Jump to content

Welcome to Geeks to Go
Geeks to Go Welcome
Create Account Login to Account
Photo

Removal instructions for Window Raws Manager

- - - - -
Started by Metallica , Aug 29 2016 03:08 AM

  • Please log in to reply
No replies to this topic

#1
Metallica
Posted 29 August 2016 - 03:08 AM

Metallica

    Spyware Veteran

  • GeekU Moderator
  • 33,101 posts
Content is republished with permission from Malwarebytes.

What is Window Raws Manager?

The Malwarebytes research team has determined that Window Raws Manager is adware. These adware applications display advertisements not originating from the sites you are browsing.
This one belongs to the WinRange family.

How do I know if my computer is affected by Window Raws Manager?

You may see this entry in your list of installed programs:

warning4.png

How did Window Raws Manager get on my computer?

Adware applications use different methods for distributing themselves. This particular one was bundled with other software.

How do I remove Window Raws Manager?

Our program Malwarebytes Anti-Malware can detect and remove this potentially unwanted program.
  • Please download Malwarebytes Anti-Malware to your desktop.
  • Double-click mbam-setup-{version}.exe and follow the prompts to install the program.
  • At the end, be sure a check-mark is placed next to:
    Launch Malwarebytes Anti-Malware
  • Then click Finish.
  • Once the program has loaded, select Scan Now. Or select the Threat Scan from the Scan menu.
  • If an update is available, it will be implemented before the rest of the scanning procedure.
  • When the scan is complete, make sure that all Threats are selected, and click Remove Selected.
  • Restart your computer when prompted to do so.
Is there anything else I need to do to get rid of Window Raws Manager?
  • No, Malwarebytes' Anti-Malware removes Window Raws Manager completely.
How would the full version of Malwarebytes Anti-Malware help protect me?

We hope our application and this guide have helped you eradicate this hijacker.

As you can see below the full version of Malwarebytes Anti-Malware would have protected you against the Window Raws Manager adware. It would have warned you before the adware could install itself, giving you a chance to stop it before it became too late.


protection1.png


The web protection module also blocks some of the connections the installer tries to make:
 

protection2.png


Technical details for experts

Possible signs in FRST logs:


 (Homesat Co.) C:\Program Files (x86)\winraw\WinRawSync.exe
 (Homesat Co.) C:\Program Files (x86)\winraw\WinRaw.exe
 (Homesat Co.) C:\Program Files (x86)\winraw\WinRaw_.exe
 R2 WinRawSvc; C:\Program Files (x86)\winraw\WinRawSync.exe [134656 2016-08-24] (Homesat Co.) [File not signed]
 R2 WinRawSvc2; C:\Program Files (x86)\winraw\WinRawSync_.exe [128512 2016-08-24] (Homesat Co.) [File not signed]
 C:\Users\{username}\AppData\Local\CEF
 C:\Program Files (x86)\winraw

Window Raws Manager (HKLM-x32\...\Window Raws Manager) (Version: 1.69 - Homesat Co.)
() C:\Program Files (x86)\WinRaw\libcef.dll
() C:\Program Files (x86)\WinRaw\log4cplusU.dll
Alterations made by the installer:
 
File system details [View: All details] (Selection)
---------------------------------------------------
    Adds the folder C:\Program Files (x86)\winraw
       Adds the file cef.pak"="6/20/2016 8:37 AM, 2749972 bytes, A
       Adds the file cef_100_percent.pak"="6/20/2016 8:37 AM, 146067 bytes, A
       Adds the file cef_200_percent.pak"="6/20/2016 8:37 AM, 235262 bytes, A
       Adds the file cef_extensions.pak"="6/20/2016 8:37 AM, 4409164 bytes, A
       Adds the file d3dcompiler_43.dll"="6/20/2016 8:37 AM, 2106216 bytes, A
       Adds the file d3dcompiler_47.dll"="6/20/2016 8:37 AM, 3709120 bytes, A
       Adds the file devtools_resources.pak"="6/20/2016 8:37 AM, 4740603 bytes, A
       Adds the file icudtl.dat"="6/20/2016 8:37 AM, 10127152 bytes, A
       Adds the file libcef.dll"="6/20/2016 8:37 AM, 52043776 bytes, A
       Adds the file libcurl.dll"="10/27/2014 6:11 PM, 1358336 bytes, A
       Adds the file libEGL.dll"="6/20/2016 8:37 AM, 80384 bytes, A
       Adds the file libGLESv2.dll"="6/20/2016 8:37 AM, 1734656 bytes, A
       Adds the file log4cplusU.dll"="1/14/2015 11:55 AM, 386560 bytes, A
       Adds the file msvcp120.dll"="11/24/2014 9:23 AM, 455328 bytes, A
       Adds the file msvcr120.dll"="11/24/2014 9:23 AM, 970912 bytes, A
       Adds the file natives_blob.bin"="6/20/2016 8:37 AM, 415490 bytes, A
       Adds the file release.log"="8/26/2016 8:10 AM, 0 bytes, A
       Adds the file snapshot_blob.bin"="6/20/2016 8:37 AM, 517972 bytes, A
       Adds the file Uninstall.exe"="8/26/2016 8:10 AM, 141856 bytes, A
       Adds the file widevinecdmadapter.dll"="6/20/2016 8:37 AM, 212992 bytes, A
       Adds the file WinRaw.exe"="8/24/2016 4:45 PM, 693248 bytes, A
       Adds the file WinRaw_.exe"="8/24/2016 4:47 PM, 693248 bytes, A
       Adds the file WinRawSync.exe"="8/24/2016 4:55 PM, 134656 bytes, A
       Adds the file WinRawSync_.exe"="8/24/2016 4:58 PM, 128512 bytes, A
       Adds the file winrawtask.exe"="8/24/2016 5:17 PM, 1821696 bytes, A
       Adds the file winrawtask_.exe"="8/24/2016 4:52 PM, 1822720 bytes, A
       Adds the file wow_helper.exe"="5/13/2016 9:59 AM, 67072 bytes, A
    Adds the folder C:\Program Files (x86)\winraw\cache
       Adds the file Cookies"="8/26/2016 8:12 AM, 10240 bytes, A
       Adds the file Cookies-journal"="8/26/2016 8:12 AM, 0 bytes, A
       Adds the file index"="8/26/2016 8:10 AM, 262512 bytes, A
       Adds the file Visited Links"="8/26/2016 8:12 AM, 131072 bytes, A
    Adds the folder C:\Program Files (x86)\winraw\cache\GPUCache
       Adds the file index"="8/26/2016 8:10 AM, 262512 bytes, A
    Adds the folder C:\Program Files (x86)\winraw\cache1
       Adds the file Cookies"="8/26/2016 8:14 AM, 10240 bytes, A
       Adds the file Cookies-journal"="8/26/2016 8:14 AM, 0 bytes, A
       Adds the file index"="8/26/2016 8:10 AM, 262512 bytes, A
       Adds the file Visited Links"="8/26/2016 8:13 AM, 131072 bytes, A
    Adds the folder C:\Program Files (x86)\winraw\cache1\GPUCache
       Adds the file index"="8/26/2016 8:10 AM, 262512 bytes, A
    Adds the folder C:\Program Files (x86)\winraw\locales
    Adds the folder C:\Program Files (x86)\winraw\plugins
       Adds the file pepflashplayer.dll"="6/30/2016 3:25 AM, 31555776 bytes, A
    Adds the folder C:\Program Files (x86)\winraw\Update
    Adds the folder C:\Users\{username}\AppData\Local\CEF\User Data\Dictionaries

Registry details [View: All details] (Selection)
------------------------------------------------
    [HKEY_LOCAL_MACHINE\SOFTWARE\okwinraw]
       "ID"="REG_SZ", "E531A24D-0AE0-4179-A574-117FFBAA0BB5"
       "InstallAMID"="REG_SZ", ""
       "InstallSID"="REG_SZ", ""
       "Version"="REG_SZ", "169"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Window Raws Manager]
       "DisplayName"="REG_SZ", "Window Raws Manager"
       "DisplayVersion"="REG_SZ", "1.69"
       "EstimatedSize"="REG_DWORD", 95886
       "InstallDate"="REG_SZ", "20150826"
       "Publisher"="REG_SZ", "Homesat Co."
       "UninstallString"="REG_SZ", ""C:\Program Files (x86)\winraw\uninstall.exe""
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\okwinraw]
       "ID"="REG_SZ", "E531A24D-0AE0-4179-A574-117FFBAA0BB5"
       "InstallAMID"="REG_SZ", "0"
       "InstallDate"="REG_SZ", "26.08.2016 8:10"
       "InstallSID"="REG_SZ", ""
       "restart1"="REG_SZ", "1"
       "restart2"="REG_SZ", "1"
       "Success"="REG_SZ", "1"
       "Version"="REG_SZ", "169"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\WinRawSvc]
       "DisplayName"="REG_SZ", "Window Raws Manager"
       "ErrorControl"="REG_DWORD", 1
       "ImagePath"="REG_EXPAND_SZ, "C:\Program Files (x86)\winraw\WinRawSync.exe"
       "ObjectName"="REG_SZ", "LocalSystem"
       "Start"="REG_DWORD", 2
       "Type"="REG_DWORD", 16
       "WOW64"="REG_DWORD", 1
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\WinRawSvc2]
       "DisplayName"="REG_SZ", "Window Raws Manager2"
       "ErrorControl"="REG_DWORD", 1
       "ImagePath"="REG_EXPAND_SZ, "C:\Program Files (x86)\winraw\WinRawSync_.exe"
       "ObjectName"="REG_SZ", "LocalSystem"
       "Start"="REG_DWORD", 2
       "Type"="REG_DWORD", 16
       "WOW64"="REG_DWORD", 1
    [HKEY_CURRENT_USER\Software\winmnt]
       "Success"="REG_SZ", "1"
Malwarebytes Anti-Malware log:
 
Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 8/26/2016
Scan Time: 8:18 AM
Logfile: mbamWindowRaws.txt
Administrator: Yes

Version: 2.2.1.1043
Malware Database: v2016.08.26.04
Rootkit Database: v2016.08.15.01
License: Premium
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Enabled

OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: {username}

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 319059
Time Elapsed: 9 min, 53 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 6
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\WinRaw.exe, 3468, Delete-on-Reboot, [e4c87cd32d6df83eebca12c88084f808]
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\WinRaw.exe, 1812, Delete-on-Reboot, [e4c87cd32d6df83eebca12c88084f808]
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\WinRawSync.exe, 3360, Delete-on-Reboot, [e4c87cd32d6df83eebca12c88084f808]
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\WinRawSync_.exe, 3276, Delete-on-Reboot, [e4c87cd32d6df83eebca12c88084f808]
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\WinRaw_.exe, 3056, Delete-on-Reboot, [e4c87cd32d6df83eebca12c88084f808]
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\WinRaw_.exe, 4052, Delete-on-Reboot, [e4c87cd32d6df83eebca12c88084f808]

Modules: 21
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\libcef.dll, Delete-on-Reboot, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\libcef.dll, Delete-on-Reboot, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\libcef.dll, Delete-on-Reboot, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\libcef.dll, Delete-on-Reboot, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\libcurl.dll, Delete-on-Reboot, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\libcurl.dll, Delete-on-Reboot, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\libcurl.dll, Delete-on-Reboot, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\libcurl.dll, Delete-on-Reboot, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\libcurl.dll, Delete-on-Reboot, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\log4cplusU.dll, Delete-on-Reboot, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\log4cplusU.dll, Delete-on-Reboot, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\log4cplusU.dll, Delete-on-Reboot, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\log4cplusU.dll, Delete-on-Reboot, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\msvcp120.dll, Delete-on-Reboot, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\msvcp120.dll, Delete-on-Reboot, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\msvcp120.dll, Delete-on-Reboot, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\msvcp120.dll, Delete-on-Reboot, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\msvcr120.dll, Delete-on-Reboot, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\msvcr120.dll, Delete-on-Reboot, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\msvcr120.dll, Delete-on-Reboot, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\msvcr120.dll, Delete-on-Reboot, [e4c87cd32d6df83eebca12c88084f808], 

Registry Keys: 5
PUP.Optional.Winraw, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\Window Raws Manager, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\WinRawSvc, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\WinRawSvc2, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, HKLM\SOFTWARE\OKWINRAW, Quarantined, [6f3d103fa4f60d2923953c9e0cf8c13f], 
PUP.Optional.Winraw, HKLM\SOFTWARE\WOW6432NODE\OKWINRAW, Quarantined, [dbd1ada2a6f4d36391270ad012f23dc3], 

Registry Values: 4
PUP.Optional.Winraw, HKLM\SOFTWARE\OKWINRAW|Version, 169, Quarantined, [6f3d103fa4f60d2923953c9e0cf8c13f]
PUP.Optional.Winraw, HKLM\SOFTWARE\WOW6432NODE\OKWINRAW|Version, 169, Quarantined, [dbd1ada2a6f4d36391270ad012f23dc3]
PUP.Optional.Winraw, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\WinRawSvc|ImagePath, C:\Program Files (x86)\winraw\WinRawSync.exe, Quarantined, [773528273b5f9f97417513c749bb2ed2]
PUP.Optional.Winraw, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\WinRawSvc2|ImagePath, C:\Program Files (x86)\winraw\WinRawSync_.exe, Quarantined, [7636cf80ccce75c1f2c484564eb6f709]

Registry Data[b]:[/b] 0
(No malicious items detected)

Folders: 8
PUP.Optional.Winraw, C:\Program Files (x86)\winraw, Delete-on-Reboot, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\cache, Delete-on-Reboot, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\cache\GPUCache, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\cache1, Delete-on-Reboot, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\cache1\GPUCache, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\locales, Delete-on-Reboot, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\plugins, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\Update, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 

Files: 172
PUP.Optional.Winraw, C:\Users\{username}\Desktop\install.exe, Quarantined, [109c99b632681e182f834f8b4fb5a25e], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\libcef.dll, Delete-on-Reboot, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\libGLESv2.dll, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\cef.pak, Delete-on-Reboot, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\cef_100_percent.pak, Delete-on-Reboot, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\cef_200_percent.pak, Delete-on-Reboot, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\cef_extensions.pak, Delete-on-Reboot, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\d3dcompiler_43.dll, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\d3dcompiler_47.dll, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\devtools_resources.pak, Delete-on-Reboot, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\icudtl.dat, Delete-on-Reboot, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\libcurl.dll, Delete-on-Reboot, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\libEGL.dll, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\log4cplusU.dll, Delete-on-Reboot, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\msvcp120.dll, Delete-on-Reboot, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\msvcr120.dll, Delete-on-Reboot, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\natives_blob.bin, Delete-on-Reboot, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\release.log, Delete-on-Reboot, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\snapshot_blob.bin, Delete-on-Reboot, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\Uninstall.exe, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\widevinecdmadapter.dll, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\WinRaw.exe, Delete-on-Reboot, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\WinRawSync.exe, Delete-on-Reboot, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\WinRawSync_.exe, Delete-on-Reboot, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\winrawtask.exe, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\winrawtask_.exe, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\WinRaw_.exe, Delete-on-Reboot, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\wow_helper.exe, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\cache\f_00000d, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\cache\Cookies, Delete-on-Reboot, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\cache\Cookies-journal, Delete-on-Reboot, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\cache\data_0, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\cache\data_1, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\cache\data_2, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\cache\data_3, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\cache\f_000001, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\cache\f_000002, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\cache\f_000003, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\cache\f_000004, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\cache\f_000005, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\cache\f_000006, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\cache\f_000007, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\cache\f_000008, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\cache\f_000009, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\cache\f_00000a, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\cache\f_00000b, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\cache\f_00000c, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\cache\f_00000e, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\cache\f_00000f, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\cache\f_000010, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\cache\f_000011, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\cache\f_000012, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\cache\f_000013, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\cache\f_000014, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\cache\f_000015, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\cache\f_000016, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\cache\f_000017, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\cache\f_000018, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\cache\f_000019, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\cache\f_00001a, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\cache\f_00001b, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\cache\f_00001c, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\cache\f_00001d, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\cache\f_00001e, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\cache\f_00001f, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\cache\f_000020, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\cache\f_000021, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\cache\f_000022, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\cache\f_000023, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\cache\f_000024, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\cache\f_000025, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\cache\f_000026, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\cache\f_000027, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\cache\f_000028, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\cache\f_000029, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\cache\f_00002a, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\cache\index, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\cache\Visited Links, Delete-on-Reboot, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\cache\GPUCache\data_0, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\cache\GPUCache\data_1, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\cache\GPUCache\data_2, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\cache\GPUCache\data_3, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\cache\GPUCache\index, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\cache1\Cookies, Delete-on-Reboot, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\cache1\Cookies-journal, Delete-on-Reboot, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\cache1\data_0, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\cache1\data_1, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\cache1\data_2, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\cache1\data_3, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\cache1\f_000001, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\cache1\f_000002, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\cache1\f_000003, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\cache1\f_000004, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\cache1\f_000005, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\cache1\f_000006, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\cache1\f_000007, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\cache1\f_000008, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\cache1\f_000009, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\cache1\f_00000a, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\cache1\f_00000b, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\cache1\f_00000c, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\cache1\f_00000d, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\cache1\f_00000e, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\cache1\f_00000f, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\cache1\f_000010, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\cache1\f_000011, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\cache1\f_000012, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\cache1\f_000013, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\cache1\f_000014, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\cache1\f_000015, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\cache1\f_000016, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\cache1\index, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\cache1\Visited Links, Delete-on-Reboot, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\cache1\GPUCache\data_0, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\cache1\GPUCache\data_1, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\cache1\GPUCache\data_2, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\cache1\GPUCache\data_3, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\cache1\GPUCache\index, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\locales\hi.pak, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\locales\am.pak, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\locales\ar.pak, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\locales\bg.pak, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\locales\bn.pak, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\locales\ca.pak, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\locales\cs.pak, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\locales\da.pak, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\locales\de.pak, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\locales\el.pak, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\locales\en-GB.pak, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\locales\en-US.pak, Delete-on-Reboot, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\locales\es-419.pak, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\locales\es.pak, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\locales\et.pak, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\locales\fa.pak, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\locales\fi.pak, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\locales\fil.pak, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\locales\fr.pak, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\locales\gu.pak, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\locales\he.pak, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\locales\hr.pak, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\locales\hu.pak, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\locales\id.pak, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\locales\it.pak, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\locales\ja.pak, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\locales\kn.pak, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\locales\ko.pak, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\locales\lt.pak, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\locales\lv.pak, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\locales\ml.pak, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\locales\mr.pak, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\locales\ms.pak, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\locales\nb.pak, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\locales\nl.pak, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\locales\pl.pak, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\locales\pt-BR.pak, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\locales\pt-PT.pak, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\locales\ro.pak, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\locales\ru.pak, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\locales\sk.pak, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\locales\sl.pak, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\locales\sr.pak, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\locales\sv.pak, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\locales\sw.pak, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\locales\ta.pak, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\locales\te.pak, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\locales\th.pak, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\locales\tr.pak, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\locales\uk.pak, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\locales\vi.pak, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\locales\zh-CN.pak, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\locales\zh-TW.pak, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 
PUP.Optional.Winraw, C:\Program Files (x86)\winraw\plugins\pepflashplayer.dll, Quarantined, [e4c87cd32d6df83eebca12c88084f808], 

Physical Sectors: 0
(No malicious items detected)


(end)
As mentioned before the full version of Malwarebytes Anti-Malware could have protected your computer against this threat.
We use different ways of protecting your computer(s):
  • Dynamically Blocks Malware Sites & Servers
  • Malware Execution Prevention
Save yourself the hassle and get protected.
  • 0

Advertisements

Back to Malware Removal Guides and Tutorials


0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

  1. Geeks to Go Community
  2. → Security
  3. → Malware Removal Guides and Tutorials

As Featured On:

featured
Malware Removal How to Guides Windows 7 System Building Download Files Register welcome

Never used a forum? Learn how.