AdWare.Win32.OpenCandy.com removal guide

The AdWare.Win32.OpenCandy.com is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What AdWare.Win32.OpenCandy.com virus can do?

Reads data out of its own binary image
Network activity detected but not expressed in API logs
Anomalous binary characteristics

How to determine AdWare.Win32.OpenCandy.com?


File Info:
crc32: 8C9F4109
md5: 1b14342c99f565ea462b428580d3f89c
name: 1B14342C99F565EA462B428580D3F89C.mlw
sha1: 5875428ccc2fcf729a6a48d1953545a8ebd2cad5
sha256: 329347b0d64e9b78f2d1a60ed7afb1b3806c2546e4742d6d1b21c8384aab6276
sha512: e6741292463f0215e9330c4588e258ad95bdeb32fbb92f266b1dfaf31ee9de26b8aba360ca67088295cf0a9dc134302b9e98b73649862a950ef9b14db4fb8512
ssdeep: 12288:5ekQcix/NuwxbPjDd5alUOPJRuzQdDvDHGreh0SUeGKz:5ektixN3d1nekSDvzWW0SUC
type: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive

Version Info:
LegalCopyright: Copyright (C) 2005-2014 Mooii
FileVersion: V3.7
CompanyName: Mooii
Comments: PhotoScape Setup (2014-09-11 xc624xc804 1:38:17)
ProductName: PhotoScape
FileDescription: PhotoScape Setup
Translation: 0x0000 0x03b5

AdWare.Win32.OpenCandy.com also known as:

FireEye	Generic.mg.1b14342c99f565ea
K7GW	Unwanted-Program ( 004b8c341 )
K7AntiVirus	Unwanted-Program ( 004b8c341 )
Cyren	W32/OpenCandy.E.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
Avast	Win32:OpenCandy-D [PUP]
Kaspersky	not-a-virus:AdWare.Win32.OpenCandy.com
NANO-Antivirus	Trojan.Win32.Mlw.egkuys
Emsisoft	Application.AdInstall (A)
DrWeb	Adware.OpenCandy.51
Zillya	Adware.OpenCandy.Win32.44
Invincea	Generic ML PUA (PUA)
Antiy-AVL	GrayWare[AdWare]/Win32.OpenCandy.a
Gridinsoft	Adware.Win32.OpenCandy.vb!s5
SUPERAntiSpyware	PUP.OpenCandy/Variant
ZoneAlarm	not-a-virus:AdWare.Win32.OpenCandy.com
VBA32	Adware.OpenCandy
ESET-NOD32	Win32/OpenCandy potentially unsafe
TrendMicro-HouseCall	TROJ_GEN.R06EH0CKI20
Rising	Adware.OpenCandy!1.CC17 (CLASSIC)
Yandex	Riskware.OpenCandy!AygB4+XeDZk
Ikarus	AdWare.OpenCandy
AVG	Win32:OpenCandy-D [PUP]

How to remove AdWare.Win32.OpenCandy.com?

AdWare.Win32.OpenCandy.com removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X