Jump to content

Welcome to Geeks to Go
Geeks to Go Welcome
Create Account Login to Account
Photo

Removal instructions for Sm23mS

- - - - -
Started by Metallica , May 29 2014 04:15 AM

  • Please log in to reply
No replies to this topic

#1
Metallica
Posted 29 May 2014 - 04:15 AM

Metallica

    Spyware Veteran

  • GeekU Moderator
  • 33,101 posts
Content is republished with permission from Malwarebytes.

What is Sm23mS?

The Malwarebytes research team has determined that Sm23mS is a browser hijacker. These so-called "hijackers" alter your startpage or searchscopes so that the affected browser visits their site or one of their choice. This one also displays advertisements.

How do I know if my computer is affected by Sm23mS?

You may see these browser extensions/add-ons:

warning1.png

warning2.png

and this entry in your list of installed programs:

warning4.png


How did Sm23mS get on my computer?

Browser hijackers use different methods for distributing themselves. This particular one was bundled with other software.

How do I remove Sm23mS?

Our program Malwarebytes Anti-Malware can detect and remove this potentially unwanted application.
  • Please download Malwarebytes Anti-Malware to your desktop.
  • Double-click mbam-setup-version.exe and follow the prompts to install the program.
  • At the end, be sure a check-mark is placed next to the following:
    • Enable free trial of Malwarebytes Anti-Malware Premium
    • Launch Malwarebytes Anti-Malware
  • Then click Finish.
  • If an update is found, you will be prompted to download and install the latest version.
  • Once the program has loaded, select Scan now.
  • When the scan is complete , make sure that everything is set to "Quarantine", and click Apply Actions.
  • Reboot your computer if prompted.
Is there anything else I need to do to get rid of Sm23mS?
  • No, Malwarebytes' Anti-Malware removes Sm23mS completely.
How would the full version of Malwarebytes Anti-Malware help protect me?

We hope our application and this guide have helped you eradicate this hijacker.

As you can see below the full version of Malwarebytes Anti-Malware would have protected you against the Sm23mS hijacker. It would have warned you before the rogue could install itself, giving you a chance to stop it before it became too late.


protection1.png

Technical details for experts

Signs in a HijackThis log:
O2 - BHO: CrossriderApp0048914 - {11111111-1111-1111-1111-110411891114} - C:\Program Files\Sm23mS\Sm23mS-bho.dll
Alterations made by the installer:
File system details  
---------------------------------------------
    Adds the folder C:\Program Files\Sm23mS
       Adds the file 48914.xpi"="5/29/2014 10:14 AM, 453326 bytes, A
       Adds the file background.html"="5/28/2014 3:42 PM, 729 bytes, A
       Adds the file bgNova.html"="5/28/2014 3:42 PM, 729 bytes, A
       Adds the file f03656dd-25da-4e15-904b-99d5a4e81b0e-2.exe"="5/29/2014 10:14 AM, 361472 bytes, A
       Adds the file f03656dd-25da-4e15-904b-99d5a4e81b0e-4.exe"="5/29/2014 10:14 AM, 834048 bytes, A
       Adds the file f03656dd-25da-4e15-904b-99d5a4e81b0e-5.exe"="5/29/2014 10:14 AM, 456192 bytes, A
       Adds the file Sm23mS.ico"="5/28/2014 3:42 PM, 9662 bytes, A
       Adds the file Sm23mS-bg.exe"="5/29/2014 10:14 AM, 559616 bytes, A
       Adds the file Sm23mS-bho.dll"="5/29/2014 10:14 AM, 539136 bytes, A
       Adds the file Sm23mS-codedownloader.exe"="5/29/2014 10:14 AM, 507904 bytes, A
       Adds the file Sm23mS-nova.dll"="5/29/2014 10:14 AM, 117760 bytes, A
       Adds the file Sm23mS-nova.exe"="5/29/2014 10:14 AM, 590336 bytes, A
       Adds the file Sm23mS-novainstaller.exe"="5/29/2014 10:14 AM, 507904 bytes, A
       Adds the file Uninstall.exe"="5/29/2014 10:14 AM, 79872 bytes, A
       Adds the file utils.exe"="5/29/2014 10:14 AM, 2191817 bytes, A
    Adds the folder C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com
       Adds the file chrome.manifest"="5/29/2014 10:14 AM, 732 bytes, A
       Adds the file install.rdf"="5/29/2014 10:14 AM, 1398 bytes, A
    Adds the folder C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\chrome\content
       Adds the file 4a2212998706ed67519c4e53acc60242.js"="5/29/2014 10:14 AM, 50376 bytes, A
       Adds the file 5c77d3f99f55c099dd0193596b46622f.js"="5/29/2014 10:14 AM, 1772 bytes, A
       Adds the file 7dac651eb1974c0edb623b542aaa3077.js"="5/29/2014 10:14 AM, 2058 bytes, A
       Adds the file 7fae3d4f0965231713d3fd776183f151.js"="5/29/2014 10:14 AM, 192 bytes, A
       Adds the file aaa742a186fccf23226161a6991a54c6.js"="5/29/2014 10:14 AM, 50020 bytes, A
       Adds the file background.html"="5/29/2014 10:14 AM, 2001 bytes, A
       Adds the file browser.xul"="5/29/2014 10:14 AM, 5706 bytes, A
       Adds the file dialog.js"="5/29/2014 10:14 AM, 3716 bytes, A
       Adds the file ffCoreFilesIndex.txt"="5/29/2014 10:14 AM, 1894 bytes, A
       Adds the file options.js"="5/29/2014 10:14 AM, 5284 bytes, A
       Adds the file options.xul"="5/29/2014 10:14 AM, 1913 bytes, A
       Adds the file search_dialog.xul"="5/29/2014 10:14 AM, 2457 bytes, A
    Adds the folder C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\chrome\content\api
    Adds the folder C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\chrome\content\core
    Adds the folder C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\defaults\preferences
       Adds the file prefs.js"="5/29/2014 10:14 AM, 3992 bytes, A
    Adds the folder C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\extensionData
       Adds the file manifest.xml"="5/29/2014 10:14 AM, 1759 bytes, A
       Adds the file plugins.json"="5/29/2014 10:14 AM, 8414 bytes, A
    Adds the folder C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\extensionData\plugins
    Adds the folder C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\extensionData\userCode
       Adds the file background.js"="5/29/2014 10:14 AM, 429 bytes, A
       Adds the file extension.js"="5/29/2014 10:14 AM, 515 bytes, A
    Adds the folder C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\locale\en-US
       Adds the file translations.dtd"="5/29/2014 10:14 AM, 425 bytes, A
    Adds the folder C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\skin
       Adds the file button1.png"="5/29/2014 10:14 AM, 1361 bytes, A
       Adds the file button2.png"="5/29/2014 10:14 AM, 1361 bytes, A
       Adds the file button3.png"="5/29/2014 10:14 AM, 1361 bytes, A
       Adds the file button4.png"="5/29/2014 10:14 AM, 1361 bytes, A
       Adds the file button5.png"="5/29/2014 10:14 AM, 1361 bytes, A
       Adds the file crossrider_statusbar.png"="5/29/2014 10:14 AM, 1361 bytes, A
       Adds the file icon128.png"="5/29/2014 10:14 AM, 6353 bytes, A
       Adds the file icon16.png"="5/29/2014 10:14 AM, 3673 bytes, A
       Adds the file icon24.png"="5/29/2014 10:14 AM, 4379 bytes, A
       Adds the file icon48.png"="5/29/2014 10:14 AM, 5469 bytes, A
       Adds the file panelarrow-up.png"="5/29/2014 10:14 AM, 917 bytes, A
       Adds the file popup.html"="5/29/2014 10:14 AM, 349 bytes, A
       Adds the file skin.css"="5/29/2014 10:14 AM, 990 bytes, A
       Adds the file update.css"="5/29/2014 10:14 AM, 140 bytes, A
    In the existing folder C:\Windows\System32\Tasks
       Adds the file f03656dd-25da-4e15-904b-99d5a4e81b0e-1"="5/29/2014 10:14 AM, 4390 bytes, A
       Adds the file f03656dd-25da-4e15-904b-99d5a4e81b0e-2"="5/29/2014 10:14 AM, 4396 bytes, A
       Adds the file f03656dd-25da-4e15-904b-99d5a4e81b0e-4"="5/29/2014 10:14 AM, 5290 bytes, A
       Adds the file f03656dd-25da-4e15-904b-99d5a4e81b0e-5"="5/29/2014 10:14 AM, 4496 bytes, A
       Adds the file f03656dd-25da-4e15-904b-99d5a4e81b0e-6"="5/29/2014 10:14 AM, 4406 bytes, A
       Adds the file f03656dd-25da-4e15-904b-99d5a4e81b0e-7"="5/29/2014 10:14 AM, 4334 bytes, A
    In the existing folder C:\Windows\Tasks
       Adds the file f03656dd-25da-4e15-904b-99d5a4e81b0e-1.job"="5/29/2014 10:14 AM, 1360 bytes, A
       Adds the file f03656dd-25da-4e15-904b-99d5a4e81b0e-2.job"="5/29/2014 10:14 AM, 1366 bytes, A
       Adds the file f03656dd-25da-4e15-904b-99d5a4e81b0e-4.job"="5/29/2014 10:14 AM, 2260 bytes, A
       Adds the file f03656dd-25da-4e15-904b-99d5a4e81b0e-5.job"="5/29/2014 10:14 AM, 1466 bytes, A
       Adds the file f03656dd-25da-4e15-904b-99d5a4e81b0e-6.job"="5/29/2014 10:14 AM, 1376 bytes, A
       Adds the file f03656dd-25da-4e15-904b-99d5a4e81b0e-7.job"="5/29/2014 10:14 AM, 1306 bytes, A

Registry details  
------------------------------------------
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11111111-1111-1111-1111-110411891114}]
       "(Default)"="REG_SZ", "Sm23mS"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11111111-1111-1111-1111-110411891114}\Implemented Categories]
       "(Default)"="REG_SZ", ""
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11111111-1111-1111-1111-110411891114}\Implemented Categories\{59fb2056-d625-48d0-a944-1a85b5ab2640}]
       "(Default)"="REG_SZ", ""
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11111111-1111-1111-1111-110411891114}\InprocServer32]
       "(Default)"="REG_SZ", "C:\Program Files\Sm23mS\Sm23mS-bho.dll"
       "ThreadingModel"="REG_SZ", "Apartment"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11111111-1111-1111-1111-110411891114}\ProgID]
       "(Default)"="REG_SZ", "CrossriderApp0048914.BHO.1"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11111111-1111-1111-1111-110411891114}\Programmable]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11111111-1111-1111-1111-110411891114}\TypeLib]
       "(Default)"="REG_SZ", "{44444444-4444-4444-4444-440444894414}"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11111111-1111-1111-1111-110411891114}\VersionIndependentProgID]
       "(Default)"="REG_SZ", "CrossriderApp0048914"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{22222222-2222-2222-2222-220422892214}]
       "(Default)"="REG_SZ", "CrossriderApp0048914.Sandbox"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{22222222-2222-2222-2222-220422892214}\InprocServer32]
       "(Default)"="REG_SZ", "C:\Program Files\Sm23mS\Sm23mS-bho.dll"
       "ThreadingModel"="REG_SZ", "Apartment"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{22222222-2222-2222-2222-220422892214}\ProgID]
       "(Default)"="REG_SZ", "CrossriderApp0048914.Sandbox.1"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{22222222-2222-2222-2222-220422892214}\Programmable]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{22222222-2222-2222-2222-220422892214}\TypeLib]
       "(Default)"="REG_SZ", "{44444444-4444-4444-4444-440444894414}"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{22222222-2222-2222-2222-220422892214}\VersionIndependentProgID]
       "(Default)"="REG_SZ", "CrossriderApp0048914.Sandbox"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CrossriderApp0048914.BHO]
       "(Default)"="REG_SZ", "CrossriderApp0048914"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CrossriderApp0048914.BHO\CLSID]
       "(Default)"="REG_SZ", "{11111111-1111-1111-1111-110411891114}"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CrossriderApp0048914.BHO\CurVer]
       "(Default)"="REG_SZ", "CrossriderApp0048914"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CrossriderApp0048914.BHO.1]
       "(Default)"="REG_SZ", "CrossriderApp0048914"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CrossriderApp0048914.BHO.1\CLSID]
       "(Default)"="REG_SZ", "{11111111-1111-1111-1111-110411891114}"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CrossriderApp0048914.Sandbox]
       "(Default)"="REG_SZ", "CrossriderApp0048914.Sandbox"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CrossriderApp0048914.Sandbox\CLSID]
       "(Default)"="REG_SZ", "{22222222-2222-2222-2222-220422892214}"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CrossriderApp0048914.Sandbox\CurVer]
       "(Default)"="REG_SZ", "CrossriderApp0048914.Sandbox"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CrossriderApp0048914.Sandbox.1]
       "(Default)"="REG_SZ", "CrossriderApp0048914.Sandbox"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CrossriderApp0048914.Sandbox.1\CLSID]
       "(Default)"="REG_SZ", "{22222222-2222-2222-2222-220422892214}"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{55555555-5555-5555-5555-550455895514}]
       "(Default)"="REG_SZ", "ICrossriderBHO"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{55555555-5555-5555-5555-550455895514}\ProxyStubClsid]
       "(Default)"="REG_SZ", "{00020424-0000-0000-C000-000000000046}"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{55555555-5555-5555-5555-550455895514}\ProxyStubClsid32]
       "(Default)"="REG_SZ", "{00020424-0000-0000-C000-000000000046}"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{55555555-5555-5555-5555-550455895514}\TypeLib]
       "(Default)"="REG_SZ", "{44444444-4444-4444-4444-440444894414}"
       "Version"="REG_SZ", "1.0"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660466896614}]
       "(Default)"="REG_SZ", "ISandBox"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660466896614}\ProxyStubClsid]
       "(Default)"="REG_SZ", "{00020424-0000-0000-C000-000000000046}"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660466896614}\ProxyStubClsid32]
       "(Default)"="REG_SZ", "{00020424-0000-0000-C000-000000000046}"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660466896614}\TypeLib]
       "(Default)"="REG_SZ", "{44444444-4444-4444-4444-440444894414}"
       "Version"="REG_SZ", "1.0"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{44444444-4444-4444-4444-440444894414}\1.0]
       "(Default)"="REG_SZ", "CrossriderApp0048914 Type Library"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{44444444-4444-4444-4444-440444894414}\1.0\0\win32]
       "(Default)"="REG_SZ", "C:\Program Files\Sm23mS\Sm23mS-bho.dll"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{44444444-4444-4444-4444-440444894414}\1.0\FLAGS]
       "(Default)"="REG_SZ", "0"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{44444444-4444-4444-4444-440444894414}\1.0\HELPDIR]
       "(Default)"="REG_SZ", "C:\Program Files\Sm23mS"
    [HKEY_LOCAL_MACHINE\SOFTWARE\GlobalUpdate\Update\Clients\{63b26ee0-1f43-42e2-a3c5-f77f1279d4df}]
       "bic"="REG_SZ", "A53FBD8C747F49C89075BDEA83231222IE"
       "name"="REG_SZ", "smart-saverplus"
       "pv"="REG_SZ", "1.3.25.0"
       "srcid_var"="REG_SZ", "000837"
       "verifier"="REG_SZ", "6747927a902b610a5f87ca275413016d"
    [HKEY_LOCAL_MACHINE\SOFTWARE\InstalledBrowserExtensions\26549]
       "48914"="REG_SZ", "Sm23mS"
    [HKEY_LOCAL_MACHINE\SOFTWARE\InstalledBrowserExtensions\26549\Status]
       "Installed"="REG_DWORD", 1
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11111111-1111-1111-1111-110411891114}]
       "(Default)"="REG_SZ", "CrossriderApp0048914"
       "NoExplorer"="REG_DWORD", 1
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID]
       "{11111111-1111-1111-1111-110411891114}"="REG_SZ", "1"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Sm23mS]
       "CrAppId"="REG_SZ", "48914"
       "CrPublisherId"="REG_SZ", "26549"
       "DisplayIcon"="REG_SZ", "C:\Program Files\Sm23mS\utils.exe"
       "DisplayName"="REG_SZ", "Sm23mS"
       "DisplayVersion"="REG_SZ", "1.34.5.22"
       "Publisher"="REG_SZ", "smart-saverplus"
       "UninstallString"="REG_SZ", "C:\Program Files\Sm23mS\Uninstall.exe /fcp=1"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Sm23mS]
       "ActiveAppId"="REG_SZ", "48914"
       "Sm23mS-ver"="REG_BINARY, (zero length data)
    [HKEY_LOCAL_MACHINE\SOFTWARE\Sm23mS\Code]
       "AppJavaScript"="REG_SZ", "  { javascript removed, full log available on request } "
    [HKEY_LOCAL_MACHINE\SOFTWARE\Sm23mS\Firefox]
       "TotalProfiles"="REG_DWORD", 1
    [HKEY_LOCAL_MACHINE\SOFTWARE\Sm23mS\Firefox\Profiles]
       "C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835"="REG_DWORD", 1
    [HKEY_LOCAL_MACHINE\SOFTWARE\Sm23mS\IE]
       "TotalProfiles"="REG_DWORD", 1
    [HKEY_LOCAL_MACHINE\SOFTWARE\Sm23mS\IE\Profiles]
       "S-1-5-21-4016700205-1717049133-1125222536-1001"="REG_DWORD", 1
    [HKEY_LOCAL_MACHINE\SOFTWARE\Sm23mS\Installer]
       "Bic"="REG_SZ", "A53FBD8C747F49C89075BDEA83231222IE"
       "BundledFirefox"="REG_DWORD", 1
       "BundledIe"="REG_DWORD", 1
       "BundledNova"="REG_DWORD", 1
       "CodeDownloadDomain"="REG_SZ", "http://js.clientstatsservice.com"
       "DefaultBrowser"="REG_SZ", "ie"
       "ErrorsDomain"="REG_SZ", "http://errors.clientstatsservice.com"
       "FullVersion"="REG_SZ", "1.34.5.22"
       "FullVersionForUrl"="REG_SZ", "1_34_05_22"
       "OsName"="REG_SZ", "7"
       "Params"="REG_SZ", "{   "source_id" : "000837",   "sub_id" : "0",   "uzid" : "0"}"
       "SrcId"="REG_SZ", "000837"
       "StatsDomain"="REG_SZ", "http://stats.clientstatsservice.com"
       "SubId"="REG_SZ", "0"
       "Time"="REG_SZ", "1401351278"
       "Verifier"="REG_SZ", "6747927a902b610a5f87ca275413016d"
       "ZData"="REG_SZ", "0"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Sm23mS\Manifest]
       "AddressbarURL"="REG_SZ", "NA"
       "BgVersion"="REG_SZ", "1"
       "ChangePrevious"="REG_SZ", "false"
       "Description"="REG_SZ", "We give superior shopping experience by giving you the best offers instantly!"
       "DisableIe"="REG_SZ", "true"
       "EnableSearchIE"="REG_SZ", "false"
       "HomePageUrl"="REG_SZ", "NA"
       "IsButtonEnabled"="REG_SZ", "false"
       "Manifest"="REG_SZ", "NA"
       "ModeType"="REG_SZ", "production"
       "Name"="REG_SZ", "Sm23mS"
       "PluginsManifestVersion"="REG_SZ", "29"
       "PublisherId"="REG_SZ", "26549"
       "PublisherName"="REG_SZ", "smart-saverplus"
       "RunInFrame"="REG_SZ", "false"
       "SetNewTab"="REG_SZ", "false"
       "ThanksUrl"="REG_SZ", "NA"
       "UninstallerOfferAction"="REG_SZ", "NA"
       "UninstallerOfferUrl"="REG_SZ", "NA"
       "UpdateInterval"="REG_DWORD", 360
       "Version"="REG_SZ", "36"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Sm23mS\Plugins]
       "AppPluginList"="REG_SZ", "246,14,78,4,93,102,180,184,223,233,263,91"
       "BgPluginList"="REG_SZ", "246,4,14,78,251,249,250,93,102,180,184,223,233,263,91"
       "BrowserEventPluginList"="REG_SZ", "14"
       "NewTabPluginList"="REG_SZ", "14,78,4"
       "OnRequestPluginList"="REG_SZ", "14"
       "PopupPluginList"="REG_SZ", "4,14,78"
    [HKEY_CURRENT_USER\Software\AppDataLow\Software\Sm23mS\Update]
       "LastCheck"="REG_DWORD", 1401351288
    [HKEY_CURRENT_USER\Software\InstalledBrowserExtensions\26549]
       "48914"="REG_SZ", "Sm23mS"
    [HKEY_CURRENT_USER\Software\InstalledBrowserExtensions\26549\Status]
       "Installed"="REG_DWORD", 1
    [HKEY_CURRENT_USER\Software\InstalledBrowserExtensions\smart-saverplus]
       "48914"="REG_SZ", "Sm23mS"
    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{11111111-1111-1111-1111-110411891114}]
       "Flags"="REG_DWORD", 1024
Malwarebytes Anti-Malware log:
Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 5/29/2014
Scan Time: 10:24:18 AM
Logfile: mbamSm23ms.txt
Administrator: Yes

Version: 2.00.1.1004
Malware Database: v2014.05.29.05
Rootkit Database: v2014.05.21.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Chameleon: Disabled

OS: Windows 7 Service Pack 1
CPU: x86
File System: NTFS
User: Malwarebytes

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 224701
Time Elapsed: 3 min, 21 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Shuriken: Enabled
PUP: Enabled
PUM: Enabled

Processes: 1
PUP.Optional.SmartSaver.A, C:\Program Files\Sm23mS\Sm23mS-nova.exe, 3876, Delete-on-Reboot, [52d7be99aad12412aa4ce59c0bf6728e]

Modules: 0
(No malicious items detected)

Registry Keys: 20
PUP.Optional.SmartSaver.A, HKLM\SOFTWARE\CLASSES\CLSID\{11111111-1111-1111-1111-110411891114}, Quarantined, [4bde37205a21e452c92d9ee344bdd52b], 
PUP.Optional.SmartSaver.A, HKLM\SOFTWARE\CLASSES\TYPELIB\{44444444-4444-4444-4444-440444894414}, Quarantined, [4bde37205a21e452c92d9ee344bdd52b], 
PUP.Optional.SmartSaver.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{55555555-5555-5555-5555-550455895514}, Quarantined, [4bde37205a21e452c92d9ee344bdd52b], 
PUP.Optional.SmartSaver.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{66666666-6666-6666-6666-660466896614}, Quarantined, [4bde37205a21e452c92d9ee344bdd52b], 
PUP.Optional.SmartSaver.A, HKLM\SOFTWARE\CLASSES\CrossriderApp0048914.BHO.1, Quarantined, [4bde37205a21e452c92d9ee344bdd52b], 
PUP.Optional.SmartSaver.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{11111111-1111-1111-1111-110411891114}, Quarantined, [4bde37205a21e452c92d9ee344bdd52b], 
PUP.Optional.SmartSaver.A, HKLM\SOFTWARE\CLASSES\CrossriderApp0048914.BHO, Quarantined, [4bde37205a21e452c92d9ee344bdd52b], 
PUP.Optional.SmartSaver.A, HKU\S-1-5-21-4016700205-1717049133-1125222536-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{11111111-1111-1111-1111-110411891114}, Quarantined, [4bde37205a21e452c92d9ee344bdd52b], 
PUP.Optional.SmartSaver.A, HKU\S-1-5-21-4016700205-1717049133-1125222536-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{11111111-1111-1111-1111-110411891114}, Quarantined, [4bde37205a21e452c92d9ee344bdd52b], 
PUP.Optional.SmartSaver.A, HKLM\SOFTWARE\CLASSES\CLSID\{22222222-2222-2222-2222-220422892214}, Quarantined, [4bde37205a21e452c92d9ee344bdd52b], 
PUP.Optional.SmartSaver.A, HKLM\SOFTWARE\CLASSES\CrossriderApp0048914.Sandbox.1, Quarantined, [4bde37205a21e452c92d9ee344bdd52b], 
PUP.Optional.SmartSaver.A, HKLM\SOFTWARE\CLASSES\CrossriderApp0048914.Sandbox, Quarantined, [4bde37205a21e452c92d9ee344bdd52b], 
PUP.Optional.SmartSaver.A, HKLM\SOFTWARE\CLASSES\CLSID\{11111111-1111-1111-1111-110411891114}\INPROCSERVER32, Quarantined, [4bde37205a21e452c92d9ee344bdd52b], 
PUP.Optional.SmartSaver.A, HKLM\SOFTWARE\Sm23mS, Quarantined, [f3364413d0abb87ea3108b0041c17b85], 
PUP.Optional.CrossRider.A, HKLM\SOFTWARE\INSTALLEDBROWSEREXTENSIONS\26549, Quarantined, [bf6a1d3acfac3bfb4897f9a35aa8b54b], 
PUP.Optional.CrossRider.A, HKU\S-1-5-21-4016700205-1717049133-1125222536-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\Crossrider, Quarantined, [5dcc3c1bc5b674c272849d3609fad42c], 
PUP.Optional.SmartSaver.A, HKU\S-1-5-21-4016700205-1717049133-1125222536-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\Sm23mS, Quarantined, [75b4164163185fd7dbda9fece31fc63a], 
PUP.Optional.CrossRider.A, HKU\S-1-5-21-4016700205-1717049133-1125222536-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLEDBROWSEREXTENSIONS\26549, Quarantined, [7aafd087aecd90a618c84d4f7a88c53b], 
PUP.Optional.SmartSaver.A, HKU\S-1-5-21-4016700205-1717049133-1125222536-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLEDBROWSEREXTENSIONS\smart-saverplus, Quarantined, [a78267f07308ee48bfb6287b857d2bd5], 
PUP.Optional.SmartSaver.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\Sm23mS, Quarantined, [7faa90c7552647efe4b997f4f50d25db], 

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 14
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\chrome, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\chrome\content, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\chrome\content\api, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\chrome\content\core, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\defaults, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\defaults\preferences, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\extensionData, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\extensionData\plugins, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\extensionData\userCode, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\locale, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\locale\en-US, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\skin, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.SmartSaver.A, C:\Program Files\Sm23mS, Quarantined, [7faa90c7552647efe4b997f4f50d25db], 

Files: 123
PUP.Optional.SmartSaver.A, C:\Program Files\Sm23mS\Sm23mS-nova.exe, Quarantined, [52d7be99aad12412aa4ce59c0bf6728e], 
PUP.Optional.SmartSaver.A, C:\Program Files\Sm23mS\Sm23mS-bho.dll, Quarantined, [4bde37205a21e452c92d9ee344bdd52b], 
PUP.Optional.CrossRider.A, C:\Users\{username}\Desktop\Sm23mS.exe, Quarantined, [e742a1b67407072f8c9d66ddde221fe1], 
PUP.Optional.CrossRider.A, C:\Windows\Tasks\f03656dd-25da-4e15-904b-99d5a4e81b0e-1.job, Quarantined, [b2776dea3b403402ed73b0eb16ec29d7], 
PUP.Optional.CrossRider.A, C:\Windows\Tasks\f03656dd-25da-4e15-904b-99d5a4e81b0e-2.job, Quarantined, [59d0db7c611ae1553d233f5cd52d6b95], 
PUP.Optional.CrossRider.A, C:\Windows\Tasks\f03656dd-25da-4e15-904b-99d5a4e81b0e-4.job, Quarantined, [e544e473a3d852e485db6239f111cf31], 
PUP.Optional.CrossRider.A, C:\Windows\Tasks\f03656dd-25da-4e15-904b-99d5a4e81b0e-5.job, Quarantined, [270272e5ef8cc472550b13888b7749b7], 
PUP.Optional.CrossRider.A, C:\Windows\Tasks\f03656dd-25da-4e15-904b-99d5a4e81b0e-6.job, Quarantined, [e04970e7e497181ec59bbfdc0200cc34], 
PUP.Optional.CrossRider.A, C:\Windows\Tasks\f03656dd-25da-4e15-904b-99d5a4e81b0e-7.job, Quarantined, [a1886aed205bcd69d48c821907fbae52], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\chrome.manifest, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\install.rdf, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\chrome\content\4a2212998706ed67519c4e53acc60242.js, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\chrome\content\5c77d3f99f55c099dd0193596b46622f.js, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\chrome\content\7dac651eb1974c0edb623b542aaa3077.js, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\chrome\content\7fae3d4f0965231713d3fd776183f151.js, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\chrome\content\aaa742a186fccf23226161a6991a54c6.js, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\chrome\content\background.html, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\chrome\content\browser.xul, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\chrome\content\dialog.js, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\chrome\content\ffCoreFilesIndex.txt, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\chrome\content\options.js, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\chrome\content\options.xul, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\chrome\content\search_dialog.xul, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\chrome\content\api\9588f1fee00d53c69186d1f0c13cd0df.js, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\chrome\content\api\2dcdfa44368dd837011d06aa24765b0d.js, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\chrome\content\api\49ab6e0e817ecb11bc11d2f5d53ecf3b.js, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\chrome\content\api\5075998a04bb0229d842aa73cc8492d1.js, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\chrome\content\api\61abb724921a9f787007e9c7d1aaf027.js, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\chrome\content\api\6272daa68a3f1727270d4a200ef8acb6.js, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\chrome\content\api\6363e20cf8819d2f669afa635311de4e.js, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\chrome\content\api\69135273fedf4b497fac81ac64b64e98.js, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\chrome\content\api\8b0a4b140b84ddde6a8813618655de4a.js, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\chrome\content\api\a1ff9ffb2c1724f12312d114a47a6da9.js, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\chrome\content\api\ac369df0a3fed4e70086edce0b06b203.js, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\chrome\content\api\b13020748866df49e5175c45d627d500.js, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\chrome\content\api\b9f1d4a67592ae7195b5c84cc4f52726.js, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\chrome\content\api\c61ddc858b7f456c237b14868054667f.js, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\chrome\content\api\f1abae025805c15e7aeee1a9f3160472.js, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\chrome\content\api\ffbf015d3bbff7a8594c01953ee96f43.js, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\chrome\content\core\7ad42673aefb2a2077cbdf6b06127ea0.js, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\chrome\content\core\08ee81d66a98385085c6a9c3aa95d181.js, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\chrome\content\core\0f2eff9bbb20e5f2bb86894ee099aac3.js, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\chrome\content\core\1b4aecb234117dde8f620aef54ca2fbb.js, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\chrome\content\core\2947942be2c85ba6055d85fb9393cb99.js, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\chrome\content\core\2b3e9ad65e653ca7c9eca44d359fc0fb.js, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\chrome\content\core\3120e3b24fd6c40af146171ead0ca9ba.js, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\chrome\content\core\37d5626b6a3764789824de39f0360acb.js, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\chrome\content\core\3984676a47135205fac33819ed58bccf.js, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\chrome\content\core\4f51fa7d17ea372cef16892a3ffd2dd0.js, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\chrome\content\core\77064b8161e6e7790874fef329ff5389.js, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\chrome\content\core\9b230fdfa2218fd87560b2c4266e3f3c.js, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\chrome\content\core\a4332e63111638bb10187732632dc6b0.js, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\chrome\content\core\b14b2ce48139d3ede14687a081b0dc7e.js, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\chrome\content\core\b7f9b8c72cd477e344e0b012b108f014.js, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\chrome\content\core\c0f8b6b5d7ffe804b00fcfbc6b7d13bf.js, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\chrome\content\core\cda0ac656ad5bcd8836682086d15c622.js, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\chrome\content\core\dfb900a7bb321ce7b28a2804c44f8d2b.js, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\chrome\content\core\e910b2b60dd9da13cb30952c4f5b7291.js, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\chrome\content\core\f9fafb50956a8b0a5c223a65c541d7c3.js, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\chrome\content\core\installer.js, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\defaults\preferences\prefs.js, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\extensionData\manifest.xml, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\extensionData\plugins.json, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\extensionData\plugins\1.js, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\extensionData\plugins\102.js, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\extensionData\plugins\104.js, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\extensionData\plugins\13.js, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\extensionData\plugins\14.js, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\extensionData\plugins\16.js, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\extensionData\plugins\17.js, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\extensionData\plugins\177.js, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\extensionData\plugins\180.js, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\extensionData\plugins\182.js, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\extensionData\plugins\183.js, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\extensionData\plugins\184.js, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\extensionData\plugins\190.js, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\extensionData\plugins\207.js, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\extensionData\plugins\21.js, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\extensionData\plugins\22.js, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\extensionData\plugins\223.js, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\extensionData\plugins\233.js, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\extensionData\plugins\246.js, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\extensionData\plugins\263.js, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\extensionData\plugins\28.js, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\extensionData\plugins\4.js, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\extensionData\plugins\47.js, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\extensionData\plugins\64.js, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\extensionData\plugins\72.js, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\extensionData\plugins\78.js, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\extensionData\plugins\91.js, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\extensionData\plugins\93.js, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\extensionData\plugins\98.js, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\extensionData\userCode\background.js, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\extensionData\userCode\extension.js, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\locale\en-US\translations.dtd, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\skin\button1.png, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\skin\button2.png, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\skin\button3.png, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\skin\button4.png, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\skin\button5.png, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\skin\crossrider_statusbar.png, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\skin\icon128.png, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\skin\icon16.png, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\skin\icon24.png, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\skin\icon48.png, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\skin\panelarrow-up.png, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\skin\popup.html, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\skin\skin.css, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\extensions\a8f91a16-f051-41e0-82f3-ac9171dda07c@234823c2-2f63-44a0-b3a8-857001dc0b25.com\skin\update.css, Quarantined, [51d8c39469125ed8d15f0678c73bc937], 
PUP.Optional.SmartSaver.A, C:\Program Files\Sm23mS\48914.xpi, Quarantined, [7faa90c7552647efe4b997f4f50d25db], 
PUP.Optional.SmartSaver.A, C:\Program Files\Sm23mS\background.html, Quarantined, [7faa90c7552647efe4b997f4f50d25db], 
PUP.Optional.SmartSaver.A, C:\Program Files\Sm23mS\bgNova.html, Quarantined, [7faa90c7552647efe4b997f4f50d25db], 
PUP.Optional.SmartSaver.A, C:\Program Files\Sm23mS\f03656dd-25da-4e15-904b-99d5a4e81b0e-2.exe, Quarantined, [7faa90c7552647efe4b997f4f50d25db], 
PUP.Optional.SmartSaver.A, C:\Program Files\Sm23mS\f03656dd-25da-4e15-904b-99d5a4e81b0e-4.exe, Quarantined, [7faa90c7552647efe4b997f4f50d25db], 
PUP.Optional.SmartSaver.A, C:\Program Files\Sm23mS\f03656dd-25da-4e15-904b-99d5a4e81b0e-5.exe, Quarantined, [7faa90c7552647efe4b997f4f50d25db], 
PUP.Optional.SmartSaver.A, C:\Program Files\Sm23mS\Sm23mS-bg.exe, Quarantined, [7faa90c7552647efe4b997f4f50d25db], 
PUP.Optional.SmartSaver.A, C:\Program Files\Sm23mS\Sm23mS-codedownloader.exe, Quarantined, [7faa90c7552647efe4b997f4f50d25db], 
PUP.Optional.SmartSaver.A, C:\Program Files\Sm23mS\Sm23mS-nova.dll, Quarantined, [7faa90c7552647efe4b997f4f50d25db], 
PUP.Optional.SmartSaver.A, C:\Program Files\Sm23mS\Sm23mS-novainstaller.exe, Quarantined, [7faa90c7552647efe4b997f4f50d25db], 
PUP.Optional.SmartSaver.A, C:\Program Files\Sm23mS\Sm23mS.ico, Quarantined, [7faa90c7552647efe4b997f4f50d25db], 
PUP.Optional.SmartSaver.A, C:\Program Files\Sm23mS\Uninstall.exe, Quarantined, [7faa90c7552647efe4b997f4f50d25db], 
PUP.Optional.SmartSaver.A, C:\Program Files\Sm23mS\utils.exe, Quarantined, [7faa90c7552647efe4b997f4f50d25db], 
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\6qeoodjs.default-1401006518835\prefs.js, Good: (), Bad: (user_pref("extensions.crossrider.bic", "146470f184d0cb494c598b5ec91798d4");), Replaced,[45e4f95ed3a870c62d6b365282822dd3]

Physical Sectors: 0
(No malicious items detected)


(end)
As mentioned before the full version of Malwarebytes Anti-Malware could have protected your computer against this threat.
We use different ways of protecting your computer(s):
  • Dynamically Blocks Malware Sites & Servers
  • Malware Execution Prevention
Save yourself the hassle and get protected.
  • 0

Advertisements

Back to Malware Removal Guides and Tutorials


0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

  1. Geeks to Go Community
  2. → Security
  3. → Malware Removal Guides and Tutorials

As Featured On:

featured
Malware Removal How to Guides Windows 7 System Building Download Files Register welcome

Never used a forum? Learn how.