DF9D.EXE is Adware WSearch

We received the file DF9D.EXE and detected that DF9D.EXE is not good.
DF9D.EXE is Adware. You should remove the file DF9D.EXE.
Kill the process DF9D.EXE and remove DF9D.EXE from Windows.

Malware Analysis of DF9D.EXE
Full path on a computer: %WinDir%\df9d.exe

Detected by UnHackMe:

DF9D.EXE
Default location: %WinDir%\df9d.exe

Removal Results: Success
Number of reboot: 1

DF9D.EXE is known as:

Adware.WSearch

DF9D.EXE hash:

  • MD5: 11b91dec9c36ccfce217c1865a30569b
The file tries to download information from some web sites.
How to quickly detect DF9D.EXE presence?

Registry:
  • HKLM\Software\Classes\CLSID\{FCAA0766-15FC-4aec-A010-F4605D272581}\InprocServer32\: “%SysDir%\727o.dll”
  • HKLM\Software\Classes\TypeLib\{8A4F328C-C9F4-4449-A0DF-A756A6B52ABF}\1.0\0\win32\: “%SysDir%\727o.dll”
  • HKLM\Software\Microsoft\Windows\CurrentVersion\Run\plc: “c:\windows\system32\rundll32.exe %SysDir%/2bee.dll,Always”
  • HKLM\System\CurrentControlSet\Services\Eventlog\Application\OSTD\EventMessageFile: “%SysDir%\2bed.exe”
  • HKLM\System\CurrentControlSet\Services\OSTD\ImagePath: “%SysDir%\2bed.exe”
Files:
  • %Common Startmenu%\Programs\Startup\ktv.lnk
  • %Common Startmenu%\Programs\Startup\star.lnk
  • %SysDir%\2bed.exe
  • %SysDir%\2bee.dll
  • %SysDir%\727o.dll
  • %WinDir%\Tasks\ms.job
  • %WinDir%\df9d.exe
  • %WinDir%\df9d.flv
  • %WinDir%\df9u.bmp

Fix it immediately!

Free Download

UnHackMe removes malware invisible for your antivirus!

Leave a Reply