No replies to this topic

[Metallica]

Content is republished with permission from Malwarebytes.

What is CRaccoon?

CRaccoon is a browser optimizer that triggers our PUP detection rules. By doing so we offer users a choice to consider whether they want to use this software. More information can be found on our Malwarebytes Labs blog.

How do I know if I am affected by CRaccoon?

This is how the main screen of the system optimizer looks:



You will find these icons in your taskbar, your startmenu, and on your desktop:



and see this type of windows during install:





You may see this entry in your list of installed programs:



How did CRaccoon get on my computer?

These so-called system optimizers use different methods of getting installed. This particular one was downloaded from their website.



How do I remove CRaccoon?

Our program Malwarebytes does not remove this PUP. You can uninstall the program using the built-in uninstaller.
You can download and run Malwarebytes to check for other (potentially) unwanted programs.

• Please download Malwarebytes for Windows to your desktop.
• Double-click MBSetup.exe and follow the prompts to install the program.
• When your Malwarebytes for Windows installation completes, the program opens to the Welcome to Malwarebytes screen.
• Click on the Get started button.
• Click Scan to start a Threat Scan.
• When the scan is finished click Quarantine to remove the found threats.
• Reboot the system if prompted to complete the removal process.

Is there anything else I need to do to get rid of CRaccoon?

• No, the uninstall is complete.

What if I want to keep CRaccoon?

Should users wish to keep this program and exclude it from being detected in future scans, they can add the program to the exclusions list. Heres how to do it.

• Open Malwarebytes for Windows.
• Click the Detection History
• Click the Allow List
• To add an item to the Allow List, click Add.
• Select the exclusion type Allow a file or folder and use the Select a folder button to select the main folder for the software that you wish to keep.
• Repeat this for any secondary files or folder(s) that belong to the software.

If the installer was quarantined by Malwarebytes you can Restore it from the Quarantined Items tab under Detection History by using the Restore button.

How would the full version of Malwarebytes help protect me?

We hope our application and this guide have helped you in dealing with this browser optimizer.

As you can see below the full version of Malwarebytes would have warned you against the CRaccoon installer.

Technical details for experts

You may see these entries in FRST logs:

(Waterfall Technology LTD -> CRaccoon) C:\Users\{username}\AppData\Roaming\CRaccoon\CRaccoon CRApp.exe
(Waterfall Technology LTD -> CRaccoon) C:\Users\{username}\AppData\Roaming\CRaccoon\CRaccoon.exe
HKCU\...\Run: [CRaccoon] => C:\Users\{username}\AppData\Roaming\CRaccoon\CRaccoon.exe [3289024 2020-11-11] (Waterfall Technology LTD -> CRaccoon) <==== ATTENTION
Startup: C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CRaccoon.lnk [2021-04-11] <==== ATTENTION
ShortcutTarget: CRaccoon.lnk -> C:\Users\{username}\AppData\Roaming\CRaccoon\CRaccoon.exe (Waterfall Technology LTD -> CRaccoon) <==== ATTENTION

CRaccoon (HKCU\...\CRaccoon) (Version: 1.5.0 - CRX) <==== ATTENTION

Alterations made by the installer:

File system details [View: All details] (Selection)
---------------------------------------------------
    Adds the folder C:\Users\{username}\AppData\Roaming\aS45hGtzu3RRns2
       Adds the file CRaccoon_4_VISIBLE_INSTALLER.exe"="11/11/2020 12:31 PM, 3289024 bytes, A
       Adds the file CRaccoon_4_VISIBLE_INSTALLER.exe.res"="4/11/2021 11:14 AM, 3 bytes, A
    Adds the folder C:\Users\{username}\AppData\Roaming\CRaccoon
       Adds the file cr_installed.txt"="4/11/2021 11:14 AM, 58 bytes, A
       Adds the file CRaccoon CRApp.exe"="11/11/2020 12:31 PM, 3289024 bytes, A
       Adds the file CRaccoon CRUninstall.exe"="11/11/2020 12:31 PM, 3289024 bytes, A
       Adds the file CRaccoon.exe"="11/11/2020 12:31 PM, 3289024 bytes, A
       Adds the file default_config"="4/11/2021 11:14 AM, 38 bytes, A
       Adds the file settings.ini"="4/11/2021 11:16 AM, 89 bytes, A
    Adds the folder C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CRaccoon
       Adds the file CR System Cleaner.lnk"="4/11/2021 11:14 AM, 953 bytes, A
    In the existing folder C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
       Adds the file CRaccoon.lnk"="4/11/2021 11:14 AM, 941 bytes, A

Registry details [View: All details] (Selection)
------------------------------------------------
    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
       "CRaccoon"="REG_SZ", "C:\Users\{username}\AppData\Roaming\CRaccoon\CRaccoon.exe"
    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\CRaccoon]
       "DisplayIcon"="REG_SZ", ""C:\Users\{username}\AppData\Roaming\CRaccoon\CRaccoon CRUninstall.exe""
       "DisplayName"="REG_SZ", "CRaccoon"
       "DisplayVersion"="REG_SZ", "1.5.0"
       "InstallDate"="REG_SZ", "4/11/2021"
       "InstallLocation"="REG_SZ", ""C:\Users\{username}\AppData\Roaming\CRaccoon\"
       "Publisher"="REG_SZ", "CRX"
       "UninstallString"="REG_SZ", ""C:\Users\{username}\AppData\Roaming\CRaccoon\CRaccoon CRUninstall.exe""

As mentioned before the full version of Malwarebytes could have protected your computer against this potentially unwanted program.
We use different ways of protecting your computer(s):

• Dynamically Blocks Malware Sites & Servers
• Malware Execution Prevention

Save yourself the hassle and get protected.