abhcop.sys - Dangerous
%sysdir%\drivers\abhcop.sys
Manual removal instructions:
Antivirus Report of %sysdir%\drivers\abhcop.sys:
%sysdir%\drivers\abhcop.sys
abhcop.sys is rootkit Adware.PigSearch.
abhcop.sys is used to hide files, processes and registry.
abhcop.sys is a kernel mode rootkit.
Rootkit creates new system service.
Related files:
%System%\drivers\abhcop.sys
%System%\drivers\hcalway.sys
%ProgramFiles%\wsearch\allverx.dat
%ProgramFiles%\HuaCi\Mouse.dll
%ProgramFiles%\wsearch\mUninstall.exe
%ProgramFiles%\HuaCi\mupdate.exe
%ProgramFiles%\wsearch\Search.exe
%ProgramFiles%\HuaCi\SearchM.dll
%ProgramFiles%\wsearch\sysupdate.ini
%ProgramFiles%\HuaCi\_uninstall
%UserProfile%\Start Menu\Programs\Startup\»®??????.lnk
%UserProfile%\Start Menu\Programs\»®??????.lnk
Adds the value:
"MoveSearch" = "[PATH TO ADWARE]"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
to the Windows startup registry keys.
Added to registry:
HKEY_CLASSES_ROOT\CLSID\{594BE7B2-23B0-4FAE-A2B9-0C21CC1417CE}
HKEY_CLASSES_ROOT\Interface\{4E1ACE40-F681-4CC4-A7C0-AD1E6C9AD86F}
HKEY_CLASSES_ROOT\Interface\{A07E6B9B-BB30-4381-A9D8-FABB0648BCEF}
HKEY_CLASSES_ROOT\TypeLib\{FD536575-73F7-42A3-9E9F-11688F1A006A}
HKEY_CLASSES_ROOT\TypeLib\{C5CE084B-31E0-4B34-A33A-82B4EA913CF8}
HKEY_CLASSES_ROOT\SearchM.Com
HKEY_CLASSES_ROOT\SearchM.Com.1
HKEY_CLASSES_ROOT\SearchM.Search
HKEY_CLASSES_ROOT\SearchM.Search.1
HKEY_CURRENT_USER\Software\Pig Move Search
HKEY_CURRENT_USER\Software\MSWord\Search
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\CDSearch
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\abhcop
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\hcalway
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\abhcop
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\hcalway
| %sysdir%\drivers\abhcop.sys | Malware |
| %sysdir%\drivers\abhcop.sys | Dangerous |
| %sysdir%\drivers\abhcop.sys | High Risk |
abhcop.sys is used to hide files, processes and registry.
abhcop.sys is a kernel mode rootkit.
Rootkit creates new system service.
Related files:
%System%\drivers\abhcop.sys
%System%\drivers\hcalway.sys
%ProgramFiles%\wsearch\allverx.dat
%ProgramFiles%\HuaCi\Mouse.dll
%ProgramFiles%\wsearch\mUninstall.exe
%ProgramFiles%\HuaCi\mupdate.exe
%ProgramFiles%\wsearch\Search.exe
%ProgramFiles%\HuaCi\SearchM.dll
%ProgramFiles%\wsearch\sysupdate.ini
%ProgramFiles%\HuaCi\_uninstall
%UserProfile%\Start Menu\Programs\Startup\»®??????.lnk
%UserProfile%\Start Menu\Programs\»®??????.lnk
Adds the value:
"MoveSearch" = "[PATH TO ADWARE]"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
to the Windows startup registry keys.
Added to registry:
HKEY_CLASSES_ROOT\CLSID\{594BE7B2-23B0-4FAE-A2B9-0C21CC1417CE}
HKEY_CLASSES_ROOT\Interface\{4E1ACE40-F681-4CC4-A7C0-AD1E6C9AD86F}
HKEY_CLASSES_ROOT\Interface\{A07E6B9B-BB30-4381-A9D8-FABB0648BCEF}
HKEY_CLASSES_ROOT\TypeLib\{FD536575-73F7-42A3-9E9F-11688F1A006A}
HKEY_CLASSES_ROOT\TypeLib\{C5CE084B-31E0-4B34-A33A-82B4EA913CF8}
HKEY_CLASSES_ROOT\SearchM.Com
HKEY_CLASSES_ROOT\SearchM.Com.1
HKEY_CLASSES_ROOT\SearchM.Search
HKEY_CLASSES_ROOT\SearchM.Search.1
HKEY_CURRENT_USER\Software\Pig Move Search
HKEY_CURRENT_USER\Software\MSWord\Search
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\CDSearch
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\abhcop
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\hcalway
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\abhcop
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\hcalway
Dmitry Sokolov:
I created UnHackMe in 2006 to fix the problem that antivioruses did not fix: detecting rootkits.
Since that time I work every day to fix the issues that antiviruses cannot.
If your antivirus have not helped you solve the problem, you should try UnHackMe.
We are a small company and you can ask me directly, if you have any questions.