Adware

Win32/Adware.Neoreklami.KY removal instruction

Malware Removal

The Win32/Adware.Neoreklami.KY is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Win32/Adware.Neoreklami.KY virus can do?

  • SetUnhandledExceptionFilter detected (possible anti-debug)
  • Behavioural detection: Executable code extraction – unpacking
  • Executed a command line with /C or /R argument to terminate command shell on completion which can be used to hide execution
  • Creates RWX memory
  • Anomalous file deletion behavior detected (10+)
  • Guard pages use detected – possible anti-debugging.
  • Dynamic (imported) function loading detected
  • A named pipe was used for inter-process communication
  • Reads data out of its own binary image
  • A process created a hidden window
  • CAPE extracted potentially suspicious content
  • Executed a very long command line or script command which may be indicative of chained commands or obfuscation
  • Drops a binary and executes it
  • The binary contains an unknown PE section name indicative of packing
  • Authenticode signature is invalid
  • A scripting utility was executed
  • Uses Windows utilities for basic functionality
  • Uses Windows utilities for basic functionality
  • Detects VirtualBox using WNetGetProviderName trick
  • Behavioural detection: Transacted Hollowing
  • Installs itself for autorun at Windows startup
  • Creates a hidden or system file
  • Checks the version of Bios, possibly for anti-virtualization
  • Appears to use command line obfuscation
  • A script or command line contains a long continuous string indicative of obfuscation
  • Attempts to disable Windows Defender
  • Attempts to execute suspicious powershell command arguments
  • Uses suspicious command line tools or Windows utilities

How to determine Win32/Adware.Neoreklami.KY?


File Info:

name: 8629A5C188BFB64D2B8A.mlw
path: /opt/CAPEv2/storage/binaries/5985c65ed089f2c2975c1ddc021813b274e3fa67f9f9b17f887eebc4b1e0a3f4
crc32: 5CD1AF1E
md5: 8629a5c188bfb64d2b8a5c9ac2a6422d
sha1: 2666f1eff898efe33837365f0e77eec8c02f6e94
sha256: 5985c65ed089f2c2975c1ddc021813b274e3fa67f9f9b17f887eebc4b1e0a3f4
sha512: e96178678b25934e8d9bda5af257f73efe66f3c1295c132cc8405a9a104f15488e68fbe18a0d9f0f34ec761d6b317fce5581ef02a88b094289fec3abd6e57485
ssdeep: 98304:91ONhED8i92b9SVtc4A00+h98xiSvE3m1+mMqYioz+azmqD0FvXfNZSt0NQ2QrsY:91ON+r92b9R+b0iDqU+aiqD2F8OQvspW
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T184663370BBCE80F7C8B62A334A245F9AB1358E0EC53D197713A5519C3FEED66C41924A
sha3_384: f9e8e3a43edc52309ec3f0151c9d80cff8cff6629c6069360ef4a593810ad37b83e9e7d9dbc14e5476ffb3ccc7f8f657
ep_bytes: 558bec6aff68e0b94100682c4a410064
timestamp: 2010-11-18 16:27:35

Version Info:

CompanyName: Igor Pavlov
FileDescription: 7z Setup SFX
FileVersion: 9.20
InternalName: 7zS.sfx
LegalCopyright: Copyright (c) 1999-2010 Igor Pavlov
OriginalFilename: 7zS.sfx.exe
ProductName: 7-Zip
ProductVersion: 9.20
Translation: 0x0409 0x04b0

Win32/Adware.Neoreklami.KY also known as:

LionicTrojan.Win32.Agent.b!c
Elasticmalicious (high confidence)
MicroWorld-eScanGen:Variant.Jaik.48175
FireEyeGen:Variant.Jaik.48175
CAT-QuickHealPUA.NeoreklamiRI.S20793814
McAfeeArtemis!8629A5C188BF
CylanceUnsafe
VIPRETrojan.Win32.Generic!BT
SangforTrojan.Win32.Agent.tetpkc
K7AntiVirusRiskware ( 0040eff71 )
AlibabaAdWare:Win32/Neoreklami.c6ef959f
K7GWRiskware ( 0040eff71 )
CyrenW32/Neoreklami.H.gen!Eldorado
SymantecML.Attribute.HighConfidence
ESET-NOD32a variant of Win32/Adware.Neoreklami.KY
APEXMalicious
Paloaltogeneric.ml
KasperskyTrojan-Dropper.Win32.Agent.tetpkc
BitDefenderGen:Variant.Jaik.48175
NANO-AntivirusRiskware.Win32.Neoreklami.ivobyo
Ad-AwareGen:Variant.Jaik.48175
EmsisoftGen:Variant.Jaik.48175 (B)
DrWebTrojan.MulDrop17.48509
McAfee-GW-EditionGenericRXOP-HH!D99109308316
SophosGeneric PUA CG (PUA)
IkarusPUA.Neoreklami
GDataGen:Variant.Jaik.48175
JiangminTrojan.Multi.anu
eGambitUnsafe.AI_Score_99%
AviraHEUR/AGEN.1140029
Antiy-AVLTrojan/Generic.ASMalwS.331B71A
MicrosoftProgram:Win32/Wacapew.C!ml
CynetMalicious (score: 100)
AhnLab-V3Malware/Win.Generic.C4498139
VBA32Trojan.Sabsik.FT
ALYacGen:Variant.Jaik.48175
MAXmalware (ai score=82)
MalwarebytesAdware.Neoreklami
RisingTrojan.Generic@ML.89 (RDML:6joilQmBQduNB3wBqqSAdg)
SentinelOneStatic AI – Malicious SFX
FortinetAdware/Neoreklami.KR
AVGWin32:TrojanX-gen [Trj]
AvastWin32:TrojanX-gen [Trj]

How to remove Win32/Adware.Neoreklami.KY?

Win32/Adware.Neoreklami.KY removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment