PDA

View Full Version : Manual Removal Guide for PU.Kuai8



Friday
2017-06-27, 09:19
The following instructions have been created to help you to get rid of "PU.Kuai8" manually.
Use this guide at your own risk; software should usually be better suited to remove malware, since it is able to look deeper.

If this guide was helpful to you, please consider donating towards this site (http://www.safer-networking.org/index.php?page=donate).

Threat Details:

Categories:
pups

Description:
PU.Kuai8 is a web browser application from kuai8.com that offers a vast quantity of advertising.
Links (be careful!):

: ww.kuai8.com
Removal Instructions:

Files:

Please use Windows Explorer or another file manager of your choice to locate and delete these files.

The file at "<$APPDATA>\kuai8\data\database.gmx".
The file at "<$APPDATA>\kuai8\data\plugin\hot.gmx".
The file at "<$APPDATA>\kuai8\data\plugin\inwl.gmx".
The file at "<$APPDATA>\kuai8\data\plugin\netwl.gmx".
The file at "<$APPDATA>\kuai8\data\plugin\pc.gmx".
The file at "<$APPDATA>\kuai8\data\plugin\scan.gmx".
The file at "<$APPDATA>\kuai8\data\plugin\top.gmx".
The file at "<$APPDATA>\kuai8\data\plugin\window.gmx".
The file at "<$PROGRAMFILES>\Kuai8\audio\complete.wav".
The file at "<$PROGRAMFILES>\Kuai8\K8Browser.exe".
The file at "<$PROGRAMFILES>\Kuai8\K8BugReport.exe".
The file at "<$PROGRAMFILES>\Kuai8\K8Common.dll".
The file at "<$PROGRAMFILES>\Kuai8\K8DLPlatform.exe".
The file at "<$PROGRAMFILES>\Kuai8\K8DLUtils.dll".
The file at "<$PROGRAMFILES>\Kuai8\K8Flash.exe".
The file at "<$PROGRAMFILES>\Kuai8\K8GM.exe".
The file at "<$PROGRAMFILES>\Kuai8\K8UIRender.dll".
The file at "<$PROGRAMFILES>\Kuai8\K8Update.exe".
The file at "<$PROGRAMFILES>\Kuai8\K8UrlEncrypt.dll".
The file at "<$PROGRAMFILES>\Kuai8\K8Version.dll".
The file at "<$PROGRAMFILES>\Kuai8\K8Web.exe".
The file at "<$PROGRAMFILES>\Kuai8\tool\K8Bubble.exe".
The file at "<$PROGRAMFILES>\Kuai8\tool\K8Common.dll".
The file at "<$PROGRAMFILES>\Kuai8\tool\K8DLUtils.dll".
The file at "<$PROGRAMFILES>\Kuai8\tool\K8External.exe".
The file at "<$PROGRAMFILES>\Kuai8\tool\K8Mini.exe".
The file at "<$PROGRAMFILES>\Kuai8\tool\K8NetDetect.exe".
The file at "<$PROGRAMFILES>\Kuai8\tool\K8PluginFix.exe".
The file at "<$PROGRAMFILES>\Kuai8\tool\K8RestoreWindow.dll".
The file at "<$PROGRAMFILES>\Kuai8\tool\K8RTLFix.exe".
The file at "<$PROGRAMFILES>\Kuai8\tool\K8Tray.exe".
The file at "<$PROGRAMFILES>\Kuai8\tool\K8UIRender.dll".
The file at "<$PROGRAMFILES>\Kuai8\Uninstall.exe".
Make sure you set your file manager to display hidden and system files. If PU.Kuai8 uses rootkit technologies, use the rootkit scanner integrated into Spybot-S&D (http://www.safer-networking.org/index.php?page=spybotsd) 2.x or our Total Commander anti-rootkit plugins (http://forums.spybot.info/downloads.php?id=3).
You will have to use a global search for files without a name specified. Be extra careful, because just the name might not be enough to identify files!

Important: There are more files that cannot be safely described in simple words. Please use Spybot-S&D (http://www.safer-networking.org/index.php?page=spybotsd) to remove them.

Folders:

Please use Windows Explorer or another file manager of your choice to locate and delete these folders.

The directory at "<$APPDATA>\kuai8\data\plugin".
The directory at "<$APPDATA>\kuai8\data".
The directory at "<$PROGRAMFILES>\Kuai8\audio".
The directory at "<$PROGRAMFILES>\Kuai8\tool".
The directory at "<$PROGRAMFILES>\Kuai8".
Make sure you set your file manager to display hidden and system files. If PU.Kuai8 uses rootkit technologies, use our RootAlyzer (http://forums.spybot.info/downloads.php?id=8) or our Total Commander anti-rootkit plugins (http://forums.spybot.info/downloads.php?id=3).
You will have to use a global search for files without a name specified. Be extra careful, because just the name might not be enough to identify folders!

Final Words:

If neither Spybot-S&D nor self help did resolve the issue or you would prefer one on one help,
Please read these instructions (http://forums.spybot.info/showthread.php?t=288) before requesting assistance,
Then start your own thread in the Malware Removal Forum (http://forums.spybot.info/forumdisplay.php?f=22) where a volunteer analyst will advise you as soon as available.

There are more files or system entries belonging to this product that <$SPYBOTSD> can remove, but that cannot be easily described in text. Please use <$SPYBOTSD> to make sure <$PRODUCTNAME> gets completely removed.