Jump to content

Welcome to Geeks to Go
Geeks to Go Welcome
Create Account Login to Account
Photo

Removal instructions for Dotdo Applica

- - - - -
Started by Metallica , Jul 14 2016 11:54 AM

  • Please log in to reply
No replies to this topic

#1
Metallica
Posted 14 July 2016 - 11:54 AM

Metallica

    Spyware Veteran

  • GeekU Moderator
  • 33,101 posts
Content is republished with permission from Malwarebytes.

What is Dotdo Applica?

The Malwarebytes research team has determined that Dotdo Applica is adware. These adware applications display advertisements not originating from the sites you are browsing.

How do I know if my computer is affected by Dotdo Applica?

You may see these entries in your list of installed programs:

warning4.png

and this Scheduled Task:

warning3.png

How did Dotdo Applica get on my computer?

Adware applications use different methods for distributing themselves. This particular one was installed by a trojan.

How do I remove Dotdo Applica?

Our program Malwarebytes Anti-Malware can detect and remove this potentially unwanted program.
  • Please download Malwarebytes Anti-Malware to your desktop.
  • Double-click mbam-setup-{version}.exe and follow the prompts to install the program.
  • At the end, be sure a check-mark is placed next to:
    Launch Malwarebytes Anti-Malware
  • Then click Finish.
  • Once the program has loaded, select Scan Now. Or select the Threat Scan from the Scan menu.
  • If an update is available, it will be implemented before the rest of the scanning procedure.
  • When the scan is complete, make sure that all Threats are selected, and click Remove Selected.
  • Restart your computer when prompted to do so.
Is there anything else I need to do to get rid of Dotdo Applica?
  • No, Malwarebytes' Anti-Malware removes Dotdo Applica completely.
  • Please note that this trojan deletes Scheduled Tasks that belong to legitimate programs and installs an outdated version of Adobe Flash, so you may have to re-install some programs to repair the damage.
How would the full version of Malwarebytes Anti-Malware help protect me?

We hope our application and this guide have helped you eradicate this hijacker.

As you can see below the full version of Malwarebytes Anti-Malware would have protected you against the Dotdo Applica adware. It would have warned you before the adware could install itself, giving you a chance to stop it before it became too late.

protection1.png


Technical details for experts

Possible signs in FRST logs:
() C:\Program Files (x86)\applica\applica.exe
 HKLM\...\Run: [applica] => C:\Program Files (x86)\applica\applica.exe [4608 2016-04-18] ()
 HKLM-x32\...\Run: [applica] => C:\Program Files (x86)\applica\applica.exe [4608 2016-04-18] ()
 HKCU\...\Run: [applica] => C:\Program Files (x86)\applica\applica.exe [4608 2016-04-18] ()
 (Adobe Systems Incorporated) C:\Users\{username}\AppData\Local\install_flash_player_21_active_x.exe
 (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
 (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
 C:\Windows\System32\Tasks\Adobe Flash Player Updater
 C:\Windows\Tasks\Adobe Flash Player Updater.job
 C:\Windows\SysWOW64\Macromed
 C:\Windows\system32\Macromed
 C:\Program Files (x86)\applica
 C:\Users\{username}\AppData\Local\tr5b.txt
 C:\Users\{username}\AppData\Local\setupone.exe
 C:\Users\{username}\AppData\Local\aatxtname.txt
 () C:\Users\{username}\AppData\Local\aatxtname.txt
 () C:\Users\{username}\AppData\Local\ddnow.exe
 () C:\Users\{username}\AppData\Local\ddnow4.exe
 (Adobe Systems Incorporated) C:\Users\{username}\AppData\Local\install_flash_player_21_active_x.exe
 () C:\Users\{username}\AppData\Local\ok223.txt
 () C:\Users\{username}\AppData\Local\setupone.exe
 () C:\Users\{username}\AppData\Local\tinstall.exe
 () C:\Users\{username}\AppData\Local\tinstall4.exe
 () C:\Users\{username}\AppData\Local\tr5b.txt

Adobe Flash Player 21 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 21.0.0.213 - Adobe Systems Incorporated)
Applica (HKLM\...\Applica) (Version:  - Dotdo)
Task: {5D3257BD-C310-47F4-9DB9-413E52A0AD2E} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2016-07-14] (Adobe Systems Incorporated)
Task: {625E158E-2330-4D23-8DEB-D2BCD4445EE6} - \User_Feed_Synchronization-{EFFEA14C-5A8A-4071-873B-8F6712B52DEB} -> No File <==== ATTENTION
Task: {763B925E-B18B-41DF-88A5-70AD79410AD1} - \GoogleUpdateTaskMachineUA -> No File <==== ATTENTION
Task: {7E7C193D-CB12-42EB-A305-281CD70D9985} - \GoogleUpdateTaskMachineCore -> No File <==== ATTENTION
Task: {93845E4F-38D6-40C3-ACE2-6D55CF43344A} - \Total Uninstall -> No File <==== ATTENTION
Task: {E0CB09A0-9F85-456A-A98A-346264D47919} - \Opera scheduled Autoupdate 1454935183 -> No File <==== ATTENTION
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
FirewallRules: [{374A8604-7292-4A6B-92B2-122E7C74C464}] => (Allow) C:\Users\{username}\AppData\Local\ddnowyes.exe
FirewallRules: [{4DC98209-8FB2-4AD4-B710-F4C1F304B02F}] => (Allow) C:\Users\{username}\Desktop\setup.exe
FirewallRules: [{E5F2CE33-97FE-4FDC-9BE4-73F4AB0AF130}] => (Allow) C:\Users\{username}\AppData\Local\88350222.exe
FirewallRules: [{0AE2515D-3007-4B4B-AB7D-17F0A16F598D}] => (Allow) C:\Users\{username}\AppData\Local\tinstall.exe
Alterations made by the installer:
File system details [View: All details] (Selection)
---------------------------------------------------
    Adds the folder C:\Program Files (x86)\applica
       Adds the file applica.exe"="4/18/2016 2:02 PM, 4608 bytes, A
       Adds the file key.ini"="7/14/2016 1:46 PM, 0 bytes, A
       Adds the file uninstall.exe"="4/18/2016 2:14 PM, 37725 bytes, A
    In the existing folder C:\Users\{username}\AppData\Local
       Adds the file aatxtname.txt"="7/14/2016 1:44 PM, 3 bytes, A
       Adds the file ddnow.exe"="5/18/2016 9:35 PM, 5120 bytes, A
       Adds the file ddnow4.exe"="5/18/2016 9:36 PM, 5632 bytes, A
       Adds the file install_flash_player_21_active_x.exe"="7/14/2016 1:46 PM, 19397312 bytes, A
       Adds the file ok223.txt"="3/18/2016 6:00 AM, 0 bytes, A
       Adds the file setupone.exe"="7/14/2016 1:45 PM, 61844 bytes, A
       Adds the file tinstall.exe"="5/12/2016 9:44 PM, 7680 bytes, A
       Adds the file tinstall4.exe"="5/12/2016 9:45 PM, 7680 bytes, A
       Adds the file tr5b.txt"="7/14/2016 1:46 PM, 0 bytes, A
    Adds the folder C:\Windows\System32\Macromed\Flash
       Adds the file activex.vch"="7/14/2016 1:46 PM, 155815 bytes, A
       Adds the file Flash64_21_0_0_213.ocx"="7/14/2016 1:46 PM, 27167424 bytes, RA
       Adds the file FlashInstall.log"="7/14/2016 1:46 PM, 1932 bytes, A
       Adds the file FlashUtil64_21_0_0_213_ActiveX.dll"="7/14/2016 1:46 PM, 583872 bytes, A
       Adds the file FlashUtil64_21_0_0_213_ActiveX.exe"="7/14/2016 1:46 PM, 887488 bytes, A
    In the existing folder C:\Windows\System32\Tasks
       Adds the file Adobe Flash Player Updater"="7/14/2016 1:46 PM, 3768 bytes, A
       (-)(FILE) GoogleUpdateTaskMachineCore"="5/17/2016 10:48 AM, 3642 bytes, A
       (-)(FILE) GoogleUpdateTaskMachineUA"="5/17/2016 10:48 AM, 3894 bytes, A
       (-)(FILE) Opera scheduled Autoupdate 1454935183"="7/14/2016 12:40 PM, 3854 bytes, A
    In the existing folder C:\Windows\SysWOW64
       Adds the file FlashPlayerApp.exe"="7/14/2016 1:46 PM, 797376 bytes, A
       Adds the file FlashPlayerCPLApp.cpl"="7/14/2016 1:46 PM, 142528 bytes, A
    Adds the folder C:\Windows\SysWOW64\Macromed\Flash
       Adds the file activex.vch"="7/14/2016 1:46 PM, 435207 bytes, A
       Adds the file Flash32_21_0_0_213.ocx"="7/14/2016 1:46 PM, 19473088 bytes, RA
       Adds the file FlashInstall.log"="7/14/2016 1:46 PM, 2012 bytes, A
       Adds the file FlashPlayerUpdateService.exe"="7/14/2016 1:46 PM, 269504 bytes, A
       Adds the file FlashUtil32_21_0_0_213_ActiveX.dll"="7/14/2016 1:46 PM, 514240 bytes, A
       Adds the file FlashUtil32_21_0_0_213_ActiveX.exe"="7/14/2016 1:46 PM, 1172672 bytes, A
    In the existing folder C:\Windows\Tasks
       Adds the file Adobe Flash Player Updater.job"="7/14/2016 1:46 PM, 830 bytes, A

Registry details [View: All details] (Selection)
------------------------------------------------
    [HKEY_LOCAL_MACHINE\SOFTWARE\idot]
       "idot"="REG_SZ", "ok"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Macromedia\FlashPlayerActiveX]
       "isESR"="REG_DWORD", 0
       "isScriptDebugger"="REG_DWORD", 0
       "PlayerPath"="REG_SZ", "C:\Windows\system32\Macromed\Flash\Flash64_21_0_0_213.ocx"
       "UninstallerPath"="REG_SZ", "C:\Windows\system32\Macromed\Flash\FlashUtil64_21_0_0_213_ActiveX.exe"
       "Version"="REG_SZ", "21.0.0.213"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
       "applica"="REG_SZ", ""C:\Program Files (x86)\applica\applica.exe""
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Applica]
       "DisplayName"="REG_SZ", "Applica"
       "Publisher"="REG_SZ", "Dotdo"
       "UninstallString"="REG_SZ", "C:\Program Files (x86)\Applica\uninstall.exe"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Macromedia\FlashPlayer]
       "CurrentVersion"="REG_SZ", "21,0,0,213"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
       "applica"="REG_SZ", ""C:\Program Files (x86)\applica\applica.exe""
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Flash Player ActiveX]
       "DisplayIcon"="REG_SZ", "C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_21_0_0_213_ActiveX.exe"
       "DisplayName"="REG_SZ", "Adobe Flash Player 21 ActiveX"
       "DisplayVersion"="REG_SZ", "21.0.0.213"
       "EstimatedSize"="REG_DWORD", 18942
       "HelpLink"="REG_SZ", "http://www.adobe.com/go/flashplayer_support/"
       "NoModify"="REG_DWORD", 1
       "NoRepair"="REG_DWORD", 1
       "Publisher"="REG_SZ", "Adobe Systems Incorporated"
       "RequiresIESysFile"="REG_SZ", "4.70.0.1155"
       "UninstallString"="REG_SZ", "C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_21_0_0_213_ActiveX.exe -maintain activex"
       "URLInfoAbout"="REG_SZ", "http://www.adobe.com"
       "URLUpdateInfo"="REG_SZ", "http://www.adobe.com/go/getflashplayer/"
       "VersionMajor"="REG_DWORD", 21
       "VersionMinor"="REG_DWORD", 0
    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
       "applica"="REG_SZ", ""C:\Program Files (x86)\applica\applica.exe""
Malwarebytes Anti-Malware log:
Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 7/14/2016
Scan Time: 3:34 PM
Logfile: mbamDotoApplica.txt
Administrator: Yes

Version: 2.2.1.1043
Malware Database: v2016.07.14.06
Rootkit Database: v2016.05.27.01
License: Premium
Malware Protection: Disabled
Malicious Website Protection: Enabled
Self-protection: Enabled

OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: {username}

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 314945
Time Elapsed: 11 min, 6 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 1
PUP.Optional.Applica, C:\Program Files (x86)\applica\applica.exe, 2488, Delete-on-Reboot, [1bd381a2435743f35f99609a59aa8779]

Modules: 0
(No malicious items detected)

Registry Keys: 4
PUP.Optional.Applica, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\Applica, Quarantined, [1bd381a2435743f35f99609a59aa8779], 
PUP.Optional.iDot, HKLM\SOFTWARE\IDOT, Quarantined, [6e8039ea3c5e96a0030d69939a6917e9], 
Adware.Agent, HKLM\SOFTWARE\MICROSOFT\TRACING\ddnow_RASAPI32, Quarantined, [0de1fa29ff9bea4cd0f2ae4edc2737c9], 
Adware.Agent, HKLM\SOFTWARE\MICROSOFT\TRACING\ddnow_RASMANCS, Quarantined, [d11df62d801a90a6caf8807cd42f18e8], 

Registry Values: 4
PUP.Optional.Applica, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|applica, "C:\Program Files (x86)\applica\applica.exe", Quarantined, [1bd381a2435743f35f99609a59aa8779]
PUP.Optional.Applica, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|applica, "C:\Program Files (x86)\applica\applica.exe", Quarantined, [1bd381a2435743f35f99609a59aa8779]
PUP.Optional.Applica, HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|applica, "C:\Program Files (x86)\applica\applica.exe", Quarantined, [1bd381a2435743f35f99609a59aa8779]
PUP.Optional.iDot, HKLM\SOFTWARE\IDOT|idot, ok, Quarantined, [6e8039ea3c5e96a0030d69939a6917e9]

Registry Data: 0
(No malicious items detected)

Folders: 1
PUP.Optional.Applica, C:\Program Files (x86)\applica, Delete-on-Reboot, [1bd381a2435743f35f99609a59aa8779], 

Files: 13
PUP.Optional.DotDo, C:\Users\{username}\Desktop\setup.exe, Quarantined, [945ada4907931b1b9be73c9714edf907], 
PUP.Optional.DotDo, C:\Users\{username}\AppData\Local\tinstall.exe, Quarantined, [5995d053b8e27fb7265c13c038c9bc44], 
PUP.Optional.DotDo, C:\Users\{username}\AppData\Local\tinstall4.exe, Quarantined, [ba34e63d27731c1aaed4a72cb44dd12f], 
PUP.Optional.Applica, C:\Program Files (x86)\applica\key.ini, Quarantined, [1bd381a2435743f35f99609a59aa8779], 
PUP.Optional.Applica, C:\Program Files (x86)\applica\applica.exe, Delete-on-Reboot, [1bd381a2435743f35f99609a59aa8779], 
PUP.Optional.Applica, C:\Program Files (x86)\applica\uninstall.exe, Quarantined, [1bd381a2435743f35f99609a59aa8779], 
Adware.Agent.Proxy, C:\Users\{username}\AppData\Local\ddnow.exe, Quarantined, [21cd27fc227880b61a20dd1eb0535ca4], 
Adware.Agent.Proxy, C:\Users\{username}\AppData\Local\ddnow4.exe, Quarantined, [21cdea391783ed49a59630cb9d660bf5], 
Adware.Agent.Proxy, C:\Users\{username}\AppData\Local\setupone.exe, Quarantined, [618d56cd9109a59143f975869073fc04], 
Adware.Agent.Proxy, C:\Users\{username}\AppData\Local\tinstall.exe, Quarantined, [43ab1b08dfbb2d09b08e94677192ba46], 
Adware.Agent.Trace, C:\Users\{username}\AppData\Local\aatxtname.txt, Quarantined, [09e5e43f0991d26481be11eaa85b728e], 
Adware.Agent.Trace, C:\Users\{username}\AppData\Local\ok223.txt, Quarantined, [c22c64bf47539b9b4af6a05b61a2fb05], 
Adware.Agent.Trace, C:\Users\{username}\AppData\Local\tr5b.txt, Quarantined, [e70742e16d2dba7cd968708bcb38a65a], 

Physical Sectors: 0
(No malicious items detected)


(end)
As mentioned before the full version of Malwarebytes Anti-Malware could have protected your computer against this threat.
We use different ways of protecting your computer(s):
  • Dynamically Blocks Malware Sites & Servers
  • Malware Execution Prevention
Save yourself the hassle and get protected.
  • 0

Advertisements

Back to Malware Removal Guides and Tutorials


0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

  1. Geeks to Go Community
  2. → Security
  3. → Malware Removal Guides and Tutorials

As Featured On:

featured
Malware Removal How to Guides Windows 7 System Building Download Files Register welcome

Never used a forum? Learn how.