Removal instructions for SwytShop

Content is republished with permission from Malwarebytes.

What is SwytShop?

The Malwarebytes research team has determined that SwytShop is a browser hijacker. These so-called "hijackers" manipulate your browser(s), for example to change your startpage or searchscopes, so that the affected browser visits their site or one of their choice. This one also displays advertisements.

How do I know if my computer is affected by SwytShop?

You may see this entry in your list of installed software:

this Chrome extension:

and these Scheduled Tasks:

and you will see this icon in your Chrome browser:

How did SwytShop get on my computer?

Browser hijackers use different methods for distributing themselves. This particular one was bundled with other software.

How do I remove SwytShop?

Our program Malwarebytes can detect and remove this potentially unwanted program.

Please download Malwarebytes to your desktop.
Double-click mb3-setup-consumer-{version}.exe and follow the prompts to install the program.
Then click Finish.
Once the program has fully updated, select Scan Now on the Dashboard. Or select the Threat Scan from the Scan menu.
If another update of the definitions is available, it will be implemented before the rest of the scanning procedure.
When the scan is complete, make sure that all Threats are selected, and click Remove Selected.
Restart your computer when prompted to do so.

Is there anything else I need to do to get rid of SwytShop?

No, Malwarebytes removes SwytShop completely.
This PUP creates some scheduled tasks. You can read here how to check for and, if necessary, remove Scheduled Tasks.
If you are using Chrome, you may have to remove the Extension manually under Tools > Settings > Extensions. Remove the checkmark and click on the bin behind the SwytShop entry.

How would the full version of Malwarebytes help protect me?

We hope our application and this guide have helped you eradicate this hijacker.

As you can see below the full version of Malwarebytes would have protected you against the SwytShop hijacker. It would have warned you before the application could install itself, giving you a chance to stop it before it became too late.

Technical details for experts

Possible signs in FRST logs:

 CHR Extension: (SwytShop) - C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\gobbnicjoijcfndfmmfjnfgldgcnjibl [2017-04-05]
 C:\Windows\System32\Tasks\GEN_Interval
 C:\Windows\System32\Tasks\GEN

SwytShop version 1.0 (HKCU\...\SwytShopAlgoadChrome_Pkg2_is1) (Version: 1.0 - SwytShop)
Task: {3A824A09-B4E2-443C-BE37-A5AD42A69F28} - System32\Tasks\GEN => C:\Users\{username}\AppData\Local\Programs\GEN\GEN.exe [2017-04-02] (                                                            )
Task: {91C85A91-E0F2-49FD-91F9-4CF433B0EC5E} - System32\Tasks\GEN_Interval => C:\Users\{username}\AppData\Local\Programs\GEN\GEN.exe [2017-04-02] (                                                            )

Alterations made by the installer:

File system details [View: All details] (Selection)
---------------------------------------------------
    Adds the folder C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\gobbnicjoijcfndfmmfjnfgldgcnjibl\4.1.9.2_0
       Adds the file icon.png"="4/5/2017 9:25 AM, 20634 bytes, A
       Adds the file manifest.json"="4/5/2017 9:25 AM, 2121 bytes, A
    Adds the folder C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\gobbnicjoijcfndfmmfjnfgldgcnjibl\4.1.9.2_0\algoad
       Adds the file google.css"="4/5/2017 9:25 AM, 388 bytes, A
       Adds the file google.js"="4/5/2017 9:25 AM, 14772 bytes, A
       Adds the file index.js"="4/5/2017 9:25 AM, 72137 bytes, A
       Adds the file popup.html"="4/5/2017 9:25 AM, 5888 bytes, A
       Adds the file token.json"="4/5/2017 9:25 AM, 34 bytes, A
    Adds the folder C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\gobbnicjoijcfndfmmfjnfgldgcnjibl\4.1.9.2_0\algoad\in-image
       Adds the file createInImage.css"="4/5/2017 9:25 AM, 3188 bytes, A
       Adds the file createInImage.js"="4/5/2017 9:25 AM, 2125 bytes, A
       Adds the file in-image.css"="4/5/2017 9:25 AM, 104 bytes, A
       Adds the file in-image.js"="4/5/2017 9:25 AM, 2891 bytes, A
    Adds the folder C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\gobbnicjoijcfndfmmfjnfgldgcnjibl\4.1.9.2_0\algoad\in-text
       Adds the file createInText.css"="4/5/2017 9:25 AM, 3515 bytes, A
       Adds the file createInText.js"="4/5/2017 9:25 AM, 2731 bytes, A
       Adds the file findAndReplaceDOMText.js"="4/5/2017 9:25 AM, 6639 bytes, A
       Adds the file in-text.css"="4/5/2017 9:25 AM, 197 bytes, A
       Adds the file in-text.js"="4/5/2017 9:25 AM, 3279 bytes, A
       Adds the file opentip.css"="4/5/2017 9:25 AM, 7908 bytes, A
       Adds the file opentip-native.js"="4/5/2017 9:25 AM, 39025 bytes, A
    In the existing folder C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Local Storage
       Adds the file chrome-extension_gobbnicjoijcfndfmmfjnfgldgcnjibl_0.localstorage"="4/5/2017 9:25 AM, 3072 bytes, A
    Adds the folder C:\Users\{username}\AppData\Local\Programs\GEN
       Adds the file custom1.txt"="4/5/2017 9:25 AM, 16 bytes, A
       Adds the file GEN.exe"="4/2/2017 3:01 PM, 520127 bytes, A
       Adds the file url.txt"="4/5/2017 9:25 AM, 52 bytes, A
       Adds the file version.txt"="4/5/2017 9:25 AM, 3 bytes, A
    Adds the folder C:\Users\{username}\AppData\Local\Programs\SwytShopAlgoadChrome_Pkg2
       Adds the file captcha.hta"="1/20/2017 12:30 PM, 4406 bytes, A
       Adds the file unins000.dat"="4/5/2017 9:25 AM, 70342 bytes, A
       Adds the file unins000.exe"="4/5/2017 9:25 AM, 1202513 bytes, A
    In the existing folder C:\Windows\System32\Tasks
       Adds the file GEN"="4/5/2017 9:25 AM, 3180 bytes, A
       Adds the file GEN_Interval"="4/5/2017 9:25 AM, 3504 bytes, A

Registry details [View: All details] (Selection)
------------------------------------------------
    [HKEY_CURRENT_USER\Software\C84E]
       "ssaach-2-170402-150140_OK"="REG_DWORD", 1
    [HKEY_CURRENT_USER\Software\Genius]
       "C84E001Done"="REG_DWORD", 2
       "C84E001Result"="REG_DWORD", 1
       "C84E001Timestamp"="REG_SZ", "1491377125293"
    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\SwytShopAlgoadChrome_Pkg2_is1]
       "DisplayName"="REG_SZ", "SwytShop version 1.0"
       "DisplayVersion"="REG_SZ", "1.0"
       "EstimatedSize"="REG_DWORD", 2757
       "Inno Setup: App Path"="REG_SZ", "C:\Users\{username}\AppData\Local\Programs\SwytShopAlgoadChrome_Pkg2"
       "Inno Setup: Deselected Components"="REG_SZ", ""
       "Inno Setup: Icon Group"="REG_SZ", "(Default)"
       "Inno Setup: Language"="REG_SZ", "default"
       "Inno Setup: Selected Components"="REG_SZ", "gen"
       "Inno Setup: Setup Type"="REG_SZ", "default"
       "Inno Setup: Setup Version"="REG_SZ", "5.5.9 (u)"
       "Inno Setup: User"="REG_SZ", "{username}"
       "InstallDate"="REG_SZ", "20170405"
       "InstallLocation"="REG_SZ", "C:\Users\{username}\AppData\Local\Programs\SwytShopAlgoadChrome_Pkg2\"
       "MajorVersion"="REG_DWORD", 1
       "MinorVersion"="REG_DWORD", 0
       "NoModify"="REG_DWORD", 1
       "NoRepair"="REG_DWORD", 1
       "Publisher"="REG_SZ", "SwytShop"
       "QuietUninstallString"="REG_SZ", ""C:\Users\{username}\AppData\Local\Programs\SwytShopAlgoadChrome_Pkg2\unins000.exe" /SILENT"
       "UninstallString"="REG_SZ", ""C:\Users\{username}\AppData\Local\Programs\SwytShopAlgoadChrome_Pkg2\unins000.exe""
       "VersionMajor"="REG_DWORD", 1
       "VersionMinor"="REG_DWORD", 0
    [HKEY_CURRENT_USER\Software\SwytShop]
       "(Default)"="REG_DWORD", 1

Malwarebytes log:

Malwarebytes
www.malwarebytes.com

-Log Details-
Scan Date: 4/5/17
Scan Time: 1:13 PM
Logfile: mbamSwyftShop.txt
Administrator: Yes

-Software Information-
Version: 3.0.6.1469
Components Version: 1.0.96
Update Package Version: 1.0.1666
License: Free

-System Information-
OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: {computername}\{username}

-Scan Summary-
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 368395
Time Elapsed: 1 min, 31 sec

-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

-Scan Details-
Process: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registry Key: 6
PUP.Optional.SwytShop, HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\SwytShopAlgoadChrome_Pkg2_is1, Delete-on-Reboot, [3481], [386986],1.0.1666
PUP.Optional.SwytShop, HKCU\SOFTWARE\SwytShop, Delete-on-Reboot, [3481], [386984],1.0.1666
PUP.Optional.Geniv, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\GEN, Delete-on-Reboot, [2349], [344165],1.0.1666
PUP.Optional.Geniv, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\GEN_Interval, Delete-on-Reboot, [2349], [260517],1.0.1666
PUP.Optional.Geniv, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{3A824A09-B4E2-443C-BE37-A5AD42A69F28}, Delete-on-Reboot, [2349], [344152],1.0.1666
PUP.Optional.Geniv, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{91C85A91-E0F2-49FD-91F9-4CF433B0EC5E}, Delete-on-Reboot, [2349], [260516],1.0.1666

Registry Value: 2
PUP.Optional.Geniv, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{3A824A09-B4E2-443C-BE37-A5AD42A69F28}|PATH, Delete-on-Reboot, [2349], [344152],1.0.1666
PUP.Optional.Geniv, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{91C85A91-E0F2-49FD-91F9-4CF433B0EC5E}|PATH, Delete-on-Reboot, [2349], [260516],1.0.1666

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 9
PUP.Optional.SwytShop, C:\USERS\{username}\APPDATA\LOCAL\Programs\SwytShopAlgoadChrome_Pkg2, Delete-on-Reboot, [3481], [386986],1.0.1666
PUP.Optional.SwytShop, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\gobbnicjoijcfndfmmfjnfgldgcnjibl\4.1.9.2_0\algoad\in-image, Delete-on-Reboot, [3481], [384263],1.0.1666
PUP.Optional.SwytShop, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\gobbnicjoijcfndfmmfjnfgldgcnjibl\4.1.9.2_0\algoad\in-text, Delete-on-Reboot, [3481], [384263],1.0.1666
PUP.Optional.SwytShop, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\gobbnicjoijcfndfmmfjnfgldgcnjibl\4.1.9.2_0\_metadata, Delete-on-Reboot, [3481], [384263],1.0.1666
PUP.Optional.SwytShop, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\gobbnicjoijcfndfmmfjnfgldgcnjibl\4.1.9.2_0\algoad, Delete-on-Reboot, [3481], [384263],1.0.1666
PUP.Optional.SwytShop, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\gobbnicjoijcfndfmmfjnfgldgcnjibl\4.1.9.2_0, Delete-on-Reboot, [3481], [384263],1.0.1666
PUP.Optional.SwytShop, C:\USERS\{username}\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\EXTENSIONS\GOBBNICJOIJCFNDFMMFJNFGLDGCNJIBL, Delete-on-Reboot, [3481], [384263],1.0.1666
PUP.Optional.SwytShop, C:\USERS\{username}\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\LOCAL EXTENSION SETTINGS\GOBBNICJOIJCFNDFMMFJNFGLDGCNJIBL, Delete-on-Reboot, [3481], [384264],1.0.1666
PUP.Optional.Geniv, C:\USERS\{username}\APPDATA\LOCAL\PROGRAMS\GEN, Delete-on-Reboot, [2349], [386985],1.0.1666

File: 38
PUP.Optional.SwytShop, C:\USERS\{username}\DESKTOP\SSAACH-2-170402-150140.EXE, Delete-on-Reboot, [3481], [368892],1.0.1666
PUP.Optional.SwytShop, C:\Users\{username}\AppData\Local\Programs\SwytShopAlgoadChrome_Pkg2\captcha.hta, Delete-on-Reboot, [3481], [386986],1.0.1666
PUP.Optional.SwytShop, C:\Users\{username}\AppData\Local\Programs\SwytShopAlgoadChrome_Pkg2\unins000.dat, Delete-on-Reboot, [3481], [386986],1.0.1666
PUP.Optional.SwytShop, C:\Users\{username}\AppData\Local\Programs\SwytShopAlgoadChrome_Pkg2\unins000.exe, Delete-on-Reboot, [3481], [386986],1.0.1666
PUP.Optional.SwytShop, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\gobbnicjoijcfndfmmfjnfgldgcnjibl\4.1.9.2_0\algoad\in-image\createInImage.css, Delete-on-Reboot, [3481], [384263],1.0.1666
PUP.Optional.SwytShop, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\gobbnicjoijcfndfmmfjnfgldgcnjibl\4.1.9.2_0\algoad\in-image\createInImage.js, Delete-on-Reboot, [3481], [384263],1.0.1666
PUP.Optional.SwytShop, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\gobbnicjoijcfndfmmfjnfgldgcnjibl\4.1.9.2_0\algoad\in-image\in-image.css, Delete-on-Reboot, [3481], [384263],1.0.1666
PUP.Optional.SwytShop, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\gobbnicjoijcfndfmmfjnfgldgcnjibl\4.1.9.2_0\algoad\in-image\in-image.js, Delete-on-Reboot, [3481], [384263],1.0.1666
PUP.Optional.SwytShop, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\gobbnicjoijcfndfmmfjnfgldgcnjibl\4.1.9.2_0\algoad\in-text\createInText.css, Delete-on-Reboot, [3481], [384263],1.0.1666
PUP.Optional.SwytShop, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\gobbnicjoijcfndfmmfjnfgldgcnjibl\4.1.9.2_0\algoad\in-text\createInText.js, Delete-on-Reboot, [3481], [384263],1.0.1666
PUP.Optional.SwytShop, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\gobbnicjoijcfndfmmfjnfgldgcnjibl\4.1.9.2_0\algoad\in-text\findAndReplaceDOMText.js, Delete-on-Reboot, [3481], [384263],1.0.1666
PUP.Optional.SwytShop, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\gobbnicjoijcfndfmmfjnfgldgcnjibl\4.1.9.2_0\algoad\in-text\in-text.css, Delete-on-Reboot, [3481], [384263],1.0.1666
PUP.Optional.SwytShop, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\gobbnicjoijcfndfmmfjnfgldgcnjibl\4.1.9.2_0\algoad\in-text\in-text.js, Delete-on-Reboot, [3481], [384263],1.0.1666
PUP.Optional.SwytShop, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\gobbnicjoijcfndfmmfjnfgldgcnjibl\4.1.9.2_0\algoad\in-text\opentip-native.js, Delete-on-Reboot, [3481], [384263],1.0.1666
PUP.Optional.SwytShop, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\gobbnicjoijcfndfmmfjnfgldgcnjibl\4.1.9.2_0\algoad\in-text\opentip.css, Delete-on-Reboot, [3481], [384263],1.0.1666
PUP.Optional.SwytShop, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\gobbnicjoijcfndfmmfjnfgldgcnjibl\4.1.9.2_0\algoad\google.css, Delete-on-Reboot, [3481], [384263],1.0.1666
PUP.Optional.SwytShop, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\gobbnicjoijcfndfmmfjnfgldgcnjibl\4.1.9.2_0\algoad\google.js, Delete-on-Reboot, [3481], [384263],1.0.1666
PUP.Optional.SwytShop, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\gobbnicjoijcfndfmmfjnfgldgcnjibl\4.1.9.2_0\algoad\index.js, Delete-on-Reboot, [3481], [384263],1.0.1666
PUP.Optional.SwytShop, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\gobbnicjoijcfndfmmfjnfgldgcnjibl\4.1.9.2_0\algoad\popup.html, Delete-on-Reboot, [3481], [384263],1.0.1666
PUP.Optional.SwytShop, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\gobbnicjoijcfndfmmfjnfgldgcnjibl\4.1.9.2_0\algoad\token.json, Delete-on-Reboot, [3481], [384263],1.0.1666
PUP.Optional.SwytShop, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\gobbnicjoijcfndfmmfjnfgldgcnjibl\4.1.9.2_0\_metadata\computed_hashes.json, Delete-on-Reboot, [3481], [384263],1.0.1666
PUP.Optional.SwytShop, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\gobbnicjoijcfndfmmfjnfgldgcnjibl\4.1.9.2_0\_metadata\verified_contents.json, Delete-on-Reboot, [3481], [384263],1.0.1666
PUP.Optional.SwytShop, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\gobbnicjoijcfndfmmfjnfgldgcnjibl\4.1.9.2_0\icon.png, Delete-on-Reboot, [3481], [384263],1.0.1666
PUP.Optional.SwytShop, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\gobbnicjoijcfndfmmfjnfgldgcnjibl\4.1.9.2_0\manifest.json, Delete-on-Reboot, [3481], [384263],1.0.1666
PUP.Optional.SwytShop, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gobbnicjoijcfndfmmfjnfgldgcnjibl\000003.log, Delete-on-Reboot, [3481], [384264],1.0.1666
PUP.Optional.SwytShop, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gobbnicjoijcfndfmmfjnfgldgcnjibl\CURRENT, Delete-on-Reboot, [3481], [384264],1.0.1666
PUP.Optional.SwytShop, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gobbnicjoijcfndfmmfjnfgldgcnjibl\LOCK, Delete-on-Reboot, [3481], [384264],1.0.1666
PUP.Optional.SwytShop, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gobbnicjoijcfndfmmfjnfgldgcnjibl\LOG, Delete-on-Reboot, [3481], [384264],1.0.1666
PUP.Optional.SwytShop, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gobbnicjoijcfndfmmfjnfgldgcnjibl\LOG.old, Delete-on-Reboot, [3481], [384264],1.0.1666
PUP.Optional.SwytShop, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gobbnicjoijcfndfmmfjnfgldgcnjibl\MANIFEST-000001, Delete-on-Reboot, [3481], [384264],1.0.1666
PUP.Optional.Geniv, C:\USERS\{username}\APPDATA\LOCAL\PROGRAMS\GEN\URL.TXT, Delete-on-Reboot, [2349], [386985],1.0.1666
PUP.Optional.Geniv, C:\Users\{username}\AppData\Local\Programs\GEN\custom1.txt, Delete-on-Reboot, [2349], [386985],1.0.1666
PUP.Optional.Geniv, C:\Users\{username}\AppData\Local\Programs\GEN\GEN.exe, Delete-on-Reboot, [2349], [386985],1.0.1666
PUP.Optional.Geniv, C:\Users\{username}\AppData\Local\Programs\GEN\version.txt, Delete-on-Reboot, [2349], [386985],1.0.1666
PUP.Optional.SwytShop, C:\USERS\{username}\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\LOCAL STORAGE\chrome-extension_gobbnicjoijcfndfmmfjnfgldgcnjibl_0.localstorage, Delete-on-Reboot, [3481], [384274],1.0.1666
PUP.Optional.SwytShop, C:\USERS\{username}\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\LOCAL STORAGE\chrome-extension_gobbnicjoijcfndfmmfjnfgldgcnjibl_0.localstorage-journal, Delete-on-Reboot, [3481], [384274],1.0.1666
PUP.Optional.Geniv, C:\WINDOWS\SYSTEM32\TASKS\GEN, Delete-on-Reboot, [2349], [344167],1.0.1666
PUP.Optional.Geniv, C:\WINDOWS\SYSTEM32\TASKS\GEN_INTERVAL, Delete-on-Reboot, [2349], [260514],1.0.1666

Physical Sector: 0
(No malicious items detected)


(end)

As mentioned before the full version of Malwarebytes could have protected your computer against this threat.
We use different ways of protecting your computer(s):