Has anybody found novpopen.exe on their PC?

[Donec]

I suddenly had a pop-up appear at bottom right corner that looked suspicious, and what's more, there was no "X" to close it, although I could move it around the screen.   It has "2022 Dynamic List" as a title, followed by "50 Most-followed beauties on Social Media Platforms", obviously a scam so I clicked nothing on it and started malware checks.  While that was going on I searched on my browser using "2022 Dynamic List" and found several sites offering help.  Anyway, I ignored those and what I did was, I looked to see if there were any suspicious programs running in Task Manager, one I did not recognise was "novpopen.exe", so I searched again in my browser to find out what it was and everything I found pointed to it being malware.  So I clicked "End Task" in Task Manager to delete which closed the pop-up, as simple as that.  I also did a quick search of my PC using "Everything" to see where it might be located and there were four instances of it, all in folders belonging to Iobit programs.  I deleted these files plus four prefetch items, and hopefully that is the last I will see of it.  The malware checks only found one infection by Malwarebytes called "Hijack.Host" which I quarantined.

Has anybody else had experience of this?  And I am surprised that Iobit programs are downloading this kind of stuff when we install their product, or don't they know about it?

I hope to hear from somebody.  Thanks.

[Harmburger]

I just wanted to say thank you for your post. I had the exact same thing happen, and I found it really disturbing. Not only was the message urging me to "learn the secrets of their bodies" incredibly creepy, but a cursory Google search brought up a bunch of sites that wanted me to install a program called SpyHunter to clean it out, which all seemed really suspicious. Then I found this single forum post, which helped me out a lot.

Is this a tactic IObit is using to make money now? Showing you a creepy popup that you search for a solution for to trick you into downloading actual malware? It's creepy all around, and I've scrubbed IObit from my machine. So thanks again. I hope more people see this and dump IObit. Checking my malware scanner, every single quarantined item from the past couple of years has been related to them, so it was long overdue.

[Alexicutioner]

Same thing for me. Fortunately, easily gotten rid of. But, still...super lame they're including this now.

[richardferrym]

On 11/7/2022 at 2:18 AM, Harmburger said:

I just wanted to say thank you for your post. I had the exact same thing happen, and I found it really disturbing. Not only was the message urging me to "learn the secrets of their bodies" incredibly creepy, but a cursory Google search brought up a bunch of sites that wanted me to install a program called SpyHunter to clean it out, which all seemed really suspicious. Then I found this single forum post, which helped me out a lot.

Is this a tactic IObit is using to make money now? Showing you a creepy popup that you search for a solution for to trick you into downloading actual malware? It's creepy all around, and I've scrubbed IObit from my machine. So thanks again. I hope more people see this and dump IObit. Checking my malware scanner, every single quarantined item from the past couple of years has been related to them, so it was long overdue.

got the same issue but different message, SpyHunter fix the issue