WikiBrowser is a software usually installed without your knowledge with the download of freeware. In fact some sites use the method of repackaging. This is an operation that is to redo the module software installation by adding download options. These options allow to add other software as for example toolbars browser, or potentially unwanted software. The addition of these new programs can decrease the performance of the system but also slow or redirect internet surfing. As a general rule, should focus on the author’s official site to download your software.
Identified : 06/06/2015.


– It belongs to a family of PUP (Potentially Unwanted Program).
– A polluteware is a software that pollutes storage and/or the Base of registers.
– Vendor : PUP.Optional


– It installs a plugin of the browser Google Chrome (G2),
– It installs a program of extension for browser Mozilla Firefox (M2),
– It installs a plugin of the browser Mozilla Firefox (P2),
– It changes the start page of the browser Mozilla Firefox (M0),
– It changes the start page of the browser Internet Explorer (R0),
– It changes the browser Internet Explorer search page (R1),
– It changes settings URLSearchHook browser Microsoft Internet Explorer (R3),
– It changes the IP addresses of the file Hosts (O1),
– It is installed as a BHO (Browser Helper Object) of internet browser (O2),
– It installs as a process launched at startup of the system (RP),
– It settled in the Base of registers to be launched each time with the system (O4),
– It Place multiple shortcuts application, Desktop, QuickLaunch, Taskbar (O4GS),
– It hijack key Winsock with its own resource (O10),
– It changes the address or domain DNS (O17),
– It installs as a registry value AppInit_DLLs (O20),
– It installs as a service to be launched each time the system (O23),(SS/SR),
– It starts a task planned in automatic (O39),
– It installs drivers that start automatically with the system (O41)
– It installs as a program (O42),
– It creates to many registry keys ‘Software’,
– It creates additional folders (O43),
– It installs a process of variable size to the level of the system folders (O44),
– It moved to the Windows prefetcher folder (O45),
– It creates a registry StartupReg key (O53),
– It installs as a driver system (O58),
– It creates multiple files users (O61),
– It creates a Legacy pointing to a malware service, key in the registry. (O64),
– It modifies the startup of browsers Mozilla Firefox and Internet Explorer (O68),
– It changes the Internet research provider (O69),
– It creates an active incoming connection in the application of the firewall Windows exceptions (O87),


[MD5.B24910A7D61DE265B129098869D1293D] – (…) — C:\Users\Coolman\AppData\Local\WikiUpdate.exe [364032] [PID.2311]
[MD5.0B5A14A0ED15F0C369EDAE0A79C0950E] – (…) — C:\Users\Coolman\AppData\Local\WikiUpdate.exe [364038] [PID.2452]
O4 – GS\Quicklaunch [Coolman]: Launch Internet Explorer Browser.lnk . (.The WikiBrowser Authors – WikiBrowser.) C:\Users\Coolman\AppData\Local\WikiBrowser\Application\wikibrowser.exe
O4 – GS\Quicklaunch [Coolman]: WikiBrowser.lnk . (.The WikiBrowser Authors – WikiBrowser.) C:\Users\Coolman\AppData\Local\WikiBrowser\Application\wikibrowser.exe
O23 – Service: WikiBrowserUpdateService (WikiBrowserUpdateService) . (…) – C:\Users\Coolman\AppData\Local\WikiUpdate.exe
O42 – Logiciel: WikiBrowser – (.WikiBrowser.) [HKCU] — WikiBrowser
O43 – CFD: 2015/07/04 – 14:06:32 – [] D — C:\Users\rodolphe8866\AppData\Local\WikiBrowser
O43 – CFD: 23/06/2015 – 03:13:09 – [] —-D C:\Users\Coolman\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WikiBrowser
O61 – LFC: 2015/06/30 14:23:48 A . (..) — C:\Users\Coolman\AppData\Local\WikiUpdate.exe [364032]
O67 – Shell Spawning: [HKCU\..\open\Command] (…) — C:\Users\Coolman\AppData\Local\WikiBrowser\Application\WikiBrowser.exe
O87 – FAEL: « {F2E2A785-4FBB-4278-BB28-61628ABBB617} » [In-None-P17-TRUE] .(.The WikiBrowser Authors – WikiBrowser.) — C:\Users\rodolphe8866\AppData\Local\WikiBrowser\Application\wikibrowser.exe
SR – | Auto 16/06/2015 364032 | (WikiBrowserUpdateService) . (…) – C:\Users\Coolman\AppData\Local\WikiUpdate.exe
C:\Users\Coolman\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WikiBrowser


PUP.Optional.WikiBrowser.A [ Malwarebytes Antimalware ]


– Remove software in Windows Configuration Panel,
Remove with ZHPcleaner
Diagnose with ZHPDiag