KSCAN.EXE – Unclassified Malware removal

KSCAN.EXE size: 152424 bytes
KSCAN.EXE hash: 83526E850520B8EB1D025A832F8431F8

Created files:

C:\program files\kingsoft\kingsoft antivirus\cloudctrl.config
C:\program files\kingsoft\kingsoft antivirus\data\floatskin\dudubao.skin
C:\program files\kingsoft\kingsoft antivirus\data\floatskin\jijian.skin
C:\program files\kingsoft\kingsoft antivirus\data\floatskin\kongqizhiliang.skin
C:\program files\kingsoft\kingsoft antivirus\data\floatskin\tianshizhiyi.skin
C:\program files\kingsoft\kingsoft antivirus\data\floatskin\wenduji.skin
C:\program files\kingsoft\kingsoft antivirus\data\rule.krf
C:\program files\kingsoft\kingsoft antivirus\defendmon.dll
C:\program files\kingsoft\kingsoft antivirus\jsonv6.dll
C:\program files\kingsoft\kingsoft antivirus\kavevent.dll
C:\program files\kingsoft\kingsoft antivirus\kavlog2.exe
C:\program files\kingsoft\kingsoft antivirus\kavmenu.dll
C:\program files\kingsoft\kingsoft antivirus\kavmenu64.dll
C:\program files\kingsoft\kingsoft antivirus\kavpid.kid
C:\program files\kingsoft\kingsoft antivirus\kcleaner.exe
C:\program files\kingsoft\kingsoft antivirus\kclearpanel.dll
C:\program files\kingsoft\kingsoft antivirus\kcommonpid.kid
C:\program files\kingsoft\kingsoft antivirus\kdefendpop.dll
C:\program files\kingsoft\kingsoft antivirus\kdf.exe
C:\program files\kingsoft\kingsoft antivirus\kdgui2.dll
C:\program files\kingsoft\kingsoft antivirus\kdrvmgr.exe
C:\program files\kingsoft\kingsoft antivirus\keasyipcn.dll
C:\program files\kingsoft\kingsoft antivirus\kfloatmain.dll
C:\program files\kingsoft\kingsoft antivirus\kfloatwin.dll
C:\program files\kingsoft\kingsoft antivirus\khackfix.kid
C:\program files\kingsoft\kingsoft antivirus\kisfdpro64.dll
C:\program files\kingsoft\kingsoft antivirus\kislive.exe
C:\program files\kingsoft\kingsoft antivirus\kismain.dll
C:\program files\kingsoft\kingsoft antivirus\kismain.exe
C:\program files\kingsoft\kingsoft antivirus\knetworkpanel.dll
C:\program files\kingsoft\kingsoft antivirus\kpassport.dll
C:\program files\kingsoft\kingsoft antivirus\kpopclt.dll
C:\program files\kingsoft\kingsoft antivirus\kpopsvr.dll
C:\program files\kingsoft\kingsoft antivirus\krcmdutils.dll
C:\program files\kingsoft\kingsoft antivirus\krecycle.exe
C:\program files\kingsoft\kingsoft antivirus\ks3rdhmpg.dll
C:\program files\kingsoft\kingsoft antivirus\ks3rdhmpg64.dll
C:\program files\kingsoft\kingsoft antivirus\ksapi.dll
C:\program files\kingsoft\kingsoft antivirus\ksapi.sys
C:\program files\kingsoft\kingsoft antivirus\ksapi64.dll
C:\program files\kingsoft\kingsoft antivirus\ksapi64.sys
C:\program files\kingsoft\kingsoft antivirus\kscan.exe
C:\program files\kingsoft\kingsoft antivirus\ksdectrl.dll
C:\program files\kingsoft\kingsoft antivirus\ksetupwiz.exe
C:\program files\kingsoft\kingsoft antivirus\kshmpg.dll
C:\program files\kingsoft\kingsoft antivirus\kshmpgext.dll
C:\program files\kingsoft\kingsoft antivirus\kskinmgr.dll
C:\program files\kingsoft\kingsoft antivirus\kslaunch.exe
C:\program files\kingsoft\kingsoft antivirus\kspupwnd.dll
C:\program files\kingsoft\kingsoft antivirus\kstools.dll
C:\program files\kingsoft\kingsoft antivirus\kswebshield.dll
C:\program files\kingsoft\kingsoft antivirus\kswscxex.dll
C:\program files\kingsoft\kingsoft antivirus\ksysopteng.dll
C:\program files\kingsoft\kingsoft antivirus\ktoolupd.dll
C:\program files\kingsoft\kingsoft antivirus\ktrashscan.dll
C:\program files\kingsoft\kingsoft antivirus\kupdata.exe
C:\program files\kingsoft\kingsoft antivirus\kupdatesp.dll
C:\program files\kingsoft\kingsoft antivirus\kvmpid2.kid
C:\program files\kingsoft\kingsoft antivirus\kwifitool.kid
C:\program files\kingsoft\kingsoft antivirus\kwsprotect64.exe
C:\program files\kingsoft\kingsoft antivirus\kwssp.dll
C:\program files\kingsoft\kingsoft antivirus\kwsui.dll
C:\program files\kingsoft\kingsoft antivirus\kwsui64.dll
C:\program files\kingsoft\kingsoft antivirus\kxebase.dll
C:\program files\kingsoft\kingsoft antivirus\kxebscsp.dll
C:\program files\kingsoft\kingsoft antivirus\kxecore\kxecore.dll
C:\program files\kingsoft\kingsoft antivirus\kxeksgpid.kid
C:\program files\kingsoft\kingsoft antivirus\kxereg.dll
C:\program files\kingsoft\kingsoft antivirus\kxescore.exe
C:\program files\kingsoft\kingsoft antivirus\kxescore_sp.xcf
C:\program files\kingsoft\kingsoft antivirus\kxetray.exe
C:\program files\kingsoft\kingsoft antivirus\lbhelper.dll
C:\program files\kingsoft\kingsoft antivirus\lblocker.dll
C:\program files\kingsoft\kingsoft antivirus\liectrl.config
C:\program files\kingsoft\kingsoft antivirus\msvcp80.dll
C:\program files\kingsoft\kingsoft antivirus\msvcr80.dll
C:\program files\kingsoft\kingsoft antivirus\netbuyprot.dll
C:\program files\kingsoft\kingsoft antivirus\operation\cas\kfmt.datx
C:\program files\kingsoft\kingsoft antivirus\operation\cas\kinfoc.dll
C:\program files\kingsoft\kingsoft antivirus\recommendctrl.config
C:\program files\kingsoft\kingsoft antivirus\ressrc\chs\uplive.svr
C:\program files\kingsoft\kingsoft antivirus\scom.dll
C:\program files\kingsoft\kingsoft antivirus\security\ksde\kisknl.sys
C:\program files\kingsoft\kingsoft antivirus\security\ksde\kisknl64.sys
C:\program files\kingsoft\kingsoft antivirus\security\ksde\kislog.dll
C:\program files\kingsoft\kingsoft antivirus\security\ksde\klengine.dll
C:\program files\kingsoft\kingsoft antivirus\security\ksde\kmctrl.dll
C:\program files\kingsoft\kingsoft antivirus\security\ksde\ksdecs.dll
C:\program files\kingsoft\kingsoft antivirus\security\ksnetm\kisnetm.sys
C:\program files\kingsoft\kingsoft antivirus\security\ksnetm\kisnetm64.sys
C:\program files\kingsoft\kingsoft antivirus\security\ksnetm\kisnetmxp.sys
C:\program files\kingsoft\kingsoft antivirus\security\ksnetm\kmonstat.dll
C:\program files\kingsoft\kingsoft antivirus\security\kxescan\bc.sys
C:\program files\kingsoft\kingsoft antivirus\security\kxescan\denyip.krf
C:\program files\kingsoft\kingsoft antivirus\security\kxescan\kavquara.dll
C:\program files\kingsoft\kingsoft antivirus\security\kxescan\kfcdetect.dll
C:\program files\kingsoft\kingsoft antivirus\security\kxescan\khandler.dll
C:\program files\kingsoft\kingsoft antivirus\security\kxescan\khistory.dll
C:\program files\kingsoft\kingsoft antivirus\security\kxescan\krmcdm.krf
C:\program files\kingsoft\kingsoft antivirus\security\kxescan\ksbwdet2.dll
C:\program files\kingsoft\kingsoft antivirus\security\kxescan\kscanner.dll
C:\program files\kingsoft\kingsoft antivirus\security\kxescan\kseescan.dll
C:\program files\kingsoft\kingsoft antivirus\security\kxescan\ksesscan.dll
C:\program files\kingsoft\kingsoft antivirus\security\kxescan\kseutil.dll
C:\program files\kingsoft\kingsoft antivirus\security\kxescan\ksreng3.dll
C:\program files\kingsoft\kingsoft antivirus\security\kxescan\ksscore.dll
C:\program files\kingsoft\kingsoft antivirus\security\kxescan\ksskrpr.sys
C:\program files\kingsoft\kingsoft antivirus\security\kxescan\kxesansp.dll
C:\program files\kingsoft\kingsoft antivirus\security\kxescan\sp3a.nlb
C:\program files\kingsoft\kingsoft antivirus\security\kxescan\sqlite.dll
C:\program files\kingsoft\kingsoft antivirus\security\kxescan\wfs.dll
C:\program files\kingsoft\kingsoft antivirus\uni0nst.exe
C:\program files\kingsoft\kingsoft antivirus\zlib1.dll
%SysDir%\drivers\bc.sys
%SysDir%\drivers\kisknl.sys
%SysDir%\drivers\kisknl64.sys
%SysDir%\drivers\kisnetm.sys
%SysDir%\drivers\kisnetm64.sys
%SysDir%\drivers\kisnetmxp.sys
%SysDir%\drivers\ksapi.sys
%SysDir%\drivers\ksapi64.sys
%SysDir%\drivers\ksskrpr.sys

Detected by UnHackMe:

KSCAN.EXE
Default location: %PROGRAM FILES%\KINGSOFT\KINGSOFT ANTIVIRUS\KSCAN.EXE

Dropper information:
MD5: 1f1c87b2b8528523907cc58c00923df8
File size: 17611944 bytes