Jump to content

Welcome to Geeks to Go
Geeks to Go Welcome
Create Account Login to Account
Photo

Removal instructions for Pcobserver

- - - - -

  • Please log in to reply
1 reply to this topic

#1
Metallica

Metallica

    Spyware Veteran

  • GeekU Moderator
  • 33,101 posts
Content is republished with permission from Malwarebytes.

What is Pcobserver?

The Malwarebytes research team has determined that Pcobserver is a fake registry cleaner. These so-called "registry cleaners" use intentional false positives to convince users that their systems have problems. Then they try to sell you their software, claiming it will remove these problems.
More information can be found on our Malwarebytes Labs blog.

How do I know if I am infected with Pcobserver?

This is how the main screen of the registry cleaning application looks:

main.png

You will find these icons in your taskbar and on your desktop:

icons.png

and this one in your Startup folder:

icons2.png

Note that this one will download a Tech Support screenlocker given the chance. See reply to this post.

And see these warnings during install:

warning1.png

warning2.png

and these screens during "operations":

warning7.png

warning5.png

You may see this entry in your list of installed programs:

warning4.png

How did Pcobserver get on my computer?

These so-called registry cleaners use different methods of getting installed. This particular one was bundled by other software.

How do I remove Pcobserver?

Our program Malwarebytes can detect and remove this potentially unwanted application.
  • Please download Malwarebytes to your desktop.
  • Double-click mb3-setup-consumer-{version}.exe and follow the prompts to install the program.
  • Then click Finish.
  • Once the program has fully updated, select Scan Now on the Dashboard. Or select the Threat Scan from the Scan menu.
  • If another update of the definitions is available, it will be implemented before the rest of the scanning procedure.
  • When the scan is complete, make sure that all Threats are selected, and click Remove Selected.
  • Restart your computer when prompted to do so.
Is there anything else I need to do to get rid of Pcobserver?
  • No, Malwarebytes removes Pcobserver completely.
How would the full version of Malwarebytes help protect me?

We hope our application and this guide have helped you eradicate this registry cleaner.

As you can see below the full version of Malwarebytes would have protected you against the Pcobserver installer. It would have warned you before the application could install itself, giving you a chance to stop it before it became too late.

protection1.png


and it blocks traffic to some of their domains:

protection2.png


Technical details for experts

You may see these entries in FRST logs:

 () C:\Users\{username}\AppData\Roaming\Pcobserver\Pcobserver\Pcobserver.exe
 Startup: C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WMPNewtworksSvcx.lnk [2017-04-05]
 ShortcutTarget: WMPNewtworksSvcx.lnk -> C:\Users\{username}\AppData\Roaming\Pcobserver\Pcobserver\background\WMPNewtworksSvcx.exe (Windows Media Player)
 C:\Users\{username}\AppData\Roaming\Pcobserver

Pcobserver (HKLM-x32\...\{1BFA4EE2-69A7-457C-B697-D332D6A17422}) (Version: 1.0.0 - Pcobserver)
Alterations made by the installer:

File system details [View: All details] (Selection)
---------------------------------------------------
    Adds the folder C:\Users\{username}\AppData\Roaming\Microsoft\Installer\{1BFA4EE2-69A7-457C-B697-D332D6A17422}
       Adds the file Pcobserver.exe"="4/6/2017 1:12 PM, 370070 bytes, RA
       Adds the file WRC9Setup2.exe"="4/6/2017 1:12 PM, 67646 bytes, RA
    In the existing folder C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
       Adds the file WMPNewtworksSvcx.lnk"="4/6/2017 1:12 PM, 1285 bytes, A
    Adds the folder C:\Users\{username}\AppData\Roaming\Pcobserver\Pcobserver
       Adds the file installdetails.txt"="4/6/2017 1:13 PM, 0 bytes, A
       Adds the file Interop.Scripting.dll"="7/21/2016 7:17 AM, 32768 bytes, A
       Adds the file Pcobserver.exe"="9/7/2016 5:01 AM, 615936 bytes, A
       Adds the file Pcobserver.exe.config"="9/7/2016 5:01 AM, 641 bytes, A
       Adds the file Pcobserver.pdb"="9/7/2016 5:01 AM, 226816 bytes, A
       Adds the file Pcobserver.vshost.exe"="9/7/2016 4:50 AM, 11608 bytes, A
       Adds the file Pcobserver.vshost.exe.config"="8/9/2016 8:32 PM, 642 bytes, A
       Adds the file Pcobserver.vshost.exe.manifest"="7/14/2016 5:37 PM, 2502 bytes, A
       Adds the file Pcobserver.xml"="9/7/2016 5:01 AM, 38330 bytes, A
    Adds the folder C:\Users\{username}\AppData\Roaming\Pcobserver\Pcobserver\background
       Adds the file Interop.IWshRuntimeLibrary.dll"="7/6/2016 4:04 PM, 49152 bytes, A
       Adds the file Interop.Scripting.dll"="7/11/2016 3:39 PM, 32768 bytes, A
       Adds the file PlatformInfo.dll"="7/10/2016 8:30 PM, 27136 bytes, A
       Adds the file WMPNewtworksSvcx.exe"="4/5/2017 10:41 AM, 244224 bytes, A
       Adds the file WMPNewtworksSvcx.exe.config"="4/5/2017 10:40 AM, 1616 bytes, A
    Adds the folder C:\Users\{username}\AppData\Roaming\Pcobserver\Pcobserver 1.0.0\install
    In the existing folder C:\Users\{username}\Desktop
       Adds the file Pcobserver.lnk"="4/6/2017 1:12 PM, 2124 bytes, A
    In the existing folder C:\Windows\Installer
       Adds the file b0666.msi"="4/6/2017 1:12 PM, 1149440 bytes, A
       Adds the file SourceHash{1BFA4EE2-69A7-457C-B697-D332D6A17422}"="4/6/2017 1:12 PM, 20480 bytes, A

Registry details [View: All details] (Selection)
------------------------------------------------
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\{CUSID}\Products\2EE4AFB17A96C7546B793D236D1A4722\InstallProperties]
       "AuthorizedCDFPrefix"="REG_SZ"", ""
       "Comments"="REG_SZ"", "This installer database contains the logic and data required to install Pcobserver."
       "Contact"="REG_SZ"", ""
       "DisplayName"="REG_SZ"", "Pcobserver"
       "DisplayVersion"="REG_SZ"", "1.0.0"
       "EstimatedSize"="REG_DWORD"", 1266
       "HelpLink"="REG_SZ"", ""
       "HelpTelephone"="REG_SZ"", ""
       "InstallDate"="REG_SZ"", "20170406"
       "InstallLocation"="REG_SZ"", "C:\Users\{username}\AppData\Roaming\Pcobserver\Pcobserver\"
       "InstallSource"="REG_SZ"", "C:\Users\{username}\AppData\Roaming\Pcobserver\Pcobserver 1.0.0\install\"
       "Language"="REG_DWORD"", 1033
       "LocalPackage"="REG_SZ"", "C:\Windows\Installer\b0666.msi"
       "ModifyPath"="REG_EXPAND_SZ, "MsiExec.exe /I{1BFA4EE2-69A7-457C-B697-D332D6A17422}"
       "Publisher"="REG_SZ"", "Pcobserver"
       "Readme"="REG_SZ"", ""
       "Size"="REG_SZ"", ""
       "UninstallString"="REG_EXPAND_SZ, "MsiExec.exe /I{1BFA4EE2-69A7-457C-B697-D332D6A17422}"
       "URLInfoAbout"="REG_SZ"", ""
       "URLUpdateInfo"="REG_SZ"", ""
       "Version"="REG_DWORD"", 16777216
       "VersionMajor"="REG_DWORD"", 1
       "VersionMinor"="REG_DWORD"", 0
       "WindowsInstaller"="REG_DWORD"", 1
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1BFA4EE2-69A7-457C-B697-D332D6A17422}]
       "AuthorizedCDFPrefix"="REG_SZ"", ""
       "Comments"="REG_SZ"", "This installer database contains the logic and data required to install Pcobserver."
       "Contact"="REG_SZ"", ""
       "DisplayName"="REG_SZ"", "Pcobserver"
       "DisplayVersion"="REG_SZ"", "1.0.0"
       "EstimatedSize"="REG_DWORD"", 1266
       "HelpLink"="REG_SZ"", ""
       "HelpTelephone"="REG_SZ"", ""
       "InstallDate"="REG_SZ"", "20170406"
       "InstallLocation"="REG_SZ"", "C:\Users\{username}\AppData\Roaming\Pcobserver\Pcobserver\"
       "InstallSource"="REG_SZ"", "C:\Users\{username}\AppData\Roaming\Pcobserver\Pcobserver 1.0.0\install\"
       "Language"="REG_DWORD"", 1033
       "ModifyPath"="REG_EXPAND_SZ, "MsiExec.exe /I{1BFA4EE2-69A7-457C-B697-D332D6A17422}"
       "Publisher"="REG_SZ"", "Pcobserver"
       "Readme"="REG_SZ"", ""
       "Size"="REG_SZ"", ""
       "UninstallString"="REG_EXPAND_SZ, "MsiExec.exe /I{1BFA4EE2-69A7-457C-B697-D332D6A17422}"
       "URLInfoAbout"="REG_SZ"", ""
       "URLUpdateInfo"="REG_SZ"", ""
       "Version"="REG_DWORD"", 16777216
       "VersionMajor"="REG_DWORD"", 1
       "VersionMinor"="REG_DWORD"", 0
       "WindowsInstaller"="REG_DWORD"", 1
    [HKEY_CURRENT_USER\Software\DIS\Pcobserver]
       "Path"="REG_SZ"", "C:\Users\{username}\AppData\Roaming\Pcobserver\Pcobserver\"
       "Version"="REG_SZ"", "1.0.0"

Malwarebytes log:

Malwarebytes
www.malwarebytes.com

-Log Details-
Scan Date: 4/7/17
Scan Time: 1:22 PM
Logfile: mbamPcobserver.txt
Administrator: Yes

-Software Information-
Version: 3.0.6.1469
Components Version: 1.0.96
Update Package Version: 1.0.1680
License: Premium

-System Information-
OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: {computername}\{username}

-Scan Summary-
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 325647
Time Elapsed: 1 min, 16 sec

-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

-Scan Details-
Process: 1
PUP.Optional.Pcobserver, C:\Users\{username}\AppData\Roaming\Pcobserver\Pcobserver\Pcobserver.exe, Quarantined, [5687], [387647],1.0.1680

Module: 2
PUP.Optional.Pcobserver, C:\Users\{username}\AppData\Roaming\Pcobserver\Pcobserver\Interop.Scripting.dll, Quarantined, [5687], [387647],1.0.1680
PUP.Optional.Pcobserver, C:\Users\{username}\AppData\Roaming\Pcobserver\Pcobserver\Pcobserver.exe, Quarantined, [5687], [387647],1.0.1680

Registry Key: 0
(No malicious items detected)

Registry Value: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 5
PUP.Optional.Pcobserver, C:\Users\{username}\AppData\Roaming\Pcobserver\Pcobserver 1.0.0\install, Delete-on-Reboot, [5687], [387647],1.0.1680
PUP.Optional.Pcobserver, C:\Users\{username}\AppData\Roaming\Pcobserver\Pcobserver\background, Delete-on-Reboot, [5687], [387647],1.0.1680
PUP.Optional.Pcobserver, C:\Users\{username}\AppData\Roaming\Pcobserver\Pcobserver 1.0.0, Delete-on-Reboot, [5687], [387647],1.0.1680
PUP.Optional.Pcobserver, C:\Users\{username}\AppData\Roaming\Pcobserver\Pcobserver, Delete-on-Reboot, [5687], [387647],1.0.1680
PUP.Optional.Pcobserver, C:\USERS\{username}\APPDATA\ROAMING\PCOBSERVER, Delete-on-Reboot, [5687], [387647],1.0.1680

File: 17
PUP.Optional.Pcobserver, C:\USERS\{username}\APPDATA\ROAMING\PCOBSERVER\PCOBSERVER\INSTALLDETAILS.TXT, Delete-on-Reboot, [5687], [387647],1.0.1680
PUP.Optional.Pcobserver, C:\Users\{username}\AppData\Roaming\Pcobserver\Pcobserver\background\Interop.IWshRuntimeLibrary.dll, Delete-on-Reboot, [5687], [387647],1.0.1680
PUP.Optional.Pcobserver, C:\Users\{username}\AppData\Roaming\Pcobserver\Pcobserver\background\Interop.Scripting.dll, Delete-on-Reboot, [5687], [387647],1.0.1680
PUP.Optional.Pcobserver, C:\Users\{username}\AppData\Roaming\Pcobserver\Pcobserver\background\PlatformInfo.dll, Delete-on-Reboot, [5687], [387647],1.0.1680
PUP.Optional.Pcobserver, C:\Users\{username}\AppData\Roaming\Pcobserver\Pcobserver\background\WMPNewtworksSvcx.exe, Delete-on-Reboot, [5687], [387647],1.0.1680
PUP.Optional.Pcobserver, C:\Users\{username}\AppData\Roaming\Pcobserver\Pcobserver\background\WMPNewtworksSvcx.exe.config, Delete-on-Reboot, [5687], [387647],1.0.1680
PUP.Optional.Pcobserver, C:\Users\{username}\AppData\Roaming\Pcobserver\Pcobserver\Interop.Scripting.dll, Delete-on-Reboot, [5687], [387647],1.0.1680
PUP.Optional.Pcobserver, C:\Users\{username}\AppData\Roaming\Pcobserver\Pcobserver\Pcobserver.exe, Delete-on-Reboot, [5687], [387647],1.0.1680
PUP.Optional.Pcobserver, C:\Users\{username}\AppData\Roaming\Pcobserver\Pcobserver\Pcobserver.exe.config, Delete-on-Reboot, [5687], [387647],1.0.1680
PUP.Optional.Pcobserver, C:\Users\{username}\AppData\Roaming\Pcobserver\Pcobserver\Pcobserver.pdb, Delete-on-Reboot, [5687], [387647],1.0.1680
PUP.Optional.Pcobserver, C:\Users\{username}\AppData\Roaming\Pcobserver\Pcobserver\Pcobserver.vshost.exe, Delete-on-Reboot, [5687], [387647],1.0.1680
PUP.Optional.Pcobserver, C:\Users\{username}\AppData\Roaming\Pcobserver\Pcobserver\Pcobserver.vshost.exe.config, Delete-on-Reboot, [5687], [387647],1.0.1680
PUP.Optional.Pcobserver, C:\Users\{username}\AppData\Roaming\Pcobserver\Pcobserver\Pcobserver.vshost.exe.manifest, Delete-on-Reboot, [5687], [387647],1.0.1680
PUP.Optional.Pcobserver, C:\Users\{username}\AppData\Roaming\Pcobserver\Pcobserver\Pcobserver.xml, Delete-on-Reboot, [5687], [387647],1.0.1680
PUP.Optional.Pcobserver, C:\USERS\{username}\DESKTOP\PCOBSERVER.LNK, Delete-on-Reboot, [5687], [387649],1.0.1680
Trojan.Dropper, C:\USERS\{username}\DESKTOP\WRC9SETUP.EXE, Delete-on-Reboot, [17], [387646],1.0.1680
PUP.Optional.Pcobserver, C:\USERS\{username}\APPDATA\ROAMING\MICROSOFT\WINDOWS\START MENU\PROGRAMS\STARTUP\WMPNEWTWORKSSVCX.LNK, Delete-on-Reboot, [5687], [387650],1.0.1680

Physical Sector: 0
(No malicious items detected)


(end)
As mentioned before the full version of Malwarebytes could have protected your computer against this threat.
We use different ways of protecting your computer(s):
  • Dynamically Blocks Malware Sites & Servers
  • Malware Execution Prevention
Save yourself the hassle and get protected.
  • 0

Advertisements


#2
Metallica

Metallica

    Spyware Veteran

  • GeekU Moderator
  • 33,101 posts
Intellitraces Tech Support Screenlocker

The file called WMPNewtworksSvcx.exe mentioned in the post above tries to download and run a screenlocker for a Tech Support Scam.

download.png

The screenlocker uses taskkill to shut down the Windows Taskmanager and turns the ESC key into a TAB key.

lockscreen.png

The screenlocker can be unlocked by the code 8716098676542789
Using this will produce a prompt telling you that "Closing of the registration form is not allowed"
Click OK on that prompt and you will have the control over the system back
Now run the necessary steps outlined in the first post to install and run Malwarebytes.

As you can see below the full version of Malwarebytes would have protected you against the Pcobserver installer. It would have warned you before the application could install itself, giving you a chance to stop it before it became too late.

protection1.png


and it blocks traffic too some of their domains:

protection2.png


  • 0




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

featured
Malware Removal How to Guides Windows 7 System Building Download Files Register welcome

Never used a forum? Learn how.