Jump to content

Welcome to Geeks to Go
Geeks to Go Welcome
Create Account Login to Account
Photo

Removal instructions for HPRewriter2

- - - - - traffic-media.co

  • Please log in to reply
No replies to this topic

#1
Metallica

Metallica

    Spyware Veteran

  • GeekU Moderator
  • 32,305 posts
Content is republished with permission from Malwarebytes.

What is HPRewriter2?

The Malwarebytes research team has determined that HPRewriter2 is a browser hijacker. These so-called "hijackers" manipulate your browser(s), for example to change your startpage or searchscopes, so that the affected browser visits their site or one of their choice.
This one replaces many browser shortcuts and shows advertisements.

targets.png

How do I know if my computer is affected by HPRewriter2?

You may see this entry in your list of installed software:

warning4.png

and these shortcuts on your desktop, your startmenu, and your taskbar:

warning1.png

warning2.png

warning3.png

warning3.png

and you will see this startpage:

startpage.png

How did HPRewriter2 get on my computer?

Browser hijackers use different methods for distributing themselves. This particular one was installed by a trojan.

How do I remove HPRewriter2?

Our program Malwarebytes Anti-Malware can detect and remove this potentially unwanted program.
  • Please download Malwarebytes Anti-Malware to your desktop.
  • Double-click mbam-setup-{version}.exe and follow the prompts to install the program.
  • At the end, be sure a check-mark is placed next to:
    Launch Malwarebytes Anti-Malware
  • Then click Finish.
  • Once the program has loaded, select Scan Now. Or select the Threat Scan from the Scan menu.
  • If an update is available, it will be implemented before the rest of the scanning procedure.
  • When the scan is complete, make sure that all Threats are selected, and click Remove Selected.
  • Restart your computer when prompted to do so.
Is there anything else I need to do to get rid of HPRewriter2?
  • No, Malwarebytes' Anti-Malware removes HPRewriter2 completely.
  • The hijacker alters the shortcuts for Chrome, Opera, Internet Explorer, Yandex, and FireFox. here you can read how to create new, clean shortcuts.
How would the full version of Malwarebytes Anti-Malware help protect me?

We hope our application and this guide have helped you eradicate this hijacker.

As you can see below the full version of Malwarebytes Anti-Malware would have protected you against the HPRewriter2 hijacker. It would have warned you before the application could install itself, giving you a chance to stop it before it became too late.

protection1.png


Technical details for experts

Possible signs in FRST logs:

 (PSEJHI coidt) C:\Users\{username}\AppData\Roaming\HPRewriter2\HPWriterSrv3.exe
 R2 HPWriter Service; C:\Users\{username}\AppData\Roaming\HPRewriter2\HPWriterSrv3.exe [1047040 2016-08-16] (PSEJHI coidt) [File not signed]
 C:\ProgramData\Microsoft\Windows\Start Menu\Programs\??zill? Fir?f??.lnk
 C:\ProgramData\Microsoft\Windows\Start Menu\Programs\G??gl? ?hr?m?.lnk
 C:\Users\MBAM\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Int?rn?t ???l?r?r.lnk
 C:\Users\Public\Desktop\??zill? Fir?f??.lnk
 C:\Users\Public\Desktop\G??gl? ?hr?m?.lnk
 C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Int?rn?t ???l?r?r.lnk
 C:\Users\{username}\AppData\Roaming\HPRewriter2
 C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
 C:\Users\Public\Desktop\Google Chrome.lnk

HPRewriter2 (HKLM-x32\...\HPRewriter2) (Version:  - )

Shortcut: C:\Users\MBAM\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Int?rn?t ???l?r?r.lnk -> C:\Users\MBAM\AppData\Roaming\HPRewriter2\RewRun3.exe (No File)
Shortcut: C:\Users\MBAM\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Int?rn?t ???l?r?r (N? ?dd-?ns).lnk -> C:\Users\MBAM\AppData\Roaming\HPRewriter2\RewRun3.exe (No File)
Shortcut: C:\Users\MBAM\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\G??gl? ?hr?m?.lnk -> C:\Users\MBAM\AppData\Roaming\HPRewriter2\RewRun3.exe (No File)
Shortcut: C:\Users\MBAM\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Int?rn?t ???l?r?r.lnk -> C:\Users\MBAM\AppData\Roaming\HPRewriter2\RewRun3.exe (No File)
Shortcut: C:\Users\MBAM\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\??zill? Fir?f??.lnk -> C:\Users\MBAM\AppData\Roaming\HPRewriter2\RewRun3.exe (No File)
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\G??gl? ?hr?m?.lnk -> C:\Users\{username}\AppData\Roaming\HPRewriter2\RewRun3.exe (hxaynup) -> 1 0
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\??zill? Fir?f??.lnk -> C:\Users\{username}\AppData\Roaming\HPRewriter2\RewRun3.exe (hxaynup) -> 2 0
ShortcutWithArgument: C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Int?rn?t ???l?r?r.lnk -> C:\Users\{username}\AppData\Roaming\HPRewriter2\RewRun3.exe (hxaynup) -> 3 0
ShortcutWithArgument: C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Int?rn?t ???l?r?r (N? ?dd-?ns).lnk -> C:\Users\{username}\AppData\Roaming\HPRewriter2\RewRun3.exe (hxaynup) -> 3 0
ShortcutWithArgument: C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Ease of Access.lnk -> C:\Windows\System32\control.exe (Microsoft Corporation) -> /name Microsoft.EaseOfAccessCenter
ShortcutWithArgument: C:\Users\{username}\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\G??gl? ?hr?m?.lnk -> C:\Users\{username}\AppData\Roaming\HPRewriter2\RewRun3.exe (hxaynup) -> 1 0
ShortcutWithArgument: C:\Users\{username}\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Int?rn?t ???l?r?r.lnk -> C:\Users\{username}\AppData\Roaming\HPRewriter2\RewRun3.exe (hxaynup) -> 3 0
ShortcutWithArgument: C:\Users\{username}\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\??zill? Fir?f??.lnk -> C:\Users\{username}\AppData\Roaming\HPRewriter2\RewRun3.exe (hxaynup) -> 2 0
ShortcutWithArgument: C:\Users\Public\Desktop\G??gl? ?hr?m?.lnk -> C:\Users\{username}\AppData\Roaming\HPRewriter2\RewRun3.exe (hxaynup) -> 1 0
ShortcutWithArgument: C:\Users\Public\Desktop\??zill? Fir?f??.lnk -> C:\Users\{username}\AppData\Roaming\HPRewriter2\RewRun3.exe (hxaynup) -> 2 0
Alterations made by the installer:

File system details [View: All details] (Selection)
---------------------------------------------------
    In the existing folder C:\ProgramData\Microsoft\Windows\Start Menu\Programs
       Deletes the file Google Chrome.lnk"="8/5/2016 10:51 AM, 2195 bytes, A
       Adds the file G??gl? ?hr?m?.lnk"="8/17/2016 8:38 AM, 2135 bytes, A
       Deletes the file Mozilla Firefox.lnk"="2/8/2016 1:27 PM, 1159 bytes, A
       Adds the file ??zill? Fir?f??.lnk"="8/17/2016 8:38 AM, 2137 bytes, A
    In the existing folder C:\Users\MBAM\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar
       Deletes the file Google Chrome.lnk"="2/8/2016 1:44 PM, 2284 bytes, A
       Adds the file G??gl? ?hr?m?.lnk"="8/17/2016 8:38 AM, 2313 bytes, A
       Deletes the file Internet Explorer.lnk"="2/8/2016 4:52 PM, 1419 bytes, A
       Adds the file Int?rn?t ???l?r?r.lnk"="8/17/2016 8:38 AM, 2417 bytes, A
       Deletes the file Mozilla Firefox.lnk"="2/8/2016 1:28 PM, 1159 bytes, A
       Adds the file ??zill? Fir?f??.lnk"="8/17/2016 8:38 AM, 2181 bytes, A
    In the existing folder C:\Users\MBAM\AppData\Roaming\Microsoft\Windows\Start Menu\Programs
       Deletes the file Internet Explorer.lnk"="2/8/2016 4:52 PM, 1413 bytes, A
       Adds the file Int?rn?t ???l?r?r.lnk"="8/17/2016 8:38 AM, 2127 bytes, A
    In the existing folder C:\Users\MBAM\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools
       Deletes the file Internet Explorer (No Add-ons).lnk"="2/8/2016 4:52 PM, 1463 bytes, A
       Adds the file Int?rn?t ???l?r?r (N? ?dd-?ns).lnk"="8/17/2016 8:38 AM, 2139 bytes, A
    Adds the folder C:\Users\{username}\AppData\Roaming\HPRewriter2
       Adds the file HPWriterSrv3.exe"="8/16/2016 12:03 PM, 1047040 bytes, A
       Adds the file RewRun3.exe"="8/16/2016 12:06 PM, 949760 bytes, A
       Adds the file uninstaller.exe"="8/17/2016 8:38 AM, 221442 bytes, A
    Adds the folder C:\Users\{username}\AppData\Roaming\HPRewriter2\Resources\Icons\Browsers
       Adds the file chrome.ico"="8/5/2016 1:01 PM, 24957 bytes, A
       Adds the file firefox.ico"="8/5/2016 1:01 PM, 67901 bytes, A
       Adds the file ie.ico"="8/5/2016 1:01 PM, 52231 bytes, A
       Adds the file opera.ico"="8/5/2016 1:01 PM, 18329 bytes, A
       Adds the file yandex.ico"="8/5/2016 1:01 PM, 20036 bytes, A
    In the existing folder C:\Users\{username}\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar
       Deletes the file Google Chrome.lnk"="3/3/2016 10:14 AM, 2393 bytes, A
       Adds the file G??gl? ?hr?m?.lnk"="8/17/2016 8:38 AM, 2243 bytes, A
       Deletes the file Internet Explorer.lnk"="2/10/2016 11:10 AM, 1413 bytes, A
       Adds the file Int?rn?t ???l?r?r.lnk"="8/17/2016 8:38 AM, 2347 bytes, A
       Deletes the file Mozilla Firefox.lnk"="6/20/2016 11:24 AM, 1159 bytes, A
       Adds the file ??zill? Fir?f??.lnk"="8/17/2016 8:38 AM, 2111 bytes, A
    In the existing folder C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs
       Deletes the file Internet Explorer.lnk"="2/10/2016 11:10 AM, 1413 bytes, A
       Adds the file Int?rn?t ???l?r?r.lnk"="8/17/2016 8:38 AM, 2057 bytes, A
    In the existing folder C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools
       Deletes the file Internet Explorer (No Add-ons).lnk"="2/10/2016 11:10 AM, 1463 bytes, A
       Adds the file Int?rn?t ???l?r?r (N? ?dd-?ns).lnk"="8/17/2016 8:38 AM, 2069 bytes, A
    In the existing folder C:\Users\Public\Desktop
       Deletes the file Google Chrome.lnk"="8/5/2016 10:51 AM, 2183 bytes, A
       Adds the file G??gl? ?hr?m?.lnk"="8/17/2016 8:38 AM, 2105 bytes, A
       Deletes the file Mozilla Firefox.lnk"="2/8/2016 1:27 PM, 1147 bytes, A
       Adds the file ??zill? Fir?f??.lnk"="8/17/2016 8:38 AM, 2107 bytes, A

Registry details [View: All details] (Selection)
------------------------------------------------
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\HPRewriter]
       "cwykda"="REG_SZ", "eyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInVybCIgICAgICA6ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgImh0dHA6Ly9rcmF3YXphc2lyb2NsYS5ydSIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICwgICAgICAgICAgICAgICAicmV3cml0ZV90aW1lb3V0X21pbiIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA1ICAgICAgICAgICB9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\HPRewriter\Components]
       "Main"="REG_SZ", "1"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\HPRewriter2]
       "DisplayName"="REG_SZ", "HPRewriter2"
       "UninstallString"="REG_SZ", "C:\Users\{username}\AppData\Roaming\HPRewriter2\uninstaller.exe"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\HPWriter Service]
       "DisplayName"="REG_SZ", "HPWriter Service"
       "ErrorControl"="REG_DWORD", 1
       "ImagePath"="REG_EXPAND_SZ, "C:\Users\{username}\AppData\Roaming\HPRewriter2\HPWriterSrv3.exe"
       "ObjectName"="REG_SZ", "LocalSystem"
       "Start"="REG_DWORD", 2
       "Type"="REG_DWORD", 16
       "WOW64"="REG_DWORD", 1
Malwarebytes Anti-Malware log:

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 8/17/2016
Scan Time: 8:52 AM
Logfile: mbamHPRewriter2.txt
Administrator: Yes

Version: 2.2.1.1043
Malware Database: v2016.08.17.04
Rootkit Database: v2016.08.15.01
License: Premium
Malware Protection: Disabled
Malicious Website Protection: Enabled
Self-protection: Enabled

OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: {username}

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 318137
Time Elapsed: 9 min, 5 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 1
PUP.Optional.HPDefender.Generic, C:\Users\{username}\AppData\Roaming\HPRewriter2\HPWriterSrv3.exe, 3076, Delete-on-Reboot, [f92f26265c3efd390b81d1fb659f17e9]

Modules: 0
(No malicious items detected)

Registry Keys: 3
Trojan.Agent, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\HPRewriter2, Quarantined, [e741b399c5d5e35386d005ccca3af709], 
PUP.Optional.HPDefender.Generic, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\HPWriter Service, Quarantined, [f92f26265c3efd390b81d1fb659f17e9], 
PUP.Optional.HPDefender.Generic, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\HPRewriter2, Quarantined, [f92f26265c3efd390b81d1fb659f17e9], 

Registry Values: 1
PUP.Optional.HPDefender.Generic, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\HPWriter Service|ImagePath, C:\Users\{username}\AppData\Roaming\HPRewriter2\HPWriterSrv3.exe, Quarantined, [9593bd8f465473c3c3c6be0ef60eb54b]

Registry Data: 0
(No malicious items detected)

Folders: 4
PUP.Optional.HPDefender.Generic, C:\Users\{username}\AppData\Roaming\HPRewriter2, Delete-on-Reboot, [f92f26265c3efd390b81d1fb659f17e9], 
PUP.Optional.HPDefender.Generic, C:\Users\{username}\AppData\Roaming\HPRewriter2\Resources, Quarantined, [f92f26265c3efd390b81d1fb659f17e9], 
PUP.Optional.HPDefender.Generic, C:\Users\{username}\AppData\Roaming\HPRewriter2\Resources\Icons, Quarantined, [f92f26265c3efd390b81d1fb659f17e9], 
PUP.Optional.HPDefender.Generic, C:\Users\{username}\AppData\Roaming\HPRewriter2\Resources\Icons\Browsers, Quarantined, [f92f26265c3efd390b81d1fb659f17e9], 

Files: 11
Trojan.Agent, C:\Users\{username}\AppData\Roaming\HPRewriter2\RewRun3.exe, Delete-on-Reboot, [141499b30892b383a2bf05cc1de707f9], 
Trojan.Agent, C:\Users\{username}\AppData\Roaming\HPRewriter2\uninstaller.exe, Quarantined, [e741b399c5d5e35386d005ccca3af709], 
Trojan.Agent, C:\Users\{username}\Desktop\krawazasirocla.ru_World.exe, Quarantined, [b0784606aaf054e2ec6afbd6b35145bb], 
PUP.Optional.HPDefender.Generic, C:\Users\{username}\AppData\Roaming\HPRewriter2\HPWriterSrv3.exe, Delete-on-Reboot, [f92f26265c3efd390b81d1fb659f17e9], 
PUP.Optional.HPDefender.Generic, C:\Users\{username}\AppData\Roaming\HPRewriter2\RewRun3.exe, Delete-on-Reboot, [f92f26265c3efd390b81d1fb659f17e9], 
PUP.Optional.HPDefender.Generic, C:\Users\{username}\AppData\Roaming\HPRewriter2\uninstaller.exe, Quarantined, [f92f26265c3efd390b81d1fb659f17e9], 
PUP.Optional.HPDefender.Generic, C:\Users\{username}\AppData\Roaming\HPRewriter2\Resources\Icons\Browsers\chrome.ico, Quarantined, [f92f26265c3efd390b81d1fb659f17e9], 
PUP.Optional.HPDefender.Generic, C:\Users\{username}\AppData\Roaming\HPRewriter2\Resources\Icons\Browsers\firefox.ico, Quarantined, [f92f26265c3efd390b81d1fb659f17e9], 
PUP.Optional.HPDefender.Generic, C:\Users\{username}\AppData\Roaming\HPRewriter2\Resources\Icons\Browsers\ie.ico, Quarantined, [f92f26265c3efd390b81d1fb659f17e9], 
PUP.Optional.HPDefender.Generic, C:\Users\{username}\AppData\Roaming\HPRewriter2\Resources\Icons\Browsers\opera.ico, Quarantined, [f92f26265c3efd390b81d1fb659f17e9], 
PUP.Optional.HPDefender.Generic, C:\Users\{username}\AppData\Roaming\HPRewriter2\Resources\Icons\Browsers\yandex.ico, Quarantined, [f92f26265c3efd390b81d1fb659f17e9], 

Physical Sectors: 0
(No malicious items detected)


(end)
As mentioned before the full version of Malwarebytes Anti-Malware could have protected your computer against this threat.
We use different ways of protecting your computer(s):
  • Dynamically Blocks Malware Sites & Servers
  • Malware Execution Prevention
Save yourself the hassle and get protected.
  • 0

Advertisements





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

featured
Malware Removal How to Guides Windows 7 System Building Download Files Register welcome

Never used a forum? Learn how.