Jump to content

Welcome to Geeks to Go
Geeks to Go Welcome
Create Account Login to Account
Photo

Removal instructions for AppSet

- - - - -
Started by Metallica , Aug 10 2018 03:04 AM

  • Please log in to reply
No replies to this topic

#1
Metallica
Posted 10 August 2018 - 03:04 AM

Metallica

    Spyware Veteran

  • GeekU Moderator
  • 33,101 posts
Content is republished with permission from Malwarebytes.

What is AppSet?

The Malwarebytes research team has determined that AppSet is a bundler that often delivers several browser hijackers. These so-called "hijackers" manipulate your browser(s), for example to change your startpage or searchscopes, so that the affected browser visits their site or one of their choice.

How do I know if my computer is affected by AppSet?

You may see these entries in your list of installed software:

warning9.png

and these warnings during install:

warning1.png
the bundled application

warning2.png
some of the bundled software can be opted-out, others are mandatory or silent

warning7.png
some only appear after you open your browser

you may see these browser add-ons:

warning6.png

warning8.png

this type of new default search providers:

warning5.png

and you will see these icons in your startmenu, on your taskbar and on your desktop:

icons.png

How did AppSet get on my computer?

Browser hijackers use different methods for distributing themselves. This particular one was bundled with other software.

How do I remove AppSet?

Our program Malwarebytes can detect and remove this potentially unwanted program.
  • Please download Malwarebytes to your desktop.
  • Double-click mb3-setup-consumer-{version}.exe and follow the prompts to install the program.
  • Then click Finish.
  • Once the program has fully updated, select Scan Now on the Dashboard. Or select the Threat Scan from the Scan menu.
  • If another update of the definitions is available, it will be implemented before the rest of the scanning procedure.
  • When the scan is complete, make sure that all Threats are selected, and click Remove Selected.
  • Restart your computer when prompted to do so.
Is there anything else I need to do to get rid of AppSet?
  • No, Malwarebytes removes AppSet completely.
  • This PUP can create some scheduled tasks. You can read here how to check for and, if necessary, remove Scheduled Tasks.
  • If your browsers have been hijacked, you should read our Restore Browser page. You can read there how to fix additional browser redirect methods.
How would the full version of Malwarebytes help protect me?

We hope our application and this guide have helped you eradicate this hijacker.

As you can see below the full version of Malwarebytes would have protected you against the AppSet bundler. It would have warned you before the application could install itself, giving you a chance to stop it before it became too late.

protection1.png


Technical details for experts

Possible signs in FRST logs:

(Yandex LLC) C:\Users\{username}\AppData\Local\Yandex\BrowserManager\BrowserManager.exe
HKCU\...\Run: [Browser Manager] => C:\Users\{username}\AppData\Local\Yandex\BrowserManager\MBLauncher.exe [129896 2017-08-11] (Yandex LLC)
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://www.yandex.ru/?win=345&clid=2323969-3
SearchScopes: HKCU -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://yandex.ru/search/?win=345&clid=2323970-3&text={searchTerms}
SearchScopes: HKCU -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://yandex.ru/search/?win=345&clid=2323970-3&text={searchTerms}
FF DefaultSearchEngine: Яндекс
FF SelectedSearchEngine: Яндекс
FF Homepage: hxxps://www.yandex.ru/?win=345&clid=2323969-3
FF SearchPlugin: C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\60l2dg92.default-1519559592148\searchplugins\yandex.ru-20180610.xml [2018-08-10]
FF Extension: No Name - C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\60l2dg92.default-1519559592148\Extensions\[email protected] [2018-08-10]
FF Extension: No Name - C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\60l2dg92.default-1519559592148\Extensions\[email protected] [2018-08-10]
CHR DefaultSearchURL: Default -> hxxps://yandex.ru/search/?__PARAM__from=chromesearch&text={searchTerms}
CHR DefaultSearchKeyword: Default -> yandex.ru
CHR DefaultSuggestURL: Default -> hxxps://suggest.yandex.net/suggest-ff.cgi?uil=ru&part={searchTerms}
CHR Extension: (Яндекс) - C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\ablpcikjmhamjanpibkccdmpoekjigja [2018-08-10]
CHR HKLM-x32\...\Chrome\Extension: [ablpcikjmhamjanpibkccdmpoekjigja] - hxxp://clients2.google.com/service/update2/crx
OPR StartupUrls: "hxxps:\/\/www.yandex.ru\/?win=345&clid=2323969-3"
C:\Users\{username}\Desktop\Yandex.lnk
C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Yandex
C:\Users\{username}\AppData\Local\Yandex
C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Яндекс
C:\Users\{username}\AppData\LocalLow\Yandex
C:\Users\{username}\AppData\Roaming\Yandex
C:\Users\{username}\AppData\Local\4tools
(appset.me ) C:\Users\{username}\Desktop\After Death.exe

Yandex (HKCU\...\YandexBrowser) (Version: 18.6.1.770 - ООО «ЯНДЕКС»)
Yandex taskbar button (HKCU\...\YaPinLancher) (Version: 2.0.4.2157 - Yandex)
Менеджер браузеров (HKCU\...\{d4bb3741-07a4-443a-8c73-0cfda821c697}) (Version: 3.0.6.829 - Яндекс)
Менеджер браузеров (x32 Version: 3.0.6.829 - Яндекс) Hidden
Task: {251471D4-E8A6-485F-A381-32B17C4610B7} - System32\Tasks\Обновление Браузера Яндекс => C:\Users\{username}\AppData\Local\Yandex\YandexBrowser\Application\browser.exe [2018-07-07] (YANDEX LLC)
Task: C:\Windows\Tasks\Обновление Браузера Яндекс.job => C:\Users\{username}\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
Some significant lterations made by the installer:

File system details [View: All details] (Selection)
---------------------------------------------------
    Adds the folder C:\Users\{username}\AppData\Local\Microsoft\Internet Explorer\Services
       Adds the file avia.yandex.ru.ico"="8/10/2018 9:07 AM, 6518 bytes, A
       Adds the file kinopoisk.ru.ico"="8/10/2018 9:07 AM, 13942 bytes, A
       Adds the file www.yandex.ru.ico"="8/10/2018 9:07 AM, 5430 bytes, A
       Adds the file yandex.ru.ico"="8/10/2018 9:06 AM, 5430 bytes, A
    Adds the folder C:\Users\{username}\AppData\Local\Yandex\BrowserManager
       Adds the file BrowserManager.Core.dll"="8/11/2017 1:00 PM, 415592 bytes, A
       Adds the file BrowserManager.Core.UI.dll"="8/11/2017 1:00 PM, 391528 bytes, A
       Adds the file BrowserManager.exe"="8/11/2017 1:00 PM, 352104 bytes, A
       Adds the file Crypto.Core.dll"="8/11/2017 1:00 PM, 47616 bytes, A
       Adds the file MBlauncher.exe"="8/11/2017 1:00 PM, 129896 bytes, A
       Adds the file MBlauncher_x64.exe"="8/11/2017 1:00 PM, 153960 bytes, A
       Adds the file ModuleUpgrader.dll"="8/11/2017 1:00 PM, 74088 bytes, A
       Adds the file ModuleUpgrader.dll.upgrade"="8/10/2018 9:08 AM, 76312 bytes, A
       Adds the file NAudio.dll"="8/11/2017 1:00 PM, 475136 bytes, A
       Adds the file Newtonsoft.Json.dll"="8/11/2017 1:00 PM, 521216 bytes, A
       Adds the file NLog.dll"="8/11/2017 1:00 PM, 577536 bytes, A
       Adds the file RefCheck.dll"="8/11/2017 1:00 PM, 19816 bytes, A
       Adds the file System.Data.SQLite.dll"="8/11/2017 1:00 PM, 311296 bytes, A
    Adds the folder C:\Users\{username}\AppData\Local\Yandex\Updater
    Adds the folder C:\Users\{username}\AppData\Local\Yandex\Updater2
       Adds the file res"="8/10/2018 9:07 AM, 1 bytes, A
       Adds the file show-dlg.exe"="6/14/2016 2:14 PM, 389952 bytes, A
       Adds the file u2-ctrl.exe"="6/14/2016 2:14 PM, 493568 bytes, A
       Adds the file yupdate-exec.exe"="6/14/2016 2:14 PM, 492864 bytes, A
    Adds the folder C:\Users\{username}\AppData\Local\Yandex\yapin
       Adds the file Yandex.exe"="7/20/2018 4:33 PM, 297992 bytes, A
       Adds the file Yandex.lnk"="8/10/2018 9:07 AM, 2089 bytes, A
       Adds the file YandexWorking.exe"="7/20/2018 4:33 PM, 297992 bytes, A
       Adds the file Яндекс.website"="8/10/2018 9:07 AM, 520 bytes, A
    Adds the folder C:\Users\{username}\AppData\LocalLow\Yandex
    Adds the folder C:\Users\{username}\AppData\LocalLow\Yandex\Updater
       Adds the file u2-ctrl.log"="8/10/2018 9:07 AM, 9487 bytes, A
       Adds the file u2-exec-bm.log"="8/10/2018 9:07 AM, 4874 bytes, A
       Adds the file u2-exec-statistic.log"="8/10/2018 9:07 AM, 5557 bytes, A
    Adds the folder C:\Users\{username}\AppData\LocalLow\Yandex\Updater\bm
       Adds the file appinfo.xml"="8/10/2018 9:07 AM, 805 bytes, A
       Adds the file statistics.xml"="8/10/2018 9:07 AM, 278 bytes, A
    In the existing folder C:\Users\{username}\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar
       Adds the file Yandex.lnk"="8/10/2018 9:07 AM, 2089 bytes, A
       Adds the file Кинопоиск.website"="8/10/2018 9:07 AM, 537 bytes, A
       Adds the file Яндекс.website"="8/10/2018 9:07 AM, 520 bytes, A
    Adds the folder C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Яндекс\Менеджер браузеров
       Adds the file Менеджер браузеров.lnk"="8/10/2018 9:07 AM, 1331 bytes, A
    Adds the folder C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\60l2dg92.default-1519559592148\browser-extension-data\[email protected]
       Adds the file storage.js"="8/10/2018 9:06 AM, 715 bytes, A
    Adds the folder C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\60l2dg92.default-1519559592148\browser-extension-data\[email protected]
       Adds the file storage.js"="8/10/2018 9:06 AM, 715 bytes, A
    Adds the folder C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\60l2dg92.default-1519559592148\extensions\staged
       Adds the file [email protected]"="8/10/2018 9:06 AM, 1063 bytes, A
       Adds the file [email protected]"="8/10/2018 9:06 AM, 705207 bytes, A
       Adds the file [email protected]"="8/10/2018 9:06 AM, 5222 bytes, A
       Adds the file [email protected]"="8/10/2018 9:06 AM, 1736900 bytes, A
    Adds the folder C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\60l2dg92.default-1519559592148\searchplugins
       Adds the file yandex.ru-20180610.xml"="8/10/2018 9:06 AM, 9693 bytes, A
    Adds the folder C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\60l2dg92.default-1519559592148\yandex-extensions-data
       Adds the file clids-sovetnik.xml"="8/10/2018 9:06 AM, 673 bytes, A
       Adds the file clids-vbff.xml"="8/10/2018 9:06 AM, 673 bytes, A
    Adds the folder C:\Users\{username}\AppData\Roaming\Yandex
       Adds the file clids-bm.xml"="8/10/2018 9:07 AM, 201 bytes, A
       Adds the file clids-yabrowser.xml"="8/10/2018 9:06 AM, 619 bytes, A
       Adds the file ui"="8/10/2018 9:06 AM, 38 bytes, A
    In the existing folder C:\Users\{username}\Favorites\Links
       Adds the file Авиабилеты.url"="8/10/2018 9:07 AM, 415 bytes, A
       Adds the file Яндекс.url"="8/10/2018 9:06 AM, 331 bytes, A

Registry details [View: All details] (Selection)
------------------------------------------------
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\ablpcikjmhamjanpibkccdmpoekjigja]
       "install_parameter"="REG_SZ", "clid=2323970-3&win=345&"
       "update_url"="REG_SZ", "http://clients2.google.com/service/update2/crx"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{FABA89D9-D588-4770-9F85-F6FF9F064257}]
       "AuthorizedCDFPrefix"="REG_SZ", ""
       "Comments"="REG_SZ", ""
       "Contact"="REG_SZ", ""
       "DisplayName"="REG_SZ", "Менеджер браузеров"
       "DisplayVersion"="REG_SZ", "3.0.6.829"
       "EstimatedSize"="REG_DWORD", 9328
       "HelpLink"="REG_EXPAND_SZ, "http://help.yandex.ru/bm/"
       "HelpTelephone"="REG_SZ", ""
       "InstallDate"="REG_SZ", "20180810"
       "InstallLocation"="REG_SZ", ""
       "InstallSource"="REG_SZ", "C:\Users\{username}\AppData\Local\Package Cache\{FABA89D9-D588-4770-9F85-F6FF9F064257}v3.0.6.829\"
       "Language"="REG_DWORD", 0
       "ModifyPath"="REG_EXPAND_SZ, "MsiExec.exe /X{FABA89D9-D588-4770-9F85-F6FF9F064257}"
       "NoModify"="REG_DWORD", 1
       "Publisher"="REG_SZ", "Яндекс"
       "Readme"="REG_SZ", ""
       "Size"="REG_SZ", ""
       "SystemComponent"="REG_DWORD", 1
       "UninstallString"="REG_EXPAND_SZ, "MsiExec.exe /X{FABA89D9-D588-4770-9F85-F6FF9F064257}"
       "URLInfoAbout"="REG_SZ", ""
       "URLUpdateInfo"="REG_SZ", "http://bm.yandex.ru/"
       "Version"="REG_DWORD", 50331654
       "VersionMajor"="REG_DWORD", 3
       "VersionMinor"="REG_DWORD", 0
       "WindowsInstaller"="REG_DWORD", 1
    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
       "Start Page" = REG_SZ, "https://www.yandex.ru/?win=345&clid=2323969-3"
    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}]
       "DisplayName" = REG_SZ, "Яндекс"
        REG_SZ, "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IENTSR" ==> REG_SZ, "https://yandex.ru/search/?win=345&clid=2323972-3&text={searchTerms}"
       "SuggestionsURL_JSON"="REG_SZ", "https://suggest.yandex.ru/suggest-ff.cgi?uil=ru&part={searchTerms}"
       "URL" ==> REG_SZ, "https://yandex.ru/search/?win=345&clid=2323970-3&text={searchTerms}"
    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
       "Browser Manager"="REG_SZ", "C:\Users\{username}\AppData\Local\Yandex\BrowserManager\MBLauncher.exe"
    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\{d4bb3741-07a4-443a-8c73-0cfda821c697}]
       "BundleAddonCode"="REG_MULTI_SZ, ""
       "BundleCachePath"="REG_SZ", "C:\Users\{username}\AppData\Local\Package Cache\{d4bb3741-07a4-443a-8c73-0cfda821c697}\BrowserManagerInstaller.exe"
       "BundleDetectCode"="REG_MULTI_SZ, ""
       "BundlePatchCode"="REG_MULTI_SZ, ""
       "BundleProviderKey"="REG_SZ", "{d4bb3741-07a4-443a-8c73-0cfda821c697}"
       "BundleTag"="REG_SZ", ""
       "BundleUpgradeCode"="REG_MULTI_SZ, "{CEADE967-2D56-4D80-A02E-CD3D762C0A3D} "
       "BundleVersion"="REG_SZ", "3.0.6.829"
       "DisplayIcon"="REG_SZ", "C:\Users\{username}\AppData\Local\Package Cache\{d4bb3741-07a4-443a-8c73-0cfda821c697}\BrowserManagerInstaller.exe,0"
       "DisplayName"="REG_SZ", "Менеджер браузеров"
       "DisplayVersion"="REG_SZ", "3.0.6.829"
       "EngineVersion"="REG_SZ", "3.8.2029.0"
       "EstimatedSize"="REG_DWORD", 15269
       "HelpLink"="REG_SZ", "http://help.yandex.ru/bm/"
       "Installed"="REG_DWORD", 1
       "ModifyPath"="REG_SZ", ""C:\Users\{username}\AppData\Local\Package Cache\{d4bb3741-07a4-443a-8c73-0cfda821c697}\BrowserManagerInstaller.exe" /modify"
       "NoElevateOnModify"="REG_DWORD", 1
       "Publisher"="REG_SZ", "Яндекс"
       "QuietUninstallString"="REG_SZ", ""C:\Users\{username}\AppData\Local\Package Cache\{d4bb3741-07a4-443a-8c73-0cfda821c697}\BrowserManagerInstaller.exe" /uninstall /quiet"
       "Resume"="REG_DWORD", 3
       "UninstallString"="REG_SZ", ""C:\Users\{username}\AppData\Local\Package Cache\{d4bb3741-07a4-443a-8c73-0cfda821c697}\BrowserManagerInstaller.exe"  /uninstall"
       "URLInfoAbout"="REG_SZ", "bm.yandex.ru"
       "URLUpdateInfo"="REG_SZ", "bm.yandex.ru"
    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\YaPinLancher]
       "Contact"="REG_SZ", "http://feedback.yandex.ru"
       "DisplayIcon"="REG_SZ", "C:\Users\{username}1\AppData\Local\MICROS~1\INTERN~1\Services\WWWYAN~1.ICO"
       "DisplayName"="REG_SZ", "Yandex taskbar button"
       "DisplayVersion"="REG_SZ", "2.0.4.2157"
       "HelpLink"="REG_SZ", "http://help.yandex.ru/"
       "NoModify"="REG_DWORD", 1
       "NoRepair"="REG_DWORD", 1
       "Publisher"="REG_SZ", "Yandex"
       "UninstallString"="REG_SZ", "C:\Users\{username}\AppData\Local\Yandex\yapin\YandexWorking.exe --uninstall --nopinned"
       "URLInfoAbout"="REG_SZ", "http://legal.yandex.ru/desktop_software_agreement/"
       "URLUpdateInfo"="REG_SZ", "http://soft.yandex.ru/distribution/"
    [HKEY_CURRENT_USER\Software\Yandex\BM]
       "DistrLocale"="REG_SZ", "ru-ru"
       "ExePath"="REG_SZ", ""C:\Users\{username}\AppData\Local\Yandex\BrowserManager\BrowserManager.exe""
    [HKEY_CURRENT_USER\Software\Yandex\BM\Upgrader]
       "ModuleBrowsersProtection"="REG_SZ", "3.0.0.12"
       "ModuleChromium"="REG_SZ", "3.0.0.10"
       "ModuleDefaultBrowser"="REG_SZ", "3.0.0.10"
       "ModuleFirefox"="REG_SZ", "3.0.0.8"
       "ModuleGeo"="REG_SZ", "3.0.0.8"
       "ModuleHelper"="REG_SZ", "3.0.0.8"
       "ModuleHosts"="REG_SZ", "3.0.0.8"
       "ModuleInternetExplorer"="REG_SZ", "3.0.0.8"
       "ModuleOperaPresto"="REG_SZ", "3.0.0.8"
       "ModuleSecurity"="REG_SZ", "3.0.0.12"
       "ModuleSeederInteraction"="REG_SZ", "3.0.0.8"
       "ModuleShortcuts"="REG_SZ", "3.0.0.8"
       "ModuleUpgrader"="REG_SZ", "3.0.0.8"
       "ModuleVoodoo"="REG_SZ", "3.0.0.8"
Malwarebytes log:

Malwarebytes
www.malwarebytes.com

-Log Details-
Scan Date: 8/10/18
Scan Time: 9:21 AM
Log File: f8469579-9c6d-11e8-8c7f-00ffdcc6fdfc.json
Administrator: Yes

-Software Information-
Version: 3.5.1.2522
Components Version: 1.0.391
Update Package Version: 1.0.6283
License: Premium

-System Information-
OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: {computername}\{username}

-Scan Summary-
Scan Type: Threat Scan
Scan Initiated By: Manual
Result: Completed
Objects Scanned: 252649
Threats Detected: 83
Threats Quarantined: 83
Time Elapsed: 4 min, 6 sec

-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Detect
PUM: Detect

-Scan Details-
Process: 1
PUP.Optional.BrowserManager, C:\Users\{username}\AppData\Local\Yandex\BrowserManager\BrowserManager.exe, Quarantined, [777], [383595],1.0.6283

Module: 2
PUP.Optional.BrowserManager, C:\Users\{username}\AppData\Local\Yandex\BrowserManager\x64\SQLite.Interop.dll, Quarantined, [777], [383595],1.0.6283
PUP.Optional.BrowserManager, C:\Users\{username}\AppData\Local\Yandex\BrowserManager\BrowserManager.exe, Quarantined, [777], [383595],1.0.6283

Registry Key: 1
PUP.Optional.RussAd, HKLM\SOFTWARE\WOW6432NODE\GOOGLE\CHROME\EXTENSIONS\ablpcikjmhamjanpibkccdmpoekjigja, Quarantined, [291], [510332],1.0.6283

Registry Value: 1
PUP.Optional.BrowserManager, HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|Browser Manager, Quarantined, [777], [383595],1.0.6283

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 18
PUP.Optional.BrowserManager, C:\Users\{username}\AppData\Local\Yandex\BrowserManager\data\SeederTasks, Quarantined, [777], [383595],1.0.6283
PUP.Optional.BrowserManager, C:\Users\{username}\AppData\Local\Yandex\BrowserManager\settings, Quarantined, [777], [383595],1.0.6283
PUP.Optional.BrowserManager, C:\Users\{username}\AppData\Local\Yandex\BrowserManager\modules, Quarantined, [777], [383595],1.0.6283
PUP.Optional.BrowserManager, C:\Users\{username}\AppData\Local\Yandex\BrowserManager\data, Quarantined, [777], [383595],1.0.6283
PUP.Optional.BrowserManager, C:\Users\{username}\AppData\Local\Yandex\BrowserManager\x64, Quarantined, [777], [383595],1.0.6283
PUP.Optional.BrowserManager, C:\Users\{username}\AppData\Local\Yandex\BrowserManager\x86, Quarantined, [777], [383595],1.0.6283
PUP.Optional.BrowserManager, C:\USERS\{username}\APPDATA\LOCAL\YANDEX\BROWSERMANAGER, Quarantined, [777], [383595],1.0.6283
PUP.Optional.RussAd, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\ablpcikjmhamjanpibkccdmpoekjigja\2.0.4.15_0\_locales\ru, Quarantined, [291], [510332],1.0.6283
PUP.Optional.RussAd, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\ablpcikjmhamjanpibkccdmpoekjigja\2.0.4.15_0\_locales\tr, Quarantined, [291], [510332],1.0.6283
PUP.Optional.RussAd, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\ablpcikjmhamjanpibkccdmpoekjigja\2.0.4.15_0\_locales\uk, Quarantined, [291], [510332],1.0.6283
PUP.Optional.RussAd, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\ablpcikjmhamjanpibkccdmpoekjigja\2.0.4.15_0\contextLib, Quarantined, [291], [510332],1.0.6283
PUP.Optional.RussAd, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\ablpcikjmhamjanpibkccdmpoekjigja\2.0.4.15_0\_metadata, Quarantined, [291], [510332],1.0.6283
PUP.Optional.RussAd, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\ablpcikjmhamjanpibkccdmpoekjigja\2.0.4.15_0\_locales, Quarantined, [291], [510332],1.0.6283
PUP.Optional.RussAd, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\ablpcikjmhamjanpibkccdmpoekjigja\2.0.4.15_0\icons, Quarantined, [291], [510332],1.0.6283
PUP.Optional.RussAd, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\ablpcikjmhamjanpibkccdmpoekjigja\2.0.4.15_0\lib, Quarantined, [291], [510332],1.0.6283
PUP.Optional.RussAd, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\ablpcikjmhamjanpibkccdmpoekjigja\2.0.4.15_0\own, Quarantined, [291], [510332],1.0.6283
PUP.Optional.RussAd, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\ablpcikjmhamjanpibkccdmpoekjigja\2.0.4.15_0, Quarantined, [291], [510332],1.0.6283
PUP.Optional.RussAd, C:\USERS\{username}\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\EXTENSIONS\ablpcikjmhamjanpibkccdmpoekjigja, Quarantined, [291], [510332],1.0.6283

File: 60
PUP.Optional.RussAd, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\60L2DG92.DEFAULT-1519559592148\EXTENSIONS\[email protected], Quarantined, [291], [312601],1.0.6283
PUP.Optional.BrowserManager, C:\Users\{username}\AppData\Local\Yandex\BrowserManager\data\data_exchange, Quarantined, [777], [383595],1.0.6283
PUP.Optional.BrowserManager, C:\Users\{username}\AppData\Local\Yandex\BrowserManager\data\downloads, Quarantined, [777], [383595],1.0.6283
PUP.Optional.BrowserManager, C:\Users\{username}\AppData\Local\Yandex\BrowserManager\data\Events Protection, Quarantined, [777], [383595],1.0.6283
PUP.Optional.BrowserManager, C:\Users\{username}\AppData\Local\Yandex\BrowserManager\data\GeoSettings, Quarantined, [777], [383595],1.0.6283
PUP.Optional.BrowserManager, C:\Users\{username}\AppData\Local\Yandex\BrowserManager\data\hosts, Quarantined, [777], [383595],1.0.6283
PUP.Optional.BrowserManager, C:\Users\{username}\AppData\Local\Yandex\BrowserManager\data\scuts, Quarantined, [777], [383595],1.0.6283
PUP.Optional.BrowserManager, C:\Users\{username}\AppData\Local\Yandex\BrowserManager\data\security, Quarantined, [777], [383595],1.0.6283
PUP.Optional.BrowserManager, C:\Users\{username}\AppData\Local\Yandex\BrowserManager\data\settings, Quarantined, [777], [383595],1.0.6283
PUP.Optional.BrowserManager, C:\Users\{username}\AppData\Local\Yandex\BrowserManager\data\voodoo, Quarantined, [777], [383595],1.0.6283
PUP.Optional.BrowserManager, C:\Users\{username}\AppData\Local\Yandex\BrowserManager\modules\ModuleHelper.dll, Quarantined, [777], [383595],1.0.6283
PUP.Optional.BrowserManager, C:\Users\{username}\AppData\Local\Yandex\BrowserManager\modules\ModuleBrowsersProtection.dll, Quarantined, [777], [383595],1.0.6283
PUP.Optional.BrowserManager, C:\Users\{username}\AppData\Local\Yandex\BrowserManager\modules\ModuleChromium.dll, Quarantined, [777], [383595],1.0.6283
PUP.Optional.BrowserManager, C:\Users\{username}\AppData\Local\Yandex\BrowserManager\modules\ModuleChromium.dll.upgrade, Quarantined, [777], [383595],1.0.6283
PUP.Optional.BrowserManager, C:\Users\{username}\AppData\Local\Yandex\BrowserManager\modules\ModuleDefaultBrowser.dll, Quarantined, [777], [383595],1.0.6283
PUP.Optional.BrowserManager, C:\Users\{username}\AppData\Local\Yandex\BrowserManager\modules\ModuleFirefox.dll, Quarantined, [777], [383595],1.0.6283
PUP.Optional.BrowserManager, C:\Users\{username}\AppData\Local\Yandex\BrowserManager\modules\ModuleGeo.dll, Quarantined, [777], [383595],1.0.6283
PUP.Optional.BrowserManager, C:\Users\{username}\AppData\Local\Yandex\BrowserManager\modules\ModuleH.dll.upgrade, Quarantined, [777], [383595],1.0.6283
PUP.Optional.BrowserManager, C:\Users\{username}\AppData\Local\Yandex\BrowserManager\modules\ModuleHosts.dll, Quarantined, [777], [383595],1.0.6283
PUP.Optional.BrowserManager, C:\Users\{username}\AppData\Local\Yandex\BrowserManager\modules\ModuleInternetExplorer.dll, Quarantined, [777], [383595],1.0.6283
PUP.Optional.BrowserManager, C:\Users\{username}\AppData\Local\Yandex\BrowserManager\modules\ModuleOperaPresto.dll, Quarantined, [777], [383595],1.0.6283
PUP.Optional.BrowserManager, C:\Users\{username}\AppData\Local\Yandex\BrowserManager\modules\ModuleSecurity.dll, Quarantined, [777], [383595],1.0.6283
PUP.Optional.BrowserManager, C:\Users\{username}\AppData\Local\Yandex\BrowserManager\modules\ModuleSecurity.dll.upgrade, Quarantined, [777], [383595],1.0.6283
PUP.Optional.BrowserManager, C:\Users\{username}\AppData\Local\Yandex\BrowserManager\modules\ModuleSeederInteraction.dll, Quarantined, [777], [383595],1.0.6283
PUP.Optional.BrowserManager, C:\Users\{username}\AppData\Local\Yandex\BrowserManager\modules\ModuleShortcuts.dll, Quarantined, [777], [383595],1.0.6283
PUP.Optional.BrowserManager, C:\Users\{username}\AppData\Local\Yandex\BrowserManager\modules\ModuleVoodoo.dll, Quarantined, [777], [383595],1.0.6283
PUP.Optional.BrowserManager, C:\Users\{username}\AppData\Local\Yandex\BrowserManager\modules\ModuleYaB.dll.upgrade, Quarantined, [777], [383595],1.0.6283
PUP.Optional.BrowserManager, C:\Users\{username}\AppData\Local\Yandex\BrowserManager\modules\OfferModule.dll.upgrade, Quarantined, [777], [383595],1.0.6283
PUP.Optional.BrowserManager, C:\Users\{username}\AppData\Local\Yandex\BrowserManager\settings\hosts, Quarantined, [777], [383595],1.0.6283
PUP.Optional.BrowserManager, C:\Users\{username}\AppData\Local\Yandex\BrowserManager\x64\SQLite.Interop.dll, Quarantined, [777], [383595],1.0.6283
PUP.Optional.BrowserManager, C:\Users\{username}\AppData\Local\Yandex\BrowserManager\x86\SQLite.Interop.dll, Quarantined, [777], [383595],1.0.6283
PUP.Optional.BrowserManager, C:\Users\{username}\AppData\Local\Yandex\BrowserManager\BrowserManager.Core.dll, Quarantined, [777], [383595],1.0.6283
PUP.Optional.BrowserManager, C:\Users\{username}\AppData\Local\Yandex\BrowserManager\BrowserManager.Core.UI.dll, Quarantined, [777], [383595],1.0.6283
PUP.Optional.BrowserManager, C:\Users\{username}\AppData\Local\Yandex\BrowserManager\BrowserManager.exe, Quarantined, [777], [383595],1.0.6283
PUP.Optional.BrowserManager, C:\Users\{username}\AppData\Local\Yandex\BrowserManager\Crypto.Core.dll, Quarantined, [777], [383595],1.0.6283
PUP.Optional.BrowserManager, C:\Users\{username}\AppData\Local\Yandex\BrowserManager\MBlauncher.exe, Quarantined, [777], [383595],1.0.6283
PUP.Optional.BrowserManager, C:\Users\{username}\AppData\Local\Yandex\BrowserManager\MBlauncher_x64.exe, Quarantined, [777], [383595],1.0.6283
PUP.Optional.BrowserManager, C:\Users\{username}\AppData\Local\Yandex\BrowserManager\ModuleUpgrader.dll, Quarantined, [777], [383595],1.0.6283
PUP.Optional.BrowserManager, C:\Users\{username}\AppData\Local\Yandex\BrowserManager\ModuleUpgrader.dll.upgrade, Quarantined, [777], [383595],1.0.6283
PUP.Optional.BrowserManager, C:\Users\{username}\AppData\Local\Yandex\BrowserManager\NAudio.dll, Quarantined, [777], [383595],1.0.6283
PUP.Optional.BrowserManager, C:\Users\{username}\AppData\Local\Yandex\BrowserManager\Newtonsoft.Json.dll, Quarantined, [777], [383595],1.0.6283
PUP.Optional.BrowserManager, C:\Users\{username}\AppData\Local\Yandex\BrowserManager\NLog.dll, Quarantined, [777], [383595],1.0.6283
PUP.Optional.BrowserManager, C:\Users\{username}\AppData\Local\Yandex\BrowserManager\RefCheck.dll, Quarantined, [777], [383595],1.0.6283
PUP.Optional.BrowserManager, C:\Users\{username}\AppData\Local\Yandex\BrowserManager\System.Data.SQLite.dll, Quarantined, [777], [383595],1.0.6283
PUP.Optional.RussAd, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\ablpcikjmhamjanpibkccdmpoekjigja\2.0.4.15_0\contextLib\service.js, Quarantined, [291], [510332],1.0.6283
PUP.Optional.RussAd, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\ablpcikjmhamjanpibkccdmpoekjigja\2.0.4.15_0\icons\128.png, Quarantined, [291], [510332],1.0.6283
PUP.Optional.RussAd, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\ablpcikjmhamjanpibkccdmpoekjigja\2.0.4.15_0\icons\16.png, Quarantined, [291], [510332],1.0.6283
PUP.Optional.RussAd, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\ablpcikjmhamjanpibkccdmpoekjigja\2.0.4.15_0\icons\48.png, Quarantined, [291], [510332],1.0.6283
PUP.Optional.RussAd, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\ablpcikjmhamjanpibkccdmpoekjigja\2.0.4.15_0\lib\background.js, Quarantined, [291], [510332],1.0.6283
PUP.Optional.RussAd, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\ablpcikjmhamjanpibkccdmpoekjigja\2.0.4.15_0\lib\cookies.js, Quarantined, [291], [510332],1.0.6283
PUP.Optional.RussAd, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\ablpcikjmhamjanpibkccdmpoekjigja\2.0.4.15_0\own\var.js, Quarantined, [291], [510332],1.0.6283
PUP.Optional.RussAd, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\ablpcikjmhamjanpibkccdmpoekjigja\2.0.4.15_0\_locales\ru\messages.json, Quarantined, [291], [510332],1.0.6283
PUP.Optional.RussAd, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\ablpcikjmhamjanpibkccdmpoekjigja\2.0.4.15_0\_locales\tr\messages.json, Quarantined, [291], [510332],1.0.6283
PUP.Optional.RussAd, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\ablpcikjmhamjanpibkccdmpoekjigja\2.0.4.15_0\_locales\uk\messages.json, Quarantined, [291], [510332],1.0.6283
PUP.Optional.RussAd, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\ablpcikjmhamjanpibkccdmpoekjigja\2.0.4.15_0\_metadata\computed_hashes.json, Quarantined, [291], [510332],1.0.6283
PUP.Optional.RussAd, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\ablpcikjmhamjanpibkccdmpoekjigja\2.0.4.15_0\_metadata\verified_contents.json, Quarantined, [291], [510332],1.0.6283
PUP.Optional.RussAd, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\ablpcikjmhamjanpibkccdmpoekjigja\2.0.4.15_0\manifest.json, Quarantined, [291], [510332],1.0.6283
PUP.Optional.RussAd, C:\USERS\{username}\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Secure Preferences, Replaced, [291], [510332],1.0.6283
PUP.Optional.RussAd, C:\USERS\{username}\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Preferences, Replaced, [291], [510332],1.0.6283
PUP.Optional.Appset, C:\USERS\{username}\DESKTOP\AFTER DEATH.EXE, Quarantined, [4804], [550763],1.0.6283

Physical Sector: 0
(No malicious items detected)

WMI: 0
(No malicious items detected)


(end)
As mentioned before the full version of Malwarebytes could have protected your computer against this threat.
We use different ways of protecting your computer(s):
  • Dynamically Blocks Malware Sites & Servers
  • Malware Execution Prevention
Save yourself the hassle and get protected.
  • 0

Advertisements

Back to Malware Removal Guides and Tutorials


0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

  1. Geeks to Go Community
  2. → Security
  3. → Malware Removal Guides and Tutorials

As Featured On:

featured
Malware Removal How to Guides Windows 7 System Building Download Files Register welcome

Never used a forum? Learn how.