AdWare.InstallMonster removal instruction

The AdWare.InstallMonster is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What AdWare.InstallMonster virus can do?

Sample contains Overlay data
Performs HTTP requests potentially not found in PCAP.
Reads data out of its own binary image
Authenticode signature is invalid
Attempts to modify proxy settings

How to determine AdWare.InstallMonster?


File Info:
name: 531720F8C5E1FCBBFCC4.mlw
path: /opt/CAPEv2/storage/binaries/cdc552f19d75ad7f3e64ad448cd50037c8013b0ef675a3d680dd2312cb758d27
crc32: 46FF74E5
md5: 531720f8c5e1fcbbfcc4f1dc4b421c4e
sha1: 615d36f013b5ba17bfedfa792d5b29cb24721f6c
sha256: cdc552f19d75ad7f3e64ad448cd50037c8013b0ef675a3d680dd2312cb758d27
sha512: c8ca6aaa1f7fe487778c1c2846b7c40221c887744b43ae7d7d8078d744175c21b157a140d55fa266a6ba8e2054d838cb8e9bd7139ad8ef3e85b1dc7449e9d42a
ssdeep: 393216:XYAZ/jLveLEXRl4vLvBAsfARfxnLkkKHyiCcTTS1NI:X3lXWwBiDvaIIxFXI+NI
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T138E63305386CC992D0237BF091ADA5744A765CAAF9CA80B693713F401DBC25FFE6386D
sha3_384: 6075d1833268d47b6d2846be5972993405b5b7f92444701594b34b4b8825d167a7c3fe83a6cc1b0fda0840debfb87b9b
ep_bytes: 81ec8001000053555633db57895c2418
timestamp: 2009-12-05 22:50:52

Version Info:
Comments: ScreenSaverGift.com
CompanyName: ScreenSaverGift.com
FileDescription: Avatar Screensaver
FileVersion: 1.0.0.0
InternalName: Avatar Screensaver.exe
LegalCopyright: Copyright (c) 2014 ScreenSaverGift.com
LegalTrademarks: Copyright (c) 2014 ScreenSaverGift.com
OriginalFilename: Avatar Screensaver.exe
ProductName: Avatar Screensaver
ProductVersion: 1.0.0.0
Translation: 0x0000 0x04e4

AdWare.InstallMonster also known as:

Skyhigh	BehavesLike.Win32.Dropper.tc
McAfee	Artemis!531720F8C5E1
Cylance	unsafe
Zillya	Adware.InstallMonster.Win32.1446
Sangfor	PUP.Win32.Agent.Votp
Symantec	Trojan.Gen.2
Elastic	malicious (moderate confidence)
Cynet	Malicious (score: 99)
F-Secure	PotentialRisk.PUA/Downloader.Gen
Sophos	Generic Reputation PUA (PUA)
Ikarus	Trojan-Downloader.NSIS.Adload
Avira	PUA/Downloader.Gen
Antiy-AVL	Trojan[Downloader]/Win32.AdLoad.gen
Microsoft	PUA:Win32/Presenoker
Google	Detected
VBA32	AdWare.InstallMonster
DeepInstinct	MALICIOUS

How to remove AdWare.InstallMonster?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X