We checked some samples of KEN740.EXE and detected the file KEN740.EXE as threat.
Remove the KEN740.EXE file from your computer right now.
Removal tool: http://www.unhackme.com
Malware Analysis of KEN740.EXE
Full path on a computer: %Program Files%\wiseie\ken740.exe
Detected by UnHackMe:
KEN740.EXE
Default location: %Program Files%\wiseie\ken740.exe
Removal Results: Success
Number of reboot: 1
KEN740.EXE is known as:
Trojan.Klone
KEN740.EXE hash:
- MD5: 6922d79209586257c3a3c1530dd07da6
The file tries to download information from some web sites.
How to quickly detect KEN740.EXE presence?
Image may be NSFW.
Clik here to view.
Registry:
Clik here to view.
Registry:- HKLM\Software\Classes\CLSID\{D4BBC368-B4BD-4142-A317-AC3A96047219}\LocalServer32\: “%Temp%\ken740.exe”
- HKLM\Software\Classes\file\shell\open\command\: “”C:\\Program Files\\wiseie\\ken740.exe” “%1″”
- HKLM\Software\Classes\WiseIEHTML\Shell\open\command\: “”C:\\Program Files\\wiseie\\ken740.exe” “%1″”
- HKLM\Software\Clients\StartMenuInternet\ken740.exe\shell\open\command\: “”C:\\Program Files\\wiseie\\ken740.exe”"
- HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WiseIE\DisplayName: “WiseIE 1″
- HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WiseIE\UninstallString: “C:\\Program Files\\wiseie\\ken740.exe uninstall”
- HKLM\Software\Classes\htmlfile\shell\open\command\: “”C:\\Program Files\\wiseie\\ken740.exe” “%1″”
- HKLM\Software\Classes\HTTP\shell\open\command\: “”C:\\Program Files\\wiseie\\ken740.exe” “%1″”
- HKLM\Software\Classes\https\shell\open\command\: “”C:\\Program Files\\wiseie\\ken740.exe” “%1″”
Image may be NSFW.
Clik here to view.Folders:
Clik here to view.
Folders:- %Appdata%\wiseie
- %Appdata%\wiseie\tmp
- %Appdata%\wiseie\tmp\html
- %Appdata%\wiseie\tmp\noticenew
- %Appdata%\wiseie\tmp\update
- %Appdata%\wiseie\tools
- %Appdata%\wiseie\wisedb
- %Appdata%\wiseie\wisedb\autoform
- %Program Files%\wiseie
Image may be NSFW.
Clik here to view.Files:
Clik here to view.
Files:- %Appdata%\wiseie\configs_light.ini
- %Appdata%\wiseie\tmp\setdefaultbrowser.ini
- %Appdata%\wiseie\tools\SnapShot.exe
- %Appdata%\wiseie\wisedb\syswhiteadlistl.pied
- %Desktop%\?aEUa?AA??.lnk
- %Temp%\ken740.exe
- %Temp%\