Cloud Packager

Cloud Packager is how we call a particular Trojan infection that pretends to be Creative Cloud Packager by Adobe. Apparently, once the user launches its installer, it shows a message saying the process failed and nothing was installed. Unfortunately, it is not true since the malicious program secretly settles in. Our researchers say its purpose is to stay hidden and use the infected computer’s resources to mine various cryptocurrencies. As a result, the system or even the Internet connection might appear to be slower than it used to be when the PC was clean. If you notice this happening to your computer and suspect Cloud Packager might be the one to blame, we encourage you to continue reading our text to learn more and then use the instructions located below the article to delete the Trojan manually. Of course, if you do not feel up to such a task you can use a trustworthy antimalware tool too.

Firstly, we should talk about how you might encounter Cloud Packager. The original Creative Cloud Packager created by Adobe is available through the following link helpx.adobe.com/enterprise/package/help/creative-cloud-packager.html as it was before, so the hackers did not corrupt the legitimate installer. Our researchers say it is most likely that they distribute the Trojan through torrent web pages or fake file-sharing sites. Thus, the malicious application could be encountered by those who would rather download software, not from their official web pages. Naturally, to escape such threats next time you should keep away from malicious or untrustworthy websites. Additionally, it would be smart to strengthen the computer’s security with a reliable antimalware tool if you do not have one yet.

Once Cloud Packager’s installer is launched the malware should settle in by creating two folders called wdf and nv. They might seem named randomly, but our researchers assure us these titles are the same on any computer. The installation process gets done secretly without the user noticing anything since the Trojan distracts you by showing a notification saying: “Installation Failed. Please Refer To PDApp.log for more information. Click here for help.” The system may not recognize it is an infection either because the Cloud Packager’s creators obfuscated files in the mentioned directories with Themida obfuscator. No doubt this was done to hide the software’s malicious code. Still, there are antimalware tools that can detect malicious obfuscated code and warn the user, so if the computer is protected by such a tool, the Trojan might be unable to get it.

From the moment Cloud Packager settles in it should run in the background until the PC gets turned off, and when the user turns it on again, the threat can launch itself once more. It might not do any harm to the system directly, although high usage of its resources could hasten break-down for some of the computer’s parts. Not mentioning, the system and the Internet connection could get so slow you may find yourself unable to play games, use particular programs, etc. As mentioned before, while the user cannot understand what is happening to his PC, the malicious program might make money for its creators while mining various cryptocurrencies, for example, Bitcoins.

Needless to say, you should not allow any hackers use your computer for their gain, so if you suspect Cloud Packager could be the reason why your computer has been this slow lately, we urge you to check the PC and get rid of it faster. If you prefer doing this manually, you should have a look at the instructions located below this article as they will tell you where to find the malware’s created data. Less experienced users who find the task a bit too difficult could employ a reliable antimalware tool and do a system scan. During it, the software should detect the Trojan or even other possible threats. Plus, you could erase all identified threats at once by clicking the removal button.

Erase Cloud Packager

1. Press Ctrl+Alt+Delete.
2. Open Task Manager.
3. Check if any of these processes are running:
   NvProfileUpdater64.exe
   wdf.exe
   taskmon.exe
4. If they are, select them and press End Task.
5. Close the Task Manager.
6. Press Win+E.
7. Access this folder: %WINDIR%
8. Look for folders called wdf and nv.
9. Right-click them separately and press Delete.
10. Close File Explorer.
11. Empty Recycle bin.
12. Restart the PC.