What is Pcobserver?
The Malwarebytes research team has determined that Pcobserver is a fake registry cleaner. These so-called "registry cleaners" use intentional false positives to convince users that their systems have problems. Then they try to sell you their software, claiming it will remove these problems.
More information can be found on our Malwarebytes Labs blog.
How do I know if I am infected with Pcobserver?
This is how the main screen of the registry cleaning application looks:
You will find these icons in your taskbar and on your desktop:
and this one in your Startup folder:
Note that this one will download a Tech Support screenlocker given the chance. See reply to this post.
And see these warnings during install:
and these screens during "operations":
You may see this entry in your list of installed programs:
How did Pcobserver get on my computer?
These so-called registry cleaners use different methods of getting installed. This particular one was bundled by other software.
How do I remove Pcobserver?
Our program Malwarebytes can detect and remove this potentially unwanted application.
- Please download Malwarebytes to your desktop.
- Double-click mb3-setup-consumer-{version}.exe and follow the prompts to install the program.
- Then click Finish.
- Once the program has fully updated, select Scan Now on the Dashboard. Or select the Threat Scan from the Scan menu.
- If another update of the definitions is available, it will be implemented before the rest of the scanning procedure.
- When the scan is complete, make sure that all Threats are selected, and click Remove Selected.
- Restart your computer when prompted to do so.
- No, Malwarebytes removes Pcobserver completely.
We hope our application and this guide have helped you eradicate this registry cleaner.
As you can see below the full version of Malwarebytes would have protected you against the Pcobserver installer. It would have warned you before the application could install itself, giving you a chance to stop it before it became too late.
and it blocks traffic to some of their domains:
Technical details for experts
You may see these entries in FRST logs:
() C:\Users\{username}\AppData\Roaming\Pcobserver\Pcobserver\Pcobserver.exe
Startup: C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WMPNewtworksSvcx.lnk [2017-04-05]
ShortcutTarget: WMPNewtworksSvcx.lnk -> C:\Users\{username}\AppData\Roaming\Pcobserver\Pcobserver\background\WMPNewtworksSvcx.exe (Windows Media Player)
C:\Users\{username}\AppData\Roaming\Pcobserver
Pcobserver (HKLM-x32\...\{1BFA4EE2-69A7-457C-B697-D332D6A17422}) (Version: 1.0.0 - Pcobserver)Alterations made by the installer:File system details [View: All details] (Selection)
---------------------------------------------------
Adds the folder C:\Users\{username}\AppData\Roaming\Microsoft\Installer\{1BFA4EE2-69A7-457C-B697-D332D6A17422}
Adds the file Pcobserver.exe"="4/6/2017 1:12 PM, 370070 bytes, RA
Adds the file WRC9Setup2.exe"="4/6/2017 1:12 PM, 67646 bytes, RA
In the existing folder C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
Adds the file WMPNewtworksSvcx.lnk"="4/6/2017 1:12 PM, 1285 bytes, A
Adds the folder C:\Users\{username}\AppData\Roaming\Pcobserver\Pcobserver
Adds the file installdetails.txt"="4/6/2017 1:13 PM, 0 bytes, A
Adds the file Interop.Scripting.dll"="7/21/2016 7:17 AM, 32768 bytes, A
Adds the file Pcobserver.exe"="9/7/2016 5:01 AM, 615936 bytes, A
Adds the file Pcobserver.exe.config"="9/7/2016 5:01 AM, 641 bytes, A
Adds the file Pcobserver.pdb"="9/7/2016 5:01 AM, 226816 bytes, A
Adds the file Pcobserver.vshost.exe"="9/7/2016 4:50 AM, 11608 bytes, A
Adds the file Pcobserver.vshost.exe.config"="8/9/2016 8:32 PM, 642 bytes, A
Adds the file Pcobserver.vshost.exe.manifest"="7/14/2016 5:37 PM, 2502 bytes, A
Adds the file Pcobserver.xml"="9/7/2016 5:01 AM, 38330 bytes, A
Adds the folder C:\Users\{username}\AppData\Roaming\Pcobserver\Pcobserver\background
Adds the file Interop.IWshRuntimeLibrary.dll"="7/6/2016 4:04 PM, 49152 bytes, A
Adds the file Interop.Scripting.dll"="7/11/2016 3:39 PM, 32768 bytes, A
Adds the file PlatformInfo.dll"="7/10/2016 8:30 PM, 27136 bytes, A
Adds the file WMPNewtworksSvcx.exe"="4/5/2017 10:41 AM, 244224 bytes, A
Adds the file WMPNewtworksSvcx.exe.config"="4/5/2017 10:40 AM, 1616 bytes, A
Adds the folder C:\Users\{username}\AppData\Roaming\Pcobserver\Pcobserver 1.0.0\install
In the existing folder C:\Users\{username}\Desktop
Adds the file Pcobserver.lnk"="4/6/2017 1:12 PM, 2124 bytes, A
In the existing folder C:\Windows\Installer
Adds the file b0666.msi"="4/6/2017 1:12 PM, 1149440 bytes, A
Adds the file SourceHash{1BFA4EE2-69A7-457C-B697-D332D6A17422}"="4/6/2017 1:12 PM, 20480 bytes, A
Registry details [View: All details] (Selection)
------------------------------------------------
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\{CUSID}\Products\2EE4AFB17A96C7546B793D236D1A4722\InstallProperties]
"AuthorizedCDFPrefix"="REG_SZ"", ""
"Comments"="REG_SZ"", "This installer database contains the logic and data required to install Pcobserver."
"Contact"="REG_SZ"", ""
"DisplayName"="REG_SZ"", "Pcobserver"
"DisplayVersion"="REG_SZ"", "1.0.0"
"EstimatedSize"="REG_DWORD"", 1266
"HelpLink"="REG_SZ"", ""
"HelpTelephone"="REG_SZ"", ""
"InstallDate"="REG_SZ"", "20170406"
"InstallLocation"="REG_SZ"", "C:\Users\{username}\AppData\Roaming\Pcobserver\Pcobserver\"
"InstallSource"="REG_SZ"", "C:\Users\{username}\AppData\Roaming\Pcobserver\Pcobserver 1.0.0\install\"
"Language"="REG_DWORD"", 1033
"LocalPackage"="REG_SZ"", "C:\Windows\Installer\b0666.msi"
"ModifyPath"="REG_EXPAND_SZ, "MsiExec.exe /I{1BFA4EE2-69A7-457C-B697-D332D6A17422}"
"Publisher"="REG_SZ"", "Pcobserver"
"Readme"="REG_SZ"", ""
"Size"="REG_SZ"", ""
"UninstallString"="REG_EXPAND_SZ, "MsiExec.exe /I{1BFA4EE2-69A7-457C-B697-D332D6A17422}"
"URLInfoAbout"="REG_SZ"", ""
"URLUpdateInfo"="REG_SZ"", ""
"Version"="REG_DWORD"", 16777216
"VersionMajor"="REG_DWORD"", 1
"VersionMinor"="REG_DWORD"", 0
"WindowsInstaller"="REG_DWORD"", 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1BFA4EE2-69A7-457C-B697-D332D6A17422}]
"AuthorizedCDFPrefix"="REG_SZ"", ""
"Comments"="REG_SZ"", "This installer database contains the logic and data required to install Pcobserver."
"Contact"="REG_SZ"", ""
"DisplayName"="REG_SZ"", "Pcobserver"
"DisplayVersion"="REG_SZ"", "1.0.0"
"EstimatedSize"="REG_DWORD"", 1266
"HelpLink"="REG_SZ"", ""
"HelpTelephone"="REG_SZ"", ""
"InstallDate"="REG_SZ"", "20170406"
"InstallLocation"="REG_SZ"", "C:\Users\{username}\AppData\Roaming\Pcobserver\Pcobserver\"
"InstallSource"="REG_SZ"", "C:\Users\{username}\AppData\Roaming\Pcobserver\Pcobserver 1.0.0\install\"
"Language"="REG_DWORD"", 1033
"ModifyPath"="REG_EXPAND_SZ, "MsiExec.exe /I{1BFA4EE2-69A7-457C-B697-D332D6A17422}"
"Publisher"="REG_SZ"", "Pcobserver"
"Readme"="REG_SZ"", ""
"Size"="REG_SZ"", ""
"UninstallString"="REG_EXPAND_SZ, "MsiExec.exe /I{1BFA4EE2-69A7-457C-B697-D332D6A17422}"
"URLInfoAbout"="REG_SZ"", ""
"URLUpdateInfo"="REG_SZ"", ""
"Version"="REG_DWORD"", 16777216
"VersionMajor"="REG_DWORD"", 1
"VersionMinor"="REG_DWORD"", 0
"WindowsInstaller"="REG_DWORD"", 1
[HKEY_CURRENT_USER\Software\DIS\Pcobserver]
"Path"="REG_SZ"", "C:\Users\{username}\AppData\Roaming\Pcobserver\Pcobserver\"
"Version"="REG_SZ"", "1.0.0"
Malwarebytes log:Malwarebytes
www.malwarebytes.com
-Log Details-
Scan Date: 4/7/17
Scan Time: 1:22 PM
Logfile: mbamPcobserver.txt
Administrator: Yes
-Software Information-
Version: 3.0.6.1469
Components Version: 1.0.96
Update Package Version: 1.0.1680
License: Premium
-System Information-
OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: {computername}\{username}
-Scan Summary-
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 325647
Time Elapsed: 1 min, 16 sec
-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled
-Scan Details-
Process: 1
PUP.Optional.Pcobserver, C:\Users\{username}\AppData\Roaming\Pcobserver\Pcobserver\Pcobserver.exe, Quarantined, [5687], [387647],1.0.1680
Module: 2
PUP.Optional.Pcobserver, C:\Users\{username}\AppData\Roaming\Pcobserver\Pcobserver\Interop.Scripting.dll, Quarantined, [5687], [387647],1.0.1680
PUP.Optional.Pcobserver, C:\Users\{username}\AppData\Roaming\Pcobserver\Pcobserver\Pcobserver.exe, Quarantined, [5687], [387647],1.0.1680
Registry Key: 0
(No malicious items detected)
Registry Value: 0
(No malicious items detected)
Registry Data: 0
(No malicious items detected)
Data Stream: 0
(No malicious items detected)
Folder: 5
PUP.Optional.Pcobserver, C:\Users\{username}\AppData\Roaming\Pcobserver\Pcobserver 1.0.0\install, Delete-on-Reboot, [5687], [387647],1.0.1680
PUP.Optional.Pcobserver, C:\Users\{username}\AppData\Roaming\Pcobserver\Pcobserver\background, Delete-on-Reboot, [5687], [387647],1.0.1680
PUP.Optional.Pcobserver, C:\Users\{username}\AppData\Roaming\Pcobserver\Pcobserver 1.0.0, Delete-on-Reboot, [5687], [387647],1.0.1680
PUP.Optional.Pcobserver, C:\Users\{username}\AppData\Roaming\Pcobserver\Pcobserver, Delete-on-Reboot, [5687], [387647],1.0.1680
PUP.Optional.Pcobserver, C:\USERS\{username}\APPDATA\ROAMING\PCOBSERVER, Delete-on-Reboot, [5687], [387647],1.0.1680
File: 17
PUP.Optional.Pcobserver, C:\USERS\{username}\APPDATA\ROAMING\PCOBSERVER\PCOBSERVER\INSTALLDETAILS.TXT, Delete-on-Reboot, [5687], [387647],1.0.1680
PUP.Optional.Pcobserver, C:\Users\{username}\AppData\Roaming\Pcobserver\Pcobserver\background\Interop.IWshRuntimeLibrary.dll, Delete-on-Reboot, [5687], [387647],1.0.1680
PUP.Optional.Pcobserver, C:\Users\{username}\AppData\Roaming\Pcobserver\Pcobserver\background\Interop.Scripting.dll, Delete-on-Reboot, [5687], [387647],1.0.1680
PUP.Optional.Pcobserver, C:\Users\{username}\AppData\Roaming\Pcobserver\Pcobserver\background\PlatformInfo.dll, Delete-on-Reboot, [5687], [387647],1.0.1680
PUP.Optional.Pcobserver, C:\Users\{username}\AppData\Roaming\Pcobserver\Pcobserver\background\WMPNewtworksSvcx.exe, Delete-on-Reboot, [5687], [387647],1.0.1680
PUP.Optional.Pcobserver, C:\Users\{username}\AppData\Roaming\Pcobserver\Pcobserver\background\WMPNewtworksSvcx.exe.config, Delete-on-Reboot, [5687], [387647],1.0.1680
PUP.Optional.Pcobserver, C:\Users\{username}\AppData\Roaming\Pcobserver\Pcobserver\Interop.Scripting.dll, Delete-on-Reboot, [5687], [387647],1.0.1680
PUP.Optional.Pcobserver, C:\Users\{username}\AppData\Roaming\Pcobserver\Pcobserver\Pcobserver.exe, Delete-on-Reboot, [5687], [387647],1.0.1680
PUP.Optional.Pcobserver, C:\Users\{username}\AppData\Roaming\Pcobserver\Pcobserver\Pcobserver.exe.config, Delete-on-Reboot, [5687], [387647],1.0.1680
PUP.Optional.Pcobserver, C:\Users\{username}\AppData\Roaming\Pcobserver\Pcobserver\Pcobserver.pdb, Delete-on-Reboot, [5687], [387647],1.0.1680
PUP.Optional.Pcobserver, C:\Users\{username}\AppData\Roaming\Pcobserver\Pcobserver\Pcobserver.vshost.exe, Delete-on-Reboot, [5687], [387647],1.0.1680
PUP.Optional.Pcobserver, C:\Users\{username}\AppData\Roaming\Pcobserver\Pcobserver\Pcobserver.vshost.exe.config, Delete-on-Reboot, [5687], [387647],1.0.1680
PUP.Optional.Pcobserver, C:\Users\{username}\AppData\Roaming\Pcobserver\Pcobserver\Pcobserver.vshost.exe.manifest, Delete-on-Reboot, [5687], [387647],1.0.1680
PUP.Optional.Pcobserver, C:\Users\{username}\AppData\Roaming\Pcobserver\Pcobserver\Pcobserver.xml, Delete-on-Reboot, [5687], [387647],1.0.1680
PUP.Optional.Pcobserver, C:\USERS\{username}\DESKTOP\PCOBSERVER.LNK, Delete-on-Reboot, [5687], [387649],1.0.1680
Trojan.Dropper, C:\USERS\{username}\DESKTOP\WRC9SETUP.EXE, Delete-on-Reboot, [17], [387646],1.0.1680
PUP.Optional.Pcobserver, C:\USERS\{username}\APPDATA\ROAMING\MICROSOFT\WINDOWS\START MENU\PROGRAMS\STARTUP\WMPNEWTWORKSSVCX.LNK, Delete-on-Reboot, [5687], [387650],1.0.1680
Physical Sector: 0
(No malicious items detected)
(end)As mentioned before the full version of Malwarebytes could have protected your computer against this threat.We use different ways of protecting your computer(s):
- Dynamically Blocks Malware Sites & Servers
- Malware Execution Prevention
Back to top
Sign In
Create Account
