Malwarebytes Anti-Malware www.malwarebytes.org Scan Date: 3/20/2017 Scan Time: 5:18:38 PM Logfile: MBAM scan log.txt Administrator: Yes Version: 2.01.4.1018 Malware Database: v2017.03.20.08 Rootkit Database: v2017.03.11.01 License: Premium Malware Protection: Enabled Malicious Website Protection: Enabled Self-protection: Disabled OS: Windows Vista Service Pack 2 CPU: x86 File System: NTFS User: KLUCAS Scan Type: Threat Scan Result: Completed Objects Scanned: 267796 Time Elapsed: 14 min, 52 sec Memory: Enabled Startup: Enabled Filesystem: Enabled Archives: Enabled Rootkits: Enabled Heuristics: Enabled PUP: Enabled PUM: Enabled Processes: 0 (No malicious items detected) Modules: 0 (No malicious items detected) Registry Keys: 3 PUP.Optional.Reimage, HKLM\SOFTWARE\CLASSES\REI_AxControl.ReiEngine, Quarantined, [f4545c705553b086cabcfe5efe02b848], PUP.Optional.Reimage, HKLM\SOFTWARE\CLASSES\REI_AxControl.ReiEngine.1, Quarantined, [78d012bac9df72c48402b2aa837d738d], PUP.Optional.MySearchDial, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{560B9BE3-5B6C-4953-BDFB-1DB93EAE8F90}, Delete-on-Reboot, [a3a58547406862d4b382abcc06faed13], Registry Values: 1 PUP.Optional.MySearchDial, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{560B9BE3-5B6C-4953-BDFB-1DB93EAE8F90}|Path, \MySearchDial, Delete-on-Reboot, [a3a58547406862d4b382abcc06faed13] Registry Data: 0 (No malicious items detected) Folders: 0 (No malicious items detected) Files: 50 PUP.Optional.MySearchDial, C:\Users\KLUCAS\AppData\Roaming\Mozilla\Firefox\Profiles\0uxde7hp.default\prefs.js, Good: (), Bad: (user_pref("extensions.mysearchdial.AL", 2);), Replaced,[7bcde3e90c9c2f07ab82b497d52f37c9] PUP.Optional.MySearchDial, C:\Users\KLUCAS\AppData\Roaming\Mozilla\Firefox\Profiles\0uxde7hp.default\prefs.js, Good: (), Bad: (ser Preferences /* Do not edit this file. * * If you ma), Replaced,[58f0715b9e0af046929b63e8a65e07f9] PUP.Optional.MySearchDial, C:\Users\KLUCAS\AppData\Roaming\Mozilla\Firefox\Profiles\0uxde7hp.default\prefs.js, Good: (), Bad: (/* Do not edit this file. * * If you make changes to this file while the applicat), Replaced,[1b2d8f3d7b2db581092491ba3fc5e11f] PUP.Optional.MySearchDial, C:\Users\KLUCAS\AppData\Roaming\Mozilla\Firefox\Profiles\0uxde7hp.default\prefs.js, Good: (), Bad: (e. * * If you make changes to this file while the application is running, * the changes will be overwritten when the application exits. * * To make a ), Replaced,[78d0a02c32766ccaf13c1e2dbf452ed2] PUP.Optional.MySearchDial, C:\Users\KLUCAS\AppData\Roaming\Mozilla\Firefox\Profiles\0uxde7hp.default\prefs.js, Good: (), Bad: (g, * the changes will be overwritten when the appl), Replaced,[dc6c973506a2e056c766be8d53b11be5] PUP.Optional.MySearchDial, C:\Users\KLUCAS\AppData\Roaming\Mozilla\Firefox\Profiles\0uxde7hp.default\prefs.js, Good: (), Bad: (rences /* Do not edit this file. * * If yo), Replaced,[1d2bdfed9810da5ce449024951b3936d] PUP.Optional.MySearchDial, C:\Users\KLUCAS\AppData\Roaming\Mozilla\Firefox\Profiles\0uxde7hp.default\prefs.js, Good: (), Bad: (eferences /* Do not edit this file. * * If yo), Replaced,[f355f1db2d7bce68a885a0abf311a060] PUP.Optional.MySearchDial, C:\Users\KLUCAS\AppData\Roaming\Mozilla\Firefox\Profiles\0uxde7hp.default\prefs.js, Good: (), Bad: (rences /* Do not edit this file. * * If you), Replaced,[0d3b25a77830cf67002dd774907421df] PUP.Optional.MySearchDial, C:\Users\KLUCAS\AppData\Roaming\Mozilla\Firefox\Profiles\0uxde7hp.default\prefs.js, Good: (), Bad: (ferences /* Do not edit this file. * * If you), Replaced,[fb4d4a8295131620d558ff4c24e08878] PUP.Optional.MySearchDial, C:\Users\KLUCAS\AppData\Roaming\Mozilla\Firefox\Profiles\0uxde7hp.default\prefs.js, Good: (), Bad: (rences /* Do not edit this file. * * If you make chan), Replaced,[c68209c36246d75f74b91734e91ba060] PUP.Optional.MySearchDial, C:\Users\KLUCAS\AppData\Roaming\Mozilla\Firefox\Profiles\0uxde7hp.default\prefs.js, Good: (), Bad: ( /* Do not edit this file. * * If you make changes), Replaced,[0f3955778f1951e5ed40e368d72d4cb4] PUP.Optional.MySearchDial, C:\Users\KLUCAS\AppData\Roaming\Mozilla\Firefox\Profiles\0uxde7hp.default\prefs.js, Good: (), Bad: (ces /* Do not edit this file. * * If you make chang), Replaced,[4ff9616bd1d7da5c1c11410af0145aa6] PUP.Optional.MySearchDial, C:\Users\KLUCAS\AppData\Roaming\Mozilla\Firefox\Profiles\0uxde7hp.default\prefs.js, Good: (), Bad: ( /* Do not edit this file. * * If you make changes to this file while the application is running, * the changes will be overwritten when the application exits. * * To make a manual change to preferences, you can visit the URL a), Replaced,[be8a9537e3c506305ecf59f2e71d18e8] PUP.Optional.MySearchDial, C:\Users\KLUCAS\AppData\Roaming\Mozilla\Firefox\Profiles\0uxde7hp.default\prefs.js, Good: (), Bad: (ke a manual change to preferences, you can visit the URL ab), Replaced,[a0a8b913ebbd16204edf1932eb194db3] PUP.Optional.MySearchDial, C:\Users\KLUCAS\AppData\Roaming\Mozilla\Firefox\Profiles\0uxde7hp.default\prefs.js, Good: (), Bad: ( /* Do not edit this file. * * If you make changes to t), Replaced,[d672f0dcb8f0092d3af31d2ed52fa15f] PUP.Optional.MySearchDial, C:\Users\KLUCAS\AppData\Roaming\Mozilla\Firefox\Profiles\0uxde7hp.default\prefs.js, Good: (), Bad: ( /* Do not edit this file. * * If you make changes to this ), Replaced,[1434b11b6b3d7db98ca168e3fc085aa6] PUP.Optional.MySearchDial, C:\Users\KLUCAS\AppData\Roaming\Mozilla\Firefox\Profiles\0uxde7hp.default\prefs.js, Good: (), Bad: (* Do not edit this file. * * If you make changes), Replaced,[55f3a626dfc983b3a28b5fec62a22fd1] PUP.Optional.MySearchDial, C:\Users\KLUCAS\AppData\Roaming\Mozilla\Firefox\Profiles\0uxde7hp.default\prefs.js, Good: (), Bad: (rences /* Do not edit this file. * * If you make changes to this file while the application is running, * the changes will be overwritten when the application exits. * * To make a manual change to preferences, you can visit the URL ), Replaced,[63e543893b6dbc7adb525eed030146ba] PUP.Optional.MySearchDial, C:\Users\KLUCAS\AppData\Roaming\Mozilla\Firefox\Profiles\0uxde7hp.default\prefs.js, Good: (), Bad: (manual change to preferences, you can visit the URL ab), Replaced,[b890c309beea0a2cd25b0b40ac58f808] PUP.Optional.MySearchDial, C:\Users\KLUCAS\AppData\Roaming\Mozilla\Firefox\Profiles\0uxde7hp.default\prefs.js, Good: (), Bad: (nces /* Do not edit this file. * * If you make c), Replaced,[b7916d5f64443ff79a9371da6b99e31d] PUP.Optional.MySearchDial, C:\Users\KLUCAS\AppData\Roaming\Mozilla\Firefox\Profiles\0uxde7hp.default\prefs.js, Good: (), Bad: (ces /* Do not edit this file. * * If you make ), Replaced,[9fa974589f094beb54d96ae16e96f30d] PUP.Optional.MySearchDial, C:\Users\KLUCAS\AppData\Roaming\Mozilla\Firefox\Profiles\0uxde7hp.default\prefs.js, Good: (), Bad: (ences /* Do not edit this file. * * If you make ), Replaced,[86c28f3deabec76f0a232f1ce024ad53] PUP.Optional.MySearchDial, C:\Users\KLUCAS\AppData\Roaming\Mozilla\Firefox\Profiles\0uxde7hp.default\prefs.js, Good: (), Bad: (ces /* Do not edit this file. * * If you make changes to th), Replaced,[f85095370f9953e3dd50e764b64e966a] PUP.Optional.MySearch, C:\Users\KLUCAS\AppData\Roaming\Mozilla\Firefox\Profiles\0uxde7hp.default\user.js, Good: (), Bad: (user_pref("extensions.irmysearch.cr", "11564551");), Replaced,[e068a02c8d1b0b2bc06c29222adace32] PUP.Optional.MySearch, C:\Users\KLUCAS\AppData\Roaming\Mozilla\Firefox\Profiles\0uxde7hp.default\user.js, Good: (), Bad: (sions.irmysearch.cr", "11564551"); user_pref("extensions.irmysearch.cd", "2XzuyEtN2Y1L1QzutDtDtC0DtDzy0AtD0F0FyBtB0CtDyC0BtN0D0Tzu0SzztBzytN1L2Xzu0BtG0CtBzyt), Replaced,[6eda5973b8f0092d31fb4ffc64a01ce4] PUP.Optional.MySearchDial, C:\Users\KLUCAS\AppData\Roaming\Mozilla\Firefox\Profiles\0uxde7hp.default\user.js, Good: (), Bad: (user_pref("extensions.mysearchdial.dfltSrch", true);), Replaced,[9aae626a594ffb3b4be315360cf831cf] PUP.Optional.MySearchDial, C:\Users\KLUCAS\AppData\Roaming\Mozilla\Firefox\Profiles\0uxde7hp.default\user.js, Good: (), Bad: (sions.irmysearch.cr", "11564551"); user_pref("extensions.irmys), Replaced,[ea5e38949e0a6ec8141ac685c73d4fb1] PUP.Optional.MySearchDial, C:\Users\KLUCAS\AppData\Roaming\Mozilla\Firefox\Profiles\0uxde7hp.default\user.js, Good: (), Bad: (earch.cr", "11564551"); user_pref("extensions.irm), Replaced,[fa4ea4284e5a7fb7a985b497d82cdd23] PUP.Optional.MySearchDial, C:\Users\KLUCAS\AppData\Roaming\Mozilla\Firefox\Profiles\0uxde7hp.default\user.js, Good: (), Bad: (ensions.irmysearch.cr", "11564551"); user_pref("exte), Replaced,[67e1a92316920333101ee5663aca18e8] PUP.Optional.MySearchDial, C:\Users\KLUCAS\AppData\Roaming\Mozilla\Firefox\Profiles\0uxde7hp.default\user.js, Good: (), Bad: (ions.irmysearch.cr", "11564551"); user_pref("extensions.irmysearch.cd", "2XzuyEtN2Y1L1QzutDtDtC0DtDzy0AtD0F0FyBtB0CtDyC0BtN0D0Tzu0SzztBzytN1L2Xzu0BtG0CtBzytBtGyD0CtC0BtGyCyBtBtA0Byz0EyD0D2Q"); user_pref("extensions.mysearchdial.dfltSr), Replaced,[5fe9c507c0e849ed6fbfcf7c6a9ad12f] PUP.Optional.MySearchDial, C:\Users\KLUCAS\AppData\Roaming\Mozilla\Firefox\Profiles\0uxde7hp.default\user.js, Good: (), Bad: (D2Q"); user_pref("extensions.mysearchdial.dfltSrch", true); user_pref("extensions.mysearchdial.srchPrvdr", "Mysearchdial"); user_pref("extensions.mysearchdial.dnsErr", true); user_pref("extensions.mysearchdial_i.newTab", false); user_pr), Replaced,[2b1d6666dace7fb7210d341713f15ea2] PUP.Optional.MySearchDial, C:\Users\KLUCAS\AppData\Roaming\Mozilla\Firefox\Profiles\0uxde7hp.default\user.js, Good: (), Bad: (; user_pref("extensions.mysearchdial.dfltSrch", true); ), Replaced,[2226804cfbad6dc9092556f574909a66] PUP.Optional.MySearchDial, C:\Users\KLUCAS\AppData\Roaming\Mozilla\Firefox\Profiles\0uxde7hp.default\user.js, Good: (), Bad: (mysearch.cr", "11564551"); user_pref("extensions.irmys), Replaced,[3a0ef4d8bbed73c355d9b398679d1de3] PUP.Optional.MySearchDial, C:\Users\KLUCAS\AppData\Roaming\Mozilla\Firefox\Profiles\0uxde7hp.default\user.js, Good: (), Bad: (ns.irmysearch.cr", "11564551"); user_pref("extensions), Replaced,[9dab8d3f5a4ec07673bb63e88d7748b8] PUP.Optional.MySearchDial, C:\Users\KLUCAS\AppData\Roaming\Mozilla\Firefox\Profiles\0uxde7hp.default\user.js, Good: (), Bad: (ons.irmysearch.cr", "11564551"); user_pref("extensions), Replaced,[f7515b712e7a4aece14d4efd4cb80ff1] PUP.Optional.MySearchDial, C:\Users\KLUCAS\AppData\Roaming\Mozilla\Firefox\Profiles\0uxde7hp.default\user.js, Good: (), Bad: (ns.irmysearch.cr", "11564551"); user_pref("extensions.irmysearch.), Replaced,[23255b71decaf541bd71d279b64ea25e] PUP.Optional.MySearchDial, C:\Users\KLUCAS\AppData\Roaming\Mozilla\Firefox\Profiles\0uxde7hp.default\user.js, Good: (), Bad: (ch.cr", "11564551"); user_pref("extensions.irmysearch.cd", "), Replaced,[1f29f8d4624673c361cd08431de79c64] PUP.Optional.MySearchDial, C:\Users\KLUCAS\AppData\Roaming\Mozilla\Firefox\Profiles\0uxde7hp.default\user.js, Good: (), Bad: (ysearch.cr", "11564551"); user_pref("extensions.irmysearch), Replaced,[fc4c1ab26b3d1620220cc18a15ef6a96] PUP.Optional.MySearchDial, C:\Users\KLUCAS\AppData\Roaming\Mozilla\Firefox\Profiles\0uxde7hp.default\user.js, Good: (), Bad: (rmysearch.cr", "11564551"); user_pref("extensions.irmysearch.), Replaced,[ae9ab9137b2de254b37b71da90745ca4] PUP.Optional.MySearchDial, C:\Users\KLUCAS\AppData\Roaming\Mozilla\Firefox\Profiles\0uxde7hp.default\user.js, Good: (), Bad: (search.cr", "11564551"); user_pref("extensions.irmysea), Replaced,[232574582484de58c866a0abcd379868] PUP.Optional.MySearchDial, C:\Users\KLUCAS\AppData\Roaming\Mozilla\Firefox\Profiles\0uxde7hp.default\user.js, Good: (), Bad: (ns.irmysearch.cr", "11564551"); user_pref("extensio), Replaced,[63e5913bb0f80a2c63cb89c2c73d08f8] PUP.Optional.MySearchDial, C:\Users\KLUCAS\AppData\Roaming\Mozilla\Firefox\Profiles\0uxde7hp.default\user.js, Good: (), Bad: (sions.irmysearch.cr", "11564551"); user_pref("extensions.), Replaced,[5bed8d3f0c9c61d5e648c388000448b8] PUP.Optional.MySearchDial, C:\Users\KLUCAS\AppData\Roaming\Mozilla\Firefox\Profiles\0uxde7hp.default\user.js, Good: (), Bad: (irmysearch.cr", "11564551"); user_pref("extensio), Replaced,[b1974e7e9d0b0d2979b5c9824eb69a66] PUP.Optional.MySearchDial, C:\Users\KLUCAS\AppData\Roaming\Mozilla\Firefox\Profiles\0uxde7hp.default\user.js, Good: (), Bad: (tensions.irmysearch.cr", "11564551"); user_pref("extensions.irmysearch.cd", "2XzuyEt), Replaced,[fc4c8b41b9ef4cea59d56dde9c68d729] PUP.Optional.MySearchDial, C:\Users\KLUCAS\AppData\Roaming\Mozilla\Firefox\Profiles\0uxde7hp.default\user.js, Good: (), Bad: (; user_pref("extensions.irmysearch.cd", "2XzuyEtN2Y), Replaced,[84c46e5eddcbde58101e2a210bf927d9] PUP.Optional.MySearchDial, C:\Users\KLUCAS\AppData\Roaming\Mozilla\Firefox\Profiles\0uxde7hp.default\user.js, Good: (), Bad: (sions.irmysearch.cr", "11564551"); user_pref("exten), Replaced,[7fc99834e0c80234ec4295b660a49b65] PUP.Optional.MySearchDial, C:\Users\KLUCAS\AppData\Roaming\Mozilla\Firefox\Profiles\0uxde7hp.default\user.js, Good: (), Bad: (sions.irmysearch.cr", "11564551"); user_pref("extensions.irmysearch.cd", "2XzuyEtN2Y1L1QzutDtDtC0DtDzy0AtD0F0FyBtB0CtDyC0BtN0D0Tzu0SzztBzytN1L2Xzu0BtG0CtBzytBt), Replaced,[e8608c402c7c46f01d11e368c63e4eb2] PUP.Optional.MySearchDial, C:\Users\KLUCAS\AppData\Roaming\Mozilla\Firefox\Profiles\0uxde7hp.default\user.js, Good: (), Bad: (F0FyBtB0CtDyC0BtN0D0Tzu0SzztBzytN1L2Xzu0BtG), Replaced,[73d5b71504a4f145939b16358e76ab55] PUP.Optional.MySearchDial, C:\Users\KLUCAS\AppData\Roaming\Mozilla\Firefox\Profiles\0uxde7hp.default\user.js, Good: (), Bad: (user_pref("extensions.mysearchdial.newTabUrl", "http://start.mysearchdial.com/?f=2&a=dnldstr_14_15_ff&cd=2XzuyEtN2Y1L1QzutDtDtC0DtDzy0AtD0F0FyBtB0CtDyC0BtN0D0Tzu0SzztBzytN1L2Xzu0BtG0CtBzytBtGyD0CtC0BtGyCyBtBtA0Byz0EyD0D2Q&cr=11564551&ir=");), Replaced,[2b1d7359f6b22c0af53a1833b54f08f8] PUP.Optional.MySearchDial, C:\Users\KLUCAS\AppData\Roaming\Mozilla\Firefox\Profiles\0uxde7hp.default\user.js, Good: (), Bad: (zu0BtG0CtBzytBtGyD0CtC0BtGyCyBtBtA0Byz0EyD0D2Q"); user_pref("extensions.mysearchdial.dfltSrch", true); user_pref("extensions.mysearchdial.srchPrvdr", "Mysearchdial"); user_pref("extensions.mysearchdial.dnsErr", true); user_pref("extensio), Replaced,[b8909e2e693f91a577b86dde8381b14f] Physical Sectors: 0 (No malicious items detected) (end)