Jump to content

PcAcceleratePro PUA


Recommended Posts

  • Most Valued Members

Hello,

https://www.virustotal.com/gui/file/faa55ba4b50f6eebbbaddf029f97e0324fd9dc1d606fed18935d999460dfd361?nocache=1
https://www.virustotal.com/gui/file/57b485a86929cca59150579b362ac8812a67a3e464a7663a5d3d39d4cdf1e0e9?nocache=1
https://www.virustotal.com/gui/file/c960dd553a71f676a30c93a5f6f3aa6a6363cff6547aa1bd07e2d53c1fd240cb?nocache=1

 

Those are PUP for some application that is called ChronoSpeedUp or PCAcceleratePro , even if you uninstall it , it will come back from AutoRun after restart, need to be disabled from AutoRun also

Not detected by ESET , had to clean it manually.

And unfortunately I don't have the files anymore as I've deleted them , PC was scanned with Online Scanner as ESET isn't running on it.

I know I have to send to samples email , but I don't have the sample anymore.

 

Fortinet helped catch it because it blocked all it's traffic from Web Filter as Malicious Websites

 

image.png.e42862b9f170730c0e8d24281e4cea02.png

 

Those are them

Edited by Nightowl
Link to comment
Share on other sites

Some interesting observations about ChronoSpeedupAS.exe per VT:

Quote

Copyright ChronoSpeedup Works (c) 2021
Product ChronoSpeedup
Description ChronoSpeedup
Original Name ChronoSpeedup
Internal Name ChronoSpeedup
File Version 1.0.6.52

Persistence is maintained via Win scheduled task entry: https://itsafety.net/report/20211118-45ad099f96f4edd0873ee4d247a02571-chronospeedupas-exe_general-threat . Also this analyzed version:

Quote

Product version:
1.0.0.1+21:51:16_9/20/2021

Appears to be not the one that ended up on your device and is not listed on VT.

Edited by itman
Link to comment
Share on other sites

  • Most Valued Members

Those in the links I have uploaded them from the Infected PC before I cleaned them manually since most AVs didn't detect any of it , I don't know if it's harmful , but it prevents you from uninstalling and keep re-installing , and also keep communicating with weird places about most details of the PC.

Seems like that Kaspersky and McAfee and rest started to detect it , Kaspersky AI now see it as HOAX Win32 , still no detection by ESET.

That's another remenant found in TMP folder by HitmanPro

https://www.virustotal.com/gui/file/4a4c15adf5a87c6459edfe9e7e39b29c1b632b763cf94e8419d968532c3c3078?nocache=1

Edited by Nightowl
Link to comment
Share on other sites

On 11/21/2021 at 4:47 AM, Nightowl said:

Hello,

https://www.virustotal.com/gui/file/faa55ba4b50f6eebbbaddf029f97e0324fd9dc1d606fed18935d999460dfd361?nocache=1
https://www.virustotal.com/gui/file/57b485a86929cca59150579b362ac8812a67a3e464a7663a5d3d39d4cdf1e0e9?nocache=1
https://www.virustotal.com/gui/file/c960dd553a71f676a30c93a5f6f3aa6a6363cff6547aa1bd07e2d53c1fd240cb?nocache=1

 

Those are PUP for some application that is called ChronoSpeedUp or PCAcceleratePro , even if you uninstall it , it will come back from AutoRun after restart, need to be disabled from AutoRun also

Not detected by ESET , had to clean it manually.

And unfortunately I don't have the files anymore as I've deleted them , PC was scanned with Online Scanner as ESET isn't running on it.

I know I have to send to samples email , but I don't have the sample anymore.

 

Fortinet helped catch it because it blocked all it's traffic from Web Filter as Malicious Websites

 

image.png.e42862b9f170730c0e8d24281e4cea02.png

 

Those are them

Two of these samples are detected by ESET as "a variant of Win32/Adware.PCAcceleratePro.T.gen application".

Link to comment
Share on other sites

  • Most Valued Members

The program seems to be useless, but for sure in background it's doing some weird things , like send user data and stuff like that, what makes it more annoying that it will keep reinstalling itself even if you uninstall normally from the uninstall file.

Link to comment
Share on other sites

  • Nightowl changed the title to PcAcceleratePro PUA

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...