Marius,
- I pasted ComboFix.txt here and also Mbam log. txt .
- Mbam found 31 problems and I deleted all according to instruction.
- I was not able to download Farber Service Scanner because it was not allowed by my Norton virus protection software.
I received warnings the download was not safe. I could not find a safe alternative site for the FSS download.
After I deleted the Mbam 31 "detected items" I rebooted as requested, but notice I am still receiving the same "site not trusted alerts".
Thanks, Jim
ComboFix 13-09-10.01 - Administrator 09/10/2013 9:56.6.2 - x86
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Administrator\My Documents\Downloads\CFScript.txt
AV: Norton Security Suite *Disabled/Updated* {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton Security Suite *Enabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}
.
file zipped: c:\program files\Common Files\gihirof.bat
file zipped: c:\program files\Common Files\ytuxydy.pif
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Administrator\Local Settings\Application Data\Google\Chrome\User Data\Default\Preferences
C:\END
c:\program files\Common Files\gihirof.bat
c:\program files\Common Files\ytuxydy.pif
.
.
((((((((((((((((((((((((( Files Created from 2013-08-10 to 2013-09-10 )))))))))))))))))))))))))))))))
.
.
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-08-23 22:55 . 2012-05-05 12:08 692104 —-a-w- c:\windows\system32\FlashPlayerApp.exe
2013-08-23 22:55 . 2011-10-20 15:26 71048 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-08-01 02:52 . 2003-05-06 06:54 901808 —-a-w- c:\windows\system32\wmvdmod.dll
2013-07-26 02:47 . 2004-02-06 22:05 920064 —-a-w- c:\windows\system32\wininet.dll
2013-07-26 02:47 . 2013-03-13 11:44 43520 —-a-w- c:\windows\system32\licmgr10.dll
2013-07-26 02:47 . 2013-03-13 11:44 1469440 —-a-w- c:\windows\system32\inetcpl.cpl
2013-07-25 15:52 . 2004-08-04 05:59 385024 —-a-w- c:\windows\system32\html.iec
2013-07-16 17:42 . 2013-04-22 16:53 142496 —-a-w- c:\windows\system32\drivers\SYMEVENT.SYS
2013-07-10 10:37 . 2003-05-21 20:54 406016 —-a-w- c:\windows\system32\usp10.dll
2013-07-04 03:03 . 2002-08-29 08:04 2149888 —-a-w- c:\windows\system32\ntoskrnl.exe
2013-07-04 02:08 . 2002-08-29 08:04 2028544 —-a-w- c:\windows\system32\ntkrnlpa.exe
2006-11-21 16:52 . 2006-11-21 16:52 252416 -c–a-w- c:\program files\uninstall_flash_player.exe
2005-12-03 00:18 . 2005-12-03 00:18 19846914 -c–a-w- c:\program files\71.89_win2kxp_english.exe
2005-11-22 03:55 . 2005-11-22 03:55 13831036 -c–a-w- c:\program files\VibeComcastVMInstall.exe
2005-08-10 02:35 . 2005-08-10 02:34 6860424 -c–a-w- c:\program files\MicrosoftAntiSpywareInstall.exe
2005-07-25 21:33 . 2005-07-25 21:33 2575792 -c–a-w- c:\program files\comcast_photoshow_deluxe_4.exe
2005-07-25 19:59 . 2005-07-25 19:58 465096 -c–a-w- c:\program files\SnapfishPhotoShow.exe
.
.
((((((((((((((((((((((((((((((((((((((((((((( AWF ))))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Weather"="c:\program files\AWS\WeatherBug\Weather.exe" [2006-04-07 1343488]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"KYE_Showicon"="c:\program files\USB Storage RW\shwicon.exe -tKYE\USB Storage RW" [X]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-10-22 7700480]
"nwiz"="nwiz.exe" [2006-10-22 1622016]
"ehTray"="c:\windows\ehome\ehtray.exe" [2008-04-14 50176]
"AlcxMonitor"="ALCXMNTR.EXE" [2004-09-07 57344]
"DVDTray"="c:\program files\HP DVD\Umbrella\DVDTray.exe" [2003-07-23 65536]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-10-22 86016]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2013-03-12 253816]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2013-05-01 421888]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Picasa Media Detector"="c:\program files\Picasa2\PicasaMediaDetector.exe" [N/A]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]
2008-05-19 19:23 87352 —-a-w- c:\windows\system32\LMIinit.dll
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
backup=c:\windows\pss\Adobe Gamma Loader.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^customize__IE.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\customize__IE.lnk
backup=c:\windows\pss\customize__IE.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^hp center.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\hp center.lnk
backup=c:\windows\pss\hp center.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^MsnFixer.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\MsnFixer.lnk
backup=c:\windows\pss\MsnFixer.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Quicken Scheduled Updates.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Quicken Scheduled Updates.lnk
backup=c:\windows\pss\Quicken Scheduled Updates.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 00:12 15360 —-a-w- c:\windows\system32\ctfmon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus C62 Series (Copy 1)]
2002-04-10 08:00 74240 —-a-w- c:\windows\system32\spool\drivers\w32x86\3\E_S0BIC1.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2006-12-11 01:52 49152 -c–a-w- c:\program files\HP\HP Software Update\hpwuSchd2.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2013-05-01 07:59 421888 —-a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\svchost]
c:\documents and settings\Administrator\Application Data\svcst.exe [N/A]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [N/A]
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\NetMeeting\\conf.exe"=
"c:\\Program Files\\Support.com\\bin\\tgcmd.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\FileZilla FTP Client\\filezilla.exe"=
"c:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=
.
R0 SymDS;Symantec Data Store;c:\windows\system32\drivers\N360\1404000.028\symds.sys [7/16/2013 8:14 AM 367704]
R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\N360\1404000.028\symefa.sys [7/16/2013 8:14 AM 934488]
R1 BHDrvx86;BHDrvx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\Definitions\BASHDefs\20130903.002\BHDrvx86.sys [9/3/2013 6:26 PM 1097816]
R1 ccSet_N360;Norton Security Suite Settings Manager;c:\windows\system32\drivers\N360\1404000.028\ccsetx86.sys [7/16/2013 8:14 AM 134744]
R1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\N360\1404000.028\ironx86.sys [7/16/2013 8:14 AM 175264]
R2 N360;Norton Security Suite;c:\program files\Norton Security Suite\Engine\20.4.0.40\ccsvchst.exe [7/16/2013 8:13 AM 144368]
R2 TomTomHOMEService;TomTomHOMEService;c:\program files\TomTom HOME 2\TomTomHOMEService.exe [3/22/2013 6:07 AM 93072]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [9/8/2013 8:10 PM 108120]
R3 EvcapMaui;Emuzed EvcapMaui Device;c:\windows\system32\drivers\EvcapMau.sys [5/6/2003 12:54 AM 177664]
R3 IDSxpx86;IDSxpx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\Definitions\IPSDefs\20130907.001\IDSXpx86.sys [9/10/2013 9:31 AM 380832]
S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys –> c:\windows\system32\DRIVERS\Lbd.sys [?]
S1 AntiLog32;AntiLog32;\??\c:\windows\system32\drivers\AntiLog32.sys –> c:\windows\system32\drivers\AntiLog32.sys [?]
S2 LMIInfo;LogMeIn Kernel Information Provider;\??\c:\program files\LogMeIn\x86\RaInfo.sys –> c:\program files\LogMeIn\x86\RaInfo.sys [?]
S3 CFcatchme;CFcatchme;\??\c:\docume~1\ADMINI~1\LOCALS~1\Temp\CFcatchme.sys –> c:\docume~1\ADMINI~1\LOCALS~1\Temp\CFcatchme.sys [?]
S3 EraserUtilDrvI9;EraserUtilDrvI9;\??\c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilDrvI9.sys –> c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilDrvI9.sys [?]
S3 keycrypt;keycrypt;c:\windows\system32\DRIVERS\KeyCrypt32.sys –> c:\windows\system32\DRIVERS\KeyCrypt32.sys [?]
S3 NUVision;NUVision Video Service;c:\windows\system32\drivers\NUVvid2.sys [6/21/2004 10:08 PM 153824]
S3 PCDRDRV;Pcdr Helper Driver; [x]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-09-04 01:40 1177552 —-a-w- c:\program files\Google\Chrome\Application\29.0.1547.66\Installer\chrmstp.exe
.
Contents of the 'Scheduled Tasks' folder
.
2013-09-10 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-05 22:56]
.
2013-08-31 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 22:57]
.
2013-04-30 c:\windows\Tasks\DisketchReminder.job
- c:\program files\NCH Software\Disketch\disketch.exe [2013-04-23 17:46]
.
2013-04-23 c:\windows\Tasks\DisketchSevenDays.job
- c:\program files\NCH Software\Disketch\disketch.exe [2013-04-23 17:46]
.
2013-07-22 c:\windows\Tasks\DoxillionDowngrade.job
- c:\program files\NCH Software\Doxillion\doxillion.exe [2013-05-03 14:52]
.
2013-08-06 c:\windows\Tasks\DoxillionReminder.job
- c:\program files\NCH Software\Doxillion\doxillion.exe [2013-05-03 14:52]
.
2013-09-10 c:\windows\Tasks\GoogleUpdateTaskMachineCore1cc208ea0ecc77e.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-30 03:34]
.
2013-09-10 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-30 03:34]
.
.
——- Supplementary Scan ——-
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uDefault_Search_URL = hxxp://www.google.com/ie
uInternet Settings,ProxyOverride =
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
Trusted Zone: internet
TCP: DhcpNameServer = 192.168.1.1
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2013-09-10 10:39
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\N360]
"ImagePath"="\"c:\program files\Norton Security Suite\Engine\20.4.0.40\ccSvcHst.exe\" /s \"N360\" /m \"c:\program files\Norton Security Suite\Engine\20.4.0.40\diMaster.dll\" /prefetch:1"
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_USERS\S-1-5-21-698036064-2301516679-3255942371-500\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-698036064-2301516679-3255942371-500\Software\Policies\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (Administrator)
@Allowed: (Read) (Administrator)
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_8_800_94_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_8_800_94_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'winlogon.exe'(648)
c:\windows\system32\LMIinit.dll
c:\windows\system32\LMIRfsClientNP.dll
.
- - - - - - - > 'explorer.exe'(2552)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\LMIRfsClientNP.dll
.
———————— Other Running Processes ————————
.
c:\program files\Google\Update\1.3.21.153\GoogleCrashHandler.exe
c:\windows\ehome\ehSched.exe
c:\windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
c:\program files\Java\jre7\bin\jqs.exe
c:\program files\Dantz\Retrospect\retrorun.exe
c:\progra~1\Dantz\RETROS~1\wdsvc.exe
c:\windows\system32\wdfmgr.exe
c:\windows\system32\fxssvc.exe
c:\program files\USB Storage RW\shwicon.exe
c:\windows\ALCXMNTR.EXE
c:\windows\ehome\ehmsas.exe
.
**************************************************************************
.
Completion time: 2013-09-10 10:56:16 - machine was rebooted
ComboFix-quarantined-files.txt 2013-09-10 14:56
ComboFix2.txt 2013-09-06 20:06
.
Pre-Run: 83,759,546,368 bytes free
Post-Run: 83,859,320,832 bytes free
.
- - End Of File - - E02CFC4FB8DDB251B6C4687FFB758798
B716B775FCBDABF0E2DDFF76F15C6790
Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org
Database version: v2013.09.10.08
Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
Administrator :: BREEZEWAY [administrator]
9/10/2013 1:33:40 PM
mbam-log-2013-09-10 (13-33-40).txt
Scan type: Full scan (A:\|C:\|D:\|E:\|F:\|G:\|H:\|I:\|J:\|L:\|)
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 412232
Time elapsed: 4 hour(s), 51 minute(s), 41 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 15
HKCR\CLSID\{F0F12903-DE76-4DF7-BCDC-0A0689151189} (PUP.Optional.SafeValet.A) -> Quarantined and deleted successfully.
HKCR\TypeLib\{B0F8BFBD-05D3-4ECB-B753-010DFB738018} (PUP.Optional.SafeValet.A) -> Quarantined and deleted successfully.
HKCR\Interface\{9F7412D3-8CC2-45E6-84CB-62BB22747E01} (PUP.Optional.SafeValet.A) -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F0F12903-DE76-4DF7-BCDC-0A0689151189} (PUP.Optional.SafeValet.A) -> Quarantined and deleted successfully.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{F0F12903-DE76-4DF7-BCDC-0A0689151189} (PUP.Optional.SafeValet.A) -> Quarantined and deleted successfully.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{F0F12903-DE76-4DF7-BCDC-0A0689151189} (PUP.Optional.SafeValet.A) -> Quarantined and deleted successfully.
HKCR\AppID\{D616A4A2-7B38-4DBC-9093-6FE7A4A21B17} (PUP.Optional.Wajam.A) -> Quarantined and deleted successfully.
HKCR\CLSID\{D824F0DE-3D60-4F57-9EB1-66033ECD8ABB} (PUP.Optional.WeCare.A) -> Quarantined and deleted successfully.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{D824F0DE-3D60-4F57-9EB1-66033ECD8ABB} (PUP.Optional.WeCare.A) -> Quarantined and deleted successfully.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{D824F0DE-3D60-4F57-9EB1-66033ECD8ABB} (PUP.Optional.WeCare.A) -> Quarantined and deleted successfully.
HKLM\SOFTWARE\{6791A2F3-FC80-475C-A002-C014AF797E9C} (PUP.Optional.OptimzerPro.A) -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{11111111-1111-1111-1111-110211621178} (PUP.Optional.Crossrider) -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SETUP.EXE (PUP.Optional.Ibryte) -> Quarantined and deleted successfully.
HKCU\Software\SocialBit\IE\SaveValet (PUP.Optional.SaveValet.A) -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SaveValet_IE (PUP.Optional.SaveValet.A) -> Quarantined and deleted successfully.
Registry Values Detected: 0
(No malicious items detected)
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 2
C:\Documents and Settings\Administrator\My Documents\Optimizer Pro (PUP.Optional.OptimizerPro.A) -> Quarantined and deleted successfully.
C:\Program Files\SaveValet\ie (PUP.Optional.SaveValet.A) -> Quarantined and deleted successfully.
Files Detected: 14
C:\Program Files\SaveValet\ie\SaveValetIE_32.dll (PUP.Optional.SafeValet.A) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrator\Local Settings\temp\Optimizer_Pro.exe (PUP.Optional.1ClickDownload.A) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\2FMTJ16G\OptimizerPro[1].exe (PUP.Optional.OptimizePro.A) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\NW41H1FF\Install_SaveValet_ie[1] (PUP.Optional.SafeValet.A) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\QOKMPAKL\Setup[1].exe (PUP.Optional.IBryte) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrator\My Documents\Downloads\setup (1).exe (PUP.Optional.InstallCore.A) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrator\My Documents\Downloads\Setup.exe (PUP.Optional.Ibryte) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrator\My Documents\Downloads\gimp_freely_d157195.exe (PUP.Optional.InstallIQ.A) -> Quarantined and deleted successfully.
C:\Program Files\SaveValet\ie\SaveValetIE_64.dll (PUP.Optional.SafeValet.A) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{DAC9DB1F-8BEF-451E-AB3B-6A67094EA198}\RP4\A0000466.rbf (PUP.Optional.WeCare.A) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{DAC9DB1F-8BEF-451E-AB3B-6A67094EA198}\RP4\A0000467.rbf (PUP.Optional.WeCare.A) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrator\My Documents\Optimizer Pro\CookiesException.txt (PUP.Optional.OptimizerPro.A) -> Quarantined and deleted successfully.
C:\Program Files\SaveValet\ie\sci_options.xml (PUP.Optional.SaveValet.A) -> Quarantined and deleted successfully.
C:\Program Files\SaveValet\ie\uninstaller.exe (PUP.Optional.SaveValet.A) -> Quarantined and deleted successfully.
(end)