Jump to content

Removal instructions for Screenify


Recommended Posts

  • Staff
What is Screenify?

The Malwarebytes research team has determined that Screenify is adware. These adware applications display advertisements not originating from the sites you are browsing.

How do I know if my computer is affected by Screenify?

You may see this entry in your list of installed programs:

warning4.png

and this icon on your desktop:

icons.png

How did Screenify get on my computer?

Adware applications use different methods for distributing themselves. This particular one was offered as software to control your screen brightness.

How do I remove Screenify?

Our program Malwarebytes Anti-Malware can detect and remove this potentially unwanted program.
  • Please download Malwarebytes Anti-Malware to your desktop.
  • Double-click mbam-setup-version.exe and follow the prompts to install the program.
  • At the end, be sure a check-mark is placed next to the following:
    • Enable free trial of Malwarebytes Anti-Malware Premium
    • Launch Malwarebytes Anti-Malware
  • Then click Finish.
  • If an update is found, you will be prompted to download and install the latest version.
  • Once the program has loaded, select Scan now. Or select the Threat Scan from the Scan menu.
  • When the scan is complete , make sure that everything is set to "Quarantine", and click Apply Actions.
  • Reboot your computer if prompted.
Is there anything else I need to do to get rid of Screenify?
  • No, Malwarebytes' Anti-Malware removes Screenify completely.
How would the full version of Malwarebytes Anti-Malware help protect me?

We hope our application and this guide have helped you eradicate this hijacker.

As you can see below the full version of Malwarebytes Anti-Malware would have protected you against the Screenify adware. It would have warned you before the adware could install itself, giving you a chance to stop it before it became too late.

 

protection1.png


and it blocks some of the outgoing connections the adware tries to make:
 

protection2.png


Technical details for experts

Possible signs in FRST logs:
 
 () C:\Users\{username}\AppData\Local\Apps\2.\abril.exe
 () C:\Program Files (x86)\Screenify\Screenify.exe
 HKLM\...\Run: [IDSCCOMNAB] => "C:\Program Files (x86)\Screenify\idsccom_NAB.exe"
 HKLM\...\RunOnce: [IDSCPRODUCT] => C:\Program Files (x86)\Screenify\idscservice.exe [289792 2016-04-13] ()
 R2 ProntSpooler; C:\Users\{username}\AppData\Local\Apps\2.\abril.exe [124928 2016-04-07] () [File not signed]
 C:\Users\{username}\AppData\Local\csdi_monetize_120160408
 C:\Users\{username}\AppData\Local\Apps\2.
 C:\Program Files (x86)\Screenify
 C:\Users\{username}\Desktop\Screenify.lnk
 C:\Users\{username}\AppData\Local\Temp\AZV53KQAJ7.exe
 
Screenify version 1.0 (HKLM-x32\...\Screenify_is1) (Version: 1.0 - CSDI)
() C:\Program Files (x86)\Screenify\LinqBridge.dll
Alterations made by the installer:
File system details [View: All details] (Selection)
---------------------------------------------------
    Adds the folder C:\Program Files (x86)\Screenify
       Adds the file config.conf"="4/13/2016 8:16 AM, 11 bytes, A
       Adds the file idsccom_NAB.exe"="4/13/2016 8:15 AM, 3954688 bytes, A
       Adds the file idscservice.exe"="4/13/2016 8:15 AM, 289792 bytes, A
       Adds the file LinqBridge.dll"="2/22/2016 9:18 AM, 62976 bytes, A
       Adds the file Screenify.exe"="3/9/2016 11:20 AM, 661504 bytes, A
       Adds the file unins000.dat"="4/13/2016 8:15 AM, 1946 bytes, A
       Adds the file unins000.exe"="4/13/2016 8:15 AM, 718497 bytes, A
       Adds the file uninstaller.exe"="4/13/2016 8:16 AM, 830976 bytes, A
    Adds the folder C:\Users\{username}\AppData\Local\Apps\2.
       Adds the file 367259cff71711e590c70616440bcd7d.sts"="3/8/2016 2:12 PM,  bytes, A
       Adds the file abril.exe"="4/7/2016 10:02 AM, 124928 bytes, A
       Adds the file abril.InstallLog"="4/13/2016 8:16 AM, 705 bytes, A
       Adds the file abril.InstallState"="4/13/2016 8:16 AM, 5012 bytes, A
       Adds the file InstallUtil.InstallLog"="4/13/2016 8:16 AM, 656 bytes, A
    Adds the folder C:\Users\{username}\AppData\Local\csdi_monetize_120160408\csdi_monetize_120160408\1.10
       Adds the file cnf.cyl"="4/13/2016 8:16 AM, 131 bytes, A
    In the existing folder C:\Users\{username}\Desktop
       Adds the file Screenify.lnk"="4/13/2016 8:15 AM, 1019 bytes, A

Registry details [View: All details] (Selection)
------------------------------------------------
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\{1f7ee1a8-4436-4ffc-b97b-b5b01e87d3d2}]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
       "IDSCCOMNAB"="REG_SZ", ""C:\Program Files (x86)\Screenify\idsccom_NAB.exe""
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
       "IDSCPRODUCT"="REG_SZ", ""C:\Program Files (x86)\Screenify\idscservice.exe""
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Screenify_is1]
       "DisplayName"="REG_SZ", "Screenify version 1.0"
       "DisplayVersion"="REG_SZ", "1.0"
       "EstimatedSize"="REG_DWORD", 1398
       "Inno Setup: App Path"="REG_SZ", "C:\Program Files (x86)\Screenify"
       "Inno Setup: Deselected Tasks"="REG_SZ", "desktopicon"
       "Inno Setup: Icon Group"="REG_SZ", "Screenify"
       "Inno Setup: Language"="REG_SZ", "english"
       "Inno Setup: Selected Tasks"="REG_SZ", ""
       "Inno Setup: Setup Version"="REG_SZ", "5.5.4 (a)"
       "Inno Setup: User"="REG_SZ", "{username}"
       "InstallDate"="REG_SZ", "20160413"
       "InstallLocation"="REG_SZ", "C:\Program Files (x86)\Screenify\"
       "MajorVersion"="REG_DWORD", 1
       "MinorVersion"="REG_DWORD", 0
       "NoModify"="REG_DWORD", 1
       "NoRepair"="REG_DWORD", 1
       "Publisher"="REG_SZ", "CSDI"
       "QuietUninstallString"="REG_SZ", ""C:\Program Files (x86)\Screenify\unins000.exe" /SILENT"
       "UninstallString"="REG_SZ", "C:\Program Files (x86)\Screenify\uninstaller.exe"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog\Application\ProntSpooler]
       "EventMessageFile"="REG_EXPAND_SZ, "C:\Windows\Microsoft.NET\Framework\v2.0.50727\EventLogMessages.dll"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\ProntSpooler]
       "Description"="REG_SZ", "This service provides support form reading mass-storage devices using Peer Name Resolution to query performance counter of system-level reports. If this service os disabled, any services that explicitly depend on it will fail to start."
       "DisplayName"="REG_SZ", "Pront Spooler"
       "ErrorControl"="REG_DWORD", 1
       "ImagePath"="REG_EXPAND_SZ, ""C:\Users\{username}\AppData\Local\Apps\2.0\abril.exe""
       "ObjectName"="REG_SZ", "LocalSystem"
       "Start"="REG_DWORD", 2
       "Type"="REG_DWORD", 16
       "WOW64"="REG_DWORD", 1
    [HKEY_CURRENT_USER\Software\Microsoft\idsc]
       "channel"="REG_SZ", "3"
       "partner"="REG_SZ", "add"
       "product"="REG_SZ", "screenify"
Malwarebytes Anti-Malware log:
Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 4/13/2016
Scan Time: 8:30 AM
Logfile: mbamScreenify.txt
Administrator: Yes

Version: 2.2.1.1043
Malware Database: v2016.04.13.02
Rootkit Database: v2016.04.09.01
License: Premium
Malware Protection: Disabled
Malicious Website Protection: Enabled
Self-protection: Enabled

OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: {username}

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 363432
Time Elapsed: 14 min, 35 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 2
PUP.Optional.Screenify, C:\Program Files (x86)\Screenify\Screenify.exe, 2544, Delete-on-Reboot, [e76fbaf42a6f69cda6e3d05748ba4bb5]
PUP.Optional.ProntSpooler, C:\Users\{username}\AppData\Local\Apps\2.\abril.exe, 1668, Delete-on-Reboot, [8acc88265e3b4bebb918b3f10301b44c]

Modules: 
(No malicious items detected)

Registry Keys: 4
PUP.Optional.ProntSpooler, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\ProntSpooler, Quarantined, [8acc88265e3b4bebb918b3f10301b44c], 
PUP.Optional.Screenify, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\Screenify_is1, Quarantined, [2e28604e8a0f1e18e2f2574deb19c53b], 
PUP.Optional.ProntSpooler, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\EVENTLOG\APPLICATION\ProntSpooler, Quarantined, [cb8b3c726633ad89e1f1772d1aea3cc4], 
PUP.Optional.Screenify, HKCU\SOFTWARE\MICROSOFT\IDSC, Quarantined, [0254832b1e7be74fcb0a891bac58aa56], 

Registry Values: 3
PUP.Optional.Screenify, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE|IDSCPRODUCT, "C:\Program Files (x86)\Screenify\idscservice.exe", Quarantined, [2e28604e8a0f1e18e2f2574deb19c53b]
PUP.Optional.Tuto4PC, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|IDSCCOMNAB, "C:\Program Files (x86)\Screenify\idsccom_NAB.exe", Quarantined, [cc8a3f6f8f0a3ff790a9c767a26132ce]
PUP.Optional.Screenify, HKCU\SOFTWARE\MICROSOFT\IDSC|product, screenify, Quarantined, [0254832b1e7be74fcb0a891bac58aa56]

Registry Data: 
(No malicious items detected)

Folders: 4
PUP.Optional.Screenify, C:\Program Files (x86)\Screenify, Delete-on-Reboot, [2e28604e8a0f1e18e2f2574deb19c53b], 
PUP.Optional.Tuto4PC, C:\Users\{username}\AppData\Local\csdi_monetize_120160408, Quarantined, [d581e6c8c4d570c69501bb7258ab0df3], 
PUP.Optional.Tuto4PC, C:\Users\{username}\AppData\Local\csdi_monetize_120160408\csdi_monetize_120160408, Quarantined, [d581e6c8c4d570c69501bb7258ab0df3], 
PUP.Optional.Tuto4PC, C:\Users\{username}\AppData\Local\csdi_monetize_120160408\csdi_monetize_120160408\1.10, Quarantined, [d581e6c8c4d570c69501bb7258ab0df3], 

Files: 16
PUP.Optional.Screenify, C:\Program Files (x86)\Screenify\Screenify.exe, Delete-on-Reboot, [e76fbaf42a6f69cda6e3d05748ba4bb5], 
Trojan.Injector.MSIL, C:\Users\{username}\Desktop\Screenify.exe, Quarantined, [e571ddd1f1a839fd616999bf0bfad927], 
PUP.Optional.Cloud4PC, C:\Users\{username}\AppData\Local\Temp\AZV53KQAJ7.exe, Quarantined, [db7b248aa9f01f17bcd9174243c26e92], 
Trojan.FakeAlert, C:\Users\{username}\AppData\Local\Temp\G0GVHX0MEW\testversion.exe, Quarantined, [2f278b23fc9ddb5b08d098fc16eeff01], 
PUP.Optional.ProntSpooler, C:\Users\{username}\AppData\Local\Apps\2.\abril.exe, Delete-on-Reboot, [8acc88265e3b4bebb918b3f10301b44c], 
PUP.Optional.ProntSpooler, C:\Users\{username}\AppData\Local\Apps\2.\abril.InstallLog, Quarantined, [a4b2c1edcccd8aaca42d72327490728e], 
PUP.Optional.ProntSpooler, C:\Users\{username}\AppData\Local\Apps\2.\abril.InstallState, Quarantined, [be98941aadecf93dfdd4efb560a4d52b], 
PUP.Optional.Screenify, C:\Users\{username}\Desktop\Screenify.lnk, Quarantined, [3b1b1b9334651d19b61dbfe510f4cc34], 
PUP.Optional.Screenify, C:\Program Files (x86)\Screenify\unins000.dat, Quarantined, [2e28604e8a0f1e18e2f2574deb19c53b], 
PUP.Optional.Screenify, C:\Program Files (x86)\Screenify\config.conf, Quarantined, [2e28604e8a0f1e18e2f2574deb19c53b], 
PUP.Optional.Screenify, C:\Program Files (x86)\Screenify\idscservice.exe, Quarantined, [2e28604e8a0f1e18e2f2574deb19c53b], 
PUP.Optional.Screenify, C:\Program Files (x86)\Screenify\LinqBridge.dll, Delete-on-Reboot, [2e28604e8a0f1e18e2f2574deb19c53b], 
PUP.Optional.Screenify, C:\Program Files (x86)\Screenify\unins000.exe, Quarantined, [2e28604e8a0f1e18e2f2574deb19c53b], 
PUP.Optional.Screenify, C:\Program Files (x86)\Screenify\uninstaller.exe, Quarantined, [2e28604e8a0f1e18e2f2574deb19c53b], 
PUP.Optional.Tuto4PC, C:\Users\{username}\AppData\Local\csdi_monetize_120160408\csdi_monetize_120160408\1.10\cnf.cyl, Quarantined, [d581e6c8c4d570c69501bb7258ab0df3], 
PUP.Optional.Tuto4PC, C:\Users\{username}\AppData\Local\csdi_monetize_120160408\csdi_monetize_120160408\1.10\eorezo.cyl, Quarantined, [d581e6c8c4d570c69501bb7258ab0df3], 

Physical Sectors: 
(No malicious items detected)


(end)
As mentioned before the full version of Malwarebytes Anti-Malware could have protected your computer against this threat.
We use different ways of protecting your computer(s):
  • Dynamically Blocks Malware Sites & Servers
  • Malware Execution Prevention
Save yourself the hassle and get protected.
Link to post
Share on other sites

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.