Jump to content

Welcome to Geeks to Go
Geeks to Go Welcome
Create Account Login to Account
Photo

Removal instructions for Free Malware Removal Tool

- - - - -
Started by Metallica , Mar 29 2018 03:01 AM
855-332-0124

  • Please log in to reply
No replies to this topic

#1
Metallica
Posted 29 March 2018 - 03:01 AM

Metallica

    Spyware Veteran

  • GeekU Moderator
  • 33,101 posts
Content is republished with permission from Malwarebytes.

What is Free Malware Removal Tool?

The Malwarebytes research team has determined that Free Malware Removal Tool is a "system optimizer". These so-called "system optimizers" use intentional false positives to convince users that their systems have problems. Then they try to sell you their software, claiming it will remove these problems.
More information can be found on our Malwarebytes Labs blog.

How do I know if I am infected with Free Malware Removal Tool?

This is how the main screen of the system optimizer looks:

main.png

You will find these icons in your taskbar, your startmenu, and on your desktop:

icons.png

and see these warnings during install:

warning1.png

warning2.png

and this screen when you want to fix the found "problems":

warning5.png

You may see this entry in your list of installed programs:

warning4.png

and these tasks in your list of Scheduled Tasks:

warning3.png

How did Free Malware Removal Tool get on my computer?

These so-called system optimizers use different methods of getting installed. This particular one was downloaded from their website:

website.png

How do I remove Free Malware Removal Tool?

Our program Malwarebytes can detect and remove this potentially unwanted application.
  • Please download Malwarebytes to your desktop.
  • Double-click mb3-setup-consumer-{version}.exe and follow the prompts to install the program.
  • Then click Finish.
  • Once the program has fully updated, select Scan Now on the Dashboard. Or select the Threat Scan from the Scan menu.
  • If another update of the definitions is available, it will be implemented before the rest of the scanning procedure.
  • When the scan is complete, make sure that all Threats are selected, and click Remove Selected.
  • Restart your computer when prompted to do so.
Is there anything else I need to do to get rid of Free Malware Removal Tool?
  • No, Malwarebytes removes Free Malware Removal Tool completely.
  • This PUP creates some scheduled tasks. You can read here how to check for and, if necessary, remove Scheduled Tasks.
How would the full version of Malwarebytes help protect me?

We hope our application and this guide have helped you eradicate this system optimizer.

As you can see below the full version of Malwarebytes would have protected you against the Free Malware Removal Tool installer. It would have warned you before the application could install itself, giving you a chance to stop it before it became too late.

protection1.png


and we block access to their domain:

protection2.png


Technical details for experts

You may see these entries in FRST logs:

 (FreeMalwareRemovalTool.com) C:\Program Files\Free Malware Removal Tool\FMRT.exe
 C:\Windows\System32\Tasks\Free Malware Removal Tool
 C:\Windows\System32\Tasks\Free Malware Removal Tool_Logon
 C:\Users\{username}\AppData\Roaming\FreeMalwareRemovalTool.com
 C:\ProgramData\FreeMalwareRemovalTool.com
 C:\Program Files\Free Malware Removal Tool
 C:\Users\Public\Desktop\Free Malware Removal Tool.lnk
 C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Free Malware Removal Tool

Free Malware Removal Tool (HKLM\...\F5000FCC-7382-447E-A08C-9BC17438C64E_is1) (Version: 1.0.0.42197 - FreeMalwareRemovalTool.Com)
Task: {3123F391-4805-41D7-A822-84E3259DB592} - System32\Tasks\Free Malware Removal Tool => C:\Program Files\Free Malware Removal Tool\FMRT.exe [2017-12-11] (FreeMalwareRemovalTool.com)
Task: {61A07691-0C36-414B-ADF0-7E68B948665B} - System32\Tasks\Free Malware Removal Tool_Logon => C:\Program Files\Free Malware Removal Tool\FMRT.exe [2017-12-11] (FreeMalwareRemovalTool.com)
Alterations made by the installer:

File system details [View: All details] (Selection)
---------------------------------------------------
    Adds the folder C:\Program Files\Free Malware Removal Tool
       Adds the file 7z.dll"="12/11/2017 2:02 PM, 1081208 bytes, A
       Adds the file 7z.exe"="12/11/2017 2:02 PM, 272760 bytes, A
       Adds the file Buy Free Malware Removal Tool.lnk"="3/29/2018 8:53 AM, 937 bytes, A
       Adds the file danish_iss.ini"="6/24/2017 2:17 PM, 2424 bytes, A
       Adds the file Dutch_iss.ini"="6/24/2017 2:17 PM, 2622 bytes, A
       Adds the file english_iss.ini"="6/24/2017 2:17 PM, 2278 bytes, A
       Adds the file finish_iss.ini"="6/24/2017 2:17 PM, 2390 bytes, A
       Adds the file FMRT.exe"="12/11/2017 2:30 PM, 3642232 bytes, A
       Adds the file FMRT.exe.config"="8/14/2017 3:16 PM, 2874 bytes, A
       Adds the file fmrtlog.xsl"="6/24/2017 5:03 PM, 39015 bytes, A
       Adds the file French_iss.ini"="6/24/2017 2:17 PM, 2814 bytes, A
       Adds the file german_iss.ini"="6/24/2017 2:17 PM, 2680 bytes, A
       Adds the file ICSharpCode.SharpZipLib.dll"="12/11/2017 2:03 PM, 200056 bytes, A
       Adds the file Interop.IWshRuntimeLibrary.dll"="12/11/2017 2:03 PM, 56696 bytes, A
       Adds the file italian_iss.ini"="6/24/2017 2:17 PM, 2554 bytes, A
       Adds the file japanese_iss.ini"="6/24/2017 2:17 PM, 1866 bytes, A
       Adds the file langs.db"="12/11/2017 1:04 PM, 501760 bytes, A
       Adds the file Microsoft.Win32.TaskScheduler.dll"="12/11/2017 2:03 PM, 178552 bytes, A
       Adds the file Microsoft.WindowsAPICodePack.dll"="12/11/2017 2:03 PM, 105848 bytes, A
       Adds the file Microsoft.WindowsAPICodePack.Shell.dll"="12/11/2017 2:03 PM, 549752 bytes, A
       Adds the file Newtonsoft.Json.dll"="12/11/2017 2:03 PM, 472952 bytes, A
       Adds the file norwegian_iss.ini"="6/24/2017 2:17 PM, 2380 bytes, A
       Adds the file portuguese_iss.ini"="6/24/2017 2:17 PM, 2446 bytes, A
       Adds the file PresentationCore.dll"="6/24/2017 10:55 AM, 1419104 bytes, A
       Adds the file russian_iss.ini"="6/24/2017 2:17 PM, 2516 bytes, A
       Adds the file spanish_iss.ini"="6/24/2017 2:17 PM, 2570 bytes, A
       Adds the file swedish_iss.ini"="6/24/2017 2:17 PM, 2292 bytes, A
       Adds the file System.Data.SQLite.DLL"="12/11/2017 2:03 PM, 298360 bytes, A
       Adds the file System.Windows.Controls.Input.Toolkit.dll"="6/24/2017 10:55 AM, 109400 bytes, A
       Adds the file System.Windows.Controls.Layout.Toolkit.dll"="6/24/2017 10:55 AM, 95064 bytes, A
       Adds the file TAFactory.IconPack.dll"="12/11/2017 2:03 PM, 44408 bytes, A
       Adds the file unins000.dat"="3/29/2018 8:53 AM, 125010 bytes, A
       Adds the file unins000.exe"="3/29/2018 8:53 AM, 1358200 bytes, A
       Adds the file unins000.msg"="3/29/2018 8:53 AM, 22701 bytes, A
       Adds the file upload.log"="3/29/2018 8:56 AM, 850 bytes, A
       Adds the file WpfAnimatedGif.dll"="12/11/2017 2:30 PM, 47992 bytes, A
       Adds the file WPFToolkit.dll"="6/24/2017 10:55 AM, 467288 bytes, A
    Adds the folder C:\Program Files\Free Malware Removal Tool\x64
       Adds the file SQLite.Interop.dll"="12/11/2017 2:03 PM, 1183096 bytes, A
    Adds the folder C:\Program Files\Free Malware Removal Tool\x86
       Adds the file SQLite.Interop.dll"="12/11/2017 2:03 PM, 862072 bytes, A
    Adds the folder C:\ProgramData\FreeMalwareRemovalTool.com\Free Malware Removal Tool
       Adds the file QTine.cb"="3/29/2018 8:54 AM, 3072 bytes, A
    Adds the folder C:\ProgramData\FreeMalwareRemovalTool.com\Free Malware Removal Tool\Definition
       Adds the file Browsers.cb"="3/29/2018 8:55 AM, 736 bytes, A
       Adds the file ChromeExtentions.cb"="3/29/2018 8:54 AM, 133464 bytes, A
       Adds the file ChromeFiles.cb"="3/29/2018 8:54 AM, 225296 bytes, A
       Adds the file ChromeSearch.cb"="3/29/2018 8:54 AM, 27680 bytes, A
       Adds the file CLSID.cb"="3/29/2018 8:54 AM, 477912 bytes, A
       Adds the file CompleteDatabase.db"="3/28/2018 5:44 PM, 36765696 bytes, A
       Adds the file FileNames.cb"="3/29/2018 8:54 AM, 77792 bytes, A
       Adds the file FilesPath.cb"="3/29/2018 8:54 AM, 3468624 bytes, A
       Adds the file FirefoxExtentions.cb"="3/29/2018 8:54 AM, 103400 bytes, A
       Adds the file FirefoxFiles.cb"="3/29/2018 8:54 AM, 62864 bytes, A
       Adds the file FirefoxSearch.cb"="3/29/2018 8:54 AM, 26928 bytes, A
       Adds the file FolderNames.cb"="3/29/2018 8:54 AM, 163592 bytes, A
       Adds the file FoldersPath.cb"="3/29/2018 8:54 AM, 697552 bytes, A
       Adds the file IEExtension.cb"="3/29/2018 8:54 AM, 720 bytes, A
       Adds the file IESearch.cb"="3/29/2018 8:54 AM, 3576 bytes, A
       Adds the file MalwareDetails.cb"="3/29/2018 8:54 AM, 1630824 bytes, A
       Adds the file Md5Hash.cb"="3/29/2018 8:54 AM, 17104328 bytes, A
       Adds the file Plugins.cb"="3/29/2018 8:54 AM, 11528 bytes, A
       Adds the file Registry.cb"="3/29/2018 8:54 AM, 5174432 bytes, A
       Adds the file RegistrySetting.cb"="3/29/2018 8:55 AM, 1514144 bytes, A
       Adds the file Services.cb"="3/29/2018 8:54 AM, 41952 bytes, A
       Adds the file StartupTask.cb"="3/29/2018 8:54 AM, 49512 bytes, A
       Adds the file URLS.cb"="3/29/2018 8:54 AM, 30608 bytes, A
    Adds the folder C:\ProgramData\FreeMalwareRemovalTool.com\Free Malware Removal Tool\Definition\Update
       Adds the file 281completedatabase.zip"="3/29/2018 8:54 AM, 20251056 bytes, A
    Adds the folder C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Free Malware Removal Tool
       Adds the file Free Malware Removal Tool.lnk"="3/29/2018 8:53 AM, 925 bytes, A
       Adds the file Uninstall Free Malware Removal Tool.lnk"="3/29/2018 8:53 AM, 965 bytes, A
    Adds the folder C:\Users\{username}\AppData\Roaming\FreeMalwareRemovalTool.com\Free Malware Removal Tool
       Adds the file common_desktop.gif"="3/29/2018 8:54 AM, 0 bytes, A
       Adds the file DatabaseUpdate.xml"="3/29/2018 8:54 AM, 1090 bytes, A
       Adds the file Errorlog.txt"="3/29/2018 8:55 AM, 9720 bytes, A
       Adds the file logbkp.xml"="3/29/2018 8:55 AM, 581 bytes, A
       Adds the file Result.cb"="3/29/2018 8:55 AM, 6504 bytes, A
    Adds the folder C:\Users\{username}\AppData\Roaming\FreeMalwareRemovalTool.com\Free Malware Removal Tool\icon
       Adds the file 085539.ico"="3/29/2018 8:55 AM, 46164 bytes, A
    Adds the folder C:\Users\{username}\AppData\Roaming\FreeMalwareRemovalTool.com\Free Malware Removal Tool\LogBackups
       Adds the file fmrtbackup_29032018_085538.bin"="3/29/2018 8:55 AM, 10381 bytes, A
    Adds the folder C:\Users\{username}\AppData\Roaming\FreeMalwareRemovalTool.com\Free Malware Removal Tool\smico
    Adds the folder C:\Users\{username}\AppData\Roaming\FreeMalwareRemovalTool.com\Free Malware Removal Tool\Temp
    In the existing folder C:\Users\Public\Desktop
       Adds the file Free Malware Removal Tool.lnk"="3/29/2018 8:55 AM, 1970 bytes, A
    In the existing folder C:\Windows\Fonts
       Adds the file FMRTPro.ttf"="6/26/2017 7:20 PM, 31788 bytes, A
    In the existing folder C:\Windows\System32\Tasks
       Adds the file Free Malware Removal Tool"="3/29/2018 8:54 AM, 3390 bytes, A
       Adds the file Free Malware Removal Tool_Logon"="3/29/2018 8:53 AM, 3060 bytes, A

Registry details [View: All details] (Selection)
------------------------------------------------
    [HKEY_LOCAL_MACHINE\SOFTWARE\fmrt-pr]
       "affid"="REG_SZ", ""
       "country"="REG_SZ", "nl"
       "LangCode"="REG_SZ", "en"
       "phone"="REG_SZ", ""
       "utm_medium"="REG_SZ", ""
       "utm_pubid"="REG_SZ", ""
       "x-at"="REG_SZ", ""
       "x-context"="REG_SZ", ""
       "x-plt"="REG_SZ", ""
       "x-var1"="REG_SZ", ""
    [HKEY_LOCAL_MACHINE\SOFTWARE\FreeMalwareRemovalTool.com\Free Malware Removal Tool]
       "affid"="REG_SZ", ""
       "affired"="REG_DWORD", 1
       "afterInstallUrl"="REG_SZ", "http://www.freemalwareremovaltool.com/fmrt/afterinstall/?"
       "cbkpoff"="REG_DWORD", 1
       "country"="REG_SZ", "nl"
       "delay"="REG_DWORD", 0
       "EmailURL"="REG_SZ", ""
       "expired"="REG_DWORD", 0
       "hdata"="REG_BINARY, .....................................................................................................................................................................................................................................................................................................................................................................................................
       "Installstring"="REG_SZ", "C:\Program Files\Free Malware Removal Tool"
       "issilent"="REG_DWORD", 1
       "ISTELNO"="REG_DWORD", 1
       "LangCode"="REG_SZ", "en"
       "lstscnsett"="REG_BINARY, ......................................................................................................................................................................................................................................................................................................................................................................................................................................._.....
       "prereg"="REG_DWORD", 0
       "PurchaseURL"="REG_SZ", "http://malwarecrusher.esecureshoppe.com/price.asp?"
       "pxl"="REG_SZ", "fmr2265_fmr2216_fmr1180"
       "reg"="REG_DWORD", 1
       "RenewURL"="REG_SZ", "http://malwarecrusher.esecureshoppe.com/renewal.asp?"
       "runcam"="REG_SZ", "0"
       "runpixel"="REG_SZ", "0"
       "runsrc"="REG_SZ", "0"
       "showballoontip"="REG_DWORD", 0
       "showphone"="REG_DWORD", 0
       "showseal"="REG_DWORD", 0
       "showtn"="REG_DWORD", 1
       "showunins"="REG_DWORD", 1
       "showwfo"="REG_DWORD", 1
       "supporturl"="REG_SZ", "http://www.freemalwareremovaltool.com/support/"
       "TELNO"="REG_SZ", "+31-08-58882839"
       "TELNO_ar"="REG_SZ", "+54 11 5236 0324"
       "TELNO_at"="REG_SZ", "+43 (0)720 902 309"
       "TELNO_au"="REG_SZ", "(61)280-733403"
       "TELNO_br"="REG_SZ", "+55 21 2391 4319"
       "TELNO_ch"="REG_SZ", "+41 (0)44 508 70 37"
       "TELNO_de"="REG_SZ", "(800)-180-0926"
       "TELNO_dk"="REG_SZ", "+45 78 73 09 26"
       "TELNO_es"="REG_SZ", "+34 951 203 537"
       "TELNO_fi"="REG_SZ", "+358 (0)9 4270 4911"
       "TELNO_fr"="REG_SZ", "(334)-88627945"
       "TELNO_gb"="REG_SZ", "0800-031-5066"
       "TELNO_it"="REG_SZ", "+39 069 4802886"
       "TELNO_ja"="REG_SZ", "0120-993-506"
       "TELNO_jp"="REG_SZ", "0120-993-506"
       "TELNO_lu"="REG_SZ", "(800)-180-0926"
       "TELNO_nl"="REG_SZ", "+31-08-58882839"
       "TELNO_no"="REG_SZ", "+47 21 95 01 97"
       "TELNO_pt"="REG_SZ", "+351 70 750 2094"
       "TELNO_se"="REG_SZ", "+46-08124-10298"
       "TELNO_uk"="REG_SZ", "0800-031-5066"
       "TELNO_us"="REG_SZ", "(855)-332-0124"
       "utm_campaign"="REG_SZ", "fmrtsite"
       "utm_pubid"="REG_SZ", ""
       "utm_source"="REG_SZ", "fmrtsite"
       "vendorLogo"="REG_SZ", "common_logo.jpg"
       "vendorMachineAvi"="REG_SZ", "common_desktop.gif"
       "WebURL"="REG_SZ", "http://www.freemalwareremovaltool.com/"
       "wfoset"="REG_DWORD", 1
       "x-base"="REG_SZ", ""
       "x-ccode"="REG_SZ", "nl"
       "x-datetime"="REG_SZ", ""
       "x-fetch"="REG_SZ", "0"
       "x-ip"="REG_SZ", "90_145_230_242"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\F5000FCC-7382-447E-A08C-9BC17438C64E_is1]
       "DisplayIcon"="REG_SZ", "C:\Program Files\Free Malware Removal Tool\FMRT.exe"
       "DisplayName"="REG_SZ", "Free Malware Removal Tool"
       "DisplayVersion"="REG_SZ", "1.0.0.42197"
       "EstimatedSize"="REG_DWORD", 12746
       "HelpLink"="REG_SZ", "http://www.freemalwareremovaltool.com/support/"
       "Inno Setup: App Path"="REG_SZ", "C:\Program Files\Free Malware Removal Tool"
       "Inno Setup: Icon Group"="REG_SZ", "Free Malware Removal Tool"
       "Inno Setup: Language"="REG_SZ", "en"
       "Inno Setup: Setup Version"="REG_SZ", "5.5.5 (u)"
       "Inno Setup: User"="REG_SZ", "{username}"
       "InstallDate"="REG_SZ", "20180329"
       "InstallLocation"="REG_SZ", "C:\Program Files\Free Malware Removal Tool\"
       "MajorVersion"="REG_DWORD", 1
       "MinorVersion"="REG_DWORD", 0
       "NoModify"="REG_DWORD", 1
       "NoRepair"="REG_DWORD", 1
       "Publisher"="REG_SZ", "FreeMalwareRemovalTool.Com"
       "QuietUninstallString"="REG_SZ", ""C:\Program Files\Free Malware Removal Tool\unins000.exe" /SILENT"
       "UninstallString"="REG_SZ", ""C:\Program Files\Free Malware Removal Tool\unins000.exe" /SILENT"
       "URLInfoAbout"="REG_SZ", "FreeMalwareRemovalTool.Com"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts]
       "FMRTPro (TrueType)"="REG_SZ", "FMRTPro.ttf"
    [HKEY_LOCAL_MACHINE\SOFTWARE\RnJlZU1hbHdhcmVSZW1vdmFsVG9vbC5jb20=\RnJlZSBNYWx3YXJlIFJlbW92YWwgVG9vbA==\ACT]
       "data"="REG_BINARY, ...................................................................................................................................................................................................................................................................................................................._...........................................
    [HKEY_CURRENT_USER\Software\FreeMalwareRemovalTool.com\Free Malware Removal Tool]
       "affid"="REG_SZ", ""
       "Installstring"="REG_SZ", "C:\Program Files\Free Malware Removal Tool"
       "LangCode"="REG_SZ", "en"
       "pxl"="REG_SZ", "fmr2265_fmr2216_fmr1180"
       "utm_campaign"="REG_SZ", "fmrtsite"
       "utm_pubid"="REG_SZ", ""
       "utm_source"="REG_SZ", "fmrtsite"
       "x-datetime"="REG_SZ", ""
       "x-fetch"="REG_SZ", "0"
       "x-ip"="REG_SZ", "90_145_230_242"
    [HKEY_CURRENT_USER\Software\FreeMalwareRemovalTool.com\Free Malware Removal Tool\1.0.0.42197]
Malwarebytes log:

Malwarebytes
www.malwarebytes.com

-Log Details-
Scan Date: 3/29/18
Scan Time: 9:05 AM
Log File: 91bf3114-331f-11e8-b820-080027235d76.json
Administrator: Yes

-Software Information-
Version: 3.3.1.2183
Components Version: 1.0.262
Update Package Version: 1.0.4530
License: Premium

-System Information-
OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: {computername}\{username}

-Scan Summary-
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 244704
Threats Detected: 74
Threats Quarantined: 74
Time Elapsed: 3 min, 24 sec

-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Detect
PUM: Detect

-Scan Details-
Process: 1
PUP.Optional.FreeMalwareRemovalTool.TskLnk, C:\PROGRAM FILES\FREE MALWARE REMOVAL TOOL\FMRT.EXE, Quarantined, [5337], [502497],1.0.4530

Module: 8
PUP.Optional.FreeMalwareRemovalTool.TskLnk, C:\PROGRAM FILES\FREE MALWARE REMOVAL TOOL\FMRT.EXE, Quarantined, [5337], [502497],1.0.4530
PUP.Optional.FreeMalwareRemovalTool, C:\Program Files\Free Malware Removal Tool\x64\SQLite.Interop.dll, Quarantined, [966], [502494],1.0.4530
PUP.Optional.FreeMalwareRemovalTool, C:\Program Files\Free Malware Removal Tool\Newtonsoft.Json.dll, Quarantined, [966], [502494],1.0.4530
PUP.Optional.FreeMalwareRemovalTool, C:\Program Files\Free Malware Removal Tool\System.Data.SQLite.DLL, Quarantined, [966], [502494],1.0.4530
PUP.Optional.FreeMalwareRemovalTool, C:\Program Files\Free Malware Removal Tool\WpfAnimatedGif.dll, Quarantined, [966], [502494],1.0.4530
PUP.Optional.FreeMalwareRemovalTool, C:\Program Files\Free Malware Removal Tool\WPFToolkit.dll, Quarantined, [966], [502494],1.0.4530
PUP.Optional.FreeMalwareRemovalTool, C:\Program Files\Free Malware Removal Tool\Interop.IWshRuntimeLibrary.dll, Quarantined, [966], [502494],1.0.4530
PUP.Optional.FreeMalwareRemovalTool, C:\Program Files\Free Malware Removal Tool\Microsoft.Win32.TaskScheduler.dll, Quarantined, [966], [502494],1.0.4530

Registry Key: 16
PUP.Optional.FreeMalwareRemovalTool.TskLnk, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\Free Malware Removal Tool, Quarantined, [5337], [502497],1.0.4530
PUP.Optional.FreeMalwareRemovalTool.TskLnk, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{3123F391-4805-41D7-A822-84E3259DB592}, Quarantined, [5337], [502497],1.0.4530
PUP.Optional.FreeMalwareRemovalTool.TskLnk, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\PLAIN\{3123F391-4805-41D7-A822-84E3259DB592}, Quarantined, [5337], [502497],1.0.4530
PUP.Optional.FreeMalwareRemovalTool.TskLnk, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\Free Malware Removal Tool_Logon, Quarantined, [5337], [502497],1.0.4530
PUP.Optional.FreeMalwareRemovalTool.TskLnk, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{61A07691-0C36-414B-ADF0-7E68B948665B}, Quarantined, [5337], [502497],1.0.4530
PUP.Optional.FreeMalwareRemovalTool.TskLnk, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\LOGON\{61A07691-0C36-414B-ADF0-7E68B948665B}, Quarantined, [5337], [502497],1.0.4530
PUP.Optional.FreeMalwareRemovalTool.TskLnk, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Free Malware Removal Tool, Quarantined, [5337], [-1],0.0.0
PUP.Optional.FreeMalwareRemovalTool.TskLnk, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3123F391-4805-41D7-A822-84E3259DB592}, Quarantined, [5337], [-1],0.0.0
PUP.Optional.FreeMalwareRemovalTool.TskLnk, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{3123F391-4805-41D7-A822-84E3259DB592}, Quarantined, [5337], [-1],0.0.0
PUP.Optional.FreeMalwareRemovalTool.TskLnk, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Free Malware Removal Tool_Logon, Quarantined, [5337], [-1],0.0.0
PUP.Optional.FreeMalwareRemovalTool.TskLnk, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{61A07691-0C36-414B-ADF0-7E68B948665B}, Quarantined, [5337], [-1],0.0.0
PUP.Optional.FreeMalwareRemovalTool.TskLnk, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{61A07691-0C36-414B-ADF0-7E68B948665B}, Quarantined, [5337], [-1],0.0.0
PUP.Optional.FreeMalwareRemovalTool, HKCU\SOFTWARE\FreeMalwareRemovalTool.com, Quarantined, [966], [502512],1.0.4530
PUP.Optional.FreeMalwareRemovalTool, HKLM\SOFTWARE\FreeMalwareRemovalTool.com, Quarantined, [966], [502504],1.0.4530
PUP.Optional.FreeMalwareRemovalTool, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\F5000FCC-7382-447E-A08C-9BC17438C64E_is1, Quarantined, [966], [502494],1.0.4530
PUP.Optional.FreeMalwareRemovalTool, HKLM\SOFTWARE\FMRT-PR, Quarantined, [966], [502501],1.0.4530

Registry Value: 2
PUP.Optional.FreeMalwareRemovalTool, HKLM\SOFTWARE\FMRT-PR|UTM_PUBID, Quarantined, [966], [502501],1.0.4530
PUP.Optional.FreeMalwareRemovalTool, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\F5000FCC-7382-447E-A08C-9BC17438C64E_IS1|DISPLAYNAME, Quarantined, [966], [502509],1.0.4530

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 3
PUP.Optional.FreeMalwareRemovalTool, C:\Program Files\Free Malware Removal Tool\x64, Quarantined, [966], [502494],1.0.4530
PUP.Optional.FreeMalwareRemovalTool, C:\Program Files\Free Malware Removal Tool\x86, Quarantined, [966], [502494],1.0.4530
PUP.Optional.FreeMalwareRemovalTool, C:\PROGRAM FILES\FREE MALWARE REMOVAL TOOL, Quarantined, [966], [502494],1.0.4530

File: 44
PUP.Optional.FreeMalwareRemovalTool, C:\USERS\PUBLIC\DESKTOP\FREE MALWARE REMOVAL TOOL.LNK, Quarantined, [966], [502496],1.0.4530
PUP.Optional.FreeMalwareRemovalTool.TskLnk, C:\WINDOWS\SYSTEM32\TASKS\Free Malware Removal Tool, Quarantined, [5337], [502497],1.0.4530
PUP.Optional.FreeMalwareRemovalTool.TskLnk, C:\WINDOWS\SYSTEM32\TASKS\Free Malware Removal Tool_Logon, Quarantined, [5337], [502497],1.0.4530
PUP.Optional.FreeMalwareRemovalTool.TskLnk, C:\PROGRAM FILES\FREE MALWARE REMOVAL TOOL\FMRT.EXE, Quarantined, [5337], [502497],1.0.4530
PUP.Optional.FreeMalwareRemovalTool.TskLnk, C:\WINDOWS\SYSTEM32\TASKS\Free Malware Removal Tool, Quarantined, [5337], [-1],0.0.0
PUP.Optional.FreeMalwareRemovalTool.TskLnk, C:\WINDOWS\SYSTEM32\TASKS\Free Malware Removal Tool_Logon, Quarantined, [5337], [-1],0.0.0
PUP.Optional.FreeMalwareRemovalTool, C:\PROGRAM FILES\FREE MALWARE REMOVAL TOOL\FMRT.EXE.CONFIG, Quarantined, [966], [502494],1.0.4530
PUP.Optional.FreeMalwareRemovalTool, C:\Program Files\Free Malware Removal Tool\x64\SQLite.Interop.dll, Quarantined, [966], [502494],1.0.4530
PUP.Optional.FreeMalwareRemovalTool, C:\Program Files\Free Malware Removal Tool\x86\SQLite.Interop.dll, Quarantined, [966], [502494],1.0.4530
PUP.Optional.FreeMalwareRemovalTool, C:\Program Files\Free Malware Removal Tool\7z.dll, Quarantined, [966], [502494],1.0.4530
PUP.Optional.FreeMalwareRemovalTool, C:\Program Files\Free Malware Removal Tool\7z.exe, Quarantined, [966], [502494],1.0.4530
PUP.Optional.FreeMalwareRemovalTool, C:\Program Files\Free Malware Removal Tool\Buy Free Malware Removal Tool.lnk, Quarantined, [966], [502494],1.0.4530
PUP.Optional.FreeMalwareRemovalTool, C:\Program Files\Free Malware Removal Tool\danish_iss.ini, Quarantined, [966], [502494],1.0.4530
PUP.Optional.FreeMalwareRemovalTool, C:\Program Files\Free Malware Removal Tool\Dutch_iss.ini, Quarantined, [966], [502494],1.0.4530
PUP.Optional.FreeMalwareRemovalTool, C:\Program Files\Free Malware Removal Tool\english_iss.ini, Quarantined, [966], [502494],1.0.4530
PUP.Optional.FreeMalwareRemovalTool, C:\Program Files\Free Malware Removal Tool\finish_iss.ini, Quarantined, [966], [502494],1.0.4530
PUP.Optional.FreeMalwareRemovalTool, C:\Program Files\Free Malware Removal Tool\fmrtlog.xsl, Quarantined, [966], [502494],1.0.4530
PUP.Optional.FreeMalwareRemovalTool, C:\Program Files\Free Malware Removal Tool\French_iss.ini, Quarantined, [966], [502494],1.0.4530
PUP.Optional.FreeMalwareRemovalTool, C:\Program Files\Free Malware Removal Tool\Newtonsoft.Json.dll, Quarantined, [966], [502494],1.0.4530
PUP.Optional.FreeMalwareRemovalTool, C:\Program Files\Free Malware Removal Tool\norwegian_iss.ini, Quarantined, [966], [502494],1.0.4530
PUP.Optional.FreeMalwareRemovalTool, C:\Program Files\Free Malware Removal Tool\portuguese_iss.ini, Quarantined, [966], [502494],1.0.4530
PUP.Optional.FreeMalwareRemovalTool, C:\Program Files\Free Malware Removal Tool\PresentationCore.dll, Quarantined, [966], [502494],1.0.4530
PUP.Optional.FreeMalwareRemovalTool, C:\Program Files\Free Malware Removal Tool\russian_iss.ini, Quarantined, [966], [502494],1.0.4530
PUP.Optional.FreeMalwareRemovalTool, C:\Program Files\Free Malware Removal Tool\spanish_iss.ini, Quarantined, [966], [502494],1.0.4530
PUP.Optional.FreeMalwareRemovalTool, C:\Program Files\Free Malware Removal Tool\swedish_iss.ini, Quarantined, [966], [502494],1.0.4530
PUP.Optional.FreeMalwareRemovalTool, C:\Program Files\Free Malware Removal Tool\System.Data.SQLite.DLL, Quarantined, [966], [502494],1.0.4530
PUP.Optional.FreeMalwareRemovalTool, C:\Program Files\Free Malware Removal Tool\System.Windows.Controls.Input.Toolkit.dll, Quarantined, [966], [502494],1.0.4530
PUP.Optional.FreeMalwareRemovalTool, C:\Program Files\Free Malware Removal Tool\System.Windows.Controls.Layout.Toolkit.dll, Quarantined, [966], [502494],1.0.4530
PUP.Optional.FreeMalwareRemovalTool, C:\Program Files\Free Malware Removal Tool\TAFactory.IconPack.dll, Quarantined, [966], [502494],1.0.4530
PUP.Optional.FreeMalwareRemovalTool, C:\Program Files\Free Malware Removal Tool\unins000.dat, Quarantined, [966], [502494],1.0.4530
PUP.Optional.FreeMalwareRemovalTool, C:\Program Files\Free Malware Removal Tool\unins000.exe, Quarantined, [966], [502494],1.0.4530
PUP.Optional.FreeMalwareRemovalTool, C:\Program Files\Free Malware Removal Tool\unins000.msg, Quarantined, [966], [502494],1.0.4530
PUP.Optional.FreeMalwareRemovalTool, C:\Program Files\Free Malware Removal Tool\upload.log, Quarantined, [966], [502494],1.0.4530
PUP.Optional.FreeMalwareRemovalTool, C:\Program Files\Free Malware Removal Tool\WpfAnimatedGif.dll, Quarantined, [966], [502494],1.0.4530
PUP.Optional.FreeMalwareRemovalTool, C:\Program Files\Free Malware Removal Tool\WPFToolkit.dll, Quarantined, [966], [502494],1.0.4530
PUP.Optional.FreeMalwareRemovalTool, C:\Program Files\Free Malware Removal Tool\german_iss.ini, Quarantined, [966], [502494],1.0.4530
PUP.Optional.FreeMalwareRemovalTool, C:\Program Files\Free Malware Removal Tool\ICSharpCode.SharpZipLib.dll, Quarantined, [966], [502494],1.0.4530
PUP.Optional.FreeMalwareRemovalTool, C:\Program Files\Free Malware Removal Tool\Interop.IWshRuntimeLibrary.dll, Quarantined, [966], [502494],1.0.4530
PUP.Optional.FreeMalwareRemovalTool, C:\Program Files\Free Malware Removal Tool\italian_iss.ini, Quarantined, [966], [502494],1.0.4530
PUP.Optional.FreeMalwareRemovalTool, C:\Program Files\Free Malware Removal Tool\japanese_iss.ini, Quarantined, [966], [502494],1.0.4530
PUP.Optional.FreeMalwareRemovalTool, C:\Program Files\Free Malware Removal Tool\langs.db, Quarantined, [966], [502494],1.0.4530
PUP.Optional.FreeMalwareRemovalTool, C:\Program Files\Free Malware Removal Tool\Microsoft.Win32.TaskScheduler.dll, Quarantined, [966], [502494],1.0.4530
PUP.Optional.FreeMalwareRemovalTool, C:\Program Files\Free Malware Removal Tool\Microsoft.WindowsAPICodePack.dll, Quarantined, [966], [502494],1.0.4530
PUP.Optional.FreeMalwareRemovalTool, C:\Program Files\Free Malware Removal Tool\Microsoft.WindowsAPICodePack.Shell.dll, Quarantined, [966], [502494],1.0.4530

Physical Sector: 0
(No malicious items detected)


(end)
As mentioned before the full version of Malwarebytes could have protected your computer against this threat.
We use different ways of protecting your computer(s):
  • Dynamically Blocks Malware Sites & Servers
  • Malware Execution Prevention
Save yourself the hassle and get protected.
  • 0

Advertisements

Back to Malware Removal Guides and Tutorials



Also tagged with one or more of these keywords: 855-332-0124

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

  1. Geeks to Go Community
  2. → Security
  3. → Malware Removal Guides and Tutorials

As Featured On:

featured
Malware Removal How to Guides Windows 7 System Building Download Files Register welcome

Never used a forum? Learn how.