We received the file METABLOGNEWISSUES.EXE and detected that METABLOGNEWISSUES.EXE is not good.
METABLOGNEWISSUES.EXE is Adware. You should remove the file METABLOGNEWISSUES.EXE.
Kill the process METABLOGNEWISSUES.EXE and remove METABLOGNEWISSUES.EXE from Windows.
Malware Analysis of METABLOGNEWISSUES.EXE
Full path on a computer: %Local Appdata%\MetablogNewIssues\MetablogNewIssues.exe
Detected by UnHackMe:
METABLOGNEWISSUES.EXE
Default location: %Local Appdata%\MetablogNewIssues\MetablogNewIssues.exe
Removal Results: Success
Number of reboot: 1
METABLOGNEWISSUES.EXE is known as:
Adware.KrAdword.395912.B, Adware.KorAd, Adware2, ADW_KRADDARE, not-a-virus:AdWare.CloverPlus.hk, Adware.CloverPlus.1BLXtR7ggjw, ApplicUnwnt, SPR.Tool.395912, AdWare.CloverPlus, PUP.AdMatching, probably a variant of Win32.Adware.CloverPlus.AB, Trojan-Downloader.Agent
METABLOGNEWISSUES.EXE hash:
- MD5: dd17f2d1bd0748ec84fb6ccd088ef829
The file is used for downloading and installing other malware, Trojans, viruses by the commands received from the Command Center.
How to quickly detect METABLOGNEWISSUES.EXE presence?
![]( "Registry")
Registry:
![]( "Folders")
Folders:
![]( "Files")
Files:
Registry:- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\metablogagent: “%Local Appdata%\MetablogNewIssues\metablogagent.exe”
- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\MetablogNewIssues: “”%Local Appdata%\MetablogNewIssues\MetablogNewIssues.exe” /byboot”
Folders:- %Local Appdata%\MetablogNewIssues
- %Temp%\adm
- %Temp%\is-ALFBN.tmp
Files:- %Local Appdata%\MetablogNewIssues\metablogagent.exe
- %Local Appdata%\MetablogNewIssues\MetablogNewIssues.exe
- %Local Appdata%\MetablogNewIssues\unins000.dat
- %Local Appdata%\MetablogNewIssues\unins000.exe
- %Temp%\adm\adinstall.exe
- %Temp%\is-ALFBN.tmp\adinstall.tmp