ShopForU

from PayByAds ltd.

Remove ShopForU by PayByAds ltd

What is ShopForU?

ShopForU is an ad-supported browser extension that may deliver advertisements in the form of coupons, affiliate links, price-comparisons, display media and other links through a number of functions including those based on the the content of any web page the user is visiting, plug-ins, add-ons, or the web browser itself. Advertisements may be injected to overlay the page or inserted directly into the page content. This adware may alter the content of any web page accessed for the purpose of displaying advertisements.

About (from PayByAds ltd)

PayByAds ShopForU is a browser add-on that allows users to perform visual search on products from thousands of stores. The service will display “See More” icons next to product images on online stores. After hovering or clicking on this icon, a window will appear showing deals relevant for that item and/or similar/rela... Read more

Overview

It adds registry entry for the current user which will allow the program to automatically start each time it is rebooted. A scheduled task is added to Windows Task Scheduler in order to launch the program at various scheduled times (the schedule varies depending on the version). The primary executable is named shopforu.exe. A majority of users end up uninstalling this less than a week of it being installed. The setup package generally installs about 5 files and is usually about 1.49 MB (1,563,924 bytes).

Malware detected in the program
Automatically starts with Windows
Typically distributed through a pay-per-install bundle
Displays unwanted advertisements
The experts agree, you should remove it!

Warning, multiple anti-virus scanners have detected possible malware in ShopForU.

shopforu.exe (4fe9cd1ed8efd6c6d106415506d4e867) has been flagged by the following 13 scanners:
Anti-Virus software	Version	Detection
AVG	2016.0.3141	Paybyads
Avira	7.11.184.246	ADWARE/Adware.Gen7
AVware	1.5.0.21	Montiera (fs)
Baidu-International	4.0.3.15413	Hacktool.Win32.Montiera.aOJM
ESET-NOD32	9.10714	a variant of Win32/Toolbar.Montiera.Q
IKARUS anti.virus	t3scan.1.8.3.0	not-a-virus:Downloader.Montiera
Kaspersky	14.0.0.2200	not-a-virus:Downloader.Win32.Montiera
Malwarebytes	v2015.04.13.01	PUP.Optional.ShopForU.A
McAfee	5600.6797	Artemis!4FE9CD1ED8EF
McAfee-GW-Edition	7.6797	Artemis
Qihoo-360	1.0.0.1015	Win32/Virus.Downloader.42e
Sophos	4.98	PayByAds
VIPRE Antivirus	34744	Montiera (fs)
shopforusetup.exe (2e1ef50fb4045fa2270078214cff0d4d) has been flagged by the following 30 scanners:
Anti-Virus software	Software version	Detection
Lavasoft Ad-Aware	12.0.163.0	Adware.PayByAds.A
ALYac	1.0.1.4	Adware.PayByAds.A
Antiy-AVL	1.0.0.1	RiskWare[Downloader:not-a-virus]/Win32.Montiera
avast!	8.0.1489.320	Win32:GenMaliciousA-FPG [Adw]
AVG	15.0.0.4315	Paybyads.893
AVware	1.5.0.21	Montiera (fs)
Baidu-International	3.5.1.41473	PUA.Win32.Montiera.bR
Bitdefender	7.2	Adware.PayByAds.A
Bkav FE	1.3.0.6379	W32.HfsAdware.B5AC
CAT-QuickHeal	14.00	Downloader.Montiera.r5 (Not a Virus)
Cyren	5.4.16.7	W32/Application.RTZT-0277
Emsisoft Anti-Malware	3.0.0.600	Adware.PayByAds.A (B)
ESET-NOD32	11371	a variant of Win32/Toolbar.Montiera.R potentially unwanted
Fortinet FortiGate	5.0.999.0	Riskware/Montiera
F-Secure	11.0.19100.45	Adware.PayByAds.A
G Data	25	Adware.PayByAds.A
IKARUS anti.virus	T3.1.8.6.0	not-a-virus:Downloader.Montiera
K7 AntiVirus	9.202.15367	Unwanted-Program ( 004b1ff21 )
K7GW	9.202.15367	Unwanted-Program ( 004b1ff21 )
Kaspersky	15.0.1.10	not-a-virus:Downloader.Win32.Montiera.b
Malwarebytes	1.75.0.1	PUP.Optional.ShopForU.A
McAfee	6.0.5.614	Artemis!2E1EF50FB404
MicroWorld-eScan	12.0.250.0	Adware.PayByAds.A
nProtect	2015-03-24.01	Adware.PayByAds.A
Panda Antivirus	4.6.4.2	Trj/Chgt.J
Sophos	4.98.0	PayByAds
Symantec	20141.2.0.56	Trojan.Gen.2
Trend Micro	9.740.0.1012	TROJ_GEN.R000C0ELO14
TrendMicro-HouseCall	9.700.0.1001	TROJ_GEN.R000C0ELO14
VIPRE Antivirus	38740	Montiera (fs)

View all 43 all detections

ShopForU has been found to be bundled with 3rd party software. If you have not purposefully installed this, you should be safe uninstalling it.

Program details

Displayed publisher: shopforu

Installation folder: C:\users\user\appdata\local\shopforu\shopforu\1.3.15.8

Uninstaller: "C:\users\user\appdata\Local\shopforu\shopforu\1.3.15.8\shopforusetup.exe" /uninstl

Estimated size: 1.49 MB

Files installed by ShopForU

Program executable:	shopforu.exe (Malware detected)
Path:	C:\users\user\appdata\local\shopforu\shopforu\1.3.15.8\shopforu.exe
MD5:	4fe9cd1ed8efd6c6d106415506d4e867

Additional files:

chromext.dll
firefoxt.dll
res.dll (by Pay By Ads LTD)
(Malware detected) shopforusetup.exe (by Pay By Ads LTD)

Behaviors exhibited

2 Scheduled Tasks

shopforusetup.exe is scheduled as a task named 'ShopForU Updater' (Next runs on 08/01/2015 at 16:05).
shopforu.exe is scheduled as a task named 'ShopForU' (Next runs on 08/01/2015 at 16:05).

Startup File (User Run)

shopforu.exe is loaded in the current user (HKCU) registry as an auto-starting executable named 'ShopForU' and executes as C:\users\user\appdata\Local\shopforu\shopforu\1.3.15.8\shopforu.exe.

How do I remove ShopForU?

You can uninstall ShopForU from your computer by using the Add/Remove Program feature in the Window's Control Panel.

On the Start menu (for Windows 8, right-click the screen's bottom-left corner), click Control Panel, and then, under Programs, do one of the following:

Windows Vista/7/8/10: Click Uninstall a Program.
Windows XP: Click Add or Remove Programs.

When you find the program ShopForU, click it, and then do one of the following:

Windows Vista/7/8/10: Click Uninstall.
Windows XP: Click the Remove or Change/Remove tab (to the right of the program).

Follow the prompts. A progress bar shows you how long it will take to remove ShopForU.
If for some reason uninstallation fails, please install Microsoft's uninstall fixer utility which will help fix problems with programs that can't be uninstalled at support.microsoft.com.