Threat Description

Application: ​W32/InstallBrain


Category: Spyware
Type: Application
Platform: W32
Aliases: Application:​W32/InstallBrain.[variant], Trojan:W32/InstallBrain.[variant]


InstallBrain is an updater service that runs in the background and periodically updates associates browser plug-ins and add-ons.


Automatic action

Once detected, the F-Secure security product will automatically quarantine the suspect file and prompt the user to select a further desired action.

Quarantine is a safe repository for files that may be harmful. A quarantined file can be restored or, if you decide so, deleted.

Excluding a file from scanning

If you are aware of and accept any potential risk associated with this program, you can configure the F-Secure security product to exclude it from scanning.

Suspect a False Alarm?

If you suspect a file has been incorrectly identified as malicious, (that is, it is a False Alarm or a False Positive), please first ensure your F-Secure security program is up-to-date with the latest detection database updates, then rescan the suspect file.

If you continue to suspect a False Alarm, you may submit a sample of the suspect file to our Security Labs for further analysis via the Sample Analysis System (SAS).

More scanning & removal options

More information on scanning or removal options is available in the documentation for your F-Secure security product on the Downloads section of our Home - Global site.

You may also refer to the Knowledge Base on the F-Secure Community site for more information.

Contact Support

For further assistance, F-Secure customers can request support online via the Request support or the Chat forms on our Home - Global site.

Technical Details

InstallBrain is part of a software bundler program associated with various browser plug-ins and add-ons from the Perion Network software company. When installed, the application is essentially an updater service that will run in the background as 'ibsvc.exe' and periodically download and install updates for the associated browser components.

The add-ons maintained by InstallBrain vary in function, but have reportedly silently reset the browser homepage and modified the search engine settings and/or search results. If the user elects to remove the components, the related InstallBrain program should also be uninstalled.

As of early October 2013, some InstallBrain installers have shown code similarity to Trojan-Downloader:W32/Mevade; these installers are identified with the detection name Trojan:W32/Installbrain.[variant].


Suspect a file or URL was wrongly detected? Submit a sample to our Labs for analysis

Submit Now

Scan & clean your PC

F-Secure Online Scanner will scan and clean your PC in just a few minutes for free

Learn More