Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 04/08/2016
Scan Time: 06:59 ã
Logfile: malware 4.txt
Administrator: Yes

Version: 2.2.1.1043
Malware Database: v2016.08.04.10
Rootkit Database: v2016.05.27.01
License: Trial
Malware Protection: Enabled
Malicious Website Protection: Enabled
Self-protection: Disabled

OS: Windows 10
CPU: x64
File System: NTFS
User: mezoo

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 343946
Time Elapsed: 19 min, 36 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Warn
PUM: Warn

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 12
PUP.Optional.YesSearches, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\ReoqucultsterkemppWrp.exe, Quarantined, [dd3d3c0b2971c3739980479fec15cd33],
Trojan.ProxyHijacker, HKLM\SOFTWARE\CLASSES\Tekken 5 Pc Game 2015 Free Download.DynamicNS, Quarantined, [33e72c1b7d1dc76f276b20766f93d729],
Trojan.ProxyHijacker, HKLM\SOFTWARE\WOW6432NODE\CLASSES\Tekken 5 Pc Game 2015 Free Download.DynamicNS, Quarantined, [57c3a2a5b6e450e6f0a255417b8727d9],
Trojan.ProxyHijacker, HKLM\SOFTWARE\CLASSES\WOW6432NODE\Tekken 5 Pc Game 2015 Free Download.DynamicNS, Quarantined, [57c3a2a5b6e450e6f0a255417b8727d9],
PUP.Optional.HohoSearch, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{2D93D9B4-D1A4-49C5-9413-3EDD81E6A7AA}, Delete-on-Reboot, [2af0bf88eeacd1656b67b4159c66b24e],
PUP.Optional.Elex, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{C0881FC2-94B6-495C-9D61-B3DB75DB5818}, Delete-on-Reboot, [fc1e52f557431422fccbdbe44bb9718f],
PUP.Optional.HohoSearch, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\Arikoiedrumition Configuration, Delete-on-Reboot, [a674aa9d41594fe715be79502ed438c8],
PUP.Optional.Elex, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\b2929b72a96a471893ecaa9c51368bae, Delete-on-Reboot, [9486e95ef9a1c76fc0093788fc0845bb],
PUP.Optional.Trotux, HKLM\SOFTWARE\MOZILLA\FIREFOX\{EB52F1AB-3C2B-424F-9794-833C687025CF}, Quarantined, [a07aba8debafec4a19d37e4bc73bf709],
PUP.Optional.Trotux, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{B0645DDF-6230-43C4-99D2-FC6E713BDE25}, Quarantined, [a8722720465463d3a34857727b87b14f],
PUP.Optional.TornTV, HKU\S-1-5-18\SOFTWARE\APPDATALOW\SOFTWARE\Torntv V9.0, Quarantined, [9684f7508515e25432f202b7778c06fa],
PUP.Optional.CrossRider, HKU\S-1-5-21-2355463451-85381230-1253174285-1002\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{5FF5BE66-1FA5-407F-9C6A-1D9D68F3EB8A}, Quarantined, [041653f4b2e87abc66d1dac5a1628080],

Registry Values: 11
PUP.Optional.HohoSearch, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{2D93D9B4-D1A4-49C5-9413-3EDD81E6A7AA}|Path, \Arikoiedrumition Configuration, Delete-on-Reboot, [2af0bf88eeacd1656b67b4159c66b24e]
PUP.Optional.Elex, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{C0881FC2-94B6-495C-9D61-B3DB75DB5818}|Path, \b2929b72a96a471893ecaa9c51368bae, Delete-on-Reboot, [fc1e52f557431422fccbdbe44bb9718f]
PUP.Optional.Trotux, HKLM\SOFTWARE\MOZILLA\FIREFOX\{EB52F1AB-3C2B-424F-9794-833C687025CF}|hp, http://www.trotux.com/?z=d14de9fbb82844fae09bfbeg8zemfe1gaqfgfq1tfg&from=epf1&uid=ST31000524AS_5VPBTY3NXXXX5VPBTY3N&type=hp&mode=ffsengext, Quarantined, [a07aba8debafec4a19d37e4bc73bf709]
PUP.Optional.Trotux, HKLM\SOFTWARE\MOZILLA\FIREFOX\{EB52F1AB-3C2B-424F-9794-833C687025CF}|tab, http://www.trotux.com/?z=d14de9fbb82844fae09bfbeg8zemfe1gaqfgfq1tfg&from=epf1&uid=ST31000524AS_5VPBTY3NXXXX5VPBTY3N&type=hp&mode=ffsengext, Quarantined, [021859eec2d8d85e717bc504ca38c43c]
PUP.Optional.Trotux, HKLM\SOFTWARE\MOZILLA\FIREFOX\{EB52F1AB-3C2B-424F-9794-833C687025CF}|sp, http://www.trotux.com/search/?q={searchTerms}&z=d14de9fbb82844fae09bfbeg8zemfe1gaqfgfq1tfg&from=epf1&uid=ST31000524AS_5VPBTY3NXXXX5VPBTY3N&type=sp, Quarantined, [08124afd57434de9feee6a5f3cc6926e]
PUP.Optional.Trotux, HKLM\SOFTWARE\MOZILLA\FIREFOX\{EB52F1AB-3C2B-424F-9794-833C687025CF}|surl, http://www.trotux.com/search/?&z=d14de9fbb82844fae09bfbeg8zemfe1gaqfgfq1tfg&from=epf1&uid=ST31000524AS_5VPBTY3NXXXX5VPBTY3N&type=sp&q=, Quarantined, [9b7f4304eab00d29e606caff857d2ad6]
PUP.Optional.Trotux, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{B0645DDF-6230-43C4-99D2-FC6E713BDE25}|DisplayName, trotux - Uninstall, Quarantined, [a8722720465463d3a34857727b87b14f]
Hijack.AutoConfigURL.PrxySvrRST, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\IPHLPSVC\PARAMETERS\PROXYMGR\{A786AF92-E214-47D7-8FDC-1FDC91A4CE69}|AutoConfigUrl, http://stoppblock.net/wpad.dat?cac59082bea115cb5137e2ad1deaf9e713686158, Quarantined, [e73314332d6d3df96fcaa014e222f10f]
Hijack.AutoConfigURL.PrxySvrRST, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\NLASVC\PARAMETERS\INTERNET\MANUALPROXIES, 0http://stoppblock.net/wpad.dat?cac59082bea115cb5137e2ad1deaf9e713686158, Quarantined, [dc3e93b44c4e56e094a2734144c059a7]
PUP.Optional.CrossRider, HKU\S-1-5-21-2355463451-85381230-1253174285-1002\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{5FF5BE66-1FA5-407F-9C6A-1D9D68F3EB8A}|AppName, Torntv V6.0-enabler.exe-codedownloader.exe, Quarantined, [041653f4b2e87abc66d1dac5a1628080]
Hijack.AutoConfigURL.PrxySvrRST, HKU\S-1-5-21-2355463451-85381230-1253174285-1002\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS|AutoConfigUrl, http://stoppblock.net/wpad.dat?cac59082bea115cb5137e2ad1deaf9e713686158, Quarantined, [fa2057f0ebafa690dd5ab400e32137c9]

Registry Data: 0
(No malicious items detected)

Folders: 3
PUP.Optional.HohoSearch, C:\Program Files (x86)\Arikoiedrumition, Quarantined, [7d9dbb8cb0eaa49283b7d0f9f70b2cd4],
PUP.Optional.HohoSearch, C:\Program Files (x86)\Ckavesycwoy, Quarantined, [ec2eba8d41597fb7e457498057ab08f8],
PUP.Optional.HohoSearch, C:\Program Files (x86)\Reoicult, Quarantined, [b664df68693173c343f922a71ae804fc],

Files: 19
PUP.Optional.YesSearches, C:\Program Files (x86)\Nevusygerwersh\ReoqucultsterkemppWrp.exe, Quarantined, [dd3d3c0b2971c3739980479fec15cd33],
PUP.Optional.SimpleFiles, C:\Users\mezoo\AppData\Roaming\ZHP\Quarantine\uninstall93877984.exe.VIR, Quarantined, [c654291e8a1002345ddf1f71917358a8],
PUP.Optional.SimpleFiles, C:\Users\mezoo\AppData\Roaming\ZHP\Quarantine\uninstall93878031.exe.VIR, Quarantined, [9c7e380f0e8cc37381bb8c04cc38ca36],
Adware.Agent, C:\Users\mezoo\AppData\Roaming\ZHP\Quarantine\InstallMate.DIR\{2CFF2A6F-3205-4441-A6AA-7A27F71C0899}\Custom.dll, Quarantined, [41d9083f6733ec4aff6eedc8f30d3dc3],
PUP.Optional.YesSearches, C:\Program Files (x86)\Nevusygerwersh\ReoqucultsterkemppCdr.exe, Quarantined, [6dad7ec95b3f8ea8ad6c39ad8f723cc4],
RiskWare.GameHack, C:\Program Files (x86)\Pro Evolution Soccer 2016\steam_api.dll, Quarantined, [de3c58ef6d2dc37354f23a6ef014916f],
RiskWare.GameHack, C:\Program Files (x86)\Ultra Street Fighter IV\steam_api.dll, Quarantined, [bb5f53f422787fb74303ebbd9371e11f],
PUP.Optional.Offerware, C:\Users\mezoo\AppData\Local\Temp\f9626892-7a78-3199-abd2-97bbce96297b\Extracted\adv_109.exe, Quarantined, [e23872d5663469cd5d5a226653aebf41],
CrackTool.Agent.Keygen, C:\Windows\AutoKMS.exe, Quarantined, [97831532cad0bc7aaa8874e95aa704fc],
PUP.Optional.GsearchFinder, C:\Users\mezoo\AppData\Roaming\Profiles\0oln6mk6.default\extensions\@90B817C8-8A5C-413B-9DDD-B2C61ED6E79A.xpi, Quarantined, [c951fa4de7b32610ccf1ad50e0238e72],
PUP.Optional.GsearchFinder, C:\Users\mezoo\AppData\Roaming\Profiles\vupocultjajiledrnege\extensions\@90B817C8-8A5C-413B-9DDD-B2C61ED6E79A.xpi, Quarantined, [8c8e56f1980253e313aa9766a75c1ee2],
PUP.Optional.Elex, C:\Windows\System32\Tasks\b2929b72a96a471893ecaa9c51368bae, Quarantined, [48d23f08aaf03df9e1ec556a18ece818],
PUP.Optional.Trotux, C:\Users\mezoo\AppData\Roaming\Mozilla\Firefox\Profiles\nj11tx8v.default\searchplugins\s8g1lgw3.xml, Quarantined, [8f8ba6a115857db9d410336a937137c9],
PUP.Optional.Elex, C:\Users\mezoo\AppData\Roaming\Profiles\khb5el81.default\prefs.js, Good: (), Bad: (user_pref("browser.newtab.url", "http://d2ucfwpxlh3zh3.cloudfront.net/?ts=AHEqBXIpCHEkCE..&v=20160620&uid=CD2614266816DA107F6AEBE320D1A132&ptid=isr&mode=loadm");), Replaced,[dc3ebd8a7822f83e8873dfc8b54f1ce4]
PUP.Optional.Elex, C:\Users\mezoo\AppData\Roaming\Profiles\khb5el81.default\prefs.js, Good: (), Bad: (stUpdateTime.blocklist-background-update-timer", 1457631659);
user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 1460696793);
user_pref("app.update.la), Replaced,[d3476add8a10a492a6550d9a1de7619f]
PUP.Optional.HohoSearch, C:\Users\mezoo\AppData\Roaming\Profiles\0oln6mk6.default\searchplugins\8c8wki8t.xml, Quarantined, [7b9fa89fefab9b9b6e570a93f90b9c64],
PUP.Optional.HohoSearch, C:\Users\mezoo\AppData\Roaming\Profiles\khb5el81.default\searchplugins\8c8wki8t.xml, Quarantined, [e2383e093c5e6acc794c1f7ed92bf40c],
PUP.Optional.HohoSearch, C:\Users\mezoo\AppData\Roaming\Profiles\vupocultjajiledrnege\searchplugins\8c8wki8t.xml, Quarantined, [64b662e5debc9a9c299c801d0ff5718f],
PUP.Optional.Trotux, C:\Users\mezoo\AppData\Roaming\Profiles\0oln6mk6.default\searchplugins\s8g1lgw3.xml, Quarantined, [5dbd9bacdac075c1cd4b41696e9631cf],

Physical Sectors: 0
(No malicious items detected)


(end)