OfferCore Bundler - How to remove

Sometimes, when you download an installer for a free program, your antivirus scanner might detect it as “Win32/OfferCore” or “PUP.Optional.OfferCore”. These detections show that the installer will try to offer you additional software.

OfferCore is adware, a bundler. It is a framework for advertising inside installers. Often, ads by OfferCore look like they’re part of the installation workflow, which can cause people to install the advertised software unintentionally.

While OfferCore is not necessarily dangerous, it can cause you to install unwanted software. So, if a file that you downloaded gets flagged as “OfferCore”, take that detection seriously.

About OfferCore:

Threat type	Bundler, adware.
Problems with OfferCore	It can cause unwanted software to be installed unintentionally.
How to avoid bundlers	Don’t use freeware download sites, instead, download programs from official developer websites, be careful during installation and refuse all the offers.
How to remove OfferCore	Use anti-malware programs (Spyhunter for PC, Spyhunter for Mac, Malwarebytes, etc.) to remove malware, uninstall unwanted programs.

How OfferCore works

OfferCore shows ads in installers

OfferCore is riskware – a program that is not dangerous, but that could cause security problems. It shows ads inside installers, similarly to InstallCore.

Developers and software distributors put OfferCore in their installers to make money. When users agree to install the programs that OfferCore promotes, the developers get a bit of money.

The word “agree” is a little flexible, here. OfferCore might be configured to present the ads in a way that makes them really easy to miss – and to accidentally invite potentially unwanted programs on your device. This deception is not inherent to OfferCore, but some devs do handle the bundler irresponsibly. The results can be frustrating (Download Wrappers and Unwanted Software are pure evil).

Some of the potentially unwanted programs might be adware (for instance, RelevantKnowledge, PremierOpinion spyware spread with the help of bundlers) But even when the programs that OfferCore installs are reliable and high quality, they might still be unwanted. They can be annoying and time-consuming to remove, too.

So, even though OfferCore is not very dangerous at all, it has the potential to cause trouble.

It’s downloaded from the internet

So, which sites and developers use OfferCore?

• Individual developers and companies who want to monetize their free programs.
• Freeware websites that wrap free programs in their own installers and monetize them.

One of the ways to avoid OfferCore is to avoid freeware download sites. It’s better to download programs from the developer’s site, where the installers are unlikely to be infected with adware.

This isn’t always possible, though. OfferCore is used by original developers, too.

It seems like OfferCore and similar tools are also used to monetize cheat tools and other iffy software. A lot of Minecraft and Roblox-related cheats and similar items get flagged as OfferCore.

But some developers do put OfferCore in their installers – what to do then?

Be careful during the installation. If advanced or custom installation settings are available, choose those. If you notice during setup that a screen is talking about a different app than the one that you’re trying to install, look for a button that says “Decline”, “Refuse”, or “Cancel”. Review all ticked checkboxes and untick them as needed.

You could also try disconnecting your computer from the internet during the installation process. OfferCore and other bundlers review some technical details about your computer and then download appropriate ads, but if there’s no internet, no bundlers can be downloaded. Don’t bet on this working every time, though.

How to deal with OfferCore

Although OfferCore is not malicious, it does get flagged by some anti-malware programs (Virustotal.com). If you protect your computer with an anti-malware program, such as Spyhunter for Windows, Spyhunter for Mac, Malwarebytes, etc., then you should get a warning whenever you download an installer that has OfferCore.

If you accidentally allowed some software to be installed on your device, you can restore your computer to an earlier point or uninstall the unwanted software manually. Sort your apps/programs by installation date to help you find the ones related to OfferCore more easily.

Automatic Malware removal tools

Uninstall unwanted programs

How to remove OfferCore Bundler using Windows Control Panel

Many hijackers and adware like OfferCore install some of their components as regular Windows programs as well as additional software. This part of malware can be uninstalled from the Control Panel. To access it, do the following.

• Start→Control Panel (older Windows) or press Windows Key→Search and enter Control Panel and then press Enter (Windows 8, Windows 10).
• Choose Uninstall Program (if you don't see it, click in the upper right next to "View by" and select Category).
• Go through the list of programs and select entries related to OfferCore Bundler . You can click on "Name" or "Installed On" to reorder your programs and make OfferCore easier to find.
• Click the Uninstall button. If you're asked if you really want to remove the program, click Yes.
• In many cases anti-malware programs are better at detecting related parasites, thus I recommend installing Spyhunter to identify other programs that might be a part of this infection.

How to remove OfferCore Bundler from macOS

Delete OfferCore from your applications.

1. Open Finder.
2. In the menu bar, click Go.
3. Select Applications from the dropdown.
4. Find the OfferCore Bundler app.
5. Select it and right-click it (or hold the Ctrl and click the left mouse button).
6. In the dropdown, click Move to Bin/Trash. You might be asked to provide your login password.

(Optional) Delete related settings

Some malicious apps make themselves difficult to delete by changing various settings and leaving behind malicious files. Remove settings related to OfferCore.

• Click the Apple logo in the menu bar. Open System Preferences.
• Some malicious applications set profiles to enforce unwanted settings. Remove unwanted configuration profiles.

1. 1. In System Preferences, click the Profiles icon. This icon is only visible if there are profiles on your Mac.
   2. Select unwanted profiles and remove them by pressing the minus '-'  button at the bottom.

• Some adware applications set SOCKS proxy to manipulate your internet traffic. Remove unwanted proxies:

1. 1. In System Preferences, click Network, Advanced, Proxies.
   2. If a proxy is set without your permission, uncheck it and click OK.

(Optional) Delete malicious files

Some malicious apps leave behind dangerous files in your Library folders. Delete files related to OfferCore Bundler.

1. Open Finder.
2. In the menu bar, click Go -> Computer.
3. In the search box, type in OfferCore and variations of it.
4. Delete the files that are found and that seem to be related to OfferCore Bundler.