PUAAdvertising:Win32/FlashHelper removal guide

The PUAAdvertising:Win32/FlashHelper is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What PUAAdvertising:Win32/FlashHelper virus can do?

Presents an Authenticode digital signature
Unconventionial binary language: Chinese (Simplified)
Unconventionial language used in binary resources: Chinese (Simplified)
The binary likely contains encrypted or compressed data.
The executable is compressed using UPX
Anomalous binary characteristics

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine PUAAdvertising:Win32/FlashHelper?


File Info:
crc32: 477168E0
md5: 742c8314dc5d70e32a667d8ea1c21427
name: 742C8314DC5D70E32A667D8EA1C21427.mlw
sha1: d275271139ba0aab5496fe632ec4372e2078d220
sha256: 56e3f1e8e046801ba42898fac0958064063801883b7b54f692c087e7f59f0a98
sha512: 3d73e136ddce6f6aa78b268b00db83faba3bcb69bcb44e799415816db0d9e8177b01da9151a4fe29b6cb8554f30eb2328d4e054a04f77134d379bef00f95ab87
ssdeep: 24576:dNmY+fSycE7sh2vPEJqmAq7tDsvOrSH8tnrzw0DHS/:7mY+6dh2v8kmh7UO2HqffDK
type: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed

Version Info:
LegalCopyright: Copyright(C) 2019 x91cdx5e86x91cdx6a59x7f51x7edcx79d1x6280x6709x9650x516cx53f8.All Rights Reserved
InternalName: FlashHelperServices.exe
FileVersion: 2.3.0.38
CompanyName: x91cdx5e86x91cdx6a59x7f51x7edcx79d1x6280x6709x9650x516cx53f8
ProductName: Flash Helper Service
ProductVersion: 2.3.0.38
FileDescription: Flash Helper Service rc
OriginalFilename: FlashHelperService.exe
Translation: 0x0804 0x04b0

PUAAdvertising:Win32/FlashHelper also known as:

K7AntiVirus	Adware ( 0055b8191 )
Lionic	Adware.Win32.FlashServ.2!c
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
ALYac	Gen:Variant.Application.Bulz.134121
Cylance	Unsafe
Zillya	Adware.FlashServ.Win32.78
CrowdStrike	win/malicious_confidence_90% (D)
Alibaba	AdWare:Win32/2144FlashPlayer.cfb315c6
K7GW	Adware ( 0055b8191 )
Cybereason	malicious.4dc5d7
ESET-NOD32	a variant of Win32/2144FlashPlayer.A potentially unwanted
Avast	Win32:MiscX-gen [PUP]
Kaspersky	not-a-virus:HEUR:AdWare.Win32.FlashServ.gen
BitDefender	Gen:Variant.Application.Bulz.134121
MicroWorld-eScan	Gen:Variant.Application.Bulz.134121
Ad-Aware	Gen:Variant.Application.Bulz.134121
Sophos	Generic ML PUA (PUA)
Comodo	ApplicUnwnt@#1ophp5gc9wy2q
TrendMicro	PUA.Win32.FlashPlay2144.A
McAfee-GW-Edition	Artemis!PUP
FireEye	Gen:Variant.Application.Bulz.134121
Emsisoft	Gen:Variant.Application.Bulz.134121 (B)
SentinelOne	Static AI – Suspicious PE
Jiangmin	AdWare.FlashServ.af
Webroot	W32.Adware.Gen
Microsoft	PUAAdvertising:Win32/FlashHelper
Gridinsoft	PUP.FlashServ.ka!c
Arcabit	Trojan.Application.Bulz.D20BE9
GData	Gen:Variant.Application.Bulz.134121
McAfee	Artemis!742C8314DC5D
MAX	malware (ai score=77)
VBA32	Adware.FlashServ
Malwarebytes	PUP.Optional.ChinAd
Panda	Trj/CI.A
TrendMicro-HouseCall	PUA.Win32.FlashPlay2144.A
Rising	Adware.FlashNews!1.CEA9 (CLASSIC)
MaxSecure	Trojan.Malware.74521221.susgen
Fortinet	Riskware/2144FlashPlayer
AVG	Win32:MiscX-gen [PUP]

How to remove PUAAdvertising:Win32/FlashHelper?

PUAAdvertising:Win32/FlashHelper removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

PUAAdvertising:Win32/FlashHelper removal guide