Jump to content

Welcome to Geeks to Go
Geeks to Go Welcome
Create Account Login to Account
Photo

Removal instructions for Poup Alerta

- - - - -

  • Please log in to reply
No replies to this topic

#1
Metallica

Metallica

    Spyware Veteran

  • GeekU Moderator
  • 33,053 posts
What is Poup Alerta?
 
The Malwarebytes research team has determined that Poup Alerta is a browser hijacker. These so-called "hijackers" manipulate your browser(s), for example to change your startpage or searchscopes, so that the affected browser visits their site or one of their choice. This one also displays advertisements.
 
How do I know if my computer is affected by Poup Alerta?

This is how the start-page looks:

main.png

You may see these browser extensions/add-ons:
 
warning1.png
 
warning2.png

this icon next in your Internet Explorer and Firefox toolbars:

icons.png

and this entry in your list of installed programs:
 
warning4.png
 
 
How did Poup Alerta get on my computer?
 
Browser hijackers use different methods for distributing themselves. This particular one was bundled with other software.
 
How do I remove Poup Alerta?
 
Our program Malwarebytes Anti-Malware can detect and remove this potentially unwanted application.
  • Please download Malwarebytes Anti-Malware to your desktop.
  • Double-click mbam-setup-version.exe and follow the prompts to install the program.
  • At the end, be sure a check-mark is placed next to the following:
    • Enable free trial of Malwarebytes Anti-Malware Premium
    • Launch Malwarebytes Anti-Malware
  • Then click Finish.
  • If an update is found, you will be prompted to download and install the latest version.
  • Once the program has loaded, select Scan now. Or select the Threat Scan from the Scan menu.
  • When the scan is complete , make sure that everything is set to "Quarantine", and click Apply Actions.
  • Reboot your computer if prompted.
Is there anything else I need to do to get rid of Poup Alerta?
  • No, Malwarebytes' Anti-Malware removes Poup Alerta completely.
How would the full version of Malwarebytes Anti-Malware help protect me?
 
We hope our application and this guide have helped you eradicate this hijacker.  
 
As you can see below the full version of Malwarebytes Anti-Malware would have protected you against the Poup Alerta hijacker.  It would have warned you before the rogue could install itself, giving you a chance to stop it before it became too late.
 

protection1.png


Technical details for experts
 
Signs in a HijackThis log:


O2 - BHO: CrossriderApp0013428 - {11111111-1111-1111-1111-110111341128} - C:\Program Files\Poup Alerta\Poup Alerta-bho.dll
 
Alterations made by the installer:
 
File system details  
---------------------------------------------
    Adds the folder C:\Program Files\Poup Alerta
       Adds the file 13428.xpi"="9/19/2014 8:53 AM, 322802 bytes, A
       Adds the file 675ca14b-1e77-4813-9f07-d293b015297c-2.exe"="9/19/2014 8:54 AM, 336480 bytes, A
       Adds the file 675ca14b-1e77-4813-9f07-d293b015297c-4.exe"="9/19/2014 8:53 AM, 798816 bytes, A
       Adds the file 675ca14b-1e77-4813-9f07-d293b015297c-5.exe"="9/19/2014 8:54 AM, 323680 bytes, A
       Adds the file background.html"="3/27/2014 4:06 PM, 729 bytes, A
       Adds the file Poup Alerta.ico"="3/27/2014 4:06 PM, 9662 bytes, A
       Adds the file Poup Alerta-bg.exe"="9/19/2014 8:54 AM, 596064 bytes, A
       Adds the file Poup Alerta-bho.dll"="9/19/2014 8:54 AM, 526432 bytes, A
       Adds the file Poup Alerta-buttonutil.dll"="9/19/2014 8:53 AM, 352864 bytes, A
       Adds the file Poup Alerta-buttonutil.exe"="9/19/2014 8:53 AM, 260192 bytes, A
       Adds the file Poup Alerta-codedownloader.exe"="9/19/2014 8:53 AM, 479840 bytes, A
       Adds the file Uninstall.exe"="9/19/2014 8:53 AM, 80480 bytes, A
       Adds the file utils.exe"="9/19/2014 8:53 AM, 1102186 bytes, A
    Adds the folder C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com
    Adds the folder C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\chrome\content
    Adds the folder C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\chrome\content\api
    Adds the folder C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\chrome\content\core
    Adds the folder C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\defaults\preferences
       Adds the file prefs.js"="9/19/2014 8:53 AM, 2174 bytes, A
    Adds the folder C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\extensionData
       Adds the file manifest.xml"="9/19/2014 8:53 AM, 1937 bytes, A
       Adds the file plugins.json"="9/19/2014 8:53 AM, 5623 bytes, A
    Adds the folder C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\extensionData\plugins
    Adds the folder C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\extensionData\userCode
    Adds the folder C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\locale\en-US
       Adds the file translations.dtd"="9/19/2014 8:53 AM, 425 bytes, A
    Adds the folder C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\skin
    In the existing folder C:\Windows\System32\Tasks
       Adds the file 675ca14b-1e77-4813-9f07-d293b015297c-1"="9/19/2014 8:54 AM, 4524 bytes, A
       Adds the file 675ca14b-1e77-4813-9f07-d293b015297c-2"="9/19/2014 8:54 AM, 4442 bytes, A
       Adds the file 675ca14b-1e77-4813-9f07-d293b015297c-4"="9/19/2014 8:53 AM, 5314 bytes, A
       Adds the file 675ca14b-1e77-4813-9f07-d293b015297c-5"="9/19/2014 8:54 AM, 4618 bytes, A
    In the existing folder C:\Windows\Tasks
       Adds the file 675ca14b-1e77-4813-9f07-d293b015297c-1.job"="9/19/2014 8:53 AM, 1494 bytes, A
       Adds the file 675ca14b-1e77-4813-9f07-d293b015297c-2.job"="9/19/2014 8:54 AM, 1412 bytes, A
       Adds the file 675ca14b-1e77-4813-9f07-d293b015297c-4.job"="9/19/2014 8:53 AM, 2284 bytes, A
       Adds the file 675ca14b-1e77-4813-9f07-d293b015297c-5.job"="9/19/2014 8:54 AM, 1588 bytes, A

Registry details  
------------------------------------------
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11111111-1111-1111-1111-110111341128}]
       "(Default)"="REG_SZ", "Poup Alerta"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11111111-1111-1111-1111-110111341128}\Implemented Categories]
       "(Default)"="REG_SZ", ""
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11111111-1111-1111-1111-110111341128}\Implemented Categories\{59fb2056-d625-48d0-a944-1a85b5ab2640}]
       "(Default)"="REG_SZ", ""
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11111111-1111-1111-1111-110111341128}\InprocServer32]
       "(Default)"="REG_SZ", "C:\Program Files\Poup Alerta\Poup Alerta-bho.dll"
       "ThreadingModel"="REG_SZ", "Apartment"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11111111-1111-1111-1111-110111341128}\ProgID]
       "(Default)"="REG_SZ", "CrossriderApp0013428.BHO.1"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11111111-1111-1111-1111-110111341128}\Programmable]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11111111-1111-1111-1111-110111341128}\TypeLib]
       "(Default)"="REG_SZ", "{44444444-4444-4444-4444-440144344428}"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11111111-1111-1111-1111-110111341128}\VersionIndependentProgID]
       "(Default)"="REG_SZ", "CrossriderApp0013428"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{22222222-2222-2222-2222-220122342228}]
       "(Default)"="REG_SZ", "CrossriderApp0013428.Sandbox"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{22222222-2222-2222-2222-220122342228}\InprocServer32]
       "(Default)"="REG_SZ", "C:\Program Files\Poup Alerta\Poup Alerta-bho.dll"
       "ThreadingModel"="REG_SZ", "Apartment"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{22222222-2222-2222-2222-220122342228}\ProgID]
       "(Default)"="REG_SZ", "CrossriderApp0013428.Sandbox.1"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{22222222-2222-2222-2222-220122342228}\Programmable]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{22222222-2222-2222-2222-220122342228}\TypeLib]
       "(Default)"="REG_SZ", "{44444444-4444-4444-4444-440144344428}"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{22222222-2222-2222-2222-220122342228}\VersionIndependentProgID]
       "(Default)"="REG_SZ", "CrossriderApp0013428.Sandbox"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CrossriderApp0013428.BHO]
       "(Default)"="REG_SZ", "CrossriderApp0013428"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CrossriderApp0013428.BHO\CLSID]
       "(Default)"="REG_SZ", "{11111111-1111-1111-1111-110111341128}"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CrossriderApp0013428.BHO\CurVer]
       "(Default)"="REG_SZ", "CrossriderApp0013428"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CrossriderApp0013428.BHO.1]
       "(Default)"="REG_SZ", "CrossriderApp0013428"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CrossriderApp0013428.BHO.1\CLSID]
       "(Default)"="REG_SZ", "{11111111-1111-1111-1111-110111341128}"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CrossriderApp0013428.Sandbox]
       "(Default)"="REG_SZ", "CrossriderApp0013428.Sandbox"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CrossriderApp0013428.Sandbox\CLSID]
       "(Default)"="REG_SZ", "{22222222-2222-2222-2222-220122342228}"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CrossriderApp0013428.Sandbox\CurVer]
       "(Default)"="REG_SZ", "CrossriderApp0013428.Sandbox"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CrossriderApp0013428.Sandbox.1]
       "(Default)"="REG_SZ", "CrossriderApp0013428.Sandbox"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CrossriderApp0013428.Sandbox.1\CLSID]
       "(Default)"="REG_SZ", "{22222222-2222-2222-2222-220122342228}"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{55555555-5555-5555-5555-550155345528}]
       "(Default)"="REG_SZ", "ICrossriderBHO"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{55555555-5555-5555-5555-550155345528}\ProxyStubClsid]
       "(Default)"="REG_SZ", "{00020424-0000-0000-C000-000000000046}"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{55555555-5555-5555-5555-550155345528}\ProxyStubClsid32]
       "(Default)"="REG_SZ", "{00020424-0000-0000-C000-000000000046}"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{55555555-5555-5555-5555-550155345528}\TypeLib]
       "(Default)"="REG_SZ", "{44444444-4444-4444-4444-440144344428}"
       "Version"="REG_SZ", "1.0"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660166346628}]
       "(Default)"="REG_SZ", "ISandBox"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660166346628}\ProxyStubClsid]
       "(Default)"="REG_SZ", "{00020424-0000-0000-C000-000000000046}"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660166346628}\ProxyStubClsid32]
       "(Default)"="REG_SZ", "{00020424-0000-0000-C000-000000000046}"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660166346628}\TypeLib]
       "(Default)"="REG_SZ", "{44444444-4444-4444-4444-440144344428}"
       "Version"="REG_SZ", "1.0"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{44444444-4444-4444-4444-440144344428}\1.0]
       "(Default)"="REG_SZ", "CrossriderApp0013428 Type Library"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{44444444-4444-4444-4444-440144344428}\1.0\0\win32]
       "(Default)"="REG_SZ", "C:\Program Files\Poup Alerta\Poup Alerta-bho.dll"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{44444444-4444-4444-4444-440144344428}\1.0\FLAGS]
       "(Default)"="REG_SZ", "0"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{44444444-4444-4444-4444-440144344428}\1.0\HELPDIR]
       "(Default)"="REG_SZ", "C:\Program Files\Poup Alerta"
    [HKEY_LOCAL_MACHINE\SOFTWARE\InstalledBrowserExtensions\8088]
       "13428"="REG_SZ", "Poup Alerta"
    [HKEY_LOCAL_MACHINE\SOFTWARE\InstalledBrowserExtensions\8088\Status]
       "Installed"="REG_DWORD", 1
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11111111-1111-1111-1111-110111341128}]
       "(Default)"="REG_SZ", "CrossriderApp0013428"
       "NoExplorer"="REG_DWORD", 1
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID]
       "{11111111-1111-1111-1111-110111341128}"="REG_SZ", "1"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Poup Alerta]
       "CrAppId"="REG_SZ", "13428"
       "CrPublisherId"="REG_SZ", "8088"
       "DisplayIcon"="REG_SZ", "C:\Program Files\Poup Alerta\utils.exe"
       "DisplayName"="REG_SZ", "Poup Alerta"
       "DisplayVersion"="REG_SZ", "1.34.3.28"
       "Publisher"="REG_SZ", "Carlos Botelho"
       "UninstallString"="REG_SZ", "C:\Program Files\Poup Alerta\Uninstall.exe /fromcontrolpanel=1"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\CompatibilityAdapter\Signatures]
       "675ca14b-1e77-4813-9f07-d293b015297c-1.job"="REG_BINARY, ................................
       "675ca14b-1e77-4813-9f07-d293b015297c-1.job.fp"="REG_DWORD", 1788631139
       "675ca14b-1e77-4813-9f07-d293b015297c-2.job"="REG_BINARY, ................................
       "675ca14b-1e77-4813-9f07-d293b015297c-2.job.fp"="REG_DWORD", 210330218
       "675ca14b-1e77-4813-9f07-d293b015297c-4.job"="REG_BINARY, ................................
       "675ca14b-1e77-4813-9f07-d293b015297c-4.job.fp"="REG_DWORD", 233740356
       "675ca14b-1e77-4813-9f07-d293b015297c-5.job"="REG_BINARY, ................................
       "675ca14b-1e77-4813-9f07-d293b015297c-5.job.fp"="REG_DWORD", 1278196424
    [HKEY_LOCAL_MACHINE\SOFTWARE\Poup Alerta\Firefox]
       "TotalProfiles"="REG_DWORD", 1
    [HKEY_LOCAL_MACHINE\SOFTWARE\Poup Alerta\Firefox\Profiles]
       "C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835"="REG_DWORD", 1
    [HKEY_LOCAL_MACHINE\SOFTWARE\Poup Alerta\IE]
       "TotalProfiles"="REG_DWORD", 1
    [HKEY_LOCAL_MACHINE\SOFTWARE\Poup Alerta\IE\Profiles]
       "S-1-5-21-4016700205-1717049133-1125222536-1001"="REG_DWORD", 1
    [HKEY_LOCAL_MACHINE\SOFTWARE\Poup Alerta\Installer]
       "BundledFirefox"="REG_DWORD", 1
       "BundledIe"="REG_DWORD", 1
    [HKEY_CURRENT_USER\Software\AppDataLow\Software\Crossrider]
       "Bic"="REG_SZ", "E3BDAA3738C84341A4662C3020928670IE"
       "Verifier"="REG_SZ", "bc2fe4634093a29d33c31f2b413ce2b0"
    [HKEY_CURRENT_USER\Software\AppDataLow\Software\Crossrider\Button]
       "13428"="REG_DWORD", 1
       "Index"="REG_DWORD", 1
    [HKEY_CURRENT_USER\Software\AppDataLow\Software\Crossrider\onBeforeNavigate]
       "13428"="REG_SZ", ""
    [HKEY_CURRENT_USER\Software\AppDataLow\Software\Crossrider\onRequest]
       "13428"="REG_SZ", ""
    [HKEY_CURRENT_USER\Software\AppDataLow\Software\Poup Alerta]
       "ActiveAppId"="REG_SZ", "13428"
       "BhoRunningVersion"="REG_SZ", "153"
       "IsBhoEnabled"="REG_DWORD", 1
       "LastSetSearch"="REG_DWORD", 1411109978
    [HKEY_CURRENT_USER\Software\AppDataLow\Software\Poup Alerta\background]
       " { javascript removed, full log available on request } "
    [HKEY_CURRENT_USER\Software\AppDataLow\Software\Poup Alerta\Update]
       "LastCheck"="REG_DWORD", 1411109633
    [HKEY_CURRENT_USER\Software\InstalledBrowserExtensions\8088]
       "13428"="REG_SZ", "Poup Alerta"
    [HKEY_CURRENT_USER\Software\InstalledBrowserExtensions\8088\Status]
       "Installed"="REG_DWORD", 1
    [HKEY_CURRENT_USER\Software\InstalledBrowserExtensions\Carlos Botelho]
       "13428"="REG_SZ", "Poup Alerta"
    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{11111111-1111-1111-1111-110111341128}]
       "Flags"="REG_DWORD", 1024
 
Malwarebytes Anti-Malware log:
 
Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 9/19/2014
Scan Time: 9:05:14 AM
Logfile: mbamPoupAlert.txt
Administrator: Yes

Version: 2.00.2.1012
Malware Database: v2014.09.19.02
Rootkit Database: v2014.09.18.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows 7 Service Pack 1
CPU: x86
File System: NTFS
User: Malwarebytes

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 267282
Time Elapsed: 3 min, 13 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 20
PUP.Optional.PoupAlerta.A, HKLM\SOFTWARE\CLASSES\CLSID\{11111111-1111-1111-1111-110111341128}, Quarantined, [3c423bb41f5c1323958b5c5fff02e020], 
PUP.Optional.PoupAlerta.A, HKLM\SOFTWARE\CLASSES\TYPELIB\{44444444-4444-4444-4444-440144344428}, Quarantined, [3c423bb41f5c1323958b5c5fff02e020], 
PUP.Optional.PoupAlerta.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{55555555-5555-5555-5555-550155345528}, Quarantined, [3c423bb41f5c1323958b5c5fff02e020], 
PUP.Optional.PoupAlerta.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{66666666-6666-6666-6666-660166346628}, Quarantined, [3c423bb41f5c1323958b5c5fff02e020], 
PUP.Optional.PoupAlerta.A, HKLM\SOFTWARE\CLASSES\CrossriderApp0013428.BHO.1, Quarantined, [3c423bb41f5c1323958b5c5fff02e020], 
PUP.Optional.PoupAlerta.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{11111111-1111-1111-1111-110111341128}, Quarantined, [3c423bb41f5c1323958b5c5fff02e020], 
PUP.Optional.PoupAlerta.A, HKLM\SOFTWARE\CLASSES\CrossriderApp0013428.BHO, Quarantined, [3c423bb41f5c1323958b5c5fff02e020], 
PUP.Optional.PoupAlerta.A, HKU\S-1-5-21-4016700205-1717049133-1125222536-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{11111111-1111-1111-1111-110111341128}, Quarantined, [3c423bb41f5c1323958b5c5fff02e020], 
PUP.Optional.PoupAlerta.A, HKU\S-1-5-21-4016700205-1717049133-1125222536-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{11111111-1111-1111-1111-110111341128}, Quarantined, [3c423bb41f5c1323958b5c5fff02e020], 
PUP.Optional.PoupAlerta.A, HKLM\SOFTWARE\CLASSES\CLSID\{22222222-2222-2222-2222-220122342228}, Quarantined, [3c423bb41f5c1323958b5c5fff02e020], 
PUP.Optional.PoupAlerta.A, HKLM\SOFTWARE\CLASSES\CrossriderApp0013428.Sandbox.1, Quarantined, [3c423bb41f5c1323958b5c5fff02e020], 
PUP.Optional.PoupAlerta.A, HKLM\SOFTWARE\CLASSES\CrossriderApp0013428.Sandbox, Quarantined, [3c423bb41f5c1323958b5c5fff02e020], 
PUP.Optional.PoupAlerta.A, HKLM\SOFTWARE\CLASSES\CLSID\{11111111-1111-1111-1111-110111341128}\INPROCSERVER32, Quarantined, [3c423bb41f5c1323958b5c5fff02e020], 
PUP.Optional.PoupAlerta.A, HKLM\SOFTWARE\Poup Alerta, Quarantined, [e5997d72d7a4d75fe0ec05ffea19b24e], 
PUP.Optional.CrossRider.A, HKLM\SOFTWARE\INSTALLEDBROWSEREXTENSIONS\8088, Quarantined, [5628836c344721157919b477768d30d0], 
PUP.Optional.CrossRider.A, HKU\S-1-5-21-4016700205-1717049133-1125222536-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\Crossrider, Quarantined, [215dbb34ec8f8babee96540e27dd9070], 
PUP.Optional.PoupAlerta.A, HKU\S-1-5-21-4016700205-1717049133-1125222536-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\Poup Alerta, Quarantined, [0a74ef004e2d4ceab31b0cf8e81b58a8], 
PUP.Optional.CrossRider.A, HKU\S-1-5-21-4016700205-1717049133-1125222536-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLEDBROWSEREXTENSIONS\8088, Quarantined, [413d7679bebd4bebdc25e4205fa40df3], 
PUP.Optional.CrossRider.A, HKU\S-1-5-21-4016700205-1717049133-1125222536-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLEDBROWSEREXTENSIONS\Carlos Botelho, Quarantined, [a0ded51ab7c4979fbc13897b7a89e917], 
PUP.Optional.PoupAlerta.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\Poup Alerta, Quarantined, [b9c58f60205b0630a75b4eb1b84a2cd4], 

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 15
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com, Quarantined, [403e0ee16f0c0630ad51ad437a889c64], 
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\chrome, Quarantined, [403e0ee16f0c0630ad51ad437a889c64], 
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\chrome\content, Quarantined, [403e0ee16f0c0630ad51ad437a889c64], 
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\chrome\content\api, Quarantined, [403e0ee16f0c0630ad51ad437a889c64], 
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\chrome\content\core, Quarantined, [403e0ee16f0c0630ad51ad437a889c64], 
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\defaults, Quarantined, [403e0ee16f0c0630ad51ad437a889c64], 
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\defaults\preferences, Quarantined, [403e0ee16f0c0630ad51ad437a889c64], 
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\extensionData, Quarantined, [403e0ee16f0c0630ad51ad437a889c64], 
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\extensionData\plugins, Quarantined, [403e0ee16f0c0630ad51ad437a889c64], 
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\extensionData\userCode, Quarantined, [403e0ee16f0c0630ad51ad437a889c64], 
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\locale, Quarantined, [403e0ee16f0c0630ad51ad437a889c64], 
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\locale\en-US, Quarantined, [403e0ee16f0c0630ad51ad437a889c64], 
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\skin, Quarantined, [403e0ee16f0c0630ad51ad437a889c64], 
PUP.Optional.PoupAlerta.A, C:\Users\{username}\AppData\LocalLow\Poup Alerta, Quarantined, [cab4e00f057682b45ba57788b34f8b75], 
PUP.Optional.PoupAlerta.A, C:\Program Files\Poup Alerta, Quarantined, [b9c58f60205b0630a75b4eb1b84a2cd4], 

Files: 199
PUP.Optional.PoupAlerta.A, C:\Program Files\Poup Alerta\Poup Alerta-bho.dll, Quarantined, [3c423bb41f5c1323958b5c5fff02e020], 
PUP.Optional.CrossRider.A, C:\Users\{username}\Desktop\Poup Alerta.exe, Quarantined, [eb93668991eaea4cea59ff547c84ff01], 
PUP.Optional.PoupAlerta.A, C:\Program Files\Poup Alerta\675ca14b-1e77-4813-9f07-d293b015297c-2.exe, Quarantined, [89f59a55a1dac2745ec24576847d06fa], 
PUP.Optional.PoupAlerta.A, C:\Program Files\Poup Alerta\675ca14b-1e77-4813-9f07-d293b015297c-4.exe, Quarantined, [304e14dbdf9c2c0a47d900bb3bc6cc34], 
PUP.Optional.PoupAlerta.A, C:\Program Files\Poup Alerta\675ca14b-1e77-4813-9f07-d293b015297c-5.exe, Quarantined, [c3bb4fa09be05cdad050b00b7b864bb5], 
PUP.Optional.PoupAlerta.A, C:\Program Files\Poup Alerta\Poup Alerta-bg.exe, Quarantined, [007e10df6417b2845cc406b59968ac54], 
PUP.Optional.PoupAlerta.A, C:\Program Files\Poup Alerta\Poup Alerta-buttonutil.exe, Quarantined, [750946a98bf0d2643ce47249eb164cb4], 
PUP.Optional.PoupAlerta.A, C:\Program Files\Poup Alerta\Poup Alerta-codedownloader.exe, Quarantined, [8af409e68bf0ee48ab75a7140bf69d63], 
PUP.Optional.CrossRider.A, C:\Program Files\Poup Alerta\utils.exe, Quarantined, [1e60a44bcdae5fd7063d3b18936de21e], 
PUP.Optional.CrossRider.T, C:\Windows\System32\Tasks\675ca14b-1e77-4813-9f07-d293b015297c-1, Quarantined, [fe802cc3b2c9d75f0167010f11f2ea16], 
PUP.Optional.CrossRider.T, C:\Windows\System32\Tasks\675ca14b-1e77-4813-9f07-d293b015297c-2, Quarantined, [0d7125ca0f6cf64046229e72986bc23e], 
PUP.Optional.CrossRider.T, C:\Windows\System32\Tasks\675ca14b-1e77-4813-9f07-d293b015297c-4, Quarantined, [4836e10e285385b19cccb45cf60da15f], 
PUP.Optional.CrossRider.T, C:\Windows\System32\Tasks\675ca14b-1e77-4813-9f07-d293b015297c-5, Quarantined, [2c5212dd8dee171f13553cd4966dea16], 
PUP.Optional.CrossRider.T, C:\Windows\Tasks\675ca14b-1e77-4813-9f07-d293b015297c-1.job, Quarantined, [d0ae42ad6417310548a58ae4798bc63a], 
PUP.Optional.CrossRider.T, C:\Windows\Tasks\675ca14b-1e77-4813-9f07-d293b015297c-2.job, Quarantined, [add1ab440576023406e7a0ced82ce917], 
PUP.Optional.CrossRider.T, C:\Windows\Tasks\675ca14b-1e77-4813-9f07-d293b015297c-4.job, Quarantined, [9ce2c6290a7148ee816ca2ccc0441ee2], 
PUP.Optional.CrossRider.T, C:\Windows\Tasks\675ca14b-1e77-4813-9f07-d293b015297c-5.job, Quarantined, [0975ef00cab167cf78754b23689ce719], 
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\chrome.manifest, Quarantined, [403e0ee16f0c0630ad51ad437a889c64], 
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\install.rdf, Quarantined, [403e0ee16f0c0630ad51ad437a889c64], 
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\chrome\content\api.js, Quarantined, [403e0ee16f0c0630ad51ad437a889c64], 
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\chrome\content\background.html, Quarantined, [403e0ee16f0c0630ad51ad437a889c64], 
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\chrome\content\baseObject.js, Quarantined, [403e0ee16f0c0630ad51ad437a889c64], 
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\chrome\content\browser.xul, Quarantined, [403e0ee16f0c0630ad51ad437a889c64], 
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\chrome\content\dialog.js, Quarantined, [403e0ee16f0c0630ad51ad437a889c64], 
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\chrome\content\ffCoreFilesIndex.txt, Quarantined, [403e0ee16f0c0630ad51ad437a889c64], 
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\chrome\content\main.js, Quarantined, [403e0ee16f0c0630ad51ad437a889c64], 
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\chrome\content\options.js, Quarantined, [403e0ee16f0c0630ad51ad437a889c64], 
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\chrome\content\options.xul, Quarantined, [403e0ee16f0c0630ad51ad437a889c64], 
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\chrome\content\platformVersion.js, Quarantined, [403e0ee16f0c0630ad51ad437a889c64], 
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\chrome\content\search_dialog.xul, Quarantined, [403e0ee16f0c0630ad51ad437a889c64], 
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\chrome\content\api\asyncDB.js, Quarantined, [403e0ee16f0c0630ad51ad437a889c64], 
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\chrome\content\api\background.js, Quarantined, [403e0ee16f0c0630ad51ad437a889c64], 
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\chrome\content\api\browserAction.js, Quarantined, [403e0ee16f0c0630ad51ad437a889c64], 
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\chrome\content\api\contextMenu.js, Quarantined, [403e0ee16f0c0630ad51ad437a889c64], 
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\chrome\content\api\dbManager.js, Quarantined, [403e0ee16f0c0630ad51ad437a889c64], 
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\chrome\content\api\dom_bg.js, Quarantined, [403e0ee16f0c0630ad51ad437a889c64], 
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\chrome\content\api\fileManager.js, Quarantined, [403e0ee16f0c0630ad51ad437a889c64], 
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\chrome\content\api\firefox.js, Quarantined, [403e0ee16f0c0630ad51ad437a889c64], 
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\chrome\content\api\firefoxNotifications.js, Quarantined, [403e0ee16f0c0630ad51ad437a889c64], 
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\chrome\content\api\firefoxOmnibox.js, Quarantined, [403e0ee16f0c0630ad51ad437a889c64], 
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\chrome\content\api\message.js, Quarantined, [403e0ee16f0c0630ad51ad437a889c64], 
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\chrome\content\api\pageAction.js, Quarantined, [403e0ee16f0c0630ad51ad437a889c64], 
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\chrome\content\api\request.js, Quarantined, [403e0ee16f0c0630ad51ad437a889c64], 
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\chrome\content\api\tabs.js, Quarantined, [403e0ee16f0c0630ad51ad437a889c64], 
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\chrome\content\api\webRequest.js, Quarantined, [403e0ee16f0c0630ad51ad437a889c64], 
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\chrome\content\api\windowsMessagingHandler.js, Quarantined, [403e0ee16f0c0630ad51ad437a889c64], 
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\chrome\content\core\addressBarChangeObserver.js, Quarantined, [403e0ee16f0c0630ad51ad437a889c64], 
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\chrome\content\core\console.js, Quarantined, [403e0ee16f0c0630ad51ad437a889c64], 
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\chrome\content\core\consts.js, Quarantined, [403e0ee16f0c0630ad51ad437a889c64], 
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\chrome\content\core\delegate.js, Quarantined, [403e0ee16f0c0630ad51ad437a889c64], 
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\chrome\content\core\extensionDataStore.js, Quarantined, [403e0ee16f0c0630ad51ad437a889c64], 
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\chrome\content\core\folderIOWrapper.js, Quarantined, [403e0ee16f0c0630ad51ad437a889c64], 
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\chrome\content\core\httpObserver.js, Quarantined, [403e0ee16f0c0630ad51ad437a889c64], 
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\chrome\content\core\IDBWrapper.js, Quarantined, [403e0ee16f0c0630ad51ad437a889c64], 
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\chrome\content\core\installer.js, Quarantined, [403e0ee16f0c0630ad51ad437a889c64], 
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\chrome\content\core\logFile.js, Quarantined, [403e0ee16f0c0630ad51ad437a889c64], 
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\chrome\content\core\prefs.js, Quarantined, [403e0ee16f0c0630ad51ad437a889c64], 
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\chrome\content\core\progressListenerObserver.js, Quarantined, [403e0ee16f0c0630ad51ad437a889c64], 
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\chrome\content\core\registry.js, Quarantined, [403e0ee16f0c0630ad51ad437a889c64], 
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\chrome\content\core\reloadObserver.js, Quarantined, [403e0ee16f0c0630ad51ad437a889c64], 
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\chrome\content\core\reports.js, Quarantined, [403e0ee16f0c0630ad51ad437a889c64], 
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\chrome\content\core\requestObject.js, Quarantined, [403e0ee16f0c0630ad51ad437a889c64], 
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\chrome\content\core\searchSettings.js, Quarantined, [403e0ee16f0c0630ad51ad437a889c64], 
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\chrome\content\core\uninstallObserver.js, Quarantined, [403e0ee16f0c0630ad51ad437a889c64], 
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\chrome\content\core\updateManager.js, Quarantined, [403e0ee16f0c0630ad51ad437a889c64], 
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\chrome\content\core\utils.js, Quarantined, [403e0ee16f0c0630ad51ad437a889c64], 
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\chrome\content\core\xhr.js, Quarantined, [403e0ee16f0c0630ad51ad437a889c64], 
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\defaults\preferences\prefs.js, Quarantined, [403e0ee16f0c0630ad51ad437a889c64], 
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\extensionData\manifest.xml, Quarantined, [403e0ee16f0c0630ad51ad437a889c64], 
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\extensionData\plugins.json, Quarantined, [403e0ee16f0c0630ad51ad437a889c64], 
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\extensionData\plugins\1.js, Quarantined, [403e0ee16f0c0630ad51ad437a889c64], 
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\extensionData\plugins\13.js, Quarantined, [403e0ee16f0c0630ad51ad437a889c64], 
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\extensionData\plugins\14.js, Quarantined, [403e0ee16f0c0630ad51ad437a889c64], 
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\extensionData\plugins\16.js, Quarantined, [403e0ee16f0c0630ad51ad437a889c64], 
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\extensionData\plugins\17.js, Quarantined, [403e0ee16f0c0630ad51ad437a889c64], 
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\extensionData\plugins\177.js, Quarantined, [403e0ee16f0c0630ad51ad437a889c64], 
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\extensionData\plugins\182.js, Quarantined, [403e0ee16f0c0630ad51ad437a889c64], 
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\extensionData\plugins\183.js, Quarantined, [403e0ee16f0c0630ad51ad437a889c64], 
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\extensionData\plugins\207.js, Quarantined, [403e0ee16f0c0630ad51ad437a889c64], 
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\extensionData\plugins\21.js, Quarantined, [403e0ee16f0c0630ad51ad437a889c64], 
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\extensionData\plugins\22.js, Quarantined, [403e0ee16f0c0630ad51ad437a889c64], 
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\extensionData\plugins\246.js, Quarantined, [403e0ee16f0c0630ad51ad437a889c64], 
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\extensionData\plugins\268.js, Quarantined, [403e0ee16f0c0630ad51ad437a889c64], 
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\extensionData\plugins\28.js, Quarantined, [403e0ee16f0c0630ad51ad437a889c64], 
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\extensionData\plugins\4.js, Quarantined, [403e0ee16f0c0630ad51ad437a889c64], 
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\extensionData\plugins\47.js, Quarantined, [403e0ee16f0c0630ad51ad437a889c64], 
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\extensionData\plugins\64.js, Quarantined, [403e0ee16f0c0630ad51ad437a889c64], 
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\extensionData\plugins\72.js, Quarantined, [403e0ee16f0c0630ad51ad437a889c64], 
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\extensionData\plugins\78.js, Quarantined, [403e0ee16f0c0630ad51ad437a889c64], 
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\extensionData\plugins\91.js, Quarantined, [403e0ee16f0c0630ad51ad437a889c64], 
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\extensionData\plugins\98.js, Quarantined, [403e0ee16f0c0630ad51ad437a889c64], 
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\extensionData\userCode\background.js, Quarantined, [403e0ee16f0c0630ad51ad437a889c64], 
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\extensionData\userCode\extension.js, Quarantined, [403e0ee16f0c0630ad51ad437a889c64], 
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\locale\en-US\translations.dtd, Quarantined, [403e0ee16f0c0630ad51ad437a889c64], 
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\skin\button1.png, Quarantined, [403e0ee16f0c0630ad51ad437a889c64], 
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\skin\button2.png, Quarantined, [403e0ee16f0c0630ad51ad437a889c64], 
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\skin\button3.png, Quarantined, [403e0ee16f0c0630ad51ad437a889c64], 
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\skin\button4.png, Quarantined, [403e0ee16f0c0630ad51ad437a889c64], 
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\skin\button5.png, Quarantined, [403e0ee16f0c0630ad51ad437a889c64], 
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\skin\crossrider_statusbar.png, Quarantined, [403e0ee16f0c0630ad51ad437a889c64], 
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\skin\icon128.png, Quarantined, [403e0ee16f0c0630ad51ad437a889c64], 
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\skin\icon16.png, Quarantined, [403e0ee16f0c0630ad51ad437a889c64], 
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\skin\icon24.png, Quarantined, [403e0ee16f0c0630ad51ad437a889c64], 
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\skin\icon48.png, Quarantined, [403e0ee16f0c0630ad51ad437a889c64], 
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\skin\panelarrow-up.png, Quarantined, [403e0ee16f0c0630ad51ad437a889c64], 
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\skin\popup.html, Quarantined, [403e0ee16f0c0630ad51ad437a889c64], 
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\skin\skin.css, Quarantined, [403e0ee16f0c0630ad51ad437a889c64], 
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\crossriderapp13428@crossrider.com\skin\update.css, Quarantined, [403e0ee16f0c0630ad51ad437a889c64], 
PUP.Optional.PoupAlerta.A, C:\Program Files\Poup Alerta\13428.xpi, Quarantined, [b9c58f60205b0630a75b4eb1b84a2cd4], 
PUP.Optional.PoupAlerta.A, C:\Program Files\Poup Alerta\background.html, Quarantined, [b9c58f60205b0630a75b4eb1b84a2cd4], 
PUP.Optional.PoupAlerta.A, C:\Program Files\Poup Alerta\Poup Alerta-buttonutil.dll, Quarantined, [b9c58f60205b0630a75b4eb1b84a2cd4], 
PUP.Optional.PoupAlerta.A, C:\Program Files\Poup Alerta\Poup Alerta.ico, Quarantined, [b9c58f60205b0630a75b4eb1b84a2cd4], 
PUP.Optional.PoupAlerta.A, C:\Program Files\Poup Alerta\Uninstall.exe, Quarantined, [b9c58f60205b0630a75b4eb1b84a2cd4], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\prefs.js, Good: (), Bad: (user_pref("extensions.crossrider.bic", "1488cb6e83816cfb9cf5e1bd3079ca9a");), Replaced,[512da14edd9e76c0f20cda5db0551ee2]
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\prefs.js, Good: (), Bad: (user_pref("extensions.crossriderapp13428.13428.InstallationThankYouPage", true);), Replaced,[88f6519ea4d7b086e8172c0bab5ac23e]
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\prefs.js, Good: (), Bad: (user_pref("extensions.crossriderapp13428.13428.InstallationTime", 1411109606);), Replaced,[e39b15da0f6c9a9c16e968cf679eee12]
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\prefs.js, Good: (), Bad: (user_pref("extensions.crossriderapp13428.13428.active", true);), Replaced,[3a4412dd0f6c1125fd02fd3a0df8738d]
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\prefs.js, Good: (), Bad: (user_pref("extensions.crossriderapp13428.13428.addressbar", "NA");), Replaced,[bbc3da15b7c457df03fc50e7c342fd03]
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\prefs.js, Good: (), Bad: (user_pref("extensions.crossriderapp13428.13428.addressbarenhanced", "");), Replaced,[c8b621ce7dfe78be04fbf4430302aa56]
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\prefs.js, Good: (), Bad: (user_pref("extensions.crossriderapp13428.13428.asyncdb.was_copied", "true");), Replaced,[e09e856aaecdd95dd32c4becae57cf31]
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\prefs.js, Good: (), Bad: (user_pref("extensions.crossriderapp13428.13428.asyncdb_dbWasSet", true);), Replaced,[f18dc42b09728ea8906f2e0916ef0df3]
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\prefs.js, Good: (), Bad: (user_pref("extensions.crossriderapp13428.13428.asyncdb_dbWasSet_FF25_FIX", true);), Replaced,[cfaf5c93dba0f93d5fa0e35430d5c33d]
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\prefs.js, Good: (), Bad: (user_pref("extensions.crossriderapp13428.13428.asyncinternaldb.was_copied", "true");), Replaced,[ff7f45aaf289a492ac53e84f957015eb]
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\prefs.js, Good: (), Bad: (user_pref("extensions.crossriderapp13428.13428.asyncinternaldb_dbWasSet", true);), Replaced,[d9a5c926a3d82214a758d265f70edd23]
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\prefs.js, Good: (), Bad: (user_pref("extensions.crossriderapp13428.13428.asyncinternaldb_dbWasSet_FF25_FIX", true);), Replaced,[cab4f8f7ec8f231338c785b2f60ffe02]
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\prefs.js, Good: (), Bad: (user_pref("extensions.crossriderapp13428.13428.backgroundver", 12);), Replaced,[097510df681378bef8078bace025b749]
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\prefs.js, Good: (), Bad: (user_pref("extensions.crossriderapp13428.13428.certdomaininstaller", "");), Replaced,[0975ef00f68590a610efc3746d98f010]
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\prefs.js, Good: (), Bad: (user_pref("extensions.crossriderapp13428.13428.changeprevious", false);), Replaced,[275739b6ee8dab8b53aca49323e216ea]
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\prefs.js, Good: (), Bad: (user_pref("extensions.crossriderapp13428.13428.cookie.InstallationTime.expiration", "Fri Feb 01 2030 00:00:00 GMT+0100");), Replaced,[b6c802edff7c9c9aa8573dfa61a46c94]
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\prefs.js, Good: (), Bad: (user_pref("extensions.crossriderapp13428.13428.cookie.InstallationTime.value", "%221411109606%22");), Replaced,[67179857dc9fa096f60946f130d5cc34]
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\prefs.js, Good: (), Bad: (user_pref("extensions.crossriderapp13428.13428.cookie.InstallerParams.expiration", "Fri Feb 01 2030 00:00:00 GMT+0100");), Replaced,[6d11ce21710a68ce24dba88fcf3641bf]
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\prefs.js, Good: (), Bad: (user_pref("extensions.crossriderapp13428.13428.cookie.InstallerParams.value", "%7B%22source_id%22%3A%22001364%22Replaced,[f8868669fe7d53e3ce3148efff06847c]C%22sub_id%22%3A%220%22Replaced,[f8868669fe7d53e3ce3148efff06847c]C%22uzid%22%3A%220%22%7D");), %5
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\prefs.js, Good: (), Bad: (user_pref("extensions.crossriderapp13428.13428.cookie.poupAffiliates.expiration", "Fri Feb 01 2030 00:00:00 GMT+0100");), Replaced,[1e6000ef403b1e1843bc8daacc390cf4]
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\prefs.js, Good: (), Bad: (user_pref("extensions.crossriderapp13428.13428.cookie.poupAffiliates.value", "%5B%7B%22siteName%22%3A%22Lomadee%22Replaced,[b2cc2ec195e63600609fb7806f96f40c]C%22siteURL%22%3A%22lomadee.com%22%7DReplaced,[b2cc2ec195e63600609fb7806f96f40c]C%7B%22siteName%22%3A%22Afilio%22Replaced,[b2cc2ec195e63600609fb7806f96f40c]C%22siteURL%22%3A%22afilio.com.br%22%7DReplaced,[b2cc2ec195e63600609fb7806f96f40c]C%7B%22siteName%22%3A%22Zanox%22Replaced,[b2cc2ec195e63600609fb7806f96f40c]C%22siteURL%22%3A%22zanox.com%22%7DReplaced,[b2cc2ec195e63600609fb7806f96f40c]C%7B%22siteName%22%3A%22AffiliateWindow%22Replaced,[b2cc2ec195e63600609fb7806f96f40c]C%22siteURL%22%3A%22awin1.com%22%7DReplaced,[b2cc2ec195e63600609fb7806f96f40c]C%7B%22siteName%22%3A%22Doubleclick%22Replaced,[b2cc2ec195e63600609fb7806f96f40c]C%22siteURL%22%3A%22doubleclick.net%22%7D%5D");), %5
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\prefs.js, Good: (), Bad: (user_pref("extensions.crossriderapp13428.13428.crossriderapp13428_dbWasSet", true);), Replaced,[b1cdd619c4b70630f609a493c441e61a]
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\prefs.js, Good: (), Bad: (user_pref("extensions.crossriderapp13428.13428.crossriderapp13428_dbWasSet_FF25_FIX", true);), Replaced,[8fef8d62e893b58157a8082f877e649c]
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\prefs.js, Good: (), Bad: (user_pref("extensions.crossriderapp13428.13428.description", "Sempre que você entrar em uma loja parceira, o Piggy te alerta que tem dinheiro de volta dando sopa!");), Replaced,[5826826dc2b99b9b6798a49318ed41bf]
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\prefs.js, Good: (), Bad: (user_pref("extensions.crossriderapp13428.13428.domain", "");), Replaced,[d7a70ce36516f93dfd023dfa7a8bfd03]
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\prefs.js, Good: (), Bad: (user_pref("extensions.crossriderapp13428.13428.enablesearch", false);), Replaced,[ea94fbf46f0c989eeb1447f08b7a36ca]
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\prefs.js, Good: (), Bad: (user_pref("extensions.crossriderapp13428.13428.homepage", "");), Replaced,[86f8c62925561e187b8458df0104ba46]
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\prefs.js, Good: (), Bad: (user_pref("extensions.crossriderapp13428.13428.iframe", false);), Replaced,[86f8e609c8b342f44fb0aa8d3acb9769]
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\prefs.js, Good: (), Bad: (user_pref("extensions.crossriderapp13428.13428.internaldb.InstallerIdentifiers.expiration", "Fri Feb 01 2030 00:00:00 GMT+0100");), Replaced,[1965509f82f91f17c23dbc7bc0456c94]
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\prefs.js, Good: (), Bad: (user_pref("extensions.crossriderapp13428.13428.internaldb.InstallerIdentifiers.value", "%7B%22installer_bic%22%3A%22E3BDAA3738C84341A4662C3020928670IE%22Replaced,[add119d67cff5fd72dd2f146887deb15]C%22installer_verifier%22%3A%22bc2fe4634093a29d33c31f2b413ce2b0%22%7D");), %5
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\prefs.js, Good: (), Bad: (user_pref("extensions.crossriderapp13428.13428.internaldb.InstallerParams.expiration", "Fri Feb 01 2030 00:00:00 GMT+0100");), Replaced,[a3db13dc8bf0a591ec13cc6bbf46fd03]
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\prefs.js, Good: (), Bad: (user_pref("extensions.crossriderapp13428.13428.internaldb.InstallerParams.value", "%7B%22source_id%22%3A%22001364%22Replaced,[5f1f6a853f3cd85ee817d85fa95ca35d]C%22sub_id%22%3A%220%22Replaced,[5f1f6a853f3cd85ee817d85fa95ca35d]C%22uzid%22%3A%220%22%7D");), %5
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\prefs.js, Good: (), Bad: (user_pref("extensions.crossriderapp13428.13428.internaldb.InstallerParamsCache.expiration", "Fri Feb 01 2030 00:00:00 GMT+0100");), Replaced,[79059659295238fead5293a4966f1ee2]
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\prefs.js, Good: (), Bad: (user_pref("extensions.crossriderapp13428.13428.internaldb.InstallerParamsCache.value", "%7B%22source_id%22%3A%22001364%22Replaced,[ea94a24d32497db95da21324cf36966a]C%22sub_id%22%3A%220%22Replaced,[ea94a24d32497db95da21324cf36966a]C%22uzid%22%3A%220%22Replaced,[ea94a24d32497db95da21324cf36966a]C%22__exposedProps__%22%3A%7B%22source_id%22%3A%22wr%22Replaced,[ea94a24d32497db95da21324cf36966a]C%22sub_id%22%3A%22wr%22Replaced,[ea94a24d32497db95da21324cf36966a]C%22uzid%22%3A%22wr%22%7D%7D");), %5
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\prefs.js, Good: (), Bad: (user_pref("extensions.crossriderapp13428.13428.internaldb.InstallerUserIdentifiersCache.expiration", "Fri Feb 01 2030 00:00:00 GMT+0100");), Replaced,[ccb2fcf3b7c40432758a1c1bdf2659a7]
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\prefs.js, Good: (), Bad: (user_pref("extensions.crossriderapp13428.13428.internaldb.InstallerUserIdentifiersCache.value", "%7B%22installer_bic%22%3A%22E3BDAA3738C84341A4662C3020928670IE%22Replaced,[0c728768dd9ecd69807f122510f57789]C%22installer_verifier%22%3A%22bc2fe4634093a29d33c31f2b413ce2b0%22Replaced,[0c728768dd9ecd69807f122510f57789]C%22installer_verifier_for_215app%22%3A%22%22Replaced,[0c728768dd9ecd69807f122510f57789]C%22__exposedProps__%22%3A%7B%22installer_bic%22%3A%22wr%22Replaced,[0c728768dd9ecd69807f122510f57789]C%22installer_verifier%22%3A%22wr%22Replaced,[0c728768dd9ecd69807f122510f57789]C%22installer_verifier_for_215app%22%3A%22wr%22%7D%7D");), %5
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\prefs.js, Good: (), Bad: (user_pref("extensions.crossriderapp13428.13428.internaldb.Resources_appVer.expiration", "Fri Feb 01 2030 00:00:00 GMT+0100");), Replaced,[e6984ea146353bfb817ea691dd28e818]
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\prefs.js, Good: (), Bad: (user_pref("extensions.crossriderapp13428.13428.internaldb.Resources_appVer.value", "116");), Replaced,[aed04aa53348a88ef10ee3548e77a060]
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\prefs.js, Good: (), Bad: (user_pref("extensions.crossriderapp13428.13428.internaldb.Resources_lastVersion.expiration", "Fri Feb 01 2030 00:00:00 GMT+0100");), Replaced,[314d559a0a71d95ddf204aedcd38659b]
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\prefs.js, Good: (), Bad: (user_pref("extensions.crossriderapp13428.13428.internaldb.Resources_lastVersion.value", "70");), Replaced,[1866f4fbcead03330bf4cd6ad03521df]
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\prefs.js, Good: (), Bad: (user_pref("extensions.crossriderapp13428.13428.internaldb.Resources_meta.expiration", "Fri Feb 01 2030 00:00:00 GMT+0100");), Replaced,[1c62ed02ec8f4de9c03f1f18fa0bf60a]
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\prefs.js, Good: (), Bad: (user_pref("extensions.crossriderapp13428.13428.internaldb.Resources_meta.value", "%7B%22images/poupIcon.png%22%3A%7B%22id%22%3A672882Replaced,[5a24648be99237ff906fe057867ff50b]C%22ver%22%3A70Replaced,[5a24648be99237ff906fe057867ff50b]C%22status%22%3A1Replaced,[5a24648be99237ff906fe057867ff50b]C%22name%22%3A%22images/poupIcon.png%22Replaced,[5a24648be99237ff906fe057867ff50b]C%22url%22%3A%22http%3A//resources.crossrider.com/system/resources/apps/13428/672882%22%7D%7D");), %5
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\prefs.js, Good: (), Bad: (user_pref("extensions.crossriderapp13428.13428.internaldb.Resources_nextCheck.expiration", "Fri Sep 19 2014 15:01:16 GMT+0200");), Replaced,[304e549bd7a42f0740bf38ff5fa69769]
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\prefs.js, Good: (), Bad: (user_pref("extensions.crossriderapp13428.13428.internaldb.Resources_nextCheck.value", "true");), Replaced,[93eb5e916e0d063008f7a790768fd62a]
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\prefs.js, Good: (), Bad: (user_pref("extensions.crossriderapp13428.13428.internaldb.Resources_queue.expiration", "Fri Feb 01 2030 00:00:00 GMT+0100");), Replaced,[b1cd539cc0bb2214c33cdf5826df7b85]
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\prefs.js, Good: (), Bad: (user_pref("extensions.crossriderapp13428.13428.internaldb.Resources_queue.value", "%7B%7D");), Replaced,[8fef86694338ae8839c6bd7a08fd6f91]
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\prefs.js, Good: (), Bad: (user_pref("extensions.crossriderapp13428.13428.internaldb.Resources_remote_resources.expiration", "Fri Feb 01 2030 00:00:00 GMT+0100");), Replaced,[641a6c835d1eea4c669963d4f411e51b]
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\prefs.js, Good: (), Bad: (user_pref("extensions.crossriderapp13428.13428.internaldb.Resources_remote_resources.value", "%7B%22remoteId%22Replaced,[f38ba7487209cf673dc240f76b9ac43c]A0%7D");), %5
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\prefs.js, Good: (), Bad: (user_pref("extensions.crossriderapp13428.13428.internaldb.Resources_resource_672882.expiration", "Thu Dec 18 2014 08:01:17 GMT+0100");), Replaced,[1965e30c92e96cca0df20a2d2dd806fa]
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\prefs.js, Good: (), Bad: (user_pref("extensions.crossriderapp13428.13428.internaldb.Resources_resource_672882.value", "%22data%3Aimage/png%3Bbase64Replaced,[e49ad51a1a6190a639c652e5ae57c33d]CiVBORw0KGgoAAAANSU
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\prefs.js, Good: (), Bad: (user_pref("extensions.crossriderapp13428.13428.internaldb.__defualt_browser__.expiration", "Fri Feb 01 2030 00:00:00 GMT+0100");), Replaced,[2c52e50a1269b87ec03f91a6c73ebc44]
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\prefs.js, Good: (), Bad: (user_pref("extensions.crossriderapp13428.13428.internaldb.__defualt_browser__.value", "%22ie%22");), Replaced,[a0dedb14007b0b2b37c867d0b84d8779]
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\prefs.js, Good: (), Bad: (user_pref("extensions.crossriderapp13428.13428.internaldb.installer.expiration", "Fri Feb 01 2030 00:00:00 GMT+0100");), Replaced,[334b856a0576f83efc03e65104016a96]
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\prefs.js, Good: (), Bad: (user_pref("extensions.crossriderapp13428.13428.internaldb.installer.value", "%7B%22InstallerIdentifiers%22%3A%7B%22installer_bic%22%3A%22E3BDAA3738C84341A4662C3020928670IE%22
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\prefs.js, Good: (), Bad: (user_pref("extensions.crossriderapp13428.13428.internaldb.monetization_plugin_bundledUrls.expiration", "Fri Feb 01 2030 00:00:00 GMT+0100");), Replaced,[eb930ce3275495a14ab5082ff3121fe1]
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\prefs.js, Good: (), Bad: (user_pref("extensions.crossriderapp13428.13428.internaldb.monetization_plugin_bundledUrls.value", "%7B%22dealply_s%22%3A%7B%22urls%22%PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\prefs.js, Good: (), Bad: (user_pref("extensions.crossriderapp13428.13428.internaldb.monetization_plugin_bundledWithHash.expiration", "Fri Feb 01 2030 00:00:00 GMT+0100");), Replaced,[1e602dc2a6d5b581906fbe796a9b827e]
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\prefs.js, Good: (), Bad: (user_pref("extensions.crossriderapp13428.13428.internaldb.monetization_plugin_bundledWithHash.value", "null");), Replaced,[6a14f6f96c0f95a1b14e2c0b50b5bf41]
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\prefs.js, Good: (), Bad: (user_pref("extensions.crossriderapp13428.13428.internaldb.monetization_plugin_notBundledArr_.expiration", "Fri Feb 01 2030 00:00:00 GMT+0100");), Replaced,[ceb0bc334c2f51e5e71890a7d82d37c9]
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\prefs.js, Good: (), Bad: (user_pref("extensions.crossriderapp13428.13428.internaldb.monetization_plugin_notBundledArr_.value", "Replaced,[7806a54a77044cea32cd4dea7b8a6898]BReplaced,[7806a54a77044cea32cd4dea7b8a6898]D");), Replaced,[7806a54a77044cea32cd4dea7b8a6898]
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\prefs.js, Good: (), Bad: (user_pref("extensions.crossriderapp13428.13428.internaldb.monetization_plugin_regBundledWithSoftware.expiration", "Fri Feb 01 2030 00:00:00 GMT+0100");), Replaced,[84fa7a75a0dbab8be81769cec73e08f8]
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\prefs.js, Good: (), Bad: (user_pref("extensions.crossriderapp13428.13428.internaldb.monetization_plugin_regBundledWithSoftware.value", "%7B%7D");), Replaced,[c1bd7b74f4872214ba457abd8c7959a7]
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\prefs.js, Good: (), Bad: (user_pref("extensions.crossriderapp13428.13428.lastDailyReport", "1411110073205");), Replaced,[f38be807f586fa3cfc038aad8e77aa56]
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\prefs.js, Good: (), Bad: (user_pref("extensions.crossriderapp13428.13428.lastUpdate", "1411110070954");), Replaced,[4c3227c80972ac8a1ce384b3ed1830d0]
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\prefs.js, Good: (), Bad: (user_pref("extensions.crossriderapp13428.13428.manifesturl", "");), Replaced,[601e3db2146766d002fdf54262a330d0]
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\prefs.js, Good: (), Bad: (user_pref("extensions.crossriderapp13428.13428.name", "Poup Alerta");), Replaced,[423cf6f988f383b347b8999e689d0af6]
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\prefs.js, Good: (), Bad: (user_pref("extensions.crossriderapp13428.13428.newtab", "");), Replaced,[0c72bd32df9c5bdb926dc770c73eb44c]
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\prefs.js, Good: (), Bad: (user_pref("extensions.crossriderapp13428.13428.opensearch", "");), Replaced,[e39b0ee12b50b28413ec39fe50b537c9]
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\prefs.js, Good: (), Bad: (user_pref("extensions.crossriderapp13428.13428.pluginsurl", "http://js.loadgenclientservice.com/plugin/apps/13428/plugins/na/ff/plugins.json");), Replaced,[423cfaf5a6d560d6dd22ff389174ff01]
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\prefs.js, Good: (), Bad: (user_pref("extensions.crossriderapp13428.13428.pluginsversion", 14);), Replaced,[f9855c93a1dafa3caf5085b221e459a7]
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\prefs.js, Good: (), Bad: (user_pref("extensions.crossriderapp13428.13428.publisher", "Carlos Botelho");), Replaced,[0c72589798e334023ac5a19630d59b65]
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\prefs.js, Good: (), Bad: (user_pref("extensions.crossriderapp13428.13428.searchstatus", 0);), Replaced,[c9b5cd22c4b79f975ea11225a263ae52]
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\prefs.js, Good: (), Bad: (user_pref("extensions.crossriderapp13428.13428.setnewtab", false);), Replaced,[abd3d7184a3161d545bac17627de07f9]
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\prefs.js, Good: (), Bad: (user_pref("extensions.crossriderapp13428.13428.thankyou", "http://www.poup.com.br/poup-alerta-obrigado?utm_source=poup_toolbar&utm_medium=click&utm_content=toolbar_install&utm_campaign=toolbarinstall");), Replaced,[512de10eea9103333cc30a2df2133ac6]
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\prefs.js, Good: (), Bad: (user_pref("extensions.crossriderapp13428.13428.updateinterval", 360);), Replaced,[c5b903ec55263105996674c35ca9837d]
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\prefs.js, Good: (), Bad: (user_pref("extensions.crossriderapp13428.13428.ver", 116);), Replaced,[e39b44abdaa1e74fab5456e1e223f907]
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\prefs.js, Good: (), Bad: (user_pref("extensions.crossriderapp13428.FilesValidatorDueTime", "1411110130027");), Replaced,[bcc213dc007b8fa71ce32a0de91cb947]
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\prefs.js, Good: (), Bad: (user_pref("extensions.crossriderapp13428.apps", "13428");), Replaced,[413d7b746813ef47a85768cfe2231be5]
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\prefs.js, Good: (), Bad: (user_pref("extensions.crossriderapp13428.bic", "1488cb6e83816cfb9cf5e1bd3079ca9a");), Replaced,[532b846b48337eb80ef167d0699c946c]
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\prefs.js, Good: (), Bad: (user_pref("extensions.crossriderapp13428.cid", 13428);), Replaced,[ccb26986433878becb344bec8f768878]
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\prefs.js, Good: (), Bad: (user_pref("extensions.crossriderapp13428.firstrun", false);), Replaced,[fa84a54aef8c082ef60978bf3fc6e719]
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\prefs.js, Good: (), Bad: (user_pref("extensions.crossriderapp13428.hadappinstalled", true);), Replaced,[fd812dc20e6d2b0b817eab8c3dc817e9]
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\prefs.js, Good: (), Bad: (user_pref("extensions.crossriderapp13428.installationdate", 1411110070);), Replaced,[780601eea5d64de925da88af897cf10f]
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\prefs.js, Good: (), Bad: (user_pref("extensions.crossriderapp13428.modetype", "production");), Replaced,[a5d9757a69122214966961d605000cf4]
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\prefs.js, Good: (), Bad: (user_pref("extensions.crossriderapp13428.reportInstall", true);), Replaced,[afcfbf30176479bd8e7190a76f96e818]
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\prefs.js, Good: (), Bad: (user_pref("extensions.crossriderapp13428.statsDailyCounter", 1);), Replaced,[f589559ae19adb5b7788cb6c5aabd729]

Physical Sectors: 0
(No malicious items detected)


(end)
 
As mentioned before the full version of Malwarebytes Anti-Malware could have protected your computer against this threat.
We use different ways of protecting your computer(s):
  • Dynamically Blocks Malware Sites & Servers
  • Malware Execution Prevention
Save yourself the hassle and get protected.
  • 0

Advertisements





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

featured
Malware Removal How to Guides Windows 7 System Building Download Files Register welcome

Never used a forum? Learn how.