Another find today. Stumbled on a file called UptUpdater.exe, also bundled by an unofficial Google Chrome download. I first spotted the UptUpdater.exe file running in the Windows Task Manager, but after a while UptUpdater.exe showed its GUI, where it claimed to install something called ServiceChecker:
Anyway, as usual when I find some new file, I upload them to VirusTotal to see what the anti-virus scanners says about the file. Turns out UptUpdater.exe is detected by a file of the anti-virus scanners, under names such as Adware.Win32.Pirrit, Adware.Downware and Pirrit.
If you’d like to remove Pirrit from your machine, you can do so by selecting the UptUpdater.exe file in FreeFixer:
Did you also find the ServiceChecker/Pirrit/UptUpdater.exe on your computer? Any idea how it was installed?
my antimalware finds the uptupdater.exe. Puts it in quarantaine but freefixer didn’t find it so i cant remove it
If you know the location of the UptUpdater.exe file, you can remove it with FreeFixer’s FileNuker tool, which you can find under the Tools tab. In my case, UptUpdater.exe was located under c:\Windows\Temp.