PUP.Carambis, PUP.AppMaster

PUP.Carambis

 

*file
c:\users\{USERNAME}\appdata\local\carambis\cleaner.ini
c:\users\{USERNAME}\desktop\cleaner.lnk
c:\program files\carambis\cleaner\imageformats\qico.dll
c:\program files\carambis\cleaner\imageformats\qjpeg.dll
c:\program files\carambis\cleaner\platforms\qwindows.dll
c:\program files\carambis\cleaner\sqldrivers\qsqlite.dll
c:\program files\carambis\cleaner\avcodec-55.dll
c:\program files\carambis\cleaner\avformat-55.dll
c:\program files\carambis\cleaner\avutil-52.dll
c:\program files\carambis\cleaner\chromaprint.dll
c:\program files\carambis\cleaner\cleaner.exe
c:\program files\carambis\cleaner\cleanerserviceinstaller.exe
c:\program files\carambis\cleaner\libegl.dll
c:\program files\carambis\cleaner\libglesv2.dll
c:\program files\carambis\cleaner\qjson.dll
c:\program files\carambis\cleaner\qt5core.dll
c:\program files\carambis\cleaner\qt5gui.dll
c:\program files\carambis\cleaner\qt5network.dll
c:\program files\carambis\cleaner\qt5sql.dll
c:\program files\carambis\cleaner\qt5widgets.dll
c:\program files\carambis\cleaner\uninstall.exe
c:\program files\carambis\cleaner\updateprogress.exe
c:\users\{USERNAME}\appdata\local\carambis\cleaner\cleaner{1341447b-5da0-406f-87cd-8f1d4916cbf3}.sqlite
c:\users\{USERNAME}\appdata\local\carambis\cleaner\collo1.log
c:\users\{USERNAME}\appdata\local\carambis\cleaner\install_id.txt
c:\users\{USERNAME}\appdata\local\carambis\cleaner\lastsession
c:\users\{USERNAME}\appdata\roaming\microsoft\windows\start menu\programs\cleaner\cleaner.lnk
c:\users\{USERNAME}\appdata\roaming\microsoft\windows\start menu\programs\cleaner\uninstall.lnk


*reg_key
HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\CarambisCleanerService
HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\Cleaner
HKCU\SOFTWARE\CARAMBIS\Cleaner

 

 

PUP.AppMaster

 

*file
C:\Users\{USERNAME}\AppData\Roaming\AppMaster\AbsoluteConverter.ico
C:\Users\{USERNAME}\AppData\Roaming\AppMaster\AppMaster.exe
C:\Users\{USERNAME}\AppData\Roaming\AppMaster\AppMaster.exe.config
C:\Users\{USERNAME}\AppData\Roaming\AppMaster\apps.txt
C:\Users\{USERNAME}\AppData\Roaming\AppMaster\pref.txt
C:\USERS\{USERNAME}\APPDATA\ROAMING\Microsoft\Windows\Start Menu\AbsoluteConverter.lnk
C:\USERS\{USERNAME}\DESKTOP\AbsoluteConverter.lnk
C:\USERS\{USERNAME}\APPDATA\ROAMING\Microsoft\Windows\Recent\apps.txt.lnk
C:\USERS\{USERNAME}\APPDATA\ROAMING\Microsoft\Windows\Recent\pref.txt.lnk

 
*reg_val
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce  |   wextract_cleanup0