[Nicholas Coolman]

The programme VuuPC falls into the category of Potentially Unwanted Optional Software (LPI/PUP).

LPIs, or PUPs, typically install as a program or browser extension and are loaded each time the operating system is started.

Potentially Unwanted Software (PUP/LPI) can launch services, start scheduled tasks, and create shortcuts on your Desktop. All these operations are done with or without your consent according to the terms of its user contract. Once installed, an LPI can modify certain parameters of your browsers such as search pages, the start page or even your error page. It can collect your browsing habits and communicate them to a server using the tracking method. While browsing, it may display advertisements (coupons) and advertising banners (popups). The goal of this program is often to make money by generating web traffic to sponsored sites.

Potentially unwanted software (LPI) or Potentialy Unwanted Programs (PUP) are the cause of many infections.
The most common example is adware. InstallCore, Crossrider, Graftor ou Boxore which pollute the Registry and your data storage units. They are usually installed without your knowledge by downloading freeware. Indeed some sites use the repackaging method, an operation which consists of redoing the software installation module by adding download options. These options allow you to add other software such as browser toolbars, adware, potentially unwanted software, intrusive advertising software, or even browser hijackers.

Spyware (spyware) and adware (adwares) unwanted files, just like malware, can use the writing flaws of legitimate software or those of operating systems. It is therefore essential to have official software and that it has automatic updating. Likewise, your Windows operating system must be programmed in automatic update mode and activated, so that you can have the latest updates for critical security vulnerabilities.

Main actions:
– It installs as a process launched at system startup (RP),
- It is installed as Browser Helper Object (BHO) of Internet Browser (O2),
- Created multiple application shortcuts, Desktop, QuickLaunch, Taskbar, Programs (O4GS),
- It is installed as a service to be launched each time the system starts (O23), (SS/SR),
– It starts several scheduled tasks automatically (O39),
- It installs as a program (O42)
– It creates multiple “Software” registry keys,
- Adds additional folders (O43),
– It is installed in specific folders of the user (O84),
– It creates an active inbound connection in Windows Firewall Application Exceptions (O87),

ZHPDiag overview:
[MD5.1514F46E4BC4ED04BAAB59AF0017A534] – (.ClickMeIn Limited – VuuPC Remote Engine Helper Component.) — C:\Program Files (x86)\VuuPC\RemoteEngineHelper.exe [1982992] [PID.9500]
[MD5.D26C1A01B452D464949B8DC59F3C93FA] – (.ClickMeIn Limited – VuuPC Connectivity.) — C:\Program Files (x86)\VuuPC\Connectivity.exe [4746768] [PID.2388]
[MD5.6C7BA540982409DD2E75A48D9707B360] – (.ClickMeIn Limited – VuuPC Remote Engine Component.) — C:\Program Files (x86)\VuuPC\remoteengine.exe [2967568] [PID.3036]
O2 – BHO: Lyrmix [64Bits] – {A8E06666-F1AE-4436-80C1-A1A1A865F236} . (.Lyrix Engineering – Lyrmix.) — C:\Program Files (x86)\Lyrmix\lyrmix.dll
O4 – GS\Desktop [Coolman]: Continue VuuPC Installation.lnk . (.VuuPC Limited – VuuPC Setup.) — C:\Users\EMRE\AppData\Local\nsnD3AC.tmp
O23 – Service: VuuPC RemoteEngine Service (RemoteEngineService). (.ClickMeIn Limited – VuuPC Remote Engine Component.) – C:\Program Files (x86)\VuuPC\remoteengine.exe
O23 – Service: VuuPC Connectivity (VuuPCConnectivity). (.ClickMeIn Limited – VuuPC Connectivity.) – C:\Program Files (x86)\VuuPC\Connectivity.exe
O39 – APT:Automatic Scheduled Task – C:\Windows\Tasks\Lyrmix Update.job [380]
[MD5.724AC3A4BFF4D78FF55573EC245AB702] [APT] [Lyrmix Update] (.Lyrix Engineering.) — C:\Program Files (x86)\Lyrmix\LyricsmixUpdate.exe [117760]
[MD5.029D82B15A66819D346CB61D34C1A692] [APT] [VuuPCUpdate] (.VuuPC Limited.) — C:\Program Files (x86)\VuuPC\VuuPCUpdater.exe [73056]
[MD5.029D82B15A66819D346CB61D34C1A692] [APT] [VuuPCUpdateLogin] (.VuuPC Limited.) — C:\Program Files (x86)\VuuPC\VuuPCUpdater.exe [73056]
O42 – Software: VuuPC, You're Always a Click Away! – (.VuuPC Limited.) [HKLM][64Bits] — VuuPC
O42 – Software: Lyrmix – (.Lyrix Engineering.) [HKLM][64Bits] — lyrmix@lyrmix.net
[HKCU\Software\AppDataLow\Software\Lyrmix]
O43 – CFD: 12/08/2013 – 20:26:30 – [3,467] —-DC:\Program Files (x86)\VuuPC
O43 – CFD: 09/05/2013 – 16:23:28 – [0,007] —-DC:\Users\Coolman\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VuuPC
[MD5.150574442EDBE1E0080CCEE5E0DED6BB] [SPRF][09/05/2013] (…) — C:\Users\Coolman\Desktop\VuuPC_setup.exe [590944]
O87 – FAEL: “{4C85DE13-4410-495C-A0D9-64D1F12F43B9}” |In – Domain – P6 – TRUE | .(.ClickMeIn Limited.) — C:\Program Files (x86)\VuuPC\RemoteEngine.exe
O87 – FAEL: “{F98C40D0-3DD2-4508-8E25-8FE45931FB1A}” |In – Domain – P6 – TRUE | .(.ClickMeIn Limited.) — C:\Program Files (x86)\VuuPC\Connectivity.exe
SR – | Auto 25/04/2013 2967568 | (RemoteEngineService). (.ClickMeIn Limited.) – C:\Program Files (x86)\VuuPC\remoteengine.exe
SR – | Auto 25/04/2013 4746768 | (VuuPCConnectivity). (.ClickMeIn Limited.) – C:\Program Files (x86)\VuuPC\Connectivity.exe
[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\lyrmix@lyrmix.net]
[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\VuuPC]
[HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A8E06666-F1AE-4436-80C1-A1A1A865F236}]
[HKLM\SYSTEM\CurrentControlSet\Services\RemoteEngineService]
[HKLM\SYSTEM\CurrentControlSet\Services\VuuPCConnectivity]
C:\Users\Coolman\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VuuPC
C:\Program Files (x86)\VuuPC
C:\Program Files\VuuPC\Connectivity.exe
C:\Program Files (x86)\VuuPC\RemoteEngine.exe
C:\Program Files (x86)\Lyrmix
C:\Users\Coolman\Desktop\My VuuPC.lnk

A.k.a :
Adware.Lyrmix
TIME:Trojan-Downloader.Win32.Generic [Kaspersky]
Win32.Troj.Generic.a.(kcloud) [Kingsoft]
Adware.Downware [Dr.Web]
PUP.Optional.VuuPC

Diagnose with ZHPSuite...  Uninstall with Windows...  Delete with ZHPCleaner...  Remove with Malwarebytes...

Free support forum
Nicholas Coolman

[Author]

Messages