Malwarebytes Anti-Rootkit BETA 1.10.3.1001 www.malwarebytes.org Database version: main: v2017.12.05.01 rootkit: v2017.10.14.01 Windows 10 x64 NTFS Internet Explorer 11.1770.14393.0 Amy :: AMYSCOMPUTER [administrator] 05/12/2017 01:52:30 mbar-log-2017-12-05 (01-52-30).txt Scan type: Quick scan Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken Scan options disabled: Objects scanned: 217807 Time elapsed: 33 minute(s), 16 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 8 C:\WINDOWS\SYSTEM32\drivers\winfinsv.sys (Rootkit.Agent.PUA) -> Delete on reboot. [7197bf172470e4199b8ce2576c0ed3da] C:\WINDOWS\SYSTEM32\drivers\msidntfs.sys (Rootkit.Agent.PUA) -> Delete on reboot. [2e5a88d8f70f711724c62e2d3af6aba1] C:\Program Files (x86)\s5\u.exe (Adware.Yelloader) -> Delete on reboot. [b83d67bea604f93d3aeda8fe669b728e] C:\Users\Amy\AppData\Local\ctftvqe\ctftvqe.exe (Trojan.Agent) -> Delete on reboot. [6b8a50d5efbb4ee8326f883ba45da15f] C:\Users\Amy\AppData\Local\ctftvqe\ctfvnce.exe (Adware.Yelloader) -> Delete on reboot. [2ec751d466443bfb953836fba35ece32] C:\Users\Amy\AppData\Local\fxaaefa\qqllgdce\ct.exe (Trojan.Clicker) -> Delete on reboot. [3db8bd685357330361f6ec9bf908629e] C:\Windows\System32\config\systemprofile\AppData\Local\ctftvqe\ctftvqe.exe (Trojan.Agent) -> Delete on reboot. [a64f9d88f1b993a3c7dadfe4eb1652ae] C:\Windows\System32\config\systemprofile\AppData\Local\ctftvqe\ctfvnce.exe (Adware.Yelloader) -> Delete on reboot. [26cf988de5c58caaeae34ce5d130867a] Physical Sectors Detected: 0 (No malicious items detected) (end)