Jump to content

Removal instructions for MobilePCStarterKit


Recommended Posts

  • Staff

What is MobilePCStarterKit?

The Malwarebytes research team has determined that MobilePCStarterKit is adware. These adware applications display advertisements not originating from the sites you are browsing.

How do I know if my computer is affected by MobilePCStarterKit?

You may see this entry in your list of installed programs:

warning4.png

and this warning during install:

main.png

How did MobilePCStarterKit get on my computer?

Adware applications use different methods for distributing themselves. This particular one was bundled with other software.

trick.png

How do I remove MobilePCStarterKit?

Our program Malwarebytes Anti-Malware can detect and remove this potentially unwanted program.

  • Please download Malwarebytes Anti-Malware to your desktop.
  • Double-click mbam-setup-version.exe and follow the prompts to install the program.
  • At the end, be sure a check-mark is placed next to the following:
    • Enable free trial of Malwarebytes Anti-Malware Premium
    • Launch Malwarebytes Anti-Malware
  • Then click Finish.
  • If an update is found, you will be prompted to download and install the latest version.
  • Once the program has loaded, select Scan now. Or select the Threat Scan from the Scan menu.
  • When the scan is complete , make sure that everything is set to "Quarantine", and click Apply Actions.
  • Reboot your computer if prompted.
Is there anything else I need to do to get rid of MobilePCStarterKit?
  • No, Malwarebytes' Anti-Malware removes MobilePCStarterKit completely.
How would the full version of Malwarebytes Anti-Malware help protect me?

We hope our application and this guide have helped you eradicate this adware application.

As you can see below the full version of Malwarebytes Anti-Malware would have protected you against the MobilePCStarterKit adware. It would have warned you before the application could install itself, giving you a chance to stop it before it became too late.

protection1.png

and it stops the connections the browser hijacker tries to make:

protection2.png

Technical details for experts

You will see these signs in a HijackThis log:

O4 - HKLM\..\Run: [mpck_en_004090164] "C:\Program Files (x86)\mpck_en_004090164\mpck_en_004090164.exe"O4 - HKLM\..\RunOnce: [upmpck_en_004090164.exe] C:\Users\{username}\AppData\Local\mpck_en_004090164\upmpck_en_004090164.exe -runonce
You may see these signs in FRST logs:

 () C:\Users\{username}\AppData\Local\mpck_en_004090164\upmpck_en_004090164.exe () C:\Program Files (x86)\mpck_en_004090164\mpck_en_004090164.exe HKLM-x32\...\Run: [mpck_en_004090164] => C:\Program Files (x86)\mpck_en_004090164\mpck_en_004090164.exe [4338864 2015-12-02] () HKLM-x32\...\RunOnce: [upmpck_en_004090164.exe] => C:\Users\{username}\AppData\Local\mpck_en_004090164\upmpck_en_004090164.exe [3283632 2015-12-02] () C:\Users\{username}\AppData\Local\mpck_en_004090164 C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MOBILEPCSTARTERKIT C:\Program Files (x86)\mpck_en_004090164MobilePCStarterKit 000.004090164 (HKLM-x32\...\mpck_en_004090164_is1) (Version:  - MOBILEPCSTARTERKIT) <==== ATTENTIONSetup (HKLM-x32\...\{7ADF667E-E14D-4D2C-827C-B0108F0D93BC}) (Version:  - ) <==== ATTENTION
Alterations made by the installer:

File system details [View: All details] (Selection)---------------------------------------------------    Adds the folder C:\Program Files (x86)\mpck_en_004090164       Adds the file mobilepcstarterkit_widget.exe"="02/12/2015 10:12, 3309568 bytes, A       Adds the file mpck_en_004090164.exe"="02/12/2015 11:59, 4338864 bytes, A       Adds the file predm.exe"="02/12/2015 10:18, 689504 bytes, A       Adds the file unins000.dat"="07/12/2015 08:44, 128005 bytes, A       Adds the file unins000.exe"="07/12/2015 08:44, 718515 bytes, A    Adds the folder C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MOBILEPCSTARTERKIT       Adds the file MobilePCStarterKit.lnk"="07/12/2015 08:44, 1173 bytes, A    Adds the folder C:\Users\{username}\AppData\Local\mpck_en_004090164       Adds the file upmpck_en_004090164.cyl"="07/12/2015 08:47, 600 bytes, A       Adds the file upmpck_en_004090164.exe"="02/12/2015 11:59, 3283632 bytes, A       Adds the file user_profil.cyp"="07/12/2015 08:47, 1996 bytes, A    Adds the folder C:\Users\{username}\AppData\Local\mpck_en_004090164\mpck_en_004090164\1.40       Adds the file cnf.cyl"="07/12/2015 08:44, 131 bytes, ARegistry details [View: All details] (Selection)------------------------------------------------    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]       "mpck_en_004090164"="REG_SZ", ""C:\Program Files (x86)\mpck_en_004090164\mpck_en_004090164.exe""    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce]       "upmpck_en_004090164.exe"="REG_SZ", "C:\Users\{username}\AppData\Local\mpck_en_004090164\upmpck_en_004090164.exe -runonce"    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{7ADF667E-E14D-4D2C-827C-B0108F0D93BC}]       "DisplayName"="REG_SZ", "Setup"    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\mpck_en_004090164_is1]       "DisplayName"="REG_SZ", "MobilePCStarterKit 000.004090164"       "EstimatedSize"="REG_DWORD", 5806       "HelpLink"="REG_SZ", "http://en.mobilepcstarterkit.com"       "Inno Setup: App Path"="REG_SZ", "C:\Program Files (x86)\mpck_en_004090164"       "Inno Setup: Icon Group"="REG_SZ", "MOBILEPCSTARTERKIT"       "Inno Setup: Language"="REG_SZ", "en"       "Inno Setup: Setup Version"="REG_SZ", "5.5.4 (a)"       "Inno Setup: User"="REG_SZ", "{username}"       "InstallDate"="REG_SZ", "20151207"       "InstallLocation"="REG_SZ", "C:\Program Files (x86)\mpck_en_004090164\"       "NoModify"="REG_DWORD", 1       "NoRepair"="REG_DWORD", 1       "Publisher"="REG_SZ", "MOBILEPCSTARTERKIT"       "QuietUninstallString"="REG_SZ", ""C:\Program Files (x86)\mpck_en_004090164\unins000.exe" /SILENT"       "UninstallString"="REG_SZ", ""C:\Program Files (x86)\mpck_en_004090164\unins000.exe""       "URLInfoAbout"="REG_SZ", "http://en.mobilepcstarterkit.com"       "URLUpdateInfo"="REG_SZ", "http://en.mobilepcstarterkit.com"    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MOBILEPCSTARTERKIT\mpck_en_004090164]       "PathInstall"="REG_SZ", "C:\Program Files (x86)\mpck_en_004090164"    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Tutorials]       "HostGUID"="REG_SZ", "7E82D42A-C473-4F34-B063-E2F0A1B30435"    [HKEY_CURRENT_USER\Software\Microsoft\Tinstalls]       "20151207"="REG_SZ", "1"    [HKEY_CURRENT_USER\Software\Tutorials\updatetutorialeshp]       "(Default)"="REG_SZ", "mpck_en_004090164"       "MainDir"="REG_SZ", "C:\Users\{username}\AppData\Local\mpck_en_004090164"       "version"="REG_SZ", "mpck_en_004090164"    [HKEY_CURRENT_USER\Software\Tutorials\updatetutorialshp]       "MainDir"="REG_SZ", ""    [HKEY_CURRENT_USER\Software\Tutorials\updv]       "version"="REG_SZ", "15.12.02"    [HKEY_CURRENT_USER\Software\TutoTag]       "AgenceInstalledYet"="REG_SZ", "true"       "appv"="REG_SZ", "1.40"       "OnceInstalled"="REG_SZ", "en"       "OnceInstalled2"="REG_SZ", "en"
Malwarebytes Anti-Malware log:

Malwarebytes Anti-Malwarewww.malwarebytes.orgScan Date: 07/12/2015Scan Time: 09:04Logfile: mbamMobilePCStarterKit.txtAdministrator: YesVersion: 2.2.0.1020Malware Database: v2015.12.07.01Rootkit Database: v2015.11.26.01License: PremiumMalware Protection: EnabledMalicious Website Protection: EnabledSelf-protection: DisabledOS: Windows 7 Service Pack 1CPU: x64File System: NTFSUser: {username}Scan Type: Threat ScanResult: CompletedObjects Scanned: 311366Time Elapsed: 4 min, 59 secMemory: EnabledStartup: EnabledFilesystem: EnabledArchives: EnabledRootkits: EnabledHeuristics: EnabledPUP: EnabledPUM: EnabledProcesses: 3Adware.EoRezo, C:\Program Files (x86)\mpck_en_004090164\mpck_en_004090164.exe, 2956, Delete-on-Reboot, [da6302a0d9b280b676cd0679000139c7]PUP.Optional.MobilePCStarterKit, C:\Program Files (x86)\mpck_en_004090164\mpck_en_004090164.exe, 2956, Delete-on-Reboot, [1f1e12908b00b680018da2fae320ec14]PUP.Optional.MobilePCStarterKit, C:\Users\{username}\AppData\Local\mpck_en_004090164\upmpck_en_004090164.exe, 1668, Delete-on-Reboot, [d8653c66dab1b482428c2d5c7d85c739]Modules: 0(No malicious items detected)Registry Keys: 8PUP.Optional.MobilePCStarterKit, HKLM\SOFTWARE\WOW6432NODE\MOBILEPCSTARTERKIT, Quarantined, [1a23633fa5e62412eca65f3d6d9612ee], PUP.Optional.MobilePCStarterKit, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\mpck_en_004090164_is1, Quarantined, [122b673b1d6e84b2e0b14c50d52ebb45], PUP.Optional.MySearch123, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{7ADF667E-E14D-4D2C-827C-B0108F0D93BC}, Quarantined, [71cc970b810ab77fc8a3df123fc4718f], PUP.Optional.Tuto4PC, HKLM\SOFTWARE\WOW6432NODE\TUTORIALS, Quarantined, [e558ddc50d7e9b9b88a9b2010102c937], PUP.Optional.Tuto4PC, HKCU\SOFTWARE\TutoTag, Quarantined, [55e8f6ac6229ee4884a94f6440c38f71], PUP.Optional.Tuto4PC, HKCU\SOFTWARE\TUTORIALS\updatetutorialeshp, Quarantined, [6cd1a5fdb9d20135d258278c6a991ae6], PUP.Optional.Tuto4PC, HKCU\SOFTWARE\TUTORIALS\updatetutorialshp, Quarantined, [201dcdd5ec9fd66086a5219249ba9b65], PUP.Optional.Tuto4PC, HKCU\SOFTWARE\TUTORIALS\updv, Quarantined, [26175f43315a66d00626159e6c97fd03], Registry Values: 4Adware.EoRezo, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|mpck_en_004090164, "C:\Program Files (x86)\mpck_en_004090164\mpck_en_004090164.exe", Quarantined, [da6302a0d9b280b676cd0679000139c7]PUP.Optional.MobilePCStarterKit, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|mpck_en_004090164, "C:\Program Files (x86)\mpck_en_004090164\mpck_en_004090164.exe", Quarantined, [1f1e12908b00b680018da2fae320ec14]PUP.Optional.Tuto4PC, HKLM\SOFTWARE\WOW6432NODE\TUTORIALS|HostGUID, 7E82D42A-C473-4F34-B063-E2F0A1B30435, Quarantined, [e558ddc50d7e9b9b88a9b2010102c937]PUP.Optional.MobilePCStarterKit, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE|upmpck_en_004090164.exe, C:\Users\{username}\AppData\Local\mpck_en_004090164\upmpck_en_004090164.exe -runonce, Quarantined, [d8653c66dab1b482428c2d5c7d85c739]Registry Data: 0(No malicious items detected)Folders: 5PUP.Optional.MobilePCStarterKit, C:\Users\{username}\AppData\Local\mpck_en_004090164, Delete-on-Reboot, [d8653c66dab1b482428c2d5c7d85c739], PUP.Optional.MobilePCStarterKit, C:\Users\{username}\AppData\Local\mpck_en_004090164\mpck_en_004090164, Quarantined, [d8653c66dab1b482428c2d5c7d85c739], PUP.Optional.MobilePCStarterKit, C:\Users\{username}\AppData\Local\mpck_en_004090164\mpck_en_004090164\1.40, Quarantined, [d8653c66dab1b482428c2d5c7d85c739], PUP.Optional.MobilePCStarterKit, C:\Program Files (x86)\mpck_en_004090164, Delete-on-Reboot, [29142c76305b72c4ac237514a45e31cf], PUP.Optional.MobilePCStarterKit, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MOBILEPCSTARTERKIT, Quarantined, [84b9861c2764ed49cf01682172902fd1], Files: 13Adware.EoRezo, C:\Program Files (x86)\mpck_en_004090164\mpck_en_004090164.exe, Delete-on-Reboot, [da6302a0d9b280b676cd0679000139c7], PUP.Optional.Tuto4PC, C:\Users\{username}\Desktop\Tuto4PC mpck_en.exe, Quarantined, [94a9178bcdbe171fef6bd5e08d740bf5], PUP.Optional.Tuto4PC, C:\Program Files (x86)\mpck_en_004090164\predm.exe, Quarantined, [d568eeb4cfbce1552b1f8711ad57748c], PUP.Optional.MobilePCStarterKit, C:\Program Files (x86)\mpck_en_004090164\mpck_en_004090164.exe, Delete-on-Reboot, [1f1e12908b00b680018da2fae320ec14], PUP.Optional.MobilePCStarterKit, C:\Users\{username}\AppData\Local\mpck_en_004090164\upmpck_en_004090164.cyl, Quarantined, [d8653c66dab1b482428c2d5c7d85c739], PUP.Optional.MobilePCStarterKit, C:\Users\{username}\AppData\Local\mpck_en_004090164\upmpck_en_004090164.exe, Delete-on-Reboot, [d8653c66dab1b482428c2d5c7d85c739], PUP.Optional.MobilePCStarterKit, C:\Users\{username}\AppData\Local\mpck_en_004090164\user_profil.cyp, Quarantined, [d8653c66dab1b482428c2d5c7d85c739], PUP.Optional.MobilePCStarterKit, C:\Users\{username}\AppData\Local\mpck_en_004090164\mpck_en_004090164\1.40\cnf.cyl, Quarantined, [d8653c66dab1b482428c2d5c7d85c739], PUP.Optional.MobilePCStarterKit, C:\Users\{username}\AppData\Local\mpck_en_004090164\mpck_en_004090164\1.40\eorezo.cyl, Quarantined, [d8653c66dab1b482428c2d5c7d85c739], PUP.Optional.MobilePCStarterKit, C:\Program Files (x86)\mpck_en_004090164\mobilepcstarterkit_widget.exe, Quarantined, [29142c76305b72c4ac237514a45e31cf], PUP.Optional.MobilePCStarterKit, C:\Program Files (x86)\mpck_en_004090164\unins000.dat, Quarantined, [29142c76305b72c4ac237514a45e31cf], PUP.Optional.MobilePCStarterKit, C:\Program Files (x86)\mpck_en_004090164\unins000.exe, Quarantined, [29142c76305b72c4ac237514a45e31cf], PUP.Optional.MobilePCStarterKit, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MOBILEPCSTARTERKIT\MobilePCStarterKit.lnk, Quarantined, [84b9861c2764ed49cf01682172902fd1], Physical Sectors: 0(No malicious items detected)(end)
As mentioned before the full version of Malwarebytes Anti-Malware could have protected your computer against this threat.

We use different ways of protecting your computer(s):

  • Dynamically Blocks Malware Sites & Servers
  • Malware Execution Prevention
Save yourself the hassle and get protected.
Link to post
Share on other sites

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.