Malwarebytes Anti-Malware www.malwarebytes.org Scan Date: 2/3/2017 Scan Time: 7:01 PM Logfile: scan log.txt Administrator: Yes Version: 2.2.1.1043 Malware Database: v2017.02.03.10 Rootkit Database: v2016.11.20.01 License: Free Malware Protection: Disabled Malicious Website Protection: Disabled Self-protection: Disabled OS: Windows 7 CPU: x64 File System: NTFS User: Cosmin Scan Type: Threat Scan Result: Completed Objects Scanned: 555157 Time Elapsed: 53 min, 31 sec Memory: Enabled Startup: Enabled Filesystem: Enabled Archives: Enabled Rootkits: Enabled Heuristics: Enabled PUP: Enabled PUM: Enabled Processes: 0 (No malicious items detected) Modules: 0 (No malicious items detected) Registry Keys: 11 PUP.Optional.AdvancedSystemProtector, HKLM\SOFTWARE\CLASSES\FOLDER\SHELLEX\CONTEXTMENUHANDLERS\Advanced System Protector, Quarantined, [c6d0bfdfd8d085b1d09e401717e97090], PUP.Optional.AdvancedSystemProtector, HKLM\SOFTWARE\CLASSES\WOW6432NODE\FOLDER\SHELLEX\CONTEXTMENUHANDLERS\Advanced System Protector, Quarantined, [2c6a1589c4e48fa73935d285e8189967], PUP.Optional.AdvancedSystemProtector, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{09ED7CD1-F76A-4ED8-93C7-3FE6601CAC15}, Delete-on-Reboot, [ecaa1f7fecbc181e09a49ca11de3867a], PUP.Optional.Linkury.ACMB1, HKLM\SOFTWARE\WOW6432NODE\mtFlexfix, Quarantined, [e2b4d1cd703841f5122b4879837f0000], PUP.Optional.SysTweak, HKLM\SOFTWARE\WOW6432NODE\Systweak, Quarantined, [d5c1c4da119771c50bae41147d8348b8], PUP.Optional.AdvancedSystemProtector, HKLM\SOFTWARE\WOW6432NODE\CLASSES\FOLDER\SHELLEX\CONTEXTMENUHANDLERS\Advanced System Protector, Quarantined, [eaacd9c5ecbc3303df8fbd9a639da858], PUP.Optional.AdvancedSystemProtector, HKLM\SOFTWARE\WOW6432NODE\SYSTWEAK\PARAMS, Quarantined, [deb856481890cb6bd148c491a35dd828], PUP.Optional.SysTweak, HKU\S-1-5-18\SOFTWARE\Systweak, Quarantined, [781e920c525650e681caa5b3b84803fd], PUP.Optional.Linkury.ACMB1, HKU\S-1-5-21-1265590593-2336177101-1008803050-1000\SOFTWARE\mtFlexfix, Quarantined, [eda9bae49f093bfbe551a41db34f659b], PUP.Optional.SysTweak, HKU\S-1-5-21-1265590593-2336177101-1008803050-1000\SOFTWARE\systweak, Quarantined, [3363f3ab3672181e55f61543b7494db3], PUP.Optional.AdvancedSystemProtector, HKU\S-1-5-21-1265590593-2336177101-1008803050-1000\SOFTWARE\SYSTWEAK\PARAMS, Quarantined, [2175900e1e8a72c4480f64f238c8f60a], Registry Values: 6 PUP.Optional.AdvancedSystemProtector, HKLM\SOFTWARE\CLASSES\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SHELL EXTENSIONS\APPROVED|{00212D92-C5D8-4ff4-AE50-B20F0F85C40A}, Scan with Advanced System Protector, Quarantined, [c9cdebb39414dd59d4be6fe69070c13f] PUP.Optional.AdvancedSystemProtector, HKLM\SOFTWARE\CLASSES\WOW6432NODE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SHELL EXTENSIONS\APPROVED|{00212D92-C5D8-4ff4-AE50-B20F0F85C40A}, Scan with Advanced System Protector, Quarantined, [32642a74edbb0135b0e291c405fb46ba] PUP.Optional.AdvancedSystemProtector, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{09ED7CD1-F76A-4ED8-93C7-3FE6601CAC15}|Path, \Advanced System~Protector, Delete-on-Reboot, [ecaa1f7fecbc181e09a49ca11de3867a] PUP.Optional.AdvancedSystemProtector, HKLM\SOFTWARE\WOW6432NODE\CLASSES\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SHELL EXTENSIONS\APPROVED|{00212D92-C5D8-4ff4-AE50-B20F0F85C40A}, Scan with Advanced System Protector, Quarantined, [8f070995e5c34fe73a58a5b0f40cf10f] PUP.Optional.AdvancedSystemProtector, HKLM\SOFTWARE\WOW6432NODE\SYSTWEAK\PARAMS|ASPInstalledPath, C:\Program Files (x86)\ASP, Quarantined, [deb856481890cb6bd148c491a35dd828] PUP.Optional.AdvancedSystemProtector, HKU\S-1-5-21-1265590593-2336177101-1008803050-1000\SOFTWARE\SYSTWEAK\PARAMS|ASPInstalledPath, C:\Program Files (x86)\ASP, Quarantined, [2175900e1e8a72c4480f64f238c8f60a] Registry Data: 0 (No malicious items detected) Folders: 3 PUP.Optional.BitCoinMiner, C:\Users\Cosmin\AppData\Roaming\gplyra, Quarantined, [3c5ae3bbbcec360075fe5ba901ff6a96], PUP.Optional.OpenCandy, C:\Users\Cosmin\AppData\Roaming\OpenCandy, Quarantined, [771fc8d6a107d85ec50a633ba35f48b8], PUP.Optional.OpenCandy, C:\Users\Cosmin\AppData\Roaming\OpenCandy\763352F4EEDE455D954F30FA71B0907C, Quarantined, [771fc8d6a107d85ec50a633ba35f48b8], Files: 8 PUP.Optional.AdOffer, C:\Users\Cosmin\AppData\Local\Temp\bitool.dll, Quarantined, [9afcf2ac8127b08673c085da11f11be5], PUP.Optional.Somoto, C:\Users\Cosmin\AppData\Local\Temp\nsxE75.tmp, Quarantined, [1e78831b92166dc923bec034758c659b], PUP.Optional.OpenCandy, C:\Users\Cosmin\Downloads\CheatEngine65.exe.opdownload, Quarantined, [92045549ddcbe0563d213cad78898c74], PUP.Optional.MorePowerfulCleaner, C:\Users\Cosmin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_search.mpc.am_0.localstorage, Quarantined, [3264534b1e8a8da976f6f4cd4bb76b95], PUP.Optional.MorePowerfulCleaner, C:\Users\Cosmin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_search.mpc.am_0.localstorage-journal, Quarantined, [93033a64eabe91a5204c1ea38280ef11], PUP.Optional.BundleInstaller, C:\Users\Cosmin\AppData\Local\Temp\binsis142.xml, Quarantined, [fd99514d6048b383f1f7773d31d25ca4], PUP.Optional.BundleInstaller, C:\Users\Cosmin\AppData\Local\Temp\binsischeck654.xml, Quarantined, [762015897038c373effad3e17390fb05], PUP.Optional.OpenCandy, C:\Users\Cosmin\AppData\Roaming\OpenCandy\763352F4EEDE455D954F30FA71B0907C\PlutoTVSetup0418.exe, Quarantined, [771fc8d6a107d85ec50a633ba35f48b8], Physical Sectors: 0 (No malicious items detected) (end)