Jump to content

Search the Community

Showing results for tags 'pup.optional.appset'.



More search options

  • Search By Tags

    Type tags separated by commas.
  • Search By Author

Content Type


Forums

  • Announcements
    • Malwarebytes News
    • Beta Testing Program
  • Malware Removal Help
    • Windows Malware Removal Help & Support
    • Mac Malware Removal Help & Support
    • Mobile Malware Removal Help & Support
    • Malware Removal Self-Help Guides
  • Malwarebytes for Home Support
    • Malwarebytes for Windows Support Forum
    • Malwarebytes for Mac Support Forum
    • Malwarebytes for Android Support Forum
    • Malwarebytes for iOS Support
    • Malwarebytes Privacy
    • Malwarebytes Browser Guard
    • False Positives
    • Comments and Suggestions
  • Malwarebytes for Business Support
    • Malwarebytes Endpoint Protection
    • Malwarebytes Incident Response (includes Breach Remediation)
    • Malwarebytes Endpoint Security
    • Malwarebytes Business Products Comments and Suggestions
  • Malwarebytes Tools and Other Products
    • Malwarebytes AdwCleaner
    • Malwarebytes Junkware Removal Tool Support
    • Malwarebytes Anti-Rootkit BETA Support
    • Malwarebytes Techbench USB (Legacy)
    • Malwarebytes Secure Backup discontinued
    • Other Tools
    • Malwarebytes Tools Comments and Suggestions
  • General Computer Help and Security Updates
    • BSOD, Crashes, Kernel Debugging
    • General Windows PC Help
  • Research Center
    • Newest Rogue-Ransomware Threats
    • Newest Malware Threats
    • Newest Mobile Threats
    • Newest IP or URL Threats
    • Newest Mac Threats
    • Report Scam Phone Numbers
  • General
    • General Chat
    • Forums Announcements & Feedback

Find results in...

Find results that contain...


Date Created

  • Start

    End


Last Updated

  • Start

    End


Filter by number of...

Joined

  • Start

    End


Group


AIM


MSN


Website URL


ICQ


Yahoo


Jabber


Location


Interests

Found 2 results

  1. What is Gramblr?The Malwarebytes research team has determined that Gramblr is an adware bundler. These bundlers typically install potentially unwanted programs (PUPs) or adware on top of the desired software.How do I know if my computer is affected by Gramblr?You may see these warnings during install:and this entry in your list of installed Programs and Features:How did Gramblr get on my computer?Bundlers use different methods for distributing themselves. This particular one was offered as an Instagram uploader.How do I remove Gramblr?Our program Malwarebytes can detect and remove this bundler. For a more complete removal of Gramblr use the uninstall from Programs and Features, then follow the instructions below to remove any (potentially) unwanted bundleware. Please download Malwarebytes to your desktop. Double-click mb3-setup-consumer-{version}.exe and follow the prompts to install the program. Then click Finish. Once the program has fully updated, select Scan Now on the Dashboard. Or select the Threat Scan from the Scan menu. If another update of the definitions is available, it will be implemented before the rest of the scanning procedure. When the scan is complete, make sure that all Threats are selected, and click Remove Selected. Restart your computer when prompted to do so. Is there anything else I need to do to get rid of Gramblr? No, Malwarebytes disables Gramblr completely. How would the full version of Malwarebytes help protect me?We hope our application and this guide have helped you eradicate this bundler.As you can see below the full version of Malwarebytes would have protected you against the Gramblr bundler. It would have blocked the installer before it became too late. Technical details for expertsPossible signs in FRST logs: (Gramblr -> ) [File not signed] C:\Program Files\Gramblr\gramblr.exe R2 gramblrclient; C:\Program Files\Gramblr\gramblr.exe [10014800 2019-10-22] (Gramblr -> ) [File not signed] C:\ProgramData\Gramblr C:\Program Files\Gramblr C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Gramblr.lnk (Offerbox ) C:\Users\{username}\Desktop\Gramblr_Setup.exe Gramblr (HKLM-x32\...\Gramblr) (Version: 2.9.131 - Gramblr Team) Significant changes made by the installer: File system details [View: All details] (Selection) --------------------------------------------------- Adds the folder C:\Program Files\Gramblr Adds the file gramblr.exe"="10/22/2019 10:53 AM, 10014800 bytes, A Adds the folder C:\ProgramData\Gramblr Adds the file chrome.vbs"="10/22/2019 10:53 AM, 295 bytes, A Adds the file convert.exe"="10/22/2019 10:53 AM, 12395520 bytes, A Adds the file gramblr.db"="10/22/2019 10:53 AM, 14336 bytes, A Adds the file restart.vbs"="10/22/2019 10:53 AM, 285 bytes, A Adds the file runtime.log"="10/22/2019 10:53 AM, 0 bytes, A Adds the file sessions.db"="10/22/2019 10:53 AM, 7168 bytes, A Adds the file updater.ini"="10/22/2019 10:53 AM, 0 bytes, A Adds the file vcomp100.dll"="10/22/2019 10:53 AM, 51024 bytes, A Adds the folder C:\ProgramData\Gramblr\backup Adds the file gramblr.exe"="4/24/2018 10:34 AM, 8370768 bytes, A In the existing folder C:\ProgramData\Microsoft\Windows\Start Menu\Programs Adds the file Gramblr.lnk"="10/22/2019 10:52 AM, 798 bytes, A Adds the folder C:\Users\{username}\AppData\Local\VirtualStore\ProgramData\Gramblr Adds the file gramblr.db"="10/22/2019 10:53 AM, 14336 bytes, A Adds the folder C:\Users\{username}\Desktop\Gramblr Adds the file Gramblr.exe"="4/24/2018 10:34 AM, 8370768 bytes, A Registry details [View: All details] (Selection) ------------------------------------------------ [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Gramblr] "DisplayIcon"="REG_SZ", "C:\Program Files\Gramblr\gramblr.exe" "DisplayName"="REG_SZ", "Gramblr" "DisplayVersion"="REG_SZ", "2.9.131" "EstimatedSize"="REG_DWORD", 6800 "InstallLocation"="REG_SZ", "C:\Program Files\Gramblr" "Language"="REG_DWORD", 0 "NoModify"="REG_DWORD", 1 "NoRepair"="REG_DWORD", 1 "Publisher"="REG_SZ", "Gramblr Team" "UninstallString"="REG_SZ", ""C:\Program Files\Gramblr\gramblr.exe" --uninstall" "UrlInfoAbout"="REG_SZ", "http://gramblr.com" "VersionMajor"="REG_DWORD", 2 "VersionMinor"="REG_DWORD", 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\gramblrclient] "Description"="REG_SZ", "Provides event-based networking capabilities to the core engine and gives client applications to ability to communicate with Gramblr" "DisplayName"="REG_SZ", "Windows Connectivity Manager for Gramblr" "ErrorControl"="REG_DWORD", 1 "FailureActions"="REG_BINARY, .............. "FailureActionsOnNonCrashFailures"="REG_DWORD", 1 "ImagePath"="REG_EXPAND_SZ, "C:\Program Files\Gramblr\gramblr.exe" "ObjectName"="REG_SZ", "LocalSystem" "Start"="REG_DWORD", 2 "Type"="REG_DWORD", 16 "WOW64"="REG_DWORD", 1 Malwarebytes log: Malwarebytes www.malwarebytes.com -Log Details- Scan Date: 10/22/19 Scan Time: 11:02 AM Log File: ad916cf6-f4aa-11e9-98be-00ffdcc6fdfc.json -Software Information- Version: 3.8.3.2965 Components Version: 1.0.613 Update Package Version: 1.0.13005 License: Premium -System Information- OS: Windows 7 Service Pack 1 CPU: x64 File System: NTFS User: {computername}\{username} -Scan Summary- Scan Type: Threat Scan Scan Initiated By: Manual Result: Completed Objects Scanned: 234315 Threats Detected: 2 Threats Quarantined: 2 Time Elapsed: 12 min, 38 sec -Scan Options- Memory: Enabled Startup: Enabled Filesystem: Enabled Archives: Enabled Rootkits: Enabled Heuristics: Enabled PUP: Detect PUM: Detect -Scan Details- Process: 0 (No malicious items detected) Module: 0 (No malicious items detected) Registry Key: 0 (No malicious items detected) Registry Value: 0 (No malicious items detected) Registry Data: 0 (No malicious items detected) Data Stream: 0 (No malicious items detected) Folder: 0 (No malicious items detected) File: 1 PUP.Optional.Appset, C:\USERS\{username}\DESKTOP\GRAMBLR_SETUP.EXE, Quarantined, [509], [591202],1.0.13005 Physical Sector: 0 (No malicious items detected) WMI: 0 (No malicious items detected) (end) As mentioned before the full version of Malwarebytes could have protected your computer against this threat.We use different ways of protecting your computer(s): Dynamically Blocks Malware Sites & Servers Malware Execution Prevention Save yourself the hassle and get protected.
  2. What is AppSet?The Malwarebytes research team has determined that AppSet is a bundler that often delivers several browser hijackers. These so-called "hijackers" manipulate your browser(s), for example to change your startpage or searchscopes, so that the affected browser visits their site or one of their choice.How do I know if my computer is affected by AppSet?You may see these entries in your list of installed software:and these warnings during install:the bundled applicationsome of the bundled software can be opted-out, others are mandatory or silentsome only appear after you open your browseryou may see these browser add-ons:this type of new default search providers:and you will see these icons in your startmenu, on your taskbar and on your desktop:How did AppSet get on my computer?Browser hijackers use different methods for distributing themselves. This particular one was bundled with other software.How do I remove AppSet?Our program Malwarebytes can detect and remove this potentially unwanted program. Please download Malwarebytes to your desktop. Double-click mb3-setup-consumer-{version}.exe and follow the prompts to install the program. Then click Finish. Once the program has fully updated, select Scan Now on the Dashboard. Or select the Threat Scan from the Scan menu. If another update of the definitions is available, it will be implemented before the rest of the scanning procedure. When the scan is complete, make sure that all Threats are selected, and click Remove Selected. Restart your computer when prompted to do so. Is there anything else I need to do to get rid of AppSet? No, Malwarebytes removes AppSet completely. This PUP can create some scheduled tasks. You can read here how to check for and, if necessary, remove Scheduled Tasks. If your browsers have been hijacked, you should read our Restore Browser page. You can read there how to fix additional browser redirect methods. How would the full version of Malwarebytes help protect me?We hope our application and this guide have helped you eradicate this hijacker.As you can see below the full version of Malwarebytes would have protected you against the AppSet bundler. It would have warned you before the application could install itself, giving you a chance to stop it before it became too late. Technical details for expertsPossible signs in FRST logs: (Yandex LLC) C:\Users\{username}\AppData\Local\Yandex\BrowserManager\BrowserManager.exe HKCU\...\Run: [Browser Manager] => C:\Users\{username}\AppData\Local\Yandex\BrowserManager\MBLauncher.exe [129896 2017-08-11] (Yandex LLC) HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://www.yandex.ru/?win=345&clid=2323969-3 SearchScopes: HKCU -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://yandex.ru/search/?win=345&clid=2323970-3&text={searchTerms} SearchScopes: HKCU -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://yandex.ru/search/?win=345&clid=2323970-3&text={searchTerms} FF DefaultSearchEngine: Яндекс FF SelectedSearchEngine: Яндекс FF Homepage: hxxps://www.yandex.ru/?win=345&clid=2323969-3 FF SearchPlugin: C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\60l2dg92.default-1519559592148\searchplugins\yandex.ru-20180610.xml [2018-08-10] FF Extension: No Name - C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\60l2dg92.default-1519559592148\Extensions\sovetnik@metabar.ru.xpi [2018-08-10] FF Extension: No Name - C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\60l2dg92.default-1519559592148\Extensions\vb@yandex.ru.xpi [2018-08-10] CHR DefaultSearchURL: Default -> hxxps://yandex.ru/search/?__PARAM__from=chromesearch&text={searchTerms} CHR DefaultSearchKeyword: Default -> yandex.ru CHR DefaultSuggestURL: Default -> hxxps://suggest.yandex.net/suggest-ff.cgi?uil=ru&part={searchTerms} CHR Extension: (Яндекс) - C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\ablpcikjmhamjanpibkccdmpoekjigja [2018-08-10] CHR HKLM-x32\...\Chrome\Extension: [ablpcikjmhamjanpibkccdmpoekjigja] - hxxp://clients2.google.com/service/update2/crx OPR StartupUrls: "hxxps:\/\/www.yandex.ru\/?win=345&clid=2323969-3" C:\Users\{username}\Desktop\Yandex.lnk C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Yandex C:\Users\{username}\AppData\Local\Yandex C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Яндекс C:\Users\{username}\AppData\LocalLow\Yandex C:\Users\{username}\AppData\Roaming\Yandex C:\Users\{username}\AppData\Local\4tools (appset.me ) C:\Users\{username}\Desktop\After Death.exe Yandex (HKCU\...\YandexBrowser) (Version: 18.6.1.770 - ООО «ЯНДЕКС») Yandex taskbar button (HKCU\...\YaPinLancher) (Version: 2.0.4.2157 - Yandex) Менеджер браузеров (HKCU\...\{d4bb3741-07a4-443a-8c73-0cfda821c697}) (Version: 3.0.6.829 - Яндекс) Менеджер браузеров (x32 Version: 3.0.6.829 - Яндекс) Hidden Task: {251471D4-E8A6-485F-A381-32B17C4610B7} - System32\Tasks\Обновление Браузера Яндекс => C:\Users\{username}\AppData\Local\Yandex\YandexBrowser\Application\browser.exe [2018-07-07] (YANDEX LLC) Task: C:\Windows\Tasks\Обновление Браузера Яндекс.job => C:\Users\{username}\AppData\Local\Yandex\YandexBrowser\Application\browser.exe Some significant lterations made by the installer: File system details [View: All details] (Selection) --------------------------------------------------- Adds the folder C:\Users\{username}\AppData\Local\Microsoft\Internet Explorer\Services Adds the file avia.yandex.ru.ico"="8/10/2018 9:07 AM, 6518 bytes, A Adds the file kinopoisk.ru.ico"="8/10/2018 9:07 AM, 13942 bytes, A Adds the file www.yandex.ru.ico"="8/10/2018 9:07 AM, 5430 bytes, A Adds the file yandex.ru.ico"="8/10/2018 9:06 AM, 5430 bytes, A Adds the folder C:\Users\{username}\AppData\Local\Yandex\BrowserManager Adds the file BrowserManager.Core.dll"="8/11/2017 1:00 PM, 415592 bytes, A Adds the file BrowserManager.Core.UI.dll"="8/11/2017 1:00 PM, 391528 bytes, A Adds the file BrowserManager.exe"="8/11/2017 1:00 PM, 352104 bytes, A Adds the file Crypto.Core.dll"="8/11/2017 1:00 PM, 47616 bytes, A Adds the file MBlauncher.exe"="8/11/2017 1:00 PM, 129896 bytes, A Adds the file MBlauncher_x64.exe"="8/11/2017 1:00 PM, 153960 bytes, A Adds the file ModuleUpgrader.dll"="8/11/2017 1:00 PM, 74088 bytes, A Adds the file ModuleUpgrader.dll.upgrade"="8/10/2018 9:08 AM, 76312 bytes, A Adds the file NAudio.dll"="8/11/2017 1:00 PM, 475136 bytes, A Adds the file Newtonsoft.Json.dll"="8/11/2017 1:00 PM, 521216 bytes, A Adds the file NLog.dll"="8/11/2017 1:00 PM, 577536 bytes, A Adds the file RefCheck.dll"="8/11/2017 1:00 PM, 19816 bytes, A Adds the file System.Data.SQLite.dll"="8/11/2017 1:00 PM, 311296 bytes, A Adds the folder C:\Users\{username}\AppData\Local\Yandex\Updater Adds the folder C:\Users\{username}\AppData\Local\Yandex\Updater2 Adds the file res"="8/10/2018 9:07 AM, 1 bytes, A Adds the file show-dlg.exe"="6/14/2016 2:14 PM, 389952 bytes, A Adds the file u2-ctrl.exe"="6/14/2016 2:14 PM, 493568 bytes, A Adds the file yupdate-exec.exe"="6/14/2016 2:14 PM, 492864 bytes, A Adds the folder C:\Users\{username}\AppData\Local\Yandex\yapin Adds the file Yandex.exe"="7/20/2018 4:33 PM, 297992 bytes, A Adds the file Yandex.lnk"="8/10/2018 9:07 AM, 2089 bytes, A Adds the file YandexWorking.exe"="7/20/2018 4:33 PM, 297992 bytes, A Adds the file Яндекс.website"="8/10/2018 9:07 AM, 520 bytes, A Adds the folder C:\Users\{username}\AppData\LocalLow\Yandex Adds the folder C:\Users\{username}\AppData\LocalLow\Yandex\Updater Adds the file u2-ctrl.log"="8/10/2018 9:07 AM, 9487 bytes, A Adds the file u2-exec-bm.log"="8/10/2018 9:07 AM, 4874 bytes, A Adds the file u2-exec-statistic.log"="8/10/2018 9:07 AM, 5557 bytes, A Adds the folder C:\Users\{username}\AppData\LocalLow\Yandex\Updater\bm Adds the file appinfo.xml"="8/10/2018 9:07 AM, 805 bytes, A Adds the file statistics.xml"="8/10/2018 9:07 AM, 278 bytes, A In the existing folder C:\Users\{username}\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar Adds the file Yandex.lnk"="8/10/2018 9:07 AM, 2089 bytes, A Adds the file Кинопоиск.website"="8/10/2018 9:07 AM, 537 bytes, A Adds the file Яндекс.website"="8/10/2018 9:07 AM, 520 bytes, A Adds the folder C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Яндекс\Менеджер браузеров Adds the file Менеджер браузеров.lnk"="8/10/2018 9:07 AM, 1331 bytes, A Adds the folder C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\60l2dg92.default-1519559592148\browser-extension-data\sovetnik@metabar.ru Adds the file storage.js"="8/10/2018 9:06 AM, 715 bytes, A Adds the folder C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\60l2dg92.default-1519559592148\browser-extension-data\vb@yandex.ru Adds the file storage.js"="8/10/2018 9:06 AM, 715 bytes, A Adds the folder C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\60l2dg92.default-1519559592148\extensions\staged Adds the file sovetnik@metabar.ru.json"="8/10/2018 9:06 AM, 1063 bytes, A Adds the file sovetnik@metabar.ru.xpi"="8/10/2018 9:06 AM, 705207 bytes, A Adds the file vb@yandex.ru.json"="8/10/2018 9:06 AM, 5222 bytes, A Adds the file vb@yandex.ru.xpi"="8/10/2018 9:06 AM, 1736900 bytes, A Adds the folder C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\60l2dg92.default-1519559592148\searchplugins Adds the file yandex.ru-20180610.xml"="8/10/2018 9:06 AM, 9693 bytes, A Adds the folder C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\60l2dg92.default-1519559592148\yandex-extensions-data Adds the file clids-sovetnik.xml"="8/10/2018 9:06 AM, 673 bytes, A Adds the file clids-vbff.xml"="8/10/2018 9:06 AM, 673 bytes, A Adds the folder C:\Users\{username}\AppData\Roaming\Yandex Adds the file clids-bm.xml"="8/10/2018 9:07 AM, 201 bytes, A Adds the file clids-yabrowser.xml"="8/10/2018 9:06 AM, 619 bytes, A Adds the file ui"="8/10/2018 9:06 AM, 38 bytes, A In the existing folder C:\Users\{username}\Favorites\Links Adds the file Авиабилеты.url"="8/10/2018 9:07 AM, 415 bytes, A Adds the file Яндекс.url"="8/10/2018 9:06 AM, 331 bytes, A Registry details [View: All details] (Selection) ------------------------------------------------ [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\ablpcikjmhamjanpibkccdmpoekjigja] "install_parameter"="REG_SZ", "clid=2323970-3&win=345&" "update_url"="REG_SZ", "http://clients2.google.com/service/update2/crx" [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{FABA89D9-D588-4770-9F85-F6FF9F064257}] "AuthorizedCDFPrefix"="REG_SZ", "" "Comments"="REG_SZ", "" "Contact"="REG_SZ", "" "DisplayName"="REG_SZ", "Менеджер браузеров" "DisplayVersion"="REG_SZ", "3.0.6.829" "EstimatedSize"="REG_DWORD", 9328 "HelpLink"="REG_EXPAND_SZ, "http://help.yandex.ru/bm/" "HelpTelephone"="REG_SZ", "" "InstallDate"="REG_SZ", "20180810" "InstallLocation"="REG_SZ", "" "InstallSource"="REG_SZ", "C:\Users\{username}\AppData\Local\Package Cache\{FABA89D9-D588-4770-9F85-F6FF9F064257}v3.0.6.829\" "Language"="REG_DWORD", 0 "ModifyPath"="REG_EXPAND_SZ, "MsiExec.exe /X{FABA89D9-D588-4770-9F85-F6FF9F064257}" "NoModify"="REG_DWORD", 1 "Publisher"="REG_SZ", "Яндекс" "Readme"="REG_SZ", "" "Size"="REG_SZ", "" "SystemComponent"="REG_DWORD", 1 "UninstallString"="REG_EXPAND_SZ, "MsiExec.exe /X{FABA89D9-D588-4770-9F85-F6FF9F064257}" "URLInfoAbout"="REG_SZ", "" "URLUpdateInfo"="REG_SZ", "http://bm.yandex.ru/" "Version"="REG_DWORD", 50331654 "VersionMajor"="REG_DWORD", 3 "VersionMinor"="REG_DWORD", 0 "WindowsInstaller"="REG_DWORD", 1 [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main] "Start Page" = REG_SZ, "https://www.yandex.ru/?win=345&clid=2323969-3" [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}] "DisplayName" = REG_SZ, "Яндекс" REG_SZ, "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IENTSR" ==> REG_SZ, "https://yandex.ru/search/?win=345&clid=2323972-3&text={searchTerms}" "SuggestionsURL_JSON"="REG_SZ", "https://suggest.yandex.ru/suggest-ff.cgi?uil=ru&part={searchTerms}" "URL" ==> REG_SZ, "https://yandex.ru/search/?win=345&clid=2323970-3&text={searchTerms}" [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] "Browser Manager"="REG_SZ", "C:\Users\{username}\AppData\Local\Yandex\BrowserManager\MBLauncher.exe" [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\{d4bb3741-07a4-443a-8c73-0cfda821c697}] "BundleAddonCode"="REG_MULTI_SZ, "" "BundleCachePath"="REG_SZ", "C:\Users\{username}\AppData\Local\Package Cache\{d4bb3741-07a4-443a-8c73-0cfda821c697}\BrowserManagerInstaller.exe" "BundleDetectCode"="REG_MULTI_SZ, "" "BundlePatchCode"="REG_MULTI_SZ, "" "BundleProviderKey"="REG_SZ", "{d4bb3741-07a4-443a-8c73-0cfda821c697}" "BundleTag"="REG_SZ", "" "BundleUpgradeCode"="REG_MULTI_SZ, "{CEADE967-2D56-4D80-A02E-CD3D762C0A3D} " "BundleVersion"="REG_SZ", "3.0.6.829" "DisplayIcon"="REG_SZ", "C:\Users\{username}\AppData\Local\Package Cache\{d4bb3741-07a4-443a-8c73-0cfda821c697}\BrowserManagerInstaller.exe,0" "DisplayName"="REG_SZ", "Менеджер браузеров" "DisplayVersion"="REG_SZ", "3.0.6.829" "EngineVersion"="REG_SZ", "3.8.2029.0" "EstimatedSize"="REG_DWORD", 15269 "HelpLink"="REG_SZ", "http://help.yandex.ru/bm/" "Installed"="REG_DWORD", 1 "ModifyPath"="REG_SZ", ""C:\Users\{username}\AppData\Local\Package Cache\{d4bb3741-07a4-443a-8c73-0cfda821c697}\BrowserManagerInstaller.exe" /modify" "NoElevateOnModify"="REG_DWORD", 1 "Publisher"="REG_SZ", "Яндекс" "QuietUninstallString"="REG_SZ", ""C:\Users\{username}\AppData\Local\Package Cache\{d4bb3741-07a4-443a-8c73-0cfda821c697}\BrowserManagerInstaller.exe" /uninstall /quiet" "Resume"="REG_DWORD", 3 "UninstallString"="REG_SZ", ""C:\Users\{username}\AppData\Local\Package Cache\{d4bb3741-07a4-443a-8c73-0cfda821c697}\BrowserManagerInstaller.exe" /uninstall" "URLInfoAbout"="REG_SZ", "bm.yandex.ru" "URLUpdateInfo"="REG_SZ", "bm.yandex.ru" [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\YaPinLancher] "Contact"="REG_SZ", "http://feedback.yandex.ru" "DisplayIcon"="REG_SZ", "C:\Users\{username}1\AppData\Local\MICROS~1\INTERN~1\Services\WWWYAN~1.ICO" "DisplayName"="REG_SZ", "Yandex taskbar button" "DisplayVersion"="REG_SZ", "2.0.4.2157" "HelpLink"="REG_SZ", "http://help.yandex.ru/" "NoModify"="REG_DWORD", 1 "NoRepair"="REG_DWORD", 1 "Publisher"="REG_SZ", "Yandex" "UninstallString"="REG_SZ", "C:\Users\{username}\AppData\Local\Yandex\yapin\YandexWorking.exe --uninstall --nopinned" "URLInfoAbout"="REG_SZ", "http://legal.yandex.ru/desktop_software_agreement/" "URLUpdateInfo"="REG_SZ", "http://soft.yandex.ru/distribution/" [HKEY_CURRENT_USER\Software\Yandex\BM] "DistrLocale"="REG_SZ", "ru-ru" "ExePath"="REG_SZ", ""C:\Users\{username}\AppData\Local\Yandex\BrowserManager\BrowserManager.exe"" [HKEY_CURRENT_USER\Software\Yandex\BM\Upgrader] "ModuleBrowsersProtection"="REG_SZ", "3.0.0.12" "ModuleChromium"="REG_SZ", "3.0.0.10" "ModuleDefaultBrowser"="REG_SZ", "3.0.0.10" "ModuleFirefox"="REG_SZ", "3.0.0.8" "ModuleGeo"="REG_SZ", "3.0.0.8" "ModuleHelper"="REG_SZ", "3.0.0.8" "ModuleHosts"="REG_SZ", "3.0.0.8" "ModuleInternetExplorer"="REG_SZ", "3.0.0.8" "ModuleOperaPresto"="REG_SZ", "3.0.0.8" "ModuleSecurity"="REG_SZ", "3.0.0.12" "ModuleSeederInteraction"="REG_SZ", "3.0.0.8" "ModuleShortcuts"="REG_SZ", "3.0.0.8" "ModuleUpgrader"="REG_SZ", "3.0.0.8" "ModuleVoodoo"="REG_SZ", "3.0.0.8" Malwarebytes log: Malwarebytes www.malwarebytes.com -Log Details- Scan Date: 8/10/18 Scan Time: 9:21 AM Log File: f8469579-9c6d-11e8-8c7f-00ffdcc6fdfc.json Administrator: Yes -Software Information- Version: 3.5.1.2522 Components Version: 1.0.391 Update Package Version: 1.0.6283 License: Premium -System Information- OS: Windows 7 Service Pack 1 CPU: x64 File System: NTFS User: {computername}\{username} -Scan Summary- Scan Type: Threat Scan Scan Initiated By: Manual Result: Completed Objects Scanned: 252649 Threats Detected: 83 Threats Quarantined: 83 Time Elapsed: 4 min, 6 sec -Scan Options- Memory: Enabled Startup: Enabled Filesystem: Enabled Archives: Enabled Rootkits: Enabled Heuristics: Enabled PUP: Detect PUM: Detect -Scan Details- Process: 1 PUP.Optional.BrowserManager, C:\Users\{username}\AppData\Local\Yandex\BrowserManager\BrowserManager.exe, Quarantined, [777], [383595],1.0.6283 Module: 2 PUP.Optional.BrowserManager, C:\Users\{username}\AppData\Local\Yandex\BrowserManager\x64\SQLite.Interop.dll, Quarantined, [777], [383595],1.0.6283 PUP.Optional.BrowserManager, C:\Users\{username}\AppData\Local\Yandex\BrowserManager\BrowserManager.exe, Quarantined, [777], [383595],1.0.6283 Registry Key: 1 PUP.Optional.RussAd, HKLM\SOFTWARE\WOW6432NODE\GOOGLE\CHROME\EXTENSIONS\ablpcikjmhamjanpibkccdmpoekjigja, Quarantined, [291], [510332],1.0.6283 Registry Value: 1 PUP.Optional.BrowserManager, HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|Browser Manager, Quarantined, [777], [383595],1.0.6283 Registry Data: 0 (No malicious items detected) Data Stream: 0 (No malicious items detected) Folder: 18 PUP.Optional.BrowserManager, C:\Users\{username}\AppData\Local\Yandex\BrowserManager\data\SeederTasks, Quarantined, [777], [383595],1.0.6283 PUP.Optional.BrowserManager, C:\Users\{username}\AppData\Local\Yandex\BrowserManager\settings, Quarantined, [777], [383595],1.0.6283 PUP.Optional.BrowserManager, C:\Users\{username}\AppData\Local\Yandex\BrowserManager\modules, Quarantined, [777], [383595],1.0.6283 PUP.Optional.BrowserManager, C:\Users\{username}\AppData\Local\Yandex\BrowserManager\data, Quarantined, [777], [383595],1.0.6283 PUP.Optional.BrowserManager, C:\Users\{username}\AppData\Local\Yandex\BrowserManager\x64, Quarantined, [777], [383595],1.0.6283 PUP.Optional.BrowserManager, C:\Users\{username}\AppData\Local\Yandex\BrowserManager\x86, Quarantined, [777], [383595],1.0.6283 PUP.Optional.BrowserManager, C:\USERS\{username}\APPDATA\LOCAL\YANDEX\BROWSERMANAGER, Quarantined, [777], [383595],1.0.6283 PUP.Optional.RussAd, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\ablpcikjmhamjanpibkccdmpoekjigja\2.0.4.15_0\_locales\ru, Quarantined, [291], [510332],1.0.6283 PUP.Optional.RussAd, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\ablpcikjmhamjanpibkccdmpoekjigja\2.0.4.15_0\_locales\tr, Quarantined, [291], [510332],1.0.6283 PUP.Optional.RussAd, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\ablpcikjmhamjanpibkccdmpoekjigja\2.0.4.15_0\_locales\uk, Quarantined, [291], [510332],1.0.6283 PUP.Optional.RussAd, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\ablpcikjmhamjanpibkccdmpoekjigja\2.0.4.15_0\contextLib, Quarantined, [291], [510332],1.0.6283 PUP.Optional.RussAd, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\ablpcikjmhamjanpibkccdmpoekjigja\2.0.4.15_0\_metadata, Quarantined, [291], [510332],1.0.6283 PUP.Optional.RussAd, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\ablpcikjmhamjanpibkccdmpoekjigja\2.0.4.15_0\_locales, Quarantined, [291], [510332],1.0.6283 PUP.Optional.RussAd, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\ablpcikjmhamjanpibkccdmpoekjigja\2.0.4.15_0\icons, Quarantined, [291], [510332],1.0.6283 PUP.Optional.RussAd, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\ablpcikjmhamjanpibkccdmpoekjigja\2.0.4.15_0\lib, Quarantined, [291], [510332],1.0.6283 PUP.Optional.RussAd, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\ablpcikjmhamjanpibkccdmpoekjigja\2.0.4.15_0\own, Quarantined, [291], [510332],1.0.6283 PUP.Optional.RussAd, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\ablpcikjmhamjanpibkccdmpoekjigja\2.0.4.15_0, Quarantined, [291], [510332],1.0.6283 PUP.Optional.RussAd, C:\USERS\{username}\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\EXTENSIONS\ablpcikjmhamjanpibkccdmpoekjigja, Quarantined, [291], [510332],1.0.6283 File: 60 PUP.Optional.RussAd, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\60L2DG92.DEFAULT-1519559592148\EXTENSIONS\SOVETNIK@METABAR.RU.XPI, Quarantined, [291], [312601],1.0.6283 PUP.Optional.BrowserManager, C:\Users\{username}\AppData\Local\Yandex\BrowserManager\data\data_exchange, Quarantined, [777], [383595],1.0.6283 PUP.Optional.BrowserManager, C:\Users\{username}\AppData\Local\Yandex\BrowserManager\data\downloads, Quarantined, [777], [383595],1.0.6283 PUP.Optional.BrowserManager, C:\Users\{username}\AppData\Local\Yandex\BrowserManager\data\Events Protection, Quarantined, [777], [383595],1.0.6283 PUP.Optional.BrowserManager, C:\Users\{username}\AppData\Local\Yandex\BrowserManager\data\GeoSettings, Quarantined, [777], [383595],1.0.6283 PUP.Optional.BrowserManager, C:\Users\{username}\AppData\Local\Yandex\BrowserManager\data\hosts, Quarantined, [777], [383595],1.0.6283 PUP.Optional.BrowserManager, C:\Users\{username}\AppData\Local\Yandex\BrowserManager\data\scuts, Quarantined, [777], [383595],1.0.6283 PUP.Optional.BrowserManager, C:\Users\{username}\AppData\Local\Yandex\BrowserManager\data\security, Quarantined, [777], [383595],1.0.6283 PUP.Optional.BrowserManager, C:\Users\{username}\AppData\Local\Yandex\BrowserManager\data\settings, Quarantined, [777], [383595],1.0.6283 PUP.Optional.BrowserManager, C:\Users\{username}\AppData\Local\Yandex\BrowserManager\data\voodoo, Quarantined, [777], [383595],1.0.6283 PUP.Optional.BrowserManager, C:\Users\{username}\AppData\Local\Yandex\BrowserManager\modules\ModuleHelper.dll, Quarantined, [777], [383595],1.0.6283 PUP.Optional.BrowserManager, C:\Users\{username}\AppData\Local\Yandex\BrowserManager\modules\ModuleBrowsersProtection.dll, Quarantined, [777], [383595],1.0.6283 PUP.Optional.BrowserManager, C:\Users\{username}\AppData\Local\Yandex\BrowserManager\modules\ModuleChromium.dll, Quarantined, [777], [383595],1.0.6283 PUP.Optional.BrowserManager, C:\Users\{username}\AppData\Local\Yandex\BrowserManager\modules\ModuleChromium.dll.upgrade, Quarantined, [777], [383595],1.0.6283 PUP.Optional.BrowserManager, C:\Users\{username}\AppData\Local\Yandex\BrowserManager\modules\ModuleDefaultBrowser.dll, Quarantined, [777], [383595],1.0.6283 PUP.Optional.BrowserManager, C:\Users\{username}\AppData\Local\Yandex\BrowserManager\modules\ModuleFirefox.dll, Quarantined, [777], [383595],1.0.6283 PUP.Optional.BrowserManager, C:\Users\{username}\AppData\Local\Yandex\BrowserManager\modules\ModuleGeo.dll, Quarantined, [777], [383595],1.0.6283 PUP.Optional.BrowserManager, C:\Users\{username}\AppData\Local\Yandex\BrowserManager\modules\ModuleH.dll.upgrade, Quarantined, [777], [383595],1.0.6283 PUP.Optional.BrowserManager, C:\Users\{username}\AppData\Local\Yandex\BrowserManager\modules\ModuleHosts.dll, Quarantined, [777], [383595],1.0.6283 PUP.Optional.BrowserManager, C:\Users\{username}\AppData\Local\Yandex\BrowserManager\modules\ModuleInternetExplorer.dll, Quarantined, [777], [383595],1.0.6283 PUP.Optional.BrowserManager, C:\Users\{username}\AppData\Local\Yandex\BrowserManager\modules\ModuleOperaPresto.dll, Quarantined, [777], [383595],1.0.6283 PUP.Optional.BrowserManager, C:\Users\{username}\AppData\Local\Yandex\BrowserManager\modules\ModuleSecurity.dll, Quarantined, [777], [383595],1.0.6283 PUP.Optional.BrowserManager, C:\Users\{username}\AppData\Local\Yandex\BrowserManager\modules\ModuleSecurity.dll.upgrade, Quarantined, [777], [383595],1.0.6283 PUP.Optional.BrowserManager, C:\Users\{username}\AppData\Local\Yandex\BrowserManager\modules\ModuleSeederInteraction.dll, Quarantined, [777], [383595],1.0.6283 PUP.Optional.BrowserManager, C:\Users\{username}\AppData\Local\Yandex\BrowserManager\modules\ModuleShortcuts.dll, Quarantined, [777], [383595],1.0.6283 PUP.Optional.BrowserManager, C:\Users\{username}\AppData\Local\Yandex\BrowserManager\modules\ModuleVoodoo.dll, Quarantined, [777], [383595],1.0.6283 PUP.Optional.BrowserManager, C:\Users\{username}\AppData\Local\Yandex\BrowserManager\modules\ModuleYaB.dll.upgrade, Quarantined, [777], [383595],1.0.6283 PUP.Optional.BrowserManager, C:\Users\{username}\AppData\Local\Yandex\BrowserManager\modules\OfferModule.dll.upgrade, Quarantined, [777], [383595],1.0.6283 PUP.Optional.BrowserManager, C:\Users\{username}\AppData\Local\Yandex\BrowserManager\settings\hosts, Quarantined, [777], [383595],1.0.6283 PUP.Optional.BrowserManager, C:\Users\{username}\AppData\Local\Yandex\BrowserManager\x64\SQLite.Interop.dll, Quarantined, [777], [383595],1.0.6283 PUP.Optional.BrowserManager, C:\Users\{username}\AppData\Local\Yandex\BrowserManager\x86\SQLite.Interop.dll, Quarantined, [777], [383595],1.0.6283 PUP.Optional.BrowserManager, C:\Users\{username}\AppData\Local\Yandex\BrowserManager\BrowserManager.Core.dll, Quarantined, [777], [383595],1.0.6283 PUP.Optional.BrowserManager, C:\Users\{username}\AppData\Local\Yandex\BrowserManager\BrowserManager.Core.UI.dll, Quarantined, [777], [383595],1.0.6283 PUP.Optional.BrowserManager, C:\Users\{username}\AppData\Local\Yandex\BrowserManager\BrowserManager.exe, Quarantined, [777], [383595],1.0.6283 PUP.Optional.BrowserManager, C:\Users\{username}\AppData\Local\Yandex\BrowserManager\Crypto.Core.dll, Quarantined, [777], [383595],1.0.6283 PUP.Optional.BrowserManager, C:\Users\{username}\AppData\Local\Yandex\BrowserManager\MBlauncher.exe, Quarantined, [777], [383595],1.0.6283 PUP.Optional.BrowserManager, C:\Users\{username}\AppData\Local\Yandex\BrowserManager\MBlauncher_x64.exe, Quarantined, [777], [383595],1.0.6283 PUP.Optional.BrowserManager, C:\Users\{username}\AppData\Local\Yandex\BrowserManager\ModuleUpgrader.dll, Quarantined, [777], [383595],1.0.6283 PUP.Optional.BrowserManager, C:\Users\{username}\AppData\Local\Yandex\BrowserManager\ModuleUpgrader.dll.upgrade, Quarantined, [777], [383595],1.0.6283 PUP.Optional.BrowserManager, C:\Users\{username}\AppData\Local\Yandex\BrowserManager\NAudio.dll, Quarantined, [777], [383595],1.0.6283 PUP.Optional.BrowserManager, C:\Users\{username}\AppData\Local\Yandex\BrowserManager\Newtonsoft.Json.dll, Quarantined, [777], [383595],1.0.6283 PUP.Optional.BrowserManager, C:\Users\{username}\AppData\Local\Yandex\BrowserManager\NLog.dll, Quarantined, [777], [383595],1.0.6283 PUP.Optional.BrowserManager, C:\Users\{username}\AppData\Local\Yandex\BrowserManager\RefCheck.dll, Quarantined, [777], [383595],1.0.6283 PUP.Optional.BrowserManager, C:\Users\{username}\AppData\Local\Yandex\BrowserManager\System.Data.SQLite.dll, Quarantined, [777], [383595],1.0.6283 PUP.Optional.RussAd, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\ablpcikjmhamjanpibkccdmpoekjigja\2.0.4.15_0\contextLib\service.js, Quarantined, [291], [510332],1.0.6283 PUP.Optional.RussAd, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\ablpcikjmhamjanpibkccdmpoekjigja\2.0.4.15_0\icons\128.png, Quarantined, [291], [510332],1.0.6283 PUP.Optional.RussAd, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\ablpcikjmhamjanpibkccdmpoekjigja\2.0.4.15_0\icons\16.png, Quarantined, [291], [510332],1.0.6283 PUP.Optional.RussAd, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\ablpcikjmhamjanpibkccdmpoekjigja\2.0.4.15_0\icons\48.png, Quarantined, [291], [510332],1.0.6283 PUP.Optional.RussAd, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\ablpcikjmhamjanpibkccdmpoekjigja\2.0.4.15_0\lib\background.js, Quarantined, [291], [510332],1.0.6283 PUP.Optional.RussAd, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\ablpcikjmhamjanpibkccdmpoekjigja\2.0.4.15_0\lib\cookies.js, Quarantined, [291], [510332],1.0.6283 PUP.Optional.RussAd, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\ablpcikjmhamjanpibkccdmpoekjigja\2.0.4.15_0\own\var.js, Quarantined, [291], [510332],1.0.6283 PUP.Optional.RussAd, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\ablpcikjmhamjanpibkccdmpoekjigja\2.0.4.15_0\_locales\ru\messages.json, Quarantined, [291], [510332],1.0.6283 PUP.Optional.RussAd, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\ablpcikjmhamjanpibkccdmpoekjigja\2.0.4.15_0\_locales\tr\messages.json, Quarantined, [291], [510332],1.0.6283 PUP.Optional.RussAd, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\ablpcikjmhamjanpibkccdmpoekjigja\2.0.4.15_0\_locales\uk\messages.json, Quarantined, [291], [510332],1.0.6283 PUP.Optional.RussAd, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\ablpcikjmhamjanpibkccdmpoekjigja\2.0.4.15_0\_metadata\computed_hashes.json, Quarantined, [291], [510332],1.0.6283 PUP.Optional.RussAd, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\ablpcikjmhamjanpibkccdmpoekjigja\2.0.4.15_0\_metadata\verified_contents.json, Quarantined, [291], [510332],1.0.6283 PUP.Optional.RussAd, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\ablpcikjmhamjanpibkccdmpoekjigja\2.0.4.15_0\manifest.json, Quarantined, [291], [510332],1.0.6283 PUP.Optional.RussAd, C:\USERS\{username}\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Secure Preferences, Replaced, [291], [510332],1.0.6283 PUP.Optional.RussAd, C:\USERS\{username}\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Preferences, Replaced, [291], [510332],1.0.6283 PUP.Optional.Appset, C:\USERS\{username}\DESKTOP\AFTER DEATH.EXE, Quarantined, [4804], [550763],1.0.6283 Physical Sector: 0 (No malicious items detected) WMI: 0 (No malicious items detected) (end) As mentioned before the full version of Malwarebytes could have protected your computer against this threat.We use different ways of protecting your computer(s): Dynamically Blocks Malware Sites & Servers Malware Execution Prevention Save yourself the hassle and get protected.
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.