Jump to content

Recommended Posts

  • Staff

What is Photos Exif Editor?

Photos Exif Editor is a file utility that triggers our PUP detection rules. By doing so we offer users a choice to consider whether they want to use this software. More information can be found on our Malwarebytes Labs blog.

How do I know if I am affected by Photos Exif Editor?

This is how the main screen of the exif editor looks:

main.png

You will find these icons in your taskbar, your startmenu, and on your desktop:

icons.png

and see this type of windows during install:

warning1.png

warning2.png

and this type of screens during operations:

warning5.png

You may see this entry in your list of installed programs:

warning4.png

How did Photos Exif Editor get on my computer?

These potentially unwanted programs use different methods of getting installed. This particular one was downloaded from their website.

website.png

How do I remove Photos Exif Editor?

Our program Malwarebytes can detect and remove this PUP. It is better to use the built-in uninstaller first for a more complete removal.

  • Please download Malwarebytes for Windows to your desktop.
  • Double-click MBSetup.exe and follow the prompts to install the program.
  • When your Malwarebytes for Windows installation completes, the program opens to the Welcome to Malwarebytes screen.
  • Click on the Get started button.
  • Click Scan to start a Threat Scan.
  • When the scan is finished click Quarantine to remove the found threats.
  • Reboot the system if prompted to complete the removal process.

Is there anything else I need to do to get rid of Photos Exif Editor?

  • No, Malwarebytes removes Photos Exif Editor completely.

What if I want to keep Photos Exif Editor?

Should users wish to keep this program and exclude it from being detected in future scans, they can add the program to the exclusions list. Here’s how to do it.

  • Open Malwarebytes for Windows.
  • Click the Detection History
  • Click the Allow List
  • To add an item to the Allow List, click Add.
  • Select the exclusion type Allow a file or folder and use the Select a folder button to select the main folder for the software that you wish to keep.
  • Repeat this for any secondary files or folder(s) that belong to the software.

If you want to allow the program to connect to the Internet, for example to fetch updates, also add an exclusion of the type Allow an application to connect to the internet and use the Browse button to select the file you wish to grant access.

How would the full version of Malwarebytes help protect me?

We hope our application and this guide have helped you in dealing with this exif editor.

As you can see below the full version of Malwarebytes would have warned you against the Photos Exif Editor installer.
 

protection1.png

 

Technical details for experts

You may see these entries in FRST logs:


 

(SYSTWEAK SOFTWARE PVT. LTD. -> Systweak) C:\Program Files (x86)\Photos Exif Editor\PhotosExifEditor.exe
C:\Users\Public\Desktop\Photos Exif Editor.lnk
C:\ProgramData\Desktop\Photos Exif Editor.lnk
C:\Users\{username}\AppData\Roaming\Systweak
C:\Users\{username}\AppData\Roaming\SPEXD
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Photos Exif Editor
C:\Program Files (x86)\Photos Exif Editor
(Systweak ) C:\Users\{username}\Desktop\WinExifEditorInstaller.exe

Photos Exif Editor (HKLM-x32\...\Photos Exif Editor_is1) (Version: 1.0.0.9331 - Systweak) <==== ATTENTION

Alterations made by the installer:
 

File system details [View: All details] (Selection)
---------------------------------------------------
    Adds the folder C:\Program Files (x86)\Photos Exif Editor
       Adds the file countries.json"="5/7/2019 5:56 PM, 13034 bytes, A
       Adds the file eng_pee_en.ini"="12/5/2019 5:19 PM, 74406 bytes, A
       Adds the file Exiv2Net.dll"="12/23/2019 4:03 PM, 2143456 bytes, A
       Adds the file Newtonsoft.Json.dll"="5/7/2019 5:56 PM, 319488 bytes, A
       Adds the file PhotosExifEditor.exe"="12/23/2019 4:03 PM, 4642016 bytes, A
       Adds the file PhotosExifEditor.exe.config"="12/3/2019 10:11 AM, 3266 bytes, A
       Adds the file SQLite.Interop.dll"="5/7/2019 5:56 PM, 1480192 bytes, A
       Adds the file System.Data.SQLite.dll"="5/7/2019 5:56 PM, 331776 bytes, A
       Adds the file System.Threading.dll"="5/7/2019 5:56 PM, 387408 bytes, A
       Adds the file unins000.dat"="5/31/2021 8:27 AM, 94573 bytes, A
       Adds the file unins000.exe"="5/31/2021 8:26 AM, 2860768 bytes, A
       Adds the file unins000.msg"="5/31/2021 8:27 AM, 22829 bytes, A
       Adds the file WPFToolkit.dll"="3/5/2018 10:10 AM, 467288 bytes, A
       Adds the file Xceed.Wpf.Toolkit.dll"="3/5/2018 10:10 AM, 1106944 bytes, A
    Adds the folder C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Photos Exif Editor
       Adds the file Photos Exif Editor.lnk"="5/31/2021 8:27 AM, 1135 bytes, A
       Adds the file Uninstall Photos Exif Editor.lnk"="5/31/2021 8:27 AM, 1095 bytes, A
    Adds the folder C:\Users\{username}\AppData\Roaming\SPEXD
       Adds the file backup6.bin"="5/31/2021 8:27 AM, 513 bytes, A
    Adds the folder C:\Users\{username}\AppData\Roaming\Systweak\Photos Exif Editor
       Adds the file ExifEditor.db"="5/31/2021 8:27 AM, 32768 bytes, A
    Adds the folder C:\Users\{username}\AppData\Roaming\Systweak\Photos Exif Editor\1.0.0.9331
    Adds the folder C:\Users\{username}\AppData\Roaming\Systweak\Photos Exif Editor\Logs
       Adds the file PhotosExifEditor.txt"="5/31/2021 8:27 AM, 2454 bytes, A
       Adds the file PhotosExifEditor_1.txt"="5/31/2021 8:27 AM, 499 bytes, A
    In the existing folder C:\Users\Public\Desktop
       Adds the file Photos Exif Editor.lnk"="5/31/2021 8:27 AM, 1117 bytes, A

Registry details [View: All details] (Selection)
------------------------------------------------
    [HKEY_LOCAL_MACHINE\SOFTWARE\SPEXD\key\6]
       "(Default)"="REG_BINARY, .......................................................................................................................o............................................................................................................................H...........
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Photos Exif Editor_is1]
       "DisplayIcon"="REG_SZ", "C:\Program Files (x86)\Photos Exif Editor\PhotosExifEditor.exe"
       "DisplayName"="REG_SZ", "Photos Exif Editor"
       "DisplayVersion"="REG_SZ", "1.0.0.9331"
       "EstimatedSize"="REG_DWORD", 13505
       "HelpLink"="REG_SZ", "http://www.systweak.com/"
       "Inno Setup: App Path"="REG_SZ", "C:\Program Files (x86)\Photos Exif Editor"
       "Inno Setup: Icon Group"="REG_SZ", "Photos Exif Editor"
       "Inno Setup: Language"="REG_SZ", "en"
       "Inno Setup: Setup Version"="REG_SZ", "6.0.2 (u)"
       "Inno Setup: User"="REG_SZ", "{username}"
       "InstallDate"="REG_SZ", "20210531"
       "InstallLocation"="REG_SZ", "C:\Program Files (x86)\Photos Exif Editor\"
       "MajorVersion"="REG_DWORD", 1
       "MinorVersion"="REG_DWORD", 0
       "NoModify"="REG_DWORD", 1
       "NoRepair"="REG_DWORD", 1
       "Publisher"="REG_SZ", "Systweak"
       "QuietUninstallString"="REG_SZ", ""C:\Program Files (x86)\Photos Exif Editor\unins000.exe" /SILENT"
       "UninstallString"="REG_SZ", ""C:\Program Files (x86)\Photos Exif Editor\unins000.exe""
       "URLInfoAbout"="REG_SZ", "http://www.systweak.com/"
       "VersionMajor"="REG_DWORD", 1
       "VersionMinor"="REG_DWORD", 0
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Systweak\Params]
       "affiliateid"="REG_SZ", ""
       "utm_campaign"="REG_SZ", "inExifEditorInstaller"
       "utm_medium"="REG_SZ", "newbuild"
       "utm_source"="REG_SZ", "inExifEditorInstaller"
       "x-at"="REG_SZ", ""
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Systweak\Photos Exif Editor]
       "affiliateid"="REG_SZ", ""
       "afterInstallUrl"="REG_SZ", "https://www.exifedit.com/after-install-windows?newwinexifeditor=1&utm_content=AfterInstall&utm_term=Setup&page=install&"
       "BuyNowURL"="REG_SZ", "http://www.systweak.com/"
       "CplURL"="REG_SZ", "http://www.systweak.com/"
       "InstalledPath"="REG_SZ", "C:\Program Files (x86)\Photos Exif Editor"
       "isphone"="REG_SZ", "1"
       "issilent"="REG_DWORD", 1
       "RenewNowURL"="REG_SZ", "http://www.systweak.com/"
       "setup_name"="REG_SZ", "WinExifEditorInstaller"
       "utm_campaign"="REG_SZ", "inExifEditorInstaller"
       "utm_medium"="REG_SZ", "newbuild"
       "utm_source"="REG_SZ", "inExifEditorInstaller"
       "x-at"="REG_SZ", ""
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Systweak\Photos Exif Editor\LANG]
       "LangCode"="REG_SZ", ""
    [HKEY_CURRENT_USER\Software\SPEXD\key\6]
       "(Default)"="REG_BINARY, .......................................................................................................................o............................................................................................................................H...........
    [HKEY_CURRENT_USER\Software\Systweak\Photos Exif Editor]
       "affiliateid"="REG_SZ", ""
       "DaysRemaining"="REG_SZ", "0"
       "Expired"="REG_DWORD", 0
       "InstallDate"="REG_SZ", "1622442462"
       "InstalledPath"="REG_SZ", "C:\Program Files (x86)\Photos Exif Editor"
       "Key"="REG_SZ", ""
       "LastUsed"="REG_SZ", "1622442462"
       "MaxFixLimit"="REG_DWORD", 0
       "REGVER"="REG_DWORD", 0
       "REGVER-UNINSTALL"="REG_DWORD", 0
       "setup_name"="REG_SZ", "WinExifEditorInstaller"
       "utm_campaign"="REG_SZ", "inExifEditorInstaller"
       "utm_medium"="REG_SZ", "newbuild"
       "utm_source"="REG_SZ", "inExifEditorInstaller"
       "x-at"="REG_SZ", ""
    [HKEY_CURRENT_USER\Software\Systweak\Photos Exif Editor\1.0.0.9331]
    [HKEY_CURRENT_USER\Software\Systweak\Photos Exif Editor\LANG]
       "LangCode"="REG_SZ", ""

Malwarebytes log:
 

Malwarebytes
www.malwarebytes.com

-Log Details-
Scan Date: 5/31/21
Scan Time: 8:37 AM
Log File: 9fa3a7a4-c1da-11eb-bb95-080027235d76.json

-Software Information-
Version: 4.4.0.117
Components Version: 1.0.1308
Update Package Version: 1.0.41161
License: Premium

-System Information-
OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: {username}-PC\{username}

-Scan Summary-
Scan Type: Threat Scan
Scan Initiated By: Manual
Result: Completed
Objects Scanned: 234553
Threats Detected: 3
Threats Quarantined: 3
Time Elapsed: 1 min, 37 sec

-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Detect
PUM: Detect

-Scan Details-
Process: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registry Key: 0
(No malicious items detected)

Registry Value: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 0
(No malicious items detected)

File: 3
PUP.Optional.SysTweak, C:\DOCUMENTS AND SETTINGS\PUBLIC\Desktop\Photos Exif Editor.lnk, Quarantined, 878, 944070, , , , , A257ADAF25CEB03EAE2D22D5EA62EC8A, 84022F1CFE52886056884EB990BE86C08F536319192FF33C47C85307C746AA5D
PUP.Optional.SysTweak, C:\PROGRAM FILES (X86)\PHOTOS EXIF EDITOR\PHOTOSEXIFEDITOR.EXE, Quarantined, 878, 944070, 1.0.41161, , ame, , E2C59EA0B8DA4D3D78552D54932558CF, E3AB8C4672AFADD43C1111B90D3B4322AF320C96C1404DFFD03F003BF3D52754
PUP.Optional.SysTweak, C:\USERS\{username}\DESKTOP\WINEXIFEDITORINSTALLER.EXE, Quarantined, 878, 944071, 1.0.41161, , ame, , 65F859583AD1E0C3CE42C253C9DB2148, D6E2EE9D1EE4F89C7BE7CBF3B7FFEE8845171F2BFD15B31320CBB1D6DFFBF7F8

Physical Sector: 0
(No malicious items detected)

WMI: 0
(No malicious items detected)


(end)

As mentioned before the full version of Malwarebytes could have protected your computer against this potentially unwanted program.
We use different ways of protecting your computer(s):

  • Dynamically Blocks Malware Sites & Servers
  • Malware Execution Prevention

Save yourself the hassle and get protected.

Link to post
Share on other sites

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.