84,488,480 programs installed

Should I remove markingApp?

What percent of users and experts removed it?
88% remove it12% keep it
Overall Sentiment
Bad
What do people think about it?
(click star to rate)
How common is it?
Reach 0.0009%
Lifespan of installation (until removal)
< 8.09 days
238.54 days >
Average installed length: 125.33 days

Other programs by Keep-My-Search LTD

markingApp

What is markingApp?

MarkingApp is an adware/PUP variant that will hijack your web browser’s home and search pages to an unwanted search engine (possibly serves up malware and trick-to-click ware via malvertising practices). Once installed it will add a toolbar, change your browser homepage and set your default search engine. In addition, this adware will injects advertisements in the browser, also known as an ad-injector. Ad injection will insert an add, text, banner, flash or hyperlink-over into the white space or over and existing ad in the underlying HTML. Ads can be from PCP hijacked engines with very low relevance and can serve up malware, adware or other PUP. In addition the components will track your web browser history and actions and report back to a command and control server.

Overview

During setup, the program registers itself to launch on boot through a Windows Schedule Task in order to automatically start-up (this is typically done to avoid any UAC prompts). It adds a Browser Helper Object (BHO) to Internet Explorer. A scheduled task is added to Windows Task Scheduler in order to launch the program at various scheduled times (the schedule varies depending on the version). Once installed, it will add an extension to both the Firefox and Chrome web browsers. The primary executable is named D6markingAppU89.exe. A majority of users end up uninstalling this less than a week of it being installed. The setup package generally installs about 18 files and is usually about 8.08 MB (8,467,708 bytes).
  • Malware detected in the program
  • Automatically starts with Windows
  • Adds a toolbar to IE and an extension to Chrome and Firefox
  • Typically distributed through a pay-per-install bundle
  • Injects advertisements unassociated with the underlying web page
  • The experts agree, you should remove it!
Warning, multiple anti-virus scanners have detected possible malware in markingApp.
D6markingAppU89.exe (6873f8ac444743133a9ffc63370349e0) has been flagged by the following 40 scanners:
Anti-Virus softwareVersionDetection
Lavasoft Ad-Aware 537 Gen:Variant.Adware.Kazy.600427
Agnitum Outpost 7.1.1 PUA.AddLyrics
AhnLab-V3 2015.08.10 PUP/Win32.Addlyrics
ALYac 1.0.1.4 Gen:Variant.Adware.Kazy.600427
Arcabit 1.0.0.425 Trojan.Adware.Kazy.D9296B
avast! 2014.9-150816 Win32:Adware-gen [Adw]
AVG 2016.0.3015 AddLyrics_r
Avira 8.3.1.6 TR/Crypt.EPACK.Gen2
AVware 1.5.0.21 Trojan.Win32.Generic!BT
Baidu-International 4.0.3.15816 Adware.Win32.AddLyrics.EE
Bitdefender 1.0.20.1140 Gen:Variant.Adware.Kazy.600427
CAT-QuickHeal 8.15.14.00 AdWare.AddLyrics.r5 (Not a Virus)
Comodo Security 22970 ApplicUnwnt
Cyren 5.4.16.7 W32/AddLyrics.G.gen!Eldorado
Dr.Web 9.0.0.0228 Trojan.Revizer.700
Emsisoft Anti-Malware 8.15.08.16.06 Gen:Variant.Adware.Kazy.600427
ESET-NOD32 9.12068 a variant of Win32/Adware.AddLyrics.EE
Fortinet FortiGate 8/16/2015 Riskware/AddLyrics
F-Prot v6.4.7.1.166 W32/AddLyrics.G.gen
F-Secure 11.2015-16-08_1 Gen:Variant.Adware.Kazy
G Data 15.8.25 Gen:Variant.Adware.Kazy.600427
IKARUS anti.virus t3scan.1.9.5.0 PUA.AddLyrics
Jiangmin KV150816 AdWare/AddLyrics.aee
K7 AntiVirus 13.207.16831 Adware
K7GW 13.207.16831 Adware ( 004bd69a1 )
Kaspersky 14.0.0.1571 not-a-virus:AdWare.Win32.AddLyrics
McAfee 5600.6671 RDN/Generic PUP.x!cxb
McAfee-GW-Edition 7.6671 RDN/Generic PUP.x!cxb
MicroWorld-eScan 16.0.0.684 Gen:Variant.Adware.Kazy.600427
NANO AntiVirus 0.30.24.3079 Trojan.Win32.EPACK.drodok
Panda Antivirus 15.08.16.06 Trj/Genetic.gen
Rising Antivirus 23.00.65.15814 PE:Trojan.Win32.Generic.18CB2DB3!415968691
Sophos 4.98 Generic PUA LM (PUA)
SUPERAntiSpyware 9687 Trojan.Agent/Gen-AddLyrics
Symantec 8/16/2015 rev. 1 PUA.Gen
Tencent 1.0.0.1 Win32.Adware.Addlyrics.Wpjn
Trend Micro 10.465.16 TROJ_GEN.R03EC0EEC15
Vba32 AntiVirus 3.12.26.4 AdWare.AddLyrics
VIPRE Antivirus 42750 Trojan.Win32.Generic!BT
Zillya 2.0.0.2341 Adware.AddLyrics.Win32.5158
YSResultsSetup.exe (12d81541a7d90ff39f6d9763f36a1b3f) has been flagged by the following 36 scanners:
Anti-Virus softwareSoftware versionDetection
Lavasoft Ad-Aware 12.0.163.0 Gen:Variant.Adware.Strictor.74971
Agnitum Outpost 5.5.1.3 PUA.Agent!
AhnLab-V3 2015.08.13.00 PUP/Win32.BrowseFox
ALYac 1.0.1.4 Gen:Variant.Adware.Strictor.74971
Antiy-AVL 1.0.0.1 RiskWare[Downloader]/Win32.Montiera.al
Arcabit 1.0.0.425 Trojan.Adware.Strictor.D124DB
avast! 8.0.1489.320 Win32:Adware-COP [PUP]
AVG 15.0.0.4392 Generic.CE9
Avira 8.3.1.6 PUA/Montiera.Gen7
AVware 1.5.0.21 Trojan.Win32.Generic!BT
Baidu-International 3.5.1.41473 Adware.Win32.BrowseFox.81
Bitdefender 7.2 Gen:Variant.Adware.Strictor.74971
Bkav FE 1.3.0.7062 W32.HfsAdware.E40D
CAT-QuickHeal 14.00 Adware.Kazy.g5
Cyren 5.4.16.7 W32/Application.SFCQ-7771
Dr.Web 7.0.13.5270 Adware.Downware.12026
Emsisoft Anti-Malware 3.5.0.642 Gen:Variant.Adware.Strictor.74971 (B)
ESET-NOD32 12084 a variant of Win32/Toolbar.Montiera.AE potentially unwanted
F-Secure 11.0.19100.45 Gen:Variant.Adware.Strictor
G Data 25 Gen:Variant.Adware.Strictor.74971
K7 AntiVirus 9.208.16868 Riskware ( 0040eff71 )
K7GW 9.208.16870 Riskware ( 0040eff71 )
Kaspersky 15.0.1.10 not-a-virus:Downloader.Win32.Montiera.al
Malwarebytes 2.1.1.1115 PUP.Optional.PayByAds.A
McAfee 6.0.5.614 Artemis!12D81541A7D9
McAfee-GW-Edition v2015 Artemis
MicroWorld-eScan 12.0.250.0 Gen:Variant.Adware.Strictor.74971
NANO AntiVirus 0.30.24.3079 Trojan.Win32.Montiera.dscpdk
Panda Antivirus 4.6.4.2 Trj/Genetic.gen
Sophos 4.98.0 Generic PUA HO (PUA)
SUPERAntiSpyware 5.6.0.1032 PUP.PayByAds/Variant
Symantec 20141.2.0.56 Trojan.Gen.2
Trend Micro 9.740.0.1012 TROJ_GEN.R02LC0EDP15
Vba32 AntiVirus 3.12.26.4 Downloader.Montiera
VIPRE Antivirus 42822 Trojan.Win32.Generic!BT
ViRobot 2014.3.20.0 Adware.Strictor.1216768[h]
       View all 76 all detections
markingApp has been found to be bundled with 3rd party software. If you have not purposefully installed this, you should be safe uninstalling it.

Program detailsProgram details

Displayed publisher: markingApp
Installation folder: C:\Program Files\version61markingapp
Uninstaller: C:\Program Files\version61markingApp\Uninstall.exe
Estimated size: 8.08 MB

Program filesFiles installed by markingApp

Program executable:D6markingAppU89.exe (Malware detected)
Path:C:\Program Files\version61markingapp\D6markingAppU89.exe
MD5:6873f8ac444743133a9ffc63370349e0
Additional files:
  • 192.crx
  • 192.dll
  • 192.xpi
  • 192_x64.dll
  • 7DKFpv.exe
  • AYCQdi3O.exe
  • D2sWl4Opc.exe
  • D6markingAppU89.dll
  • D6markingAppU89.exe
  • GUYLMW4gF3ir.exe
  • IKYEzoR7g3u6.exe
  • l26qFHt.exe
  • MBCZxe01agPU.exe
  • sqlite3.dll
  • Sv0ebxmNo8.exe
  • t08FWvd.exe
  • Uninstall.exe - Designed for Windows
  • (Malware detected) YSResultsSetup.exe

Program behaviorsBehaviors exhibited

Internet Explorer BHO
  • 192.dll is installed in Internet Explorer as a BHO (Browser Helper Object) under the name 'markingApp' with the class of {E6096648-A8ED-2AA9-9A5B-932BCFCCAEA1}.
Scheduled Task
  • D6markingAppU89.exe is scheduled as a task named 'markingApp Update' (runs daily at 7:45:00 PM).
Scheduled Task (Boot/Login)
  • D6markingAppU89.exe is automatically launched at startup through a scheduled task named markingApp Update.

How do I remove markingApp?

You can uninstall markingApp from your computer by using the Add/Remove Program feature in the Window's Control Panel.
  1. On the Start menu (for Windows 8, right-click the screen's bottom-left corner), click Control Panel, and then, under Programs, do one of the following:
    • Windows Vista/7/8/10: Click Uninstall a Program.
    • Windows XP: Click Add or Remove Programs.
  2. When you find the program markingApp, click it, and then do one of the following:
    • Windows Vista/7/8/10: Click Uninstall.
    • Windows XP: Click the Remove or Change/Remove tab (to the right of the program).
  3. Follow the prompts. A progress bar shows you how long it will take to remove markingApp.
  4. If for some reason uninstallation fails, please install Microsoft's uninstall fixer utility which will help fix problems with programs that can't be uninstalled at support.microsoft.com.

How do I reset my web browser?

If your web browser homepage and search settings have been modfied by markingApp you can restore them to their previous default settings.
Microsoft Internet Explorer
Mozilla Firefox
Google Chrome

OS VERSIONS
Win 7 (SP1) 47%
Win 7 6%
 
HOW IT STARTS
Scheduled task? Yes
(Runs on Windows boot)
 
USER ACTIONS
Uninstall it 88%
Keep it 12%

Windows OS versionsWindows

Which Windows OS versions does it run on?
Windows 7 52.94%
Windows 10 29.41%
Windows Vista 17.65%
Which OS releases does it run on?
Windows 7 Home Premium 29.41%
Windows 8.1 17.65%
Windows Vista Home Premiu... 11.76%
Windows 7 Home Basic 11.76%
Windows 8.1 Pro 5.88%
Windows 7 Professional 5.88%

Distribution by countryGeography

66.67% of installs come from the United States
Which countries install it?
  United States 66.67%
  Saudi Arabia 13.33%
  France 6.67%
  United Arab Emirates 6.67%
  Iran 3.33%
  Italy 3.33%

OEM distributionPC manufacturers

What PC manufacturers (OEMs) have it installed?
Hewlett-Packard 23.53%
Toshiba 17.65%
Sony 17.65%
Dell 11.76%
Acer 11.76%
ASUS 11.76%
Lenovo 5.88%
Common models
TOSHIBA Satellite U505 6.25%
TOSHIBA SATELLITE L830 6.25%
TOSHIBA SATELLITE C670D-1... 6.25%
Sony VPCEG18FA 6.25%
Sony VPCEA16FG 6.25%
LENOVO 03192AG 6.25%

commentsComments

user comment
No one has commented yet. Help others learn more about this software, share your comments.