Shopperz Ads

By GoldSparrow in Adware

Threat Scorecard

Popularity Rank:	7,948
Threat Level:	20 % (Normal)
Infected Computers:	93,353

First Seen:	November 11, 2014
Last Seen:	August 26, 2026
OS(es) Affected:	Windows

Shopperz advertisements is a Possibly Unwanted Program that may deliver several pop-up advertisements, coupons and online deals for the computer users that are shopping on the Internet. Shopperz advertisements is related to an adware program that may redirect computer users to unwanted websites in order to increase traffic and promote click-fraud. The appearance of advertisements displayed by Shopperz adware may be a clue that your machine is infected with a PUP. Shopperz-related adware and its unnecessary components should be removed to prevent repeated and irritating pop-up advertisements from appearing. The utilization of an anti-malware device is a secure way of blocking the Shopperz advertisements from being displayed and potentially disrupting a normal surfing of the Internet.

Table of Contents

Aliases

4 security vendors flagged this file as malicious.

Antivirus Vendor	Detection
Antiy-AVL	Trojan/Win32.TSGeneric
ClamAV	Win.Adware.Netfilter-722
F-Prot	W64/S-da439d85!Eldorado
AVG	Generic.4D9

SpyHunter Detects & Remove Shopperz Ads

File System Details

Shopperz Ads may create the following file(s):

Expand All | Collapse All

#	File Name	MD5	Detections Detections: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
1.	Vikonefucu.exe	e5b831d75cfdfd9b34095f408565e8d5	132
Name: Vikonefucu.exe MD5: e5b831d75cfdfd9b34095f408565e8d5 Size: 170.49 KB (170496 bytes) Detections: 132 Type: Executable File Path: %APPDATA%\Vikonefucu Group: Malware file Last Updated: March 31, 2020
2.	Poczho.exe	776cf85225fa73178868f3c4723fc605	71
Name: Poczho.exe MD5: 776cf85225fa73178868f3c4723fc605 Size: 170.49 KB (170496 bytes) Detections: 71 Type: Executable File Path: %APPDATA%\Poczho Group: Malware file Last Updated: July 6, 2016
3.	Jhunh.exe	fa71455facfcd49e5bc931a4f39e1b64	63
Name: Jhunh.exe MD5: fa71455facfcd49e5bc931a4f39e1b64 Size: 170.49 KB (170496 bytes) Detections: 63 Type: Executable File Path: %APPDATA%\Jhunh Group: Malware file Last Updated: July 6, 2016
4.	Guecelocfi.exe	41d5a52f5b523d3317bb0c137cecb770	56
Name: Guecelocfi.exe MD5: 41d5a52f5b523d3317bb0c137cecb770 Size: 170.49 KB (170496 bytes) Detections: 56 Type: Executable File Path: %APPDATA%\Guecelocfi Group: Malware file Last Updated: July 6, 2016
5.	Reicf.exe	9f17f0833e797e4faf1249cc8f11c22a	48
Name: Reicf.exe MD5: 9f17f0833e797e4faf1249cc8f11c22a Size: 170.49 KB (170496 bytes) Detections: 48 Type: Executable File Path: %APPDATA%\Reicf Group: Malware file Last Updated: July 6, 2016
6.	Gikmiw.exe	3034b72b60f4a3b00ccfb92ad080e09a	44
Name: Gikmiw.exe MD5: 3034b72b60f4a3b00ccfb92ad080e09a Size: 170.49 KB (170496 bytes) Detections: 44 Type: Executable File Path: %APPDATA%\Gikmiw Group: Malware file Last Updated: July 6, 2016
7.	Xuildauy.exe	718c2e5b28a83cfc06c713104537c8e4	41
Name: Xuildauy.exe MD5: 718c2e5b28a83cfc06c713104537c8e4 Size: 170.49 KB (170496 bytes) Detections: 41 Type: Executable File Path: %APPDATA%\Xuildauy Group: Malware file Last Updated: July 6, 2016
8.	Fidelahaou.exe	6a9e04b90b82fb35b320cb7a0c42e88f	31
Name: Fidelahaou.exe MD5: 6a9e04b90b82fb35b320cb7a0c42e88f Size: 170.49 KB (170496 bytes) Detections: 31 Type: Executable File Path: %APPDATA%\Fidelahaou Group: Malware file Last Updated: July 6, 2016
9.	Voakcygb.exe	8591dfe35faa10a726a4370cb46854b9	29
Name: Voakcygb.exe MD5: 8591dfe35faa10a726a4370cb46854b9 Size: 170.49 KB (170496 bytes) Detections: 29 Type: Executable File Path: %APPDATA%\Voakcygb Group: Malware file Last Updated: July 6, 2016
10.	Ruekwuwkic.exe	8e490ee3fe2672a583b81e7ef3aa205f	27
Name: Ruekwuwkic.exe MD5: 8e490ee3fe2672a583b81e7ef3aa205f Size: 170.49 KB (170496 bytes) Detections: 27 Type: Executable File Path: %APPDATA%\Ruekwuwkic Group: Malware file Last Updated: July 6, 2016
11.	Riidam.exe	5e23b598443ba8bceb049bb3f4f89da8	26
Name: Riidam.exe MD5: 5e23b598443ba8bceb049bb3f4f89da8 Size: 170.49 KB (170496 bytes) Detections: 26 Type: Executable File Path: %APPDATA%\Riidam Group: Malware file Last Updated: July 6, 2016
12.	Meifpu.exe	865d6e67f7f7140b2b7f379745525b90	26
Name: Meifpu.exe MD5: 865d6e67f7f7140b2b7f379745525b90 Size: 170.49 KB (170496 bytes) Detections: 26 Type: Executable File Path: %APPDATA%\Meifpu Group: Malware file Last Updated: July 6, 2016
13.	Guawr.exe	109d93c3b43a781f168ca9154ecaace6	9
Name: Guawr.exe MD5: 109d93c3b43a781f168ca9154ecaace6 Size: 272.25 KB (272256 bytes) Detections: 9 Type: Executable File Path: %PROGRAMFILES%\Wapgywceamcimk Group: Malware file Last Updated: May 10, 2016
14.	Avobahhr.exe	64c2a2551c04411fe508229cf203b48d	7
Name: Avobahhr.exe MD5: 64c2a2551c04411fe508229cf203b48d Size: 275.32 KB (275328 bytes) Detections: 7 Type: Executable File Path: %PROGRAMFILES%\Wapgywceamcimk Group: Malware file Last Updated: May 10, 2016
15.	Khmao.bat	a1fc9232f98243c7a288fc6f45b1e12c	4
Name: Khmao.bat MD5: a1fc9232f98243c7a288fc6f45b1e12c Size: 80B (80 bytes) Detections: 4 Type: Batch file Path: %PROGRAMFILES%\Lyje Group: Malware file Last Updated: April 27, 2016
16.	bsdpf64.sys	828b1d1e22527ada4a64ac1e68aa3852	4
Name: bsdpf64.sys MD5: 828b1d1e22527ada4a64ac1e68aa3852 Size: 27.45 KB (27456 bytes) Detections: 4 Type: System file Path: \??\C:\Windows\system32\Drivers Group: Malware file Last Updated: April 28, 2016
17.	bsdpr64.sys	d55540caa966d5af2c5d462f9c7ca3ab	4
Name: bsdpr64.sys MD5: d55540caa966d5af2c5d462f9c7ca3ab Size: 26.94 KB (26944 bytes) Detections: 4 Type: System file Path: \??\C:\Windows\system32\Drivers Group: Malware file Last Updated: April 28, 2016
18.	Gofva.exe	a75ca9cdf17d7392f2a75b4e1c39aaf1	3
Name: Gofva.exe MD5: a75ca9cdf17d7392f2a75b4e1c39aaf1 Size: 559.1 KB (559104 bytes) Detections: 3 Type: Executable File Path: %PROGRAMFILES%\Wapgywceamcimk Group: Malware file Last Updated: May 10, 2016
19.	Gofva64.exe	3854c79735a76783213619bc90476e04	3
Name: Gofva64.exe MD5: 3854c79735a76783213619bc90476e04 Size: 710.01 KB (710016 bytes) Detections: 3 Type: Executable File Path: %PROGRAMFILES%\Wapgywceamcimk Group: Malware file Last Updated: May 10, 2016
20.	Worjayd.bat	c8fdddf35291296ea14a3c1dcf860aac	2
Name: Worjayd.bat MD5: c8fdddf35291296ea14a3c1dcf860aac Size: 80B (80 bytes) Detections: 2 Type: Batch file Path: %PROGRAMFILES%\Lisgitiiokh Group: Malware file Last Updated: April 27, 2016
21.	Onujjion.bat	a67929b53b9c3eda08601387e88a6212	2
Name: Onujjion.bat MD5: a67929b53b9c3eda08601387e88a6212 Size: 80B (80 bytes) Detections: 2 Type: Batch file Path: %PROGRAMFILES%\Vavj Group: Malware file Last Updated: April 27, 2016
22.	Kibof.bat	fe90f30226c25f025b0a26d0025bd8b6	1
Name: Kibof.bat MD5: fe90f30226c25f025b0a26d0025bd8b6 Size: 80B (80 bytes) Detections: 1 Type: Batch file Path: %PROGRAMFILES%\Aolaffelf Group: Malware file Last Updated: April 27, 2016
23.	Wasrho.bat	f09eb9e3434542c110b148cba578e217	1
Name: Wasrho.bat MD5: f09eb9e3434542c110b148cba578e217 Size: 80B (80 bytes) Detections: 1 Type: Batch file Path: %PROGRAMFILES%\Gegr Group: Malware file Last Updated: April 27, 2016
24.	Apolraku.bat	c4b3ab8bbea36db07b66bed1b97d76bf	1
Name: Apolraku.bat MD5: c4b3ab8bbea36db07b66bed1b97d76bf Size: 80B (80 bytes) Detections: 1 Type: Batch file Path: %PROGRAMFILES%\Buajuw Group: Malware file Last Updated: April 27, 2016
25.	Imhti.bat	036ee090512f608ad08b0c63bc8c224e	1
Name: Imhti.bat MD5: 036ee090512f608ad08b0c63bc8c224e Size: 80B (80 bytes) Detections: 1 Type: Batch file Path: %PROGRAMFILES%\Wujsarkabra Group: Malware file Last Updated: April 27, 2016
26.	ZuxkEjulpam.exe	a023dad8b8008d0a76cae74777ff4d52	1
Name: ZuxkEjulpam.exe MD5: a023dad8b8008d0a76cae74777ff4d52 Size: 536.96 KB (536960 bytes) Detections: 1 Type: Executable File Path: %PROGRAMFILES%\Wapgywceamcimk Group: Malware file Last Updated: May 10, 2016

More files

Registry Details

Shopperz Ads may create the following registry entry or registry entries:

CLSID

{02FBE316-E0DD-4DB4-9FF7-44E3028A644A}

{08ACFB57-8187-47f0-AF93-56360D03634A}

{0A19D4F9-60BF-4471-88B1-FF4EC3168DEC}

{10E75EDD-1630-4E07-9CF8-B318A7717FCE}

{13189CA1-C2B1-4EE9-aE46-CE2C0520053D}

{14EF423E-3EE8-44AE-9337-07AC3F27B744}

{1664D439-C936-4560-8B1D-166CEAE021E6}

{21186475-d4df-43e2-9bba-0b52c00e0e27}

{2395B860-45E4-42fd-96E6-50BA597C1C42}

{35C4637C-4CF8-4C5D-864C-5239EEFEB0ED}

{3C2C21F7-FDB6-4b10-B605-FA4A281E3016}

{3c9ce603-44cc-4997-a166-239e6186c6ef}

{3CF50C82-4C4B-43e9-B1B2-15CB1BD0C193}

{40064F2B-BE74-40c0-B30F-1AF103872638}

{425F4ABF-B8E4-402D-9E49-06E494EB8DBF}

{4831289C-54C7-4CB5-849D-33E0350B93F7}

{483B3354-1399-4CE9-82FA-CFACA360B465}

{535b69cf-44f6-4c9f-96b1-b5adb65c582d}

{561EF67F-A0E1-4EF0-87BB-87AB9DA40665}

{5E8E5F49-3024-4E2C-80EC-BE28C81C3565}

{6F1EC027-290F-499f-BB58-BF04BA67C2B3}

{79562DD1-F962-4b2e-ADF4-434C5848F911}

{7D8DAE88-BC05-4578-8C29-E541FFBA5757}

{7EE956E9-3E36-42DD-8A60-FD83085FD20D}

{87AE2985-0835-4ABD-8398-D49B0BFCCA99}

{9c760b40-4718-40c3-a68d-2e4f21591d62}

{A9582D7B-F24A-441D-9D26-450D58F3CD17}

{AD3B3B31-21A9-44E7-8112-DF70373F3353}

{B1C01F05-691E-4402-878B-A409D4D489CE}

{B1E7C398-824A-4CB9-8D98-DF02E560EA02}

{B5C4833B-847B-49CD-8EBE-CDD9B43C882F}

{c3357769-3570-481c-9554-97865d9054e4}

{C74AB308-BA97-42f6-BB20-00E0868F52FB}

{cc89419d-fcd5-4a6b-aca2-09043448db22}

{d0174004-bb12-464b-b666-9ba9bdbd750a}

{DD50911B-2767-4061-9B55-EF5F0AAB5A79}

{EAC7DE5C-9520-435D-91AA-4A02E4773CEA}

{EE0D8859-2ED4-4B0D-9812-16865B9AFD65}

{F525CC93-970E-4841-8524-C7A087F4B650}

{F67329C7-6D17-4b82-913A-2646014A54A3}

Regexp file mask

%WINDIR%\System32\drivers\cherimoya.sys

%WinDir%\System32\JapgaeifmOff.ini

%WinDir%\System32\Ooteeotoor.ini

%WinDir%\System32\OoteeotoorOff.ini

%WinDir%\System32\Peakoar64.dll

%WINDIR%\System32\Tasks\omrUpdater

%windir%\System32\Tasks\Papuir

%WINDIR%\System32\Tasks\Uwewbiut

%WINDIR%\System32\Uiviuuj64.dll

%WINDIR%\System32\UiviuujOff.ini

%WinDir%\sysWOW64\Peakoar.dll

%WINDIR%\SysWOW64\Uiviuuj.ini

%WINDIR%\SysWOW64\UiviuujOff.ini

HKEY..\..\..\..{RegistryKeys}

SOFTWARE\Aiduwb

SOFTWARE\Classes\AppID\{425F4ABF-B8E4-402D-9E49-06E494EB8DBF}

SOFTWARE\Classes\Extension.bopon

SOFTWARE\Classes\Extension.bopon.1

SOFTWARE\Classes\Extension.Gwyn

SOFTWARE\Classes\Extension.Gwyn.1

SOFTWARE\Classes\Extension.Hopjul

SOFTWARE\Classes\Extension.Hopjul.1

SOFTWARE\Classes\Extension.tzah

SOFTWARE\Classes\Extension.Yhhbe

SOFTWARE\Classes\Extension.Yhhbe.1

Software\Classes\Software\{4E7638A1-6962-4e44-A6B9-F40E84FD6D09}

Software\Classes\Software\{79562DD1-F962-4b2e-ADF4-434C5848F911}

Software\Classes\Software\{A7FC5860-2A3A-4554-AFB1-C7F4DD432693}

Software\Classes\Software\{F51B5B89-A3AC-4BD6-b917-556C2DF511BC}

Software\Classes\Software\{F67329C7-6D17-4b82-913A-2646014A54A3}

SOFTWARE\Classes\Software\{FD93FD05-00A8-4EAB-8202-C0D95D68B940}

Software\Microsoft\Internet Explorer\Approved Extensions\{05B963BD-F46D-4117-b829-0F3FA2D12570}

Software\Microsoft\Internet Explorer\Approved Extensions\{0AB1A938-7792-4761-8861-1DD8DEE5005E}

Software\Microsoft\Internet Explorer\Approved Extensions\{318d2d55-9ce3-446e-8640-a43be68a550f}

Software\Microsoft\Internet Explorer\Approved Extensions\{3C2C21F7-FDB6-4b10-B605-FA4A281E3016}

Software\Microsoft\Internet Explorer\Approved Extensions\{3c9ce603-44cc-4997-a166-239e6186c6ef}

Software\Microsoft\Internet Explorer\Approved Extensions\{4D45295D-47E1-44EB-864C-5F3C780BD277}

Software\Microsoft\Internet Explorer\Approved Extensions\{50B41FA7-CDB0-4E1A-85AA-773B4CA2E953}

Software\Microsoft\Internet Explorer\Approved Extensions\{513EEBEC-206E-4F41-96B8-E26C3487E484}

Software\Microsoft\Internet Explorer\Approved Extensions\{5588FB9F-0CBF-4189-99E6-EBD06C0E02AC}

Software\Microsoft\Internet Explorer\Approved Extensions\{6CA285EC-02EF-46CA-8F00-79D80E4E4342}

Software\Microsoft\Internet Explorer\Approved Extensions\{709C6CF2-4B76-47BF-8569-F9C7874C9B9C}

SOFTWARE\Microsoft\Internet Explorer\Approved Extensions\{855A8483-AC9C-43D2-bBBD-65042C5523F0}

Software\Microsoft\Internet Explorer\Approved Extensions\{9A03A02C-5764-4CBB-8495-34007D94AC10}

Software\Microsoft\Internet Explorer\Approved Extensions\{A499593E-BDA6-4C3D-94AA-368852A8C549}

Software\Microsoft\Internet Explorer\Approved Extensions\{AAE3CAD1-5057-47E6-8CB8-D84EEB67D91C}

Software\Microsoft\Internet Explorer\Approved Extensions\{B0F49364-D378-4B0F-8E36-772579148834}

Software\Microsoft\Internet Explorer\Approved Extensions\{B1E7C398-824A-4CB9-8D98-DF02E560EA02}

Software\Microsoft\Internet Explorer\Approved Extensions\{B73D547E-7542-4D5C-9CCF-02D21B4219D3}

SOFTWARE\Microsoft\Internet Explorer\Approved Extensions\{C74AB308-BA97-42f6-BB20-00E0868F52FB}

Software\Microsoft\Internet Explorer\Approved Extensions\{D51D4235-9CAC-405A-9D6E-F0A3EDCC574C}

SOFTWARE\Microsoft\Internet Explorer\Approved Extensions\{D596F7A5-6563-413E-bCCB-B6D70AC596BE}

Software\Microsoft\Internet Explorer\Approved Extensions\{F02D0B85-9567-4932-828C-9A8BCE789C7B}

Software\Microsoft\Internet Explorer\Approved Extensions\{F1326CAB-2D6A-475F-9A4E-4BFD5CB3E920}

Software\Microsoft\Internet Explorer\Approved Extensions\{F4B7F5C6-C1F2-4AD0-9DD5-687682B2A363}

Software\Microsoft\Internet Explorer\Approved Extensions\{F525CC93-970E-4841-8524-C7A087F4B650}

Software\Microsoft\Internet Explorer\Approved Extensions\{F5E7D8E6-CFDB-44A0-89D5-214311E16323}

Software\Microsoft\Internet Explorer\Approved Extensions\{F77B2884-FB1D-4239-a847-D487941CE9A2}

Software\Microsoft\Internet Explorer\Stats\{3C2C21F7-FDB6-4b10-B605-FA4A281E3016}

Software\Microsoft\Internet Explorer\Stats\{B1E7C398-824A-4CB9-8D98-DF02E560EA02}

SOFTWARE\Microsoft\Internet Explorer\Stats\{C74AB308-BA97-42f6-BB20-00E0868F52FB}

SOFTWARE\Microsoft\Internet Explorer\Stats\{F525CC93-970E-4841-8524-C7A087F4B650}

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\omrUpdater

SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3C2C21F7-FDB6-4b10-B605-FA4A281E3016}

SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B1E7C398-824A-4CB9-8D98-DF02E560EA02}

SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F525CC93-970E-4841-8524-C7A087F4B650}

Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{3C2C21F7-FDB6-4B10-B605-FA4A281E3016}

SOFTWARE\Microsoft\Windows\CurrentVersion\Run\shopperz

SOFTWARE\Microsoft\Windows\CurrentVersion\Run\shopperz64

SOFTWARE\Mozilla\Firefox\Extensions\{318d2d55-9ce3-446e-8640-a43be68a550f}

SOFTWARE\Mozilla\Firefox\Extensions\{3C2C21F7-FDB6-4b10-B605-FA4A281E3016}

SOFTWARE\Mozilla\Firefox\Extensions\{970050F4-B21B-4c84-ACAB-DFEB867A4776}

SOFTWARE\Mozilla\Firefox\Extensions\{C74AB308-BA97-42f6-BB20-00E0868F52FB}

SOFTWARE\shopper-z

SOFTWARE\shopperz

SOFTWARE\Wow6432Node\Aiduwb

SOFTWARE\Wow6432Node\Classes\AppID\{425F4ABF-B8E4-402D-9E49-06E494EB8DBF}

SOFTWARE\Wow6432Node\Kajajugt

SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B1E7C398-824A-4CB9-8D98-DF02E560EA02}

SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F525CC93-970E-4841-8524-C7A087F4B650}

SOFTWARE\Wow6432Node\Mozilla\Firefox\Extensions\{318d2d55-9ce3-446e-8640-a43be68a550f}

SOFTWARE\Wow6432Node\Mozilla\Firefox\Extensions\{3C2C21F7-FDB6-4b10-B605-FA4A281E3016}

SOFTWARE\Wow6432Node\Mozilla\Firefox\Extensions\{3c9ce603-44cc-4997-a166-239e6186c6ef}

SOFTWARE\Wow6432Node\Mozilla\Firefox\Extensions\{970050F4-B21B-4c84-ACAB-DFEB867A4776}

SOFTWARE\Wow6432Node\Mozilla\Firefox\Extensions\{C74AB308-BA97-42f6-BB20-00E0868F52FB}

SOFTWARE\Wow6432Node\shopper-z

SOFTWARE\Wow6432Node\shopperz

SOFTWARE\Wow6432Node\Yhid

SOFTWARE\Yhid

Software\{4E7638A1-6962-4e44-A6B9-F40E84FD6D09}

Software\{58F2BB99-F9AF-415D-b3B0-E931E94FADA3}

Software\{F51B5B89-A3AC-4BD6-b917-556C2DF511BC}

Software\{FD93FD05-00A8-4EAB-8202-C0D95D68B940}

SYSTEM\ControlSet001\Control\SafeBoot\Minimal\bsdpf64.sys

SYSTEM\ControlSet001\Control\SafeBoot\Minimal\bsdpr64.sys

SYSTEM\ControlSet001\Control\SafeBoot\Network\bsdpf64.sys

SYSTEM\ControlSet001\Control\SafeBoot\Network\bsdpr64.sys

SYSTEM\ControlSet001\Enum\Root\LEGACY_BSDPF64

SYSTEM\ControlSet001\Enum\Root\LEGACY_BSDPR64

SYSTEM\ControlSet001\Enum\Root\LEGACY_CHERIMOYA

SYSTEM\ControlSet001\services\05B93BAB-FAE5-44A8-9846-753385F00C07

SYSTEM\ControlSet001\services\8dadad2f-d980-4b45-ab50-b9af125601a7

SYSTEM\ControlSet001\services\cherimoya

SYSTEM\ControlSet001\services\csrcc

SYSTEM\ControlSet001\services\DifkuCiabf

SYSTEM\ControlSet001\services\shopper-z Updater

SYSTEM\ControlSet001\services\shopperz Updater

SYSTEM\ControlSet002\Control\SafeBoot\Minimal\bsdpf64.sys

SYSTEM\ControlSet002\Control\SafeBoot\Minimal\bsdpr64.sys

SYSTEM\ControlSet002\Control\SafeBoot\Network\bsdpf64.sys

SYSTEM\ControlSet002\Control\SafeBoot\Network\bsdpr64.sys

SYSTEM\ControlSet002\Enum\Root\LEGACY_BSDPF64

SYSTEM\ControlSet002\Enum\Root\LEGACY_BSDPR64

SYSTEM\ControlSet002\Enum\Root\LEGACY_CHERIMOYA

SYSTEM\ControlSet002\services\05B93BAB-FAE5-44A8-9846-753385F00C07

SYSTEM\ControlSet002\services\cherimoya

SYSTEM\ControlSet002\services\csrcc

SYSTEM\ControlSet002\services\DifkuCiabf

SYSTEM\ControlSet002\services\shopperz Updater

SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\bsdpf64.sys

SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\bsdpr64.sys

SYSTEM\CurrentControlSet\Control\SafeBoot\Network\bsdpf64.sys

SYSTEM\CurrentControlSet\Control\SafeBoot\Network\bsdpr64.sys

SYSTEM\CurrentControlSet\Enum\Root\LEGACY_BSDPF64

SYSTEM\CurrentControlSet\Enum\Root\LEGACY_BSDPR64

SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CHERIMOYA

SYSTEM\CurrentControlSet\services\05B93BAB-FAE5-44A8-9846-753385F00C07

SYSTEM\CurrentControlSet\services\cherimoya

SYSTEM\CurrentControlSet\services\csrcc

SYSTEM\CurrentControlSet\services\DifkuCiabf

SYSTEM\CurrentControlSet\services\shopper-z Updater

SYSTEM\CurrentControlSet\services\shopperz Updater

SYSTEM\Setup\FirstBoot\Services\bsdriver

HKEY_LOCAL_MACHINE\Software\[APPLICATION]\Microsoft\Windows\CurrentVersion\Uninstall..{Uninstaller}

{1735357F-0D26-4566-b78C-C847801AB3F0}

{3C2C21F7-FDB6-4b10-B605-FA4A281E3016}_is1

{5081D2D4-1637-404c-B74F-50526718257D}_is1

{F0422270-2580-43FE-b53A-7F0BA1FB86E9}

Directories

Shopperz Ads may create the following directory or directories:

%APPDATA%\Anyflixdum

%APPDATA%\Asapg

%APPDATA%\Ficjagmuv

%APPDATA%\Fioxydo

%APPDATA%\Haohpex

%APPDATA%\Hejbuio

%APPDATA%\Mafcaedbew

%APPDATA%\Pywwiy

%APPDATA%\Tueasjey

%APPDATA%\Woehdovh

%LOCALAPPDATA%\Tempfolder\ortmp

%PROGRAMFILES%\Aiduwb

%PROGRAMFILES%\AiduwbUn

%PROGRAMFILES%\Ariqockatidge

%PROGRAMFILES%\Atagary

%PROGRAMFILES%\Busirekesp

%PROGRAMFILES%\Ekeh

%PROGRAMFILES%\Grgaentaneceing

%PROGRAMFILES%\Holuge

%PROGRAMFILES%\Kajajugt

%PROGRAMFILES%\Qotayphust

%PROGRAMFILES%\Shifipy

%PROGRAMFILES%\VejqepopeupluvUn

%PROGRAMFILES%\Yhid

%PROGRAMFILES%\YhidUn

%PROGRAMFILES%\Zohmaeffidwo

%PROGRAMFILES%\shopper-z

%PROGRAMFILES%\shopperz

%PROGRAMFILES%\shopperz29072015

%PROGRAMFILES(x86)%\Ariqockatidge

%PROGRAMFILES(x86)%\Atagary

%PROGRAMFILES(x86)%\Atequied

%PROGRAMFILES(x86)%\Busirekesp

%PROGRAMFILES(x86)%\Cholak

%PROGRAMFILES(x86)%\Ekeh

%PROGRAMFILES(x86)%\Grgaentaneceing

%PROGRAMFILES(x86)%\Holuge

%PROGRAMFILES(x86)%\Lmtyghodicult

%PROGRAMFILES(x86)%\Qotayphust

%PROGRAMFILES(x86)%\Shifipy

%PROGRAMFILES(x86)%\Yhid

%PROGRAMFILES(x86)%\YhidUn

%PROGRAMFILES(x86)%\shopperz

%PUBLIC%\{D2020D47-707D-4E26-B4D9-739C4F4C2E9A}

%USERPROFILE%\AppData\LocalLow\Company\Product\1.0

%USERPROFILE%\AppData\LocalLow\{D2020D47-707D-4E26-B4D9-739C4F4C2E9A}

%USERPROFILE%\Application Data\{D2020D47-707D-4E26-B4D9-739C4F4C2E9A}

%appdata%\GowvePitpagf

Analysis Report

General information

Family Name:	Adware.Shopperz
Signature status:	No Signature

Known Samples

MD5: 91c8223b3fa73b5e0dacbe4e550cc8dc

SHA1: e955d3b7a1b68dd0c85ed8cab6c49adad2f86df7

SHA256: FD3B3739612F893DB1005CC521358ADC352630C2AF27C97D45CCB9980B0B4DB1

File Size: 266.42 KB, 266415 bytes

Windows Portable Executable Attributes

File doesn't have "Rich" header
File doesn't have security information
File has exports table
File is 32-bit executable
File is console application (IMAGE_SUBSYSTEM_WINDOWS_CUI)
File is either console or GUI application
File is Native application (NOT .NET application)
File is not packed
IMAGE_FILE_DLL is not set inside PE header (Executable)
IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

Windows PE Version Information

Name	Value
Company Name	Microsoft Corporation
File Description	DNS Client API DLL
File Version	6.1.7601.21673 (win7sp1_ldr.110302-1502)
Internal Name	dnsapi
Legal Copyright	© Microsoft Corporation. All rights reserved.
Original Filename	dnsapi
Product Name	Microsoft® Windows® Operating System
Product Version	6.1.7601.21673

File Traits

dll
HighEntropy
ntdll
x86

Block Information

Total Blocks:	2,961
Potentially Malicious Blocks:	0
Whitelisted Blocks:	2,961
Unknown Blocks:	0

Visual Map

0 3 2 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0

... Data truncated

0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block

Windows API Usage

Category	API
Syscall Use	ntdll.dll!NtAlpcSendWaitReceivePort ntdll.dll!NtClose ntdll.dll!NtCreateFile ntdll.dll!NtCreateSection ntdll.dll!NtFreeVirtualMemory ntdll.dll!NtMapViewOfSection ntdll.dll!NtOpenFile ntdll.dll!NtOpenKey ntdll.dll!NtOpenProcessToken ntdll.dll!NtQueryAttributesFile Show More ntdll.dll!NtQueryDebugFilterState ntdll.dll!NtQueryInformationProcess ntdll.dll!NtQueryInformationToken ntdll.dll!NtQuerySystemInformationEx ntdll.dll!NtQueryValueKey ntdll.dll!NtQueryVirtualMemory ntdll.dll!NtQueryVolumeInformationFile ntdll.dll!NtReadFile ntdll.dll!NtSetEvent ntdll.dll!NtSetInformationFile ntdll.dll!NtSetInformationProcess ntdll.dll!NtSetInformationVirtualMemory ntdll.dll!NtSetInformationWorkerFactory ntdll.dll!NtTestAlert ntdll.dll!NtTraceControl ntdll.dll!NtUnmapViewOfSection ntdll.dll!NtWriteFile
Process Manipulation Evasion	NtUnmapViewOfSection
Process Shell Execute	CreateProcess
Anti Debug	NtQuerySystemInformation

Shell Command Execution


							C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\e955d3b7a1b68dd0c85ed8cab6c49adad2f86df7_0000266415.,LiQMAxHB

EnigmaSoft’s Payment Processor Digital River GmbH Filing for Bankruptcy Does Not Impact SpyHunter Customers’ Anti-Malware Protection

Search

Change Region

Shopperz Ads

Threat Scorecard

EnigmaSoft Threat Scorecard

Aliases

SpyHunter Detects & Remove Shopperz Ads

File System Details

Registry Details

Directories

Analysis Report

General information

Known Samples

Known Samples

Windows Portable Executable Attributes

Windows Portable Executable Attributes

Windows PE Version Information

Windows PE Version Information

File Traits

Block Information

Block Information

Visual Map

Windows API Usage

Windows API Usage

Shell Command Execution

Shell Command Execution

Submit Comment

Related Posts

Adware.Shopperz.CA

Trending

Teethbatchevy.com

Phifessisaing.com

Fc-lc.xyz

Most Viewed

Pornktube.porn

How To Fix 'Printer Driver is Unavailable' Error

Discord Shows Black Screen when Sharing Screen