Jump to content

Welcome to Geeks to Go
Geeks to Go Welcome
Create Account Login to Account
Photo

Removal instructions for True PC Booster Master

- - - - - econosoft

  • Please log in to reply
No replies to this topic

#1
Metallica

Metallica

    Spyware Veteran

  • GeekU Moderator
  • 33,101 posts
Content is republished with permission from Malwarebytes.

What is True PC Booster Master?

The Malwarebytes research team has determined that True PC Booster Master is a "system optimizer". These so-called "system optimizers" use intentional false positives to convince users that their systems have problems. Then they try to sell you their software, claiming it will remove these problems.
More information can be found on our Malwarebytes Labs blog.

How do I know if I am infected with True PC Booster Master?

This is how the main screen of the system optimizer looks:

main.png

You will find these icons in your taskbar, your startmenu, and on your desktop:

icons.png

and see these warnings during install:

warning1.png

warning2.png

and this type of screens during "operations":

warning5.png

You may see this entry in your list of installed programs:

warning4.png

and these tasks in your list of Scheduled Tasks:

warning3.png

How did True PC Booster Master get on my computer?

These so-called system optimizers use different methods of getting installed. This particular one was downloaded from their website:

website.png

How do I remove True PC Booster Master?

Our program Malwarebytes can detect and remove this potentially unwanted application.
  • Please download Malwarebytes to your desktop.
  • Double-click mb3-setup-consumer-{version}.exe and follow the prompts to install the program.
  • Then click Finish.
  • Once the program has fully updated, select Scan Now on the Dashboard. Or select the Threat Scan from the Scan menu.
  • If another update of the definitions is available, it will be implemented before the rest of the scanning procedure.
  • When the scan is complete, make sure that all Threats are selected, and click Remove Selected.
  • Restart your computer when prompted to do so.
Is there anything else I need to do to get rid of True PC Booster Master?
  • No, Malwarebytes removes True PC Booster Master completely.
  • This PUP creates some scheduled tasks. You can read here how to check for and, if necessary, remove Scheduled Tasks.
How would the full version of Malwarebytes help protect me?

We hope our application and this guide have helped you eradicate this system optimizer.

As you can see below the full version of Malwarebytes would have protected you against the True PC Booster Master installer. It would have warned you before the application could install itself, giving you a chance to stop it before it became too late.

protection1.png


and both Malwarebytes Premium and Browser Guard block access to their domain:

protection2.png


Technical details for experts

You may see these entries in FRST logs:

(Econosoft Global Services PTE. LTD. -> Econosoft Global Services Pte. Ltd.) C:\Program Files (x86)\True PC Booster Master\pcpowerplus.exe
(Econosoft Global Services Pte. Ltd.) [File not signed] C:\Program Files (x86)\True PC Booster Master\pcpowerplus_protection.exe
Task: {12C05BE5-E4D8-4B6A-99B1-232261167CD1} - System32\Tasks\True PC Booster Master Startup => C:\Program Files (x86)\True PC Booster Master\pcpowerplus_protection.exe [333312 2019-09-24] (Econosoft Global Services Pte. Ltd.) [File not signed]
Task: {5BA42EA2-3F3C-4415-9A97-3E059C2FC45D} - System32\Tasks\True PC Booster Master => C:\Program Files (x86)\True PC Booster Master\pcpowerplus.exe [7879984 2019-09-24] (Econosoft Global Services PTE. LTD. -> Econosoft Global Services Pte. Ltd.)
C:\Windows\system32\Tasks\True PC Booster Master Startup
C:\Windows\system32\Tasks\True PC Booster Master
C:\Users\Public\Desktop\True PC Booster Master.lnk
C:\ProgramData\Desktop\True PC Booster Master.lnk
C:\Users\{username}\AppData\Roaming\True PC Booster Master
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\True PC Booster Master
C:\Program Files (x86)\True PC Booster Master
(Econosoft Global Services Pte. Ltd. ) C:\Users\{username}\Downloads\truepcboostermaster.exe

True PC Booster Master (HKLM-x32\...\{61CB58F3-6B6F-488A-9163-2B56F3F44296}}_is1) (Version: 1.0 - Econosoft Global Services Pte. Ltd.)
Alterations made by the installer:

File system details [View: All details] (Selection)
---------------------------------------------------
    Adds the folder C:\Program Files (x86)\True PC Booster Master
       Adds the file Core.dll"="4/19/2018 1:01 AM, 237568 bytes, A
       Adds the file DiscUtils.Common.dll"="4/19/2018 1:01 AM, 23040 bytes, A
       Adds the file DiscUtils.dll"="4/19/2018 1:01 AM, 915456 bytes, A
       Adds the file DiscUtils.MSBuild.dll"="4/19/2018 1:01 AM, 8192 bytes, A
       Adds the file DynamicDataDisplay.dll"="4/19/2018 1:01 AM, 316416 bytes, A
       Adds the file errordetailsOpt.xml"="10/31/2019 11:29 AM, 1189982 bytes, A
       Adds the file errorlog.txt"="7/12/2019 1:46 AM, 189 bytes, A
       Adds the file Interop.IWshRuntimeLibrary.dll"="4/19/2018 1:01 AM, 49152 bytes, A
       Adds the file Interop.NATUPNPLib.dll"="4/19/2018 1:01 AM, 7680 bytes, A
       Adds the file Interop.NETCONLib.dll"="4/19/2018 1:01 AM, 10240 bytes, A
       Adds the file Interop.NetFwTypeLib.dll"="4/19/2018 1:01 AM, 19456 bytes, A
       Adds the file ISID.dll"="4/19/2018 1:01 AM, 1605120 bytes, A
       Adds the file logo.ico"="9/11/2019 4:10 AM, 21662 bytes, A
       Adds the file Microsoft.Win32.TaskScheduler.dll"="4/19/2018 1:01 AM, 171008 bytes, A
       Adds the file pcpowerplus.exe"="9/24/2019 10:21 AM, 7879984 bytes, A
       Adds the file pcpowerplus_protection.exe"="9/24/2019 10:20 AM, 333312 bytes, A
       Adds the file SharpCompress.dll"="4/19/2018 1:01 AM, 418304 bytes, A
       Adds the file System.Data.SQLite.dll"="4/19/2018 1:01 AM, 280576 bytes, A
       Adds the file System.Windows.Controls.Layout.Toolkit.dll"="4/19/2018 1:01 AM, 95064 bytes, A
       Adds the file unins000.dat"="10/31/2019 11:17 AM, 54831 bytes, A
       Adds the file unins000.exe"="10/31/2019 11:17 AM, 2556720 bytes, A
       Adds the file unins000.msg"="10/31/2019 11:17 AM, 23125 bytes, A
       Adds the file WpfAnimatedGif.dll"="4/19/2018 1:01 AM, 28160 bytes, A
       Adds the file WPFToolkit.dll"="4/19/2018 1:01 AM, 467288 bytes, A
    Adds the folder C:\Program Files (x86)\True PC Booster Master\Backup
       Adds the file 2019_07_22_052127.xml"="7/22/2019 6:21 AM, 65 bytes, A
       Adds the file 2019_07_22_052142.xml"="7/22/2019 6:21 AM, 65 bytes, A
    Adds the folder C:\Program Files (x86)\True PC Booster Master\de
       Adds the file pcpowerplus.resources.dll"="9/24/2019 10:21 AM, 73728 bytes, A
    Adds the folder C:\Program Files (x86)\True PC Booster Master\en
       Adds the file pcpowerplus.resources.dll"="9/24/2019 10:21 AM, 68608 bytes, A
    Adds the folder C:\Program Files (x86)\True PC Booster Master\fr
       Adds the file pcpowerplus.resources.dll"="9/24/2019 10:21 AM, 76288 bytes, A
    Adds the folder C:\Program Files (x86)\True PC Booster Master\ja-jp
       Adds the file pcpowerplus.resources.dll"="9/24/2019 10:21 AM, 86016 bytes, A
    Adds the folder C:\Program Files (x86)\True PC Booster Master\slider
       Adds the file Slider-1.jpg"="4/19/2018 1:01 AM, 77585 bytes, A
       Adds the file Slider-2.jpg"="4/19/2018 1:01 AM, 79413 bytes, A
    Adds the folder C:\Program Files (x86)\True PC Booster Master\uni
       Adds the file System.Data.SQLite.dll"="3/1/2018 10:21 PM, 353280 bytes, A
       Adds the file System.Data.SQLite.xml"="3/1/2018 10:21 PM, 1051056 bytes, A
       Adds the file Uninstaller.exe"="9/24/2019 10:20 AM, 468992 bytes, A
       Adds the file Uninstaller.exe.config"="8/21/2019 3:28 AM, 1552 bytes, A
       Adds the file Uninstaller.pdb"="9/24/2019 10:20 AM, 259584 bytes, A
    Adds the folder C:\Program Files (x86)\True PC Booster Master\uni\de
       Adds the file Uninstaller.resources.dll"="9/24/2019 10:20 AM, 27648 bytes, A
    Adds the folder C:\Program Files (x86)\True PC Booster Master\uni\en
       Adds the file Uninstaller.resources.dll"="9/24/2019 10:20 AM, 25600 bytes, A
    Adds the folder C:\Program Files (x86)\True PC Booster Master\uni\ja-jp
       Adds the file Uninstaller.resources.dll"="9/24/2019 10:20 AM, 33280 bytes, A
    Adds the folder C:\Program Files (x86)\True PC Booster Master\x64
       Adds the file SQLite.Interop.dll"="4/19/2018 1:01 AM, 1205248 bytes, A
    Adds the folder C:\Program Files (x86)\True PC Booster Master\x86
       Adds the file SQLite.Interop.dll"="4/19/2018 1:01 AM, 903168 bytes, A
    Adds the folder C:\ProgramData\Microsoft\Windows\Start Menu\Programs\True PC Booster Master
       Adds the file True PC Booster Master.lnk"="10/31/2019 11:17 AM, 1242 bytes, A
    Adds the folder C:\Users\{username}\AppData\Roaming\True PC Booster Master
    Adds the folder C:\Users\{username}\AppData\Roaming\True PC Booster Master\PC Repair Online
    Adds the folder C:\Users\{username}\AppData\Roaming\True PC Booster Master\PC Repair Online\setting
       Adds the file TPCBM.ash"="10/31/2019 11:29 AM, 590848 bytes, A
    In the existing folder C:\Users\Public\Desktop
       Adds the file True PC Booster Master.lnk"="10/31/2019 11:17 AM, 1224 bytes, A
    In the existing folder C:\Windows\System32\Tasks
       Adds the file True PC Booster Master"="10/31/2019 11:17 AM, 3254 bytes, A
       Adds the file True PC Booster Master Startup"="10/31/2019 11:17 AM, 3276 bytes, A

Registry details [View: All details] (Selection)
------------------------------------------------
    [HKEY_LOCAL_MACHINE\SOFTWARE\FT\TPBM\Activation]
       "Insdate"="REG_SZ", "4YHHUl1i1Br9iF7MWsYJCuGaAfmboNGpoAgMpwXQ1BI="
       "language"="REG_SZ", "en"
       "languageindex"="REG_SZ", "0"
       "lap"="REG_SZ", "MaJ2gPoqxd8XfUpiR6yGApWiy6PWHK7vLv3JQKF+yuU="
       "lbp"="REG_SZ", "MaJ2gPoqxd8XfUpiR6yGApWiy6PWHK7vLv3JQKF+yuU="
       "lr"="REG_SZ", "MaJ2gPoqxd8XfUpiR6yGApWiy6PWHK7vLv3JQKF+yuU="
       "lsp"="REG_SZ", "MaJ2gPoqxd8XfUpiR6yGApWiy6PWHK7vLv3JQKF+yuU="
       "Program"="REG_SZ", "True PC Booster Master"
       "Version"="REG_SZ", "1.0"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\FT\TPBM\Activation]
       "IsTrack"="REG_SZ", "1"
       "language"="REG_SZ", "en"
       "languageindex"="REG_SZ", "0"
       "Program"="REG_SZ", "True PC Booster Master"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{61CB58F3-6B6F-488A-9163-2B56F3F44296}}_is1]
       "Comments"="REG_SZ", "True PC Booster Master"
       "Contact"="REG_SZ", "+1 (888)200-8889"
       "DisplayIcon"="REG_SZ", "C:\Program Files (x86)\True PC Booster Master\logo.ico"
       "DisplayName"="REG_SZ", "True PC Booster Master"
       "DisplayVersion"="REG_SZ", "1.0"
       "EstimatedSize"="REG_DWORD", 22389
       "Inno Setup: App Path"="REG_SZ", "C:\Program Files (x86)\True PC Booster Master"
       "Inno Setup: Icon Group"="REG_SZ", "True PC Booster Master"
       "Inno Setup: Language"="REG_SZ", "en"
       "Inno Setup: Setup Version"="REG_SZ", "6.0.2 (u)"
       "Inno Setup: User"="REG_SZ", "{username}"
       "InstallDate"="REG_SZ", "20191031"
       "InstallLocation"="REG_SZ", "C:\Program Files (x86)\True PC Booster Master\"
       "MajorVersion"="REG_DWORD", 1
       "MinorVersion"="REG_DWORD", 0
       "NoModify"="REG_DWORD", 1
       "NoRepair"="REG_DWORD", 1
       "Publisher"="REG_SZ", "Econosoft Global Services Pte. Ltd."
       "QuietUninstallString"="REG_SZ", ""C:\Program Files (x86)\True PC Booster Master\unins000.exe" /SILENT"
       "UninstallString"="REG_SZ", ""C:\Program Files (x86)\True PC Booster Master\unins000.exe""
       "VersionMajor"="REG_DWORD", 1
       "VersionMinor"="REG_DWORD", 0
Malwarebytes log:

Malwarebytes
www.malwarebytes.com

-Log Details-
Scan Date: 10/31/19
Scan Time: 11:45 AM
Log File: 85603082-fbcb-11e9-a177-00ffdcc6fdfc.json

-Software Information-
Version: 3.8.3.2965
Components Version: 1.0.629
Update Package Version: 1.0.13127
License: Premium

-System Information-
OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: {computername}\{username}

-Scan Summary-
Scan Type: Threat Scan
Scan Initiated By: Manual
Result: Completed
Objects Scanned: 234214
Threats Detected: 20
Threats Quarantined: 20
Time Elapsed: 14 min, 58 sec

-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Detect
PUM: Detect

-Scan Details-
Process: 2
PUP.Optional.PCBooster, C:\PROGRAM FILES (X86)\TRUE PC BOOSTER MASTER\PCPOWERPLUS_PROTECTION.EXE, Quarantined, [587], [749298],1.0.13127
PUP.Optional.PCBooster, C:\PROGRAM FILES (X86)\TRUE PC BOOSTER MASTER\PCPOWERPLUS.EXE, Quarantined, [587], [749298],1.0.13127

Module: 2
PUP.Optional.PCBooster, C:\PROGRAM FILES (X86)\TRUE PC BOOSTER MASTER\PCPOWERPLUS_PROTECTION.EXE, Quarantined, [587], [749298],1.0.13127
PUP.Optional.PCBooster, C:\PROGRAM FILES (X86)\TRUE PC BOOSTER MASTER\PCPOWERPLUS.EXE, Quarantined, [587], [749298],1.0.13127

Registry Key: 7
PUP.Optional.PCBooster, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\True PC Booster Master Startup, Quarantined, [587], [749298],1.0.13127
PUP.Optional.PCBooster, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{12C05BE5-E4D8-4B6A-99B1-232261167CD1}, Quarantined, [587], [749298],1.0.13127
PUP.Optional.PCBooster, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\LOGON\{12C05BE5-E4D8-4B6A-99B1-232261167CD1}, Quarantined, [587], [749298],1.0.13127
PUP.Optional.PCBooster, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\True PC Booster Master, Quarantined, [587], [749298],1.0.13127
PUP.Optional.PCBooster, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{5BA42EA2-3F3C-4415-9A97-3E059C2FC45D}, Quarantined, [587], [749298],1.0.13127
PUP.Optional.PCBooster, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\LOGON\{5BA42EA2-3F3C-4415-9A97-3E059C2FC45D}, Quarantined, [587], [749298],1.0.13127
PUP.Optional.PCBooster, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{61CB58F3-6B6F-488A-9163-2B56F3F44296}}_is1, Quarantined, [587], [711523],1.0.13127

Registry Value: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 0
(No malicious items detected)

File: 9
PUP.Optional.PCBooster, C:\WINDOWS\SYSTEM32\TASKS\True PC Booster Master Startup, Quarantined, [587], [749298],1.0.13127
PUP.Optional.PCBooster, C:\PROGRAM FILES (X86)\TRUE PC BOOSTER MASTER\PCPOWERPLUS_PROTECTION.EXE, Quarantined, [587], [749298],1.0.13127
PUP.Optional.PCBooster, C:\WINDOWS\SYSTEM32\TASKS\True PC Booster Master, Quarantined, [587], [749298],1.0.13127
PUP.Optional.PCBooster, C:\DOCUMENTS AND SETTINGS\PUBLIC\Desktop\True PC Booster Master.lnk, Quarantined, [587], [749298],1.0.13127
PUP.Optional.PCBooster, C:\USERS\PUBLIC\Desktop\True PC Booster Master.lnk, Quarantined, [587], [749298],1.0.13127
PUP.Optional.PCBooster, C:\PROGRAM FILES (X86)\TRUE PC BOOSTER MASTER\PCPOWERPLUS.EXE, Quarantined, [587], [749298],1.0.13127
PUP.Optional.PCBooster, C:\PROGRAM FILES (X86)\TRUE PC BOOSTER MASTER\UNINS000.EXE, Quarantined, [587], [711523],1.0.13127
PUP.Optional.PCBooster, C:\USERS\{username}\DESKTOP\TRUEPCBOOSTERMASTER.EXE, Quarantined, [587], [711523],1.0.13127
PUP.Optional.PCBooster, C:\USERS\{username}\DOWNLOADS\TRUEPCBOOSTERMASTER.EXE, Quarantined, [587], [711523],1.0.13127

Physical Sector: 0
(No malicious items detected)

WMI: 0
(No malicious items detected)


(end)
As mentioned before the full version of Malwarebytes could have protected your computer against this threat.
We use different ways of protecting your computer(s):
  • Dynamically Blocks Malware Sites & Servers
  • Malware Execution Prevention
Save yourself the hassle and get protected.
  • 0

Advertisements






Also tagged with one or more of these keywords: econosoft

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

featured
Malware Removal How to Guides Windows 7 System Building Download Files Register welcome

Never used a forum? Learn how.