Downloaded Crapware Disguised As Legitimate Software

2 posters

WiredWX Hobby Weather Tools :: Archive :: Technical Support

Downloaded Crapware Disguised As Legitimate Software28th April 2015, 10:49 pm

Most of the problems seem to be removed, but every now and then, like when I rebooted earlier today, the crapware installations just open themselves and ask me to reinstall. I ran Malwarebytes, Spybot S&D, and two of the programs normally recommended here which have logs with them.

Here is the first log, from Security Check:

Results of screen317's Security Check version 1.00
x64 (UAC is enabled)
Internet Explorer 11
``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Enabled!
Windows Defender
McAfee Anti-Virus and Anti-Spyware
WMI entry may not exist for antivirus; attempting automatic update.
`````````Anti-malware/Other Utilities Check:`````````
Spybot - Search & Destroy
Google Chrome (42.0.2311.90)
````````Process Check: objlist.exe by Laurent````````
Windows Defender MSMpEng.exe
Windows Defender MpCmdRun.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: %
````````````````````End of Log``````````````````````

Here is the second log, from JRT:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.6.6 (04.28.2015:1)
OS: Windows 8.1 Connected x64
Ran by Jeffery on Tue 04/28/2015 at 18:33:38.89
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

~~~ Tasks

Successfully deleted: [Task] C:\Windows\system32\tasks\Optimize Start Menu Cache Files-S-1-5-21-1725350855-1927001909-1276192757-500
Successfully deleted: [Task] C:\Windows\system32\tasks\Optimize Start Menu Cache Files-S-1-5-21-2278621916-2737625894-394700733-500
Successfully deleted: [Task] C:\Windows\system32\tasks\Optimize Start Menu Cache Files-S-1-5-21-390256854-2030449046-3616693015-1001
Successfully deleted: [Task] C:\Windows\system32\tasks\Optimize Start Menu Cache Files-S-1-5-21-390256854-2030449046-3616693015-500
Successfully deleted: [Task] C:\Windows\system32\tasks\Optimize Start Menu Cache Files-S-1-5-21-839889159-4143274940-2464952320-500

~~~ Registry Values

~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Eventlog\Application\Update Teal Kitty

~~~ Files

Successfully deleted: [File] C:\Users\Jeffery\appdata\local\google\chrome\user data\default\local storage\https_inst.shoppingate.info_0.localstorage-journal
Successfully deleted: [File] C:\Users\Jeffery\appdata\local\google\chrome\user data\default\local storage\https_inst.shoppingate.info_0.localstorage
Successfully deleted: [File] C:\Users\Jeffery\appdata\local\google\chrome\user data\default\local storage\https_static.boostsaves.com_0.localstorage-journal
Successfully deleted: [File] C:\Users\Jeffery\appdata\local\google\chrome\user data\default\local storage\https_static.boostsaves.com_0.localstorage

~~~ Folders

Successfully deleted: [Folder] C:\Program Files (x86)\globalupdate
Successfully deleted: [Folder] C:\Users\Jeffery\appdata\local\globalupdate

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Tue 04/28/2015 at 18:39:23.57
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

If you also want my Malwarebytes log, it's pretty long, just a fair warning. A lot of crapware was quarantined and removed by it, but of course, when I restarted, these programs ran their setups on their own, but of course, I didn't click accept. I just closed them. When they ran their setups on their own, each of them created their own desktop file in a foreign format. I deleted them and cleared recycling bin. The reason I'm posting here is because I definitely don't want rogue crapware setups running themselves without my authorization. Most of the damage seems to have been contained, but I need to make sure my system is totally secure and this crapware is completely gone.

Thanks,
Jeff

EDIT: I forgot to mention some of the symptoms of this malicious software, in case others run into this problem. One thing it did was wreak havoc on the processor speed by running a bunch of nonsense processes in the background that I couldn't see. Another thing it did was delete google chrome from my desktop and replace it with something called "Crossbrowse." In addition to that, whenever I tried to uninstall it in Add or Remove Programs, it lagged my processor very hard (freezing up everything and taking forever to do anything), then it would run the corresponding program's setup 2-3 times before actually following through with uninstalling, as if I were trying to install it instead of uninstall it. Last but definitely not least, it hijacked Internet Explorer completely, making a fake MSN page as the homepage and not allowing any internet searches without opening a malicious popup page and freezing the search page. It also installed a bunch of malicious addons for IE completely on its own while I was none the wiser. As for google chrome, instead of hijacking it and installing bullcrap addons I didn't ask for or want, it just ran so many ads on every page I went to that my browser kept freezing up. These were, of course, not ads that are normally on the websites I visited. And finally, for Chrome, it loved redirecting to pages asking me to install stuff and telling me my pc is "unprotected." Got that right! Unprotected for sure!

Last edited by rambo_legacy on 28th April 2015, 11:03 pm; edited 1 time in total (Reason for editing : I figured if someone else has this problem, they can at least match the symptoms up and figure out they might have downloaded the same crapware bundle on accident.)

Re: Downloaded Crapware Disguised As Legitimate Software29th April 2015, 1:52 am

Hello and welcome to GeekPolice.Net My name is Dave. I will be helping you out with your particular problem on your computer.

1. I will be working on your Malware issues. This may or may not solve other issues you have with your machine.
2. The fixes are specific to your problem and should only be used for this issue on this machine.
3. If you don't know or understand something, please don't hesitate to ask.
4. Please DO NOT run any other tools or scans while I am helping you.
5. It is important that you reply to this thread. Do not start a new topic.
6. Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.
7. Absence of symptoms does not mean that everything is clear.

If you can't access the internet with your infected computer you will have to download and transfer any programs to the computer you're using now and transfer them to the infected computer with a CD-RW or a USB storage device. I prefer a CD because a storage device can get infected. If you use a storage device hold the shift key down while inserting the USB storage device for about 10 secs. You will also have to transfer the logs you receive back to the good computer using the same method until we can get the computer back on-line.
*************************************************************************
Windows 8.1 comes with its own AV called Windows Defender. If you wish to use another AV, WD should be de-activated.
Spybot is obsolete and should be removed

Please download AdwCleaner by Xplode onto your Desktop.

Before starting AdwCleaner, close all open programs and internet browsers, then double-click on the AdwCleaner icon.

If Windows prompts you as to whether or not you wish to run AdwCleaner, please allow it to run.
When the AdwCleaner program will open, click on the Scan button as shown below.

Downloaded Crapware Disguised As Legitimate Software Untitled

Downloaded Crapware Disguised As Legitimate Software Untitled

AdwCleaner will now start to search for malicious files that may be installed on your computer.
To remove the files that were detected in the previous step, please click on the Clean button.

Downloaded Crapware Disguised As Legitimate Software 3

Downloaded Crapware Disguised As Legitimate Software 3

AdwCleaner will now prompt you to save any open files or data as the program will need to reboot the computer. Please do so and then click on the OK button. AdwCleaner will now delete all detected adware from your computer. When it is done it will display an alert that explains what PUPs (Potentially Unwanted Programs) and Adware are. Please read through this information and then press the OK button. You will now be presented with an alert that states AdwCleaner needs to reboot your computer.
Please click on the OK button to allow AdwCleaner reboot your computer.A log will be produced. Please copy and paste this log in your next reply.
*********************************************
I would like to see the MBAM log no matter how long it is.
*************************************************
Malwarebytes' Anti-Rootkit

Please download Malwarebytes' Anti-Rootkit and save it to your desktop.

Be sure to print out and follow the instructions provided on that same page for performing a scan.
Caution: This is a beta version so also read the disclaimer and back up all your data before using.
When the scan completes, click on the Cleanup button to remove any threats found and reboot the computer if prompted to do so.
Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process.
If there are problems with Internet access, Windows Update, Windows Firewall or other system issues, run the fixdamage tool located in the folder Malwarebytes Anti-Rootkit was run from and reboot your computer.
Two files (mbar-log-YYYY-MM-DD, system-log.txt) will be created and saved within that same folder.
Copy and paste the contents of these two log files in your next reply.

Re: Downloaded Crapware Disguised As Legitimate Software29th April 2015, 4:32 am

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 4/28/2015
Scan Time: 1:58:45 PM
Logfile: Malwarebytes Log.txt
Administrator: Yes

Version: 2.01.6.1022
Malware Database: v2015.04.28.05
Rootkit Database: v2015.04.21.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows 8.1
CPU: x64
File System: NTFS
User: Jeffery

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 339259
Time Elapsed: 28 min, 7 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 4
PUP.Optional.CrossRider.A, C:\Program Files (x86)\CinemaPlus-3.2cV27.04\88e2d631-cef4-4b3b-959f-542c0d09b78a-6.exe, 8136, Delete-on-Reboot, [50a5046d7911053129456cd232d4c739]
PUP.Optional.CrossRider.A, C:\Program Files (x86)\CinemaPlus-3.2cV27.04\88e2d631-cef4-4b3b-959f-542c0d09b78a-10.exe, 1564, Delete-on-Reboot, [985d0c657614f244313da69857af966a]
PUP.Optional.CrossRider.A, C:\Program Files (x86)\CinemaPlus-3.2cV27.04\88e2d631-cef4-4b3b-959f-542c0d09b78a-1-6.exe, 3592, Delete-on-Reboot, [44b13938b5d5eb4bf27c013d1cea36ca]
PUP.Optional.PreBackup.A, C:\Program Files (x86)\OLBPre\OLBPre.exe, 5360, Delete-on-Reboot, [28cd87ea3159e650a19224509e62629e]

Modules: 0
(No malicious items detected)

Registry Keys: 141
PUP.Optional.ModGoog, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\globalUpdate, Quarantined, [00f57df43456ab8bd6ba98af2bd7cf31],
PUP.Optional.ModGoog, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\globalUpdatem, Quarantined, [00f57df43456ab8bd6ba98af2bd7cf31],
PUP.Optional.ModGoog, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\GOOGLEUPDATE.EXE, Quarantined, [00f57df43456ab8bd6ba98af2bd7cf31],
PUP.Optional.ModGoog, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\GOOGLEUPDATE.EXE, Quarantined, [00f57df43456ab8bd6ba98af2bd7cf31],
Rootkit.Agent.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\bsdriver, Quarantined, [995c135eb3d79c9affe24ef527db33cd],
Rootkit.Agent.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\cherimoya, Quarantined, [15e0d39e9cee3501531d6dd93dc9728e],
PUP.Optional.Shopperz.A, HKU\S-1-5-21-390256854-2030449046-3616693015-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{5081D2D4-1637-404C-B74F-50526718257D}, Quarantined, [54a1aac7a4e60f27f257d26f17ec0000],
PUP.Optional.Shopperz.A, HKLM\SOFTWARE\CLASSES\Extension.jshep, Quarantined, [54a1aac7a4e60f27f257d26f17ec0000],
PUP.Optional.Shopperz.A, HKLM\SOFTWARE\CLASSES\Extension.jshep.1, Quarantined, [54a1aac7a4e60f27f257d26f17ec0000],
PUP.Optional.Shopperz.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\Extension.jshep, Quarantined, [54a1aac7a4e60f27f257d26f17ec0000],
PUP.Optional.Shopperz.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\Extension.jshep.1, Quarantined, [54a1aac7a4e60f27f257d26f17ec0000],
PUP.Optional.Shopperz.A, HKLM\SOFTWARE\CLASSES\WOW6432NODE\Extension.jshep, Quarantined, [54a1aac7a4e60f27f257d26f17ec0000],
PUP.Optional.Shopperz.A, HKLM\SOFTWARE\CLASSES\WOW6432NODE\Extension.jshep.1, Quarantined, [54a1aac7a4e60f27f257d26f17ec0000],
PUP.Optional.Shopperz.A, HKU\S-1-5-21-390256854-2030449046-3616693015-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{5081D2D4-1637-404C-B74F-50526718257D}, Quarantined, [54a1aac7a4e60f27f257d26f17ec0000],
PUP.Optional.PreBackup.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\OLBPre, Quarantined, [e312adc4e6a4ef47079dcef930d34db3],
PUP.Optional.Hatchiho.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{77be1d95-799a-44c5-806b-764404317363}, Quarantined, [0fe66b06f694c472119afb4a4fb68977],
PUP.Optional.Hatchiho.A, HKLM\SOFTWARE\CLASSES\TYPELIB\{5b4f9625-4d85-4c60-8443-ff34c76d7527}, Quarantined, [0fe66b06f694c472119afb4a4fb68977],
PUP.Optional.Hatchiho.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{3E2E7CF5-4D58-4920-AB5C-1CA77559923A}, Quarantined, [0fe66b06f694c472119afb4a4fb68977],
PUP.Optional.Hatchiho.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{3E2E7CF5-4D58-4920-AB5C-1CA77559923A}, Quarantined, [0fe66b06f694c472119afb4a4fb68977],
PUP.Optional.Hatchiho.A, HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{3E2E7CF5-4D58-4920-AB5C-1CA77559923A}, Quarantined, [0fe66b06f694c472119afb4a4fb68977],
PUP.Optional.Hatchiho.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{5b4f9625-4d85-4c60-8443-ff34c76d7527}, Quarantined, [0fe66b06f694c472119afb4a4fb68977],
PUP.Optional.Hatchiho.A, HKLM\SOFTWARE\CLASSES\WOW6432NODE\TYPELIB\{5b4f9625-4d85-4c60-8443-ff34c76d7527}, Quarantined, [0fe66b06f694c472119afb4a4fb68977],
PUP.Optional.Hatchiho.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{77BE1D95-799A-44C5-806B-764404317363}, Quarantined, [0fe66b06f694c472119afb4a4fb68977],
PUP.Optional.Hatchiho.A, HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{77BE1D95-799A-44C5-806B-764404317363}, Quarantined, [0fe66b06f694c472119afb4a4fb68977],
PUP.Optional.Hatchiho.A, HKU\S-1-5-21-390256854-2030449046-3616693015-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{77BE1D95-799A-44C5-806B-764404317363}, Quarantined, [0fe66b06f694c472119afb4a4fb68977],
PUP.Optional.Hatchiho.A, HKU\S-1-5-21-390256854-2030449046-3616693015-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{77BE1D95-799A-44C5-806B-764404317363}, Quarantined, [0fe66b06f694c472119afb4a4fb68977],
PUP.Optional.Hatchiho.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\Hatchiho, Quarantined, [0fe66b06f694c472119afb4a4fb68977],
PUP.Optional.Flashbeat.A, HKLM\SOFTWARE\Flashbeat, Quarantined, [dd18a5cc593142f494049042f40ffc04],
PUP.Optional.CinemaPlus.C, HKLM\SOFTWARE\ARENAHD, Quarantined, [d42177fa6e1ca591af0bbca1d431b24e],
PUP.Optional.Crossbrowse.C, HKLM\SOFTWARE\CLASSES\CRSBRWSHTML, Quarantined, [ae471e53c9c11d19af55f7d2fb080ff1],
PUP.Optional.GlobalUpdate.A, HKLM\SOFTWARE\CLASSES\globalUpdate.OneClickCtrl.10, Quarantined, [1cd9c7aaf89247efa75f3427fb0a3ac6],
PUP.Optional.GlobalUpdate.A, HKLM\SOFTWARE\CLASSES\globalUpdate.OneClickProcessLauncherMachine, Quarantined, [db1ac7aa2b5f50e654b24c0f13f2fc04],
PUP.Optional.GlobalUpdate.A, HKLM\SOFTWARE\CLASSES\globalUpdate.OneClickProcessLauncherMachine.1.0, Quarantined, [30c59ad7c1c91c1a5babda81d72efe02],
PUP.Optional.GlobalUpdate.A, HKLM\SOFTWARE\CLASSES\globalUpdateUpdate.CoCreateAsync, Quarantined, [08ed1c554941a29462a55a01ce378878],
PUP.Optional.GlobalUpdate.A, HKLM\SOFTWARE\CLASSES\globalUpdateUpdate.CoCreateAsync.1.0, Quarantined, [698ccca5d6b480b656b179e224e158a8],
PUP.Optional.GlobalUpdate.A, HKLM\SOFTWARE\CLASSES\globalUpdateUpdate.CoreClass, Quarantined, [b045fe73a3e7ae88a463cb90ab5a4bb5],
PUP.Optional.GlobalUpdate.A, HKLM\SOFTWARE\CLASSES\globalUpdateUpdate.CoreClass.1, Quarantined, [1adb1061bbcf81b556b193c809fcf010],
PUP.Optional.GlobalUpdate.A, HKLM\SOFTWARE\CLASSES\globalUpdateUpdate.CoreMachineClass, Quarantined, [db1a413019717fb71ee9134828dd9d63],
PUP.Optional.GlobalUpdate.A, HKLM\SOFTWARE\CLASSES\globalUpdateUpdate.CoreMachineClass.1, Quarantined, [1cd9ff725535251129dea2b91de8c838],
PUP.Optional.GlobalUpdate.A, HKLM\SOFTWARE\CLASSES\globalUpdateUpdate.CredentialDialogMachine, Quarantined, [fafbff72fc8e4ceafb0cb1aab05543bd],
PUP.Optional.GlobalUpdate.A, HKLM\SOFTWARE\CLASSES\globalUpdateUpdate.CredentialDialogMachine.1.0, Quarantined, [589d8de4a4e6ad89a85fe57630d50ff1],
PUP.Optional.GlobalUpdate.A, HKLM\SOFTWARE\CLASSES\globalUpdateUpdate.OnDemandCOMClassMachine, Quarantined, [f8fd1b568a006ec87b8c4a11b74e5aa6],
PUP.Optional.GlobalUpdate.A, HKLM\SOFTWARE\CLASSES\globalUpdateUpdate.OnDemandCOMClassMachine.1.0, Quarantined, [668f125faddd171f9572f06b798c0df3],
PUP.Optional.GlobalUpdate.A, HKLM\SOFTWARE\CLASSES\globalUpdateUpdate.OnDemandCOMClassMachineFallback, Quarantined, [8570fb7699f172c49a6ddb80c44123dd],
PUP.Optional.GlobalUpdate.A, HKLM\SOFTWARE\CLASSES\globalUpdateUpdate.OnDemandCOMClassMachineFallback.1.0, Quarantined, [8d6898d98dfdb08633d40c4f38cd9868],
PUP.Optional.GlobalUpdate.A, HKLM\SOFTWARE\CLASSES\globalUpdateUpdate.OnDemandCOMClassSvc, Quarantined, [7481d49de1a9de58f80fa5b619ec54ac],
PUP.Optional.GlobalUpdate.A, HKLM\SOFTWARE\CLASSES\globalUpdateUpdate.OnDemandCOMClassSvc.1.0, Quarantined, [13e2531e0e7c05318e790d4e6e9757a9],
PUP.Optional.GlobalUpdate.A, HKLM\SOFTWARE\CLASSES\globalUpdateUpdate.ProcessLauncher, Quarantined, [2fc6bfb2533772c4bb4cc398d72edd23],
PUP.Optional.GlobalUpdate.A, HKLM\SOFTWARE\CLASSES\globalUpdateUpdate.ProcessLauncher.1.0, Quarantined, [df16fe736f1bdc5abe491f3c7590966a],
PUP.Optional.GlobalUpdate.A, HKLM\SOFTWARE\CLASSES\globalUpdateUpdate.Update3COMClassService, Quarantined, [c3323938d0bae452a0671e3ddb2a1fe1],
PUP.Optional.GlobalUpdate.A, HKLM\SOFTWARE\CLASSES\globalUpdateUpdate.Update3COMClassService.1.0, Quarantined, [fdf80869a4e6af8759ae4318be4746ba],
PUP.Optional.GlobalUpdate.A, HKLM\SOFTWARE\CLASSES\globalUpdateUpdate.Update3WebMachine, Quarantined, [8a6bf67b850554e211f684d7e025b947],
PUP.Optional.GlobalUpdate.A, HKLM\SOFTWARE\CLASSES\globalUpdateUpdate.Update3WebMachine.1.0, Quarantined, [ef068ee30e7c47ef47c0ed6e16ef02fe],
PUP.Optional.GlobalUpdate.A, HKLM\SOFTWARE\CLASSES\globalUpdateUpdate.Update3WebMachineFallback, Quarantined, [767f98d9c6c489ad6b9cb7a40005629e],
PUP.Optional.GlobalUpdate.A, HKLM\SOFTWARE\CLASSES\globalUpdateUpdate.Update3WebMachineFallback.1.0, Quarantined, [b63f74fd6c1e54e255b21249c54019e7],
PUP.Optional.GlobalUpdate.A, HKLM\SOFTWARE\CLASSES\globalUpdateUpdate.Update3WebSvc, Quarantined, [14e18fe2becc8da99f68481336cfa65a],
PUP.Optional.GlobalUpdate.A, HKLM\SOFTWARE\CLASSES\globalUpdateUpdate.Update3WebSvc.1.0, Quarantined, [d025cda41e6c78be4eb90d4eaf56ae52],
PUP.Optional.Crossbrowse.A, HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\Crossbrowse, Quarantined, [d025cea3fd8dc86e929e60699c6745bb],
PUP.Optional.PCTuner.C, HKLM\SOFTWARE\HIGHDEFACTION, Quarantined, [b3423b3624668fa77650b3aadc29ca36],
PUP.Optional.CrossRider.A, HKLM\SOFTWARE\INSTALLEDBROWSEREXTENSIONS\30935, Quarantined, [f401aec3e5a5c47251b954b657ad6898],
PUP.Optional.Crossbrowse.C, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\crossbrowse.exe, Quarantined, [b540026fe9a1340202034485eb18c43c],
PUP.Optional.CinemaPlus.A, HKLM\SOFTWARE\WOW6432NODE\CinemaPlus-3.2cV27.04, Quarantined, [21d4b1c0f892da5c3c1615c8cb3860a0],
PUP.Optional.CinemaPlus.A, HKLM\SOFTWARE\WOW6432NODE\CinemaPlus-3.2cV27.04-nv, Quarantined, [c82d5b1646445bdb81d1a33a1ae9639d],
PUP.Optional.CinemaPlus.A, HKLM\SOFTWARE\WOW6432NODE\CinemaPlus-3.2cV27.04-nv-ie, Quarantined, [7085ed845d2d70c6a8aad10c46bd1de3],
PUP.Optional.Crossbrowse.A, HKLM\SOFTWARE\WOW6432NODE\Crossbrowse, Quarantined, [767fff7274164cea5cd0e3e638cb40c0],
PUP.Optional.Flashbeat.A, HKLM\SOFTWARE\WOW6432NODE\Flashbeat, Quarantined, [e70efa776327ba7cc7d151819c67659b],
PUP.Optional.Hatchiho.A, HKLM\SOFTWARE\WOW6432NODE\Hatchiho, Quarantined, [8075f47de5a51e186b42c38214f1c040],
PUP.Optional.CrossRider.C, HKLM\SOFTWARE\WOW6432NODE\APPDATALOW\SOFTWARE\Crossrider, Quarantined, [599c462bcfbb1620c707eed8a45f3ec2],
PUP.Optional.CinemaPlus.C, HKLM\SOFTWARE\WOW6432NODE\ARENAHD, Quarantined, [d0254c2593f744f23c7e293423e2be42],
PUP.Optional.Crossbrowse.C, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CRSBRWSHTML, Quarantined, [ef06531e4b3f9d9961a318b10af98977],
PUP.Optional.GlobalUpdate.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\globalUpdate.OneClickCtrl.10, Quarantined, [51a49cd5206a41f5d92d8dcea263639d],
PUP.Optional.GlobalUpdate.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\globalUpdate.OneClickProcessLauncherMachine, Quarantined, [44b149282c5eb383e81e9bc03fc68e72],
PUP.Optional.GlobalUpdate.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\globalUpdate.OneClickProcessLauncherMachine.1.0, Quarantined, [54a16e03f199191d12f48ad1e1246d93],
PUP.Optional.GlobalUpdate.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\globalUpdateUpdate.CoCreateAsync, Quarantined, [ba3b51204941f2442ed9abb0b15437c9],
PUP.Optional.GlobalUpdate.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\globalUpdateUpdate.CoCreateAsync.1.0, Quarantined, [5b9a2b46503a0e28e522a7b4b94cff01],
PUP.Optional.GlobalUpdate.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\globalUpdateUpdate.CoreClass, Quarantined, [e70e80f1f3978caae81f1b40ff06cb35],
PUP.Optional.GlobalUpdate.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\globalUpdateUpdate.CoreClass.1, Quarantined, [7085145deb9ff0467f88a5b654b113ed],
PUP.Optional.GlobalUpdate.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\globalUpdateUpdate.CoreMachineClass, Quarantined, [ca2b09685535d75ffc0b8ecdec198c74],
PUP.Optional.GlobalUpdate.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\globalUpdateUpdate.CoreMachineClass.1, Quarantined, [f9fce091d8b240f69374b6a51ee7a759],
PUP.Optional.GlobalUpdate.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\globalUpdateUpdate.CredentialDialogMachine, Quarantined, [e114521fd5b561d55ea9b3a8c4416997],
PUP.Optional.GlobalUpdate.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\globalUpdateUpdate.CredentialDialogMachine.1.0, Quarantined, [42b38de46822142236d1bc9faf569070],
PUP.Optional.GlobalUpdate.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\globalUpdateUpdate.OnDemandCOMClassMachine, Quarantined, [05f0056c3e4cc86eb750baa142c330d0],
PUP.Optional.GlobalUpdate.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\globalUpdateUpdate.OnDemandCOMClassMachine.1.0, Quarantined, [0ce94a27484282b4ae59e27921e4b050],
PUP.Optional.GlobalUpdate.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\globalUpdateUpdate.OnDemandCOMClassMachineFallback, Quarantined, [d0258ee394f69a9cf017ee6d3cc9ba46],
PUP.Optional.GlobalUpdate.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\globalUpdateUpdate.OnDemandCOMClassMachineFallback.1.0, Quarantined, [0bea195899f13bfb34d367f430d52dd3],
PUP.Optional.GlobalUpdate.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\globalUpdateUpdate.OnDemandCOMClassSvc, Quarantined, [ab4a6f023d4d56e064a3bf9cc73e50b0],
PUP.Optional.GlobalUpdate.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\globalUpdateUpdate.OnDemandCOMClassSvc.1.0, Quarantined, [06ef2e439eec77bffb0c89d2d0351ae6],
PUP.Optional.GlobalUpdate.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\globalUpdateUpdate.ProcessLauncher, Quarantined, [975e82efbcce6ec8f2158dce09fc7d83],
PUP.Optional.GlobalUpdate.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\globalUpdateUpdate.ProcessLauncher.1.0, Quarantined, [30c55f12c1c91f179473b0ab1ee75aa6],
PUP.Optional.GlobalUpdate.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\globalUpdateUpdate.Update3COMClassService, Quarantined, [f005caa746447db96c9b2338bf46cc34],
PUP.Optional.GlobalUpdate.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\globalUpdateUpdate.Update3COMClassService.1.0, Quarantined, [678e264b494174c2a95e1d3e65a017e9],
PUP.Optional.GlobalUpdate.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\globalUpdateUpdate.Update3WebMachine, Quarantined, [de17e988f79383b3a1666fecba4b1ae6],
PUP.Optional.GlobalUpdate.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\globalUpdateUpdate.Update3WebMachine.1.0, Quarantined, [8e67c9a86228c37337d05cff06ffdc24],
PUP.Optional.GlobalUpdate.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\globalUpdateUpdate.Update3WebMachineFallback, Quarantined, [9d586011474364d20cfb89d2e223a15f],
PUP.Optional.GlobalUpdate.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\globalUpdateUpdate.Update3WebMachineFallback.1.0, Quarantined, [85703041f298082e897e72e954b13ec2],
PUP.Optional.GlobalUpdate.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\globalUpdateUpdate.Update3WebSvc, Quarantined, [02f397da7b0f4fe72ed99ac158ad46ba],
PUP.Optional.GlobalUpdate.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\globalUpdateUpdate.Update3WebSvc.1.0, Quarantined, [f005c1b07a1092a4a7600556c83d1de3],
PUP.Optional.Crossbrowse.A, HKLM\SOFTWARE\WOW6432NODE\CLIENTS\STARTMENUINTERNET\Crossbrowse, Quarantined, [787daac7533777bfcd6322a707fc25db],
PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\WOW6432NODE\GLOBALUPDATE\UPDATE, Quarantined, [0aeb5d14157581b576f89d554eb5ee12],
PUP.Optional.PCTuner.C, HKLM\SOFTWARE\WOW6432NODE\HIGHDEFACTION, Quarantined, [e0158fe21773f145ac1a85d8a65f7888],
PUP.Optional.CrossRider.A, HKLM\SOFTWARE\WOW6432NODE\INSTALLEDBROWSEREXTENSIONS\30935, Quarantined, [ef06c1b01c6e1422fe0c0ffbe91b1ee2],
PUP.Optional.Crossbrowse.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\MEDIAPLAYER\SHIMINCLUSIONLIST\crossbrowse.exe, Quarantined, [50a5b6bb2a6066d0be703099ea19f808],
PUP.Optional.Crossbrowse.C, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\crossbrowse.exe, Quarantined, [80750f62d0ba1f172dd8517836cd2bd5],
PUP.Optional.Crossbrowse.C, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\Crossbrowse, Quarantined, [f8fdb1c0404a3ff745c58742ab587c84],
PUP.Optional.GlobalUpdate.A, HKLM\SOFTWARE\WOW6432NODE\MOZILLAPLUGINS\@staging.google.com/globalUpdate Update;version=10, Quarantined, [d91c650c6d1ddf570747212c877e03fd],
PUP.Optional.GlobalUpdate.A, HKLM\SOFTWARE\WOW6432NODE\MOZILLAPLUGINS\@staging.google.com/globalUpdate Update;version=4, Quarantined, [74812b460b7f989e6de270dd8184fd03],
PUP.Optional.Shopperz.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\shopperz Updater, Quarantined, [43b2b8b963279c9ae27edbfbe71c07f9],
Rootkit.Agent.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\CSRCC, Quarantined, [688df081781247ef12c213c4c142ba46],
PUP.Optional.CinemaPlus.A, HKU\S-1-5-18\SOFTWARE\CinemaPlus-3.2cV27.04-nv, Quarantined, [6590cfa24c3e22149eb50ecf62a17888],
PUP.Optional.CinemaPlus.A, HKU\S-1-5-18\SOFTWARE\CinemaPlus-3.2cV27.04-nv-ie, Quarantined, [b73ee78aeb9f1e18391a7c61bc470df3],
PUP.Optional.Shopperz.A, HKU\S-1-5-18\SOFTWARE\{4E7638A1-6962-4e44-A6B9-F40E84FD6D09}, Quarantined, [36bffa778901ac8acd3127a5de25728e],
PUP.Optional.Crossrider.C, HKU\S-1-5-18\SOFTWARE\APPDATALOW\SOFTWARE\_CrossriderRegNamePlaceHolder_, Quarantined, [a253165b2169ed494b73fb62de2717e9],
PUP.Optional.Shopperz.A, HKU\S-1-5-19\SOFTWARE\{4E7638A1-6962-4e44-A6B9-F40E84FD6D09}, Quarantined, [1ed7eb869befa29445b901cbc14255ab],
PUP.Optional.Shopperz.A, HKU\S-1-5-20\SOFTWARE\{4E7638A1-6962-4e44-A6B9-F40E84FD6D09}, Quarantined, [46af3d3495f50e28966896366c97718f],
PUP.Optional.CinemaPlus.A, HKU\S-1-5-21-390256854-2030449046-3616693015-1001\SOFTWARE\CinemaPlus-3.2cV27.04, Quarantined, [2ec71061602af244bb989d4031d236ca],
PUP.Optional.CinemaPlus.A, HKU\S-1-5-21-390256854-2030449046-3616693015-1001\SOFTWARE\CinemaPlus-3.2cV27.04-nv, Quarantined, [10e5fa7793f7241256fd34a9867d817f],
PUP.Optional.CinemaPlus.A, HKU\S-1-5-21-390256854-2030449046-3616693015-1001\SOFTWARE\CinemaPlus-3.2cV27.04-nv-ie, Quarantined, [569f175a2a60c670094ab02dfb08a55b],
PUP.Optional.Crossbrowse.A, HKU\S-1-5-21-390256854-2030449046-3616693015-1001\SOFTWARE\CrossBrowser, Quarantined, [fff6521faedc42f4fc2f27a2ea19a060],
PUP.Optional.Hatchiho.A, HKU\S-1-5-21-390256854-2030449046-3616693015-1001\SOFTWARE\Hatchiho, Quarantined, [bb3a4c25aae059dd416b4ff68085b64a],
PUP.Optional.Shopperz.A, HKU\S-1-5-21-390256854-2030449046-3616693015-1001\SOFTWARE\{4E7638A1-6962-4e44-A6B9-F40E84FD6D09}, Quarantined, [1ed74e23c7c39c9a728c29a322e13cc4],
PUP.Optional.CinemaPlus.C, HKU\S-1-5-21-390256854-2030449046-3616693015-1001\SOFTWARE\ARENAHD, Quarantined, [a352e48d4d3d5bdb05b4c19c699c619f],
PUP.Optional.GlobalUpdate.C, HKU\S-1-5-21-390256854-2030449046-3616693015-1001\SOFTWARE\GLOBALUPDATE\UPDATE\PROXY, Quarantined, [8471d39e9dedfc3a3db9cdfb9c678c74],
PUP.Optional.CrossRider.A, HKU\S-1-5-21-390256854-2030449046-3616693015-1001\SOFTWARE\INSTALLEDBROWSEREXTENSIONS\30935, Quarantined, [1ed77ff2236793a34b5fdb0c20e3b050],
PUP.Optional.CrossRider.A, HKU\S-1-5-21-390256854-2030449046-3616693015-1001\SOFTWARE\INSTALLEDBROWSEREXTENSIONS\Cinema PlusV27.04, Quarantined, [3cb982ef8ffb6bcbe3f0c51744bf9d63],
PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{5645E0E7-FC12-43BF-A6E4-F9751942B298}, Quarantined, [995c69087911ff373c76b2f7ce35768a],
PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\CLASSES\WOW6432NODE\globalUpdate.OneClickCtrl.10, Quarantined, [995c69087911ff373c76b2f7ce35768a],
PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{5645E0E7-FC12-43BF-A6E4-F9751942B298}, Quarantined, [995c69087911ff373c76b2f7ce35768a],
PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{5645E0E7-FC12-43BF-A6E4-F9751942B298}, Quarantined, [995c69087911ff373c76b2f7ce35768a],
PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\PREAPPROVED\{5645E0E7-FC12-43BF-A6E4-F9751942B298}, Quarantined, [995c69087911ff373c76b2f7ce35768a],
PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{C7BF8F4B-7BC7-4F42-B944-3D28A3A86D8A}, Quarantined, [995c69087911ff373c76b2f7ce35768a],
PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\CLASSES\globalUpdate.Update3WebControl.4, Quarantined, [995c69087911ff373c76b2f7ce35768a],
PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\WOW6432NODE\CLASSES\globalUpdate.Update3WebControl.4, Quarantined, [995c69087911ff373c76b2f7ce35768a],
PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\CLASSES\WOW6432NODE\globalUpdate.Update3WebControl.4, Quarantined, [995c69087911ff373c76b2f7ce35768a],
PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{C7BF8F4B-7BC7-4F42-B944-3D28A3A86D8A}, Quarantined, [995c69087911ff373c76b2f7ce35768a],
PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{C7BF8F4B-7BC7-4F42-B944-3D28A3A86D8A}, Quarantined, [995c69087911ff373c76b2f7ce35768a],
PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\PREAPPROVED\{C7BF8F4B-7BC7-4F42-B944-3D28A3A86D8A}, Quarantined, [995c69087911ff373c76b2f7ce35768a],
PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{CFC47BB5-5FB5-4AD0-8427-6AA04334A3FC}, Quarantined, [995c69087911ff373c76b2f7ce35768a],
PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{CFC47BB5-5FB5-4AD0-8427-6AA04334A3FC}, Quarantined, [995c69087911ff373c76b2f7ce35768a],
PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{E0ADB535-D7B5-4D8B-B15D-578BDD20D76A}, Quarantined, [995c69087911ff373c76b2f7ce35768a],
PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{E0ADB535-D7B5-4D8B-B15D-578BDD20D76A}, Quarantined, [995c69087911ff373c76b2f7ce35768a],
PUP.Optional.CrossRider.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CinemaPlus-3.2cV27.04, Quarantined, [b540c0b16e1c77bf1a088c2b04ff3bc5],

Registry Values: 15
PUP.Optional.Shopperz.A, HKLM\SOFTWARE\MOZILLA\FIREFOX\EXTENSIONS|{5081D2D4-1637-404C-B74F-50526718257D}, C:\Program Files\shopperz\Firefox, Quarantined, [54a1aac7a4e60f27f257d26f17ec0000]
PUP.Optional.Shopperz.A, HKLM\SOFTWARE\WOW6432NODE\MOZILLA\FIREFOX\EXTENSIONS|{5081D2D4-1637-404C-B74F-50526718257D}, C:\Program Files\shopperz\Firefox, Quarantined, [54a1aac7a4e60f27f257d26f17ec0000]
PUP.Optional.Shopperz.A, HKLM\SOFTWARE\MOZILLA\FIREFOX\EXTENSIONS\{5081D2D4-1637-404c-B74F-50526718257D}, Quarantined, [0ce9e68b8bff58dea4a5f54ca1625ea2],
PUP.Optional.Shopperz.A, HKLM\SOFTWARE\WOW6432NODE\MOZILLA\FIREFOX\EXTENSIONS\{5081D2D4-1637-404c-B74F-50526718257D}, Quarantined, [41b46f021575d1652029b091ff04837d],
PUP.Optional.CinemaPlus.C, HKLM\SOFTWARE\ARENAHD|value, 1, Quarantined, [d42177fa6e1ca591af0bbca1d431b24e]
PUP.Optional.PCTuner.C, HKLM\SOFTWARE\HIGHDEFACTION|value, 1, Quarantined, [b3423b3624668fa77650b3aadc29ca36]
PUP.Optional.CinemaPlus.C, HKLM\SOFTWARE\WOW6432NODE\ARENAHD|value, 1, Quarantined, [d0254c2593f744f23c7e293423e2be42]
PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\WOW6432NODE\GLOBALUPDATE\UPDATE|path, C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe, Quarantined, [0aeb5d14157581b576f89d554eb5ee12]
PUP.Optional.GlobalUpdate.C, HKLM\SOFTWARE\WOW6432NODE\GLOBALUPDATE\UPDATEDEV|AuCheckPeriodMs, 21600000, Quarantined, [b73e620f79110d29ce9322a602016b95]
PUP.Optional.PCTuner.C, HKLM\SOFTWARE\WOW6432NODE\HIGHDEFACTION|value, 1, Quarantined, [e0158fe21773f145ac1a85d8a65f7888]
PUP.Optional.CrossBrowse.C, HKLM\SOFTWARE\WOW6432NODE\REGISTEREDAPPLICATIONS|Crossbrowse, Software\Clients\StartMenuInternet\Crossbrowse\Capabilities, Quarantined, [90653d34bbcfa69012abc19cca3b45bb]
Rootkit.Agent.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\CSRCC|ImagePath, "C:\Program Files\shopperz\csrcc.exe", Quarantined, [688df081781247ef12c213c4c142ba46]
PUP.Optional.CinemaPlus.C, HKU\S-1-5-21-390256854-2030449046-3616693015-1001\SOFTWARE\ARENAHD|value, 1, Quarantined, [a352e48d4d3d5bdb05b4c19c699c619f]
PUP.Optional.GlobalUpdate.C, HKU\S-1-5-21-390256854-2030449046-3616693015-1001\SOFTWARE\GLOBALUPDATE\UPDATE\PROXY|source, IE, Quarantined, [8471d39e9dedfc3a3db9cdfb9c678c74]
PUP.Optional.PCTuner.C, HKU\S-1-5-21-390256854-2030449046-3616693015-1001\SOFTWARE\HIGHDEFACTION|value, 1, Quarantined, [6b8a18595634c86e655f78e5778e4fb1]

Registry Data: 0
(No malicious items detected)

Folders: 27
PUP.Optional.PreBackup.A, C:\Program Files (x86)\OLBPre, Delete-on-Reboot, [e312adc4e6a4ef47079dcef930d34db3],
PUP.Optional.Hatchiho.A, C:\Program Files (x86)\Hatchiho, Quarantined, [0fe66b06f694c472119afb4a4fb68977],
PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update, Quarantined, [995c69087911ff373c76b2f7ce35768a],
PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\1.3.25.0, Quarantined, [995c69087911ff373c76b2f7ce35768a],
PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\Download, Quarantined, [995c69087911ff373c76b2f7ce35768a],
PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\Install, Quarantined, [995c69087911ff373c76b2f7ce35768a],
PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\Offline, Quarantined, [995c69087911ff373c76b2f7ce35768a],
PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\Offline\{1DCD7E35-E81F-4A70-8DF3-FEDD8BFDC7AF}, Quarantined, [995c69087911ff373c76b2f7ce35768a],
PUP.Optional.GlobalUpdate.A, C:\Users\Jeffery\AppData\Local\Temp\comh.40248, Quarantined, [32c34d241971b97d79526e3bf2114ab6],
PUP.Optional.CrossRider.A, C:\Program Files (x86)\CinemaPlus-3.2cV27.04, Delete-on-Reboot, [b540c0b16e1c77bf1a088c2b04ff3bc5],
PUP.Optional.FlashBeat.A, C:\ProgramData\FlashBeat, Quarantined, [5f9681f052380d296713b908020119e7],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.5.2171.95, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.5.2171.95\Extensions, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.5.2171.95\Installer, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.5.2171.95\Locales, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.5.2171.95\PepperFlash, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.5.2171.95\VisualElements, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\Icons, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Users\Jeffery\AppData\Local\Crossbrowse, Quarantined, [5c995f1293f72610e37cdbe98e755aa6],
PUP.Optional.Crossbrowse.C, C:\Users\Jeffery\AppData\Local\Crossbrowse\Crossbrowse, Quarantined, [5c995f1293f72610e37cdbe98e755aa6],
PUP.Optional.Crossbrowse.C, C:\Users\Jeffery\AppData\Local\Crossbrowse\Crossbrowse\User Data, Quarantined, [5c995f1293f72610e37cdbe98e755aa6],
PUP.Optional.Crossbrowse.C, C:\Users\Jeffery\AppData\Local\Crossbrowse\Crossbrowse\User Data\Caps, Quarantined, [5c995f1293f72610e37cdbe98e755aa6],
PUP.Optional.Crossbrowse.C, C:\Users\Jeffery\AppData\Local\Crossbrowse\Crossbrowse\User Data\Default, Quarantined, [5c995f1293f72610e37cdbe98e755aa6],
PUP.Optional.Crossbrowse.C, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Crossbrowse, Quarantined, [94611160afdbcf678ed2bf05f013e61a],

Re: Downloaded Crapware Disguised As Legitimate Software29th April 2015, 4:33 am

Files: 240
PUP.Optional.CrossRider.A, C:\Program Files (x86)\CinemaPlus-3.2cV27.04\88e2d631-cef4-4b3b-959f-542c0d09b78a-6.exe, Delete-on-Reboot, [50a5046d7911053129456cd232d4c739],
PUP.Optional.CrossRider.A, C:\Program Files (x86)\CinemaPlus-3.2cV27.04\88e2d631-cef4-4b3b-959f-542c0d09b78a-10.exe, Delete-on-Reboot, [985d0c657614f244313da69857af966a],
PUP.Optional.CrossRider.A, C:\Program Files (x86)\CinemaPlus-3.2cV27.04\88e2d631-cef4-4b3b-959f-542c0d09b78a-1-6.exe, Delete-on-Reboot, [44b13938b5d5eb4bf27c013d1cea36ca],
PUP.Optional.PreBackup.A, C:\Program Files (x86)\OLBPre\OLBPre.exe, Delete-on-Reboot, [28cd87ea3159e650a19224509e62629e],
PUP.Optional.ModGoog, C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe, Quarantined, [00f57df43456ab8bd6ba98af2bd7cf31],
Rootkit.Agent.A, C:\Windows\System32\drivers\bsdriver.sys, Quarantined, [995c135eb3d79c9affe24ef527db33cd],
Rootkit.Agent.A, C:\Windows\System32\drivers\cherimoya.sys, Quarantined, [15e0d39e9cee3501531d6dd93dc9728e],
PUP.Optional.JellySplit.Gen, C:\ProgramData\2434a646fe504ea78bc4f632a39b6b2f\2434a646fe504ea78bc4f632a39b6b2f.exe, Quarantined, [6f8694dd33576bcbeb4ff14b53af5aa6],
PUP.Optional.CrossRider.A, C:\Users\Jeffery\AppData\Roaming\x8m2vuTmAbHWXurp9vyD.exe, Quarantined, [b540f27f6e1cb87e6c1a97b4fb0736ca],
PUP.Optional.Nova.A, C:\Program Files (x86)\3c3f465c-505c-4354-a4e1-6738f6ea12e4\2e110917-e159-4734-b415-d566cfbf61e1.dll, Quarantined, [2ec7512088022016aa489679e12153ad],
PUP.Optional.Nova.A, C:\Program Files (x86)\Audacity\d283ce60-d400-4ad4-8d1f-ed86d93b1b36.dll, Quarantined, [4baa6e030783ce68d919da3553af53ad],
PUP.Optional.Nova.A, C:\Program Files (x86)\CinemaPlus-3.2cV27.04\33f833b2-91e1-40aa-bf12-1c62f9add2ae.dll, Quarantined, [3cb9e091ee9c9e98737f60af699941bf],
PUP.Optional.CrossRider.A, C:\Program Files (x86)\CinemaPlus-3.2cV27.04\88e2d631-cef4-4b3b-959f-542c0d09b78a-1-7.exe, Quarantined, [23d29ad78efcd56194dab18da75fec14],
PUP.Optional.CrossRider.A, C:\Program Files (x86)\CinemaPlus-3.2cV27.04\88e2d631-cef4-4b3b-959f-542c0d09b78a-3.exe, Quarantined, [f401c3ae6921d264cca22f0fdb2b926e],
PUP.Optional.CrossRider.A, C:\Program Files (x86)\CinemaPlus-3.2cV27.04\88e2d631-cef4-4b3b-959f-542c0d09b78a-5.exe, Quarantined, [38bdc4ad90fa290d36382c12af5728d8],
PUP.Optional.CrossRider.A, C:\Program Files (x86)\CinemaPlus-3.2cV27.04\88e2d631-cef4-4b3b-959f-542c0d09b78a-64.exe, Quarantined, [06ef5f12e4a634022a44d6688482af51],
PUP.Optional.CrossRider.A, C:\Program Files (x86)\CinemaPlus-3.2cV27.04\88e2d631-cef4-4b3b-959f-542c0d09b78a-7.exe, Quarantined, [8b6a82ef0b7fad89f777f747f214a15f],
PUP.Optional.CrossRider.A, C:\Program Files (x86)\CinemaPlus-3.2cV27.04\UninstallBrw.exe, Quarantined, [6b8aee8381092d09244a69d55bab768a],
PUP.Optional.CrossRider.A, C:\Program Files (x86)\CinemaPlus-3.2cV27.04\utils.exe, Quarantined, [3abbdf924e3c4beb0569a49a30d6b64a],
PUP.Optional.PreBackup.A, C:\Users\Jeffery\AppData\Local\Temp\OnlineBackup.exe, Quarantined, [b045aac7b9d1999d999af28217e99c64],
PUP.Optional.PreBackup.A, C:\Program Files (x86)\OLBPre\OLBPre.exe.config, Quarantined, [e312adc4e6a4ef47079dcef930d34db3],
PUP.Optional.PreBackup.A, C:\Program Files (x86)\OLBPre\aff.jdat, Quarantined, [e312adc4e6a4ef47079dcef930d34db3],
PUP.Optional.PreBackup.A, C:\Program Files (x86)\OLBPre\brand.jdat, Quarantined, [e312adc4e6a4ef47079dcef930d34db3],
PUP.Optional.PreBackup.A, C:\Program Files (x86)\OLBPre\de_DE.mo, Quarantined, [e312adc4e6a4ef47079dcef930d34db3],
PUP.Optional.PreBackup.A, C:\Program Files (x86)\OLBPre\es_ES.mo, Quarantined, [e312adc4e6a4ef47079dcef930d34db3],
PUP.Optional.PreBackup.A, C:\Program Files (x86)\OLBPre\fr_FR.mo, Quarantined, [e312adc4e6a4ef47079dcef930d34db3],
PUP.Optional.PreBackup.A, C:\Program Files (x86)\OLBPre\it_IT.mo, Quarantined, [e312adc4e6a4ef47079dcef930d34db3],
PUP.Optional.PreBackup.A, C:\Program Files (x86)\OLBPre\LinqBridge.dll, Delete-on-Reboot, [e312adc4e6a4ef47079dcef930d34db3],
PUP.Optional.PreBackup.A, C:\Program Files (x86)\OLBPre\pt_PT.mo, Quarantined, [e312adc4e6a4ef47079dcef930d34db3],
PUP.Optional.PreBackup.A, C:\Program Files (x86)\OLBPre\state.jdat, Quarantined, [e312adc4e6a4ef47079dcef930d34db3],
PUP.Optional.PreBackup.A, C:\Program Files (x86)\OLBPre\uninst.exe, Quarantined, [e312adc4e6a4ef47079dcef930d34db3],
PUP.Optional.Crossbrowse.C, C:\Users\Jeffery\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\crossbrowse.lnk, Quarantined, [2bcae38eb5d543f3f20d3b8d3bc8fb05],
PUP.Optional.Crossbrowse.C, C:\Windows\System32\Tasks\Crossbrowse, Quarantined, [866f9dd4c6c45dd95ca4b3163ac99d63],
PUP.Optional.Crossbrowse.C, C:\Windows\Tasks\Crossbrowse.job, Quarantined, [28cdfd74632747ef699859701ae91ee2],
PUP.Optional.Crossbrowse.A, C:\Users\Jeffery\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Crossbrowse.lnk, Quarantined, [7d786f02e9a1989e75bd8f3a8e75ad53],
PUP.Optional.SelectNGo.A, C:\Users\Jeffery\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_static.selectgo00.selectgo.net_0.localstorage, Quarantined, [16dfa5cce9a171c51842f2e2cc375ba5],
PUP.Optional.SelectNGo.A, C:\Users\Jeffery\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_static.selectgo00.selectgo.net_0.localstorage-journal, Quarantined, [5f96323f701a6bcbb1a96e66b2510ef2],
PUP.Optional.BoostSaves.A, C:\Users\Jeffery\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_static.boostsaves.com_0.localstorage, Quarantined, [ed08d8999af0072f5ee6627863a0926e],
PUP.Optional.BoostSaves.A, C:\Users\Jeffery\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_static.boostsaves.com_0.localstorage-journal, Quarantined, [6f865e132c5ef83e3014548624df926e],
PUP.Optional.MyPCBackup.A, C:\Users\Jeffery\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyPC Backup.lnk, Quarantined, [cd28066be4a6280e41c202dea3603cc4],
PUP.Optional.CrossRider.T, C:\Windows\System32\Tasks\88e2d631-cef4-4b3b-959f-542c0d09b78a-1-6, Quarantined, [49acbab766244aec274291614eb5629e],
PUP.Optional.CrossRider.T, C:\Windows\System32\Tasks\88e2d631-cef4-4b3b-959f-542c0d09b78a-1-7, Quarantined, [d1244130b9d161d5551421d1a95a23dd],
PUP.Optional.CrossRider.T, C:\Windows\System32\Tasks\88e2d631-cef4-4b3b-959f-542c0d09b78a-10_user, Quarantined, [d91c472ae5a59c9a323725cd778c35cb],
PUP.Optional.CrossRider.T, C:\Windows\System32\Tasks\88e2d631-cef4-4b3b-959f-542c0d09b78a-3, Quarantined, [35c0521f523867cfa5c49f537291ed13],
PUP.Optional.CrossRider.T, C:\Windows\System32\Tasks\88e2d631-cef4-4b3b-959f-542c0d09b78a-5, Quarantined, [ae4775fca7e30135afba16dc3cc73ac6],
PUP.Optional.CrossRider.T, C:\Windows\System32\Tasks\88e2d631-cef4-4b3b-959f-542c0d09b78a-5_user, Quarantined, [7f763839fa902c0a680171811ee5e020],
PUP.Optional.CrossRider.T, C:\Windows\System32\Tasks\88e2d631-cef4-4b3b-959f-542c0d09b78a-6, Quarantined, [5a9b81f0018957df3e2b6b87ed161fe1],
PUP.Optional.CrossRider.T, C:\Windows\System32\Tasks\88e2d631-cef4-4b3b-959f-542c0d09b78a-7, Quarantined, [22d359184f3bbd7991d81bd77c8722de],
PUP.Optional.SelectNGo.A, C:\Users\Jeffery\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_static.select-n-go00.select-n-go.com_0.localstorage, Quarantined, [1cd993ded1b9e452d4770eef1ae99967],
PUP.Optional.SelectNGo.A, C:\Users\Jeffery\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_static.select-n-go00.select-n-go.com_0.localstorage-journal, Quarantined, [7a7bfc7591f91422a6a57a83d033a25e],
PUP.Optional.ShoppingGate.A, C:\Users\Jeffery\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_inst.shoppingate.info_0.localstorage, Quarantined, [a64f3d347e0c5dd9b6ffb9460cf7e020],
PUP.Optional.ShoppingGate.A, C:\Users\Jeffery\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_inst.shoppingate.info_0.localstorage-journal, Quarantined, [dd185b16c7c3e4521b9a5da2f310c33d],
PUP.Optional.Hatchiho.A, C:\Program Files (x86)\Hatchiho\Hatchiho.ico, Quarantined, [0fe66b06f694c472119afb4a4fb68977],
PUP.Optional.Hatchiho.A, C:\Program Files (x86)\Hatchiho\HatchihoBHO.dll, Quarantined, [0fe66b06f694c472119afb4a4fb68977],
PUP.Optional.Hatchiho.A, C:\Program Files (x86)\Hatchiho\HatchihoUninstall.exe, Quarantined, [0fe66b06f694c472119afb4a4fb68977],
PUP.Optional.CrossRider.T, C:\Windows\Tasks\88e2d631-cef4-4b3b-959f-542c0d09b78a-1-6.job, Quarantined, [e411650c93f7e74fa5a264e774911fe1],
PUP.Optional.CrossRider.T, C:\Windows\Tasks\88e2d631-cef4-4b3b-959f-542c0d09b78a-1-7.job, Quarantined, [6a8ba9c8b5d5e452b295e863ba4b3cc4],
PUP.Optional.CrossRider.T, C:\Windows\Tasks\88e2d631-cef4-4b3b-959f-542c0d09b78a-10_user.job, Quarantined, [dc19a0d15e2c3ef875d212398a7bfb05],
PUP.Optional.CrossRider.T, C:\Windows\Tasks\88e2d631-cef4-4b3b-959f-542c0d09b78a-3.job, Quarantined, [a253066bf29872c4f94e5dee2bdaa858],
PUP.Optional.CrossRider.T, C:\Windows\Tasks\88e2d631-cef4-4b3b-959f-542c0d09b78a-5.job, Quarantined, [cf2684ed6822999dec5b79d208fd669a],
PUP.Optional.CrossRider.T, C:\Windows\Tasks\88e2d631-cef4-4b3b-959f-542c0d09b78a-5_user.job, Quarantined, [18dd96dbb6d450e62522f655f5107f81],
PUP.Optional.CrossRider.T, C:\Windows\Tasks\88e2d631-cef4-4b3b-959f-542c0d09b78a-6.job, Quarantined, [a15474fd4c3e39fd17308ac1040146ba],
PUP.Optional.CrossRider.T, C:\Windows\Tasks\88e2d631-cef4-4b3b-959f-542c0d09b78a-7.job, Quarantined, [5c997af794f6f343d96e9ab17095966a],
PUP.Optional.GlobalUpdate.A, C:\Windows\Tasks\globalUpdateUpdateTaskMachineCore.job, Quarantined, [609573feaedc9a9cf26469e20df832ce],
PUP.Optional.GlobalUpdate.A, C:\Windows\System32\Tasks\globalUpdateUpdateTaskMachineCore, Quarantined, [b73eec85fb8fd85eb4a32d1e699c837d],
PUP.Optional.GlobalUpdate.A, C:\Windows\Tasks\globalUpdateUpdateTaskMachineUA.job, Quarantined, [777ea9c88efcbc7a3721bb90f4118977],
PUP.Optional.GlobalUpdate.A, C:\Windows\System32\Tasks\globalUpdateUpdateTaskMachineUA, Quarantined, [a64fadc48dfdb87e95c45deed82d41bf],
PUP.Optional.ReMarkable.A, C:\Users\Jeffery\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_static.re-markable00.re-markable.net_0.localstorage, Quarantined, [51a4a7ca04867abc57387bde3ec745bb],
PUP.Optional.ReMarkable.A, C:\Users\Jeffery\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_static.re-markable00.re-markable.net_0.localstorage-journal, Quarantined, [d421cfa23b4f8aaca1eec099ac5926da],
PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\GoogleCrashHandler.exe, Quarantined, [995c69087911ff373c76b2f7ce35768a],
PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\GoogleUpdate.exe, Quarantined, [995c69087911ff373c76b2f7ce35768a],
PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\GoogleUpdateBroker.exe, Quarantined, [995c69087911ff373c76b2f7ce35768a],
PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\GoogleUpdateHelper.msi, Quarantined, [995c69087911ff373c76b2f7ce35768a],
PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\GoogleUpdateOnDemand.exe, Quarantined, [995c69087911ff373c76b2f7ce35768a],
PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\goopdate.dll, Quarantined, [995c69087911ff373c76b2f7ce35768a],
PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\goopdateres_en.dll, Quarantined, [995c69087911ff373c76b2f7ce35768a],
PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\npGoogleUpdate4.dll, Quarantined, [995c69087911ff373c76b2f7ce35768a],
PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\psmachine.dll, Quarantined, [995c69087911ff373c76b2f7ce35768a],
PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\psuser.dll, Quarantined, [995c69087911ff373c76b2f7ce35768a],
PUP.Optional.CrossRider.A, C:\Program Files (x86)\CinemaPlus-3.2cV27.04\33f833b2-91e1-40aa-bf12-1c62f9add2ae.crx, Quarantined, [b540c0b16e1c77bf1a088c2b04ff3bc5],
PUP.Optional.CrossRider.A, C:\Program Files (x86)\CinemaPlus-3.2cV27.04\56bdf99a-e600-4178-a0f8-0710b4d31942.dll, Quarantined, [b540c0b16e1c77bf1a088c2b04ff3bc5],
PUP.Optional.CrossRider.A, C:\Program Files (x86)\CinemaPlus-3.2cV27.04\bgNova.html, Quarantined, [b540c0b16e1c77bf1a088c2b04ff3bc5],
PUP.Optional.CrossRider.A, C:\Program Files (x86)\CinemaPlus-3.2cV27.04\Uninstall.exe, Quarantined, [b540c0b16e1c77bf1a088c2b04ff3bc5],
PUP.Optional.FlashBeat.A, C:\ProgramData\FlashBeat\1, Quarantined, [5f9681f052380d296713b908020119e7],
PUP.Optional.FlashBeat.A, C:\ProgramData\FlashBeat\FlashBeat32.dll, Quarantined, [5f9681f052380d296713b908020119e7],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\chrome.dat, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\crossbrowse.exe, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\master_preferences, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\utility.exe, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\VisualElementsManifest.xml, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.5.2171.95\icudtl.dat, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.5.2171.95\39.4.2171.95.manifest, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.5.2171.95\39.5.2171.95.manifest, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.5.2171.95\chrome.dll, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.5.2171.95\chrome_100_percent.pak, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.5.2171.95\chrome_200_percent.pak, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.5.2171.95\chrome_child.dll, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.5.2171.95\chrome_elf.dll, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.5.2171.95\d3dcompiler_46.dll, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.5.2171.95\delegate_execute.exe, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.5.2171.95\ffmpegsumo.dll, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.5.2171.95\libegl.dll, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.5.2171.95\libexif.dll, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.5.2171.95\libglesv2.dll, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.5.2171.95\metro_driver.dll, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.5.2171.95\nacl64.exe, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.5.2171.95\nacl_irt_x86_32.nexe, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.5.2171.95\nacl_irt_x86_64.nexe, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.5.2171.95\pdf.dll, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.5.2171.95\resources.pak, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.5.2171.95\secondarytile.png, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.5.2171.95\Extensions\external_extensions.json, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.5.2171.95\Installer\chrmstp.exe, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.5.2171.95\Installer\chrome.7z, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.5.2171.95\Installer\setup.exe, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.5.2171.95\Locales\hi.pak, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.5.2171.95\Locales\am.pak, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.5.2171.95\Locales\ar.pak, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.5.2171.95\Locales\bg.pak, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.5.2171.95\Locales\bn.pak, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.5.2171.95\Locales\ca.pak, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.5.2171.95\Locales\cs.pak, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.5.2171.95\Locales\da.pak, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.5.2171.95\Locales\de.pak, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.5.2171.95\Locales\el.pak, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.5.2171.95\Locales\en-GB.pak, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.5.2171.95\Locales\en-US.pak, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.5.2171.95\Locales\es-419.pak, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.5.2171.95\Locales\es.pak, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.5.2171.95\Locales\et.pak, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.5.2171.95\Locales\fa.pak, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.5.2171.95\Locales\fi.pak, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.5.2171.95\Locales\fil.pak, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.5.2171.95\Locales\fr.pak, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.5.2171.95\Locales\gu.pak, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.5.2171.95\Locales\he.pak, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.5.2171.95\Locales\hr.pak, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.5.2171.95\Locales\hu.pak, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.5.2171.95\Locales\id.pak, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.5.2171.95\Locales\it.pak, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.5.2171.95\Locales\ja.pak, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.5.2171.95\Locales\kn.pak, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.5.2171.95\Locales\ko.pak, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.5.2171.95\Locales\lt.pak, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.5.2171.95\Locales\lv.pak, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.5.2171.95\Locales\ml.pak, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.5.2171.95\Locales\mr.pak, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.5.2171.95\Locales\ms.pak, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.5.2171.95\Locales\nb.pak, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.5.2171.95\Locales\nl.pak, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.5.2171.95\Locales\pl.pak, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.5.2171.95\Locales\pt-BR.pak, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.5.2171.95\Locales\pt-PT.pak, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.5.2171.95\Locales\ro.pak, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.5.2171.95\Locales\ru.pak, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.5.2171.95\Locales\sk.pak, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.5.2171.95\Locales\sl.pak, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.5.2171.95\Locales\sr.pak, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.5.2171.95\Locales\sv.pak, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.5.2171.95\Locales\sw.pak, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.5.2171.95\Locales\ta.pak, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.5.2171.95\Locales\te.pak, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.5.2171.95\Locales\th.pak, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.5.2171.95\Locales\tr.pak, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.5.2171.95\Locales\uk.pak, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.5.2171.95\Locales\vi.pak, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.5.2171.95\Locales\zh-CN.pak, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.5.2171.95\Locales\zh-TW.pak, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.5.2171.95\PepperFlash\manifest.json, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.5.2171.95\PepperFlash\pepflashplayer.dll, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.5.2171.95\VisualElements\logo.png, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.5.2171.95\VisualElements\smalllogo.png, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.5.2171.95\VisualElements\splash-620x300.png, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\Icons\google_plus.ico, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\Icons\mail_live_msn.ico, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\Icons\9gag.ico, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\Icons\agoda.ico, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\Icons\amazon.ico, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\Icons\bbc.ico, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\Icons\bestbuy.ico, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\Icons\bing.ico, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\Icons\booking.com.ico, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\Icons\cnn.ico, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\Icons\ebay.ico, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\Icons\espn.ico, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\Icons\etsy.ico, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\Icons\expedia.ico, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\Icons\facebook.ico, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\Icons\forbes.ico, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\Icons\gizmodo.ico, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\Icons\gmail.ico, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\Icons\google_news.ico, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\Icons\google_translate.ico, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\Icons\groupom.ico, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\Icons\hotels.com.ico, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\Icons\huffingtonpost.ico, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\Icons\icon.json, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\Icons\ikea.ico, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\Icons\imdb.ico, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\Icons\kayak.com.ico, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\Icons\linkedin.ico, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\Icons\mail.ru.ico, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\Icons\msn.ico, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\Icons\nba.ico, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\Icons\netflix.ico, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\Icons\nfl.ico, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\Icons\nytimes.ico, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\Icons\pinterest.ico, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\Icons\priceline.ico, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\Icons\reddit.ico, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\Icons\search.ico, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\Icons\skype.ico, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\Icons\target.ico, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\Icons\ted.ico, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\Icons\theguardian.ico, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\Icons\tripadvisor.ico, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\Icons\tumblr.ico, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\Icons\twitter.ico, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\Icons\walmart.ico, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\Icons\weather_channel.ico, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\Icons\wikipedia.ico, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\Icons\yahoo.ico, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\Icons\yahoo_finance.ico, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\Icons\yahoo_mail.ico, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\Icons\yahoo_search.ico, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\Icons\yandex.ico, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\Icons\yelp.ico, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\Icons\youtube.ico, Quarantined, [4da899d8a8e23df9411cd7ed36cd33cd],
PUP.Optional.Crossbrowse.C, C:\Users\Jeffery\AppData\Local\Crossbrowse\Crossbrowse\User Data\Local State, Quarantined, [5c995f1293f72610e37cdbe98e755aa6],
PUP.Optional.Crossbrowse.C, C:\Users\Jeffery\AppData\Local\Crossbrowse\Crossbrowse\User Data\Default\Cookies, Quarantined, [5c995f1293f72610e37cdbe98e755aa6],
PUP.Optional.Crossbrowse.C, C:\Users\Jeffery\AppData\Local\Crossbrowse\Crossbrowse\User Data\Default\Current Session, Quarantined, [5c995f1293f72610e37cdbe98e755aa6],
PUP.Optional.Crossbrowse.C, C:\Users\Jeffery\AppData\Local\Crossbrowse\Crossbrowse\User Data\Default\Current Tabs, Quarantined, [5c995f1293f72610e37cdbe98e755aa6],
PUP.Optional.Crossbrowse.C, C:\Users\Jeffery\AppData\Local\Crossbrowse\Crossbrowse\User Data\Default\Favicons, Quarantined, [5c995f1293f72610e37cdbe98e755aa6],
PUP.Optional.Crossbrowse.C, C:\Users\Jeffery\AppData\Local\Crossbrowse\Crossbrowse\User Data\Default\History, Quarantined, [5c995f1293f72610e37cdbe98e755aa6],
PUP.Optional.Crossbrowse.C, C:\Users\Jeffery\AppData\Local\Crossbrowse\Crossbrowse\User Data\Default\Last Session, Quarantined, [5c995f1293f72610e37cdbe98e755aa6],
PUP.Optional.Crossbrowse.C, C:\Users\Jeffery\AppData\Local\Crossbrowse\Crossbrowse\User Data\Default\Last Tabs, Quarantined, [5c995f1293f72610e37cdbe98e755aa6],
PUP.Optional.Crossbrowse.C, C:\Users\Jeffery\AppData\Local\Crossbrowse\Crossbrowse\User Data\Default\Shortcuts, Quarantined, [5c995f1293f72610e37cdbe98e755aa6],
PUP.Optional.Crossbrowse.C, C:\Users\Jeffery\AppData\Local\Crossbrowse\Crossbrowse\User Data\Default\Top Sites, Quarantined, [5c995f1293f72610e37cdbe98e755aa6],
PUP.Optional.Crossbrowse.C, C:\Users\Jeffery\AppData\Local\Crossbrowse\Crossbrowse\User Data\Default\Visited Links, Quarantined, [5c995f1293f72610e37cdbe98e755aa6],
PUP.Optional.Crossbrowse.C, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Crossbrowse\Crossbrowse.lnk, Quarantined, [94611160afdbcf678ed2bf05f013e61a],

Physical Sectors: 0
(No malicious items detected)

(end)

Re: Downloaded Crapware Disguised As Legitimate Software29th April 2015, 2:21 pm

Ok, there a lot of malware in that scan. Can you post the logs from AdwCleaner and MBAM rootkit detector? I have to go into the hospital for a few days. I'll get back to you as soon as I'm released.

Re: Downloaded Crapware Disguised As Legitimate Software29th April 2015, 8:10 pm

---------------------------------------
Malwarebytes Anti-Rootkit BETA 1.09.1.1004

(c) Malwarebytes Corporation 2011-2012

OS version: 6.3.9200 Windows 8.1 x64

Account is Administrative

Internet Explorer version: 11.0.9600.17728

File system is: NTFS
Disk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED
CPU speed: 2.167000 GHz
Memory total: 4180623360, free: 1816453120

Downloaded database version: v2015.04.28.08
Downloaded database version: v2015.04.21.01
Downloaded database version: v2015.04.22.01
=======================================
Initializing...
------------ Kernel report ------------
04/29/2015 00:41:50
------------ Loaded modules -----------
\SystemRoot\system32\ntoskrnl.exe
\SystemRoot\system32\hal.dll
\SystemRoot\system32\kd.dll
\SystemRoot\system32\mcupdate_GenuineIntel.dll
\SystemRoot\System32\drivers\werkernel.sys
\SystemRoot\System32\drivers\CLFS.SYS
\SystemRoot\System32\drivers\tm.sys
\SystemRoot\system32\PSHED.dll
\SystemRoot\system32\BOOTVID.dll
\SystemRoot\system32\CI.dll
\SystemRoot\System32\drivers\msrpc.sys
\SystemRoot\system32\drivers\Wdf01000.sys
\SystemRoot\system32\drivers\WDFLDR.SYS
\SystemRoot\System32\Drivers\acpiex.sys
\SystemRoot\System32\Drivers\WppRecorder.sys
\SystemRoot\System32\drivers\ACPI.sys
\SystemRoot\System32\drivers\WMILIB.SYS
\SystemRoot\System32\Drivers\cng.sys
\SystemRoot\System32\drivers\ttcrna.sys
\SystemRoot\System32\drivers\msisadrv.sys
\SystemRoot\System32\drivers\pci.sys
\SystemRoot\System32\drivers\vdrvroot.sys
\SystemRoot\system32\drivers\pdc.sys
\SystemRoot\System32\drivers\partmgr.sys
\SystemRoot\System32\drivers\spaceport.sys
\SystemRoot\System32\drivers\volmgr.sys
\SystemRoot\System32\drivers\volmgrx.sys
\SystemRoot\System32\drivers\mountmgr.sys
\SystemRoot\System32\drivers\storahci.sys
\SystemRoot\System32\drivers\storport.sys
\SystemRoot\system32\drivers\fltmgr.sys
\SystemRoot\System32\drivers\fileinfo.sys
\SystemRoot\System32\Drivers\Wof.sys
\SystemRoot\system32\drivers\WdFilter.sys
\SystemRoot\system32\drivers\mfehidk.sys
\SystemRoot\System32\Drivers\Ntfs.sys
\SystemRoot\System32\Drivers\ksecdd.sys
\SystemRoot\System32\drivers\MBI.sys
\SystemRoot\System32\drivers\pcw.sys
\SystemRoot\System32\Drivers\Fs_Rec.sys
\SystemRoot\system32\drivers\ndis.sys
\SystemRoot\system32\drivers\NETIO.SYS
\SystemRoot\System32\Drivers\ksecpkg.sys
\SystemRoot\System32\drivers\tcpip.sys
\SystemRoot\System32\drivers\fwpkclnt.sys
\SystemRoot\system32\DRIVERS\wfplwfs.sys
\SystemRoot\system32\drivers\mfewfpk.sys
\SystemRoot\System32\DRIVERS\fvevol.sys
\SystemRoot\System32\drivers\volsnap.sys
\SystemRoot\System32\drivers\rdyboost.sys
\SystemRoot\System32\Drivers\mup.sys
\SystemRoot\System32\drivers\intelpep.sys
\SystemRoot\System32\drivers\disk.sys
\SystemRoot\System32\drivers\CLASSPNP.SYS
\SystemRoot\System32\Drivers\crashdmp.sys
\SystemRoot\System32\drivers\cdrom.sys
\SystemRoot\System32\Drivers\Null.SYS
\SystemRoot\System32\Drivers\Beep.SYS
\SystemRoot\System32\drivers\BasicRender.sys
\SystemRoot\System32\drivers\dxgkrnl.sys
\SystemRoot\System32\drivers\watchdog.sys
\SystemRoot\System32\drivers\dxgmms1.sys
\SystemRoot\System32\drivers\BasicDisplay.sys
\SystemRoot\System32\Drivers\Npfs.SYS
\SystemRoot\System32\Drivers\Msfs.SYS
\SystemRoot\system32\DRIVERS\tdx.sys
\SystemRoot\system32\DRIVERS\TDI.SYS
\SystemRoot\System32\DRIVERS\netbt.sys
\SystemRoot\system32\drivers\afd.sys
\SystemRoot\system32\DRIVERS\pacer.sys
\SystemRoot\system32\DRIVERS\vwififlt.sys
\SystemRoot\system32\DRIVERS\netbios.sys
\SystemRoot\system32\DRIVERS\rdbss.sys
\SystemRoot\system32\DRIVERS\wanarp.sys
\SystemRoot\system32\drivers\nsiproxy.sys
\SystemRoot\System32\drivers\npsvctrig.sys
\SystemRoot\System32\drivers\mssmbios.sys
\SystemRoot\System32\Drivers\dfsc.sys
\SystemRoot\system32\DRIVERS\CLVirtualDrive.sys
\SystemRoot\system32\DRIVERS\ahcache.sys
\SystemRoot\System32\drivers\CompositeBus.sys
\SystemRoot\system32\DRIVERS\kdnic.sys
\SystemRoot\System32\drivers\umbus.sys
\SystemRoot\System32\drivers\CmBatt.sys
\SystemRoot\System32\drivers\BATTC.SYS
\SystemRoot\system32\DRIVERS\igdkmd64.sys
\SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
\SystemRoot\System32\drivers\USBXHCI.SYS
\SystemRoot\System32\drivers\ucx01000.sys
\SystemRoot\System32\drivers\TXEIx64.sys
\SystemRoot\System32\drivers\HDAudBus.sys
\SystemRoot\system32\DRIVERS\RtsP2Stor.sys
\SystemRoot\system32\DRIVERS\rtwlane.sys
\SystemRoot\System32\Drivers\fastfat.SYS
\SystemRoot\System32\drivers\vwifibus.sys
\SystemRoot\system32\DRIVERS\Rt630x64.sys
\SystemRoot\System32\drivers\i8042prt.sys
\SystemRoot\system32\DRIVERS\SynTP.sys
\SystemRoot\system32\DRIVERS\USBD.SYS
\SystemRoot\System32\drivers\kbdclass.sys
\SystemRoot\System32\drivers\mouclass.sys
\SystemRoot\System32\drivers\WirelessButtonDriver64.sys
\SystemRoot\System32\drivers\HIDCLASS.SYS
\SystemRoot\System32\drivers\HIDPARSE.SYS
\SystemRoot\System32\drivers\intelppm.sys
\SystemRoot\System32\drivers\wmiacpi.sys
\SystemRoot\System32\drivers\UEFI.sys
\SystemRoot\System32\drivers\NdisVirtualBus.sys
\SystemRoot\System32\drivers\swenum.sys
\SystemRoot\System32\drivers\ks.sys
\SystemRoot\System32\drivers\iwdbus.sys
\SystemRoot\System32\drivers\rdpbus.sys
\SystemRoot\system32\DRIVERS\clwvd.sys
\SystemRoot\system32\drivers\ksthunk.sys
\SystemRoot\System32\drivers\UsbHub3.sys
\SystemRoot\system32\drivers\RTKVHD64.sys
\SystemRoot\system32\drivers\portcls.sys
\SystemRoot\system32\drivers\drmk.sys
\SystemRoot\system32\DRIVERS\IntcDAud.sys
\SystemRoot\System32\drivers\usbccgp.sys
\SystemRoot\system32\drivers\mfeavfk.sys
\SystemRoot\system32\drivers\mfefirek.sys
\SystemRoot\system32\DRIVERS\mfencbdc.sys
\SystemRoot\System32\win32k.sys
\SystemRoot\System32\drivers\hidusb.sys
\SystemRoot\System32\drivers\rzendpt.sys
\SystemRoot\System32\drivers\mouhid.sys
\SystemRoot\System32\drivers\rzudd.sys
\SystemRoot\System32\drivers\kbdhid.sys
\SystemRoot\System32\Drivers\dump_diskdump.sys
\SystemRoot\System32\Drivers\dump_storahci.sys
\SystemRoot\System32\Drivers\dump_dumpfve.sys
\SystemRoot\System32\drivers\monitor.sys
\SystemRoot\System32\TSDDD.dll
\SystemRoot\System32\cdd.dll
\SystemRoot\System32\ATMFD.DLL
\SystemRoot\system32\drivers\luafv.sys
\??\C:\Windows\system32\drivers\mbam.sys
\SystemRoot\system32\DRIVERS\lltdio.sys
\SystemRoot\system32\DRIVERS\nwifi.sys
\SystemRoot\system32\DRIVERS\ndisuio.sys
\SystemRoot\system32\DRIVERS\rspndr.sys
\SystemRoot\system32\DRIVERS\vwifimp.sys
\SystemRoot\system32\drivers\HTTP.sys
\SystemRoot\system32\DRIVERS\bowser.sys
\SystemRoot\System32\drivers\mpsdrv.sys
\SystemRoot\system32\DRIVERS\mrxsmb.sys
\SystemRoot\system32\DRIVERS\mrxsmb20.sys
\SystemRoot\system32\DRIVERS\mrxsmb10.sys
\SystemRoot\system32\drivers\Ndu.sys
\SystemRoot\system32\drivers\peauth.sys
\??\C:\Windows\system32\drivers\rzpmgrk.sys
\SystemRoot\System32\Drivers\secdrv.SYS
\SystemRoot\System32\DRIVERS\srvnet.sys
\SystemRoot\System32\drivers\tcpipreg.sys
\SystemRoot\system32\Drivers\WdNisDrv.sys
\SystemRoot\System32\DRIVERS\srv2.sys
\SystemRoot\System32\DRIVERS\srv.sys
\SystemRoot\system32\drivers\WudfPf.sys
\SystemRoot\system32\drivers\mfeapfk.sys
\SystemRoot\system32\drivers\cfwids.sys
\SystemRoot\System32\drivers\condrv.sys
\??\C:\Windows\system32\drivers\MBAMSwissArmy.sys
\??\C:\Windows\system32\drivers\mbamchameleon.sys
----------- End -----------
Done!

Scan started
Database versions:
main: v2015.04.28.08
rootkit: v2015.04.21.01

<<<2>>>
Physical Sector Size: 512
Drive: 0, DevicePointer: 0xffffe0004da9a5e0, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\disk\
--------- Disk Stack ------
DevicePointer: 0xffffe0004da99040, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xffffe0004da9a5e0, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\disk\
DevicePointer: 0xffffe0004d5ec060, DeviceName: \Device\00000022\, DriverName: \Driver\storahci\
------------ End ----------
Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\disk\
Upper DeviceData: 0x0, 0x0, 0x0
Lower DeviceData: 0x0, 0x0, 0x0
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
<<<2>>>
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Scanning drivers directory: C:\WINDOWS\SYSTEM32\drivers...
File "C:\Windows\System32\drivers\1394ohci.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\1394ohci.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\acpipagr.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\acpipagr.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\acpipmi.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\acpipmi.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\acpitime.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\acpitime.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\AGP440.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\AGP440.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\amdk8.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\amdk8.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\amdppm.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\amdppm.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\intelpep.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\intelpep.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\intelppm.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\intelppm.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\isapnp.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\isapnp.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\kdnic.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\kdnic.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\sbp2port.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\sbp2port.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\atapi.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\atapi.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\ataport.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\ataport.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\BasicDisplay.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\BasicDisplay.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\BasicRender.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\BasicRender.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\battc.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\battc.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\BtaMPM.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\BtaMPM.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\BthAvrcpTg.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\BthAvrcpTg.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\BthhfHid.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\BthhfHid.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\cdrom.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\cdrom.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\CmBatt.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\CmBatt.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\CompositeBus.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\CompositeBus.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\disk.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\disk.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\dumpsd.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\dumpsd.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\EhStorTcgDrv.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\EhStorTcgDrv.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\errdev.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\errdev.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\fdc.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\fdc.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\flpydisk.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\flpydisk.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\circlass.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\circlass.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\fxppm.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\fxppm.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\npsvctrig.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\npsvctrig.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\usbprint.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\usbprint.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\hdaudbus.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\hdaudbus.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\HdAudio.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\HdAudio.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\hidbatt.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\hidbatt.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\hidbth.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\hidbth.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\hidclass.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\hidclass.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\hidi2c.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\hidi2c.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\hidparse.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\hidparse.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\hidusb.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\hidusb.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\monitor.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\monitor.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\msgpiowin32.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\msgpiowin32.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\msisadrv.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\msisadrv.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\msiscsi.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\msiscsi.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\mssmbios.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\mssmbios.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\MTConfig.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\MTConfig.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\parport.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\parport.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\pci.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\pci.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\pciide.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\pciide.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\pciidex.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\pciidex.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\pcmcia.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\pcmcia.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\processr.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\processr.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\rdpbus.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\rdpbus.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\stornvme.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\stornvme.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\terminpt.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\terminpt.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\tpm.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\tpm.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\uaspstor.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\uaspstor.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\uefi.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\uefi.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\umbus.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\umbus.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\umpass.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\umpass.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\USBAUDIO.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\USBAUDIO.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\usbccgp.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\usbccgp.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\usbd.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\usbd.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\usbehci.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\usbehci.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\usbhub.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\usbhub.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\usbohci.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\usbohci.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\usbport.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\usbport.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\USBSTOR.SYS" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\USBSTOR.SYS" is compressed (flags = 1)
File "C:\Windows\System32\drivers\usbuhci.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\usbuhci.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\vdrvroot.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\vdrvroot.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\volmgr.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\volmgr.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\volsnap.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\volsnap.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\vwifibus.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\vwifibus.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\wacompen.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\wacompen.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\wmiacpi.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\wmiacpi.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\sdbus.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\sdbus.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\sdstor.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\sdstor.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\serenum.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\serenum.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\serial.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\serial.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\sfloppy.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\sfloppy.sys" is compressed (flags = 1)
Done!
Drive 0
This is a System drive
Scanning MBR on drive 0...
Inspecting partition table:
This drive is a GPT Drive.
MBR Signature: 55AA
Disk Signature: 159542BB

GPT Protective MBR Partition information:

Partition 0 type is EFI-GPT (0xee)
Partition is NOT ACTIVE.
Partition starts at LBA: 1 Numsec = 4294967295

Partition 1 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Partition 2 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Partition 3 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

GPT Partition information:

GPT Header Signature 4546492050415254
GPT Header Revision 65536 Size 92 CRC 992955874
GPT Header CurrentLba = 1 BackupLba 976773167
GPT Header FirstUsableLba 34 LastUsableLba 976773134
GPT Header Guid e889530c-a73f-4139-931d-f3514484ddfe
GPT Header Contains 128 partition entries starting at LBA 2
GPT Header Partition entry size = 128

Backup GPT header Signature 4546492050415254
Backup GPT header Revision 65536 Size 92 CRC 992955874
Backup GPT header CurrentLba = 976773167 BackupLba 1
Backup GPT header FirstUsableLba 34 LastUsableLba 976773134
Backup GPT header Guid e889530c-a73f-4139-931d-f3514484ddfe
Backup GPT header Contains 128 partition entries starting at LBA 976773135
Backup GPT header Partition entry size = 128

Partition 0 Type de94bba4-6d1-4d40-a16a-bfd5179d6ac
Partition ID 3526f557-a121-41dd-a9e-58ad6dfe9fed
FirstLBA 2048 Last LBA 1333247
Attributes 1
Partition Name Basic data partition

Partition 1 Type c12a7328-f81f-11d2-ba4b-0a0c93ec93b
Partition ID eedf0fde-1f8b-4688-8bf4-eb7ed14a1089
FirstLBA 1333248 Last LBA 1865727
Attributes 0
Partition Name EFI system partition

GPT Partition 1 is bootable
Partition 2 Type e3c9e316-b5c-4db8-817d-f92df0215ae
Partition ID a45403cb-9dd0-4da6-91f1-2a9dacc04410
FirstLBA 1865728 Last LBA 2127871
Attributes 0
Partition Name Microsoft reserved partition

Partition 3 Type ebd0a0a2-b9e5-4433-87c0-68b6b72699c7
Partition ID b4a0a528-8c48-4e28-af38-7d54fc3ceec2
FirstLBA 2127872 Last LBA 932607999
Attributes 0
Partition Name Basic data partition

Partition 4 Type ebd0a0a2-b9e5-4433-87c0-68b6b72699c7
Partition ID 9eee42a8-323f-43f2-be1d-c9ae9ad7e95b
FirstLBA 932608000 Last LBA 976762879
Attributes 1
Partition Name Basic data partition

Disk Size: 500107862016 bytes
Sector size: 512 bytes

Done!
Infected: C:\Users\Jeffery\AppData\Local\Temp\nsmFF6E.tmp --> [Trojan.Downloader]
Scan finished
Creating System Restore point...
Cleaning up...
Removal scheduling successful. System shutdown needed.
System shutdown occurred
=======================================

Removal queue found; removal started
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-0-i.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-0-r.mbam...
Removal finished

Re: Downloaded Crapware Disguised As Legitimate Software29th April 2015, 8:20 pm

I'd like to scan your machine with ESET OnlineScan

•Hold down Control and click on the following link to open ESET OnlineScan in a new window.
ESET OnlineScan

•Click the Downloaded Crapware Disguised As Legitimate Software EsetOnline

Downloaded Crapware Disguised As Legitimate Software EsetOnline

button.
•For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)

Click on to download the ESET Smart Installer. Save it to your desktop.
Double click on the icon on your desktop.

•Check

Downloaded Crapware Disguised As Legitimate Software EsetAcceptTerms

•Click the Downloaded Crapware Disguised As Legitimate Software EsetStart

button.
•Accept any security warnings from your browser.

Leave the check mark next to Remove found threats.

•Check

Downloaded Crapware Disguised As Legitimate Software EsetScanArchives

•Push the Start button.
•ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
•When the scan completes, push Downloaded Crapware Disguised As Legitimate Software EsetListThreats

Downloaded Crapware Disguised As Legitimate Software EsetListThreats

•Push

Downloaded Crapware Disguised As Legitimate Software EsetExport

, and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
•Push the Downloaded Crapware Disguised As Legitimate Software EsetBack

Downloaded Crapware Disguised As Legitimate Software EsetBack

button.
•Push Downloaded Crapware Disguised As Legitimate Software EsetFinish

A log file will be saved here: C:\Program Files\ESET\ESET Online Scanner\log.txt

Downloaded Crapware Disguised As Legitimate Software

descriptionDownloaded Crapware Disguised As Legitimate Software28th April 2015, 10:49 pm

descriptionRe: Downloaded Crapware Disguised As Legitimate Software29th April 2015, 1:52 am

descriptionRe: Downloaded Crapware Disguised As Legitimate Software29th April 2015, 4:32 am

descriptionRe: Downloaded Crapware Disguised As Legitimate Software29th April 2015, 4:33 am

descriptionRe: Downloaded Crapware Disguised As Legitimate Software29th April 2015, 2:21 pm

descriptionRe: Downloaded Crapware Disguised As Legitimate Software29th April 2015, 8:10 pm

descriptionRe: Downloaded Crapware Disguised As Legitimate Software29th April 2015, 8:20 pm