Jump to content

Welcome to Geeks to Go
Geeks to Go Welcome
Create Account Login to Account
Photo

Removal instructions for Max Uninstaller

- - - - -
Started by Metallica , Feb 04 2020 03:43 AM

  • Please log in to reply
No replies to this topic

#1
Metallica
Posted 04 February 2020 - 03:43 AM

Metallica

    Spyware Veteran

  • GeekU Moderator
  • 33,101 posts
Content is republished with permission from Malwarebytes.

What is Max Uninstaller?

The Malwarebytes research team has determined that Max Uninstaller is a "system tool". These so-called "system tools" use intentional false positives to convince users that their systems have problems. Then they try to sell you their software, claiming it will remove these problems.

How do I know if I am infected with Max Uninstaller?

This is how the main screen of the system tool looks:

main.png

You will find these icons in your taskbar, your startmenu, and on your desktop:

icons.png

and see these warnings during install:

warning1.png

warning2.png

and these types of screens during "operations":

warning5.png

warning6.png

You may see this entry in your list of installed programs:

warning4.png

How did Max Uninstaller get on my computer?

These so-called system tools use different methods of getting installed. This particular one was downloaded from their website:

website.png

How do I remove Max Uninstaller?

Our program Malwarebytes can detect and remove this potentially unwanted application.
  • Please download Malwarebytes for Windows to your desktop.
  • Double-click MBSetup.exe and follow the prompts to install the program.
  • When your Malwarebytes for Windows installation completes, the program opens to the Welcome to Malwarebytes screen.
  • Click on the Get started button.
  • Click Scan to start a Threat Scan.
  • When the scan is finished click Quarantine to remove the found threats.
  • Reboot the system if prompted to complete the removal process.
Is there anything else I need to do to get rid of Max Uninstaller?
  • No, Malwarebytes removes Max Uninstaller completely.
How would the full version of Malwarebytes help protect me?

We hope our application and this guide have helped you eradicate this system optimizer.

As you can see below the full version of Malwarebytes would have protected you against the Max Uninstaller installer. It would have warned you before the application could install itself, giving you a chance to stop it before it became too late.

protection1.png


Technical details for experts

You may see these entries in FRST logs:

(Ideakee Inc -> ) C:\Program Files (x86)\Max Uninstaller\MU.exe
C:\Users\Public\Desktop\Max Uninstaller.lnk
C:\ProgramData\Desktop\Max Uninstaller.lnk
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Max Uninstaller
C:\Program Files (x86)\Max Uninstaller
(hxxps://www.maxuninstaller.com/ ) C:\Users\{username}\Desktop\MaxUninstaller_Setup.exe

Max Uninstaller version 3.8 (HKLM-x32\...\{C7022C9B-4DE0-4A57-B395-ED3BFDB78D73}_is1) (Version: 3.8 - hxxps://www.maxuninstaller.com/)
Alterations made by the installer:

File system details [View: All details] (Selection)
---------------------------------------------------
    Adds the folder C:\Program Files (x86)\Max Uninstaller
       Adds the file ALMU.exe"="12/7/2016 11:03 AM, 849608 bytes, A
       Adds the file installedsoftware.txt"="2/4/2020 9:01 AM, 919 bytes, A
       Adds the file j_fixcs.dll"="4/8/2014 2:42 PM, 1937608 bytes, A
       Adds the file License.txt"="12/7/2016 11:13 AM, 6381 bytes, A
       Adds the file MU.exe"="5/9/2017 10:37 AM, 5458632 bytes, A
       Adds the file MU_UCC.exe"="12/7/2016 11:03 AM, 3222720 bytes, A
       Adds the file MU_Update.exe"="12/7/2016 11:04 AM, 2013896 bytes, A
       Adds the file s_fixcs.dll"="3/31/2014 4:14 PM, 3829960 bytes, A
       Adds the file sqlite3.dll"="3/31/2014 4:14 PM, 651936 bytes, A
       Adds the file unins000.dat"="2/4/2020 9:01 AM, 9055 bytes, A
       Adds the file unins000.exe"="2/4/2020 9:00 AM, 1190896 bytes, A
       Adds the file unins000.msg"="2/4/2020 9:01 AM, 22701 bytes, A
       Adds the file Uninstall.ico"="11/18/2011 3:35 PM, 17542 bytes, A
       Adds the file UnZip.dll"="3/3/2014 3:16 PM, 1223368 bytes, A
    Adds the folder C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Max Uninstaller
       Adds the file Max Uninstaller.lnk"="2/4/2020 9:01 AM, 1050 bytes, A
       Adds the file Uninstall Max Uninstaller.lnk"="2/4/2020 9:01 AM, 1174 bytes, A
    In the existing folder C:\Users\{username}\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch
       Adds the file Max Uninstaller.lnk"="2/4/2020 9:01 AM, 1056 bytes, A
    In the existing folder C:\Users\Public\Desktop
       Adds the file Max Uninstaller.lnk"="2/4/2020 9:01 AM, 1032 bytes, A

Registry details [View: All details] (Selection)
------------------------------------------------
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{C7022C9B-4DE0-4A57-B395-ED3BFDB78D73}_is1]
       "DisplayIcon"="REG_SZ", "C:\Program Files (x86)\Max Uninstaller\Uninstall.ico"
       "DisplayName"="REG_SZ", "Max Uninstaller version 3.8"
       "DisplayVersion"="REG_SZ", "3.8"
       "EstimatedSize"="REG_DWORD", 20754
       "HelpLink"="REG_SZ", "https://www.maxuninstaller.com/"
       "Inno Setup: App Path"="REG_SZ", "C:\Program Files (x86)\Max Uninstaller"
       "Inno Setup: Deselected Tasks"="REG_SZ", ""
       "Inno Setup: Icon Group"="REG_SZ", "Max Uninstaller"
       "Inno Setup: Language"="REG_SZ", "default"
       "Inno Setup: Selected Tasks"="REG_SZ", "desktopicon,quicklaunchicon"
       "Inno Setup: Setup Version"="REG_SZ", "5.5.5 (u)"
       "Inno Setup: User"="REG_SZ", "{username}"
       "InstallDate"="REG_SZ", "20200204"
       "InstallLocation"="REG_SZ", "C:\Program Files (x86)\Max Uninstaller\"
       "MajorVersion"="REG_DWORD", 3
       "MinorVersion"="REG_DWORD", 8
       "NoModify"="REG_DWORD", 1
       "NoRepair"="REG_DWORD", 1
       "Publisher"="REG_SZ", "https://www.maxuninstaller.com/"
       "QuietUninstallString"="REG_SZ", ""C:\Program Files (x86)\Max Uninstaller\unins000.exe" /SILENT"
       "UninstallString"="REG_SZ", ""C:\Program Files (x86)\Max Uninstaller\unins000.exe""
       "URLInfoAbout"="REG_SZ", "https://www.maxuninstaller.com/"
       "URLUpdateInfo"="REG_SZ", "https://www.maxuninstaller.com/"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MU_FROM]
       "Id"="REG_EXPAND_SZ, "all"
       "LastUn"="REG_EXPAND_SZ, "no"
       "Site"="REG_EXPAND_SZ, "maxuninstaller.com"
Malwarebytes log:

Malwarebytes
www.malwarebytes.com

-Log Details-
Scan Date: 2/4/20
Scan Time: 9:11 AM
Log File: e9422a74-4725-11ea-81d2-00ffdcc6fdfc.json

-Software Information-
Version: 4.0.4.49
Components Version: 1.0.810
Update Package Version: 1.0.18684
License: Premium

-System Information-
OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: {computername}\{username}

-Scan Summary-
Scan Type: Threat Scan
Scan Initiated By: Manual
Result: Completed
Objects Scanned: 235914
Threats Detected: 34
Threats Quarantined: 34
Time Elapsed: 18 min, 4 sec

-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Detect
PUM: Detect

-Scan Details-
Process: 1
PUP.Optional.MaxUnInstaller, C:\Program Files (x86)\Max Uninstaller\MU.exe, Quarantined, 3170, 786750, , , , 

Module: 1
PUP.Optional.MaxUnInstaller, C:\Program Files (x86)\Max Uninstaller\MU.exe, Quarantined, 3170, 786750, , , , 

Registry Key: 2
PUP.Optional.MaxUninstaller, HKLM\SOFTWARE\WOW6432NODE\MU_FROM, Quarantined, 6959, 786754, 1.0.18684, , ame, 
PUP.Optional.MaxUnInstaller, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{C7022C9B-4DE0-4A57-B395-ED3BFDB78D73}_is1, Quarantined, 3170, 786750, , , , 

Registry Value: 1
PUP.Optional.MaxUninstaller, HKLM\SOFTWARE\WOW6432NODE\MU_FROM|SITE, Quarantined, 6959, 786754, 1.0.18684, , ame, 

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 2
PUP.Optional.MaxUnInstaller, C:\PROGRAM FILES (X86)\MAX UNINSTALLER, Quarantined, 3170, 786750, 1.0.18684, , ame, 
PUP.Optional.MaxUnInstaller, C:\PROGRAMDATA\MICROSOFT\WINDOWS\START MENU\PROGRAMS\MAX UNINSTALLER, Quarantined, 3170, 786751, 1.0.18684, , ame, 

File: 27
PUP.Optional.MaxUnInstaller, C:\Program Files (x86)\Max Uninstaller\ALMU.exe, Quarantined, 3170, 786750, , , , 
PUP.Optional.MaxUnInstaller, C:\Program Files (x86)\Max Uninstaller\installedsoftware.txt, Quarantined, 3170, 786750, , , , 
PUP.Optional.MaxUnInstaller, C:\Program Files (x86)\Max Uninstaller\j_fixcs.dll, Quarantined, 3170, 786750, , , , 
PUP.Optional.MaxUnInstaller, C:\Program Files (x86)\Max Uninstaller\License.txt, Quarantined, 3170, 786750, , , , 
PUP.Optional.MaxUnInstaller, C:\Program Files (x86)\Max Uninstaller\MU.exe, Quarantined, 3170, 786750, , , , 
PUP.Optional.MaxUnInstaller, C:\Program Files (x86)\Max Uninstaller\MU_UCC.exe, Quarantined, 3170, 786750, , , , 
PUP.Optional.MaxUnInstaller, C:\Program Files (x86)\Max Uninstaller\MU_Update.exe, Quarantined, 3170, 786750, , , , 
PUP.Optional.MaxUnInstaller, C:\Program Files (x86)\Max Uninstaller\RAConfig.txt, Quarantined, 3170, 786750, , , , 
PUP.Optional.MaxUnInstaller, C:\Program Files (x86)\Max Uninstaller\SIConfig.txt, Quarantined, 3170, 786750, , , , 
PUP.Optional.MaxUnInstaller, C:\Program Files (x86)\Max Uninstaller\SLF_FI.txt, Quarantined, 3170, 786750, , , , 
PUP.Optional.MaxUnInstaller, C:\Program Files (x86)\Max Uninstaller\SLF_FL.txt, Quarantined, 3170, 786750, , , , 
PUP.Optional.MaxUnInstaller, C:\Program Files (x86)\Max Uninstaller\SLF_RG.txt, Quarantined, 3170, 786750, , , , 
PUP.Optional.MaxUnInstaller, C:\Program Files (x86)\Max Uninstaller\sqlite3.dll, Quarantined, 3170, 786750, , , , 
PUP.Optional.MaxUnInstaller, C:\Program Files (x86)\Max Uninstaller\s_fixcs.dll, Quarantined, 3170, 786750, , , , 
PUP.Optional.MaxUnInstaller, C:\Program Files (x86)\Max Uninstaller\unins000.dat, Quarantined, 3170, 786750, , , , 
PUP.Optional.MaxUnInstaller, C:\Program Files (x86)\Max Uninstaller\unins000.exe, Quarantined, 3170, 786750, , , , 
PUP.Optional.MaxUnInstaller, C:\Program Files (x86)\Max Uninstaller\unins000.msg, Quarantined, 3170, 786750, , , , 
PUP.Optional.MaxUnInstaller, C:\Program Files (x86)\Max Uninstaller\Uninstall.ico, Quarantined, 3170, 786750, , , , 
PUP.Optional.MaxUnInstaller, C:\Program Files (x86)\Max Uninstaller\uninstalledsoftware.txt, Quarantined, 3170, 786750, , , , 
PUP.Optional.MaxUnInstaller, C:\Program Files (x86)\Max Uninstaller\UnZip.dll, Quarantined, 3170, 786750, , , , 
PUP.Optional.MaxUnInstaller, C:\DOCUMENTS AND SETTINGS\PUBLIC\Desktop\Max Uninstaller.lnk, Quarantined, 3170, 786750, , , , 
PUP.Optional.MaxUnInstaller, C:\USERS\{username}\APPDATA\ROAMING\Microsoft\Internet Explorer\Quick Launch\Max Uninstaller.lnk, Quarantined, 3170, 786750, , , , 
PUP.Optional.MaxUnInstaller, C:\USERS\PUBLIC\Desktop\Max Uninstaller.lnk, Quarantined, 3170, 786750, , , , 
PUP.Optional.MaxUnInstaller, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Max Uninstaller\Max Uninstaller.lnk, Quarantined, 3170, 786751, , , , 
PUP.Optional.MaxUnInstaller, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Max Uninstaller\Uninstall Max Uninstaller.lnk, Quarantined, 3170, 786751, , , , 
PUP.Optional.MaxUnInstaller, C:\PROGRAMDATA\MICROSOFT\WINDOWS DEFENDER\LOCALCOPY\{435EC95C-BD80-49EA-BF45-9949E3ED7A71}-MAXUNINSTALLER_SETUP.EXE, Quarantined, 3170, 786767, 1.0.18684, , ame, 
PUP.Optional.MaxUnInstaller, C:\USERS\{username}\DESKTOP\MAXUNINSTALLER_SETUP.EXE, Quarantined, 3170, 786767, 1.0.18684, , ame, 

Physical Sector: 0
(No malicious items detected)

WMI: 0
(No malicious items detected)


(end)
As mentioned before the full version of Malwarebytes could have protected your computer against this threat.
We use different ways of protecting your computer(s):
  • Dynamically Blocks Malware Sites & Servers
  • Malware Execution Prevention
Save yourself the hassle and get protected.
  • 0

Advertisements

Back to Malware Removal Guides and Tutorials


0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

  1. Geeks to Go Community
  2. → Security
  3. → Malware Removal Guides and Tutorials

As Featured On:

featured
Malware Removal How to Guides Windows 7 System Building Download Files Register welcome

Never used a forum? Learn how.