Jump to content

Welcome to Geeks to Go
Geeks to Go Welcome
Create Account Login to Account
Photo

Removal instructions for YunPanSer

- - - - -
Started by Metallica , Jul 25 2017 08:06 AM
Baidu Cloud Search

  • Please log in to reply
No replies to this topic

#1
Metallica
Posted 25 July 2017 - 08:06 AM

Metallica

    Spyware Veteran

  • GeekU Moderator
  • 33,101 posts
Content is republished with permission from Malwarebytes.

What is YunPanSer?

The Malwarebytes research team has determined that YunPanSer is a browser hijacker. These so-called "hijackers" manipulate your browser(s), for example to change your startpage or searchscopes, so that the affected browser visits their site or one of their choice. This one hijacks browser shortcuts.

How do I know if my computer is affected by YunPanSer?

You may see this entry in your list of installed software:

warning4.png

and these warnings during install:

warning1.png

warning2.png

this type of change to your browser shortcuts:

warning3.png

and you will see these icons in your startmenu and on your desktop:

icons.png

How did YunPanSer get on my computer?

Browser hijackers use different methods for distributing themselves. This particular one was offered as Baidu Cloud Search.

How do I remove YunPanSer?

Our program Malwarebytes can detect and remove this potentially unwanted program.
  • Please download Malwarebytes to your desktop.
  • Double-click mb3-setup-consumer-{version}.exe and follow the prompts to install the program.
  • Then click Finish.
  • Once the program has fully updated, select Scan Now on the Dashboard. Or select the Threat Scan from the Scan menu.
  • If another update of the definitions is available, it will be implemented before the rest of the scanning procedure.
  • When the scan is complete, make sure that all Threats are selected, and click Remove Selected.
  • Restart your computer when prompted to do so.
Is there anything else I need to do to get rid of YunPanSer?
  • No, Malwarebytes removes YunPanSer completely.
  • The shortcut called 百度网盘种子综合搜索器 on the desktop can be deleted if it belonged to the rogue.
How would the full version of Malwarebytes help protect me?

We hope our application and this guide have helped you eradicate this hijacker.

As you can see below the full version of Malwarebytes would have protected you against the YunPanSer hijacker. It would have warned you before the application could install itself, giving you a chance to stop it before it became too late.

protection1.png


Technical details for experts

Possible signs in FRST logs:

 () C:\Program Files (x86)\YunPanSer\YunPanSer.exe
 C:\Users\Public\Desktop\百度网盘种子综合搜索器.lnk
 C:\ProgramData\Microsoft\Windows\Start Menu\Programs\百度网盘种子综合搜索器
 C:\Program Files (x86)\YunPanSer
 C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
 C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
 C:\Users\Public\Desktop\Google Chrome.lnk
 C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera Browser.lnk
 C:\Users\Public\Desktop\Opera Browser.lnk
 C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
 C:\Users\Public\Desktop\Mozilla Firefox.lnk
 C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
 C:\Users\Public\Desktop\Google Chrome.lnk

百度网盘种子综合搜索器版本V2.0.0 (HKLM-x32\...\{0E684690-1A6F-4E5B-AB49-9992958E460E}_is1) (Version: V2.0.0 - )
ShortcutWithArgument: C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://hao549.com/?r=y&m=8
ShortcutWithArgument: C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Windows Explorer.lnk -> C:\Windows\explorer.exe (Microsoft Corporation) -> hxxp://hao549.com/?r=y&m=8
ShortcutWithArgument: C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://hao549.com/?r=y&m=8
ShortcutWithArgument: C:\Users\{username}\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> hxxp://hao549.com/?r=y&m=8
ShortcutWithArgument: C:\Users\{username}\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://hao549.com/?r=y&m=8
ShortcutWithArgument: C:\Users\{username}\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> hxxp://hao549.com/?r=y&m=8
ShortcutWithArgument: C:\Users\{username}\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://hao549.com/?r=y&m=8
ShortcutWithArgument: C:\Users\{username}\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mozilla Firefox.lnk -> C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) -> hxxp://hao549.com/?r=y&m=8
ShortcutWithArgument: C:\Users\{username}\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Opera.lnk -> C:\Program Files (x86)\Opera\launcher.exe (Opera Software) -> hxxp://hao549.com/?r=y&m=8
ShortcutWithArgument: C:\Users\{username}\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Windows Explorer.lnk -> C:\Windows\explorer.exe (Microsoft Corporation) -> hxxp://hao549.com/?r=y&m=8
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> hxxp://hao549.com/?r=y&m=8
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk -> C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) -> hxxp://hao549.com/?r=y&m=8
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera Browser.lnk -> C:\Program Files (x86)\Opera\launcher.exe (Opera Software) -> hxxp://hao549.com/?r=y&m=8
ShortcutWithArgument: C:\Users\Public\Desktop\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> hxxp://hao549.com/?r=y&m=8
ShortcutWithArgument: C:\Users\Public\Desktop\Mozilla Firefox.lnk -> C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) -> hxxp://hao549.com/?r=y&m=8
ShortcutWithArgument: C:\Users\Public\Desktop\Opera Browser.lnk -> C:\Program Files (x86)\Opera\launcher.exe (Opera Software) -> hxxp://hao549.com/?r=y&m=8
Alterations made by the installer:

File system details [View: All details] (Selection)
---------------------------------------------------
    Adds the folder C:\Program Files (x86)\YunPanSer
       Adds the file bannerdown.gif"="7/25/2017 9:23 AM, 13852 bytes, A
       Adds the file bj.gif"="7/25/2017 9:23 AM, 178267 bytes, A
       Adds the file HtmlAgilityPack.dll"="8/6/2012 9:30 PM, 134656 bytes, A
       Adds the file HtmlAgilityPack.XML"="8/6/2012 9:30 PM, 122991 bytes, A
       Adds the file Interop.ThunderAgentLib.dll"="8/1/2016 12:30 PM, 29696 bytes, A
       Adds the file Newtonsoft.Json.dll"="7/17/2012 8:24 PM, 333312 bytes, A
       Adds the file SetHomePage.dll"="8/11/2016 5:36 PM, 394240 bytes, A
       Adds the file ThunderAgent.dll"="3/22/2016 12:53 PM, 125808 bytes, A
       Adds the file unins000.dat"="7/25/2017 9:23 AM, 11295 bytes, A
       Adds the file unins000.exe"="7/25/2017 9:23 AM, 1218959 bytes, A
       Adds the file YunPanSer.exe"="8/26/2016 11:58 AM, 362496 bytes, A
       Adds the file YunPanSer.exe.config"="7/4/2016 9:41 PM, 161 bytes, A
       Adds the file YunPanSer.pdb"="8/26/2016 11:58 AM, 103936 bytes, A
       Adds the file YunPanSer.vshost.exe"="8/26/2016 11:58 AM, 22696 bytes, A
       Adds the file YunPanSer.vshost.exe.config"="7/4/2016 9:41 PM, 161 bytes, A
       Adds the file YunPanSer.vshost.exe.manifest"="6/29/2016 6:10 PM, 3336 bytes, A
    Adds the folder C:\Program Files (x86)\YunPanSer\skin
    In the existing folder C:\ProgramData\Microsoft\Windows\Start Menu\Programs
       Alters the file Google Chrome.lnk
       Alters the file Mozilla Firefox.lnk
       Alters the file Opera Browser.lnk
    Adds the folder C:\ProgramData\Microsoft\Windows\Start Menu\Programs\百度网盘种子综合搜索器
       Adds the file 卸载百度网盘种子综合搜索器.lnk"="7/25/2017 9:23 AM, 1032 bytes, A
       Adds the file 百度网盘种子综合搜索器.lnk"="7/25/2017 9:23 AM, 1037 bytes, A
    In the existing folder C:\Users\{username}\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch
       Alters the file Google Chrome.lnk
       Alters the file Launch Internet Explorer Browser.lnk
    In the existing folder C:\Users\{username}\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar
       Alters the file Google Chrome.lnk
       Alters the file Internet Explorer.lnk
       Alters the file Mozilla Firefox.lnk
       Alters the file Opera.lnk
       Alters the file Windows Explorer.lnk
    In the existing folder C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs
       Alters the file Internet Explorer.lnk
    In the existing folder C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
       Alters the file Windows Explorer.lnk
    In the existing folder C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools
       Alters the file Internet Explorer (No Add-ons).lnk
    In the existing folder C:\Users\Public\Desktop
       Alters the file Google Chrome.lnk
       Alters the file Mozilla Firefox.lnk
       Alters the file Opera Browser.lnk
       Adds the file 百度网盘种子综合搜索器.lnk"="7/25/2017 9:23 AM, 1019 bytes, A

Registry details [View: All details] (Selection)
------------------------------------------------
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{0E684690-1A6F-4E5B-AB49-9992958E460E}_is1]
       "DisplayName"="REG_SZ", "百度网盘种子综合搜索器版本V2.0.0"
       "DisplayVersion"="REG_SZ", "V2.0.0"
       "EstimatedSize"="REG_DWORD", 4121
       "Inno Setup: App Path"="REG_SZ", "C:\Program Files (x86)\YunPanSer"
       "Inno Setup: Deselected Tasks"="REG_SZ", ""
       "Inno Setup: Icon Group"="REG_SZ", "百度网盘种子综合搜索器"
       "Inno Setup: Language"="REG_SZ", "default"
       "Inno Setup: Selected Tasks"="REG_SZ", "desktopicon"
       "Inno Setup: Setup Version"="REG_SZ", "5.5.4 (u)"
       "Inno Setup: User"="REG_SZ", "{username}"
       "InstallDate"="REG_SZ", "20170725"
       "InstallLocation"="REG_SZ", "C:\Program Files (x86)\YunPanSer\"
       "NoModify"="REG_DWORD", 1
       "NoRepair"="REG_DWORD", 1
       "QuietUninstallString"="REG_SZ", ""C:\Program Files (x86)\YunPanSer\unins000.exe" /SILENT"
       "UninstallString"="REG_SZ", ""C:\Program Files (x86)\YunPanSer\unins000.exe""
Malwarebytes log:

Malwarebytes
www.malwarebytes.com

-Log Details-
Scan Date: 7/25/17
Scan Time: 2:40 PM
Log File: mbamYunPanSer.txt
Administrator: Yes

-Software Information-
Version: 3.1.2.1733
Components Version: 1.0.160
Update Package Version: 1.0.2433
License: Premium

-System Information-
OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: {computername}\{username}

-Scan Summary-
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 339360
Threats Detected: 41
Threats Quarantined: 41
Time Elapsed: 1 min, 36 sec

-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

-Scan Details-
Process: 1
Adware.ChinAd.ShrtCln, C:\PROGRAM FILES (X86)\YUNPANSER\YUNPANSER.EXE, Quarantined, [9714], [419783],1.0.2433

Module: 2
Adware.HomeGuard, C:\PROGRAM FILES (X86)\YUNPANSER\SETHOMEPAGE.DLL, Quarantined, [3222], [387871],1.0.2433
Adware.ChinAd.ShrtCln, C:\PROGRAM FILES (X86)\YUNPANSER\YUNPANSER.EXE, Quarantined, [9714], [419783],1.0.2433

Registry Key: 3
Adware.ChinAd.ShrtCln, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{0E684690-1A6F-4E5B-AB49-9992958E460E}_is1, Delete-on-Reboot, [9714], [419783],1.0.2433
Adware.ChinAd.ShrtCln, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\YunPanSer_RASAPI32, Delete-on-Reboot, [9714], [419784],1.0.2433
Adware.ChinAd.ShrtCln, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\YunPanSer_RASMANCS, Delete-on-Reboot, [9714], [419784],1.0.2433

Registry Value: 1
Adware.ChinAd.ShrtCln, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{0E684690-1A6F-4E5B-AB49-9992958E460E}_is1|INSTALLLOCATION, Delete-on-Reboot, [9714], [419785],1.0.2433

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 1
Adware.ChinAd.ShrtCln, C:\Program Files (x86)\YunPanSer\skin, Delete-on-Reboot, [9714], [419783],1.0.2433

File: 33
Adware.HomeGuard, C:\PROGRAM FILES (X86)\YUNPANSER\SETHOMEPAGE.DLL, Delete-on-Reboot, [3222], [387871],1.0.2433
Adware.Agent, C:\USERS\{username}\DESKTOP\BDWPZZSSSQ.EXE, Delete-on-Reboot, [259], [419664],1.0.2433
Adware.ChinAd.ShrtCln, C:\PROGRAM FILES (X86)\YUNPANSER\YUNPANSER.EXE, Delete-on-Reboot, [9714], [419783],1.0.2433
Adware.ChinAd.ShrtCln, C:\Program Files (x86)\YunPanSer\skin\b1.png, Delete-on-Reboot, [9714], [419783],1.0.2433
Adware.ChinAd.ShrtCln, C:\Program Files (x86)\YunPanSer\skin\b2.png, Delete-on-Reboot, [9714], [419783],1.0.2433
Adware.ChinAd.ShrtCln, C:\Program Files (x86)\YunPanSer\skin\bb1.png, Delete-on-Reboot, [9714], [419783],1.0.2433
Adware.ChinAd.ShrtCln, C:\Program Files (x86)\YunPanSer\skin\bb2.png, Delete-on-Reboot, [9714], [419783],1.0.2433
Adware.ChinAd.ShrtCln, C:\Program Files (x86)\YunPanSer\skin\bj.png, Delete-on-Reboot, [9714], [419783],1.0.2433
Adware.ChinAd.ShrtCln, C:\Program Files (x86)\YunPanSer\skin\logo.ico, Delete-on-Reboot, [9714], [419783],1.0.2433
Adware.ChinAd.ShrtCln, C:\Program Files (x86)\YunPanSer\skin\logo.png, Delete-on-Reboot, [9714], [419783],1.0.2433
Adware.ChinAd.ShrtCln, C:\Program Files (x86)\YunPanSer\skin\sx1.png, Delete-on-Reboot, [9714], [419783],1.0.2433
Adware.ChinAd.ShrtCln, C:\Program Files (x86)\YunPanSer\skin\sx2.png, Delete-on-Reboot, [9714], [419783],1.0.2433
Adware.ChinAd.ShrtCln, C:\Program Files (x86)\YunPanSer\skin\xx1.png, Delete-on-Reboot, [9714], [419783],1.0.2433
Adware.ChinAd.ShrtCln, C:\Program Files (x86)\YunPanSer\skin\xx2.png, Delete-on-Reboot, [9714], [419783],1.0.2433
Adware.ChinAd.ShrtCln, C:\Program Files (x86)\YunPanSer\skin\分割线.png, Delete-on-Reboot, [9714], [419783],1.0.2433
Adware.ChinAd.ShrtCln, C:\Program Files (x86)\YunPanSer\skin\箭头初始状态.png, Delete-on-Reboot, [9714], [419783],1.0.2433
Adware.ChinAd.ShrtCln, C:\Program Files (x86)\YunPanSer\skin\箭头点击状态.png, Delete-on-Reboot, [9714], [419783],1.0.2433
Adware.ChinAd.ShrtCln, C:\Program Files (x86)\YunPanSer\skin\类型选择常态.png, Delete-on-Reboot, [9714], [419783],1.0.2433
Adware.ChinAd.ShrtCln, C:\Program Files (x86)\YunPanSer\skin\类型选择悬停状态.png, Delete-on-Reboot, [9714], [419783],1.0.2433
Adware.ChinAd.ShrtCln, C:\Program Files (x86)\YunPanSer\skin\背景图（无文字）.png, Delete-on-Reboot, [9714], [419783],1.0.2433
Adware.ChinAd.ShrtCln, C:\Program Files (x86)\YunPanSer\bannerdown.gif, Delete-on-Reboot, [9714], [419783],1.0.2433
Adware.ChinAd.ShrtCln, C:\Program Files (x86)\YunPanSer\bj.gif, Delete-on-Reboot, [9714], [419783],1.0.2433
Adware.ChinAd.ShrtCln, C:\Program Files (x86)\YunPanSer\HtmlAgilityPack.dll, Delete-on-Reboot, [9714], [419783],1.0.2433
Adware.ChinAd.ShrtCln, C:\Program Files (x86)\YunPanSer\HtmlAgilityPack.XML, Delete-on-Reboot, [9714], [419783],1.0.2433
Adware.ChinAd.ShrtCln, C:\Program Files (x86)\YunPanSer\Interop.ThunderAgentLib.dll, Delete-on-Reboot, [9714], [419783],1.0.2433
Adware.ChinAd.ShrtCln, C:\Program Files (x86)\YunPanSer\Newtonsoft.Json.dll, Delete-on-Reboot, [9714], [419783],1.0.2433
Adware.ChinAd.ShrtCln, C:\Program Files (x86)\YunPanSer\ThunderAgent.dll, Delete-on-Reboot, [9714], [419783],1.0.2433
Adware.ChinAd.ShrtCln, C:\Program Files (x86)\YunPanSer\unins000.dat, Delete-on-Reboot, [9714], [419783],1.0.2433
Adware.ChinAd.ShrtCln, C:\Program Files (x86)\YunPanSer\unins000.exe, Delete-on-Reboot, [9714], [419783],1.0.2433
Adware.ChinAd.ShrtCln, C:\Program Files (x86)\YunPanSer\YunPanSer.exe.config, Delete-on-Reboot, [9714], [419783],1.0.2433
Adware.ChinAd.ShrtCln, C:\Program Files (x86)\YunPanSer\YunPanSer.pdb, Delete-on-Reboot, [9714], [419783],1.0.2433
Adware.ChinAd.ShrtCln, C:\Program Files (x86)\YunPanSer\YunPanSer.vshost.exe.config, Delete-on-Reboot, [9714], [419783],1.0.2433
Adware.ChinAd.ShrtCln, C:\Program Files (x86)\YunPanSer\YunPanSer.vshost.exe.manifest, Delete-on-Reboot, [9714], [419783],1.0.2433

Physical Sector: 0
(No malicious items detected)


(end)
As mentioned before the full version of Malwarebytes could have protected your computer against this threat.
We use different ways of protecting your computer(s):
  • Dynamically Blocks Malware Sites & Servers
  • Malware Execution Prevention
Save yourself the hassle and get protected.
  • 0

Advertisements

Back to Malware Removal Guides and Tutorials


0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

  1. Geeks to Go Forum
  2. → Security
  3. → Malware Removal Guides and Tutorials

As Featured On:

featured
Malware Removal How to Guides Windows 7 System Building Download Files Register welcome

Never used a forum? Learn how.