Adware.Elex

Short bio

Adware.Elex is Malwarebytes’ generic detection name for a large family of Windows-oriented adware of Chinese origin.

Symptoms

Once executed, Adware.Elex displays ads by injecting them into visited sites and pops up browser windows.

Type and source of infection

Adware.Elex arrives on a system as a file downloaded from the Internet. Sometimes it disguises itself as a tool that can detect and remove adware. At times, it hides under the guise of an Adobe Flash or Java update. Adware.Elex can also be dropped by Trojan.Elex which has been known to use rootkits.

Protection

Malwarebytes protects users from Adware.Elex by using real-time protection.

Malwarebytes blocks Adware.Elex

Business remediation

Malwarebytes can detect and remove Adware.Elex on business machines without further user interaction.
To remove Adware.Elex using Malwarebytes business products, follow the instructions below.

How to remove Adware.Elex with Malwarebytes Endpoint Protection

Go to the Malwarebytes Cloud console.
To allow you to invoke a scan while the machine is off the network, go to Settings > Policies > your policy > General.
Under Endpoint Interface Options, turn ON:
1. Show Malwarebytes icon in notification area
2. Allow users to run a Threat Scan (all threats will be quarantined automatically)
Temporarily enable Anti-Rootkit scanning for all invoked threat scans.
Go to Settings > Policies > your policy > Endpoint Protection > Scan Options
Set Scan Rootkits to ON.
Once the endpoint has been updated with the latest policy changes:
1. Take the client off the network
2. From the system tray icon, run an Anti-Rootkit threat scan.

If you have infected machines that are not registered endpoints in Malwarebytes Endpoint Protection, you can remove Adware.Elex with our Breach Remediation tool (MBBR).

Log into your My Account page and copy your license key. The key is needed to activate MBBR tool.
Open your Cloud console.
From a clean and safe machine, go to Endpoints > Add > Malwarebytes Breach Remediation. This will download the MBBR zip package.
Unzip the package.
Access a Windows command line prompt and issue the following commands:
mbbr register –key:<prodkey>
mbbr update
Note: You must substitute your license key for <prodkey>.
Copy the MBBR folder to a flash drive.
From an infected, offline machine, copy the MBBR folder from the flash drive.
Start a scan using the following command:
mbbr scan –full –ark –remove –noreboot
Refer to the Malwarebytes Breach Remediation Windows Administrator Guide for all supported scanning commands.

How to remove Adware.Elex with Malwarebytes Endpoint Security

You can use Malwarebytes Anti-Malware v1.80, which is included in your Malwarebytes Endpoint Security deployment to scan and remove Adware.Elex.

Option 1

Remove the infected endpoint from the network.
On the infected machine, right click the system tray icon and click on Start Scanner.
Select Perform full scan.
Click on Scan button.

Option 2

Open CMD
CD to C:\Program Files (x86)\Malwarebytes’ Anti-Malware
Run mbamapi /scan –full –remove -reboot

It is recommended to follow the MBAM scan with an Anti-Rootkit (MBAR) tool scan.

From a safe computer, download the Anti-Rootkit tool.
For detailed instructions, refer to the KB article How do I use Malwarebytes Anti-Rookit?
Once Anti-Rootkit is updated (steps 1 – 4), copy it to a flash drive.
Go to an infected machine that has been scanned/cleaned with Anti-Malware and is still off the network.
Copy the Anti-Rootkit files from the flash drive to the machine.
Turn off Anti-Malware. Right click the Anti-Malware system tray icon and select Exit.
Run the Anti-Rootkit program to scan for threats. Refer to How do I use Malwarebytes Anti-Rookit? steps 5 – 12 for instructions.

Home remediation

Malwarebytes can detect and remove Adware.Elex without further user interaction.

Please download Malwarebytes to your desktop.
Double-click MBSetup.exe and follow the prompts to install the program.
When your Malwarebytes for Windows installation completes, the program opens to the Welcome to Malwarebytes screen.
Click on the Get started button.
Click Scan to start a Threat Scan.
Click Quarantine to remove the found threats.
Reboot the system if prompted to complete the removal process.

Malwarebytes removal log

An example Malwarebytes log for a member of this family called Youndoo:

Malwarebytes
www.malwarebytes.com

-Log Details-
Scan Date: 2/20/17
Scan Time: 2:10 PM
Logfile: mbamYoundoo.txt
Administrator: Yes

-Software Information-
Version: 3.0.6.1469
Components Version: 1.0.50
Update Package Version: 1.0.1307
License: Premium

-System Information-
OS: Windows 10
CPU: x64
File System: NTFS
User: {computername}\{username}

-Scan Summary-
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 420585
Time Elapsed: 8 min, 58 sec

-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

-Scan Details-
Process: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registry Key: 4
Adware.Elex.Generic, HKLM\SOFTWARE\CLASSES\CLSID\{5AD340E8-F445-11E6-B566-64006A5CFC23}, Delete-on-Reboot, [2155], [356410],1.0.1307
Adware.Elex.Generic, HKLM\SOFTWARE\CLASSES\CLSID\{5AD340E8-F445-11E6-B566-64006A5CFC23}\InprocServer32, Delete-on-Reboot, [2155], [356410],1.0.1307
PUP.Optional.Youndoo, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{92C91B86-B20E-474B-A1D9-6B7D5AC229C4}, Delete-on-Reboot, [767], [182916],1.0.1307
PUP.Optional.Youndoo, HKLM\SOFTWARE\WOW6432NODE\youndooSoftware, Delete-on-Reboot, [767], [182849],1.0.1307

Registry Value: 4
Adware.Elex.Generic, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELLEXECUTEHOOKS|{5AD340E8-F445-11E6-B566-64006A5CFC23}, Delete-on-Reboot, [2155], [356410],1.0.1307
Adware.Elex.SHHKRST, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER|ENABLESHELLEXECUTEHOOKS, Delete-on-Reboot, [357], [-1],0.0.0
Adware.Elex.SHHKRST, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER|ENABLESHELLEXECUTEHOOKS, Delete-on-Reboot, [357], [-1],0.0.0
PUP.Optional.Youndoo, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{92C91B86-B20E-474B-A1D9-6B7D5AC229C4}|DISPLAYNAME, Delete-on-Reboot, [767], [182916],1.0.1307

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 3
PUP.Optional.FakeFFProfile, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\naweriweentcofise\Profiles\mhc384j1.default, Delete-on-Reboot, [2786], [363173],1.0.1307
PUP.Optional.FakeFFProfile, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\naweriweentcofise\Profiles, Delete-on-Reboot, [2786], [363173],1.0.1307
PUP.Optional.FakeFFProfile, C:\USERS\{username}\APPDATA\ROAMING\Mozilla\Firefox\naweriweentcofise, Delete-on-Reboot, [2786], [363173],1.0.1307

File: 22
PUP.Optional.FakeFFProfile, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\naweriweentcofise\Profiles\mhc384j1.default\prefs.js, Delete-on-Reboot, [2786], [363173],1.0.1307
PUP.Optional.FakeFFProfile, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\naweriweentcofise\Profiles\mhc384j1.default\profiles.ini, Delete-on-Reboot, [2786], [363173],1.0.1307
PUP.Optional.FakeFFProfile, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\naweriweentcofise\Profiles\mhc384j1.default\search-metadata.json, Delete-on-Reboot, [2786], [363173],1.0.1307
PUP.Optional.FakeFFProfile, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\naweriweentcofise\Profiles\mhc384j1.default\search.json.mozlz4, Delete-on-Reboot, [2786], [363173],1.0.1307
Adware.Elex.Generic, C:\PROGRAM FILES (X86)\THULUCH\REUQUTAIN.DLL, Delete-on-Reboot, [2155], [356410],1.0.1307
PUP.Optional.Youndoo, C:\USERS\{username}\APPDATA\ROAMING\PROFILES\GHERLUWARDCOOZEIED.DEFAULT\PREFS.JS, Replaced, [767], [324487],1.0.1307
PUP.Optional.Youndoo, C:\USERS\{username}\APPDATA\ROAMING\PROFILES\GHERLUWARDCOOZEIED.DEFAULT\PREFS.JS, Replaced, [767], [324487],1.0.1307
PUP.Optional.Youndoo, C:\USERS\{username}\APPDATA\ROAMING\PROFILES\GHERLUWARDCOOZEIED.DEFAULT\PREFS.JS, Replaced, [767], [324487],1.0.1307
PUP.Optional.Youndoo, C:\USERS\{username}\APPDATA\ROAMING\PROFILES\GHERLUWARDCOOZEIED.DEFAULT\PREFS.JS, Replaced, [767], [324487],1.0.1307
PUP.Optional.Youndoo, C:\USERS\{username}\APPDATA\ROAMING\PROFILES\GHERLUWARDCOOZEIED.DEFAULT\PREFS.JS, Replaced, [767], [324487],1.0.1307
PUP.Optional.Youndoo, C:\USERS\{username}\APPDATA\ROAMING\PROFILES\GHERLUWARDCOOZEIED.DEFAULT\PREFS.JS, Replaced, [767], [324487],1.0.1307
PUP.Optional.Youndoo, C:\USERS\{username}\APPDATA\ROAMING\PROFILES\GHERLUWARDCOOZEIED.DEFAULT\PREFS.JS, Replaced, [767], [324487],1.0.1307
PUP.Optional.Youndoo, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\MHC384J1.DEFAULT\PREFS.JS, Replaced, [767], [302817],1.0.1307
PUP.Optional.Youndoo, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\MHC384J1.DEFAULT\PREFS.JS, Replaced, [767], [302817],1.0.1307
PUP.Optional.Youndoo, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\MHC384J1.DEFAULT\PREFS.JS, Replaced, [767], [302817],1.0.1307
PUP.Optional.Youndoo, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\MHC384J1.DEFAULT\PREFS.JS, Replaced, [767], [302817],1.0.1307
PUP.Optional.Youndoo, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\MHC384J1.DEFAULT\PREFS.JS, Replaced, [767], [302817],1.0.1307
Adware.Elex, C:\USERS\{username}\DESKTOP\WAK_MY.EXE, Delete-on-Reboot, [305], [363419],1.0.1307
PUP.Optional.Youndoo, C:\USERS\{username}\APPDATA\ROAMING\PROFILES\GHERLUWARDCOOZEIED.DEFAULT\SEARCHPLUGINS\JEBNKUVK.XML, Delete-on-Reboot, [767], [324489],1.0.1307
Adware.Elex.SHHKRST, C:\PROGRAM FILES (X86)\THULUCH\CRASHREPORT.DLL, Delete-on-Reboot, [357], [372356],1.0.1307
Adware.Elex.SHHKRST, C:\WINDOWS\SYSTEM32\TASKS\Gfakdutoing, Delete-on-Reboot, [357], [-1],0.0.0
PUP.Optional.Youndoo, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\MHC384J1.DEFAULT\SEARCHPLUGINS\JEBNKUVK.XML, Delete-on-Reboot, [767], [302734],1.0.1307

Physical Sector: 0
(No malicious items detected)


(end)