Jump to content

Welcome to Geeks to Go
Geeks to Go Welcome
Create Account Login to Account
Photo

Removal instructions for Youndoo FakeFFProfile

- - - - -
Started by Metallica , Feb 20 2017 09:50 AM

  • Please log in to reply
No replies to this topic

#1
Metallica
Posted 20 February 2017 - 09:50 AM

Metallica

    Spyware Veteran

  • GeekU Moderator
  • 33,101 posts
Content is republished with permission from Malwarebytes.

What is Youndoo?

The Malwarebytes research team has determined that Youndoo is a browser hijacker. These so-called "hijackers" manipulate your browser(s), for example to change your startpage or searchscopes, so that the affected browser visits their site or one of their choice. This one also displays advertisements.
This version of the Youndoo search hijacker adds an extra Firefox profile and uses a Scheduled Task to re-infect or update the infection.

How do I know if my computer is affected by Youndoo?

You may see this entry in your list of installed software:

warning4.png

this new startpage in the affected browsers:

startpage.png

warning1.png

these Scheduled Tasks:

warning3.png

and you may see this type of advertisements:

advertisement.png

How did Youndoo get on my computer?

Browser hijackers use different methods for distributing themselves. This particular one was bundled with other software.

How do I remove Youndoo?

Our program Malwarebytes can detect and remove this potentially unwanted program.
  • Please download Malwarebytes to your desktop.
  • Double-click mb3-setup-consumer-{version}.exe and follow the prompts to install the program.
  • Then click Finish.
  • Once the program has fully updated, select Scan Now on the Dashboard. Or select the Threat Scan from the Scan menu.
  • If another update of the definitions is available, it will be implemented before the rest of the scanning procedure.
  • When the scan is complete, make sure that all Threats are selected, and click Remove Selected.
  • Restart your computer when prompted to do so.
Is there anything else I need to do to get rid of Youndoo?
  • This adware creates some scheduled tasks. You can read here how to check for and, if necessary, remove Scheduled Tasks.
  • Follow the instructions posted here to remove the fake Firefox profile.
How would the full version of Malwarebytes help protect me?

We hope our application and this guide have helped you eradicate this hijacker.

As you can see below the full version of Malwarebytes would have protected you against the Youndoo hijacker. It would have warned you before the application could install itself, giving you a chance to stop it before it became too late.

protection1.png

and we block access to some of their domains:

protection2.png

Technical details for experts

Possible signs in FRST logs:

 HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1
 ShellExecuteHooks:  - {5AD340E8-F445-11E6-B566-64006A5CFC23} - C:\Program Files (x86)\Thuluch\Reuqutain.dll [146432 2017-02-20] ()
 FF NewTab: hxxp://www.youndoo.com/?z={z1}&from=wak&uid={uid1}&type=hp
 FF DefaultSearchEngine: youndoo
 FF SelectedSearchEngine: youndoo
 FF Homepage: hxxp://www.youndoo.com/?z={z1}&from=wak&uid={uid1}&type=hp
 FF SearchPlugin: C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\mhc384j1.default\searchplugins\jebnkuvk.xml [2017-02-20]
 CHR HomePage: ChromeDefaultData2 -> hxxp://www.youndoo.com/?z={z1}&from=wak&uid={uid1}&type=hp
 CHR StartupUrls: ChromeDefaultData2 -> "hxxp://www.youndoo.com/?z={z1}&from=wak&uid={uid1}&type=hp"
 CHR DefaultSearchURL: ChromeDefaultData2 -> hxxp://www.youndoo.com/search/?q={searchTerms}&z={z1}&from=wak&uid={uid1}&type=sp
 CHR DefaultSearchKeyword: ChromeDefaultData2 -> youndoo
 C:\Users\{username}\AppData\Local\Gunelejahidom
 C:\Program Files (x86)\Thuluch
 C:\WINDOWS\System32\Tasks\Nimasy Engine
 C:\WINDOWS\System32\Tasks\Gfakdutoing
 C:\Program Files (x86)\Nimasy Engine

youndoo - Uninstall (HKLM-x32\...\{92C91B86-B20E-474B-A1D9-6B7D5AC229C4}) (Version:  - )
Task: {17E1E42D-FDE0-4335-977B-6DFA92F053ED} - System32\Tasks\Gfakdutoing => /i hxxp://d2buh1bf1g584w.cloudfront.net/msi/rel.php?u={uid1}&v=2017220 /q
Task: {40A77D42-8C8A-4FA2-8C4E-51FBC532FD30} - System32\Tasks\Nimasy Engine => C:\Program Files (x86)\Thuluch\plejither.exe [2017-02-20] (Glarysoft Ltd)
Alterations made by the installer:


File system details [View: All details] (Selection)
---------------------------------------------------
    Adds the folder C:\Program Files (x86)\Nimasy Engine
    Adds the folder C:\Program Files (x86)\Thuluch
       Adds the file ClearData.exe"="2/20/2017 1:42 PM, 169664 bytes, A
       Adds the file CrashReport.dll"="2/20/2017 1:42 PM, 121344 bytes, A
       Adds the file mglobal.dll"="2/20/2017 1:42 PM, 112128 bytes, A
       Adds the file plejither.exe"="2/20/2017 1:42 PM, 1027000 bytes, A
       Adds the file Reuqutain.dll"="2/20/2017 1:42 PM, 146432 bytes, A
    In the existing folder C:\Windows\System32\Tasks
       Adds the file Gfakdutoing"="2/20/2017 1:42 PM, 5128 bytes, A
       Adds the file Nimasy Engine"="2/20/2017 1:42 PM, 6030 bytes, A

Registry details [View: All details] (Selection)
------------------------------------------------
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5AD340E8-F445-11E6-B566-64006A5CFC23}\InProcServer32]
       "(Default)"="REG_SZ", "C:\Program Files (x86)\Thuluch\Reuqutain.dll"
       "ThreadingModel"="REG_SZ", "Apartment"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft]
       "help"="REG_SZ", "http://www.youndoo.com/?z={z1}&from=wak&uid={uid1}&type=hp"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
       "{5AD340E8-F445-11E6-B566-64006A5CFC23}"="REG_SZ", ""
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer]
       "EnableShellExecuteHooks"="REG_DWORD", 1
    [HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\{84416237-6490-494D-9AD6-4994DD978971}]
       "chd"="REG_SZ", "C:\Users\{username}\AppData\Local\Gunelejahidom"
       "ffd"="REG_SZ", "C:\Users\{username}\AppData\Roaming\Profiles\Gherluwardcoozeied.default"
    [HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Cherlaghphaige]
    [HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Gouwardguzele]
    [HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{92C91B86-B20E-474B-A1D9-6B7D5AC229C4}]
       "DisplayName"="REG_SZ", "youndoo - Uninstall"
       "UninstallString"="REG_SZ", "C:\Program Files (x86)\Thuluch\plejither.exe 29be9ce7-f8b2-42b3-b0a4-32c68378402a "/k={92C91B86-B20E-474B-A1D9-6B7D5AC229C4}""
    [HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\msServer]
       "(Default)"="REG_DWORD", 1
    [HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\plejither.exe]
       "(Default)"="REG_SZ", "2017220"
    [HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\TaskInj]
       "(Default)"="REG_DWORD", 1
    [HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\xvb`lj]
       "day"="REG_SZ", "20170220"
       "upday"="REG_SZ", "20170220"
    [HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\youndooSoftware\youndoohp]
       "oem"="REG_SZ", "wak"
       "Time"="REG_DWORD", 1487594583
    [HKEY_LOCAL_MACHINE\SOFTWARE\xvb`lj]
       "day"="REG_SZ", "20170220"
       "upday"="REG_SZ", "20170220"
    [HKEY_USERS\.DEFAULT\Software\xvb`lj]
       "day"="REG_SZ", "20170220"
       "upday"="REG_SZ", "20170220"
Malwarebytes log:

{computername}
www.{computername}.com

-Log Details-
Scan Date: 2/20/17
Scan Time: 2:10 PM
Logfile: mbamYoundoo.txt
Administrator: Yes

-Software Information-
Version: 3.0.6.1469
Components Version: 1.0.50
Update Package Version: 1.0.1307
License: Premium

-System Information-
OS: Windows 10
CPU: x64
File System: NTFS
User: {computername}\{username}

-Scan Summary-
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 420585
Time Elapsed: 8 min, 58 sec

-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

-Scan Details-
Process: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registry Key: 4
Adware.Elex.Generic, HKLM\SOFTWARE\CLASSES\CLSID\{5AD340E8-F445-11E6-B566-64006A5CFC23}, Delete-on-Reboot, [2155], [356410],1.0.1307
Adware.Elex.Generic, HKLM\SOFTWARE\CLASSES\CLSID\{5AD340E8-F445-11E6-B566-64006A5CFC23}\InprocServer32, Delete-on-Reboot, [2155], [356410],1.0.1307
PUP.Optional.Youndoo, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{92C91B86-B20E-474B-A1D9-6B7D5AC229C4}, Delete-on-Reboot, [767], [182916],1.0.1307
PUP.Optional.Youndoo, HKLM\SOFTWARE\WOW6432NODE\youndooSoftware, Delete-on-Reboot, [767], [182849],1.0.1307

Registry Value: 4
Adware.Elex.Generic, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELLEXECUTEHOOKS|{5AD340E8-F445-11E6-B566-64006A5CFC23}, Delete-on-Reboot, [2155], [356410],1.0.1307
Adware.Elex.SHHKRST, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER|ENABLESHELLEXECUTEHOOKS, Delete-on-Reboot, [357], [-1],0.0.0
Adware.Elex.SHHKRST, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER|ENABLESHELLEXECUTEHOOKS, Delete-on-Reboot, [357], [-1],0.0.0
PUP.Optional.Youndoo, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{92C91B86-B20E-474B-A1D9-6B7D5AC229C4}|DISPLAYNAME, Delete-on-Reboot, [767], [182916],1.0.1307

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 3
PUP.Optional.FakeFFProfile, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\naweriweentcofise\Profiles\mhc384j1.default, Delete-on-Reboot, [2786], [363173],1.0.1307
PUP.Optional.FakeFFProfile, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\naweriweentcofise\Profiles, Delete-on-Reboot, [2786], [363173],1.0.1307
PUP.Optional.FakeFFProfile, C:\USERS\{username}\APPDATA\ROAMING\Mozilla\Firefox\naweriweentcofise, Delete-on-Reboot, [2786], [363173],1.0.1307

File: 22
PUP.Optional.FakeFFProfile, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\naweriweentcofise\Profiles\mhc384j1.default\prefs.js, Delete-on-Reboot, [2786], [363173],1.0.1307
PUP.Optional.FakeFFProfile, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\naweriweentcofise\Profiles\mhc384j1.default\profiles.ini, Delete-on-Reboot, [2786], [363173],1.0.1307
PUP.Optional.FakeFFProfile, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\naweriweentcofise\Profiles\mhc384j1.default\search-metadata.json, Delete-on-Reboot, [2786], [363173],1.0.1307
PUP.Optional.FakeFFProfile, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\naweriweentcofise\Profiles\mhc384j1.default\search.json.mozlz4, Delete-on-Reboot, [2786], [363173],1.0.1307
Adware.Elex.Generic, C:\PROGRAM FILES (X86)\THULUCH\REUQUTAIN.DLL, Delete-on-Reboot, [2155], [356410],1.0.1307
PUP.Optional.Youndoo, C:\USERS\{username}\APPDATA\ROAMING\PROFILES\GHERLUWARDCOOZEIED.DEFAULT\PREFS.JS, Replaced, [767], [324487],1.0.1307
PUP.Optional.Youndoo, C:\USERS\{username}\APPDATA\ROAMING\PROFILES\GHERLUWARDCOOZEIED.DEFAULT\PREFS.JS, Replaced, [767], [324487],1.0.1307
PUP.Optional.Youndoo, C:\USERS\{username}\APPDATA\ROAMING\PROFILES\GHERLUWARDCOOZEIED.DEFAULT\PREFS.JS, Replaced, [767], [324487],1.0.1307
PUP.Optional.Youndoo, C:\USERS\{username}\APPDATA\ROAMING\PROFILES\GHERLUWARDCOOZEIED.DEFAULT\PREFS.JS, Replaced, [767], [324487],1.0.1307
PUP.Optional.Youndoo, C:\USERS\{username}\APPDATA\ROAMING\PROFILES\GHERLUWARDCOOZEIED.DEFAULT\PREFS.JS, Replaced, [767], [324487],1.0.1307
PUP.Optional.Youndoo, C:\USERS\{username}\APPDATA\ROAMING\PROFILES\GHERLUWARDCOOZEIED.DEFAULT\PREFS.JS, Replaced, [767], [324487],1.0.1307
PUP.Optional.Youndoo, C:\USERS\{username}\APPDATA\ROAMING\PROFILES\GHERLUWARDCOOZEIED.DEFAULT\PREFS.JS, Replaced, [767], [324487],1.0.1307
PUP.Optional.Youndoo, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\MHC384J1.DEFAULT\PREFS.JS, Replaced, [767], [302817],1.0.1307
PUP.Optional.Youndoo, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\MHC384J1.DEFAULT\PREFS.JS, Replaced, [767], [302817],1.0.1307
PUP.Optional.Youndoo, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\MHC384J1.DEFAULT\PREFS.JS, Replaced, [767], [302817],1.0.1307
PUP.Optional.Youndoo, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\MHC384J1.DEFAULT\PREFS.JS, Replaced, [767], [302817],1.0.1307
PUP.Optional.Youndoo, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\MHC384J1.DEFAULT\PREFS.JS, Replaced, [767], [302817],1.0.1307
Adware.Elex, C:\USERS\{username}\DESKTOP\WAK_MY.EXE, Delete-on-Reboot, [305], [363419],1.0.1307
PUP.Optional.Youndoo, C:\USERS\{username}\APPDATA\ROAMING\PROFILES\GHERLUWARDCOOZEIED.DEFAULT\SEARCHPLUGINS\JEBNKUVK.XML, Delete-on-Reboot, [767], [324489],1.0.1307
Adware.Elex.SHHKRST, C:\PROGRAM FILES (X86)\THULUCH\CRASHREPORT.DLL, Delete-on-Reboot, [357], [372356],1.0.1307
Adware.Elex.SHHKRST, C:\WINDOWS\SYSTEM32\TASKS\Gfakdutoing, Delete-on-Reboot, [357], [-1],0.0.0
PUP.Optional.Youndoo, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\MHC384J1.DEFAULT\SEARCHPLUGINS\JEBNKUVK.XML, Delete-on-Reboot, [767], [302734],1.0.1307

Physical Sector: 0
(No malicious items detected)


(end)
As mentioned before the full version of Malwarebytes could have protected your computer against this threat.
We use different ways of protecting your computer(s):
  • Dynamically Blocks Malware Sites & Servers
  • Malware Execution Prevention
Save yourself the hassle and get protected.
  • 0

Advertisements

Back to Malware Removal Guides and Tutorials


0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

  1. Geeks to Go Community
  2. → Security
  3. → Malware Removal Guides and Tutorials

As Featured On:

featured
Malware Removal How to Guides Windows 7 System Building Download Files Register welcome

Never used a forum? Learn how.