Jump to content

Welcome to Geeks to Go
Geeks to Go Welcome
Create Account Login to Account
Photo

Removal instructions for Shopperz

- - - - -
Started by Metallica , Feb 27 2015 03:46 AM

  • Please log in to reply
4 replies to this topic

#1
Metallica
Posted 27 February 2015 - 03:46 AM

Metallica

    Spyware Veteran

  • GeekU Moderator
  • 33,101 posts
Content is republished with permission from Malwarebytes.

What is Shopperz?

The Malwarebytes research team has determined that Shopperz is a browser hijacker. These so-called "hijackers" manipulate your browser(s), for example to change your startpage or searchscopes, so that the affected browser visits their site or one of their choice. This one also displays advertisements.

How do I know if my computer is affected by Shopperz?

You may see this entry in your list of installed software:

warning4.png

Or this entry in your Scheduled Tasks :

warning5.png

and these warnings:

warning1.png

main.png

and these browser extensions/add-ons

warning2.png

warning3.png

How did Shopperz get on my computer?

Browser hijackers use different methods for distributing themselves. This particular one was bundled with other software.

How do I remove Shopperz?

Our program Malwarebytes Anti-Malware can detect and remove this potentially unwanted program.
  • Please download Malwarebytes Anti-Malware to your desktop.
  • Double-click mbam-setup-version.exe and follow the prompts to install the program.
  • At the end, be sure a check-mark is placed next to the following:
    • Enable free trial of Malwarebytes Anti-Malware Premium
    • Launch Malwarebytes Anti-Malware
  • Then click Finish.
  • If an update is found, you will be prompted to download and install the latest version.
  • Once the program has loaded, select Scan now. Or select the Threat Scan from the Scan menu.
  • When the scan is complete , make sure that everything is set to "Quarantine", and click Apply Actions.
  • Reboot your computer if prompted.
Is there anything else I need to do to get rid of Shopperz?
  • No, Malwarebytes' Anti-Malware removes Shopperz completely.
  • This PUP creates some scheduled tasks. You can read here how to remove Scheduled Tasks.
How would the full version of Malwarebytes Anti-Malware help protect me?

We hope our application and this guide have helped you eradicate this hijacker.

As you can see below the full version of Malwarebytes Anti-Malware would have protected you against the Shopperz hijacker. It would have warned you before the rogue could install itself, giving you a chance to stop it before it became too late.

protection1.png


Technical details for experts

Signs in a HijackThis log:

O2 - BHO: shopperz Helper - {5081D2D4-1637-404c-B74F-50526718257D} - C:\Program Files\shopperz\mseff32.dll
O4 - HKLM\..\Run: [shopperz] C:\Program Files\shopperz\wrex.exe
O23 - Service: 70F4EEDB-1367-4b4f-8247-3133551A7415 - Unknown owner - C:\Program Files\shopperz\grunt.exe
O23 - Service: csrcc - Unknown owner - C:\Program Files\shopperz\csrcc.exe
O23 - Service: shopperz Updater - Unknown owner - C:\Program Files\shopperz\nseven.exe
Possible signs in FRST logs:

 () C:\Program Files\Shopperz\csrcc.exe
 () C:\Program Files\Shopperz\grunt.exe
 () C:\Program Files\Shopperz\nseven.exe
 () C:\Program Files\Shopperz\wrex.exe
 HKLM\...\Run: [shopperz] => C:\Program Files\shopperz\wrex.exe [429944 2015-02-15] ()
 BHO: shopperz -> {5081D2D4-1637-404c-B74F-50526718257D} -> C:\Program Files\shopperz\mseff32.dll ()
 FF user.js: detected! => C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\user.js
 FF HKLM\...\Firefox\Extensions: [{5081D2D4-1637-404c-B74F-50526718257D}] - C:\Program Files\shopperz\Firefox
 FF Extension: shopperz - C:\Program Files\shopperz\Firefox [2015-02-27]
 R2 70F4EEDB-1367-4b4f-8247-3133551A7415; C:\Program Files\shopperz\grunt.exe [281976 2015-02-15] ()
 R2 csrcc; C:\Program Files\shopperz\csrcc.exe [1445752 2015-02-15] ()
 R2 shopperz Updater; C:\Program Files\shopperz\nseven.exe [169848 2015-02-15] ()
 R1 cherimoya; C:\Windows\System32\drivers\cherimoya.sys [51160 2015-01-06] (Cherimoya Ltd)
 () C:\Program Files\Shopperz
 (Cherimoya Ltd) C:\Windows\system32\Drivers\cherimoya.sys

 Task: {2B5B0663-0494-49ED-8413-1B0F61F0717B} - System32\Tasks\gtaUpt => C:\Program Files\shopperz\zaeed.bat [2015-02-15] ()
Alterations made by the installer:

File system details  
---------------------------------------------
    Adds the folder C:\Program Files\Shopperz
       Adds the file csrcc.exe"="2/15/2015 5:02 PM, 1445752 bytes, A
       Adds the file garrus.dll"="2/15/2015 5:02 PM, 884088 bytes, A
       Adds the file grunt.exe"="2/15/2015 5:02 PM, 281976 bytes, A
       Adds the file kasumi32.dll"="2/15/2015 5:02 PM, 308600 bytes, A
       Adds the file kasumi64.dll"="2/15/2015 5:02 PM, 333176 bytes, A
       Adds the file krios.dll"="2/15/2015 5:02 PM, 288120 bytes, A
       Adds the file krios64.dll"="2/15/2015 5:02 PM, 294264 bytes, A
       Adds the file liara.dll"="2/15/2015 5:02 PM, 238456 bytes, A
       Adds the file liara64.dll"="2/15/2015 5:02 PM, 273272 bytes, A
       Adds the file mseff32.dll"="2/15/2015 5:02 PM, 176504 bytes, A
       Adds the file nfregdrv32.exe"="2/15/2015 5:02 PM, 111480 bytes, A
       Adds the file nseven.exe"="2/15/2015 5:02 PM, 169848 bytes, A
       Adds the file sprz.exe"="2/26/2015 4:53 PM, 2520616 bytes, A
       Adds the file tree.js"="2/27/2015 9:37 AM, 292 bytes, A
       Adds the file tsoni.dll"="2/15/2015 5:02 PM, 610680 bytes, A
       Adds the file tsoni64.dll"="2/15/2015 5:02 PM, 620920 bytes, A
       Adds the file unins000.dat"="2/27/2015 9:37 AM, 82874 bytes, A
       Adds the file unins000.exe"="2/27/2015 9:37 AM, 1198793 bytes, A
       Adds the file wrex.exe"="2/15/2015 5:02 PM, 429944 bytes, A
       Adds the file wrex64.exe"="2/15/2015 5:02 PM, 460664 bytes, A
       Adds the file zaeed.bat"="2/15/2015 4:59 PM, 75 bytes, A
    Adds the folder C:\Program Files\Shopperz\Firefox
       Adds the file {5081D2D4-1637-404c-B74F-50526718257D}.xpi"="2/15/2015 4:59 PM, 15198 bytes, A
       Adds the file chrome.manifest"="2/15/2015 4:59 PM, 338 bytes, A
       Adds the file icon.png"="5/12/2013 3:03 PM, 2424 bytes, A
       Adds the file install.rdf"="2/15/2015 4:59 PM, 841 bytes, A
    Adds the folder C:\Program Files\Shopperz\Firefox\chrome\content
    Adds the folder C:\Program Files\Shopperz\Firefox\chrome\locale
    Adds the folder C:\Program Files\Shopperz\Firefox\chrome\skin
    Adds the folder C:\Program Files\Shopperz\Firefox\defaults
    Adds the folder C:\Program Files\Shopperz\libraries
       Adds the file DataExchangeScript.js"="2/15/2015 4:59 PM, 2329 bytes, A
    Adds the folder C:\Program Files\Shopperz\resources
       Adds the file LocalScript.js"="2/15/2015 4:59 PM, 4098 bytes, A
    Adds the folder C:\Users\{username}\AppData\LocalLow\{D2020D47-707D-4E26-B4D9-739C4F4C2E9A}\{FBC0652C-7B29-4FB6-8ADA-91F54B267AD4}\1.5
       Adds the file config.js"="10/14/2014 3:06 PM, 1233 bytes, A
       Adds the file sts.js"="2/27/2015 9:38 AM, 0 bytes, A
       Adds the file tree.js"="2/27/2015 9:37 AM, 292 bytes, A
       Adds the file wlist.js"="11/30/2014 3:41 PM, 67 bytes, A
    Adds the folder C:\Users\{username}\AppData\LocalLow\Company\Product\1.0
       Adds the file localStorageIE.txt"="2/27/2015 9:37 AM, 240 bytes, A
       Adds the file localStorageIE_backup.txt"="2/27/2015 9:37 AM, 240 bytes, A
    In the existing folder C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles
       Adds the file 6qeoodjs.default-1401006518835extensions.ini"="2/27/2015 9:37 AM, 63 bytes, A
    In the existing folder C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835
       Alters the file prefs.js
        2/11/2015 2:30 PM, 4847 bytes, A ==> 2/27/2015 9:37 AM, 4894 bytes, A
       Adds the file user.js"="2/27/2015 9:37 AM, 45 bytes, A
    In the existing folder C:\Windows\System32\drivers
       Adds the file cherimoya.sys"="1/6/2015 12:38 PM, 51160 bytes, A
    In the existing folder C:\Windows\System32\Tasks
       Adds the file gtaUpt"="2/27/2015 9:37 AM, 3634 bytes, A

Registry details  
------------------------------------------
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{425F4ABF-B8E4-402D-9E49-06E494EB8DBF}]
       "LocalService"="REG_SZ", "csrcc"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{4AC9981D-592D-4044-8C0A-8F6FE843D683}]
       "LocalService"="REG_SZ", "70F4EEDB-1367-4b4f-8247-3133551A7415"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{94CB6BE7-AE1A-4751-AE74-1EDD6B567264}]
       "(Default)"="REG_SZ", "Extension"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\mseff32.DLL]
       "AppID"="REG_SZ", "{94CB6BE7-AE1A-4751-AE74-1EDD6B567264}"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{08ACFB57-8187-47f0-AF93-56360D03634A}]
       "Init"="REG_SZ", "true"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3CF50C82-4C4B-43e9-B1B2-15CB1BD0C193}]
       "(Default)"="REG_SZ", "SG Class"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3CF50C82-4C4B-43e9-B1B2-15CB1BD0C193}\LocalServer32]
       "(Default)"="REG_SZ", ""C:\Program Files\shopperz\grunt.exe""
       "ServerExecutable"="REG_SZ", "C:\Program Files\shopperz\grunt.exe"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3CF50C82-4C4B-43e9-B1B2-15CB1BD0C193}\Programmable]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3CF50C82-4C4B-43e9-B1B2-15CB1BD0C193}\TypeLib]
       "(Default)"="REG_SZ", "{B5C4833B-847B-49cd-8EBE-CDD9B43C882F}"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3CF50C82-4C4B-43e9-B1B2-15CB1BD0C193}\Version]
       "(Default)"="REG_SZ", "1.0"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5081D2D4-1637-404c-B74F-50526718257D}]
       "(Default)"="REG_SZ", "shopperz"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5081D2D4-1637-404c-B74F-50526718257D}\Implemented Categories]
       "(Default)"="REG_SZ", ""
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5081D2D4-1637-404c-B74F-50526718257D}\Implemented Categories\{59fb2056-d625-48d0-a944-1a85b5ab2640}]
       "(Default)"="REG_SZ", ""
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5081D2D4-1637-404c-B74F-50526718257D}\InprocServer32]
       "(Default)"="REG_SZ", "C:\Program Files\shopperz\mseff32.dll"
       "ThreadingModel"="REG_SZ", "Apartment"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5081D2D4-1637-404c-B74F-50526718257D}\ProgID]
       "(Default)"="REG_SZ", "Extension.jshep.1"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5081D2D4-1637-404c-B74F-50526718257D}\Programmable]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5081D2D4-1637-404c-B74F-50526718257D}\TypeLib]
       "(Default)"="REG_SZ", "{9AE7A6AE-162E-44c4-9A2B-A6B4EF19909D}"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5081D2D4-1637-404c-B74F-50526718257D}\VersionIndependentProgID]
       "(Default)"="REG_SZ", "Extension.jshep"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7D8DAE88-BC05-4578-8C29-E541FFBA5757}]
       "(Default)"="REG_SZ", "CSRC Class"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7D8DAE88-BC05-4578-8C29-E541FFBA5757}\LocalServer32]
       "(Default)"="REG_SZ", ""C:\Program Files\shopperz\csrcc.exe""
       "ServerExecutable"="REG_SZ", "C:\Program Files\shopperz\csrcc.exe"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7D8DAE88-BC05-4578-8C29-E541FFBA5757}\Programmable]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7D8DAE88-BC05-4578-8C29-E541FFBA5757}\TypeLib]
       "(Default)"="REG_SZ", "{14EF423E-3EE8-44AE-9337-07AC3F27B744}"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7D8DAE88-BC05-4578-8C29-E541FFBA5757}\Version]
       "(Default)"="REG_SZ", "1.0"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Extension.jshep]
       "(Default)"="REG_SZ", "shopperz"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Extension.jshep\CLSID]
       "(Default)"="REG_SZ", "{5081D2D4-1637-404c-B74F-50526718257D}"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Extension.jshep\CurVer]
       "(Default)"="REG_SZ", "Extension.jshep.1"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Extension.jshep.1]
       "(Default)"="REG_SZ", "shopperz"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Extension.jshep.1\CLSID]
       "(Default)"="REG_SZ", "{5081D2D4-1637-404c-B74F-50526718257D}"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A9582D7B-F24A-441D-9D26-450D58F3CD17}]
       "(Default)"="REG_SZ", "_ICSRCEvents"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A9582D7B-F24A-441D-9D26-450D58F3CD17}\ProxyStubClsid]
       "(Default)"="REG_SZ", "{00020420-0000-0000-C000-000000000046}"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A9582D7B-F24A-441D-9D26-450D58F3CD17}\ProxyStubClsid32]
       "(Default)"="REG_SZ", "{00020420-0000-0000-C000-000000000046}"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A9582D7B-F24A-441D-9D26-450D58F3CD17}\TypeLib]
       "(Default)"="REG_SZ", "{14EF423E-3EE8-44AE-9337-07AC3F27B744}"
       "Version"="REG_SZ", "1.0"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D1661A59-E9D3-4603-8822-2FBEADA5E097}]
       "(Default)"="REG_SZ", "ISG"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D1661A59-E9D3-4603-8822-2FBEADA5E097}\ProxyStubClsid]
       "(Default)"="REG_SZ", "{00020424-0000-0000-C000-000000000046}"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D1661A59-E9D3-4603-8822-2FBEADA5E097}\ProxyStubClsid32]
       "(Default)"="REG_SZ", "{00020424-0000-0000-C000-000000000046}"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D1661A59-E9D3-4603-8822-2FBEADA5E097}\TypeLib]
       "(Default)"="REG_SZ", "{B5C4833B-847B-49CD-8EBE-CDD9B43C882F}"
       "Version"="REG_SZ", "1.0"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E309D526-009C-490B-9BB1-CF9D525F6854}]
       "(Default)"="REG_SZ", "_ISGEvents"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E309D526-009C-490B-9BB1-CF9D525F6854}\ProxyStubClsid]
       "(Default)"="REG_SZ", "{00020420-0000-0000-C000-000000000046}"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E309D526-009C-490B-9BB1-CF9D525F6854}\ProxyStubClsid32]
       "(Default)"="REG_SZ", "{00020420-0000-0000-C000-000000000046}"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E309D526-009C-490B-9BB1-CF9D525F6854}\TypeLib]
       "(Default)"="REG_SZ", "{B5C4833B-847B-49CD-8EBE-CDD9B43C882F}"
       "Version"="REG_SZ", "1.0"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E4C3E50F-5761-4BF8-95A0-939A819DF1C3}]
       "(Default)"="REG_SZ", "IExtensionHelperObject"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E4C3E50F-5761-4BF8-95A0-939A819DF1C3}\ProxyStubClsid]
       "(Default)"="REG_SZ", "{00020424-0000-0000-C000-000000000046}"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E4C3E50F-5761-4BF8-95A0-939A819DF1C3}\ProxyStubClsid32]
       "(Default)"="REG_SZ", "{00020424-0000-0000-C000-000000000046}"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E4C3E50F-5761-4BF8-95A0-939A819DF1C3}\TypeLib]
       "(Default)"="REG_SZ", "{9AE7A6AE-162E-44C4-9A2B-A6B4EF19909D}"
       "Version"="REG_SZ", "1.0"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EE0D8859-2ED4-4B0D-9812-16865B9AFD65}]
       "(Default)"="REG_SZ", "ICSRC"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EE0D8859-2ED4-4B0D-9812-16865B9AFD65}\ProxyStubClsid]
       "(Default)"="REG_SZ", "{00020424-0000-0000-C000-000000000046}"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EE0D8859-2ED4-4B0D-9812-16865B9AFD65}\ProxyStubClsid32]
       "(Default)"="REG_SZ", "{00020424-0000-0000-C000-000000000046}"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EE0D8859-2ED4-4B0D-9812-16865B9AFD65}\TypeLib]
       "(Default)"="REG_SZ", "{14EF423E-3EE8-44AE-9337-07AC3F27B744}"
       "Version"="REG_SZ", "1.0"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{14EF423E-3EE8-44AE-9337-07AC3F27B744}\1.0]
       "(Default)"="REG_SZ", "csrccLib"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{14EF423E-3EE8-44AE-9337-07AC3F27B744}\1.0\0\win32]
       "(Default)"="REG_SZ", "C:\Program Files\shopperz\csrcc.exe"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{14EF423E-3EE8-44AE-9337-07AC3F27B744}\1.0\FLAGS]
       "(Default)"="REG_SZ", "0"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{14EF423E-3EE8-44AE-9337-07AC3F27B744}\1.0\HELPDIR]
       "(Default)"="REG_SZ", "C:\Program Files\shopperz"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{9AE7A6AE-162E-44C4-9A2B-A6B4EF19909D}\1.0]
       "(Default)"="REG_SZ", "Extension 1.0 Type Library"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{9AE7A6AE-162E-44C4-9A2B-A6B4EF19909D}\1.0\0\win32]
       "(Default)"="REG_SZ", "C:\Program Files\shopperz\mseff32.dll"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{9AE7A6AE-162E-44C4-9A2B-A6B4EF19909D}\1.0\FLAGS]
       "(Default)"="REG_SZ", "0"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{9AE7A6AE-162E-44C4-9A2B-A6B4EF19909D}\1.0\HELPDIR]
       "(Default)"="REG_SZ", "C:\Program Files\shopperz"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{B5C4833B-847B-49CD-8EBE-CDD9B43C882F}\1.0]
       "(Default)"="REG_SZ", "guardsvcLib"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{B5C4833B-847B-49CD-8EBE-CDD9B43C882F}\1.0\0\win32]
       "(Default)"="REG_SZ", "C:\Program Files\shopperz\grunt.exe"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{B5C4833B-847B-49CD-8EBE-CDD9B43C882F}\1.0\FLAGS]
       "(Default)"="REG_SZ", "0"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{B5C4833B-847B-49CD-8EBE-CDD9B43C882F}\1.0\HELPDIR]
       "(Default)"="REG_SZ", "C:\Program Files\shopperz"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5081D2D4-1637-404c-B74F-50526718257D}]
       "(Default)"="REG_SZ", "shopperz Helper"
       "NoExplorer"="REG_DWORD", 1
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
       "shopperz"="REG_SZ", "C:\Program Files\shopperz\wrex.exe"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5081D2D4-1637-404c-B74F-50526718257D}_is1]
       "DisplayName"="REG_SZ", "shopperz 2.0.0.457"
       "DisplayVersion"="REG_SZ", "2.0.0.457"
       "EstimatedSize"="REG_DWORD", 8028
       "Inno Setup: App Path"="REG_SZ", "C:\Program Files\shopperz"
       "Inno Setup: Icon Group"="REG_SZ", "shopperz"
       "Inno Setup: Language"="REG_SZ", "english"
       "Inno Setup: Setup Version"="REG_SZ", "5.5.3 (u)"
       "Inno Setup: User"="REG_SZ", "Malwarebytes"
       "InstallDate"="REG_SZ", "20150227"
       "InstallLocation"="REG_SZ", "C:\Program Files\shopperz\"
       "MajorVersion"="REG_DWORD", 2
       "MinorVersion"="REG_DWORD", 0
       "NoModify"="REG_DWORD", 1
       "NoRepair"="REG_DWORD", 1
       "Publisher"="REG_SZ", "shopperz"
       "QuietUninstallString"="REG_SZ", ""C:\Program Files\shopperz\unins000.exe" /SILENT"
       "UninstallString"="REG_SZ", ""C:\Program Files\shopperz\unins000.exe""
    [HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\Extensions]
       "{5081D2D4-1637-404c-B74F-50526718257D}"="REG_SZ", "C:\Program Files\shopperz\Firefox"
    [HKEY_LOCAL_MACHINE\SOFTWARE\shopperz
       "appID"="REG_SZ", "5081D2D4-1637-404c-B74F-50526718257D"
       "channel_id"="REG_SZ", ""
       "install_time"="REG_SZ", "27-02-2015"
       "installer_name"="REG_SZ", "vbates__.exe"
       "product_name"="REG_SZ", "shopperz"
       "product_version"="REG_SZ", "2.0.0.457"
       "ToolbarID"="REG_SZ", "65de197e87c34a898a4f5271cffb1483"
       "version"="REG_SZ", "2.0.0.457"
    [HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Mozilla\Firefox\Extensions]
       "{5081D2D4-1637-404c-B74F-50526718257D}"="REG_SZ", "C:\Program Files\shopperz\Firefox"
    [HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\shopperz]
       "appID"="REG_SZ", "5081D2D4-1637-404c-B74F-50526718257D"
       "channel_id"="REG_SZ", ""
       "install_time"="REG_SZ", "27-02-2015"
       "installer_name"="REG_SZ", "vbates__.exe"
       "product_name"="REG_SZ", "shopperz"
       "product_version"="REG_SZ", "2.0.0.457"
       "ToolbarID"="REG_SZ", "65de197e87c34a898a4f5271cffb1483"
       "version"="REG_SZ", "2.0.0.457"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\70F4EEDB-1367-4b4f-8247-3133551A7415]
       "DependOnService"="REG_MULTI_SZ, "RPCSS "
       "DisplayName"="REG_SZ", "70F4EEDB-1367-4b4f-8247-3133551A7415"
       "ErrorControl"="REG_DWORD", 1
       "ImagePath"="REG_EXPAND_SZ, ""C:\Program Files\shopperz\grunt.exe""
       "ObjectName"="REG_SZ", "LocalSystem"
       "Start"="REG_DWORD", 2
       "Type"="REG_DWORD", 16
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\cherimoya]
       "DisplayName"="REG_SZ", "cherimoya"
       "ErrorControl"="REG_DWORD", 1
       "Group"="REG_SZ", "PNP_TDI"
       "ImagePath"="REG_EXPAND_SZ, "system32\drivers\cherimoya.sys"
       "Start"="REG_DWORD", 1
       "Tag"="REG_DWORD", 9
       "Type"="REG_DWORD", 1
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\cherimoya\Enum]
       "0"="REG_SZ", "Root\LEGACY_CHERIMOYA\0000"
       "Count"="REG_DWORD", 1
       "NextInstance"="REG_DWORD", 1
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\csrcc]
       "DependOnService"="REG_MULTI_SZ, "RPCSS "
       "DisplayName"="REG_SZ", "csrcc"
       "ErrorControl"="REG_DWORD", 1
       "ImagePath"="REG_EXPAND_SZ, ""C:\Program Files\shopperz\csrcc.exe""
       "ObjectName"="REG_SZ", "LocalSystem"
       "Start"="REG_DWORD", 2
       "Type"="REG_DWORD", 16
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\shopperz Updater]
       "DisplayName"="REG_SZ", "shopperz Updater"
       "ErrorControl"="REG_DWORD", 0
       "ImagePath"="REG_EXPAND_SZ, "C:\Program Files\shopperz\nseven.exe"
       "ObjectName"="REG_SZ", "LocalSystem"
       "Start"="REG_DWORD", 2
       "Type"="REG_DWORD", 16
    [HKEY_USERS\.DEFAULT\Software\{4E7638A1-6962-4e44-A6B9-F40E84FD6D09}]
       "Name"="REG_SZ", "C:\Program Files\shopperz\wrex.exe"
    [HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-18\Software\shopperz]
       "lastProcessCheckTimeH"="REG_DWORD", 30429800
       "lastProcessCheckTimeL"="REG_DWORD", -1083148096
       "lastUpdateCheckTimeH"="REG_DWORD", 30429800
       "lastUpdateCheckTimeL"="REG_DWORD", -1083148096
    [HKEY_USERS\S-1-5-19\Software\{4E7638A1-6962-4e44-A6B9-F40E84FD6D09}]
       "Name"="REG_SZ", "C:\Program Files\shopperz\wrex.exe"
    [HKEY_USERS\S-1-5-20\Software\{4E7638A1-6962-4e44-A6B9-F40E84FD6D09}]
       "Name"="REG_SZ", "C:\Program Files\shopperz\wrex.exe"
    [HKEY_CURRENT_USER\Software\{4E7638A1-6962-4e44-A6B9-F40E84FD6D09}]
       "Name"="REG_SZ", "C:\Program Files\shopperz\wrex.exe"
    [HKEY_CURRENT_USER\Software\Classes\Software\{4E7638A1-6962-4e44-A6B9-F40E84FD6D09}]
       "Name"="REG_SZ", "C:\Program Files\shopperz\wrex.exe"
    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-4016700205-1717049133-1125222536-1001\Software\shopperz]
       "toolbarID"="REG_SZ", "65de197e87c34a898a4f5271cffb1483"
    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-4016700205-1717049133-1125222536-1001\Software\shopperz\script_storage]
       "install_time"="REG_SZ", "27-02-2015"
       "installer_name"="REG_SZ", "vbates__.exe"
       "nb_timer"="REG_SZ", "not set"
       "prepop_timer"="REG_SZ", "not set"
       "prepop_url"="REG_SZ", "not set"
       "product_name"="REG_SZ", "shopperz"
       "product_version"="REG_SZ", "2.0.0.457"
       "pxl_VBATES_dailyPing"="REG_SZ", "dailyPing|||1425112676153"
       "temp_installer_name"="REG_SZ", "vbates__.exe"
       "temp_version"="REG_SZ", "2.0.0.457|||8641425026272682"
       "toolbarID"="REG_SZ", "65de197e87c34a898a4f5271cffb1483"
       "VBATES_executeCode"="REG_SZ", "not set"
       "VBATES_ga_redirected"="REG_SZ", "not set"
       "VBATES_ga_redirectedUrl"="REG_SZ", "not set"
       "VBATES_lastUpdate"="REG_SZ", "1425026278053|||8641425026278054"
       "VBATES_redirectURL"="REG_SZ", "|||8641425026273028"
       "VBATES_referer"="REG_SZ", "|||8641425026273028"
       "VBATES_status"="REG_SZ", "active"
       "VBATES_whiteList"="REG_SZ", "{}|||8641425026273028"
       "vbts_geo"="REG_SZ", "NL|||8641425026277139"
    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{5081D2D4-1637-404C-B74F-50526718257D}]
       "Flags"="REG_DWORD", 1024
       "VerCache"="REG_BINARY, ......................
Malwarebytes Anti-Malware log:

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 2/27/2015
Scan Time: 9:48:20 AM
Logfile: mbamShopperz.txt
Administrator: Yes

Version: 2.00.4.1028
Malware Database: v2015.02.27.03
Rootkit Database: v2015.02.25.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows 7 Service Pack 1
CPU: x86
File System: NTFS
User: Malwarebytes

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 294635
Time Elapsed: 4 min, 14 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 4
PUP.Optional.Shopperz.A, C:\Program Files\Shopperz\wrex.exe, 620, Delete-on-Reboot, [4e2163c04446b383033fd6cf92719769]
PUP.Optional.Shopperz.A, C:\Program Files\Shopperz\grunt.exe, 584, Delete-on-Reboot, [bdb20d16b6d4f244c6ef71338083b848]
PUP.Optional.Shopperz.A, C:\Program Files\Shopperz\nseven.exe, 2824, Delete-on-Reboot, [4e218b982b5f063020d2544edf24d32d]
PUP.Optional.Shopperz.A, C:\Program Files\Shopperz\csrcc.exe, 3484, Delete-on-Reboot, [412eb1722b5f91a56650ccd8649f857b]

Modules: 5
PUP.Optional.Shopperz.A, C:\Program Files\Shopperz\kasumi32.dll, Delete-on-Reboot, [284777ac64262a0c50a41082917224dc], 
PUP.Optional.Shopperz.A, C:\Program Files\Shopperz\krios.dll, Delete-on-Reboot, [284777ac64262a0c50a41082917224dc], 
PUP.Optional.Shopperz.A, C:\Program Files\Shopperz\krios.dll, Delete-on-Reboot, [284777ac64262a0c50a41082917224dc], 
PUP.Optional.Shopperz.A, C:\Program Files\Shopperz\liara.dll, Delete-on-Reboot, [284777ac64262a0c50a41082917224dc], 
PUP.Optional.Shopperz.A, C:\Program Files\Shopperz\tsoni.dll, Delete-on-Reboot, [284777ac64262a0c50a41082917224dc], 

Registry Keys: 22
PUP.Optional.cherimoya.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\cherimoya, Quarantined, [3b3475ae5634a096af54acf633d001ff], 
PUP.Optional.Shopperz.A, HKLM\SOFTWARE\shopperz, Quarantined, [fd72e53ed4b6a690e310dbc703004eb2], 
PUP.Optional.Shopperz.A, HKLM\SOFTWARE\WOW6432NODE\shopperz, Quarantined, [8de236ed2a60f442f201a9f9867d28d8], 
PUP.Optional.Shopperz.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\70F4EEDB-1367-4b4f-8247-3133551A7415, Quarantined, [bdb20d16b6d4f244c6ef71338083b848], 
PUP.Optional.Shopperz.A, HKLM\SOFTWARE\CLASSES\TYPELIB\{B5C4833B-847B-49CD-8EBE-CDD9B43C882F}, Quarantined, [bdb20d16b6d4f244c6ef71338083b848], 
PUP.Optional.Shopperz.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{D1661A59-E9D3-4603-8822-2FBEADA5E097}, Quarantined, [bdb20d16b6d4f244c6ef71338083b848], 
PUP.Optional.Shopperz.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{E309D526-009C-490B-9BB1-CF9D525F6854}, Quarantined, [bdb20d16b6d4f244c6ef71338083b848], 
PUP.Optional.Shopperz.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\shopperz Updater, Quarantined, [4e218b982b5f063020d2544edf24d32d], 
PUP.Optional.Shopperz.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\CSRCC, Quarantined, [412eb1722b5f91a56650ccd8649f857b], 
PUP.Optional.Shopperz.A, HKLM\SOFTWARE\CLASSES\TYPELIB\{14EF423E-3EE8-44AE-9337-07AC3F27B744}, Quarantined, [412eb1722b5f91a56650ccd8649f857b], 
PUP.Optional.Shopperz.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{A9582D7B-F24A-441D-9D26-450D58F3CD17}, Quarantined, [412eb1722b5f91a56650ccd8649f857b], 
PUP.Optional.Shopperz.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{EE0D8859-2ED4-4B0D-9812-16865B9AFD65}, Quarantined, [412eb1722b5f91a56650ccd8649f857b], 
PUP.Optional.Shopperz.A, HKLM\SOFTWARE\CLASSES\CLSID\{5081D2D4-1637-404c-B74F-50526718257D}, Quarantined, [284777ac64262a0c50a41082917224dc], 
PUP.Optional.Shopperz.A, HKLM\SOFTWARE\CLASSES\TYPELIB\{9AE7A6AE-162E-44c4-9A2B-A6B4EF19909D}, Quarantined, [284777ac64262a0c50a41082917224dc], 
PUP.Optional.Shopperz.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{E4C3E50F-5761-4BF8-95A0-939A819DF1C3}, Quarantined, [284777ac64262a0c50a41082917224dc], 
PUP.Optional.Shopperz.A, HKLM\SOFTWARE\CLASSES\Extension.jshep.1, Quarantined, [284777ac64262a0c50a41082917224dc], 
PUP.Optional.Shopperz.A, HKLM\SOFTWARE\CLASSES\Extension.jshep, Quarantined, [284777ac64262a0c50a41082917224dc], 
PUP.Optional.Shopperz.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{5081D2D4-1637-404C-B74F-50526718257D}, Quarantined, [284777ac64262a0c50a41082917224dc], 
PUP.Optional.Shopperz.A, HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{5081D2D4-1637-404C-B74F-50526718257D}, Quarantined, [284777ac64262a0c50a41082917224dc], 
PUP.Optional.Shopperz.A, HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{5081D2D4-1637-404C-B74F-50526718257D}, Quarantined, [284777ac64262a0c50a41082917224dc], 
PUP.Optional.Shopperz.A, HKLM\SOFTWARE\CLASSES\CLSID\{5081D2D4-1637-404C-B74F-50526718257D}\INPROCSERVER32, Quarantined, [284777ac64262a0c50a41082917224dc], 
PUP.Optional.Shopperz.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{5081D2D4-1637-404c-B74F-50526718257D}_is1, Quarantined, [284777ac64262a0c50a41082917224dc], 

Registry Values: 4
PUP.Optional.Shopperz.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|shopperz, C:\Program Files\shopperz\wrex.exe, Quarantined, [4e2163c04446b383033fd6cf92719769]
PUP.Optional.Shopperz.A, HKLM\SOFTWARE\MOZILLA\FIREFOX\EXTENSIONS|{5081D2D4-1637-404c-B74F-50526718257D}, C:\Program Files\shopperz\Firefox, Quarantined, [006fcd562961f54148fc842145bef50b]
PUP.Optional.Shopperz.A, HKLM\SOFTWARE\WOW6432NODE\MOZILLA\FIREFOX\EXTENSIONS|{5081D2D4-1637-404c-B74F-50526718257D}, C:\Program Files\shopperz\Firefox, Quarantined, [bdb2091aafdb989e10345352e71cbc44]
PUP.Optional.Shopperz.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\CSRCC|ImagePath, "C:\Program Files\shopperz\csrcc.exe", Quarantined, [412eb1722b5f91a56650ccd8649f857b]

Registry Data: 0
(No malicious items detected)

Folders: 13
PUP.Optional.Shopperz.A, C:\Program Files\Shopperz, Delete-on-Reboot, [284777ac64262a0c50a41082917224dc], 
PUP.Optional.Shopperz.A, C:\Program Files\Shopperz\Firefox, Quarantined, [284777ac64262a0c50a41082917224dc], 
PUP.Optional.Shopperz.A, C:\Program Files\Shopperz\Firefox\chrome, Quarantined, [284777ac64262a0c50a41082917224dc], 
PUP.Optional.Shopperz.A, C:\Program Files\Shopperz\Firefox\chrome\content, Quarantined, [284777ac64262a0c50a41082917224dc], 
PUP.Optional.Shopperz.A, C:\Program Files\Shopperz\Firefox\chrome\content\libraries, Quarantined, [284777ac64262a0c50a41082917224dc], 
PUP.Optional.Shopperz.A, C:\Program Files\Shopperz\Firefox\chrome\content\resources, Quarantined, [284777ac64262a0c50a41082917224dc], 
PUP.Optional.Shopperz.A, C:\Program Files\Shopperz\Firefox\chrome\locale, Quarantined, [284777ac64262a0c50a41082917224dc], 
PUP.Optional.Shopperz.A, C:\Program Files\Shopperz\Firefox\chrome\locale\en-US, Quarantined, [284777ac64262a0c50a41082917224dc], 
PUP.Optional.Shopperz.A, C:\Program Files\Shopperz\Firefox\chrome\skin, Quarantined, [284777ac64262a0c50a41082917224dc], 
PUP.Optional.Shopperz.A, C:\Program Files\Shopperz\Firefox\defaults, Quarantined, [284777ac64262a0c50a41082917224dc], 
PUP.Optional.Shopperz.A, C:\Program Files\Shopperz\Firefox\defaults\preferences, Quarantined, [284777ac64262a0c50a41082917224dc], 
PUP.Optional.Shopperz.A, C:\Program Files\Shopperz\libraries, Quarantined, [284777ac64262a0c50a41082917224dc], 
PUP.Optional.Shopperz.A, C:\Program Files\Shopperz\resources, Quarantined, [284777ac64262a0c50a41082917224dc], 

Files: 35
PUP.Optional.cherimoya.A, C:\Windows\System32\drivers\cherimoya.sys, Quarantined, [3b3475ae5634a096af54acf633d001ff], 
PUP.Optional.Shopperz.A, C:\Program Files\Shopperz\wrex.exe, Delete-on-Reboot, [4e2163c04446b383033fd6cf92719769], 
PUP.Optional.Shopperz.A, C:\Program Files\Shopperz\grunt.exe, Delete-on-Reboot, [bdb20d16b6d4f244c6ef71338083b848], 
PUP.Optional.Shopperz.A, C:\Program Files\Shopperz\nseven.exe, Delete-on-Reboot, [4e218b982b5f063020d2544edf24d32d], 
PUP.Optional.Shopperz.A, C:\Program Files\Shopperz\csrcc.exe, Delete-on-Reboot, [412eb1722b5f91a56650ccd8649f857b], 
PUP.Optional.Shopperz.A, C:\Program Files\Shopperz\garrus.dll, Quarantined, [284777ac64262a0c50a41082917224dc], 
PUP.Optional.Shopperz.A, C:\Program Files\Shopperz\kasumi32.dll, Delete-on-Reboot, [284777ac64262a0c50a41082917224dc], 
PUP.Optional.Shopperz.A, C:\Program Files\Shopperz\kasumi64.dll, Quarantined, [284777ac64262a0c50a41082917224dc], 
PUP.Optional.Shopperz.A, C:\Program Files\Shopperz\krios.dll, Delete-on-Reboot, [284777ac64262a0c50a41082917224dc], 
PUP.Optional.Shopperz.A, C:\Program Files\Shopperz\krios64.dll, Quarantined, [284777ac64262a0c50a41082917224dc], 
PUP.Optional.Shopperz.A, C:\Program Files\Shopperz\liara.dll, Delete-on-Reboot, [284777ac64262a0c50a41082917224dc], 
PUP.Optional.Shopperz.A, C:\Program Files\Shopperz\liara64.dll, Quarantined, [284777ac64262a0c50a41082917224dc], 
PUP.Optional.Shopperz.A, C:\Program Files\Shopperz\mseff32.dll, Quarantined, [284777ac64262a0c50a41082917224dc], 
PUP.Optional.Shopperz.A, C:\Program Files\Shopperz\nfregdrv32.exe, Quarantined, [284777ac64262a0c50a41082917224dc], 
PUP.Optional.Shopperz.A, C:\Program Files\Shopperz\sprz.exe, Quarantined, [284777ac64262a0c50a41082917224dc], 
PUP.Optional.Shopperz.A, C:\Program Files\Shopperz\tree.js, Quarantined, [284777ac64262a0c50a41082917224dc], 
PUP.Optional.Shopperz.A, C:\Program Files\Shopperz\tsoni.dll, Delete-on-Reboot, [284777ac64262a0c50a41082917224dc], 
PUP.Optional.Shopperz.A, C:\Program Files\Shopperz\tsoni64.dll, Quarantined, [284777ac64262a0c50a41082917224dc], 
PUP.Optional.Shopperz.A, C:\Program Files\Shopperz\unins000.dat, Quarantined, [284777ac64262a0c50a41082917224dc], 
PUP.Optional.Shopperz.A, C:\Program Files\Shopperz\unins000.exe, Quarantined, [284777ac64262a0c50a41082917224dc], 
PUP.Optional.Shopperz.A, C:\Program Files\Shopperz\wrex64.exe, Quarantined, [284777ac64262a0c50a41082917224dc], 
PUP.Optional.Shopperz.A, C:\Program Files\Shopperz\zaeed.bat, Quarantined, [284777ac64262a0c50a41082917224dc], 
PUP.Optional.Shopperz.A, C:\Program Files\Shopperz\Firefox\chrome.manifest, Quarantined, [284777ac64262a0c50a41082917224dc], 
PUP.Optional.Shopperz.A, C:\Program Files\Shopperz\Firefox\icon.png, Quarantined, [284777ac64262a0c50a41082917224dc], 
PUP.Optional.Shopperz.A, C:\Program Files\Shopperz\Firefox\install.rdf, Quarantined, [284777ac64262a0c50a41082917224dc], 
PUP.Optional.Shopperz.A, C:\Program Files\Shopperz\Firefox\{5081D2D4-1637-404c-B74F-50526718257D}.xpi, Quarantined, [284777ac64262a0c50a41082917224dc], 
PUP.Optional.Shopperz.A, C:\Program Files\Shopperz\Firefox\chrome\content\main.js, Quarantined, [284777ac64262a0c50a41082917224dc], 
PUP.Optional.Shopperz.A, C:\Program Files\Shopperz\Firefox\chrome\content\main.xul, Quarantined, [284777ac64262a0c50a41082917224dc], 
PUP.Optional.Shopperz.A, C:\Program Files\Shopperz\Firefox\chrome\content\libraries\DataExchangeScript.js, Quarantined, [284777ac64262a0c50a41082917224dc], 
PUP.Optional.Shopperz.A, C:\Program Files\Shopperz\Firefox\chrome\content\resources\LocalScript.js, Quarantined, [284777ac64262a0c50a41082917224dc], 
PUP.Optional.Shopperz.A, C:\Program Files\Shopperz\Firefox\chrome\locale\en-US\overlay.dtd, Quarantined, [284777ac64262a0c50a41082917224dc], 
PUP.Optional.Shopperz.A, C:\Program Files\Shopperz\Firefox\chrome\skin\overlay.css, Quarantined, [284777ac64262a0c50a41082917224dc], 
PUP.Optional.Shopperz.A, C:\Program Files\Shopperz\Firefox\defaults\preferences\defaults.js, Quarantined, [284777ac64262a0c50a41082917224dc], 
PUP.Optional.Shopperz.A, C:\Program Files\Shopperz\libraries\DataExchangeScript.js, Quarantined, [284777ac64262a0c50a41082917224dc], 
PUP.Optional.Shopperz.A, C:\Program Files\Shopperz\resources\LocalScript.js, Quarantined, [284777ac64262a0c50a41082917224dc], 

Physical Sectors: 0
(No malicious items detected)


(end)
As mentioned before the full version of Malwarebytes Anti-Malware could have protected your computer against this threat.
We use different ways of protecting your computer(s):
  • Dynamically Blocks Malware Sites & Servers
  • Malware Execution Prevention
Save yourself the hassle and get protected.
  • 0

Advertisements

#2
gerrybnz
Posted 28 February 2015 - 07:46 PM

gerrybnz

    New Member

  • Member
  • Pip
  • 3 posts

I became infected with cime watch by downloading from cnet !

Crime watch defies removal in so far as this sequence shows:

Scan

detect infection

remove infection

restart

scan again

detect infection

remove infection

TURN OFF WIFI

restart

scan again

infection detected

 

possibilities:

Malwarebytes did not remove successuly

crime watch can re-infect a " clean" PC even when the WIFI is off


  • 0

#3
Metallica
Posted 01 March 2015 - 02:01 AM

Metallica

    Spyware Veteran

  • GeekU Moderator
  • 33,101 posts
Hi gerrybnz,

Please start a new topic here. Include a description of your problem, including the fact that you already tried MBAM. There are probably other factors involved, and one of our malware experts will be able to help you with this issue. :)
  • 0

#4
dnellis
Posted 16 June 2015 - 01:40 PM

dnellis

    New Member

  • Member
  • Pip
  • 1 posts

I became infected with cime watch by downloading from cnet !

Crime watch defies removal in so far as this sequence shows:

Scan

detect infection

remove infection

restart

scan again

detect infection

remove infection

TURN OFF WIFI

restart

scan again

infection detected

 

possibilities:

Malwarebytes did not remove successuly

crime watch can re-infect a " clean" PC even when the WIFI is off

The malware (or PUP) is restoring itself. Go to "Control Panel', "System",   Select "System Properties".   Select the "System Restore Tab". Check the box marked "Turn Off System Restore". Run your malware scan. Restart computer. Don't forget to turn System Restore back on.


  • 0

#5
ramkumar
Posted 06 July 2015 - 05:47 AM

ramkumar

    New Member

  • Member
  • Pip
  • 3 posts

including the fact that you already tried MBAM. There are probably other factors involved, and one of our malware experts will be able to help you with this issue.


  • 0
Back to Malware Removal Guides and Tutorials


0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

  1. Geeks to Go Community
  2. → Security
  3. → Malware Removal Guides and Tutorials

As Featured On:

featured
Malware Removal How to Guides Windows 7 System Building Download Files Register welcome

Never used a forum? Learn how.