What is HPRewriter2?
The Malwarebytes research team has determined that HPRewriter2 is a browser hijacker. These so-called "hijackers" manipulate your browser(s), for example to change your startpage or searchscopes, so that the affected browser visits their site or one of their choice.
This one replaces many browser shortcuts and shows advertisements.
How do I know if my computer is affected by HPRewriter2?
You may see this entry in your list of installed software:
and these shortcuts on your desktop, your startmenu, and your taskbar:
and you will see this startpage:
How did HPRewriter2 get on my computer?
Browser hijackers use different methods for distributing themselves. This particular one was installed by a trojan.
How do I remove HPRewriter2?
Our program Malwarebytes Anti-Malware can detect and remove this potentially unwanted program.
- Please download Malwarebytes Anti-Malware to your desktop.
- Double-click mbam-setup-{version}.exe and follow the prompts to install the program.
- At the end, be sure a check-mark is placed next to:
Launch Malwarebytes Anti-Malware - Then click Finish.
- Once the program has loaded, select Scan Now. Or select the Threat Scan from the Scan menu.
- If an update is available, it will be implemented before the rest of the scanning procedure.
- When the scan is complete, make sure that all Threats are selected, and click Remove Selected.
- Restart your computer when prompted to do so.
- No, Malwarebytes' Anti-Malware removes HPRewriter2 completely.
- The hijacker alters the shortcuts for Chrome, Opera, Internet Explorer, Yandex, and FireFox. here you can read how to create new, clean shortcuts.
We hope our application and this guide have helped you eradicate this hijacker.
As you can see below the full version of Malwarebytes Anti-Malware would have protected you against the HPRewriter2 hijacker. It would have warned you before the application could install itself, giving you a chance to stop it before it became too late.
Technical details for experts
Possible signs in FRST logs:
(PSEJHI coidt) C:\Users\{username}\AppData\Roaming\HPRewriter2\HPWriterSrv3.exe
R2 HPWriter Service; C:\Users\{username}\AppData\Roaming\HPRewriter2\HPWriterSrv3.exe [1047040 2016-08-16] (PSEJHI coidt) [File not signed]
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\??zill? Fir?f??.lnk
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\G??gl? ?hr?m?.lnk
C:\Users\MBAM\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Int?rn?t ???l?r?r.lnk
C:\Users\Public\Desktop\??zill? Fir?f??.lnk
C:\Users\Public\Desktop\G??gl? ?hr?m?.lnk
C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Int?rn?t ???l?r?r.lnk
C:\Users\{username}\AppData\Roaming\HPRewriter2
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
C:\Users\Public\Desktop\Google Chrome.lnk
HPRewriter2 (HKLM-x32\...\HPRewriter2) (Version: - )
Shortcut: C:\Users\MBAM\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Int?rn?t ???l?r?r.lnk -> C:\Users\MBAM\AppData\Roaming\HPRewriter2\RewRun3.exe (No File)
Shortcut: C:\Users\MBAM\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Int?rn?t ???l?r?r (N? ?dd-?ns).lnk -> C:\Users\MBAM\AppData\Roaming\HPRewriter2\RewRun3.exe (No File)
Shortcut: C:\Users\MBAM\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\G??gl? ?hr?m?.lnk -> C:\Users\MBAM\AppData\Roaming\HPRewriter2\RewRun3.exe (No File)
Shortcut: C:\Users\MBAM\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Int?rn?t ???l?r?r.lnk -> C:\Users\MBAM\AppData\Roaming\HPRewriter2\RewRun3.exe (No File)
Shortcut: C:\Users\MBAM\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\??zill? Fir?f??.lnk -> C:\Users\MBAM\AppData\Roaming\HPRewriter2\RewRun3.exe (No File)
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\G??gl? ?hr?m?.lnk -> C:\Users\{username}\AppData\Roaming\HPRewriter2\RewRun3.exe (hxaynup) -> 1 0
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\??zill? Fir?f??.lnk -> C:\Users\{username}\AppData\Roaming\HPRewriter2\RewRun3.exe (hxaynup) -> 2 0
ShortcutWithArgument: C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Int?rn?t ???l?r?r.lnk -> C:\Users\{username}\AppData\Roaming\HPRewriter2\RewRun3.exe (hxaynup) -> 3 0
ShortcutWithArgument: C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Int?rn?t ???l?r?r (N? ?dd-?ns).lnk -> C:\Users\{username}\AppData\Roaming\HPRewriter2\RewRun3.exe (hxaynup) -> 3 0
ShortcutWithArgument: C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Ease of Access.lnk -> C:\Windows\System32\control.exe (Microsoft Corporation) -> /name Microsoft.EaseOfAccessCenter
ShortcutWithArgument: C:\Users\{username}\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\G??gl? ?hr?m?.lnk -> C:\Users\{username}\AppData\Roaming\HPRewriter2\RewRun3.exe (hxaynup) -> 1 0
ShortcutWithArgument: C:\Users\{username}\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Int?rn?t ???l?r?r.lnk -> C:\Users\{username}\AppData\Roaming\HPRewriter2\RewRun3.exe (hxaynup) -> 3 0
ShortcutWithArgument: C:\Users\{username}\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\??zill? Fir?f??.lnk -> C:\Users\{username}\AppData\Roaming\HPRewriter2\RewRun3.exe (hxaynup) -> 2 0
ShortcutWithArgument: C:\Users\Public\Desktop\G??gl? ?hr?m?.lnk -> C:\Users\{username}\AppData\Roaming\HPRewriter2\RewRun3.exe (hxaynup) -> 1 0
ShortcutWithArgument: C:\Users\Public\Desktop\??zill? Fir?f??.lnk -> C:\Users\{username}\AppData\Roaming\HPRewriter2\RewRun3.exe (hxaynup) -> 2 0Alterations made by the installer:
File system details [View: All details] (Selection)
---------------------------------------------------
In the existing folder C:\ProgramData\Microsoft\Windows\Start Menu\Programs
Deletes the file Google Chrome.lnk"="8/5/2016 10:51 AM, 2195 bytes, A
Adds the file G??gl? ?hr?m?.lnk"="8/17/2016 8:38 AM, 2135 bytes, A
Deletes the file Mozilla Firefox.lnk"="2/8/2016 1:27 PM, 1159 bytes, A
Adds the file ??zill? Fir?f??.lnk"="8/17/2016 8:38 AM, 2137 bytes, A
In the existing folder C:\Users\MBAM\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar
Deletes the file Google Chrome.lnk"="2/8/2016 1:44 PM, 2284 bytes, A
Adds the file G??gl? ?hr?m?.lnk"="8/17/2016 8:38 AM, 2313 bytes, A
Deletes the file Internet Explorer.lnk"="2/8/2016 4:52 PM, 1419 bytes, A
Adds the file Int?rn?t ???l?r?r.lnk"="8/17/2016 8:38 AM, 2417 bytes, A
Deletes the file Mozilla Firefox.lnk"="2/8/2016 1:28 PM, 1159 bytes, A
Adds the file ??zill? Fir?f??.lnk"="8/17/2016 8:38 AM, 2181 bytes, A
In the existing folder C:\Users\MBAM\AppData\Roaming\Microsoft\Windows\Start Menu\Programs
Deletes the file Internet Explorer.lnk"="2/8/2016 4:52 PM, 1413 bytes, A
Adds the file Int?rn?t ???l?r?r.lnk"="8/17/2016 8:38 AM, 2127 bytes, A
In the existing folder C:\Users\MBAM\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools
Deletes the file Internet Explorer (No Add-ons).lnk"="2/8/2016 4:52 PM, 1463 bytes, A
Adds the file Int?rn?t ???l?r?r (N? ?dd-?ns).lnk"="8/17/2016 8:38 AM, 2139 bytes, A
Adds the folder C:\Users\{username}\AppData\Roaming\HPRewriter2
Adds the file HPWriterSrv3.exe"="8/16/2016 12:03 PM, 1047040 bytes, A
Adds the file RewRun3.exe"="8/16/2016 12:06 PM, 949760 bytes, A
Adds the file uninstaller.exe"="8/17/2016 8:38 AM, 221442 bytes, A
Adds the folder C:\Users\{username}\AppData\Roaming\HPRewriter2\Resources\Icons\Browsers
Adds the file chrome.ico"="8/5/2016 1:01 PM, 24957 bytes, A
Adds the file firefox.ico"="8/5/2016 1:01 PM, 67901 bytes, A
Adds the file ie.ico"="8/5/2016 1:01 PM, 52231 bytes, A
Adds the file opera.ico"="8/5/2016 1:01 PM, 18329 bytes, A
Adds the file yandex.ico"="8/5/2016 1:01 PM, 20036 bytes, A
In the existing folder C:\Users\{username}\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar
Deletes the file Google Chrome.lnk"="3/3/2016 10:14 AM, 2393 bytes, A
Adds the file G??gl? ?hr?m?.lnk"="8/17/2016 8:38 AM, 2243 bytes, A
Deletes the file Internet Explorer.lnk"="2/10/2016 11:10 AM, 1413 bytes, A
Adds the file Int?rn?t ???l?r?r.lnk"="8/17/2016 8:38 AM, 2347 bytes, A
Deletes the file Mozilla Firefox.lnk"="6/20/2016 11:24 AM, 1159 bytes, A
Adds the file ??zill? Fir?f??.lnk"="8/17/2016 8:38 AM, 2111 bytes, A
In the existing folder C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs
Deletes the file Internet Explorer.lnk"="2/10/2016 11:10 AM, 1413 bytes, A
Adds the file Int?rn?t ???l?r?r.lnk"="8/17/2016 8:38 AM, 2057 bytes, A
In the existing folder C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools
Deletes the file Internet Explorer (No Add-ons).lnk"="2/10/2016 11:10 AM, 1463 bytes, A
Adds the file Int?rn?t ???l?r?r (N? ?dd-?ns).lnk"="8/17/2016 8:38 AM, 2069 bytes, A
In the existing folder C:\Users\Public\Desktop
Deletes the file Google Chrome.lnk"="8/5/2016 10:51 AM, 2183 bytes, A
Adds the file G??gl? ?hr?m?.lnk"="8/17/2016 8:38 AM, 2105 bytes, A
Deletes the file Mozilla Firefox.lnk"="2/8/2016 1:27 PM, 1147 bytes, A
Adds the file ??zill? Fir?f??.lnk"="8/17/2016 8:38 AM, 2107 bytes, A
Registry details [View: All details] (Selection)
------------------------------------------------
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\HPRewriter]
"cwykda"="REG_SZ", "eyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInVybCIgICAgICA6ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgImh0dHA6Ly9rcmF3YXphc2lyb2NsYS5ydSIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICwgICAgICAgICAgICAgICAicmV3cml0ZV90aW1lb3V0X21pbiIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA1ICAgICAgICAgICB9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\HPRewriter\Components]
"Main"="REG_SZ", "1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\HPRewriter2]
"DisplayName"="REG_SZ", "HPRewriter2"
"UninstallString"="REG_SZ", "C:\Users\{username}\AppData\Roaming\HPRewriter2\uninstaller.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\HPWriter Service]
"DisplayName"="REG_SZ", "HPWriter Service"
"ErrorControl"="REG_DWORD", 1
"ImagePath"="REG_EXPAND_SZ, "C:\Users\{username}\AppData\Roaming\HPRewriter2\HPWriterSrv3.exe"
"ObjectName"="REG_SZ", "LocalSystem"
"Start"="REG_DWORD", 2
"Type"="REG_DWORD", 16
"WOW64"="REG_DWORD", 1
Malwarebytes Anti-Malware log:Malwarebytes Anti-Malware
www.malwarebytes.org
Scan Date: 8/17/2016
Scan Time: 8:52 AM
Logfile: mbamHPRewriter2.txt
Administrator: Yes
Version: 2.2.1.1043
Malware Database: v2016.08.17.04
Rootkit Database: v2016.08.15.01
License: Premium
Malware Protection: Disabled
Malicious Website Protection: Enabled
Self-protection: Enabled
OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: {username}
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 318137
Time Elapsed: 9 min, 5 sec
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled
Processes: 1
PUP.Optional.HPDefender.Generic, C:\Users\{username}\AppData\Roaming\HPRewriter2\HPWriterSrv3.exe, 3076, Delete-on-Reboot, [f92f26265c3efd390b81d1fb659f17e9]
Modules: 0
(No malicious items detected)
Registry Keys: 3
Trojan.Agent, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\HPRewriter2, Quarantined, [e741b399c5d5e35386d005ccca3af709],
PUP.Optional.HPDefender.Generic, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\HPWriter Service, Quarantined, [f92f26265c3efd390b81d1fb659f17e9],
PUP.Optional.HPDefender.Generic, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\HPRewriter2, Quarantined, [f92f26265c3efd390b81d1fb659f17e9],
Registry Values: 1
PUP.Optional.HPDefender.Generic, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\HPWriter Service|ImagePath, C:\Users\{username}\AppData\Roaming\HPRewriter2\HPWriterSrv3.exe, Quarantined, [9593bd8f465473c3c3c6be0ef60eb54b]
Registry Data: 0
(No malicious items detected)
Folders: 4
PUP.Optional.HPDefender.Generic, C:\Users\{username}\AppData\Roaming\HPRewriter2, Delete-on-Reboot, [f92f26265c3efd390b81d1fb659f17e9],
PUP.Optional.HPDefender.Generic, C:\Users\{username}\AppData\Roaming\HPRewriter2\Resources, Quarantined, [f92f26265c3efd390b81d1fb659f17e9],
PUP.Optional.HPDefender.Generic, C:\Users\{username}\AppData\Roaming\HPRewriter2\Resources\Icons, Quarantined, [f92f26265c3efd390b81d1fb659f17e9],
PUP.Optional.HPDefender.Generic, C:\Users\{username}\AppData\Roaming\HPRewriter2\Resources\Icons\Browsers, Quarantined, [f92f26265c3efd390b81d1fb659f17e9],
Files: 11
Trojan.Agent, C:\Users\{username}\AppData\Roaming\HPRewriter2\RewRun3.exe, Delete-on-Reboot, [141499b30892b383a2bf05cc1de707f9],
Trojan.Agent, C:\Users\{username}\AppData\Roaming\HPRewriter2\uninstaller.exe, Quarantined, [e741b399c5d5e35386d005ccca3af709],
Trojan.Agent, C:\Users\{username}\Desktop\krawazasirocla.ru_World.exe, Quarantined, [b0784606aaf054e2ec6afbd6b35145bb],
PUP.Optional.HPDefender.Generic, C:\Users\{username}\AppData\Roaming\HPRewriter2\HPWriterSrv3.exe, Delete-on-Reboot, [f92f26265c3efd390b81d1fb659f17e9],
PUP.Optional.HPDefender.Generic, C:\Users\{username}\AppData\Roaming\HPRewriter2\RewRun3.exe, Delete-on-Reboot, [f92f26265c3efd390b81d1fb659f17e9],
PUP.Optional.HPDefender.Generic, C:\Users\{username}\AppData\Roaming\HPRewriter2\uninstaller.exe, Quarantined, [f92f26265c3efd390b81d1fb659f17e9],
PUP.Optional.HPDefender.Generic, C:\Users\{username}\AppData\Roaming\HPRewriter2\Resources\Icons\Browsers\chrome.ico, Quarantined, [f92f26265c3efd390b81d1fb659f17e9],
PUP.Optional.HPDefender.Generic, C:\Users\{username}\AppData\Roaming\HPRewriter2\Resources\Icons\Browsers\firefox.ico, Quarantined, [f92f26265c3efd390b81d1fb659f17e9],
PUP.Optional.HPDefender.Generic, C:\Users\{username}\AppData\Roaming\HPRewriter2\Resources\Icons\Browsers\ie.ico, Quarantined, [f92f26265c3efd390b81d1fb659f17e9],
PUP.Optional.HPDefender.Generic, C:\Users\{username}\AppData\Roaming\HPRewriter2\Resources\Icons\Browsers\opera.ico, Quarantined, [f92f26265c3efd390b81d1fb659f17e9],
PUP.Optional.HPDefender.Generic, C:\Users\{username}\AppData\Roaming\HPRewriter2\Resources\Icons\Browsers\yandex.ico, Quarantined, [f92f26265c3efd390b81d1fb659f17e9],
Physical Sectors: 0
(No malicious items detected)
(end)As mentioned before the full version of Malwarebytes Anti-Malware could have protected your computer against this threat.We use different ways of protecting your computer(s):
- Dynamically Blocks Malware Sites & Servers
- Malware Execution Prevention
Back to top
Sign In
Create Account
