Ghokswa Browser
Posted: November 18, 2015
Threat Metric
The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to
give every identifiable malware threat. Our Threat Meter includes several criteria based off of
specific malware threats to value their severity, reach and volume. The Threat Meter is able to give
you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count,
Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic
breakdown of how all threats are ranked within our own extensive malware database. The scoring for
each specific malware threat can be easily compared to other emerging threats to draw a contrast in
its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to
remove a threat or pursue additional analytical research for all types of computer users.
The following fields listed on the Threat Meter containing a specific value, are explained in detail below:
Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.
Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.
Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.
Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.
% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.
The following fields listed on the Threat Meter containing a specific value, are explained in detail below:
Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.
Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.
Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.
Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.
% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.
| Ranking: | 98 |
|---|---|
| Threat Level: | 1/10 |
| Infected PCs: | 1,107,853 |
| First Seen: | November 18, 2015 |
|---|---|
| Last Seen: | October 17, 2023 |
| OS(es) Affected: | Windows |
The Ghokswa Browser is a recompiled version of Chrome sometimes associated with shortcut hijackings and unwanted installations. Since these habits tend to be signs of unwanted products that may monitor your information or launch additional advertisements, malware experts have classified the Ghokswa Browser as being a Potentially Unwanted Program (PUP) until further information is available. Most PC users should use their anti-malware and anti-adware software for deleting a Ghokswa Browser, which has a well-documented history of reinstalling itself when removed by standard methods.
The 'Other' Chrome You Didn't Know About
The Chrome's popularity as a 'safe' Web browser has made it one of the prime targets for adware and other extensions dedicated to loading unwanted or even threatening Web content ironically. However, some developers of Potentially Unwanted Programs go even further than that, and may replace your Chrome browser in its entirety. This trend is one that malware analysts have seen in previous products, such as the Crxbro Browser, and now are seeing in the Ghokswa Browser.
While the Ghokswa Browser does have a dedicated website, either its developers or even third parties have been distributing this browser through alternative means, such as bundled downloads, mislabeled e-mail attachments or browser exploits. As of the last two months of 2015, most PC users report of experiencing the Ghokswa Browser installing itself automatically. The Ghokswa Browser does display an entry in the Windows 'installed programs' list, although efforts at removing the Ghokswa Browser through traditional means merely result in its reinstalling itself.
In addition to reinstalling itself, the Ghokswa Browser also may hijack your default Chrome shortcuts and file associations (such as what browser launches when you double-click an HTML file). Other discrepancies you may notice include additional advertising content being served by the Ghokswa Browser, extended loading times, redirects to unwanted websites or extra usage of your system resources. Malware analysts have not yet identified any confirmed, threatening behavior from the Ghokswa Browser, although a minority of PC security companies have gone so far as to label its site as toxic.
Restoring a Chrome Browser to Its Original Shine
Despite its being a rebuild of Chrome, the Ghokswa Browser's poor business practices and notably installation changes force malware analysts to recommend deleting this program, much as they already have recommended for the Crxbro Browser. Once you've verified that the Ghokswa Browser is on your PC, restart into Safe Mode and launch system scans with appropriate security products while keeping all browsers closed. You also may need to reinstall the original version of Chrome to restore your shortcuts. While doing so, be sure to avoid reinstalling the Ghokswa Browser unintentionally, due to interacting with a 'hijacked' file link.
Techniques like the ones seen in the Ghokswa Browser may serve advertisements, much like an invasive form of adware. However, some con artists also may use them for collecting information. If you've transferred passwords, account names, or other, sensitive information through a Ghokswa Browser, that information may be used against you. After cleaning up the Ghokswa Browser, you should change all passwords as needed and contact related institutions, such as your bank, when it's appropriate.
Technical Details
File System Modifications
Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.
The following files were created in the system:c:\programdata\apple\temp\upgrade.ini:ad
File name: upgrade.ini:adSize: 99.84 KB (99840 bytes)
MD5: f4dc24f953c05ffff726f1394b70cbf7
Detection count: 1,815
Mime Type: unknown/ini:ad
Path: c:\programdata\apple\temp\upgrade.ini:ad
Group: Malware file
Last Updated: August 26, 2023
c:\programdata\package cache\{00c5024d-925c-4e9e-a8e6-f9b84abe0da0}\packages\win81_sdk\9bcb3fab78e80d68be28892ea7ad46c3.msp:dp
File name: 9bcb3fab78e80d68be28892ea7ad46c3.msp:dpSize: 106.49 KB (106496 bytes)
MD5: 0b5d38194d0dca523326dec951b03210
Detection count: 1,211
Mime Type: unknown/msp:dp
Path: c:\programdata\package cache\{00c5024d-925c-4e9e-a8e6-f9b84abe0da0}\packages\win81_sdk\9bcb3fab78e80d68be28892ea7ad46c3.msp:dp
Group: Malware file
Last Updated: March 9, 2023
c:\program files (x86)\firefox\bin\firefoxupdate.exe
File name: firefoxupdate.exeSize: 98.45 KB (98456 bytes)
MD5: b48f781ed01b76bde633261caad4deda
Detection count: 1,194
File type: Executable File
Mime Type: unknown/exe
Path: c:\program files (x86)\firefox\bin\firefoxupdate.exe
Group: Malware file
Last Updated: May 31, 2022
%ALLUSERSPROFILE%\microsoft onenote\updates\versioncheck\chk.dll
File name: chk.dllSize: 105.47 KB (105472 bytes)
MD5: 9260fcee39be90620e1f202590c40f97
Detection count: 400
File type: Dynamic link library
Mime Type: unknown/dll
Path: %ALLUSERSPROFILE%\microsoft onenote\updates\versioncheck\chk.dll
Group: Malware file
Last Updated: July 21, 2022
c:\programdata\microsoft\app-v\client\appv.dll
File name: appv.dllSize: 105.98 KB (105984 bytes)
MD5: 79d096f16e7538c2df69f61403b06da8
Detection count: 241
File type: Dynamic link library
Mime Type: unknown/dll
Path: c:\programdata\microsoft\app-v\client\appv.dll
Group: Malware file
Last Updated: May 23, 2022
C:\ProgramData\Package Cache\{00C5024D-925C-4E9E-A8E6-F9B84ABE0DA0}\packages\Win81_SDK\9bcb3fab78e80d68be28892ea7ad46c3.msp.dll
File name: 9bcb3fab78e80d68be28892ea7ad46c3.msp.dllSize: 105.47 KB (105472 bytes)
MD5: 77cd97afc91d1e31bd8e2023fab25b90
Detection count: 129
File type: Dynamic link library
Mime Type: unknown/dll
Path: C:\ProgramData\Package Cache\{00C5024D-925C-4E9E-A8E6-F9B84ABE0DA0}\packages\Win81_SDK\9bcb3fab78e80d68be28892ea7ad46c3.msp.dll
Group: Malware file
Last Updated: December 20, 2021
%ALLUSERSPROFILE%\Package Cache\{1FBCBC17-4527-2340-0832-B1D49C41FF67}v10.0.26624\packages\Font\10240\4e29234340aaf3a96ec480c1aad8d179.cab:ad
File name: 4e29234340aaf3a96ec480c1aad8d179.cab:adSize: 107 KB (107008 bytes)
MD5: 51fe179e199b04bb3e82558fd5a9183b
Detection count: 77
Mime Type: unknown/cab:ad
Path: %ALLUSERSPROFILE%\Package Cache\{1FBCBC17-4527-2340-0832-B1D49C41FF67}v10.0.26624\packages\Font\10240
Group: Malware file
Last Updated: August 22, 2020
%ALLUSERSPROFILE%\Package Cache\{00C5024D-925C-4E9E-A8E6-F9B84ABE0DA0}\packages\Win81_SDK\9bcb3fab78e80d68be28892ea7ad46c3.msp:dp
File name: 9bcb3fab78e80d68be28892ea7ad46c3.msp:dpSize: 106.49 KB (106496 bytes)
MD5: 8181dc651a89923800a109c9629d957f
Detection count: 74
Mime Type: unknown/msp:dp
Path: %ALLUSERSPROFILE%\Package Cache\{00C5024D-925C-4E9E-A8E6-F9B84ABE0DA0}\packages\Win81_SDK
Group: Malware file
Last Updated: June 2, 2017
%ALLUSERSPROFILE%\Microsoft\Phone Tools\CoreCon\12.0\addons\SDKFilesVer.dll
File name: SDKFilesVer.dllSize: 325.99 KB (325997 bytes)
MD5: 2311c387be305e70dc6103bb623c3f4d
Detection count: 72
File type: Dynamic link library
Mime Type: unknown/dll
Path: %ALLUSERSPROFILE%\Microsoft\Phone Tools\CoreCon\12.0\addons
Group: Malware file
Last Updated: June 27, 2017
c:\programdata\package cache\{00c5024d-925c-4e9e-a8e6-f9b84abe0da0}\packages\win81_sdk\9bcb3fab78e80d68be28892ea7ad46c3.msp:dp
File name: 9bcb3fab78e80d68be28892ea7ad46c3.msp:dpSize: 106.49 KB (106496 bytes)
MD5: 1e4ff4f3511aaea5e43c4f288c4ef953
Detection count: 68
Mime Type: unknown/msp:dp
Path: c:\programdata\package cache\{00c5024d-925c-4e9e-a8e6-f9b84abe0da0}\packages\win81_sdk\9bcb3fab78e80d68be28892ea7ad46c3.msp:dp
Group: Malware file
Last Updated: December 22, 2021
%ALLUSERSPROFILE%\Microsoft\Windows\system\appidsvr.dll
File name: appidsvr.dllSize: 103.93 KB (103936 bytes)
MD5: 66edd44eb8353805b4ed081f4aab0e2e
Detection count: 40
File type: Dynamic link library
Mime Type: unknown/dll
Path: %ALLUSERSPROFILE%\Microsoft\Windows\system
Group: Malware file
Last Updated: April 4, 2020
%ALLUSERSPROFILE%\Microsoft\Phone Tools\CoreCon\12.0\addons\SDKFilesVer.dll
File name: SDKFilesVer.dllSize: 104.44 KB (104448 bytes)
MD5: 3a89b102ed7549e4c1aabdc19294b02f
Detection count: 30
File type: Dynamic link library
Mime Type: unknown/dll
Path: %ALLUSERSPROFILE%\Microsoft\Phone Tools\CoreCon\12.0\addons
Group: Malware file
Last Updated: August 27, 2018
%ALLUSERSPROFILE%\Package Cache\{E01CB7F1-3E88-4450-1764-B3CC1E205C4A}v10.1.14393.795\Installers\30daf459e79c5d26366654b1b482e87.cab:dp
File name: 30daf459e79c5d26366654b1b482e87.cab:dpSize: 102.91 KB (102912 bytes)
MD5: 5adfb9b6b20b61fc06603ac6867a4f31
Detection count: 16
Mime Type: unknown/cab:dp
Path: %ALLUSERSPROFILE%\Package Cache\{E01CB7F1-3E88-4450-1764-B3CC1E205C4A}v10.1.14393.795\Installers
Group: Malware file
Last Updated: June 12, 2019
%ALLUSERSPROFILE%\Package Cache\{00C5024D-925C-4E9E-A8E6-F9B84ABE0DA0}\packages\Win81_SDK\9bcb3fab78e80d68be28892ea7ad46c3.msp:dp
File name: 9bcb3fab78e80d68be28892ea7ad46c3.msp:dpSize: 106.49 KB (106496 bytes)
MD5: 594f565986c7a3db0e853ceedbe47cf0
Detection count: 14
Mime Type: unknown/msp:dp
Path: %ALLUSERSPROFILE%\Package Cache\{00C5024D-925C-4E9E-A8E6-F9B84ABE0DA0}\packages\Win81_SDK
Group: Malware file
Last Updated: June 11, 2019
%ALLUSERSPROFILE%\PreEmptive Solutions\Common\LAC\sos\1.1.4322__2.3.0.2.dll
File name: 1.1.4322__2.3.0.2.dllSize: 423.87 KB (423879 bytes)
MD5: 9991bf0c0deca2cc57daca55ea56db0d
Detection count: 5
File type: Dynamic link library
Mime Type: unknown/dll
Path: %ALLUSERSPROFILE%\PreEmptive Solutions\Common\LAC\sos
Group: Malware file
Last Updated: November 4, 2017
%ALLUSERSPROFILE%\Package Cache\{E01CB7F1-3E88-4450-1764-B3CC1E205C4A}v10.1.14393.795\Installers\30daf459e79c5d26366654b1b482e87.cab:dp
File name: 30daf459e79c5d26366654b1b482e87.cab:dpSize: 102.91 KB (102912 bytes)
MD5: 11552c35ea61525d8ba2102eeec1ae38
Detection count: 5
Mime Type: unknown/cab:dp
Path: %ALLUSERSPROFILE%\Package Cache\{E01CB7F1-3E88-4450-1764-B3CC1E205C4A}v10.1.14393.795\Installers
Group: Malware file
Last Updated: June 2, 2017
More files
Registry Modifications
The following newly produced Registry Values are:
Regexp file mask%ALLUSERSPROFILE%\Apple\Common\Cloud\WinHelper.dll%ALLUSERSPROFILE%\Apple\Temp\upgrade.ini:ad%ALLUSERSPROFILE%\common\Apple\Apps\AzureTools.dll%ALLUSERSPROFILE%\Microsoft OneDrive\setup\SyncTool.dll%ALLUSERSPROFILE%\Microsoft OneNote\Updates\Version\Check\chkver.dll%ALLUSERSPROFILE%\Microsoft OneNote\Updates\VersionCheck\chk.dll%ALLUSERSPROFILE%\Microsoft\App-V\Client\AppV.dll%ALLUSERSPROFILE%\Microsoft\Apps\common\helper.dll%ALLUSERSPROFILE%\Microsoft\AppV\setup\install.dll%ALLUSERSPROFILE%\Microsoft\AppV\Setup\Integrator.dll%ALLUSERSPROFILE%\Microsoft\AppV\sym\dbg.dll%ALLUSERSPROFILE%\Microsoft\IdentityCRL\production\ppcrlconfig617.dll%ALLUSERSPROFILE%\Microsoft\Office\OneNote\Appinfo.dll%ALLUSERSPROFILE%\Microsoft\Office\PackageLocker.dll%ALLUSERSPROFILE%\Microsoft\OneDrive\Uploader.dll%ALLUSERSPROFILE%\Microsoft\Phone Tools\CoreCon\12.0\addons\SDKFilesVer.dll%ALLUSERSPROFILE%\Microsoft\Software\Shadow\Provider.dll%ALLUSERSPROFILE%\Microsoft\Windows\GameExplorer\Resources.dll%ALLUSERSPROFILE%\Microsoft\Windows\system\appidsvr.dll%ALLUSERSPROFILE%\Package Cache\{2A002F88-FD5D-379B-A350-A25D84AF128B}v14.0.25420\packages\VisualC_D14\VC_IDE.Base\VC_IDE_Base.dll%ALLUSERSPROFILE%\PreEmptive Solutions\Common\LAC\sos\1.1.4322__2.3.0.2.dll%ALLUSERSPROFILE%\Software\Apple\Apps\Notification.dll%ALLUSERSPROFILE%\Sun\Java\extension.dll%ALLUSERSPROFILE%\Windows\App\Kit\ApplicationVerifier.dll%APPDATA%\go00001.bak%PROGRAMFILES%\Explorer\iedvutils.exe%PROGRAMFILES(x86)%\Explorer\iedvutils.exe%PROGRAMFILES(x86)%\IIS\Microsoft Web Deploy V3\te\msdeploy.resources.dll%PROGRAMFILES(x86)%\Microsoft Office\Updates\Detection\Version\Descriptor.dll%WINDIR%\System32\Tasks\BookfatUpdateTaskMachineCore%WINDIR%\System32\Tasks\BookfatUpdateTaskMachineUA%WINDIR%\System32\Tasks\ceQeekgBrowserUpdateCore%WINDIR%\System32\Tasks\ceQeekgBrowserUpdateUA%WINDIR%\System32\Tasks\ceQeekgCheckTask%WINDIR%\System32\Tasks\FootblueUpdateTaskMachineCore%WINDIR%\System32\Tasks\FootblueUpdateTaskMachineUA%WINDIR%\System32\Tasks\milimili%WINDIR%\System32\Tasks\MonoldBrowserUpdateUA%WINDIR%\System32\Tasks\MonoldCheckTask%WINDIR%\System32\Tasks\OutboatUpdateTaskMachineCore%WINDIR%\System32\Tasks\OutboatUpdateTaskMachineUA%WINDIR%\System32\Tasks\ZootonyUpdateTaskMachineCore%WINDIR%\System32\Tasks\ZootonyUpdateTaskMachineUAHKEY..\..\..\..{RegistryKeys}SOFTWARE\ApplemySOFTWARE\BaglookSOFTWARE\BagSarahSOFTWARE\BangcarSOFTWARE\BangtonySOFTWARE\BedkissSOFTWARE\DohatSOFTWARE\EastnessSOFTWARE\EvernessSOFTWARE\FootjaneSOFTWARE\GotoeSoftware\HipmySOFTWARE\HippigSOFTWARE\HotleafSOFTWARE\LegassSOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\milimiliSOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\MonoldBrowserUpdateCoreSOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\MonoldBrowserUpdateUASOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost\apple_configSOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost\AppsSvcSoftware\Microsoft\Windows\CurrentVersion\Run\background_faultSOFTWARE\PearhasSOFTWARE\SetleafSOFTWARE\Wow6432Node\ApplemySOFTWARE\Wow6432Node\BaglookSOFTWARE\WOW6432Node\BagSarahSOFTWARE\Wow6432Node\BangcarSOFTWARE\Wow6432Node\BangtonySOFTWARE\WOW6432Node\BedkissSOFTWARE\WOW6432Node\DohatSOFTWARE\WOW6432Node\EastnessSOFTWARE\WOW6432Node\EvernessSOFTWARE\WOW6432Node\FootjaneSOFTWARE\Wow6432Node\GotoeSOFTWARE\Wow6432Node\HipmySOFTWARE\Wow6432Node\HippigSOFTWARE\WOW6432Node\HotleafSOFTWARE\Wow6432Node\LegassSOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Svchost\apple_configSOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Svchost\AppsSvcSOFTWARE\Wow6432Node\PearhasSOFTWARE\WOW6432Node\SetleafSYSTEM\ControlSet001\services\AlltieSUSYSTEM\ControlSet001\services\Apple_CfgSYSTEM\ControlSet001\Services\APPLE_svrSYSTEM\ControlSet001\services\AppleAzureSrvSYSTEM\ControlSet001\services\Apps_CfgSYSTEM\ControlSet001\services\eventlog\Application\iedvutilsSYSTEM\ControlSet001\Services\FootblueUSYSTEM\ControlSet001\services\FootperSUSYSTEM\ControlSet001\Services\MCSvcSYSTEM\ControlSet001\Services\MSCFG_SVRSYSTEM\ControlSet001\services\MVCSrvSYSTEM\ControlSet001\services\vreXjvX_protectSYSTEM\ControlSet001\services\vreXjvX_updateSYSTEM\ControlSet001\Services\WPDTSrvSYSTEM\ControlSet002\services\AlltieSUSYSTEM\ControlSet002\services\Apple_CfgSYSTEM\ControlSet002\Services\APPLE_svrSYSTEM\ControlSet002\services\AppleAzureSrvSYSTEM\ControlSet002\services\Apps_CfgSYSTEM\ControlSet002\services\eventlog\Application\iedvutilsSYSTEM\ControlSet002\Services\FootblueUSYSTEM\ControlSet002\services\FootperSUSYSTEM\ControlSet002\Services\MCSvcSYSTEM\ControlSet002\Services\MSCFG_SVRSYSTEM\ControlSet002\services\MVCSrvSYSTEM\ControlSet002\services\vreXjvX_protectSYSTEM\ControlSet002\services\vreXjvX_updateSYSTEM\ControlSet002\Services\WPDTSrvSYSTEM\CurrentControlSet\services\AlltieSUSYSTEM\CurrentControlSet\services\Apple_CfgSYSTEM\CurrentControlSet\Services\APPLE_svrSYSTEM\CurrentControlSet\services\AppleAzureSrvSYSTEM\CurrentControlSet\services\Apps_CfgSYSTEM\CurrentControlSet\services\eventlog\Application\iedvutilsSYSTEM\CurrentControlSet\Services\FootblueUSYSTEM\CurrentControlSet\services\FootperSUSYSTEM\CurrentControlSet\Services\MCSvcSYSTEM\CurrentControlSet\Services\MSCFG_SVRSYSTEM\CurrentControlSet\services\MVCSrvSYSTEM\CurrentControlSet\services\vreXjvX_protectSYSTEM\CurrentControlSet\services\vreXjvX_updateSYSTEM\CurrentControlSet\Services\WPDTSrv
Regexp file mask%ALLUSERSPROFILE%\Apple\Common\Cloud\WinHelper.dll%ALLUSERSPROFILE%\Apple\Temp\upgrade.ini:ad%ALLUSERSPROFILE%\common\Apple\Apps\AzureTools.dll%ALLUSERSPROFILE%\Microsoft OneDrive\setup\SyncTool.dll%ALLUSERSPROFILE%\Microsoft OneNote\Updates\Version\Check\chkver.dll%ALLUSERSPROFILE%\Microsoft OneNote\Updates\VersionCheck\chk.dll%ALLUSERSPROFILE%\Microsoft\App-V\Client\AppV.dll%ALLUSERSPROFILE%\Microsoft\Apps\common\helper.dll%ALLUSERSPROFILE%\Microsoft\AppV\setup\install.dll%ALLUSERSPROFILE%\Microsoft\AppV\Setup\Integrator.dll%ALLUSERSPROFILE%\Microsoft\AppV\sym\dbg.dll%ALLUSERSPROFILE%\Microsoft\IdentityCRL\production\ppcrlconfig617.dll%ALLUSERSPROFILE%\Microsoft\Office\OneNote\Appinfo.dll%ALLUSERSPROFILE%\Microsoft\Office\PackageLocker.dll%ALLUSERSPROFILE%\Microsoft\OneDrive\Uploader.dll%ALLUSERSPROFILE%\Microsoft\Phone Tools\CoreCon\12.0\addons\SDKFilesVer.dll%ALLUSERSPROFILE%\Microsoft\Software\Shadow\Provider.dll%ALLUSERSPROFILE%\Microsoft\Windows\GameExplorer\Resources.dll%ALLUSERSPROFILE%\Microsoft\Windows\system\appidsvr.dll%ALLUSERSPROFILE%\Package Cache\{2A002F88-FD5D-379B-A350-A25D84AF128B}v14.0.25420\packages\VisualC_D14\VC_IDE.Base\VC_IDE_Base.dll%ALLUSERSPROFILE%\PreEmptive Solutions\Common\LAC\sos\1.1.4322__2.3.0.2.dll%ALLUSERSPROFILE%\Software\Apple\Apps\Notification.dll%ALLUSERSPROFILE%\Sun\Java\extension.dll%ALLUSERSPROFILE%\Windows\App\Kit\ApplicationVerifier.dll%APPDATA%\go00001.bak%PROGRAMFILES%\Explorer\iedvutils.exe%PROGRAMFILES(x86)%\Explorer\iedvutils.exe%PROGRAMFILES(x86)%\IIS\Microsoft Web Deploy V3\te\msdeploy.resources.dll%PROGRAMFILES(x86)%\Microsoft Office\Updates\Detection\Version\Descriptor.dll%WINDIR%\System32\Tasks\BookfatUpdateTaskMachineCore%WINDIR%\System32\Tasks\BookfatUpdateTaskMachineUA%WINDIR%\System32\Tasks\ceQeekgBrowserUpdateCore%WINDIR%\System32\Tasks\ceQeekgBrowserUpdateUA%WINDIR%\System32\Tasks\ceQeekgCheckTask%WINDIR%\System32\Tasks\FootblueUpdateTaskMachineCore%WINDIR%\System32\Tasks\FootblueUpdateTaskMachineUA%WINDIR%\System32\Tasks\milimili%WINDIR%\System32\Tasks\MonoldBrowserUpdateUA%WINDIR%\System32\Tasks\MonoldCheckTask%WINDIR%\System32\Tasks\OutboatUpdateTaskMachineCore%WINDIR%\System32\Tasks\OutboatUpdateTaskMachineUA%WINDIR%\System32\Tasks\ZootonyUpdateTaskMachineCore%WINDIR%\System32\Tasks\ZootonyUpdateTaskMachineUAHKEY..\..\..\..{RegistryKeys}SOFTWARE\ApplemySOFTWARE\BaglookSOFTWARE\BagSarahSOFTWARE\BangcarSOFTWARE\BangtonySOFTWARE\BedkissSOFTWARE\DohatSOFTWARE\EastnessSOFTWARE\EvernessSOFTWARE\FootjaneSOFTWARE\GotoeSoftware\HipmySOFTWARE\HippigSOFTWARE\HotleafSOFTWARE\LegassSOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\milimiliSOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\MonoldBrowserUpdateCoreSOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\MonoldBrowserUpdateUASOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost\apple_configSOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost\AppsSvcSoftware\Microsoft\Windows\CurrentVersion\Run\background_faultSOFTWARE\PearhasSOFTWARE\SetleafSOFTWARE\Wow6432Node\ApplemySOFTWARE\Wow6432Node\BaglookSOFTWARE\WOW6432Node\BagSarahSOFTWARE\Wow6432Node\BangcarSOFTWARE\Wow6432Node\BangtonySOFTWARE\WOW6432Node\BedkissSOFTWARE\WOW6432Node\DohatSOFTWARE\WOW6432Node\EastnessSOFTWARE\WOW6432Node\EvernessSOFTWARE\WOW6432Node\FootjaneSOFTWARE\Wow6432Node\GotoeSOFTWARE\Wow6432Node\HipmySOFTWARE\Wow6432Node\HippigSOFTWARE\WOW6432Node\HotleafSOFTWARE\Wow6432Node\LegassSOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Svchost\apple_configSOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Svchost\AppsSvcSOFTWARE\Wow6432Node\PearhasSOFTWARE\WOW6432Node\SetleafSYSTEM\ControlSet001\services\AlltieSUSYSTEM\ControlSet001\services\Apple_CfgSYSTEM\ControlSet001\Services\APPLE_svrSYSTEM\ControlSet001\services\AppleAzureSrvSYSTEM\ControlSet001\services\Apps_CfgSYSTEM\ControlSet001\services\eventlog\Application\iedvutilsSYSTEM\ControlSet001\Services\FootblueUSYSTEM\ControlSet001\services\FootperSUSYSTEM\ControlSet001\Services\MCSvcSYSTEM\ControlSet001\Services\MSCFG_SVRSYSTEM\ControlSet001\services\MVCSrvSYSTEM\ControlSet001\services\vreXjvX_protectSYSTEM\ControlSet001\services\vreXjvX_updateSYSTEM\ControlSet001\Services\WPDTSrvSYSTEM\ControlSet002\services\AlltieSUSYSTEM\ControlSet002\services\Apple_CfgSYSTEM\ControlSet002\Services\APPLE_svrSYSTEM\ControlSet002\services\AppleAzureSrvSYSTEM\ControlSet002\services\Apps_CfgSYSTEM\ControlSet002\services\eventlog\Application\iedvutilsSYSTEM\ControlSet002\Services\FootblueUSYSTEM\ControlSet002\services\FootperSUSYSTEM\ControlSet002\Services\MCSvcSYSTEM\ControlSet002\Services\MSCFG_SVRSYSTEM\ControlSet002\services\MVCSrvSYSTEM\ControlSet002\services\vreXjvX_protectSYSTEM\ControlSet002\services\vreXjvX_updateSYSTEM\ControlSet002\Services\WPDTSrvSYSTEM\CurrentControlSet\services\AlltieSUSYSTEM\CurrentControlSet\services\Apple_CfgSYSTEM\CurrentControlSet\Services\APPLE_svrSYSTEM\CurrentControlSet\services\AppleAzureSrvSYSTEM\CurrentControlSet\services\Apps_CfgSYSTEM\CurrentControlSet\services\eventlog\Application\iedvutilsSYSTEM\CurrentControlSet\Services\FootblueUSYSTEM\CurrentControlSet\services\FootperSUSYSTEM\CurrentControlSet\Services\MCSvcSYSTEM\CurrentControlSet\Services\MSCFG_SVRSYSTEM\CurrentControlSet\services\MVCSrvSYSTEM\CurrentControlSet\services\vreXjvX_protectSYSTEM\CurrentControlSet\services\vreXjvX_updateSYSTEM\CurrentControlSet\Services\WPDTSrv
Additional Information
The following directories were created:
%ALLUSERSPROFILE%\Application Data\Inbob%ALLUSERSPROFILE%\Bagbin%ALLUSERSPROFILE%\Banglamp%ALLUSERSPROFILE%\Birdeye%ALLUSERSPROFILE%\Birdmay%ALLUSERSPROFILE%\Bookfat%ALLUSERSPROFILE%\Bossseed%ALLUSERSPROFILE%\Eastmy%ALLUSERSPROFILE%\Eastness%ALLUSERSPROFILE%\Fishlose%ALLUSERSPROFILE%\Footblue%ALLUSERSPROFILE%\Gotoe%ALLUSERSPROFILE%\Hotdear%ALLUSERSPROFILE%\Hotmay%ALLUSERSPROFILE%\Inbob%ALLUSERSPROFILE%\Jamben%ALLUSERSPROFILE%\Jamjob%ALLUSERSPROFILE%\Junetoe%ALLUSERSPROFILE%\Newjob%ALLUSERSPROFILE%\Onfat%ALLUSERSPROFILE%\Setmike%ALLUSERSPROFILE%\Weness%ALLUSERSPROFILE%\Zootony%ALLUSERSPROFILE%\ceQeekg%ALLUSERSPROFILE%\redjane%ALLUSERSPROFILE%\seteat%APPDATA%\go00001%LOCALAPPDATA%\Allold%LOCALAPPDATA%\Alltoe%LOCALAPPDATA%\Antanna%LOCALAPPDATA%\Antper%LOCALAPPDATA%\Applefat%LOCALAPPDATA%\Applemy%LOCALAPPDATA%\Bagbin%LOCALAPPDATA%\Baghair%LOCALAPPDATA%\Baglook%LOCALAPPDATA%\Bagsarah%LOCALAPPDATA%\Ballcine%LOCALAPPDATA%\Ballduck%LOCALAPPDATA%\Bangcar%LOCALAPPDATA%\Banglamp%LOCALAPPDATA%\Bangone%LOCALAPPDATA%\Bangtony%LOCALAPPDATA%\Bedhat%LOCALAPPDATA%\Bedkiss%LOCALAPPDATA%\Bemike%LOCALAPPDATA%\Bepat%LOCALAPPDATA%\Bigflat%LOCALAPPDATA%\Bigold%LOCALAPPDATA%\Birdeye%LOCALAPPDATA%\Birdkiss%LOCALAPPDATA%\Birdmay%LOCALAPPDATA%\Birdsarah%LOCALAPPDATA%\Bookfat%LOCALAPPDATA%\Bossface%LOCALAPPDATA%\Bossseed%LOCALAPPDATA%\Bossship%LOCALAPPDATA%\Boxbob%LOCALAPPDATA%\Boxfat%LOCALAPPDATA%\Cansuck%LOCALAPPDATA%\Coldmay%LOCALAPPDATA%\Coldold%LOCALAPPDATA%\Coldone%LOCALAPPDATA%\Cupblue%LOCALAPPDATA%\Cupface%LOCALAPPDATA%\Cuppat%LOCALAPPDATA%\Daydoor%LOCALAPPDATA%\Docine%LOCALAPPDATA%\Doeye%LOCALAPPDATA%\Dohat%LOCALAPPDATA%\Doold%LOCALAPPDATA%\Eastmy%LOCALAPPDATA%\Eastness%LOCALAPPDATA%\Eggness%LOCALAPPDATA%\Evercine%LOCALAPPDATA%\Everness%LOCALAPPDATA%\Fishjane%LOCALAPPDATA%\Fishlamp%LOCALAPPDATA%\Fishlose%LOCALAPPDATA%\Footblue%LOCALAPPDATA%\Footeat%LOCALAPPDATA%\Footjane%LOCALAPPDATA%\Footlook%LOCALAPPDATA%\Footper%LOCALAPPDATA%\Gofat%LOCALAPPDATA%\Goldass%LOCALAPPDATA%\Gotoe%LOCALAPPDATA%\Gunone%LOCALAPPDATA%\Gunship%LOCALAPPDATA%\Hipbear%LOCALAPPDATA%\Hipeat%LOCALAPPDATA%\Hipfat%LOCALAPPDATA%\Hipmy%LOCALAPPDATA%\Hippig%LOCALAPPDATA%\Hisarah%LOCALAPPDATA%\Hotdear%LOCALAPPDATA%\Hothair%LOCALAPPDATA%\Hotjob%LOCALAPPDATA%\Hotleaf%LOCALAPPDATA%\Hotmay%LOCALAPPDATA%\Inbob%LOCALAPPDATA%\Infun%LOCALAPPDATA%\Inper%LOCALAPPDATA%\Jamben%LOCALAPPDATA%\Jamjob%LOCALAPPDATA%\Jamlarry%LOCALAPPDATA%\Jamsarah%LOCALAPPDATA%\Jarhair%LOCALAPPDATA%\Jarness%LOCALAPPDATA%\Junedoor%LOCALAPPDATA%\Junetoe%LOCALAPPDATA%\Lefttoe%LOCALAPPDATA%\Legness%LOCALAPPDATA%\Legpat%LOCALAPPDATA%\Mapbob%LOCALAPPDATA%\Mapcar%LOCALAPPDATA%\Moncar%LOCALAPPDATA%\Monold%LOCALAPPDATA%\Newjob%LOCALAPPDATA%\Nobean%LOCALAPPDATA%\Nolarry%LOCALAPPDATA%\Nosekiss%LOCALAPPDATA%\Nosemay%LOCALAPPDATA%\Onfat%LOCALAPPDATA%\Ontoe%LOCALAPPDATA%\Outbob%LOCALAPPDATA%\Outfire%LOCALAPPDATA%\Outlose%LOCALAPPDATA%\Pearhas%LOCALAPPDATA%\Seablue%LOCALAPPDATA%\Seaness%LOCALAPPDATA%\Setleaf%LOCALAPPDATA%\Setmike%LOCALAPPDATA%\Shutness%LOCALAPPDATA%\Stancine%LOCALAPPDATA%\Standoor%LOCALAPPDATA%\Standuck%LOCALAPPDATA%\Stanper%LOCALAPPDATA%\Tooleat%LOCALAPPDATA%\Toolhair%LOCALAPPDATA%\Toolrain%LOCALAPPDATA%\Tooltony%LOCALAPPDATA%\Wefat%LOCALAPPDATA%\Weness%LOCALAPPDATA%\Yeahfire%LOCALAPPDATA%\Yeahseed%LOCALAPPDATA%\Yeahship%LOCALAPPDATA%\Yesdear%LOCALAPPDATA%\Yeshat%LOCALAPPDATA%\Yestony%LOCALAPPDATA%\Zooarm%LOCALAPPDATA%\Zooface%LOCALAPPDATA%\Zootony%LOCALAPPDATA%\background_fault%LOCALAPPDATA%\birdjob%LOCALAPPDATA%\ceQeekg%LOCALAPPDATA%\fishhas%LOCALAPPDATA%\hotcine%LOCALAPPDATA%\legass%LOCALAPPDATA%\redjane%LOCALAPPDATA%\seteat%LOCALAPPDATA%\vreXjvX%PROGRAMFILES%\Alltoe%PROGRAMFILES%\Antanna%PROGRAMFILES%\Antper%PROGRAMFILES%\Applefat%PROGRAMFILES%\Applemy%PROGRAMFILES%\Bagbin%PROGRAMFILES%\Baghair%PROGRAMFILES%\Baglook%PROGRAMFILES%\Bagsarah%PROGRAMFILES%\Ballcine%PROGRAMFILES%\Ballduck%PROGRAMFILES%\Bangcar%PROGRAMFILES%\Banglamp%PROGRAMFILES%\Bangtony%PROGRAMFILES%\Bedhat%PROGRAMFILES%\Bedkiss%PROGRAMFILES%\Bemike%PROGRAMFILES%\Bepat%PROGRAMFILES%\Bigflat%PROGRAMFILES%\Bigold%PROGRAMFILES%\Birdeye%PROGRAMFILES%\Birdmay%PROGRAMFILES%\Bookfat%PROGRAMFILES%\Bossface%PROGRAMFILES%\Bossseed%PROGRAMFILES%\Bossship%PROGRAMFILES%\Boxbob%PROGRAMFILES%\Boxfat%PROGRAMFILES%\Cansuck%PROGRAMFILES%\Coldmay%PROGRAMFILES%\Coldold%PROGRAMFILES%\Coldone%PROGRAMFILES%\Cupface%PROGRAMFILES%\Cuppat%PROGRAMFILES%\Doeye%PROGRAMFILES%\Dohat%PROGRAMFILES%\Eastmy%PROGRAMFILES%\Eastness%PROGRAMFILES%\Eggness%PROGRAMFILES%\Evercine%PROGRAMFILES%\Everness%PROGRAMFILES%\Fishjane%PROGRAMFILES%\Fishlose%PROGRAMFILES%\Footblue%PROGRAMFILES%\Footeat%PROGRAMFILES%\Footjane%PROGRAMFILES%\Footlook%PROGRAMFILES%\Footper%PROGRAMFILES%\Gofat%PROGRAMFILES%\Goldass%PROGRAMFILES%\Gotoe%PROGRAMFILES%\Gunone%PROGRAMFILES%\Hipeat%PROGRAMFILES%\Hipmy%PROGRAMFILES%\Hippig%PROGRAMFILES%\Hotdear%PROGRAMFILES%\Hothair%PROGRAMFILES%\Hotjob%PROGRAMFILES%\Hotleaf%PROGRAMFILES%\Hotmay%PROGRAMFILES%\Inbob%PROGRAMFILES%\Infun%PROGRAMFILES%\Inper%PROGRAMFILES%\Jamben%PROGRAMFILES%\Jamjob%PROGRAMFILES%\Jamlarry%PROGRAMFILES%\Jarhair%PROGRAMFILES%\Jarness%PROGRAMFILES%\Junetoe%PROGRAMFILES%\Legness%PROGRAMFILES%\Lerfopervather Host%PROGRAMFILES%\MIO\loader%PROGRAMFILES%\Mapbob%PROGRAMFILES%\Moncar%PROGRAMFILES%\Newjob%PROGRAMFILES%\Nolarry%PROGRAMFILES%\Nosekiss%PROGRAMFILES%\Onfat%PROGRAMFILES%\Ontoe%PROGRAMFILES%\Outbob%PROGRAMFILES%\Pearhas%PROGRAMFILES%\Setleaf%PROGRAMFILES%\Setmike%PROGRAMFILES%\Shutness%PROGRAMFILES%\Stancine%PROGRAMFILES%\Standoor%PROGRAMFILES%\Standuck%PROGRAMFILES%\Stanper%PROGRAMFILES%\Tooleat%PROGRAMFILES%\Toolhair%PROGRAMFILES%\Tooltony%PROGRAMFILES%\Weness%PROGRAMFILES%\Yeahfire%PROGRAMFILES%\Yeahseed%PROGRAMFILES%\Yeahship%PROGRAMFILES%\Yeshat%PROGRAMFILES%\Zooarm%PROGRAMFILES%\Zootony%PROGRAMFILES%\birdjob%PROGRAMFILES%\fishhas%PROGRAMFILES%\hotcine%PROGRAMFILES%\legass%PROGRAMFILES%\redjane%PROGRAMFILES%\seteat%PROGRAMFILES(x86)%\Alltoe%PROGRAMFILES(x86)%\Antanna%PROGRAMFILES(x86)%\Antper%PROGRAMFILES(x86)%\Applefat%PROGRAMFILES(x86)%\Applemy%PROGRAMFILES(x86)%\Bagbin%PROGRAMFILES(x86)%\Baghair%PROGRAMFILES(x86)%\Baglook%PROGRAMFILES(x86)%\Bagsarah%PROGRAMFILES(x86)%\Ballcine%PROGRAMFILES(x86)%\Ballduck%PROGRAMFILES(x86)%\Bangcar%PROGRAMFILES(x86)%\Banglamp%PROGRAMFILES(x86)%\Bangtony%PROGRAMFILES(x86)%\Bedhat%PROGRAMFILES(x86)%\Bedkiss%PROGRAMFILES(x86)%\Bemike%PROGRAMFILES(x86)%\Bepat%PROGRAMFILES(x86)%\Bigflat%PROGRAMFILES(x86)%\Bigold%PROGRAMFILES(x86)%\Birdeye%PROGRAMFILES(x86)%\Birdmay%PROGRAMFILES(x86)%\Bookfat%PROGRAMFILES(x86)%\Bossface%PROGRAMFILES(x86)%\Bossseed%PROGRAMFILES(x86)%\Bossship%PROGRAMFILES(x86)%\Boxbob%PROGRAMFILES(x86)%\Boxfat%PROGRAMFILES(x86)%\Cansuck%PROGRAMFILES(x86)%\Coldmay%PROGRAMFILES(x86)%\Coldold%PROGRAMFILES(x86)%\Coldone%PROGRAMFILES(x86)%\Cupface%PROGRAMFILES(x86)%\Cuppat%PROGRAMFILES(x86)%\Daydoor%PROGRAMFILES(x86)%\Doeye%PROGRAMFILES(x86)%\Dohat%PROGRAMFILES(x86)%\Eastmy%PROGRAMFILES(x86)%\Eastness%PROGRAMFILES(x86)%\Eggness%PROGRAMFILES(x86)%\Evercine%PROGRAMFILES(x86)%\Everness%PROGRAMFILES(x86)%\Fishjane%PROGRAMFILES(x86)%\Fishlose%PROGRAMFILES(x86)%\Footblue%PROGRAMFILES(x86)%\Footeat%PROGRAMFILES(x86)%\Footjane%PROGRAMFILES(x86)%\Footlook%PROGRAMFILES(x86)%\Footper%PROGRAMFILES(x86)%\Gofat%PROGRAMFILES(x86)%\Goldass%PROGRAMFILES(x86)%\Gotoe%PROGRAMFILES(x86)%\Gunone%PROGRAMFILES(x86)%\Hipeat%PROGRAMFILES(x86)%\Hipmy%PROGRAMFILES(x86)%\Hippig%PROGRAMFILES(x86)%\Hotdear%PROGRAMFILES(x86)%\Hothair%PROGRAMFILES(x86)%\Hotjob%PROGRAMFILES(x86)%\Hotleaf%PROGRAMFILES(x86)%\Hotmay%PROGRAMFILES(x86)%\Inbob%PROGRAMFILES(x86)%\Infun%PROGRAMFILES(x86)%\Inper%PROGRAMFILES(x86)%\Jamben%PROGRAMFILES(x86)%\Jamjob%PROGRAMFILES(x86)%\Jamlarry%PROGRAMFILES(x86)%\Jarhair%PROGRAMFILES(x86)%\Jarness%PROGRAMFILES(x86)%\Junetoe%PROGRAMFILES(x86)%\Legness%PROGRAMFILES(x86)%\Lerfopervather Host%PROGRAMFILES(x86)%\MIO\loader%PROGRAMFILES(x86)%\Mapbob%PROGRAMFILES(x86)%\Moncar%PROGRAMFILES(x86)%\Newjob%PROGRAMFILES(x86)%\Nolarry%PROGRAMFILES(x86)%\Nosekiss%PROGRAMFILES(x86)%\Onfat%PROGRAMFILES(x86)%\Ontoe%PROGRAMFILES(x86)%\Outbob%PROGRAMFILES(x86)%\Pearhas%PROGRAMFILES(x86)%\Setleaf%PROGRAMFILES(x86)%\Setmike%PROGRAMFILES(x86)%\Shutness%PROGRAMFILES(x86)%\Stancine%PROGRAMFILES(x86)%\Standoor%PROGRAMFILES(x86)%\Standuck%PROGRAMFILES(x86)%\Stanper%PROGRAMFILES(x86)%\Tooleat%PROGRAMFILES(x86)%\Toolhair%PROGRAMFILES(x86)%\Tooltony%PROGRAMFILES(x86)%\Weness%PROGRAMFILES(x86)%\Yeahfire%PROGRAMFILES(x86)%\Yeahseed%PROGRAMFILES(x86)%\Yeahship%PROGRAMFILES(x86)%\Yeshat%PROGRAMFILES(x86)%\Zooarm%PROGRAMFILES(x86)%\Zootony%PROGRAMFILES(x86)%\birdjob%PROGRAMFILES(x86)%\fishhas%PROGRAMFILES(x86)%\hotcine%PROGRAMFILES(x86)%\legass%PROGRAMFILES(x86)%\redjane%PROGRAMFILES(x86)%\seteat%UserProfile%\Local Settings\Application Data\Weness%UserProfile%\Local Settings\Application Data\Yestony
Leave a Reply
Please note that we are not able to assist with billing and support issues regarding SpyHunter or other products. If you're having issues with SpyHunter, please get in touch with SpyHunter customer support through your SpyHunter . If you have SpyHunter billing questions, we recommend you check the Billing FAQ. For general suggestions or feedback, contact us.