XINSTALLER.EXE – Unclassified Malware removal

XINSTALLER.EXE size: 35208 bytes
XINSTALLER.EXE hash: 273E4B7F759DC94C0DA8E9036103A24F

Created files:

%Program Files Common%\Thunder Network\Kankan\temp\kankanlite.dll
%Program Files Common%\Thunder Network\Kankan\temp\KankanLiteLiveUD.dll
%Program Files Common%\Thunder Network\Kankan\temp\KankanLiteLiveUD.exe
%Program Files Common%\Thunder Network\Kankan\temp\KanKanLive.exe
%Program Files Common%\Thunder Network\Kankan\temp\KKMediaCtrl.dll
%Program Files Common%\Thunder Network\Kankan\temp\KKVPCtrl.dll
%Program Files Common%\Thunder Network\Kankan\temp\LiveDapCtrl.dll
%Program Files Common%\Thunder Network\Kankan\temp\livelite.dll
%Program Files Common%\Thunder Network\Kankan\temp\live_download.dll
%Program Files Common%\Thunder Network\Kankan\temp\PutDeskLnk.exe
%Program Files Common%\Thunder Network\Kankan\temp\StreamI.dll
%Program Files Common%\Thunder Network\Kankan\temp\ThunderServiceLite.exe
%Program Files Common%\Thunder Network\Kankan\temp\Uninstall.exe
%Program Files Common%\Thunder Network\Kankan\temp\xinstaller.dll
%Program Files Common%\Thunder Network\Kankan\temp\xinstaller.exe
%Program Files Common%\Thunder Network\Kankan\temp\xlnpDapCtrl.dll
%Program Files Common%\Thunder Network\Kankan\temp\XLStartKankan.exe
%Program Files Common%\Thunder Network\Kankan\temp\Xmp.exe
%Program Files Common%\Thunder Network\Kankan\temp\XmpSetupHelper.dll
%Program Files%\Thunder Network\XMP\V5.1.18.3909\Bin\DapCtrl.dll
%Program Files%\Thunder Network\XMP\V5.1.18.3909\Bin\LiveUDInstaller.exe
%Program Files%\Thunder Network\XMP\V5.1.18.3909\Bin\ShlExt.dll
%Program Files%\Thunder Network\XMP\V5.1.18.3909\Bin\ShlExt_x64.dll
%Program Files%\Thunder Network\XMP\V5.1.18.3909\Bin\ThunderFW.exe
%Program Files%\Thunder Network\XMP\V5.1.18.3909\Bin\UserAgent.dll
%Program Files%\Thunder Network\XMP\V5.1.18.3909\Bin\XLLiveUD.exe
%Program Files%\Thunder Network\XMP\V5.1.18.3909\Bin\xlstat4.dll
%Program Files%\Thunder Network\XMP\V5.1.18.3909\Bin\XLUserS.dll
%Program Files%\Thunder Network\XMP\V5.1.18.3909\Bin\XMP.exe
%Program Files%\Thunder Network\XMP\V5.1.18.3909\TP\al.dll
%Program Files%\Thunder Network\XMP\V5.1.18.3909\TP\asyn_download_interface.dll
%Program Files%\Thunder Network\XMP\V5.1.18.3909\TP\asyn_frame.dll
%Program Files%\Thunder Network\XMP\V5.1.18.3909\TP\backend_agent.dll
%Program Files%\Thunder Network\XMP\V5.1.18.3909\TP\bt_kernel.dll
%Program Files%\Thunder Network\XMP\V5.1.18.3909\TP\dl_peer_id.dll
%Program Files%\Thunder Network\XMP\V5.1.18.3909\TP\dl_uac_tool.dll
%Program Files%\Thunder Network\XMP\V5.1.18.3909\TP\download_engine.dll
%Program Files%\Thunder Network\XMP\V5.1.18.3909\TP\download_interface.dll
%Program Files%\Thunder Network\XMP\V5.1.18.3909\TP\download_profiles\server.met
%Program Files%\Thunder Network\XMP\V5.1.18.3909\TP\down_dispatcher.dll
%Program Files%\Thunder Network\XMP\V5.1.18.3909\TP\dphubt.dll
%Program Files%\Thunder Network\XMP\V5.1.18.3909\TP\dtnet.dll
%Program Files%\Thunder Network\XMP\V5.1.18.3909\TP\emule_kernel.dll
%Program Files%\Thunder Network\XMP\V5.1.18.3909\TP\fs.dll
%Program Files%\Thunder Network\XMP\V5.1.18.3909\TP\libexpat.dll
%Program Files%\Thunder Network\XMP\V5.1.18.3909\TP\MediaFileHeaderFirst.dll
%Program Files%\Thunder Network\XMP\V5.1.18.3909\TP\MediaParser.dll
%Program Files%\Thunder Network\XMP\V5.1.18.3909\TP\media_data.dll
%Program Files%\Thunder Network\XMP\V5.1.18.3909\TP\minizip.dll
%Program Files%\Thunder Network\XMP\V5.1.18.3909\TP\mini_unzip_dll.dll
%Program Files%\Thunder Network\XMP\V5.1.18.3909\TP\module_downloader.dll
%Program Files%\Thunder Network\XMP\V5.1.18.3909\TP\mp.dll
%Program Files%\Thunder Network\XMP\V5.1.18.3909\TP\p2p.dll
%Program Files%\Thunder Network\XMP\V5.1.18.3909\TP\p2p_cloud.dll
%Program Files%\Thunder Network\XMP\V5.1.18.3909\TP\p2p_local_res.dll
%Program Files%\Thunder Network\XMP\V5.1.18.3909\TP\p2p_session_com.dll
%Program Files%\Thunder Network\XMP\V5.1.18.3909\TP\p2p_upload.dll
%Program Files%\Thunder Network\XMP\V5.1.18.3909\TP\p2sp.dll
%Program Files%\Thunder Network\XMP\V5.1.18.3909\TP\ptl.dll
%Program Files%\Thunder Network\XMP\V5.1.18.3909\TP\ptl_proxy.dll
%Program Files%\Thunder Network\XMP\V5.1.18.3909\TP\sl.dll
%Program Files%\Thunder Network\XMP\V5.1.18.3909\TP\stream.dll
%Program Files%\Thunder Network\XMP\V5.1.18.3909\TP\TA.dll
%Program Files%\Thunder Network\XMP\V5.1.18.3909\TP\task_report.dll
%Program Files%\Thunder Network\XMP\V5.1.18.3909\TP\TDPRepair.exe
%Program Files%\Thunder Network\XMP\V5.1.18.3909\TP\ThunderFW.exe
%Program Files%\Thunder Network\XMP\V5.1.18.3909\TP\ThunderLiveUD.exe
%Program Files%\Thunder Network\XMP\V5.1.18.3909\TP\ThunderPlatform.exe
%Program Files%\Thunder Network\XMP\V5.1.18.3909\TP\tp_proxy.dll
%Program Files%\Thunder Network\XMP\V5.1.18.3909\TP\ts.dll
%Program Files%\Thunder Network\XMP\V5.1.18.3909\TP\UACTool.dll
%Program Files%\Thunder Network\XMP\V5.1.18.3909\TP\upnp.exe
%Program Files%\Thunder Network\XMP\V5.1.18.3909\TP\utl.dll
%Program Files%\Thunder Network\XMP\V5.1.18.3909\TP\XLBugHandler.dll
%Program Files%\Thunder Network\XMP\V5.1.18.3909\TP\XLBugReport.exe
%Program Files%\Thunder Network\XMP\V5.1.18.3909\TP\XLCrypto.dll
%Program Files%\Thunder Network\XMP\V5.1.18.3909\TP\xldc.dll
%Program Files%\Thunder Network\XMP\V5.1.18.3909\TP\xldcagent.dll
%Program Files%\Thunder Network\XMP\V5.1.18.3909\TP\XLFSIO.dll
%Program Files%\Thunder Network\XMP\V5.1.18.3909\TP\XLLuaRuntime.dll
%Program Files%\Thunder Network\XMP\V5.1.18.3909\TP\xl_client.dll
%Program Files%\Thunder Network\XMP\V5.1.18.3909\TP\xl_data.dll
%Program Files%\Thunder Network\XMP\V5.1.18.3909\TP\xl_data_warehouse.dll
%Program Files%\Thunder Network\XMP\V5.1.18.3909\TP\zlib1.dll
%Program Files%\Thunder Network\XMP\V5.1.18.3909\Uninst.exe
%Common AppData%\Thunder Network\APlayerRelease\codecs\agif.dll
%Common AppData%\Thunder Network\APlayerRelease\codecs\audioswitcher.dll
%Common AppData%\Thunder Network\APlayerRelease\codecs\evrcp.dll
%Common AppData%\Thunder Network\APlayerRelease\codecs\flvmultisrc.dll
%Common AppData%\Thunder Network\APlayerRelease\codecs\flvsplitter.dll
%Common AppData%\Thunder Network\APlayerRelease\codecs\ijl15.dll
%Common AppData%\Thunder Network\APlayerRelease\codecs\vsfilter.dll
%Common AppData%\Thunder Network\APlayerRelease\Temp\APlayer.dll
%Common AppData%\Thunder Network\APlayerRelease\Temp\APlayerUI.dll
%Common AppData%\Thunder Network\KKVideo\Temp\Core\Program\DataX.dll
%Common AppData%\Thunder Network\KKVideo\Temp\Core\Program\KKV.exe
%Common AppData%\Thunder Network\KKVideo\Temp\Core\Program\KKVIconHandler.dll
%Common AppData%\Thunder Network\KKVideo\Temp\Core\Program\KKVIconHandler64.dll
%Common AppData%\Thunder Network\KKVideo\Temp\Core\Program\KKVideo.dll
%Common AppData%\Thunder Network\KKVideo\Temp\Resource\IconRes\default.skin
%Common AppData%\Thunder Network\KKVideo\Temp\Uninstall.exe
%Common AppData%\Thunder Network\KKVideo\Temp\Xar\KKVideo\basecontrol.xar
%Common AppData%\Thunder Network\KKVideo\Temp\Xar\KKVideo\main.xar
%Common AppData%\Thunder Network\KKVideo\Temp\Xar\KKVideo\plugins\hao123textexplugin.xar
%Common AppData%\Thunder Network\KKVideo\Temp\Xar\KKVideo\plugins\searchbarplugin.xar
%Common AppData%\Thunder Network\XMP5\V5.1.18.3909\Program\APlayer.exe
%Common AppData%\Thunder Network\XMP5\V5.1.18.3909\Program\BrowserExternal.dll
%Common AppData%\Thunder Network\XMP5\V5.1.18.3909\Program\BrowserPage.dll
%Common AppData%\Thunder Network\XMP5\V5.1.18.3909\Program\DataX.dll
%Common AppData%\Thunder Network\XMP5\V5.1.18.3909\Program\dcdn_sdk.dll
%Common AppData%\Thunder Network\XMP5\V5.1.18.3909\Program\MainTray.dll
%Common AppData%\Thunder Network\XMP5\V5.1.18.3909\Program\MediaDoctor.dll
%Common AppData%\Thunder Network\XMP5\V5.1.18.3909\Program\MediaInfo.dll
%Common AppData%\Thunder Network\XMP5\V5.1.18.3909\Program\StreamI.dll
%Common AppData%\Thunder Network\XMP5\V5.1.18.3909\Program\SystemPlugin.dll
%Common AppData%\Thunder Network\XMP5\V5.1.18.3909\Program\TipAddin.dll
%Common AppData%\Thunder Network\XMP5\V5.1.18.3909\Program\UserLogin.dll
%Common AppData%\Thunder Network\XMP5\V5.1.18.3909\Program\VideoUrlSniffer.dll
%Common AppData%\Thunder Network\XMP5\V5.1.18.3909\Program\WebBrowserHelper.dll
%Common AppData%\Thunder Network\XMP5\V5.1.18.3909\Program\XAddinUpdate.dll
%Common AppData%\Thunder Network\XMP5\V5.1.18.3909\Program\xlstat4.dll
%Common AppData%\Thunder Network\XMP5\V5.1.18.3909\Program\XMediaLibrary.dll
%Common AppData%\Thunder Network\XMP5\V5.1.18.3909\Program\XMediaLibrary64.dll
%Common AppData%\Thunder Network\XMP5\V5.1.18.3909\Program\xmp.exe
%Common AppData%\Thunder Network\XMP5\V5.1.18.3909\Program\XmpAddins.dll
%Common AppData%\Thunder Network\XMP5\V5.1.18.3909\Program\XmpAdvance.dll
%Common AppData%\Thunder Network\XMP5\V5.1.18.3909\Program\XmpAssociate.dll
%Common AppData%\Thunder Network\XMP5\V5.1.18.3909\Program\XmpCoreVersion.dll
%Common AppData%\Thunder Network\XMP5\V5.1.18.3909\Program\XmpLiveUpdateHelper.dll
%Common AppData%\Thunder Network\XMP5\V5.1.18.3909\Program\XmpPlayer.dll
%Common AppData%\Thunder Network\XMP5\V5.1.18.3909\Program\XmpUpdateCodecs.dll
%Common AppData%\Thunder Network\XMP5\V5.1.18.3909\Program\XmpUtility.dll
%Common AppData%\Thunder Network\XMP5\V5.1.18.3909\Program\XmpWin7TaskbarTrait.dll
%Common AppData%\Thunder Network\XMP5\V5.1.18.3909\webxmp\xmp.exe
%Common AppData%\Thunder Network\XMP5\V5.1.18.3909\webxmp\xmp.exe.bak
%Common AppData%\Thunder Network\XMP5\V5.1.18.3909\xar\app\ipcaplayer.xar
%Common AppData%\Thunder Network\XMP5\V5.1.18.3909\xar\app\kkvfixwork.xar
%Common AppData%\Thunder Network\XMP5\V5.1.18.3909\xar\app\pusherfix.xar
%Common AppData%\Thunder Network\XMP5\V5.1.18.3909\xar\browser\browser.xar
%Common AppData%\Thunder Network\XMP5\V5.1.18.3909\xar\browser\webaplayerplugin.xar
%Common AppData%\Thunder Network\XMP5\V5.1.18.3909\xar\browser\webbrowserhelper.xar
%Common AppData%\Thunder Network\XMP5\V5.1.18.3909\xar\liveupdate\xmpliveupdate.xar
%Common AppData%\Thunder Network\XMP5\V5.1.18.3909\xar\plugins\bottomtipsplugin.xar
%Common AppData%\Thunder Network\XMP5\V5.1.18.3909\xar\plugins\browserhistoryplugin.xar
%Common AppData%\Thunder Network\XMP5\V5.1.18.3909\xar\plugins\configplugin.xar
%Common AppData%\Thunder Network\XMP5\V5.1.18.3909\xar\plugins\dlnaplugin.xar
%Common AppData%\Thunder Network\XMP5\V5.1.18.3909\xar\plugins\favoriteplugin.xar
%Common AppData%\Thunder Network\XMP5\V5.1.18.3909\xar\plugins\kkvplugin.xar
%Common AppData%\Thunder Network\XMP5\V5.1.18.3909\xar\plugins\menuplugin.xar
%Common AppData%\Thunder Network\XMP5\V5.1.18.3909\xar\plugins\movietipsplugin.xar
%Common AppData%\Thunder Network\XMP5\V5.1.18.3909\xar\plugins\playlistplugin.xar
%Common AppData%\Thunder Network\XMP5\V5.1.18.3909\xar\plugins\playlistsubviewplugin.xar
%Common AppData%\Thunder Network\XMP5\V5.1.18.3909\xar\plugins\playpanelplugin.xar
%Common AppData%\Thunder Network\XMP5\V5.1.18.3909\xar\plugins\playpaneltipplugin.xar
%Common AppData%\Thunder Network\XMP5\V5.1.18.3909\xar\plugins\playrecordsynplugin.xar
%Common AppData%\Thunder Network\XMP5\V5.1.18.3909\xar\plugins\programtreeplugin.xar
%Common AppData%\Thunder Network\XMP5\V5.1.18.3909\xar\plugins\recreationplugin.xar
%Common AppData%\Thunder Network\XMP5\V5.1.18.3909\xar\plugins\rightsideviewhandleplugin.xar
%Common AppData%\Thunder Network\XMP5\V5.1.18.3909\xar\plugins\rightsideviewplugin.xar
%Common AppData%\Thunder Network\XMP5\V5.1.18.3909\xar\plugins\searchbarplugin.xar
%Common AppData%\Thunder Network\XMP5\V5.1.18.3909\xar\plugins\subtitleplugin.xar
%Common AppData%\Thunder Network\XMP5\V5.1.18.3909\xar\plugins\TipAddin.xar
%Common AppData%\Thunder Network\XMP5\V5.1.18.3909\xar\plugins\topviewsearchplugin.xar
%Common AppData%\Thunder Network\XMP5\V5.1.18.3909\xar\plugins\userplugin.xar
%Common AppData%\Thunder Network\XMP5\V5.1.18.3909\xar\plugins\vipreachplugin.xar
%Common AppData%\Thunder Network\XMP5\V5.1.18.3909\xar\plugins\webaplayerplugin.xar
%Common AppData%\Thunder Network\XMP5\V5.1.18.3909\xar\plugins\webbrowserhelperplugin.xar
%Common AppData%\Thunder Network\XMP5\V5.1.18.3909\xar\plugins\webbrowserplugin.xar
%Common AppData%\Thunder Network\XMP5\V5.1.18.3909\xar\plugins\welcomeplugin.xar
%Common AppData%\Thunder Network\XMP5\V5.1.18.3909\xar\plugins\win7traitplugin.xar
%Common AppData%\Thunder Network\XMP5\V5.1.18.3909\xar\plugins\xldownloadplugin.xar
%Common AppData%\Thunder Network\XMP5\V5.1.18.3909\xar\plugins\xmpassistplugin.xar
%Common AppData%\Thunder Network\XMP5\V5.1.18.3909\xar\plugins\xmpcloudplugin.xar
%Common AppData%\Thunder Network\XMP5\V5.1.18.3909\xar\plugins\xmpexternal.xar
%Common AppData%\Thunder Network\XMP5\V5.1.18.3909\xar\plugins\xmpstatplugin.xar
%Common AppData%\Thunder Network\XMP5\V5.1.18.3909\xar\tray\maintray.xar
%Temp%\VirusShare_a20b9fba609b3005afdbe6d1b89eff5d\5.1.18.3909\atl71.dll
%Temp%\VirusShare_a20b9fba609b3005afdbe6d1b89eff5d\5.1.18.3909\atl90.dll
%Temp%\VirusShare_a20b9fba609b3005afdbe6d1b89eff5d\5.1.18.3909\CooperationInstaller.exe
%Temp%\VirusShare_a20b9fba609b3005afdbe6d1b89eff5d\5.1.18.3909\dl_peer_id.dll
%Temp%\VirusShare_a20b9fba609b3005afdbe6d1b89eff5d\5.1.18.3909\find_area_lua.lua
%Temp%\VirusShare_a20b9fba609b3005afdbe6d1b89eff5d\5.1.18.3909\libexpat.dll
%Temp%\VirusShare_a20b9fba609b3005afdbe6d1b89eff5d\5.1.18.3909\libpng13.dll
%Temp%\VirusShare_a20b9fba609b3005afdbe6d1b89eff5d\5.1.18.3909\minizip.dll
%Temp%\VirusShare_a20b9fba609b3005afdbe6d1b89eff5d\5.1.18.3909\mini_unzip_dll.dll
%Temp%\VirusShare_a20b9fba609b3005afdbe6d1b89eff5d\5.1.18.3909\msvcp71.dll
%Temp%\VirusShare_a20b9fba609b3005afdbe6d1b89eff5d\5.1.18.3909\msvcp90.dll
%Temp%\VirusShare_a20b9fba609b3005afdbe6d1b89eff5d\5.1.18.3909\msvcr71.dll
%Temp%\VirusShare_a20b9fba609b3005afdbe6d1b89eff5d\5.1.18.3909\msvcr90.dll
%Temp%\VirusShare_a20b9fba609b3005afdbe6d1b89eff5d\5.1.18.3909\onlineindex.lua
%Temp%\VirusShare_a20b9fba609b3005afdbe6d1b89eff5d\5.1.18.3909\SetupReal.dll
%Temp%\VirusShare_a20b9fba609b3005afdbe6d1b89eff5d\5.1.18.3909\SetupUI.cab
%Temp%\VirusShare_a20b9fba609b3005afdbe6d1b89eff5d\5.1.18.3909\SetupXar.xar
%Temp%\VirusShare_a20b9fba609b3005afdbe6d1b89eff5d\5.1.18.3909\shortcutonline.lua
%Temp%\VirusShare_a20b9fba609b3005afdbe6d1b89eff5d\5.1.18.3909\startpageonline.lua
%Temp%\VirusShare_a20b9fba609b3005afdbe6d1b89eff5d\5.1.18.3909\Uninstall.exe
%Temp%\VirusShare_a20b9fba609b3005afdbe6d1b89eff5d\5.1.18.3909\VUS4Chrome\manifest.json
%Temp%\VirusShare_a20b9fba609b3005afdbe6d1b89eff5d\5.1.18.3909\VUS4Chrome\npvusplugin.dll
%Temp%\VirusShare_a20b9fba609b3005afdbe6d1b89eff5d\5.1.18.3909\XLBugHandler.dll
%Temp%\VirusShare_a20b9fba609b3005afdbe6d1b89eff5d\5.1.18.3909\XLBugReport.exe
%Temp%\VirusShare_a20b9fba609b3005afdbe6d1b89eff5d\5.1.18.3909\XLFSIO.dll
%Temp%\VirusShare_a20b9fba609b3005afdbe6d1b89eff5d\5.1.18.3909\XLGraphic.dll
%Temp%\VirusShare_a20b9fba609b3005afdbe6d1b89eff5d\5.1.18.3909\XLGraphicPlus.dll
%Temp%\VirusShare_a20b9fba609b3005afdbe6d1b89eff5d\5.1.18.3909\XLLuaRuntime.dll
%Temp%\VirusShare_a20b9fba609b3005afdbe6d1b89eff5d\5.1.18.3909\xlstat4.dll
%Temp%\VirusShare_a20b9fba609b3005afdbe6d1b89eff5d\5.1.18.3909\XLUE.dll
%Temp%\VirusShare_a20b9fba609b3005afdbe6d1b89eff5d\5.1.18.3909\XLUEIPC.dll
%Temp%\VirusShare_a20b9fba609b3005afdbe6d1b89eff5d\5.1.18.3909\XLUEOPC.dll
%Temp%\VirusShare_a20b9fba609b3005afdbe6d1b89eff5d\5.1.18.3909\XLUEOPS.exe
%Temp%\VirusShare_a20b9fba609b3005afdbe6d1b89eff5d\5.1.18.3909\XmpPusherSetup.exe
%Temp%\VirusShare_a20b9fba609b3005afdbe6d1b89eff5d\5.1.18.3909\XmpSetup0.cab
%Temp%\VirusShare_a20b9fba609b3005afdbe6d1b89eff5d\5.1.18.3909\XmpSetup1.cab
%Temp%\VirusShare_a20b9fba609b3005afdbe6d1b89eff5d\5.1.18.3909\XmpSetup2.cab
%Temp%\VirusShare_a20b9fba609b3005afdbe6d1b89eff5d\5.1.18.3909\XmpSetup3.cab
%Temp%\VirusShare_a20b9fba609b3005afdbe6d1b89eff5d\5.1.18.3909\XmpSetup4.cab
%Temp%\VirusShare_a20b9fba609b3005afdbe6d1b89eff5d\5.1.18.3909\XmpSetup5.cab
%Temp%\VirusShare_a20b9fba609b3005afdbe6d1b89eff5d\5.1.18.3909\XmpSetup6.cab
%Temp%\VirusShare_a20b9fba609b3005afdbe6d1b89eff5d\5.1.18.3909\XmpSetup7.cab
%Temp%\VirusShare_a20b9fba609b3005afdbe6d1b89eff5d\5.1.18.3909\XmpSetup8.cab
%Temp%\VirusShare_a20b9fba609b3005afdbe6d1b89eff5d\5.1.18.3909\XmpSetupAgent.exe
%Temp%\VirusShare_a20b9fba609b3005afdbe6d1b89eff5d\5.1.18.3909\XmpSetupProxy.dll
%Temp%\VirusShare_a20b9fba609b3005afdbe6d1b89eff5d\5.1.18.3909\XmpWin7TaskbarTrait.dll
%Temp%\VirusShare_a20b9fba609b3005afdbe6d1b89eff5d\5.1.18.3909\zlib1.dll

Detected by UnHackMe:

XINSTALLER.EXE
Default location: %PROGRAM FILES COMMON%\THUNDER NETWORK\KANKAN\TEMP\XINSTALLER.EXE

Dropper information:
MD5: a20b9fba609b3005afdbe6d1b89eff5d
File size: 26894208 bytes