84,285,534 programs installed

Should I remove less2pay?

What percent of users and experts removed it?
84% remove it16% keep it
Overall Sentiment
What do people think about it?
(click star to rate)
How common is it?
Reach <0.001%


Remove less2pay
Powered by Reason Antivirus

What is less2pay?

Less2Pay is a JustPlug.It web browser extension that is delivered via the WebPick InstalleRex download and install manager. In addition to be included with various adware offer bundles, the JustPlug.It cross browser extension runs with multiple parts including a Windows service, an auto-starting component and the browser toolbar/plugin which is designed to inject advertisements in the browser in form of banner ads, hyper-text links and popups. In addition, some version might hijack existing advertising on web sites as well as inject affiliate codes in links as coupon offers. During installation, the program will install itself in a folder with a random name in Program Files or ProgramData and each of the included files will also have a shared random generated name. The Windows Service that is installed runs with full administrator rights under the Services control app and connects to a remote server (toolkitsetbest.info, getapplicationmy.info) for updates as well as creates a server that listens for TCP network requests locally.

The advertisements that are displayed in the browser could include deceptive malvertising ads for 'required' updates of known common programs as well as unwanted pop-ups advertisements. If downloaded these programs install a number of bundled adware utilities and additional browser extensions. Additionally components of the program will modify the browser's default security levels.

A number of the versions may include a setup file signed by WEB PICK - INTERNET HOLDINGS LTD (this is the partner installer/distributor).


It adds a Browser Helper Object (BHO) to Internet Explorer. The primary executable is named aSFh.exe. A majority of users end up uninstalling this less than a week of it being installed. The setup package generally installs about 3 files and is usually about 1.34 MB (1,403,989 bytes).
  • Malware detected in the program
  • Integrates into the web browser
  • Typically distributed through a pay-per-install bundle
  • Injects advertisements unassociated with the underlying web page
  • Most users and experts agree, you should remove it!
Warning, multiple anti-virus scanners have detected possible malware in less2pay.
aSFh.exe (065a59096c5f1a6b3450f599141f13e8) has been flagged by the following 24 scanners:
Anti-Virus softwareVersionDetection
AhnLab-V3 2014.02.23 Trojan/Win32.Preloader
Antiy-AVL GrayWare[AdWare:not-a-virus]/Win32.MegaSearch
avast! 2014.9-140304 Win32:Adware-gen [Adw]
AVG 2015.0.3546 Generic_r
Baidu-International Adware.Win32.MegaSearch.aX
CAT-QuickHeal Adware.Megasearch.at (Not a Virus)
Comodo Security 17826 UnclassifiedMalware
ESET-NOD32 8.9457 a variant of Win32/AdWare.MultiPlug.K.gen
Fortinet FortiGate 3/4/2014 Adware/Megasearch
IKARUS anti.virus t3scan.2.2.29 Win32.AdWare
K7 AntiVirus 13.176.11239 Adware
K7GW 13.176.11226 Adware ( 00490ca81 )
Kaspersky not-a-virus:AdWare.Win32.MegaSearch
Kingsoft AntiVirus 331020.49267 Win32.Troj.MegaSearch.at.(kcloud)
Malwarebytes v2014.03.04.12 PUP.Optional.MultiPlug.A
McAfee 5600.7202 PUP-FFY!065A59096C5F
NANO AntiVirus Riskware.Win32.MegaSearch.csukmc
Panda Antivirus Trj/Genetic.gen
Qihoo-360 HEUR/Malware.QVM10.Gen
Sophos 4.97 Generic PUA KI
Trend Micro 10.465.04 TROJ_GEN.R0CBC0PBK14
TrendMicro-HouseCall 7.2.63 TROJ_GEN.R0CBC0PBK14
Vba32 AntiVirus BScope.Trojan.Agent
VIPRE Antivirus 26730 MegaSearch Toolbar
aSFh.dll (957e832f7e5a3d97cdaef6354c247135) has been flagged by the following 11 scanners:
Anti-Virus softwareSoftware versionDetection
AhnLab-V3 2014.01.25.00 Adware/Win32.Graftor
Avira AntiVir ADWARE/Adware.Gen
AVG Generic_r.GU
Baidu-International Adware.Win32.MultiPlug.N
Comodo Security 17671 ApplicUnwnt.Win32.InstallRex.ALC
ESET-NOD32 9336 a variant of Win32/AdWare.MultiPlug.N
Kingsoft AntiVirus 2013.4.9.267 Win32.Troj.Generic.a.(kcloud)
Malwarebytes PUP.Optional.MultiPlug.A
Qihoo-360 HEUR/Malware.QVM30.Gen
Rising Antivirus PE:Malware.Adware!6.1293
VIPRE Antivirus 25784 JustPlugIt (fs)
aSFh.x64.dll (0567ddd12805526ce48de1fc9df2a8db) has been flagged by the following 5 scanners:
Anti-Virus softwareSoftware versionDetection
AhnLab-V3 2014.01.26.00 Trojan/Win32.Preloader
AVG Generic_r.GX
Baidu-International Adware.Win64.MultiPlug.A
ESET-NOD32 9338 a variant of Win64/Adware.MultiPlug.A
Malwarebytes PUP.Optional.MultiPlug.A
       View all 40 all detections
less2pay has been found to be bundled with 3rd party software. If you have not purposefully installed this, you should be safe uninstalling it.
Find out how to remove less2pay.

Program detailsProgram details

Displayed publisher: less2ppaayy
URL: justplug.it
Installation folder: C:\ProgramData\less2pay
Uninstaller: "C:\ProgramData\less2pay\aSFh.exe" /s /n /C:"ExecuteCommands;UninstallCommands" ""
Estimated size: 1.34 MB

Program filesFiles installed by less2pay

Program executable:aSFh.exe (Malware detected)
Additional files:
  • (Malware detected) aSFh.exe (by Setup)
  • (Malware detected) aSFh.dll
  • (Malware detected) aSFh.x64.dll

Program behaviorsBehaviors exhibited

2 Internet Explorer BHOs
  • aSFh.dll is installed in Internet Explorer as a BHO (Browser Helper Object) under the name 'downloaeditkeeup' with the class of {3E93B849-6E91-212D-8B4A-0027BF3C7619}.
  • aSFh.x64.dll is installed in Internet Explorer as a BHO (Browser Helper Object) under the name 'WoowCoiupon' with the class of {301BA2D0-F466-2E5B-82E1-A33346985830}.

How do I remove less2pay?

Quickly and completely remove less2pay from your computer by downloading "Should I Remove It?", its 100% FREE and installs in seconds (click the button below).
Download "Should I Remove It?", it's FREE!Remove less2pay from your computer.
Or, you can uninstall less2pay from your computer by using the Add/Remove Program feature in the Window's Control Panel.
  1. On the Start menu (for Windows 8, right-click the screen's bottom-left corner), click Control Panel, and then, under Programs, do one of the following:
    • Windows Vista/7/8: Click Uninstall a Program.
    • Windows XP: Click Add or Remove Programs.
  2. When you find the program less2pay, click it, and then do one of the following:
    • Windows Vista/7/8: Click Uninstall.
    • Windows XP: Click the Remove or Change/Remove tab (to the right of the program).
  3. Follow the prompts. A progress bar shows you how long it will take to remove less2pay.
  4. If for some reason uninstallation fails, please install Microsoft's uninstall fixer utility which will help fix problems with programs that can't be uninstalled at support.microsoft.com.

How do I reset my web browser?

If your web browser homepage and search settings have been modfied by less2pay you can restore them to their previous default settings.
Microsoft Internet Explorer
Mozilla Firefox
Google Chrome
Scan your PC for malware
If you do not have a good anti-virus program, please consider installing one. Below are some we highly recommend.

Uninstall it 84%
Keep it 16%
Windows 10
United States

Distribution by countryGeography

100.00% of installs come from the United States
Which countries install it?
  United States 100.00%

comments1 comment

user comment
user comment
Adam H.over a year ago
This program is a malware that does NOT uninstall on Internet explorer. Please do NOT try to install this program, As it WILL NOT ALLOW YOU TO DISABLE IT!!