant
K39KF6OLVBE.EXE hash:
- MD5: 8300c91b40229b42301aebc6d8859907
The file tries to download information from some web sites.
How to quickly detect K39KF6OLVBE.EXE presence?
Registry:
- HKLM\Software\Classes\CLSID\{68013C49-27FE-3EFC-6192-DCD19257222D}\InprocServer32\: “%Common Appdata%\DowenloAud keepierr\ftMgeveLTo.dll”
- HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{C1A27135-69EB-8D44-7358-34727DD7B820}\UninstallString: “”%Common Appdata%\DowenloAud keepierr\K39Kf6Olvbe.exe” /s /n /i:”ExecuteCommands;UninstallCommands” “””
- HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{C1A27135-69EB-8D44-7358-34727DD7B820}\DisplayName: “DowenloAud keepierr”
Folders:
- %Appdata%\Mozilla\Firefox\Profiles\gi17c3pt.default\extensions\staged
- %Appdata%\Mozilla\Firefox\Profiles\gi17c3pt.default\extensions\staged\hs8acnb@yaeux.net
- %Appdata%\Mozilla\Firefox\Profiles\gi17c3pt.default\extensions\staged\hs8acnb@yaeux.net\content
- %Local Appdata%\Google\Chrome\User Data\Default\Extensions\mnehilgmidaabcbeleggbfgfccknjaii
- %Local Appdata%\Google\Chrome\User Data\Default\Extensions\mnehilgmidaabcbeleggbfgfccknjaii\1.6
- %Common Appdata%\DowenloAud keepierr
Files:
- %Appdata%\Mozilla\Firefox\Profiles\gi17c3pt.default\extensions\staged\hs8acnb@yaeux.net\bootstrap.js
- %Appdata%\Mozilla\Firefox\Profiles\gi17c3pt.default\extensions\staged\hs8acnb@yaeux.net\chrome.manifest
- %Appdata%\Mozilla\Firefox\Profiles\gi17c3pt.default\extensions\staged\hs8acnb@yaeux.net\content\bg.js
- %Appdata%\Mozilla\Firefox\Profiles\gi17c3pt.default\extensions\staged\hs8acnb@yaeux.net\install.rdf
- %Local Appdata%\Google\Chrome\User Data\Default\Extensions\mnehilgmidaabcbeleggbfgfccknjaii\1.6\background.html
- %Local Appdata%\Google\Chrome\User Data\Default\Extensions\mnehilgmidaabcbeleggbfgfccknjaii\1.6\content.js
- %Local Appdata%\Google\Chrome\User Data\Default\Extensions\mnehilgmidaabcbeleggbfgfccknjaii\1.6\lsdb.js
- %Local Appdata%\Google\Chrome\User Data\Default\Extensions\mnehilgmidaabcbeleggbfgfccknjaii\1.6\manifest.json
- %Local Appdata%\Google\Chrome\User Data\Default\Extensions\mnehilgmidaabcbeleggbfgfccknjaii\1.6\OlNYoKRcAi4.js
- %Local Appdata%\Google\Chrome\User Data\Default\Extensions\mnehilgmidaabcbeleggbfgfccknjaii\1.6\sqlite.js
- %Common Appdata%\DowenloAud keepierr\ftMgeveLTo.dat
- %Common Appdata%\DowenloAud keepierr\ftMgeveLTo.dll
- %Common Appdata%\DowenloAud keepierr\ftMgeveLTo.tlb
- %Common Appdata%\DowenloAud keepierr\K39Kf6Olvbe.dat
- %Common Appdata%\DowenloAud keepierr\K39Kf6Olvbe.exe