Jump to content

Removal instructions for Window User Manager


Recommended Posts

  • Staff
What is Window User Manager?

The Malwarebytes research team has determined that Window User Manager is adware. These adware applications display advertisements not originating from the sites you are browsing.

How do I know if my computer is affected by Window User Manager?

You may see this entry in your list of installed programs:

warning4.png

How did Window User Manager get on my computer?

Adware applications use different methods for distributing themselves. This particular one was bundled with other software.

How do I remove Window User Manager?

Our program Malwarebytes Anti-Malware can detect and remove this potentially unwanted program.
  • Please download Malwarebytes Anti-Malware to your desktop.
  • Double-click mbam-setup-{version}.exe and follow the prompts to install the program.
  • At the end, be sure a check-mark is placed next to:
    Launch Malwarebytes Anti-Malware
  • Then click Finish.
  • Once the program has loaded, select Scan Now. Or select the Threat Scan from the Scan menu.
  • If an update is available, it will be implemented before the rest of the scanning procedure.
  • When the scan is complete, make sure that all Threats are selected, and click Remove Selected.
  • Restart your computer when prompted to do so.
Is there anything else I need to do to get rid of Window User Manager?
  • No, Malwarebytes' Anti-Malware removes Window User Manager completely.
How would the full version of Malwarebytes Anti-Malware help protect me?

We hope our application and this guide have helped you eradicate this adware.

As you can see below the full version of Malwarebytes Anti-Malware would have protected you against the Window User Manager adware. It would have warned you before the adware could install itself, giving you a chance to stop it before it became too late.

 

protection1.png


The web protection module also blocks some of the connections the installer tries to make:
 

protection2.png


Technical details for experts

Possible signs in FRST logs:
 
 (FLC Soft) C:\Program Files (x86)\winuse\WinUserSync.exe
 (FLC Soft) C:\Program Files (x86)\winuse\WinUserSync_.exe
 (FLC Soft) C:\Program Files (x86)\winuse\WinUse_.exe
 (FLC Soft) C:\Program Files (x86)\winuse\WinUse.exe
 R2 WinUseSvc; C:\Program Files (x86)\winuse\WinUserSync.exe [134656 2016-09-19] (FLC Soft) [File not signed]
 R2 WinUseSvc2; C:\Program Files (x86)\winuse\WinUserSync_.exe [128512 2016-09-19] (FLC Soft) [File not signed]
 C:\Program Files (x86)\winuse

Window User Manager (HKLM-x32\...\Window User Manager) (Version: 1.72 - FLC Soft)
() C:\Program Files (x86)\WinUse\libcef.dll
Alterations made by the installer:
File system details [View: All details] (Selection)
---------------------------------------------------
    Adds the folder C:\Program Files (x86)\winuse
       Adds the file cef.pak"="6/20/2016 8:37 AM, 2749972 bytes, A
       Adds the file cef_100_percent.pak"="6/20/2016 8:37 AM, 146067 bytes, A
       Adds the file cef_200_percent.pak"="6/20/2016 8:37 AM, 235262 bytes, A
       Adds the file cef_extensions.pak"="6/20/2016 8:37 AM, 4409164 bytes, A
       Adds the file d3dcompiler_43.dll"="6/20/2016 8:37 AM, 2106216 bytes, A
       Adds the file d3dcompiler_47.dll"="6/20/2016 8:37 AM, 3709120 bytes, A
       Adds the file devtools_resources.pak"="6/20/2016 8:37 AM, 4740603 bytes, A
       Adds the file icudtl.dat"="6/20/2016 8:37 AM, 10127152 bytes, A
       Adds the file libcef.dll"="6/20/2016 8:37 AM, 52043776 bytes, A
       Adds the file libcurl.dll"="10/27/2014 6:11 PM, 1358336 bytes, A
       Adds the file libEGL.dll"="6/20/2016 8:37 AM, 80384 bytes, A
       Adds the file libGLESv2.dll"="6/20/2016 8:37 AM, 1734656 bytes, A
       Adds the file log4cplusU.dll"="1/14/2015 11:55 AM, 386560 bytes, A
       Adds the file msvcp120.dll"="11/24/2014 9:23 AM, 455328 bytes, A
       Adds the file msvcr120.dll"="11/24/2014 9:23 AM, 970912 bytes, A
       Adds the file natives_blob.bin"="6/20/2016 8:37 AM, 415490 bytes, A
       Adds the file snapshot_blob.bin"="6/20/2016 8:37 AM, 517972 bytes, A
       Adds the file Uninstall.exe"="9/20/2016 10:45 AM, 189958 bytes, A
       Adds the file widevinecdmadapter.dll"="6/20/2016 8:37 AM, 212992 bytes, A
       Adds the file WinUse.exe"="9/19/2016 7:53 PM, 680448 bytes, A
       Adds the file WinUse_.exe"="9/19/2016 7:35 PM, 662528 bytes, A
       Adds the file WinUserSync.exe"="9/19/2016 4:34 PM, 134656 bytes, A
       Adds the file WinUserSync_.exe"="9/19/2016 4:37 PM, 128512 bytes, A
       Adds the file winusertask.exe"="9/19/2016 4:27 PM, 1890304 bytes, A
       Adds the file winusertask_.exe"="9/19/2016 4:29 PM, 1822208 bytes, A
       Adds the file wow_helper.exe"="5/13/2016 9:59 AM, 67072 bytes, A
    Adds the folder C:\Program Files (x86)\winuse\che
       Adds the file Cookies"="9/20/2016 10:45 AM, 7168 bytes, A
       Adds the file Cookies-journal"="9/20/2016 10:45 AM, 0 bytes, A
       Adds the file data_0"="9/20/2016 10:45 AM, 45056 bytes, A
       Adds the file f_00001b"="9/20/2016 10:46 AM, 27658 bytes, A
       Adds the file index"="9/20/2016 10:45 AM, 262512 bytes, A
       Adds the file Visited Links"="9/20/2016 10:45 AM, 131072 bytes, A
    Adds the folder C:\Program Files (x86)\winuse\che\GPUCache
       Adds the file data_0"="9/20/2016 10:45 AM, 8192 bytes, A
       Adds the file index"="9/20/2016 10:45 AM, 262512 bytes, A
    Adds the folder C:\Program Files (x86)\winuse\che1
       Adds the file Cookies"="9/20/2016 10:45 AM, 7168 bytes, A
       Adds the file Cookies-journal"="9/20/2016 10:45 AM, 0 bytes, A
       Adds the file data_0"="9/20/2016 10:45 AM, 45056 bytes, A
       Adds the file f_000018"="9/20/2016 10:46 AM, 71508 bytes, A
       Adds the file index"="9/20/2016 10:45 AM, 262512 bytes, A
       Adds the file Visited Links"="9/20/2016 10:45 AM, 131072 bytes, A
    Adds the folder C:\Program Files (x86)\winuse\che1\GPUCache
       Adds the file data_0"="9/20/2016 10:45 AM, 8192 bytes, A
       Adds the file data_1"="9/20/2016 10:45 AM, 270336 bytes, A
       Adds the file data_2"="9/20/2016 10:45 AM, 8192 bytes, A
       Adds the file data_3"="9/20/2016 10:45 AM, 8192 bytes, A
       Adds the file index"="9/20/2016 10:45 AM, 262512 bytes, A
    Adds the folder C:\Program Files (x86)\winuse\locales
    Adds the folder C:\Program Files (x86)\winuse\plugins
       Adds the file pepflashplayer.dll"="6/30/2016 3:25 AM, 31555776 bytes, A
    Adds the folder C:\Program Files (x86)\winuse\Update
    Adds the folder C:\Users\{username}\AppData\Local\CEF\User Data\Dictionaries

Registry details [View: All details] (Selection)
------------------------------------------------
    [HKEY_LOCAL_MACHINE\SOFTWARE\okwinuse]
       "ID"="REG_SZ"", "3D02DFE1-1DFE-4E12-8766-5B8D7B480922"
       "InstallAMID"="REG_SZ"", ""
       "InstallSID"="REG_SZ"", ""
       "Version"="REG_SZ"", "172"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Window User Manager]
       "DisplayName"="REG_SZ"", "Window User Manager"
       "DisplayVersion"="REG_SZ"", "1.72"
       "EstimatedSize"="REG_DWORD"", 94776
       "InstallDate"="REG_SZ"", "20150920"
       "Publisher"="REG_SZ"", "FLC Soft"
       "UninstallString"="REG_SZ"", ""C:\Program Files (x86)\winuse\uninstall.exe""
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\okwinuse]
       "ID"="REG_SZ"", "3D02DFE1-1DFE-4E12-8766-5B8D7B480922"
       "InstallAMID"="REG_SZ"", "0"
       "InstallDate"="REG_SZ"", "20.09.2016 10:45"
       "InstallSID"="REG_SZ"", ""
       "restart1"="REG_SZ"", "1"
       "restart2"="REG_SZ"", "1"
       "Success"="REG_SZ"", "1"
       "Version"="REG_SZ"", "172"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\WinUseSvc]
       "DisplayName"="REG_SZ"", "Window User Manager"
       "ErrorControl"="REG_DWORD"", 1
       "ImagePath"="REG_EXPAND_SZ, "C:\Program Files (x86)\winuse\WinUserSync.exe"
       "ObjectName"="REG_SZ"", "LocalSystem"
       "Start"="REG_DWORD"", 2
       "Type"="REG_DWORD"", 16
       "WOW64"="REG_DWORD"", 1
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\WinUseSvc2]
       "DisplayName"="REG_SZ"", "Window User Manager2"
       "ErrorControl"="REG_DWORD"", 1
       "ImagePath"="REG_EXPAND_SZ, "C:\Program Files (x86)\winuse\WinUserSync_.exe"
       "ObjectName"="REG_SZ"", "LocalSystem"
       "Start"="REG_DWORD"", 2
       "Type"="REG_DWORD"", 16
       "WOW64"="REG_DWORD"", 1
    [HKEY_CURRENT_USER\Software\winmnt]
       "Success"="REG_SZ"", "1"
Malwarebytes Anti-Malware log:
Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 9/21/2016
Scan Time: 9:22 AM
Logfile: mbamWindowUserManager.txt
Administrator: Yes

Version: 2.2.1.1043
Malware Database: v2016.09.21.04
Rootkit Database: v2016.08.15.01
License: Premium
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Enabled

OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: {username}

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 321774
Time Elapsed: 10 min, 3 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 6
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\WinUse.exe, 3140, Delete-on-Reboot, [4385165ef6a431050712aa4a24e0f30d]
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\WinUse.exe, 2652, Delete-on-Reboot, [4385165ef6a431050712aa4a24e0f30d]
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\WinUserSync.exe, 3496, Delete-on-Reboot, [4385165ef6a431050712aa4a24e0f30d]
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\WinUserSync_.exe, 1408, Delete-on-Reboot, [4385165ef6a431050712aa4a24e0f30d]
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\WinUse_.exe, 3952, Delete-on-Reboot, [4385165ef6a431050712aa4a24e0f30d]
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\WinUse_.exe, 3992, Delete-on-Reboot, [4385165ef6a431050712aa4a24e0f30d]

Modules: 9
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\libcef.dll, Delete-on-Reboot, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\libcef.dll, Delete-on-Reboot, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\libcef.dll, Delete-on-Reboot, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\libcef.dll, Delete-on-Reboot, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\libcurl.dll, Delete-on-Reboot, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\libcurl.dll, Delete-on-Reboot, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\libcurl.dll, Delete-on-Reboot, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\libcurl.dll, Delete-on-Reboot, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\libcurl.dll, Delete-on-Reboot, [4385165ef6a431050712aa4a24e0f30d], 

Registry Keys: 5
PUP.Optional.WinUse, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\Window User Manager, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\WinUseSvc, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\WinUseSvc2, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, HKLM\SOFTWARE\OKWINUSE, Quarantined, [9b2d95df1a80f1456eb41bd9798b8d73], 
PUP.Optional.WinUse, HKLM\SOFTWARE\WOW6432NODE\OKWINUSE, Quarantined, [3a8ea3d17822ae885bc7c52f9c682fd1], 

Registry Values: 3
PUP.Optional.WinUse, HKLM\SOFTWARE\OKWINUSE|Version, 172, Quarantined, [9b2d95df1a80f1456eb41bd9798b8d73]
PUP.Optional.WinUse, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\WINDOW USER MANAGER|UninstallString, "C:\Program Files (x86)\winuse\uninstall.exe", Quarantined, [83455b194654ba7c74a952a2e81c837d]
PUP.Optional.WinUse, HKLM\SOFTWARE\WOW6432NODE\OKWINUSE|Version, 172, Quarantined, [3a8ea3d17822ae885bc7c52f9c682fd1]

Registry Data: 0
(No malicious items detected)

Folders: 8
PUP.Optional.WinUse, C:\Program Files (x86)\winuse, Delete-on-Reboot, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\che, Delete-on-Reboot, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\che\GPUCache, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\che1, Delete-on-Reboot, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\che1\GPUCache, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\locales, Delete-on-Reboot, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\plugins, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\Update, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 

Files: 179
PUP.Optional.WinUse, C:\Users\{username}\Desktop\install.exe, Quarantined, [4d7bb6be97039a9c46c36094cd3711ef], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\libcef.dll, Delete-on-Reboot, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\libGLESv2.dll, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\cef.pak, Delete-on-Reboot, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\cef_100_percent.pak, Delete-on-Reboot, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\cef_200_percent.pak, Delete-on-Reboot, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\cef_extensions.pak, Delete-on-Reboot, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\d3dcompiler_43.dll, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\d3dcompiler_47.dll, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\devtools_resources.pak, Delete-on-Reboot, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\icudtl.dat, Delete-on-Reboot, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\libcurl.dll, Delete-on-Reboot, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\libEGL.dll, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\log4cplusU.dll, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\msvcp120.dll, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\msvcr120.dll, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\natives_blob.bin, Delete-on-Reboot, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\snapshot_blob.bin, Delete-on-Reboot, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\Uninstall.exe, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\widevinecdmadapter.dll, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\WinUse.exe, Delete-on-Reboot, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\WinUserSync.exe, Delete-on-Reboot, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\WinUserSync_.exe, Delete-on-Reboot, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\winusertask.exe, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\winusertask_.exe, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\WinUse_.exe, Delete-on-Reboot, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\wow_helper.exe, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\che\f_00000d, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\che\f_000021, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\che\Cookies, Delete-on-Reboot, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\che\Cookies-journal, Delete-on-Reboot, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\che\data_0, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\che\data_1, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\che\data_2, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\che\data_3, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\che\f_000001, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\che\f_000002, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\che\f_000003, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\che\f_000004, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\che\f_000005, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\che\f_000006, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\che\f_000007, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\che\f_000008, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\che\f_000009, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\che\f_00000a, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\che\f_00000b, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\che\f_00000c, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\che\f_00000e, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\che\f_00000f, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\che\f_000010, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\che\f_000011, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\che\f_000012, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\che\f_000013, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\che\f_000014, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\che\f_000015, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\che\f_000016, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\che\f_000017, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\che\f_000018, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\che\f_000019, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\che\f_00001a, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\che\f_00001b, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\che\f_00001c, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\che\f_00001d, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\che\f_00001e, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\che\f_00001f, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\che\f_000020, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\che\f_000022, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\che\f_000023, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\che\f_000024, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\che\f_000025, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\che\f_000026, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\che\f_000027, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\che\f_000028, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\che\f_000029, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\che\f_00002a, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\che\f_00002b, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\che\f_00002c, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\che\f_00002d, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\che\f_00002e, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\che\f_00002f, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\che\f_000030, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\che\f_000031, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\che\f_000032, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\che\f_000033, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\che\f_000034, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\che\f_000035, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\che\f_000036, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\che\f_000037, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\che\f_000038, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\che\f_000039, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\che\f_00003a, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\che\index, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\che\Visited Links, Delete-on-Reboot, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\che\GPUCache\data_0, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\che\GPUCache\data_1, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\che\GPUCache\data_2, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\che\GPUCache\data_3, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\che\GPUCache\index, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\che1\Cookies, Delete-on-Reboot, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\che1\Cookies-journal, Delete-on-Reboot, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\che1\data_0, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\che1\data_1, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\che1\data_2, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\che1\data_3, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\che1\f_000001, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\che1\f_000002, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\che1\f_000003, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\che1\f_000004, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\che1\f_000005, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\che1\f_000006, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\che1\f_000007, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\che1\f_000008, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\che1\f_000009, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\che1\f_00000a, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\che1\f_00000b, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\che1\f_00000c, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\che1\f_00000d, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\che1\f_00000e, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\che1\index, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\che1\Visited Links, Delete-on-Reboot, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\che1\GPUCache\data_0, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\che1\GPUCache\data_1, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\che1\GPUCache\data_2, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\che1\GPUCache\data_3, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\che1\GPUCache\index, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\locales\he.pak, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\locales\am.pak, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\locales\ar.pak, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\locales\bg.pak, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\locales\bn.pak, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\locales\ca.pak, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\locales\cs.pak, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\locales\da.pak, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\locales\de.pak, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\locales\el.pak, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\locales\en-GB.pak, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\locales\en-US.pak, Delete-on-Reboot, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\locales\es-419.pak, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\locales\es.pak, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\locales\et.pak, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\locales\fa.pak, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\locales\fi.pak, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\locales\fil.pak, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\locales\fr.pak, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\locales\gu.pak, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\locales\hi.pak, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\locales\hr.pak, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\locales\hu.pak, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\locales\id.pak, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\locales\it.pak, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\locales\ja.pak, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\locales\kn.pak, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\locales\ko.pak, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\locales\lt.pak, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\locales\lv.pak, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\locales\ml.pak, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\locales\mr.pak, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\locales\ms.pak, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\locales\nb.pak, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\locales\nl.pak, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\locales\pl.pak, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\locales\pt-BR.pak, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\locales\pt-PT.pak, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\locales\ro.pak, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\locales\ru.pak, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\locales\sk.pak, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\locales\sl.pak, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\locales\sr.pak, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\locales\sv.pak, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\locales\sw.pak, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\locales\ta.pak, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\locales\te.pak, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\locales\th.pak, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\locales\tr.pak, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\locales\uk.pak, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\locales\vi.pak, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\locales\zh-CN.pak, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\locales\zh-TW.pak, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 
PUP.Optional.WinUse, C:\Program Files (x86)\winuse\plugins\pepflashplayer.dll, Quarantined, [4385165ef6a431050712aa4a24e0f30d], 

Physical Sectors: 0
(No malicious items detected)


(end)
As mentioned before the full version of Malwarebytes Anti-Malware could have protected your computer against this threat.
We use different ways of protecting your computer(s):
  • Dynamically Blocks Malware Sites & Servers
  • Malware Execution Prevention
Save yourself the hassle and get protected.
Edited by Metallica
Link to post
Share on other sites

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.