Jump to content

Search the Community

Showing results for tags 'acapps.online'.

  • Search By Tags

    Type tags separated by commas.
  • Search By Author

Content Type


Forums

  • Announcements
    • Malwarebytes News
    • Beta Testing Program
  • Malware Removal Help
    • Windows Malware Removal Help & Support
    • Mac Malware Removal Help & Support
    • Mobile Malware Removal Help & Support
    • Malware Removal Self-Help Guides
  • Malwarebytes for Home Support
    • Malwarebytes for Windows Support Forum
    • Malwarebytes for Mac Support Forum
    • Malwarebytes for Android Support Forum
    • Malwarebytes for iOS Support
    • Malwarebytes Privacy
    • Malwarebytes Browser Guard
    • False Positives
    • Comments and Suggestions
  • Malwarebytes for Business Support
    • Malwarebytes Endpoint Protection
    • Malwarebytes Incident Response (includes Breach Remediation)
    • Malwarebytes Endpoint Security
    • Malwarebytes Business Products Comments and Suggestions
  • Malwarebytes Tools and Other Products
    • Malwarebytes AdwCleaner
    • Malwarebytes Junkware Removal Tool Support
    • Malwarebytes Anti-Rootkit BETA Support
    • Malwarebytes Techbench USB (Legacy)
    • Malwarebytes Secure Backup discontinued
    • Other Tools
    • Malwarebytes Tools Comments and Suggestions
  • General Computer Help and Security Updates
    • BSOD, Crashes, Kernel Debugging
    • General Windows PC Help
  • Research Center
    • Newest Rogue-Ransomware Threats
    • Newest Malware Threats
    • Newest Mobile Threats
    • Newest IP or URL Threats
    • Newest Mac Threats
    • Report Scam Phone Numbers
  • General
    • General Chat
    • Forums Announcements & Feedback

Find results in...

Find results that contain...


Date Created

  • Start

    End


Last Updated

  • Start

    End


Filter by number of...

Joined

  • Start

    End


Group


AIM


MSN


Website URL


ICQ


Yahoo


Jabber


Location


Interests

Found 3 results

  1. What is InstaQuick? The Malwarebytes research team has determined that InstaQuick is adware. These adware applications display advertisements not originating from the sites you are browsing. How do I know if my computer is affected by InstaQuick? You may see these warnings during install: and this entry in your list of installed Programs and Features: How did InstaQuick get on my computer? Adware applications use different methods for distributing themselves. This particular one was downloaded from their website. How do I remove InstaQuick? Our program Malwarebytes can detect and remove this adware program. Please download Malwarebytes for Windows to your desktop. Double-click MBSetup.exe and follow the prompts to install the program. When your Malwarebytes for Windows installation completes, the program opens to the Welcome to Malwarebytes screen. Click on the Get started button. Click Scan to start a Threat Scan. When the scan is finished click Quarantine to remove the found threats. Reboot the system if prompted to complete the removal process. Is there anything else I need to do to get rid of InstaQuick? No, Malwarebytes removes InstaQuick completely. How would the full version of Malwarebytes help protect me? We hope our application and this guide have helped you eradicate this adware. As you can see below the full version of Malwarebytes would have protected you against the InstaQuick adware. It would have blocked the installer before it became too late. and we would have blocked access to their domain. Technical details for experts Possible signs in FRST logs: (InstaQuick -> InstaQuick) [File not signed] C:\Users\{username}\AppData\Roaming\InstaQuick\InstaQuick.exe <6> HKLM-x32\...\Run: [InstaQuick] => C:\Users\{username}\AppData\Roaming\InstaQuick\InstaQuick.exe [5304992 2021-02-04] (InstaQuick -> InstaQuick) [File not signed] C:\Users\{username}\AppData\Local\InstaQuick C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\InstaQuick C:\Users\{username}\AppData\Roaming\InstaQuick (InstaQuick) C:\Users\{username}\Desktop\InstaQuick.17.2102.1acwk.exe InstaQuick - Instagram for Desktop (HKLM-x32\...\InstaQuick) (Version: 17.2102.1acwk - InstaQuick) () [File not signed] C:\Users\{username}\AppData\Roaming\InstaQuick\swiftshader\libegl.dll () [File not signed] C:\Users\{username}\AppData\Roaming\InstaQuick\swiftshader\libglesv2.dll (InstaQuick -> Microsoft Corporation) [File not signed] C:\Users\{username}\AppData\Roaming\InstaQuick\D3DCompiler_47.dll (InstaQuick -> The NW.js Community) [File not signed] C:\Users\{username}\AppData\Roaming\InstaQuick\node.dll (InstaQuick -> The NW.js Community) [File not signed] C:\Users\{username}\AppData\Roaming\InstaQuick\nw.dll (InstaQuick -> The NW.js Community) [File not signed] C:\Users\{username}\AppData\Roaming\InstaQuick\nw_elf.dll Significant changes made by the installer: File system details [View: All details] (Selection) --------------------------------------------------- Adds the folder C:\Users\{username}\AppData\Local\InstaQuick\User Data Adds the file CrashpadMetrics-active.pma"="3/22/2021 8:40 AM, 1048576 bytes, A Adds the file First Run"="3/22/2021 8:40 AM, 0 bytes, A Adds the file Local State"="3/22/2021 8:41 AM, 3427 bytes, A Adds the file lockfile"="3/22/2021 8:40 AM, 0 bytes, A Adds the folder C:\Users\{username}\AppData\Local\InstaQuick\User Data\BrowserMetrics Adds the file BrowserMetrics-605849D8-1384.pma"="3/22/2021 8:40 AM, 4194304 bytes, A Adds the folder C:\Users\{username}\AppData\Local\InstaQuick\User Data\Crashpad Adds the file metadata"="3/22/2021 8:40 AM, 0 bytes, A Adds the file settings.dat"="3/22/2021 8:40 AM, 40 bytes, A Adds the folder C:\Users\{username}\AppData\Local\InstaQuick\User Data\Crashpad\reports Adds the folder C:\Users\{username}\AppData\Local\InstaQuick\User Data\Default Adds the file 000003.log"="3/22/2021 8:40 AM, 0 bytes, A Adds the file Cookies"="3/22/2021 8:41 AM, 20480 bytes, A Adds the file Cookies-journal"="3/22/2021 8:41 AM, 0 bytes, A Adds the file CURRENT"="3/22/2021 8:40 AM, 16 bytes, A Adds the file Favicons"="3/22/2021 8:40 AM, 20480 bytes, A Adds the file Favicons-journal"="3/22/2021 8:40 AM, 0 bytes, A Adds the file Google Profile.ico"="3/22/2021 8:40 AM, 151668 bytes, A Adds the file History"="3/22/2021 8:40 AM, 118784 bytes, A Adds the file History-journal"="3/22/2021 8:40 AM, 0 bytes, A Adds the file LOCK"="3/22/2021 8:40 AM, 0 bytes, A Adds the file LOG"="3/22/2021 8:40 AM, 0 bytes, A Adds the file Login Data"="3/22/2021 8:40 AM, 18432 bytes, A Adds the file Login Data-journal"="3/22/2021 8:40 AM, 0 bytes, A Adds the file MANIFEST-000002"="3/22/2021 8:40 AM, 50 bytes, A Adds the file Network Action Predictor"="3/22/2021 8:40 AM, 36864 bytes, A Adds the file Network Action Predictor-journal"="3/22/2021 8:40 AM, 0 bytes, A Adds the file Network Persistent State"="3/22/2021 8:41 AM, 499 bytes, A Adds the file page_load_capping_opt_out.db"="3/22/2021 8:40 AM, 16384 bytes, A Adds the file page_load_capping_opt_out.db-journal"="3/22/2021 8:40 AM, 0 bytes, A Adds the file Preferences"="3/22/2021 8:41 AM, 2430 bytes, A Adds the file previews_opt_out.db"="3/22/2021 8:40 AM, 16384 bytes, A Adds the file previews_opt_out.db-journal"="3/22/2021 8:40 AM, 0 bytes, A Adds the file QuotaManager"="3/22/2021 8:41 AM, 53248 bytes, A Adds the file QuotaManager-journal"="3/22/2021 8:41 AM, 0 bytes, A Adds the file README"="3/22/2021 8:40 AM, 162 bytes, A Adds the file Secure Preferences"="3/22/2021 8:40 AM, 4724 bytes, A Adds the file Top Sites"="3/22/2021 8:40 AM, 20480 bytes, A Adds the file Top Sites-journal"="3/22/2021 8:40 AM, 0 bytes, A Adds the file TransportSecurity"="3/22/2021 8:41 AM, 1592 bytes, A Adds the file Visited Links"="3/22/2021 8:40 AM, 0 bytes, A Adds the file Web Data"="3/22/2021 8:40 AM, 65536 bytes, A Adds the file Web Data-journal"="3/22/2021 8:40 AM, 0 bytes, A Adds the folder C:\Users\{username}\AppData\Local\InstaQuick\User Data\Default\blob_storage Adds the folder C:\Users\{username}\AppData\Local\InstaQuick\User Data\Default\Cache Adds the file data_0"="3/22/2021 8:40 AM, 45056 bytes, A Adds the file data_1"="3/22/2021 8:40 AM, 270336 bytes, A Adds the file data_2"="3/22/2021 8:40 AM, 1056768 bytes, A Adds the file data_3"="3/22/2021 8:40 AM, 4202496 bytes, A Adds the file f_000001"="3/22/2021 8:40 AM, 33478 bytes, A Adds the file f_000011"="3/22/2021 8:40 AM, 259232 bytes, A Adds the file index"="3/22/2021 8:40 AM, 262512 bytes, A Adds the folder C:\Users\{username}\AppData\Local\InstaQuick\User Data\Default\data_reduction_proxy_leveldb Adds the file 000003.log"="3/22/2021 8:40 AM, 0 bytes, A Adds the file CURRENT"="3/22/2021 8:40 AM, 16 bytes, A Adds the file LOCK"="3/22/2021 8:40 AM, 0 bytes, A Adds the file LOG"="3/22/2021 8:40 AM, 0 bytes, A Adds the file MANIFEST-000002"="3/22/2021 8:40 AM, 50 bytes, A Adds the folder C:\Users\{username}\AppData\Local\InstaQuick\User Data\Default\databases Adds the file Databases.db"="3/22/2021 8:40 AM, 28672 bytes, A Adds the file Databases.db-journal"="3/22/2021 8:40 AM, 0 bytes, A Adds the folder C:\Users\{username}\AppData\Local\InstaQuick\User Data\Default\databases\chrome-extension_mhbghaopeodicgkmjaffmkmdfddmncnh_0 Adds the file 1"="3/22/2021 8:40 AM, 16384 bytes, A Adds the folder C:\Users\{username}\AppData\Local\InstaQuick\User Data\Default\Extension Rules Adds the file 000003.log"="3/22/2021 8:40 AM, 0 bytes, A Adds the file CURRENT"="3/22/2021 8:40 AM, 16 bytes, A Adds the file LOCK"="3/22/2021 8:40 AM, 0 bytes, A Adds the file LOG"="3/22/2021 8:40 AM, 0 bytes, A Adds the file MANIFEST-000001"="3/22/2021 8:40 AM, 41 bytes, A Adds the folder C:\Users\{username}\AppData\Local\InstaQuick\User Data\Default\Extension State Adds the file 000003.log"="3/22/2021 8:40 AM, 0 bytes, A Adds the file CURRENT"="3/22/2021 8:40 AM, 16 bytes, A Adds the file LOCK"="3/22/2021 8:40 AM, 0 bytes, A Adds the file LOG"="3/22/2021 8:40 AM, 0 bytes, A Adds the file MANIFEST-000001"="3/22/2021 8:40 AM, 41 bytes, A Adds the folder C:\Users\{username}\AppData\Local\InstaQuick\User Data\Default\GPUCache Adds the file data_0"="3/22/2021 8:40 AM, 8192 bytes, A Adds the file data_1"="3/22/2021 8:40 AM, 270336 bytes, A Adds the file data_2"="3/22/2021 8:40 AM, 8192 bytes, A Adds the file data_3"="3/22/2021 8:40 AM, 8192 bytes, A Adds the file index"="3/22/2021 8:40 AM, 262512 bytes, A Adds the folder C:\Users\{username}\AppData\Local\InstaQuick\User Data\Default\IndexedDB\https_www.instagram.com_0.indexeddb.leveldb Adds the file 000003.log"="3/22/2021 8:40 AM, 318 bytes, A Adds the file CURRENT"="3/22/2021 8:40 AM, 16 bytes, A Adds the file LOCK"="3/22/2021 8:40 AM, 0 bytes, A Adds the file LOG"="3/22/2021 8:40 AM, 0 bytes, A Adds the file MANIFEST-000001"="3/22/2021 8:40 AM, 23 bytes, A Adds the folder C:\Users\{username}\AppData\Local\InstaQuick\User Data\Default\Local Storage\leveldb Adds the file 000003.log"="3/22/2021 8:40 AM, 0 bytes, A Adds the file CURRENT"="3/22/2021 8:40 AM, 16 bytes, A Adds the file LOCK"="3/22/2021 8:40 AM, 0 bytes, A Adds the file LOG"="3/22/2021 8:40 AM, 0 bytes, A Adds the file MANIFEST-000001"="3/22/2021 8:40 AM, 41 bytes, A Adds the folder C:\Users\{username}\AppData\Local\InstaQuick\User Data\Default\Session Storage Adds the file 000003.log"="3/22/2021 8:40 AM, 0 bytes, A Adds the file CURRENT"="3/22/2021 8:40 AM, 16 bytes, A Adds the file LOCK"="3/22/2021 8:40 AM, 0 bytes, A Adds the file LOG"="3/22/2021 8:40 AM, 0 bytes, A Adds the file MANIFEST-000001"="3/22/2021 8:40 AM, 41 bytes, A Adds the folder C:\Users\{username}\AppData\Local\InstaQuick\User Data\Default\Site Characteristics Database Adds the file 000003.log"="3/22/2021 8:40 AM, 0 bytes, A Adds the file CURRENT"="3/22/2021 8:40 AM, 16 bytes, A Adds the file LOCK"="3/22/2021 8:40 AM, 0 bytes, A Adds the file LOG"="3/22/2021 8:40 AM, 0 bytes, A Adds the file MANIFEST-000001"="3/22/2021 8:40 AM, 41 bytes, A Adds the folder C:\Users\{username}\AppData\Local\InstaQuick\User Data\Default\Sync Data\LevelDB Adds the file 000003.log"="3/22/2021 8:40 AM, 0 bytes, A Adds the file CURRENT"="3/22/2021 8:40 AM, 16 bytes, A Adds the file LOCK"="3/22/2021 8:40 AM, 0 bytes, A Adds the file LOG"="3/22/2021 8:40 AM, 0 bytes, A Adds the file MANIFEST-000001"="3/22/2021 8:40 AM, 41 bytes, A Adds the folder C:\Users\{username}\AppData\Local\InstaQuick\User Data\Default\Thumbnails Adds the file 000003.log"="3/22/2021 8:40 AM, 0 bytes, A Adds the file CURRENT"="3/22/2021 8:40 AM, 16 bytes, A Adds the file LOCK"="3/22/2021 8:40 AM, 0 bytes, A Adds the file LOG"="3/22/2021 8:40 AM, 0 bytes, A Adds the file MANIFEST-000001"="3/22/2021 8:40 AM, 41 bytes, A Adds the folder C:\Users\{username}\AppData\Local\InstaQuick\User Data\Default\Web Applications\_nwjs_mhbghaopeodicgkmjaffmkmdfddmncnh Adds the file InstaQuick.ico"="3/22/2021 8:40 AM, 172894 bytes, A Adds the file InstaQuick.ico.md5"="3/22/2021 8:40 AM, 16 bytes, A Adds the folder C:\Users\{username}\AppData\Local\InstaQuick\User Data\ShaderCache\GPUCache Adds the file data_0"="3/22/2021 8:40 AM, 8192 bytes, A Adds the file data_1"="3/22/2021 8:40 AM, 270336 bytes, A Adds the file data_2"="3/22/2021 8:40 AM, 8192 bytes, A Adds the file data_3"="3/22/2021 8:40 AM, 8192 bytes, A Adds the file index"="3/22/2021 8:40 AM, 262512 bytes, A Adds the folder C:\Users\{username}\AppData\Local\InstaQuick\User Data\Stability Adds the file 4996-1616398806548303.pma"="3/22/2021 8:40 AM, 1048576 bytes, A Adds the folder C:\Users\{username}\AppData\Roaming\InstaQuick Adds the file d3dcompiler_47.dll"="2/4/2021 11:49 AM, 3710752 bytes, A Adds the file ffmpeg.dll"="2/4/2021 11:50 AM, 1488160 bytes, A Adds the file icudtl.dat"="1/19/2021 11:29 AM, 10245952 bytes, A Adds the file InstaQuick.exe"="2/4/2021 11:49 AM, 5304992 bytes, A Adds the file libEGL.dll"="2/4/2021 11:50 AM, 96544 bytes, A Adds the file libGLESv2.dll"="2/4/2021 11:50 AM, 4434720 bytes, A Adds the file natives_blob.bin"="1/19/2021 11:29 AM, 92247 bytes, A Adds the file node.dll"="2/4/2021 11:50 AM, 12371744 bytes, A Adds the file notification_helper.exe"="2/4/2021 11:49 AM, 493344 bytes, A Adds the file nw.dll"="2/4/2021 11:50 AM, 94750496 bytes, A Adds the file nw_100_percent.pak"="1/19/2021 11:29 AM, 1021430 bytes, A Adds the file nw_200_percent.pak"="1/19/2021 11:29 AM, 1341563 bytes, A Adds the file nw_elf.dll"="2/4/2021 11:50 AM, 493856 bytes, A Adds the file resources.pak"="1/19/2021 11:29 AM, 5550400 bytes, A Adds the file snapshot_blob.bin"="1/19/2021 11:29 AM, 1283220 bytes, A Adds the file storage.json"="3/22/2021 8:39 AM, 80 bytes, A Adds the file Uninstall.exe"="3/22/2021 8:39 AM, 472524 bytes, A Adds the file v8_context_snapshot.bin"="1/19/2021 11:29 AM, 1607648 bytes, A Adds the folder C:\Users\{username}\AppData\Roaming\InstaQuick\locales Adds the folder C:\Users\{username}\AppData\Roaming\InstaQuick\swiftshader Adds the file libEGL.dll"="1/19/2021 11:29 AM, 122368 bytes, A Adds the file libGLESv2.dll"="1/19/2021 11:29 AM, 2256896 bytes, A Adds the folder C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\InstaQuick Adds the file InstaQuick.lnk"="3/22/2021 8:39 AM, 1873 bytes, A Adds the file Uninstall.lnk"="3/22/2021 8:39 AM, 1866 bytes, A Registry details [View: All details] (Selection) ------------------------------------------------ [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "InstaQuick"="REG_SZ", "C:\Users\{username}\AppData\Roaming\InstaQuick\InstaQuick.exe --su" [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\InstaQuick] "DisplayIcon"="REG_SZ", ""C:\Users\{username}\AppData\Roaming\InstaQuick\Uninstall.exe"" "DisplayName"="REG_SZ", "InstaQuick - Instagram for Desktop" "DisplayVersion"="REG_SZ", "17.2102.1acwk" "EstimatedSize"="REG_DWORD", 179797 "Publisher"="REG_SZ", "InstaQuick" "UninstallString"="REG_SZ", ""C:\Users\{username}\AppData\Roaming\InstaQuick\Uninstall.exe"" [HKEY_CURRENT_USER\Software\AppDataLow\Software\InstaQuick] "uid"="REG_SZ", "BD2E4143-63F5-4568-BE87-73C4F20BC096" [HKEY_CURRENT_USER\Software\nwjs] "FirstNotDefault"="REG_QWORD, .../ "metricsid"="REG_SZ", "b94fb534-649f-41ab-b791-f6472c7aac8a" "metricsid_enableddate"="REG_SZ", "1616398809" "metricsid_installdate"="REG_SZ", "1616398808" [HKEY_CURRENT_USER\Software\nwjs\BLBeacon] "failed_count"="REG_DWORD", 0 "state"="REG_DWORD", 1 "version"="REG_SZ", "71.0.3578.98" [HKEY_CURRENT_USER\Software\nwjs\PreferenceMACs\Default] "browser.show_home_button"="REG_SZ", "D4AE6B748030C65B37203BF504F4BAB6B7189D30A8068E933D27D272B9825121" "default_search_provider_data.template_url_data"="REG_SZ", "577902E48778C2084EA38A666D6F118AC7A10E564E6D2C614157FE4553B1CDF1" "google.services.account_id"="REG_SZ", "6FD09700B4A149D948B55F3C0AB72673D5C367B9E751454C6202DC1D3DFA6802" "google.services.last_account_id"="REG_SZ", "6AF24852E27EDB5DFA7E36D3AC87D5EBDB6B1A2ACB4AF4E651C22798B2394A67" "google.services.last_username"="REG_SZ", "BF235C9F83153EC2D71D60021ED0AA56728D62A5264E811DCEBFF589EA33BE81" "google.services.username"="REG_SZ", "A70B5C736433139A005D3E49D73AB8574672434936A4FA21F55757B0E4882F3C" "homepage"="REG_SZ", "6BEC350ECF8125372A826D71D2DB258A636A08AF0C652D9E774072EFB372A346" "homepage_is_newtabpage"="REG_SZ", "71E415DF84698054516E68295FA7E443543243920785F715BF71F2641FD03239" "media.storage_id_salt"="REG_SZ", "7CB55C624C43F9AF857E83B87E0E531816C28E8B247C5FBF4E6515960AD67692" "pinned_tabs"="REG_SZ", "988BA7AF49CBEED46002524FB1DC5972CCCEE6DF03B77A755B3E322D74E33697" "prefs.preference_reset_time"="REG_SZ", "3BB6D1CF1E2266580804D7B343EB3D436157898CC157308C74F704B5D85BFEB3" "safebrowsing.incidents_sent"="REG_SZ", "749D4F2A5067553DBA6E47E7C37A086D83F1623F54420951FD2646E8E8E27C80" "search_provider_overrides"="REG_SZ", "D868509C983E4D4868450576F8A3D3E7E05C68568CF8D7DF91589972AEF37E93" "session.restore_on_startup"="REG_SZ", "43A753CE09B9BF0DC9660872B81B90FD2A0D9B708609FE84D2B964F6828053EA" "session.startup_urls"="REG_SZ", "5622145A2429114A31AC87D39A6757FFC8802A76D4158BC08DC268C76568D401" "settings_reset_prompt.last_triggered_for_default_search"="REG_SZ", "1B7549747E6FD7C37E6D498A93AB6980CF3A2002D339CFD5D09C6997B37FA7E3" "settings_reset_prompt.last_triggered_for_homepage"="REG_SZ", "3937DC165E7432A408A1AEAC832766F0C8D5A7C7ADB070399FE60CB887003332" "settings_reset_prompt.last_triggered_for_startup_urls"="REG_SZ", "9CA5289F21296A288C9A358716171FDF673C04D4A30D443BB97A408B83B08135" "settings_reset_prompt.prompt_wave"="REG_SZ", "8E49A1A3D2AA3456F777518FDCC2BA30722E089ECFD7B7265C2EE8BB90D3EF15" "software_reporter.prompt_seed"="REG_SZ", "CC15095EDB89D7530910B1296F1D27AF2AC038D4F6B627A0668381488E697535" "software_reporter.prompt_version"="REG_SZ", "04FFA133961EA613587BC3C40EBACF2A6F42BCECBCEAE1CE4312993E3A3E752E" [HKEY_CURRENT_USER\Software\nwjs\StabilityMetrics] "user_experience_metrics.stability.exited_cleanly"="REG_DWORD", 0 Malwarebytes log: Malwarebytes www.malwarebytes.com -Log Details- Scan Date: 3/22/21 Scan Time: 12:22 PM Log File: db431486-8b00-11eb-a0fa-080027235d76.json -Software Information- Version: 4.3.0.98 Components Version: 1.0.1217 Update Package Version: 1.0.38517 License: Premium -System Information- OS: Windows 7 Service Pack 1 CPU: x64 File System: NTFS User: {username}-PC\{username} -Scan Summary- Scan Type: Threat Scan Scan Initiated By: Manual Result: Completed Objects Scanned: 233833 Threats Detected: 19 Threats Quarantined: 18 Time Elapsed: 3 min, 54 sec -Scan Options- Memory: Enabled Startup: Enabled Filesystem: Enabled Archives: Enabled Rootkits: Disabled Heuristics: Enabled PUP: Detect PUM: Detect -Scan Details- Process: 0 (No malicious items detected) Module: 8 PUP.Optional.InstaQuick, C:\USERS\{username}\APPDATA\ROAMING\INSTAQUICK\D3DCOMPILER_47.DLL, Quarantined, 3596, 923360, , , , , 6F2978198B7CC08E34769B2660B2C6DF, 3C511D1ED4C5F5D710BE5CACCD7BF596F97F848EBC53F490223A60ECD5542B74 PUP.Optional.InstaQuick, C:\USERS\{username}\APPDATA\ROAMING\INSTAQUICK\SWIFTSHADER\LIBGLESV2.DLL, Quarantined, 3596, 923360, , , , , DC0A1C2539D26524AADF8AA8937CEF0B, 6C3F9D4062A383983716C6956DEE35C6832E6C7D5DE82D60220D3BF6BEB74A56 PUP.Optional.InstaQuick, C:\USERS\{username}\APPDATA\ROAMING\INSTAQUICK\SWIFTSHADER\LIBEGL.DLL, Quarantined, 3596, 923360, , , , , 1C85AE3C2CD01A0FA35306E4A79AB09D, E73AEE1DF92CC5ED40F38097310F98C58C41E729C05FE554877B42B620C7D658 PUP.Optional.InstaQuick, C:\USERS\{username}\APPDATA\ROAMING\INSTAQUICK\NW_ELF.DLL, Quarantined, 3596, 923360, , , , , B179DD1DB5D623A4B44CB29A733C5BAC, A4F4B8F64DC649AE49C1771AA8357A1D139D082F1C39063ECBE2A3010E504E3F PUP.Optional.InstaQuick, C:\USERS\{username}\APPDATA\ROAMING\INSTAQUICK\NW_ELF.DLL, Quarantined, 3596, 923360, , , , , B179DD1DB5D623A4B44CB29A733C5BAC, A4F4B8F64DC649AE49C1771AA8357A1D139D082F1C39063ECBE2A3010E504E3F PUP.Optional.InstaQuick, C:\USERS\{username}\APPDATA\ROAMING\INSTAQUICK\NW_ELF.DLL, Quarantined, 3596, 923360, , , , , B179DD1DB5D623A4B44CB29A733C5BAC, A4F4B8F64DC649AE49C1771AA8357A1D139D082F1C39063ECBE2A3010E504E3F PUP.Optional.InstaQuick, C:\USERS\{username}\APPDATA\ROAMING\INSTAQUICK\NW_ELF.DLL, Quarantined, 3596, 923360, , , , , B179DD1DB5D623A4B44CB29A733C5BAC, A4F4B8F64DC649AE49C1771AA8357A1D139D082F1C39063ECBE2A3010E504E3F PUP.Optional.InstaQuick, C:\USERS\{username}\APPDATA\ROAMING\INSTAQUICK\NW_ELF.DLL, Quarantined, 3596, 923360, , , , , B179DD1DB5D623A4B44CB29A733C5BAC, A4F4B8F64DC649AE49C1771AA8357A1D139D082F1C39063ECBE2A3010E504E3F Registry Key: 2 PUP.Optional.InstaQuick, HKCU\SOFTWARE\APPDATALOW\SOFTWARE\InstaQuick, Quarantined, 3596, 923363, 1.0.38517, , ame, , , PUP.Optional.InstaQuick, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\InstaQuick, Quarantined, 3596, 923362, 1.0.38517, , ame, , , Registry Value: 0 (No malicious items detected) Registry Data: 0 (No malicious items detected) Data Stream: 0 (No malicious items detected) Folder: 3 PUP.Optional.InstaQuick, C:\USERS\{username}\APPDATA\LOCAL\INSTAQUICK, Removal Failed, 3596, 923359, 1.0.38517, , ame, , , PUP.Optional.InstaQuick, C:\USERS\{username}\APPDATA\ROAMING\INSTAQUICK, Quarantined, 3596, 923360, 1.0.38517, , ame, , , PUP.Optional.InstaQuick, C:\USERS\{username}\APPDATA\ROAMING\MICROSOFT\WINDOWS\START MENU\PROGRAMS\INSTAQUICK, Quarantined, 3596, 923361, 1.0.38517, , ame, , , File: 6 PUP.Optional.InstaQuick, C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\InstaQuick\InstaQuick.lnk, Quarantined, 3596, 923361, , , , , F45D8F715F6A1157FD446B77D6CDDFE5, A0AAEBC3557D85EA3C6061A367111531FE7B07E7838A384C356CB2CDF809C5E6 PUP.Optional.InstaQuick, C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\InstaQuick\Uninstall.lnk, Quarantined, 3596, 923361, , , , , 567EE12CA4B7BA400771D090903FF71D, E5CD824956130AC3CD32FFA717B39B8664CBDEF09171F0E7A08D80D13232AD90 PUP.Optional.InstaQuick, C:\USERS\{username}\APPDATA\ROAMING\INSTAQUICK\D3DCOMPILER_47.DLL, Quarantined, 3596, 923360, 1.0.38517, , ame, , 6F2978198B7CC08E34769B2660B2C6DF, 3C511D1ED4C5F5D710BE5CACCD7BF596F97F848EBC53F490223A60ECD5542B74 PUP.Optional.InstaQuick, C:\USERS\{username}\APPDATA\ROAMING\INSTAQUICK\SWIFTSHADER\LIBGLESV2.DLL, Quarantined, 3596, 923360, 1.0.38517, , ame, , DC0A1C2539D26524AADF8AA8937CEF0B, 6C3F9D4062A383983716C6956DEE35C6832E6C7D5DE82D60220D3BF6BEB74A56 PUP.Optional.InstaQuick, C:\USERS\{username}\APPDATA\ROAMING\INSTAQUICK\SWIFTSHADER\LIBEGL.DLL, Quarantined, 3596, 923360, 1.0.38517, , ame, , 1C85AE3C2CD01A0FA35306E4A79AB09D, E73AEE1DF92CC5ED40F38097310F98C58C41E729C05FE554877B42B620C7D658 PUP.Optional.InstaQuick, C:\USERS\{username}\APPDATA\ROAMING\INSTAQUICK\NW_ELF.DLL, Quarantined, 3596, 923360, 1.0.38517, , ame, , B179DD1DB5D623A4B44CB29A733C5BAC, A4F4B8F64DC649AE49C1771AA8357A1D139D082F1C39063ECBE2A3010E504E3F Physical Sector: 0 (No malicious items detected) WMI: 0 (No malicious items detected) (end) As mentioned before the full version of Malwarebytes could have protected your computer against this threat. We use different ways of protecting your computer(s): Dynamically Blocks Malware Sites & Servers Malware Execution Prevention Save yourself the hassle and get protected.
  2. What is MessengerTime? The Malwarebytes research team has determined that MessengerTime is a potentially unwanted program that behaves like adware. These adware applications display advertisements not originating from the sites you are browsing. How do I know if my computer is affected by MessengerTime? This is the main screen of the program: You may see these warnings during install: these running processes in your taskmanager: this icon in your taskbar: and this entry in your list of installed Programs and Features: How did MessengerTime get on my computer? Adware applications use different methods for distributing themselves. This particular one was downloaded from their website: How do I remove MessengerTime? Our program Malwarebytes can detect and remove this adware program. Please download Malwarebytes for Windows to your desktop. Double-click MBSetup.exe and follow the prompts to install the program. When your Malwarebytes for Windows installation completes, the program opens to the Welcome to Malwarebytes screen. Click on the Get started button. Click Scan to start a Threat Scan. When the scan is finished click Quarantine to remove the found threats. Reboot the system if prompted to complete the removal process. Is there anything else I need to do to get rid of MessengerTime? No, Malwarebytes removes MessengerTime completely. How would the full version of Malwarebytes help protect me? We hope our application and this guide have helped you eradicate this adware. As you can see below the full version of Malwarebytes would have protected you against the MessengerTime adware. It would have blocked the installer before it became too late. and we would have blocked traffic to their domain: Technical details for experts Possible signs in FRST logs: HKLM-x32\...\Run: [MessengerTime] => C:\Users\{username}\AppData\Roaming\MessengerTime\MessengerTime.exe [47905560 2019-06-10] (MessengerTime -> ) [File not signed] C:\Users\{username}\AppData\Local\MessengerTime C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MessengerTime C:\Users\{username}\AppData\Roaming\MessengerTime (MessengerTime) C:\Users\{username}\Downloads\MessengerTime.14.1906.1.exe Significant changes made by the installer: File system details [View: All details] (Selection) --------------------------------------------------- Adds the folder C:\Users\{username}\AppData\Local\MessengerTime Adds the file cookies"="1/26/2021 9:19 AM, 6144 bytes, A Adds the file cookies-journal"="1/26/2021 9:19 AM, 4640 bytes, A Adds the file lockfile"="1/26/2021 9:15 AM, 0 bytes, A Adds the file QuotaManager"="1/26/2021 9:16 AM, 13312 bytes, A Adds the file QuotaManager-journal"="1/26/2021 9:16 AM, 8768 bytes, A Adds the file Web Data"="1/26/2021 9:15 AM, 40960 bytes, A Adds the file Web Data-journal"="1/26/2021 9:15 AM, 512 bytes, A Adds the folder C:\Users\{username}\AppData\Local\MessengerTime\Cache Adds the file 039874a14273793a_0"="1/26/2021 9:15 AM, 1052181 bytes, A Adds the file 0894cf888c75339c_0"="1/26/2021 9:15 AM, 97098 bytes, A Adds the file 08f7cd021f2fa376_0"="1/26/2021 9:15 AM, 3854 bytes, A Adds the file fcf223eddd011794_0"="1/26/2021 9:15 AM, 8608 bytes, A Adds the file index"="1/26/2021 9:15 AM, 24 bytes, A Adds the folder C:\Users\{username}\AppData\Local\MessengerTime\Cache\index-dir Adds the file the-real-index"="1/26/2021 9:19 AM, 1052 bytes, A Adds the folder C:\Users\{username}\AppData\Local\MessengerTime\databases Adds the file Databases.db"="1/26/2021 9:15 AM, 7168 bytes, A Adds the file Databases.db-journal"="1/26/2021 9:15 AM, 5672 bytes, A Adds the folder C:\Users\{username}\AppData\Local\MessengerTime\databases\file__0 Adds the file 1"="1/26/2021 9:15 AM, 4096 bytes, A Adds the folder C:\Users\{username}\AppData\Local\MessengerTime\GPUCache Adds the file data_0"="1/26/2021 9:15 AM, 8192 bytes, A Adds the file data_1"="1/26/2021 9:15 AM, 270336 bytes, A Adds the file data_2"="1/26/2021 9:15 AM, 8192 bytes, A Adds the file data_3"="1/26/2021 9:15 AM, 8192 bytes, A Adds the file index"="1/26/2021 9:15 AM, 262512 bytes, A Adds the folder C:\Users\{username}\AppData\Local\MessengerTime\Local Storage Adds the file file__0.localstorage"="1/26/2021 9:18 AM, 15360 bytes, A Adds the file file__0.localstorage-journal"="1/26/2021 9:18 AM, 4640 bytes, A Adds the file https_www.messenger.com_0.localstorage"="1/26/2021 9:19 AM, 3072 bytes, A Adds the file https_www.messenger.com_0.localstorage-journal"="1/26/2021 9:19 AM, 3608 bytes, A Adds the folder C:\Users\{username}\AppData\Roaming\MessengerTime Adds the file ffmpegsumo.dll"="6/10/2019 1:36 PM, 1652800 bytes, A Adds the file icudtl.dat"="6/10/2019 1:33 PM, 10457856 bytes, A Adds the file MessengerTime.exe"="6/10/2019 1:36 PM, 47905560 bytes, A Adds the file nw.pak"="6/10/2019 1:33 PM, 7481810 bytes, A Adds the file storage.json"="1/26/2021 9:15 AM, 81 bytes, A Adds the file Uninstall.exe"="1/26/2021 9:15 AM, 472524 bytes, A Adds the folder C:\Users\{username}\AppData\Roaming\MessengerTime\locales Adds the folder C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MessengerTime Adds the file MessengerTime.lnk"="1/26/2021 9:15 AM, 1921 bytes, A Adds the file Uninstall.lnk"="1/26/2021 9:15 AM, 1893 bytes, A In the existing folder C:\Users\{username}\Desktop Adds the file MessengerTime.14.1906.1.exe"="1/26/2021 9:11 AM, 29379840 bytes, A Registry details [View: All details] (Selection) ------------------------------------------------ [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "MessengerTime"="REG_SZ", "C:\Users\{username}\AppData\Roaming\MessengerTime\MessengerTime.exe su" [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MessengerTime] "DisplayIcon"="REG_SZ", ""C:\Users\{username}\AppData\Roaming\MessengerTime\Uninstall.exe"" "DisplayName"="REG_SZ", "MessengerTime - Facebook Messenger for Desktop" "DisplayVersion"="REG_SZ", "14.1906.1" "EstimatedSize"="REG_DWORD", 65916 "Publisher"="REG_SZ", "MessengerTime" "UninstallString"="REG_SZ", ""C:\Users\{username}\AppData\Roaming\MessengerTime\Uninstall.exe"" [HKEY_CURRENT_USER\Software\AppDataLow\Software\MessengerTime] "uid"="REG_SZ", "5A86DCDB-CAA0-4E1B-8420-4D78999DDDDC" Malwarebytes log: Malwarebytes www.malwarebytes.com -Log Details- Scan Date: 1/26/21 Scan Time: 9:31 AM Log File: e21cec26-5fb0-11eb-890f-080027235d76.json -Software Information- Version: 4.3.0.98 Components Version: 1.0.1146 Update Package Version: 1.0.36219 License: Premium -System Information- OS: Windows 7 Service Pack 1 CPU: x64 File System: NTFS User: {computername}\{username} -Scan Summary- Scan Type: Threat Scan Scan Initiated By: Manual Result: Completed Objects Scanned: 232951 Threats Detected: 138 Threats Quarantined: 138 Time Elapsed: 3 min, 8 sec -Scan Options- Memory: Enabled Startup: Enabled Filesystem: Enabled Archives: Enabled Rootkits: Disabled Heuristics: Enabled PUP: Detect PUM: Detect -Scan Details- Process: 0 (No malicious items detected) Module: 0 (No malicious items detected) Registry Key: 2 PUP.Optional.MessengerTime, HKCU\SOFTWARE\APPDATALOW\SOFTWARE\MessengerTime, Quarantined, 10317, 689705, 1.0.36219, , ame, , , PUP.Optional.MessengerTime, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\MessengerTime, Quarantined, 10317, 517430, , , , , , Registry Value: 1 PUP.Optional.MessengerTime, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|MessengerTime, Quarantined, 10317, 517430, , , , , , Registry Data: 0 (No malicious items detected) Data Stream: 0 (No malicious items detected) Folder: 10 PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Local\MessengerTime\databases\file__0, Quarantined, 10317, 503074, , , , , , PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Local\MessengerTime\Cache\index-dir, Quarantined, 10317, 503074, , , , , , PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Local\MessengerTime\Local Storage, Quarantined, 10317, 503074, , , , , , PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Local\MessengerTime\databases, Quarantined, 10317, 503074, , , , , , PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Local\MessengerTime\GPUCache, Quarantined, 10317, 503074, , , , , , PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Local\MessengerTime\Cache, Quarantined, 10317, 503074, , , , , , PUP.Optional.MessengerTime, C:\USERS\{username}\APPDATA\LOCAL\MESSENGERTIME, Quarantined, 10317, 503074, 1.0.36219, , ame, , , PUP.Optional.MessengerTime, C:\USERS\{username}\APPDATA\ROAMING\MICROSOFT\WINDOWS\START MENU\PROGRAMS\MESSENGERTIME, Quarantined, 10317, 517427, 1.0.36219, , ame, , , PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Roaming\MessengerTime\locales, Quarantined, 10317, 517430, , , , , , PUP.Optional.MessengerTime, C:\USERS\{username}\APPDATA\ROAMING\MessengerTime, Quarantined, 10317, 517430, 1.0.36219, , ame, , , File: 124 PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Local\MessengerTime\Cache\index-dir\the-real-index, Quarantined, 10317, 503074, , , , , 89E948D99723E20F172E827D29BEE986, E0A358BD45469F9B52255E8D14444DADFCC279AE9F7494F9F63C88DA53B6B46B PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Local\MessengerTime\Cache\039874a14273793a_0, Quarantined, 10317, 503074, , , , , 4495E450639E2CE156B165646A40F40F, 98199278AE71E61ADDF09691C12DA8A622C342037B349B3563A9118C2F5CB702 PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Local\MessengerTime\Cache\0894cf888c75339c_0, Quarantined, 10317, 503074, , , , , 9C6887DEAA373B50FEC8645A7D366579, B9858A80379F696A0BAA25D058CC6109F27C0686F03C650468D2815F2F7C6D9D PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Local\MessengerTime\Cache\08f7cd021f2fa376_0, Quarantined, 10317, 503074, , , , , EED7B46D51696EB4331C250C92F15697, D9967423BE7836D561610C2B961B4968D7E27D2ABD1427FB21FF9DD20EEC368E PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Local\MessengerTime\Cache\09e30cc22d3b4bb6_0, Quarantined, 10317, 503074, , , , , C8D5B746902510A7BBDCB60F4616AC67, 6C60B794CC3B9E9978874CFE0BAF6BDB8E7F0592054430975635F33E5C0E84BE PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Local\MessengerTime\Cache\16d6864419f65ec4_0, Quarantined, 10317, 503074, , , , , FBAC2F9B868A190CBDF1B20AF20109A6, 31AC26C8BD7948DA2A938AB8765F84982BD2BB085C9F7F0821B78F3F6FE1607B PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Local\MessengerTime\Cache\1f93ce6d5924e56d_0, Quarantined, 10317, 503074, , , , , 3228CCB21F531F2CB765F7BD82694E7A, 9D50A16D83F9733A7A5D6A3606ED3EE4F6AC92D26527828723BA31D9DD1FCD67 PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Local\MessengerTime\Cache\2d87860584b260ae_0, Quarantined, 10317, 503074, , , , , D10A632478F3AD96DE26B7609540B1DD, DEAE5CE27E1EA86E46CF32546C6723BA0710D7A1C8D9C23BCFB7294AB71B4BDF PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Local\MessengerTime\Cache\3595993468dd4e35_0, Quarantined, 10317, 503074, , , , , EAA2C38A93AF0BDB5246731BEFA943F6, D16FC9B81550814AFA00456D22FC4F873655F7CFE486147CB89AAF407B3563F0 PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Local\MessengerTime\Cache\3733944b93f9f7c0_0, Quarantined, 10317, 503074, , , , , B1F2E55370D702C086E02E7D8369F319, 2291551EA66C6DDC34EF5EFC244789ED083C953E63507E5AD993D1DE2A3F1FE3 PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Local\MessengerTime\Cache\399624c6c6be23fd_0, Quarantined, 10317, 503074, , , , , FFBA1B5443A17F89AB29523D0F49F08A, ED815528EB78D8C265651EE89834C684DDF46219C473E11566A564FF945B6325 PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Local\MessengerTime\Cache\45e8a7b3a9a39630_0, Quarantined, 10317, 503074, , , , , 6B9FDA714DFFEF0AE92F7CCFDC971A14, BAD8F6B305BD1B4BB69FCA2E3C1B2643940B578B198C50067C18CE83F127DBC0 PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Local\MessengerTime\Cache\46a6fa395fd9530d_0, Quarantined, 10317, 503074, , , , , E3418CDCBF2A0CB1FD828C288042ECE3, 94F037F5E5A3D8F83BF6A5DEC9A856FB5A6DFBEC05221B7425F4FE25599BE14A PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Local\MessengerTime\Cache\4b39efed3553ad24_0, Quarantined, 10317, 503074, , , , , FCF941C513AD1EDDAC252FA09F35863A, 3C31CE66527583F71F985F7A0BF45A991ECBFB0A9BB6F7D58C3B53229C1FE7DB PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Local\MessengerTime\Cache\4b446d87636a44df_0, Quarantined, 10317, 503074, , , , , E850C806F4B33657F7A9E355C709EF28, 5F476A4437B4422DA8CA7B887AD53700D3626A452751177960F1158D7FC343E1 PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Local\MessengerTime\Cache\4c62aaddebb7bd60_0, Quarantined, 10317, 503074, , , , , 1050B7E2E1A2D62F1B45E64FFE96B6A9, 45DC5084CF202045137D6900C396A1A2918ADE7758BE1900F30657A11B81BDF2 PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Local\MessengerTime\Cache\5e721eec36958a68_0, Quarantined, 10317, 503074, , , , , 012A040C3E54A932A7AA848DFD51E2B6, 32628C6456ECD2ADBAB2E0952E7FB40AF5892DA04D091D8005C05182D8889DF1 PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Local\MessengerTime\Cache\5ec195c554dc9470_0, Quarantined, 10317, 503074, , , , , 6D5A1513F4A42658034FD154708B5582, D9E04F78EB635C46E6BA39FF972899BF2AE9CF56A52EF3E225C9496B7E2AF786 PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Local\MessengerTime\Cache\6787f2ca849a4301_0, Quarantined, 10317, 503074, , , , , F559A722F3C0B5C2FBE9BD568C0B4042, 8A171106F5D76056E9C9408E6E703937FE198B0E0732C540B8B2EB52223D0EAC PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Local\MessengerTime\Cache\732ca7077eb4994a_0, Quarantined, 10317, 503074, , , , , 9E3D41C3A2E064C60016EABB038F0FB2, 4B5558EE7FE9C7F8B3D0A12C4970AD647698FA6386A795A1441164F7A5777A66 PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Local\MessengerTime\Cache\77b611fda0588b38_0, Quarantined, 10317, 503074, , , , , E635FE0099F8355541AFC1E464B748F6, BE7FC2D811EA75A009FB0C9FEADE9884B64B68A579B1C4B5CBBAD29560490D3B PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Local\MessengerTime\Cache\7ceb2257d97b1783_0, Quarantined, 10317, 503074, , , , , 69D73B62A0A1069C2657392E6CBA1D4F, 5FB5A9144BB0B053E2DD9ED1ADFD67AFC49CBF792C67FCDCB7A1696FC26C3ED2 PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Local\MessengerTime\Cache\7e3cdd1d75f89fbe_0, Quarantined, 10317, 503074, , , , , B7342EBD12F834B3D923224594E754DD, FCE07AA91760FE0834DC9F17F4B675EBAEF837972E2338C451FA226BC2997708 PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Local\MessengerTime\Cache\7f4acceea76ffb77_0, Quarantined, 10317, 503074, , , , , 00658089FA46E14C3A339DC0867AEB3C, 22B6CA5A60F1665091BCB482848BBF3C948E59536320CE0173509E90733EEB38 PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Local\MessengerTime\Cache\8231c745e6be6520_0, Quarantined, 10317, 503074, , , , , C8185971CEDFA4900D865BF3D5252799, 3C3676B55B57E7E4758202FE849576FF3DAAA9917CDB7D8A785072E98F7BF580 PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Local\MessengerTime\Cache\980622f0f7ccd10c_0, Quarantined, 10317, 503074, , , , , F77B6A690D46E0206BB113BFEA1A98B3, 962F6DF78A20DD354775163F3A8B60AFEAD8CBC50E0B4236C17A718CC225A6FF PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Local\MessengerTime\Cache\a5c2d8a3c6540688_0, Quarantined, 10317, 503074, , , , , 98AF9DCAEB9EEA4E54424ED2A797D11B, B9E510995A6CFF373CC285EA956EB3E91E7069570EF5B84529C246F9E9BDCDD4 PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Local\MessengerTime\Cache\a78b383aa7619113_0, Quarantined, 10317, 503074, , , , , 021ECCE3F84F0230740A2CF4471F5E73, 40462285AC6733C2BB2FB9B985F11389710A03DA6AB7BBC69D94E5C7CD207295 PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Local\MessengerTime\Cache\b17532471872b511_0, Quarantined, 10317, 503074, , , , , DC7AD1DA3517DEAFCFBEAD1A50E43143, 7981CEF2B2F94538FE1AB1D3B3035B9F24D2CD9C162761AA4BDA910111F276B8 PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Local\MessengerTime\Cache\b71174e78b483ccc_0, Quarantined, 10317, 503074, , , , , ADE4F294093E1B4695DCA913E7D3E7CC, A5A0B79EE8D399FC2BF22AEA01557B0001B25DE5F453D0140B483A403E862EA3 PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Local\MessengerTime\Cache\b9785c790a214c90_0, Quarantined, 10317, 503074, , , , , F04AE27446D5EDB0184371520741C96C, 86EE6E5A443DE06B8723776C2CF7E06DAEC8CCD4AF93B976FB13E921010874AF PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Local\MessengerTime\Cache\bfc08ab22020dee3_0, Quarantined, 10317, 503074, , , , , 6AA7169E27D3E31BD96999C4B847521F, 25DD483C6C9568AA56957BD7FE574703B0B8750738582692D491FA7E22683B40 PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Local\MessengerTime\Cache\c28e3d560773a357_0, Quarantined, 10317, 503074, , , , , 18B8724F8CA42E005DD5D6792A2574EC, 531B79DED3F14C4B03123E1060533294C90F80748369CA3D46D33B2748D8D41E PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Local\MessengerTime\Cache\c42efa32f29a4a68_0, Quarantined, 10317, 503074, , , , , 53287FD12482DBE173C6BD485A58FC6F, 61457DFE6E7893AD8CCC679839D64CD51742F133FE4F1E8A967A7B5545D9D399 PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Local\MessengerTime\Cache\cb8719eb370bb75e_0, Quarantined, 10317, 503074, , , , , DE6E60C23E224A49878186B42870B7F7, 20D78B68380DC933E932FDD02920D6CFD883B5E699A3FE5AE0C8330CFE522D49 PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Local\MessengerTime\Cache\cd44c54745053790_0, Quarantined, 10317, 503074, , , , , B4B0C3C8D1ACC6EB82B5F52A183EC393, 5B181CF1C2829F4A38545B613612B5593E6407F16E9E27227E3C7513D73C9BB4 PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Local\MessengerTime\Cache\ce0b4d7676e95d8d_0, Quarantined, 10317, 503074, , , , , B95EBDE2DFB30AC79919F0DED991A221, 295676E38D08609C78A5220C5F1BB381F895770F68FF7536B64E60484F814D68 PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Local\MessengerTime\Cache\d36542748e81181d_0, Quarantined, 10317, 503074, , , , , E4C1B4D3F0DC03A882BD2DE024A99BC5, 89F34F043B89DB3E4D49320AF8DED1E2CFD5F7896BFDA1F564706C982EADFA84 PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Local\MessengerTime\Cache\de54e649c987477c_0, Quarantined, 10317, 503074, , , , , 733C1D332CB8F5CF2FBA921E30EB94F8, 2B621CBCBB23AFAA7F5C19A3B31F81A7142FF131AE0DB20C5193B052160FE9B5 PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Local\MessengerTime\Cache\e1c9faf3f02a7194_0, Quarantined, 10317, 503074, , , , , FD8356556AF5DA1940E86BC120B315F0, E1564BCDA008BBAF1C471A8D7BC7AE6CBB91C940847AE2E41B9A0A2BEF775281 PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Local\MessengerTime\Cache\ea4065a01653d874_0, Quarantined, 10317, 503074, , , , , 438117D4698E1F8D662C7285D17B93A2, 4F624DA95622859587E1110667AD242C75EED12CE49B1840F7D7CDFF4C19E92C PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Local\MessengerTime\Cache\f4ca130513df98b4_0, Quarantined, 10317, 503074, , , , , 686A29886B316305E426762BB114E468, 708A0C35B58D4F268B246D5F98B01213B9E63922CC7A17040C2888A22E2D50C8 PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Local\MessengerTime\Cache\fcf223eddd011794_0, Quarantined, 10317, 503074, , , , , 1B3F9CBAFA60A3AE3F874C3A10110FE9, 74CEF61A70BD1037AB543960D2B768CDC4C4A925924A3E77BB62C139B5EDA5F6 PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Local\MessengerTime\Cache\index, Quarantined, 10317, 503074, , , , , B9F02D71D006E6DE969A4BC8DEBB18DD, C41B9E00A3DB99D731DB822FBB4C70702383B53882A27A7DD05EF0CA892F30AF PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Local\MessengerTime\databases\file__0\1, Quarantined, 10317, 503074, , , , , 22E4DB30925B4E0F197FA51193D1D944, 587B8EAE97D592D8D661CFC2C4DB38A420B937F6524FC7914B3D35F868B83048 PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Local\MessengerTime\databases\Databases.db, Quarantined, 10317, 503074, , , , , 3559B13E5D513360054FCA42DFCE06AC, 8150EB7888FAAEA36DB3EFF68F4A1A8F6C362DBB7DC7AD11E7C5A969E902D68E PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Local\MessengerTime\databases\Databases.db-journal, Quarantined, 10317, 503074, , , , , 7325492084185D684661262234007F63, C557014352A529AB33BA1862976C9F5C7F575D29EB449FA8DB94684D456F14E8 PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Local\MessengerTime\GPUCache\data_0, Quarantined, 10317, 503074, , , , , CF89D16BB9107C631DAABF0C0EE58EFB, D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Local\MessengerTime\GPUCache\data_1, Quarantined, 10317, 503074, , , , , F50F89A0A91564D0B8A211F8921AA7DE, B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Local\MessengerTime\GPUCache\data_2, Quarantined, 10317, 503074, , , , , 0962291D6D367570BEE5454721C17E11, EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7 PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Local\MessengerTime\GPUCache\data_3, Quarantined, 10317, 503074, , , , , 41876349CB12D6DB992F1309F22DF3F0, E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Local\MessengerTime\GPUCache\index, Quarantined, 10317, 503074, , , , , D496F503FFC4B429484AC594D7145B0C, DF35B40321C4EE7EA84ECF47AE0FF139793C37A7474C0E5DDAFB68B78FB221E1 PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Local\MessengerTime\Local Storage\file__0.localstorage, Quarantined, 10317, 503074, , , , , 44645D4A152F5C2C1A7072B9ED188F9F, 8C64B724490A9E6A5415EEEFFAC4FB113AEAFF43792FFC0434B8EB46C780F265 PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Local\MessengerTime\Local Storage\file__0.localstorage-journal, Quarantined, 10317, 503074, , , , , FD99A236C6A0A1315833720649378B46, 5F716BD7CA8A442F1115837AE1ED70E9FE4A336902D1B6C53BEF614C30C4868A PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Local\MessengerTime\Local Storage\https_www.messenger.com_0.localstorage, Quarantined, 10317, 503074, , , , , 4B0E4B980CC80FB8BFA84F8A978A5EC8, D623F5E02A9D93A035BC7E55F5A61CD893BC3263F2459D5D1A703D5313C00F53 PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Local\MessengerTime\Local Storage\https_www.messenger.com_0.localstorage-journal, Quarantined, 10317, 503074, , , , , 61F0B0A17C61967CE69E66AAAFC5884B, 35C41AB7DD85FF31AEB457C279575EFCC30614B02A06CDC3EE3CC6B5C1A53DE9 PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Local\MessengerTime\cookies, Quarantined, 10317, 503074, , , , , 98408867C429F3A0506812F8F0F75A62, A840B1F20C7CD27ACC00401D2553B02947EFE79C5529852D0AF6EA8B8B0AA47F PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Local\MessengerTime\cookies-journal, Quarantined, 10317, 503074, , , , , A8C0A625D4583CB10267EC416F2CCFFC, 2A1FD2FAAA106A44DB477CFD2B38FB667FBB4FA6723420A492DE57DA708B7904 PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Local\MessengerTime\QuotaManager, Quarantined, 10317, 503074, , , , , EB37EB4299EEED478B3B35E7FAFEA678, 82AF1BE8A85054BCBBBEFDEA565A6EC42DAD147ACA44D3D20E54F19ECE962980 PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Local\MessengerTime\QuotaManager-journal, Quarantined, 10317, 503074, , , , , 36CCDF55A578AD52FF780C0ABFB11778, 625C483D05D106831068A5BC3DA8A33D3494BEB9440D4029F35FE6939DD21B20 PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Local\MessengerTime\Web Data, Quarantined, 10317, 503074, , , , , 2B455F9577D1E7C09F6D417B3005CF94, D8F9AC1C53666153A5387B342FB6ABE5B294A8DC92EA07CAB69ADA9ABBE2B9E7 PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Local\MessengerTime\Web Data-journal, Quarantined, 10317, 503074, , , , , BF619EAC0CDF3F68D496EA9344137E8B, 076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560 PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MessengerTime\MessengerTime.lnk, Quarantined, 10317, 517427, , , , , 8B00DC4077E7859919945624D35D574C, 36851B8EF90FF72797C741275DF97AAE87EE6445B0BE62B60D357AA933473995 PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MessengerTime\Uninstall.lnk, Quarantined, 10317, 517427, , , , , D5481157FDA7F015AC062AB1D9E6BB15, 22F5D185A8C3852A6EDF9F468D9F1B90AB602BFDFEBF51BC7A9D3E4503396A19 PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Roaming\MessengerTime\locales\am.pak, Quarantined, 10317, 517430, , , , , 7C321056F805AABD5A503821FA1994CD, 261E6AAD3AD0A5F608B5694919EE39026C4C3EB4256540068F7C1AA46BE9315A PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Roaming\MessengerTime\locales\ar.pak, Quarantined, 10317, 517430, , , , , 7C321056F805AABD5A503821FA1994CD, 261E6AAD3AD0A5F608B5694919EE39026C4C3EB4256540068F7C1AA46BE9315A PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Roaming\MessengerTime\locales\bg.pak, Quarantined, 10317, 517430, , , , , 7C321056F805AABD5A503821FA1994CD, 261E6AAD3AD0A5F608B5694919EE39026C4C3EB4256540068F7C1AA46BE9315A PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Roaming\MessengerTime\locales\bn.pak, Quarantined, 10317, 517430, , , , , 7C321056F805AABD5A503821FA1994CD, 261E6AAD3AD0A5F608B5694919EE39026C4C3EB4256540068F7C1AA46BE9315A PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Roaming\MessengerTime\locales\ca.pak, Quarantined, 10317, 517430, , , , , 7C321056F805AABD5A503821FA1994CD, 261E6AAD3AD0A5F608B5694919EE39026C4C3EB4256540068F7C1AA46BE9315A PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Roaming\MessengerTime\locales\cs.pak, Quarantined, 10317, 517430, , , , , 7C321056F805AABD5A503821FA1994CD, 261E6AAD3AD0A5F608B5694919EE39026C4C3EB4256540068F7C1AA46BE9315A PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Roaming\MessengerTime\locales\da.pak, Quarantined, 10317, 517430, , , , , 7C321056F805AABD5A503821FA1994CD, 261E6AAD3AD0A5F608B5694919EE39026C4C3EB4256540068F7C1AA46BE9315A PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Roaming\MessengerTime\locales\de.pak, Quarantined, 10317, 517430, , , , , 7C321056F805AABD5A503821FA1994CD, 261E6AAD3AD0A5F608B5694919EE39026C4C3EB4256540068F7C1AA46BE9315A PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Roaming\MessengerTime\locales\el.pak, Quarantined, 10317, 517430, , , , , 7C321056F805AABD5A503821FA1994CD, 261E6AAD3AD0A5F608B5694919EE39026C4C3EB4256540068F7C1AA46BE9315A PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Roaming\MessengerTime\locales\en-GB.pak, Quarantined, 10317, 517430, , , , , 7C321056F805AABD5A503821FA1994CD, 261E6AAD3AD0A5F608B5694919EE39026C4C3EB4256540068F7C1AA46BE9315A PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Roaming\MessengerTime\locales\en-US.pak, Quarantined, 10317, 517430, , , , , 7C321056F805AABD5A503821FA1994CD, 261E6AAD3AD0A5F608B5694919EE39026C4C3EB4256540068F7C1AA46BE9315A PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Roaming\MessengerTime\locales\es-419.pak, Quarantined, 10317, 517430, , , , , 7C321056F805AABD5A503821FA1994CD, 261E6AAD3AD0A5F608B5694919EE39026C4C3EB4256540068F7C1AA46BE9315A PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Roaming\MessengerTime\locales\es.pak, Quarantined, 10317, 517430, , , , , 7C321056F805AABD5A503821FA1994CD, 261E6AAD3AD0A5F608B5694919EE39026C4C3EB4256540068F7C1AA46BE9315A PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Roaming\MessengerTime\locales\et.pak, Quarantined, 10317, 517430, , , , , 7C321056F805AABD5A503821FA1994CD, 261E6AAD3AD0A5F608B5694919EE39026C4C3EB4256540068F7C1AA46BE9315A PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Roaming\MessengerTime\locales\fa.pak, Quarantined, 10317, 517430, , , , , 7C321056F805AABD5A503821FA1994CD, 261E6AAD3AD0A5F608B5694919EE39026C4C3EB4256540068F7C1AA46BE9315A PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Roaming\MessengerTime\locales\fi.pak, Quarantined, 10317, 517430, , , , , 7C321056F805AABD5A503821FA1994CD, 261E6AAD3AD0A5F608B5694919EE39026C4C3EB4256540068F7C1AA46BE9315A PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Roaming\MessengerTime\locales\fil.pak, Quarantined, 10317, 517430, , , , , 7C321056F805AABD5A503821FA1994CD, 261E6AAD3AD0A5F608B5694919EE39026C4C3EB4256540068F7C1AA46BE9315A PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Roaming\MessengerTime\locales\fr.pak, Quarantined, 10317, 517430, , , , , 7C321056F805AABD5A503821FA1994CD, 261E6AAD3AD0A5F608B5694919EE39026C4C3EB4256540068F7C1AA46BE9315A PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Roaming\MessengerTime\locales\gu.pak, Quarantined, 10317, 517430, , , , , 7C321056F805AABD5A503821FA1994CD, 261E6AAD3AD0A5F608B5694919EE39026C4C3EB4256540068F7C1AA46BE9315A PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Roaming\MessengerTime\locales\hi.pak, Quarantined, 10317, 517430, , , , , 7C321056F805AABD5A503821FA1994CD, 261E6AAD3AD0A5F608B5694919EE39026C4C3EB4256540068F7C1AA46BE9315A PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Roaming\MessengerTime\locales\hr.pak, Quarantined, 10317, 517430, , , , , 7C321056F805AABD5A503821FA1994CD, 261E6AAD3AD0A5F608B5694919EE39026C4C3EB4256540068F7C1AA46BE9315A PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Roaming\MessengerTime\locales\hu.pak, Quarantined, 10317, 517430, , , , , 7C321056F805AABD5A503821FA1994CD, 261E6AAD3AD0A5F608B5694919EE39026C4C3EB4256540068F7C1AA46BE9315A PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Roaming\MessengerTime\locales\id.pak, Quarantined, 10317, 517430, , , , , 7C321056F805AABD5A503821FA1994CD, 261E6AAD3AD0A5F608B5694919EE39026C4C3EB4256540068F7C1AA46BE9315A PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Roaming\MessengerTime\locales\it.pak, Quarantined, 10317, 517430, , , , , 7C321056F805AABD5A503821FA1994CD, 261E6AAD3AD0A5F608B5694919EE39026C4C3EB4256540068F7C1AA46BE9315A PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Roaming\MessengerTime\locales\iw.pak, Quarantined, 10317, 517430, , , , , 7C321056F805AABD5A503821FA1994CD, 261E6AAD3AD0A5F608B5694919EE39026C4C3EB4256540068F7C1AA46BE9315A PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Roaming\MessengerTime\locales\ja.pak, Quarantined, 10317, 517430, , , , , 7C321056F805AABD5A503821FA1994CD, 261E6AAD3AD0A5F608B5694919EE39026C4C3EB4256540068F7C1AA46BE9315A PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Roaming\MessengerTime\locales\kn.pak, Quarantined, 10317, 517430, , , , , 7C321056F805AABD5A503821FA1994CD, 261E6AAD3AD0A5F608B5694919EE39026C4C3EB4256540068F7C1AA46BE9315A PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Roaming\MessengerTime\locales\ko.pak, Quarantined, 10317, 517430, , , , , 7C321056F805AABD5A503821FA1994CD, 261E6AAD3AD0A5F608B5694919EE39026C4C3EB4256540068F7C1AA46BE9315A PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Roaming\MessengerTime\locales\lt.pak, Quarantined, 10317, 517430, , , , , 7C321056F805AABD5A503821FA1994CD, 261E6AAD3AD0A5F608B5694919EE39026C4C3EB4256540068F7C1AA46BE9315A PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Roaming\MessengerTime\locales\lv.pak, Quarantined, 10317, 517430, , , , , 7C321056F805AABD5A503821FA1994CD, 261E6AAD3AD0A5F608B5694919EE39026C4C3EB4256540068F7C1AA46BE9315A PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Roaming\MessengerTime\locales\ml.pak, Quarantined, 10317, 517430, , , , , 7C321056F805AABD5A503821FA1994CD, 261E6AAD3AD0A5F608B5694919EE39026C4C3EB4256540068F7C1AA46BE9315A PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Roaming\MessengerTime\locales\mr.pak, Quarantined, 10317, 517430, , , , , 7C321056F805AABD5A503821FA1994CD, 261E6AAD3AD0A5F608B5694919EE39026C4C3EB4256540068F7C1AA46BE9315A PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Roaming\MessengerTime\locales\ms.pak, Quarantined, 10317, 517430, , , , , 7C321056F805AABD5A503821FA1994CD, 261E6AAD3AD0A5F608B5694919EE39026C4C3EB4256540068F7C1AA46BE9315A PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Roaming\MessengerTime\locales\nl.pak, Quarantined, 10317, 517430, , , , , 7C321056F805AABD5A503821FA1994CD, 261E6AAD3AD0A5F608B5694919EE39026C4C3EB4256540068F7C1AA46BE9315A PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Roaming\MessengerTime\locales\no.pak, Quarantined, 10317, 517430, , , , , 7C321056F805AABD5A503821FA1994CD, 261E6AAD3AD0A5F608B5694919EE39026C4C3EB4256540068F7C1AA46BE9315A PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Roaming\MessengerTime\locales\pl.pak, Quarantined, 10317, 517430, , , , , 7C321056F805AABD5A503821FA1994CD, 261E6AAD3AD0A5F608B5694919EE39026C4C3EB4256540068F7C1AA46BE9315A PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Roaming\MessengerTime\locales\pt-BR.pak, Quarantined, 10317, 517430, , , , , 7C321056F805AABD5A503821FA1994CD, 261E6AAD3AD0A5F608B5694919EE39026C4C3EB4256540068F7C1AA46BE9315A PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Roaming\MessengerTime\locales\pt-PT.pak, Quarantined, 10317, 517430, , , , , 7C321056F805AABD5A503821FA1994CD, 261E6AAD3AD0A5F608B5694919EE39026C4C3EB4256540068F7C1AA46BE9315A PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Roaming\MessengerTime\locales\ro.pak, Quarantined, 10317, 517430, , , , , 7C321056F805AABD5A503821FA1994CD, 261E6AAD3AD0A5F608B5694919EE39026C4C3EB4256540068F7C1AA46BE9315A PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Roaming\MessengerTime\locales\ru.pak, Quarantined, 10317, 517430, , , , , 7C321056F805AABD5A503821FA1994CD, 261E6AAD3AD0A5F608B5694919EE39026C4C3EB4256540068F7C1AA46BE9315A PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Roaming\MessengerTime\locales\sk.pak, Quarantined, 10317, 517430, , , , , 7C321056F805AABD5A503821FA1994CD, 261E6AAD3AD0A5F608B5694919EE39026C4C3EB4256540068F7C1AA46BE9315A PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Roaming\MessengerTime\locales\sl.pak, Quarantined, 10317, 517430, , , , , 7C321056F805AABD5A503821FA1994CD, 261E6AAD3AD0A5F608B5694919EE39026C4C3EB4256540068F7C1AA46BE9315A PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Roaming\MessengerTime\locales\sr.pak, Quarantined, 10317, 517430, , , , , 7C321056F805AABD5A503821FA1994CD, 261E6AAD3AD0A5F608B5694919EE39026C4C3EB4256540068F7C1AA46BE9315A PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Roaming\MessengerTime\locales\sv.pak, Quarantined, 10317, 517430, , , , , 7C321056F805AABD5A503821FA1994CD, 261E6AAD3AD0A5F608B5694919EE39026C4C3EB4256540068F7C1AA46BE9315A PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Roaming\MessengerTime\locales\sw.pak, Quarantined, 10317, 517430, , , , , 7C321056F805AABD5A503821FA1994CD, 261E6AAD3AD0A5F608B5694919EE39026C4C3EB4256540068F7C1AA46BE9315A PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Roaming\MessengerTime\locales\ta.pak, Quarantined, 10317, 517430, , , , , 7C321056F805AABD5A503821FA1994CD, 261E6AAD3AD0A5F608B5694919EE39026C4C3EB4256540068F7C1AA46BE9315A PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Roaming\MessengerTime\locales\te.pak, Quarantined, 10317, 517430, , , , , 7C321056F805AABD5A503821FA1994CD, 261E6AAD3AD0A5F608B5694919EE39026C4C3EB4256540068F7C1AA46BE9315A PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Roaming\MessengerTime\locales\th.pak, Quarantined, 10317, 517430, , , , , 7C321056F805AABD5A503821FA1994CD, 261E6AAD3AD0A5F608B5694919EE39026C4C3EB4256540068F7C1AA46BE9315A PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Roaming\MessengerTime\locales\tr.pak, Quarantined, 10317, 517430, , , , , 7C321056F805AABD5A503821FA1994CD, 261E6AAD3AD0A5F608B5694919EE39026C4C3EB4256540068F7C1AA46BE9315A PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Roaming\MessengerTime\locales\uk.pak, Quarantined, 10317, 517430, , , , , 7C321056F805AABD5A503821FA1994CD, 261E6AAD3AD0A5F608B5694919EE39026C4C3EB4256540068F7C1AA46BE9315A PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Roaming\MessengerTime\locales\vi.pak, Quarantined, 10317, 517430, , , , , 7C321056F805AABD5A503821FA1994CD, 261E6AAD3AD0A5F608B5694919EE39026C4C3EB4256540068F7C1AA46BE9315A PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Roaming\MessengerTime\locales\zh-CN.pak, Quarantined, 10317, 517430, , , , , 7C321056F805AABD5A503821FA1994CD, 261E6AAD3AD0A5F608B5694919EE39026C4C3EB4256540068F7C1AA46BE9315A PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Roaming\MessengerTime\locales\zh-TW.pak, Quarantined, 10317, 517430, , , , , 7C321056F805AABD5A503821FA1994CD, 261E6AAD3AD0A5F608B5694919EE39026C4C3EB4256540068F7C1AA46BE9315A PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Roaming\MessengerTime\ffmpegsumo.dll, Quarantined, 10317, 517430, , , , , 130C5CA9BCC4A4A70061C27531AE4443, A38AE639667371E4548EE60ED706CA72470AB19553565E7E5D0EBB7AE035D90E PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Roaming\MessengerTime\icudtl.dat, Quarantined, 10317, 517430, , , , , AC8B45F4478EFB25E978FCCA2507EA01, 70710CEBB20F601C7B8AB0C082232309A90BAF645CB3B9E90B6D7DA84C891ABE PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Roaming\MessengerTime\MessengerTime.exe, Quarantined, 10317, 517430, , , , , , PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Roaming\MessengerTime\nw.pak, Quarantined, 10317, 517430, , , , , D209F52FE369C7DED7219DB7E8A166E1, 59B32BF4E976AAE544D591B79C88487E35C19471BFE32AA41E7DD0C4809B737B PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Roaming\MessengerTime\storage.json, Quarantined, 10317, 517430, , , , , ED64E35DD9BA46FA18EDD82249129D3C, 6141A42608954ED002C910F0A46EBAC8CC2A16A6015E6383BEFE6F445B45B52A PUP.Optional.MessengerTime, C:\Users\{username}\AppData\Roaming\MessengerTime\Uninstall.exe, Quarantined, 10317, 517430, , , , , BA40E6684ED8AC805D24D61DAA70A8CB, 2F7EB3CF5ECC46F2CC5D45C735DF2E1B42B23B3F9EDE3484C6BCF219388205FF PUP.Optional.MessengerTime, C:\USERS\{username}\DOWNLOADS\MESSENGERTIME.14.1906.1.EXE, Quarantined, 10317, 503068, 1.0.36219, , ame, , B990B9962AEF4C66D3AFE9D5A155F245, 4D34D7017DFEC261DE9A558F6636B94ED4C2A9A808C8FFFE0B7E5F9F9EA85A4F Physical Sector: 0 (No malicious items detected) WMI: 0 (No malicious items detected) (end) As mentioned before the full version of Malwarebytes could have protected your computer against this threat. We use different ways of protecting your computer(s): Dynamically Blocks Malware Sites & Servers Malware Execution Prevention Save yourself the hassle and get protected.
  3. What is WikiNow? The Malwarebytes research team has determined that WikiNow is a potentially unwanted program that behaves like adware. These adware applications display advertisements not originating from the sites you are browsing. How do I know if my computer is affected by WikiNow? This is the main screen of the program: You may see these warnings during install: and this entry in your list of installed Programs and Features: How did WikiNow get on my computer? Adware applications use different methods for distributing themselves. This particular one was downloaded from their website: How do I remove WikiNow? Our program Malwarebytes can detect and remove this adware program. Please download Malwarebytes for Windows to your desktop. Double-click MBSetup.exe and follow the prompts to install the program. When your Malwarebytes for Windows installation completes, the program opens to the Welcome to Malwarebytes screen. Click on the Get started button. Click Scan to start a Threat Scan. When the scan is finished click Quarantine to remove the found threats. Reboot the system if prompted to complete the removal process. Is there anything else I need to do to get rid of WikiNow? No, Malwarebytes removes WikiNow completely. How would the full version of Malwarebytes help protect me? We hope our application and this guide have helped you eradicate this adware. As you can see below the full version of Malwarebytes would have protected you against the WikiNow adware. It would have blocked the installer before it became too late. and it would have blocked access to their domain: Technical details for experts Possible signs in FRST logs: (WikiNow -> WikiNow) [File not signed] C:\Users\{username}\AppData\Roaming\WikiNow\WikiNow.exe <3> HKLM-x32\...\Run: [WikiNow] => C:\Users\{username}\AppData\Roaming\WikiNow\WikiNow.exe [4576296 2020-11-05] (WikiNow -> WikiNow) [File not signed] C:\Users\{username}\AppData\Local\WikiNow C:\Users\{username}\AppData\Roaming\WikiNow C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WikiNow WikiNow - WikiNow for Desktop (HKLM-x32\...\WikiNow) (Version: 16.2011.1acwk - WikiNow) (WikiNow -> ) [File not signed] C:\Users\{username}\AppData\Roaming\WikiNow\ffmpeg.dll (WikiNow -> ) [File not signed] C:\Users\{username}\AppData\Roaming\WikiNow\node.dll (WikiNow -> The NWJS Community) [File not signed] C:\Users\{username}\AppData\Roaming\WikiNow\nw.dll (WikiNow -> The NWJS Community) [File not signed] C:\Users\{username}\AppData\Roaming\WikiNow\nw_elf.dll Significant changes made by the installer: File system details [View: All details] (Selection) --------------------------------------------------- In the existing folder C:\Downloads Adds the file WikiNow.16.2011.1acwk.exe"="12/20/2020 1:56 PM, 48377192 bytes, A Adds the folder C:\Users\{username}\AppData\Local\WikiNow\User Data Adds the file First Run"="12/20/2020 1:58 PM, 0 bytes, A Adds the file Local State"="12/20/2020 1:58 PM, 1537 bytes, A Adds the file lockfile"="12/20/2020 1:58 PM, 0 bytes, A Adds the folder C:\Users\{username}\AppData\Local\WikiNow\User Data\Default Adds the file Cookies"="12/20/2020 2:01 PM, 17408 bytes, A Adds the file Cookies-journal"="12/20/2020 2:01 PM, 0 bytes, A Adds the file Favicons"="12/20/2020 1:58 PM, 20480 bytes, A Adds the file Favicons-journal"="12/20/2020 1:58 PM, 0 bytes, A Adds the file History"="12/20/2020 1:58 PM, 94208 bytes, A Adds the file History-journal"="12/20/2020 1:58 PM, 0 bytes, A Adds the file Login Data"="12/20/2020 1:58 PM, 18432 bytes, A Adds the file Login Data-journal"="12/20/2020 1:58 PM, 0 bytes, A Adds the file Network Persistent State"="12/20/2020 1:58 PM, 40 bytes, A Adds the file Origin Bound Certs"="12/20/2020 1:58 PM, 5120 bytes, A Adds the file Origin Bound Certs-journal"="12/20/2020 1:58 PM, 0 bytes, A Adds the file Preferences"="12/20/2020 2:02 PM, 1702 bytes, A Adds the file QuotaManager"="12/20/2020 1:59 PM, 15360 bytes, A Adds the file QuotaManager-journal"="12/20/2020 1:59 PM, 0 bytes, A Adds the file README"="12/20/2020 1:58 PM, 162 bytes, A Adds the file Secure Preferences"="12/20/2020 1:58 PM, 4490 bytes, A Adds the file Top Sites"="12/20/2020 1:58 PM, 20480 bytes, A Adds the file Top Sites-journal"="12/20/2020 1:58 PM, 0 bytes, A Adds the file TransportSecurity"="12/20/2020 2:03 PM, 1905 bytes, A Adds the file Visited Links"="12/20/2020 1:58 PM, 0 bytes, A Adds the file Web Data"="12/20/2020 1:58 PM, 59392 bytes, A Adds the file Web Data-journal"="12/20/2020 1:58 PM, 0 bytes, A Adds the file WebRTCIdentityStore"="12/20/2020 2:01 PM, 4096 bytes, A Adds the file WebRTCIdentityStore-journal"="12/20/2020 2:01 PM, 0 bytes, A Adds the folder C:\Users\{username}\AppData\Local\WikiNow\User Data\Default\Cache Adds the file data_0"="12/20/2020 1:58 PM, 45056 bytes, A Adds the file data_1"="12/20/2020 1:58 PM, 270336 bytes, A Adds the file data_2"="12/20/2020 1:58 PM, 1056768 bytes, A Adds the file data_3"="12/20/2020 1:58 PM, 4202496 bytes, A Adds the file f_000001"="12/20/2020 1:58 PM, 59428 bytes, A Adds the file f_000016"="12/20/2020 2:01 PM, 18916 bytes, A Adds the file index"="12/20/2020 1:58 PM, 262512 bytes, A Adds the folder C:\Users\{username}\AppData\Local\WikiNow\User Data\Default\data_reduction_proxy_leveldb Adds the file 000003.log"="12/20/2020 1:58 PM, 0 bytes, A Adds the file CURRENT"="12/20/2020 1:58 PM, 16 bytes, A Adds the file LOCK"="12/20/2020 1:58 PM, 0 bytes, A Adds the file LOG"="12/20/2020 1:58 PM, 0 bytes, A Adds the file MANIFEST-000001"="12/20/2020 1:58 PM, 41 bytes, A Adds the folder C:\Users\{username}\AppData\Local\WikiNow\User Data\Default\databases Adds the file Databases.db"="12/20/2020 1:58 PM, 7168 bytes, A Adds the file Databases.db-journal"="12/20/2020 1:58 PM, 0 bytes, A Adds the folder C:\Users\{username}\AppData\Local\WikiNow\User Data\Default\databases\chrome-extension_pmbjdlnofemiebodamiigbdkhlhknjpp_0 Adds the file 1"="12/20/2020 1:58 PM, 16384 bytes, A Adds the folder C:\Users\{username}\AppData\Local\WikiNow\User Data\Default\Extension Rules Adds the file 000003.log"="12/20/2020 1:58 PM, 0 bytes, A Adds the file CURRENT"="12/20/2020 1:58 PM, 16 bytes, A Adds the file LOCK"="12/20/2020 1:58 PM, 0 bytes, A Adds the file LOG"="12/20/2020 1:58 PM, 0 bytes, A Adds the file MANIFEST-000001"="12/20/2020 1:58 PM, 41 bytes, A Adds the folder C:\Users\{username}\AppData\Local\WikiNow\User Data\Default\Extension State Adds the file 000003.log"="12/20/2020 1:58 PM, 0 bytes, A Adds the file CURRENT"="12/20/2020 1:58 PM, 16 bytes, A Adds the file LOCK"="12/20/2020 1:58 PM, 0 bytes, A Adds the file LOG"="12/20/2020 1:58 PM, 0 bytes, A Adds the file MANIFEST-000001"="12/20/2020 1:58 PM, 41 bytes, A Adds the folder C:\Users\{username}\AppData\Local\WikiNow\User Data\Default\File System\000\t Adds the file .usage"="12/20/2020 1:58 PM, 24 bytes, A Adds the folder C:\Users\{username}\AppData\Local\WikiNow\User Data\Default\File System\000\t\Paths Adds the file 000003.log"="12/20/2020 1:58 PM, 0 bytes, A Adds the file CURRENT"="12/20/2020 1:58 PM, 16 bytes, A Adds the file LOCK"="12/20/2020 1:58 PM, 0 bytes, A Adds the file LOG"="12/20/2020 1:58 PM, 0 bytes, A Adds the file MANIFEST-000001"="12/20/2020 1:58 PM, 41 bytes, A Adds the folder C:\Users\{username}\AppData\Local\WikiNow\User Data\Default\File System\001\t Adds the folder C:\Users\{username}\AppData\Local\WikiNow\User Data\Default\File System\Origins Adds the file 000003.log"="12/20/2020 1:58 PM, 0 bytes, A Adds the file CURRENT"="12/20/2020 1:58 PM, 16 bytes, A Adds the file LOCK"="12/20/2020 1:58 PM, 0 bytes, A Adds the file LOG"="12/20/2020 1:58 PM, 0 bytes, A Adds the file MANIFEST-000001"="12/20/2020 1:58 PM, 41 bytes, A Adds the folder C:\Users\{username}\AppData\Local\WikiNow\User Data\Default\GPUCache Adds the file data_0"="12/20/2020 1:58 PM, 8192 bytes, A Adds the file data_1"="12/20/2020 1:58 PM, 270336 bytes, A Adds the file data_2"="12/20/2020 1:58 PM, 8192 bytes, A Adds the file data_3"="12/20/2020 1:58 PM, 8192 bytes, A Adds the file index"="12/20/2020 1:58 PM, 262512 bytes, A Adds the folder C:\Users\{username}\AppData\Local\WikiNow\User Data\Default\Local Storage Adds the file chrome-extension_pmbjdlnofemiebodamiigbdkhlhknjpp_0.localstorage"="12/20/2020 2:01 PM, 646144 bytes, A Adds the file chrome-extension_pmbjdlnofemiebodamiigbdkhlhknjpp_0.localstorage-journal"="12/20/2020 2:01 PM, 0 bytes, A Adds the file https_en.wiki2.org_0.localstorage"="12/20/2020 2:01 PM, 1855488 bytes, A Adds the file https_en.wiki2.org_0.localstorage-journal"="12/20/2020 2:01 PM, 0 bytes, A Adds the file https_wiki2.org_0.localstorage"="12/20/2020 2:01 PM, 5120 bytes, A Adds the file https_wiki2.org_0.localstorage-journal"="12/20/2020 2:01 PM, 0 bytes, A Adds the folder C:\Users\{username}\AppData\Local\WikiNow\User Data\Default\Session Storage Adds the file 000003.log"="12/20/2020 1:58 PM, 0 bytes, A Adds the file CURRENT"="12/20/2020 1:58 PM, 16 bytes, A Adds the file LOCK"="12/20/2020 1:58 PM, 0 bytes, A Adds the file LOG"="12/20/2020 1:58 PM, 0 bytes, A Adds the file MANIFEST-000001"="12/20/2020 1:58 PM, 41 bytes, A Adds the folder C:\Users\{username}\AppData\Local\WikiNow\User Data\Default\Thumbnails Adds the file 000003.log"="12/20/2020 1:58 PM, 0 bytes, A Adds the file CURRENT"="12/20/2020 1:58 PM, 16 bytes, A Adds the file LOCK"="12/20/2020 1:58 PM, 0 bytes, A Adds the file LOG"="12/20/2020 1:58 PM, 0 bytes, A Adds the file MANIFEST-000001"="12/20/2020 1:58 PM, 41 bytes, A Adds the folder C:\Users\{username}\AppData\Local\WikiNow\User Data\Default\Web Applications\_crx_pmbjdlnofemiebodamiigbdkhlhknjpp Adds the file WikiNow.ico"="12/20/2020 1:58 PM, 189361 bytes, A Adds the file WikiNow.ico.md5"="12/20/2020 1:58 PM, 16 bytes, A Adds the folder C:\Users\{username}\AppData\Local\WikiNow\User Data\ShaderCache\GPUCache Adds the file data_0"="12/20/2020 1:58 PM, 8192 bytes, A Adds the file data_1"="12/20/2020 1:58 PM, 270336 bytes, A Adds the file data_2"="12/20/2020 1:58 PM, 8192 bytes, A Adds the file data_3"="12/20/2020 1:58 PM, 8192 bytes, A Adds the file index"="12/20/2020 1:58 PM, 262512 bytes, A Adds the folder C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WikiNow Adds the file Uninstall.lnk"="12/20/2020 1:57 PM, 1837 bytes, A Adds the file WikiNow.lnk"="12/20/2020 1:57 PM, 1821 bytes, A Adds the folder C:\Users\{username}\AppData\Roaming\WikiNow Adds the file d3dcompiler_47.dll"="11/5/2020 10:08 AM, 3670864 bytes, A Adds the file ffmpeg.dll"="11/5/2020 10:08 AM, 1943888 bytes, A Adds the file icudtl.dat"="9/5/2019 3:32 PM, 10127152 bytes, A Adds the file libEGL.dll"="11/5/2020 10:08 AM, 83792 bytes, A Adds the file libGLESv2.dll"="11/5/2020 10:08 AM, 1743696 bytes, A Adds the file natives_blob.bin"="9/5/2019 3:32 PM, 415756 bytes, A Adds the file node.dll"="11/5/2020 10:08 AM, 3384144 bytes, A Adds the file nw.dll"="11/5/2020 10:08 AM, 60787024 bytes, A Adds the file nw_100_percent.pak"="9/5/2019 3:32 PM, 614590 bytes, A Adds the file nw_200_percent.pak"="9/5/2019 3:32 PM, 933426 bytes, A Adds the file nw_elf.dll"="11/5/2020 10:08 AM, 126800 bytes, A Adds the file resources.pak"="9/5/2019 3:32 PM, 7807631 bytes, A Adds the file snapshot_blob.bin"="9/5/2019 3:32 PM, 518036 bytes, A Adds the file storage.json"="12/20/2020 1:57 PM, 80 bytes, A Adds the file Uninstall.exe"="12/20/2020 1:57 PM, 431621 bytes, A Adds the file WikiNow.exe"="11/5/2020 10:08 AM, 4576296 bytes, A Adds the folder C:\Users\{username}\AppData\Roaming\WikiNow\locales In the existing folder C:\Users\{username}\Desktop Adds the file WikiNow.16.2011.1acwk.exe"="12/20/2020 1:56 PM, 48377192 bytes, A Registry details [View: All details] (Selection) ------------------------------------------------ [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "WikiNow"="REG_SZ", "C:\Users\{username}\AppData\Roaming\WikiNow\WikiNow.exe --su" [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WikiNow] "DisplayIcon"="REG_SZ", ""C:\Users\{username}\AppData\Roaming\WikiNow\Uninstall.exe"" "DisplayName"="REG_SZ", "WikiNow - WikiNow for Desktop" "DisplayVersion"="REG_SZ", "16.2011.1acwk" "EstimatedSize"="REG_DWORD", 111346 "Publisher"="REG_SZ", "WikiNow" "UninstallString"="REG_SZ", ""C:\Users\{username}\AppData\Roaming\WikiNow\Uninstall.exe"" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\QWAVEdrv\Enum] "0"="REG_SZ", "Root\LEGACY_QWAVEDRV\0000" "Count"="REG_DWORD", 1 "NextInstance"="REG_DWORD", 1 [HKEY_CURRENT_USER\Software\AppDataLow\Software\WikiNow] "uid"="REG_SZ", "51978453-B275-4844-A65A-6A55CA26DE1B" Malwarebytes log: Malwarebytes www.malwarebytes.com -Log Details- Scan Date: 12/23/20 Scan Time: 9:13 AM Log File: bd74eb1e-44f6-11eb-8546-080027235d76.json -Software Information- Version: 4.3.0.98 Components Version: 1.0.1130 Update Package Version: 1.0.34655 License: Premium -System Information- OS: Windows 7 Service Pack 1 CPU: x64 File System: NTFS User: {computername}\{username} -Scan Summary- Scan Type: Threat Scan Scan Initiated By: Manual Result: Completed Objects Scanned: 232841 Threats Detected: 18 Threats Quarantined: 17 Time Elapsed: 3 min, 27 sec -Scan Options- Memory: Enabled Startup: Enabled Filesystem: Enabled Archives: Enabled Rootkits: Disabled Heuristics: Enabled PUP: Detect PUM: Detect -Scan Details- Process: 3 PUP.Optional.WikiNow, C:\USERS\{username}\APPDATA\ROAMING\WIKINOW\WIKINOW.EXE, Quarantined, 16846, 891996, , , , , 2D41237FD89646D92843307A3C822ACD, 3C9E877019910F4C8758E46168431356C8A5E37C11BDB766F81CA732616F9F88 PUP.Optional.WikiNow, C:\USERS\{username}\APPDATA\ROAMING\WIKINOW\WIKINOW.EXE, Quarantined, 16846, 891996, , , , , 2D41237FD89646D92843307A3C822ACD, 3C9E877019910F4C8758E46168431356C8A5E37C11BDB766F81CA732616F9F88 PUP.Optional.WikiNow, C:\USERS\{username}\APPDATA\ROAMING\WIKINOW\WIKINOW.EXE, Quarantined, 16846, 891996, , , , , 2D41237FD89646D92843307A3C822ACD, 3C9E877019910F4C8758E46168431356C8A5E37C11BDB766F81CA732616F9F88 Module: 6 PUP.Optional.WikiNow, C:\USERS\{username}\APPDATA\ROAMING\WIKINOW\WIKINOW.EXE, Quarantined, 16846, 891996, , , , , 2D41237FD89646D92843307A3C822ACD, 3C9E877019910F4C8758E46168431356C8A5E37C11BDB766F81CA732616F9F88 PUP.Optional.WikiNow, C:\USERS\{username}\APPDATA\ROAMING\WIKINOW\WIKINOW.EXE, Quarantined, 16846, 891996, , , , , 2D41237FD89646D92843307A3C822ACD, 3C9E877019910F4C8758E46168431356C8A5E37C11BDB766F81CA732616F9F88 PUP.Optional.WikiNow, C:\USERS\{username}\APPDATA\ROAMING\WIKINOW\WIKINOW.EXE, Quarantined, 16846, 891996, , , , , 2D41237FD89646D92843307A3C822ACD, 3C9E877019910F4C8758E46168431356C8A5E37C11BDB766F81CA732616F9F88 PUP.Optional.WikiNow, C:\USERS\{username}\APPDATA\ROAMING\WIKINOW\NW_ELF.DLL, Quarantined, 16846, 891999, , , , , C00AD23CF2F47F3BB87009B6B619C03C, EDBFDCD80D9D077FC78CE619AB8F4983AEDA373AB7678D08E2026D5CA1BC940A PUP.Optional.WikiNow, C:\USERS\{username}\APPDATA\ROAMING\WIKINOW\NW_ELF.DLL, Quarantined, 16846, 891999, , , , , C00AD23CF2F47F3BB87009B6B619C03C, EDBFDCD80D9D077FC78CE619AB8F4983AEDA373AB7678D08E2026D5CA1BC940A PUP.Optional.WikiNow, C:\USERS\{username}\APPDATA\ROAMING\WIKINOW\NW_ELF.DLL, Quarantined, 16846, 891999, , , , , C00AD23CF2F47F3BB87009B6B619C03C, EDBFDCD80D9D077FC78CE619AB8F4983AEDA373AB7678D08E2026D5CA1BC940A Registry Key: 1 PUP.Optional.WikiNow, HKCU\SOFTWARE\APPDATALOW\SOFTWARE\WikiNow, Quarantined, 16846, 892000, 1.0.34655, , ame, , , Registry Value: 1 PUP.Optional.WikiNow, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|WikiNow, Quarantined, 16846, 891996, , , , , , Registry Data: 0 (No malicious items detected) Data Stream: 0 (No malicious items detected) Folder: 3 PUP.Optional.WikiNow, C:\USERS\{username}\APPDATA\LOCAL\WIKINOW, Removal Failed, 16846, 891997, 1.0.34655, , ame, , , PUP.Optional.WikiNow, C:\USERS\{username}\APPDATA\ROAMING\MICROSOFT\WINDOWS\START MENU\PROGRAMS\WIKINOW, Quarantined, 16846, 891998, 1.0.34655, , ame, , , PUP.Optional.WikiNow, C:\USERS\{username}\APPDATA\ROAMING\WIKINOW, Quarantined, 16846, 891999, 1.0.34655, , ame, , , File: 4 PUP.Optional.WikiNow, C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WikiNow\Uninstall.lnk, Quarantined, 16846, 891998, , , , , E966994CE3DD4B54FBA154EC2CAB84BA, B4AF85F7E8702B9E71D1BBA5FCB221149651AD2B60E33FAF2514670F6586802D PUP.Optional.WikiNow, C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WikiNow\WikiNow.lnk, Quarantined, 16846, 891998, , , , , 674192A92F4AC2D4432E012E91276BA7, 7B05E8EABB049F0EF3A38DB76EE3EF8C582C6E95C031C6D4A45DD5F95B1D13FE PUP.Optional.WikiNow, C:\USERS\{username}\APPDATA\ROAMING\WIKINOW\WIKINOW.EXE, Quarantined, 16846, 891996, 1.0.34655, , ame, , 2D41237FD89646D92843307A3C822ACD, 3C9E877019910F4C8758E46168431356C8A5E37C11BDB766F81CA732616F9F88 PUP.Optional.WikiNow, C:\USERS\{username}\APPDATA\ROAMING\WIKINOW\NW_ELF.DLL, Quarantined, 16846, 891999, 1.0.34655, 0000000000000000000003E9, dds, 01040122, C00AD23CF2F47F3BB87009B6B619C03C, EDBFDCD80D9D077FC78CE619AB8F4983AEDA373AB7678D08E2026D5CA1BC940A Physical Sector: 0 (No malicious items detected) WMI: 0 (No malicious items detected) (end) As mentioned before the full version of Malwarebytes could have protected your computer against this threat. We use different ways of protecting your computer(s): Dynamically Blocks Malware Sites & Servers Malware Execution Prevention Save yourself the hassle and get protected.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.