Malwarebytes Anti-Malware www.malwarebytes.org Scan Date: 12-6-2015 Scan Time: 23:09:56 Logfile: mbam results.txt Administrator: Yes Version: 2.01.6.1022 Malware Database: v2015.06.12.07 Rootkit Database: v2015.06.02.01 License: Trial Malware Protection: Enabled Malicious Website Protection: Enabled Self-protection: Disabled OS: Windows 7 Service Pack 1 CPU: x64 File System: NTFS User: Alexander Scan Type: Threat Scan Result: Completed Objects Scanned: 337271 Time Elapsed: 15 min, 15 sec Memory: Enabled Startup: Enabled Filesystem: Enabled Archives: Enabled Rootkits: Disabled Heuristics: Enabled PUP: Enabled PUM: Enabled Processes: 1 PUP.Optional.MultiPlug.Gen, C:\Users\Alexander\AppData\Roaming\98460464-1434033623-11E4-8D3F-E16D75071200\hnsg64DF.tmp, 1976, Delete-on-Reboot, [18bfeecb305a2f075036156c7b8ad927] Modules: 0 (No malicious items detected) Registry Keys: 12 PUP.Optional.ModGoog, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\GOOGLEUPDATE.EXE, Quarantined, [1eb9467366241b1bf15cd97454ae44bc], PUP.Optional.ModGoog, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\GOOGLEUPDATE.EXE, Quarantined, [1eb9467366241b1bf15cd97454ae44bc], PUP.Optional.MultiPlug.Gen, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\zedepory, Quarantined, [18bfeecb305a2f075036156c7b8ad927], PUM.Security.Hijack.DisableChromeUpdates, HKLM\SOFTWARE\POLICIES\GOOGLE\UPDATE, Quarantined, [0bcca910f09a0432d823197044c1758b], PUP.Optional.CrossRider.C, HKLM\SOFTWARE\WOW6432NODE\APPDATALOW\SOFTWARE\Crossrider, Quarantined, [72652297800a7abc8bd65e91b84b21df], PUP.Optional.MultiPlug.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{1146AC44-2F03-4431-B4FD-889BC837521F}{53a1c4d9}, Quarantined, [bd1a10a9a8e2f83ec48f9aee1bea827e], PUM.Security.Hijack.DisableChromeUpdates, HKLM\SOFTWARE\WOW6432NODE\POLICIES\GOOGLE\UPDATE, Quarantined, [f1e68237fa903cfa9962c1c83acbdc24], PUP.Optional.MultiPlug.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\FUCIXIWY, Quarantined, [ae29befb2e5ced49c7457e026b9a54ac], PUP.Optional.MultiPlug.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\XOPEROZE, Quarantined, [5780d3e6e8a22313937a4a363dc80cf4], PUP.Optional.SuperOptimizer.C, HKU\S-1-5-18\SOFTWARE\APPDATALOW\{1146AC44-2F03-4431-B4FD-889BC837521F}, Quarantined, [12c58e2bb0dabb7b3fd14448ba4bdb25], PUP.Optional.Crossrider.C, HKU\S-1-5-18\SOFTWARE\APPDATALOW\SOFTWARE\_CrossriderRegNamePlaceHolder_, Quarantined, [e0f7447571193df915a9a5df8085a55b], PUP.Optional.RapidMediaConverter.A, HKU\S-1-5-21-3239934883-776162143-1995868664-1000\SOFTWARE\RapidMediaConverterApp, Quarantined, [399eb30618726dc9cfd63a4b6e975fa1], Registry Values: 6 PUM.Security.Hijack.DisableChromeUpdates, HKLM\SOFTWARE\POLICIES\GOOGLE\UPDATE|DisableAutoUpdateChecksCheckboxValue, 1, Quarantined, [0bcca910f09a0432d823197044c1758b] PUP.Optional.MBot.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|mbot_nl_282, Quarantined, [3d9a4475f09a4fe7dcb872a2cc38bf41], PUM.Security.Hijack.DisableChromeUpdates, HKLM\SOFTWARE\WOW6432NODE\POLICIES\GOOGLE\UPDATE|DisableAutoUpdateChecksCheckboxValue, 1, Quarantined, [f1e68237fa903cfa9962c1c83acbdc24] PUP.Optional.MultiPlug.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\fucixiwy|ImagePath, C:\Users\Alexander\AppData\Roaming\98460464-1434033623-11E4-8D3F-E16D75071200\nsv244E.tmpfs, Quarantined, [ae29befb2e5ced49c7457e026b9a54ac] PUP.Optional.MultiPlug.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\xoperoze|ImagePath, C:\Users\Alexander\AppData\Roaming\98460464-1434033623-11E4-8D3F-E16D75071200\jnsb4ECE.tmp, Quarantined, [5780d3e6e8a22313937a4a363dc80cf4] PUP.Optional.MultiPlug.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\zedepory|ImagePath, C:\Users\Alexander\AppData\Roaming\98460464-1434033623-11E4-8D3F-E16D75071200\hnsg64DF.tmp, Quarantined, [0ccb12a70189a19539d4dda38f767987] Registry Data: 0 (No malicious items detected) Folders: 10 PUP.Optional.MultiPlug.A, C:\Users\Alexander\AppData\Local\98460464-1434040858-11E4-8D3F-E16D75071200, Quarantined, [5a7d94255832e35383fe305100054db3], PUP.Optional.MultiPlug.Gen, C:\Users\Alexander\AppData\Roaming\98460464-1434033623-11E4-8D3F-E16D75071200, Delete-on-Reboot, [18bfeecb305a2f075036156c7b8ad927], PUP.Optional.MultiPlug.Gen, C:\Users\Alexander\AppData\Roaming\98460464-1434033659-11E4-8D3F-E16D75071200, Quarantined, [e7f0f4c569217fb70b7ca9d8e81d56aa], PUP.Optional.MultiPlug.Gen, C:\Users\Alexander\AppData\Roaming\98460464-1434033820-11E4-8D3F-E16D75071200, Quarantined, [5f7809b01377a49243448df461a4ea16], PUP.Optional.GlobalUpdate.A, C:\Users\Alexander\AppData\Local\Temp\comh.291735, Quarantined, [5582279295f5af87496e9d3123e0da26], PUP.Optional.OptimizerPro.A, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Optimizer Pro v3.2, Quarantined, [d0073a7fd9b1b482d0af9c5016ed43bd], PUP.Optional.OptimizerPro.A, C:\Users\Alexander\AppData\Roaming\Optimizer Pro, Quarantined, [5a7d6059becc2d09cac73cb0c53eb34d], PUP.Optional.OptimizerPro.A, C:\Users\Alexander\AppData\Roaming\Optimizer Pro\Backup, Quarantined, [5a7d6059becc2d09cac73cb0c53eb34d], PUP.Optional.OptimizerPro.A, C:\Users\Alexander\AppData\Roaming\Optimizer Pro\Log, Quarantined, [5a7d6059becc2d09cac73cb0c53eb34d], PUP.Optional.OptimizerPro.A, C:\Users\Alexander\AppData\Roaming\Optimizer Pro\Undo, Quarantined, [5a7d6059becc2d09cac73cb0c53eb34d], Files: 49 PUP.Optional.Nova.A, C:\Program Files (x86)\69dc8177-a574-4dff-8461-b3267b078dcf\40882d6a-0c6a-479b-917d-dd9bf7ea5963.dll, Quarantined, [31a6a217bdcd4beb7f49799c4eb434cc], PUP.Optional.SkiSearch.A, C:\Users\Alexander\AppData\Local\Temp\2qivlooE35.exe, Quarantined, [97406356167448eea1e05428af578779], PUP.Optional.OptimizerPro.A, C:\Users\Alexander\AppData\Local\Temp\optprosetup.exe, Quarantined, [cd0ab306cebce65088c542239a68718f], Trojan.Agent.AI, C:\Users\Alexander\AppData\Local\Temp\Quarantine.exe, Quarantined, [e3f43683d0ba2f07a94375f8709237c9], PUP.Optional.OurSeaching.A, C:\Users\Alexander\AppData\Local\Temp\Bgpwz1HyyY.exe, Quarantined, [b126388193f7979f37d689f2c73f40c0], PUP.Optional.EORezo, C:\Users\Alexander\AppData\Local\Temp\cYeUNmPzoe.exe, Quarantined, [72655c5d4a4092a4c11cdaa1ed1946ba], PUP.Optional.OfferInstaller.C, C:\Users\Alexander\AppData\Local\Temp\fsd2D2B.exe, Quarantined, [9542e8d13a503cfad4b4122e4db56a96], PUP.Optional.OfferInstaller.C, C:\Users\Alexander\AppData\Local\Temp\fsd6895.exe, Quarantined, [e8efa5143a50dc5a0f7991afeb17bb45], PUP.Optional.OfferInstaller.C, C:\Users\Alexander\AppData\Local\Temp\fsd8B32.exe, Quarantined, [0dcad4e5c4c60a2c2e5a86ba24de4fb1], PUP.Optional.CheckOffer, C:\Users\Alexander\AppData\Local\Temp\nsc8517.tmp\nsCBHTML5.dll, Quarantined, [55824f6a137776c0d02b5013a45e9a66], PUP.Optional.Giner, C:\Users\Alexander\AppData\Local\Temp\~ld60D8\fgrs\tmp\XTab_Setup(2536).exe, Quarantined, [e7f011a8a0ea0432639e3a42d036d729], PUP.Optional.ModGoog, C:\Users\Alexander\AppData\Local\Temp\comh.291735\GoogleCrashHandler.exe, Quarantined, [e5f2b9000a801620ff4e3a13f80a13ed], PUP.Optional.ModGoog, C:\Users\Alexander\AppData\Local\Temp\comh.291735\GoogleUpdate.exe, Quarantined, [1eb9467366241b1bf15cd97454ae44bc], PUP.Optional.ModGoog, C:\Users\Alexander\AppData\Local\Temp\comh.291735\GoogleUpdateBroker.exe, Quarantined, [a82f5267a9e1b18509443f0e936fc23e], PUP.Optional.ModGoog, C:\Users\Alexander\AppData\Local\Temp\comh.291735\GoogleUpdateOnDemand.exe, Quarantined, [5285c5f46921c96daca10c417989bf41], PUP.Optional.ModGoog, C:\Users\Alexander\AppData\Local\Temp\comh.291735\goopdate.dll, Quarantined, [5c7b3287ff8b55e192bb400de81ae61a], PUP.Optional.ModGoog, C:\Users\Alexander\AppData\Local\Temp\comh.291735\goopdateres_en.dll, Quarantined, [fed98831ef9bef479ab33e0fbe44f907], PUP.Optional.ModGoog, C:\Users\Alexander\AppData\Local\Temp\comh.291735\npGoogleUpdate4.dll, Quarantined, [488f4970a2e88fa762eb3e0f8e74d729], PUP.Optional.ModGoog, C:\Users\Alexander\AppData\Local\Temp\comh.291735\psmachine.dll, Quarantined, [8f485663286202341538f6574ab822de], PUP.Optional.ModGoog, C:\Users\Alexander\AppData\Local\Temp\comh.291735\psuser.dll, Quarantined, [f7e05b5e2268a0966ce11835b05205fb], PUP.Optional.Adlyrics.A, C:\Users\Alexander\AppData\Local\Temp\f9626892-7a78-3199-abd2-97bbce96297b\adv_85.exe, Quarantined, [ffd89b1ec1c9c670593b59f740c227d9], PUP.Optional.OfferInstaller.C, C:\Users\Alexander\AppData\Local\Temp\f9626892-7a78-3199-abd2-97bbce96297b\OfferInstaller.exe, Quarantined, [6f685f5a7a10af8740488ab6dd253ac6], PUP.Optional.Tuto4PC.A, C:\Users\Alexander\AppData\Local\Temp\is-8T425.tmp\gentlemjmp_ieu.exe, Quarantined, [7a5df4c59eec70c6c7063744cb3b0cf4], PUP.Optional.Tuto4PC.A, C:\Users\Alexander\AppData\Local\Temp\is-H6H5H.tmp\gentlemjmp_ieu.exe, Quarantined, [9c3b8831b2d88ea8933a3843a066a35d], PUP.Optional.Tuto4PC.A, C:\Users\Alexander\AppData\Local\Temp\is-SPNQE.tmp\gentlemjmp_ieu.exe, Quarantined, [71665069c9c1ec4a705d88f319ed768a], PUP.Optional.CheckOffer, C:\Users\Alexander\AppData\Local\Temp\is-SS9A8.tmp\InstallManager.exe, Quarantined, [7b5cd8e14e3cc4727388451ede2454ac], PUP.Optional.SimpleFiles.A, C:\Users\Alexander\Downloads\fl-studio-11.zip, Quarantined, [16c154651476e05699fb80fbe71fdc24], PUP.Optional.WebTInst.A, C:\Windows\System32\drivers\Msft_Kernel_webTinstMKTN84_01009.Wdf, Quarantined, [a532a5147515ce6825ebc43404ff827e], PUP.Optional.MultiPlug.A, C:\Users\Alexander\AppData\Local\98460464-1434040858-11E4-8D3F-E16D75071200\onsqA902.tmp, Quarantined, [5a7d94255832e35383fe305100054db3], PUP.Optional.MultiPlug.A, C:\Users\Alexander\AppData\Local\98460464-1434040858-11E4-8D3F-E16D75071200\pnsqA903.exe, Quarantined, [5a7d94255832e35383fe305100054db3], PUP.Optional.MultiPlug.A, C:\Users\Alexander\AppData\Local\98460464-1434040858-11E4-8D3F-E16D75071200\rnsqA901.exe, Quarantined, [5a7d94255832e35383fe305100054db3], PUP.Optional.MultiPlug.A, C:\Users\Alexander\AppData\Local\98460464-1434040858-11E4-8D3F-E16D75071200\snsqA900.tmp, Quarantined, [5a7d94255832e35383fe305100054db3], PUP.Optional.MultiPlug.A, C:\Users\Alexander\AppData\Local\98460464-1434040858-11E4-8D3F-E16D75071200\Uninstall.exe, Quarantined, [5a7d94255832e35383fe305100054db3], PUP.Optional.MultiPlug.Gen, C:\Users\Alexander\AppData\Roaming\98460464-1434033623-11E4-8D3F-E16D75071200\nsa3053.tmp, Quarantined, [18bfeecb305a2f075036156c7b8ad927], PUP.Optional.MultiPlug.Gen, C:\Users\Alexander\AppData\Roaming\98460464-1434033623-11E4-8D3F-E16D75071200\hnsg64DF.tmp, Delete-on-Reboot, [18bfeecb305a2f075036156c7b8ad927], PUP.Optional.MultiPlug.Gen, C:\Users\Alexander\AppData\Roaming\98460464-1434033623-11E4-8D3F-E16D75071200\nse9BFB.tmp, Quarantined, [18bfeecb305a2f075036156c7b8ad927], PUP.Optional.MultiPlug.Gen, C:\Users\Alexander\AppData\Roaming\98460464-1434033623-11E4-8D3F-E16D75071200\rnsl4CE6.exe, Quarantined, [18bfeecb305a2f075036156c7b8ad927], PUP.Optional.MultiPlug.Gen, C:\Users\Alexander\AppData\Roaming\98460464-1434033623-11E4-8D3F-E16D75071200\Uninstall.exe, Quarantined, [18bfeecb305a2f075036156c7b8ad927], PUP.Optional.MultiPlug.Gen, C:\Users\Alexander\AppData\Roaming\98460464-1434033623-11E4-8D3F-E16D75071200\vnsl1EAC.tmp, Quarantined, [18bfeecb305a2f075036156c7b8ad927], PUP.Optional.MultiPlug.Gen, C:\Users\Alexander\AppData\Roaming\98460464-1434033659-11E4-8D3F-E16D75071200\vnsgA931.tmp, Quarantined, [e7f0f4c569217fb70b7ca9d8e81d56aa], PUP.Optional.MultiPlug.Gen, C:\Users\Alexander\AppData\Roaming\98460464-1434033659-11E4-8D3F-E16D75071200\Uninstall.exe, Quarantined, [e7f0f4c569217fb70b7ca9d8e81d56aa], PUP.Optional.MultiPlug.Gen, C:\Users\Alexander\AppData\Roaming\98460464-1434033820-11E4-8D3F-E16D75071200\vnsh216C.tmp, Quarantined, [5f7809b01377a49243448df461a4ea16], PUP.Optional.MultiPlug.Gen, C:\Users\Alexander\AppData\Roaming\98460464-1434033820-11E4-8D3F-E16D75071200\Uninstall.exe, Quarantined, [5f7809b01377a49243448df461a4ea16], PUP.Optional.Multiplug.A, C:\Windows\System32\Tasks\Bidaily Synchronize Task[3c32], Quarantined, [5087f2c77e0c43f3427d087fc83d0000], PUP.Optional.Multiplug.A, C:\Windows\Tasks\Bidaily Synchronize Task[3c32].job, Quarantined, [419644752367d165912fdea991745ea2], PUP.Optional.GlobalUpdate.A, C:\Users\Alexander\AppData\Local\Temp\comh.291735\GoogleUpdateHelper.msi, Quarantined, [5582279295f5af87496e9d3123e0da26], PUP.Optional.OptimizerPro.A, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Optimizer Pro v3.2\Help.lnk, Quarantined, [d0073a7fd9b1b482d0af9c5016ed43bd], PUP.Optional.OptimizerPro.A, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Optimizer Pro v3.2\Optimizer Pro on the Web.lnk, Quarantined, [d0073a7fd9b1b482d0af9c5016ed43bd], PUP.Optional.OptimizerPro.A, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Optimizer Pro v3.2\Uninstall Optimizer Pro.lnk, Quarantined, [d0073a7fd9b1b482d0af9c5016ed43bd], Physical Sectors: 0 (No malicious items detected) (end)