Jump to content

Welcome to Geeks to Go
Geeks to Go Welcome
Create Account Login to Account
Photo

Removal instructions for Safe Finder widget

- - - - -
Started by Metallica , Nov 10 2016 03:24 AM

  • Please log in to reply
No replies to this topic

#1
Metallica
Posted 10 November 2016 - 03:24 AM

Metallica

    Spyware Veteran

  • GeekU Moderator
  • 33,101 posts
Content is republished with permission from Malwarebytes.

What is Safe Finder widget?

The Malwarebytes research team has determined that Safe Finder widget is a browser hijacker. These so-called "hijackers" manipulate your browser(s), for example to change your startpage or searchscopes, so that the affected browser visits their site or one of their choice. This one also displays advertisements.

How do I know if my computer is affected by Safe Finder widget?

You may see this entry in your list of installed software:

warning4.png

and these warnings during install:

main.png

warning1.png

warning2.png

these altered search settings in Chrome and INternet Explorer:

warning5.png

warning6.png

and this widget at the righthand site of your desktop:

icons.png

and this will be your new startpage in all affected browsers:

searchsite.png

How did Safe Finder widget get on my computer?

Browser hijackers use different methods for distributing themselves. This particular one was downloaded from their site.
We have discussed the silent, bundled, install earlier.

How do I remove Safe Finder widget?

Our program Malwarebytes Anti-Malware can detect and remove this potentially unwanted program.
  • Please download Malwarebytes Anti-Malware to your desktop.
  • Double-click mbam-setup-{version}.exe and follow the prompts to install the program.
  • At the end, be sure a check-mark is placed next to:
    Launch Malwarebytes Anti-Malware
  • Then click Finish.
  • Once the program has loaded, select Scan Now. Or select the Threat Scan from the Scan menu.
  • If an update is available, it will be implemented before the rest of the scanning procedure.
  • When the scan is complete, make sure that all Threats are selected, and click Remove Selected.
  • Restart your computer when prompted to do so.
Is there anything else I need to do to get rid of Safe Finder widget?
  • No, Malwarebytes' Anti-Malware removes Safe Finder widget completely.
How would the full version of Malwarebytes Anti-Malware help protect me?

We hope our application and this guide have helped you eradicate this hijacker.

As you can see below the full version of Malwarebytes Anti-Malware would have protected you against the Safe Finder widget hijacker. It would have warned you before the application could install itself, giving you a chance to stop it before it became too late.

protection1.png


Technical details for experts

Possible signs in FRST logs:

 () C:\ProgramData\SafeFinder\SafeFinder.exe
 () C:\Program Files (x86)\ProductUI\Startup.exe
 HKLM\...\Run: [smrt] => C:\Program Files (x86)\ProductUI\Startup.exe [78848 2016-04-05] ()
 AppInit_DLLs: C:\ProgramData\SafeFinder\Subhold.dll => C:\ProgramData\SafeFinder\Subhold.dll [368744 2016-11-09] ()
 AppInit_DLLs-x32: C:\ProgramData\SafeFinder\Isnimlux.dll => C:\ProgramData\SafeFinder\Isnimlux.dll [263272 2016-11-09] ()
 HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRbPPu-brYsVApIPOERS58GcQeivu6iPL1Ne74nne9omldl6NEnXgUnm5V1HwDNYEApmRO7x45JUfiBePj2SfeEuXuiXuTJiudSgPGRyfAvkotptyR-vsRxaIg0cFPDu_Xozpfm67ZcOL2l75-bVpruz0sE5gXCz6D1Le9iQ2XsbrqABGF8tlE5rMXis2F5E1V0Q,&q={searchTerms}
 HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbPPu-brYsVApIPOERS58GcQeivu6iPL1Ne74nne9omldl6NEnXgUnm5V1HwDNYEApmRO7x45JUfiBePj2SfeEuXuiXuTJiudSgPGRCZciw56u8F4OmHlUQh95h8Pc8ba5PjQ8E-hUucQPDy8nG-nIK_2MTjCqjbuXDpgXzEesHAlHzlhDIV6WmmzOzGNXJJOJM,
 HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRbPPu-brYsVApIPOERS58GcQeivu6iPL1Ne74nne9omldl6NEnXgUnm5V1HwDNYEApmRO7x45JUfiBePj2SfeEuXuiXuTJiudSgPGRyfAvkotptyR-vsRxaIg0cFPDu_Xozpfm67ZcOL2l75-bVpruz0sE5gXCz6D1Le9iQ2XsbrqABGF8tlE5rMXis2F5E1V0Q,&q={searchTerms}
 HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = hxxp://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRbPPu-brYsVApIPOERS58GcQeivu6iPL1Ne74nne9omldl6NEnXgUnm5V1HwDNYEApmRO7x45JUfiBePj2SfeEuXuiXuTJiudSgPGRyfAvkotptyR-vsRxaIg0cFPDu_Xozpfm67ZcOL2l75-bVpruz0sE5gXCz6D1Le9iQ2XsbrqABGF8tlE5rMXis2F5E1V0Q,&q={searchTerms}
 SearchScopes: HKLM-x32 -> DefaultScope {ielnksrch} URL = 
 SearchScopes: HKLM-x32 -> ielnksrch URL = hxxp://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRbPPu-brYsVApIPOERS58GcQeivu6iPL1Ne74nne9omldl6NEnXgUnm5V1HwDNYEApmRO7x45JUfiBePj2SfeEuXuiXuTJiudSgPGRyfAvkotptyR-vsRxaIg0cFPDu_Xozpfm67ZcOL2l75-bVpruz0sE5gXCz6D1Le9iQ2XsbrqABGF8tlE5rMXis2F5E1V0Q,&q={searchTerms}
 SearchScopes: HKCU -> DefaultScope {ielnksrch} URL = hxxp://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRbPPu-brYsVApIPOERS58GcQeivu6iPL1Ne74nne9omldl6NEnXgUnm5V1HwDNYEApmRO7x45JUfiBePj2SfeEuXuiXuTJiudSgPGRyfAvkotptyR-vsRxaIg0cFPDu_Xozpfm67ZcOL2l75-bVpruz0sE5gXCz6D1Le9iQ2XsbrqABGF8tlE5rMXis2F5E1V0Q,&q={searchTerms}
 SearchScopes: HKCU -> {ielnksrch} URL = hxxp://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRbPPu-brYsVApIPOERS58GcQeivu6iPL1Ne74nne9omldl6NEnXgUnm5V1HwDNYEApmRO7x45JUfiBePj2SfeEuXuiXuTJiudSgPGRyfAvkotptyR-vsRxaIg0cFPDu_Xozpfm67ZcOL2l75-bVpruz0sE5gXCz6D1Le9iQ2XsbrqABGF8tlE5rMXis2F5E1V0Q,&q={searchTerms}
 FF NewTab: C:\\ProgramData\\SafeFinders\\ff.NT
 FF Homepage: C:\\ProgramData\\SafeFinders\\ff.HP
 CHR HomePage: Default -> hxxp://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRbPPu-brYsVApIPOERS58GcQeivu6iPL1Ne74nne9omldl6NEnXgUnm5V1HwDNYEApmRO7x45JUfiBePj2SfeEuXuiXuTJiudSgPGRyECg85kvzo0VRu3SzW3wQTwAEA3uX4DxidHj1C8x_SRFYv4f1SvJexDL57RPIsc2oZd6t3zVs-r_rG5QYF2Hm5W0kQUmI,
 CHR DefaultSearchURL: Default -> hxxp://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRbPPu-brYsVApIPOERS58GcQeivu6iPL1Ne74nne9omldl6NEnXgUnm5V1HwDNYEApmRO7x45JUfiBePj2SfeEuXuiXuTJiudSgPGRyISOLnuZlvHWH08PEUZnPUQOeymjN2QbPv8VoC6AyPjRV3F2b39dW_5bP1k93z9nAuoFk5xuCDrIvJZhhisQlaOCRG_S8,&q={searchTerms}
 CHR DefaultSearchKeyword: Default -> feed.sonic-search.com
 R2 SafeFinder; C:\ProgramData\\SafeFinder\\SafeFinder.exe [770152 2016-04-21] ()
 C:\Windows\SysWOW64\findit.xml
 C:\ProgramData\SafeFinders
 C:\Program Files (x86)\ProductUI
 (SlimDesktop) C:\Users\{username}\AppData\Roaming\OverFan.bin
 C:\ProgramData\SafeFinder
 C:\Users\{username}\AppData\Roaming\agent.dat
 C:\Users\{username}\AppData\Roaming\Alphakix.tst
 C:\Users\{username}\AppData\Roaming\Installer.dat
 C:\Users\{username}\AppData\Roaming\noah.dat
 C:\Users\{username}\AppData\Roaming\Config.xml
 C:\Users\{username}\AppData\Roaming\Main.dat
 C:\Users\{username}\AppData\Roaming\InstallationConfiguration.xml
 C:\Users\{username}\AppData\Roaming\md.xml
 C:\Users\{username}\AppData\Roaming\Alphakix.exe
 () C:\Users\{username}\AppData\Roaming\uninstall_temp.ico

SafeFinder (HKLM-x32\...\{5BECDE00-F7D5-4635-AE15-9191755DFF85}) (Version: 1.0.0.0 - Linkury) <==== ATTENTION
Alterations made by the installer:

File system details [View: All details] (Selection)
---------------------------------------------------
    Adds the folder C:\Program Files (x86)\Common Files\Triolight
       Adds the file InstallationConfiguration.xml"="11/9/2016 4:18 PM, 13056 bytes, A
       Adds the file uninstall.dat"="11/9/2016 4:18 PM, 127488 bytes, A
       Adds the file uninstall.exe"="4/21/2016 10:10 AM, 770152 bytes, A
       Adds the file uninstall.ico"="11/9/2016 4:19 PM, 32038 bytes, A
    Adds the folder C:\Program Files (x86)\ProductUI
       Adds the file DataConvertor.dll"="4/5/2016 11:08 AM, 6144 bytes, A
       Adds the file jgly.dll"="4/5/2016 11:08 AM, 18944 bytes, A
       Adds the file ScreenShot.dll"="4/5/2016 11:08 AM, 15872 bytes, A
       Adds the file Startup.exe"="4/5/2016 11:08 AM, 78848 bytes, A
       Adds the file Startup.exe.config"="11/9/2016 4:20 PM, 1111 bytes, A
       Adds the file uninstall.exe"="11/9/2016 4:19 PM, 73589 bytes, A
    Adds the folder C:\ProgramData\SafeFinder
       Adds the file Blacksoft.bin"="11/9/2016 4:19 PM, 420352 bytes, A
       Adds the file conf.config"="11/9/2016 4:20 PM, 756 bytes, A
       Adds the file Config.xml"="11/9/2016 4:25 PM, 82224 bytes, A
       Adds the file Doublehome.dat"="11/9/2016 4:19 PM, 24576 bytes, A
       Adds the file Freshcof.bin"="11/9/2016 4:19 PM, 0 bytes, A
       Adds the file Isnimlux.dll"="11/9/2016 4:19 PM, 263272 bytes, A
       Adds the file Math-Dox.bin"="11/9/2016 4:19 PM, 0 bytes, A
       Adds the file md.xml"="11/9/2016 4:18 PM, 5568 bytes, A
       Adds the file Nimex.bin"="11/9/2016 4:19 PM, 0 bytes, A
       Adds the file Phystom.dat"="11/9/2016 4:19 PM, 0 bytes, A
       Adds the file Quadremjob.exe"="11/9/2016 4:19 PM, 144488 bytes, A
       Adds the file Quadremjob.exe.config"="11/9/2016 4:19 PM, 266 bytes, A
       Adds the file Qvofresh.bin"="11/9/2016 4:19 PM, 559104 bytes, A
       Adds the file SafeFinder.d.dat"="11/9/2016 4:18 PM, 6896640 bytes, A
       Adds the file SafeFinder.dat"="11/9/2016 4:18 PM, 18432 bytes, A
       Adds the file SafeFinder.exe"="4/21/2016 10:10 AM, 770152 bytes, A
       Adds the file Subhold.dll"="11/9/2016 4:19 PM, 368744 bytes, A
       Adds the file Subsaotip.exe"="11/9/2016 4:19 PM, 121448 bytes, A
       Adds the file Subsaotip.exe.config"="11/9/2016 4:19 PM, 266 bytes, A
       Adds the file Topsing.bin"="11/9/2016 4:19 PM, 393728 bytes, A
       Adds the file Trislab.exe"="11/9/2016 4:19 PM, 32360 bytes, A
       Adds the file Trislab.exe.config"="11/9/2016 4:19 PM, 266 bytes, A
       Adds the file Unagolax.bin"="11/9/2016 4:20 PM, 844288 bytes, A
       Adds the file Unagolax.bin.bck"="11/9/2016 4:19 PM, 810496 bytes, A
       Adds the file uninstall.dat"="11/9/2016 4:18 PM, 126464 bytes, A
    Adds the folder C:\ProgramData\SafeFinder\ondemand
    Adds the folder C:\ProgramData\SafeFinder\temp
    Adds the folder C:\ProgramData\SafeFinders
       Adds the file ff.HP"="11/9/2016 4:20 PM, 227 bytes, A
       Adds the file ff.NT"="11/9/2016 4:20 PM, 243 bytes, A
    In the existing folder C:\Users\{username}\AppData\Roaming
       Adds the file agent.dat"="11/9/2016 4:18 PM, 6896640 bytes, A
       Adds the file Alphakix.exe"="4/21/2016 10:10 AM, 770152 bytes, A
       Adds the file Alphakix.tst"="11/9/2016 4:18 PM, 1765993 bytes, A
       Adds the file Config.xml"="11/9/2016 4:18 PM, 69072 bytes, A
       Adds the file InstallationConfiguration.xml"="11/9/2016 4:18 PM, 13056 bytes, A
       Adds the file Installer.dat"="11/9/2016 4:18 PM, 127488 bytes, A
       Adds the file Main.dat"="11/9/2016 4:18 PM, 18432 bytes, A
       Adds the file md.xml"="11/9/2016 4:18 PM, 5568 bytes, A
       Adds the file noah.dat"="11/9/2016 4:18 PM, 126464 bytes, A
       Adds the file OverFan.bin"="11/9/2016 4:19 PM, 153371 bytes, A
       Adds the file uninstall_temp.ico"="11/9/2016 4:19 PM, 32038 bytes, A
    In the existing folder C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default
       Alters the file prefs.js
        11/3/2016 10:51 AM, 11121 bytes, A ==> 11/9/2016 4:20 PM, 11229 bytes, A
       Alters the file search.json.mozlz4
        11/3/2016 10:51 AM, 25663 bytes, A ==> 11/9/2016 4:20 PM, 27087 bytes, A
    In the existing folder C:\Windows\SysWOW64
       Adds the file findit.xml"="11/9/2016 4:20 PM, 2398 bytes, A

Registry details [View: All details] (Selection)
------------------------------------------------
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\Startup.exe]
       "(Default)"="REG_SZ", "C:\Program Files (x86)\ProductUI\Startup.exe"
       "Params"="REG_SZ", "DeviceId=d03b690e-6f54-1ec9-9e73-c726299460e5 Distributer=SafeFinderAVs ChannelId=999 BarcodeId=51583999 DefaultSearchDomain=http://feed.helperbar.com ProductName=SafeFinder AboutUrl=http://safefinder.com/ InstallerVersion=3.0.0.2"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
       "smrt"="REG_SZ", "C:\Program Files (x86)\ProductUI\Startup.exe"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SafeFinder.exe]
       "GlobalFlag"="REG_DWORD", 512
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
       "AppInit_DLLs"= REG_SZ, "C:\ProgramData\SafeFinder\Subhold.dll"
       "LoadAppInit_DLLs"= REG_DWORD, 1
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes]
       "DefaultScope"= REG_SZ, "{ielnksrch}"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\ielnksrch]
       "DisplayName"="REG_SZ", "Search the web"
       "SuggestionsURL_JSON"="REG_SZ", "http://suggestqueries.google.com/complete/search?output=firefox&client=firefox&qu={searchTerms}"
       "SuggestionsURLFallback"="REG_SZ", "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}&sectionHeight={ie:sectionHeight}&FORM=IE8SSC&market={language}"
       "URL"="REG_SZ", "http://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRbPPu-brYsVApIPOERS58GcQeivu6iPL1Ne74nne9omldl6NEnXgUnm5V1HwDNYEApmRO7x45JUfiBePj2SfeEuXuiXuTJiudSgPGRyfAvkotptyR-vsRxaIg0cFPDu_Xozpfm67ZcOL2l75-bVpruz0sE5gXCz6D1Le9iQ2XsbrqABGF8tlE5rMXis2F5E1V0Q,&q={searchTerms}"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchUrl]
       "Default"="REG_SZ", "http://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRbPPu-brYsVApIPOERS58GcQeivu6iPL1Ne74nne9omldl6NEnXgUnm5V1HwDNYEApmRO7x45JUfiBePj2SfeEuXuiXuTJiudSgPGRyfAvkotptyR-vsRxaIg0cFPDu_Xozpfm67ZcOL2l75-bVpruz0sE5gXCz6D1Le9iQ2XsbrqABGF8tlE5rMXis2F5E1V0Q,&q={searchTerms}"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\Alphakix_RASAPI32]
       "ConsoleTracingMask"="REG_DWORD", -65536
       "EnableConsoleTracing"="REG_DWORD", 0
       "EnableFileTracing"="REG_DWORD", 0
       "FileDirectory"="REG_EXPAND_SZ, "%windir%\tracing"
       "FileTracingMask"="REG_DWORD", -65536
       "MaxFileSize"="REG_DWORD", 1048576
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\Alphakix_RASMANCS]
       "ConsoleTracingMask"="REG_DWORD", -65536
       "EnableConsoleTracing"="REG_DWORD", 0
       "EnableFileTracing"="REG_DWORD", 0
       "FileDirectory"="REG_EXPAND_SZ, "%windir%\tracing"
       "FileTracingMask"="REG_DWORD", -65536
       "MaxFileSize"="REG_DWORD", 1048576
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\linker_RASAPI32]
       "ConsoleTracingMask"="REG_DWORD", -65536
       "EnableConsoleTracing"="REG_DWORD", 0
       "EnableFileTracing"="REG_DWORD", 0
       "FileDirectory"="REG_EXPAND_SZ, "%windir%\tracing"
       "FileTracingMask"="REG_DWORD", -65536
       "MaxFileSize"="REG_DWORD", 1048576
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\linker_RASMANCS]
       "ConsoleTracingMask"="REG_DWORD", -65536
       "EnableConsoleTracing"="REG_DWORD", 0
       "EnableFileTracing"="REG_DWORD", 0
       "FileDirectory"="REG_EXPAND_SZ, "%windir%\tracing"
       "FileTracingMask"="REG_DWORD", -65536
       "MaxFileSize"="REG_DWORD", 1048576
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\SafeFinder_RASAPI32]
       "ConsoleTracingMask"="REG_DWORD", -65536
       "EnableConsoleTracing"="REG_DWORD", 0
       "EnableFileTracing"="REG_DWORD", 0
       "FileDirectory"="REG_EXPAND_SZ, "%windir%\tracing"
       "FileTracingMask"="REG_DWORD", -65536
       "MaxFileSize"="REG_DWORD", 1048576
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\SafeFinder_RASMANCS]
       "ConsoleTracingMask"="REG_DWORD", -65536
       "EnableConsoleTracing"="REG_DWORD", 0
       "EnableFileTracing"="REG_DWORD", 0
       "FileDirectory"="REG_EXPAND_SZ, "%windir%\tracing"
       "FileTracingMask"="REG_DWORD", -65536
       "MaxFileSize"="REG_DWORD", 1048576
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\Startup_RASAPI32]
       "ConsoleTracingMask"="REG_DWORD", -65536
       "EnableConsoleTracing"="REG_DWORD", 0
       "EnableFileTracing"="REG_DWORD", 0
       "FileDirectory"="REG_EXPAND_SZ, "%windir%\tracing"
       "FileTracingMask"="REG_DWORD", -65536
       "MaxFileSize"="REG_DWORD", 1048576
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\Startup_RASMANCS]
       "ConsoleTracingMask"="REG_DWORD", -65536
       "EnableConsoleTracing"="REG_DWORD", 0
       "EnableFileTracing"="REG_DWORD", 0
       "FileDirectory"="REG_EXPAND_SZ, "%windir%\tracing"
       "FileTracingMask"="REG_DWORD", -65536
       "MaxFileSize"="REG_DWORD", 1048576
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5BECDE00-F7D5-4635-AE15-9191755DFF85}]
       "DisplayIcon"="REG_SZ", "C:\Program Files (x86)\Common Files\Triolight\uninstall.ico"
       "DisplayName"="REG_SZ", "SafeFinder"
       "DisplayVersion"="REG_SZ", "1.0.0.0"
       "Publisher"="REG_SZ", "Linkury"
       "UninstallString"="REG_SZ", ""C:\Program Files (x86)\Common Files\Triolight\uninstall.exe" shuz -f "C:\Program Files (x86)\Common Files\Triolight\uninstall.dat" -a uninstallme 5BECDE00-F7D5-4635-AE15-9191755DFF85 DeviceId=d03b690e-6f54-1ec9-9e73-c726299460e5 BarcodeId=51583999 ChannelId=999 DistributerName=SafeFinderAVs"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\SafeFinder.exe]
       "IgnoreSelfExits"="REG_DWORD", 1
       "MonitorProcess"="REG_SZ", "C:\ProgramData\Windows Monitor\Monitor.exe %i deviceId=d03b690e-6f54-1ec9-9e73-c726299460e5 channelId=999 distributer=SafeFinderAVs processName=SafeFinder.exe statsAddress=http://stats.ijnewhb.com/StatisticsService.svc/V1/JSON/LogEvent"
       "ReportingMode"="REG_DWORD", 1
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows]
       "AppInit_DLLs" = REG_SZ, "C:\ProgramData\SafeFinder\Isnimlux.dll"
       "LoadAppInit_DLLs" = REG_DWORD, 1
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\mtSafeFinder]
       "_dd"="REG_BINARY, ..............................................................................................................................................
       "_dh"="REG_BINARY, ......................................................................................................................................
       "_dn"="REG_BINARY, ..............................................................................................................................................
       "_fd"="REG_BINARY, ..............................................................................................................................
       "_fh"="REG_BINARY, ......................................................................................................................
       "_fn"="REG_BINARY, ..............................................................................................................................
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SafeFinder]
       "DisplayName"="REG_SZ", "SafeFinder"
       "ErrorControl"="REG_DWORD", 1
       "ImagePath"="REG_EXPAND_SZ, "C:\ProgramData\\SafeFinder\\SafeFinder.exe shuz -f "C:\ProgramData\\SafeFinder\\SafeFinder.dat" -l -a"
       "ObjectName"="REG_SZ", "LocalSystem"
       "Start"="REG_DWORD", 2
       "Type"="REG_DWORD", 16
       "WOW64"="REG_DWORD", 1
    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
       "Search Bar"="REG_SZ", "http://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRbPPu-brYsVApIPOERS58GcQeivu6iPL1Ne74nne9omldl6NEnXgUnm5V1HwDNYEApmRO7x45JUfiBePj2SfeEuXuiXuTJiudSgPGRyfAvkotptyR-vsRxaIg0cFPDu_Xozpfm67ZcOL2l75-bVpruz0sE5gXCz6D1Le9iQ2XsbrqABGF8tlE5rMXis2F5E1V0Q,&q={searchTerms}"
       "Search Page" = REG_SZ, "http://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRbPPu-brYsVApIPOERS58GcQeivu6iPL1Ne74nne9omldl6NEnXgUnm5V1HwDNYEApmRO7x45JUfiBePj2SfeEuXuiXuTJiudSgPGRyfAvkotptyR-vsRxaIg0cFPDu_Xozpfm67ZcOL2l75-bVpruz0sE5gXCz6D1Le9iQ2XsbrqABGF8tlE5rMXis2F5E1V0Q,&q={searchTerms}"
       "SearchAssistant"="REG_SZ", "http://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRbPPu-brYsVApIPOERS58GcQeivu6iPL1Ne74nne9omldl6NEnXgUnm5V1HwDNYEApmRO7x45JUfiBePj2SfeEuXuiXuTJiudSgPGRyfAvkotptyR-vsRxaIg0cFPDu_Xozpfm67ZcOL2l75-bVpruz0sE5gXCz6D1Le9iQ2XsbrqABGF8tlE5rMXis2F5E1V0Q,&q={searchTerms}"
       "Start Page" = REG_SZ, "http://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRbPPu-brYsVApIPOERS58GcQeivu6iPL1Ne74nne9omldl6NEnXgUnm5V1HwDNYEApmRO7x45JUfiBePj2SfeEuXuiXuTJiudSgPGRCZciw56u8F4OmHlUQh95h8Pc8ba5PjQ8E-hUucQPDy8nG-nIK_2MTjCqjbuXDpgXzEesHAlHzlhDIV6WmmzOzGNXJJOJM,"
       "Use Search Asst"="REG_SZ", "yes"
    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Search]
       "Default_Search_URL"="REG_SZ", "http://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRbPPu-brYsVApIPOERS58GcQeivu6iPL1Ne74nne9omldl6NEnXgUnm5V1HwDNYEApmRO7x45JUfiBePj2SfeEuXuiXuTJiudSgPGRyfAvkotptyR-vsRxaIg0cFPDu_Xozpfm67ZcOL2l75-bVpruz0sE5gXCz6D1Le9iQ2XsbrqABGF8tlE5rMXis2F5E1V0Q,&q={searchTerms}"
    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes]
       "DefaultScope" = REG_SZ, "{ielnksrch}"
    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{ielnksrch}]
       "DisplayName"="REG_SZ", "Search the web"
       "SuggestionsURL_JSON"="REG_SZ", "http://suggestqueries.google.com/complete/search?output=firefox&client=firefox&qu={searchTerms}"
       "SuggestionsURLFallback"="REG_SZ", "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}&sectionHeight={ie:sectionHeight}&FORM=IE8SSC&market={language}"
       "URL"="REG_SZ", "http://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRbPPu-brYsVApIPOERS58GcQeivu6iPL1Ne74nne9omldl6NEnXgUnm5V1HwDNYEApmRO7x45JUfiBePj2SfeEuXuiXuTJiudSgPGRyfAvkotptyR-vsRxaIg0cFPDu_Xozpfm67ZcOL2l75-bVpruz0sE5gXCz6D1Le9iQ2XsbrqABGF8tlE5rMXis2F5E1V0Q,&q={searchTerms}"
    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl]
       "Default"="REG_SZ", "http://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRbPPu-brYsVApIPOERS58GcQeivu6iPL1Ne74nne9omldl6NEnXgUnm5V1HwDNYEApmRO7x45JUfiBePj2SfeEuXuiXuTJiudSgPGRyfAvkotptyR-vsRxaIg0cFPDu_Xozpfm67ZcOL2l75-bVpruz0sE5gXCz6D1Le9iQ2XsbrqABGF8tlE5rMXis2F5E1V0Q,&q={searchTerms}"
    [HKEY_CURRENT_USER\Software\Rtp]
       "state"="REG_SZ", "success"
Malwarebytes Anti-Malware log:

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 11/9/2016
Scan Time: 5:22 PM
Logfile: mbamSafeFinder.txt
Administrator: Yes

Version: 2.2.1.1043
Malware Database: v2016.11.09.07
Rootkit Database: v2016.10.31.01
License: Premium
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Enabled

OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: {username}

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 328078
Time Elapsed: 12 min, 21 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 2
PUP.Optional.Linkury, C:\ProgramData\SafeFinder\SafeFinder.exe, 2304, Delete-on-Reboot, [fd3e2995f8a2ad892e874b5de51ca759]
PUP.Optional.Linkury, C:\Program Files (x86)\ProductUI\Startup.exe, 3184, Delete-on-Reboot, [9aa18f2f683245f1f6d0a0c114ec9868]

Modules: 0
(No malicious items detected)

Registry Keys: 10
PUP.Optional.Linkury, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\SAFEFINDER.EXE, Quarantined, [fd3e2995f8a2ad892e874b5de51ca759], 
PUP.Optional.Linkury, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\SAFEFINDER.EXE, Quarantined, [fd3e2995f8a2ad892e874b5de51ca759], 
PUP.Optional.Linkury.ACMB1, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\SafeFinder, Quarantined, [97a4a717a8f2b87ead4bda240af912ee], 
PUP.Optional.Linkury.ACMB1, HKLM\SOFTWARE\WOW6432NODE\mtSafeFinder, Quarantined, [d962a618b7e3360016e7d826d0339070], 
PUP.Optional.Linkury, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\IELNKSRCH, Quarantined, [96a5c5f9d5c5ad89f8c542b1669d3ec2], 
PUP.Optional.Linkury.ACMB1, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\SafeFinder_RASAPI32, Quarantined, [6bd06e502377b086e219e816f211b947], 
PUP.Optional.Linkury.ACMB1, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\SafeFinder_RASMANCS, Quarantined, [87b41da1c0dacd695f9c29d5be455ca4], 
PUP.Optional.Linkury.ACMB1, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SILENTPROCESSEXIT\SafeFinder.exe, Quarantined, [cc6f803eb8e2c86e09f39d61f90a9b65], 
PUP.Optional.Linkury, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{47098264-60CB-43BA-960F-15484FAFCDB0}, Quarantined, [62d9b90523779e985112e5c32fd449b7], 
PUP.Optional.Linkury, HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{IELNKSRCH}, Quarantined, [83b8308eebafc76f56669a593cc719e7], 

Registry Values: 9
PUP.Optional.Linkury, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|smrt, C:\Program Files (x86)\ProductUI\Startup.exe, Quarantined, [9aa18f2f683245f1f6d0a0c114ec9868]
PUP.Optional.Linkury, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\ielnksrch|DisplayName, Search the web, Quarantined, [96a5c5f9d5c5ad89f8c542b1669d3ec2]
PUP.Optional.Linkury.ACMB1, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\ielnksrch|URL, http://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRbPPu-brYsVApIPOERS58GcQeivu6iPL1Ne74nne9omldl6NEnXgUnm5V1HwDNYEApmRO7x45JUfiBePj2SfeEuXuiXuTJiudSgPGRyfAvkotptyR-vsRxaIg0cFPDu_Xozpfm67ZcOL2l75-bVpruz0sE5gXCz6D1Le9iQ2XsbrqABGF8tlE5rMXis2F5E1V0Q,&q={searchTerms}, Quarantined, [c5762b931f7b75c14719985e45be639d]
PUP.Optional.Linkury, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHURL|Default, http://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRbPPu-brYsVApIPOERS58GcQeivu6iPL1Ne74nne9omldl6NEnXgUnm5V1HwDNYEApmRO7x45JUfiBePj2SfeEuXuiXuTJiudSgPGRyfAvkotptyR-vsRxaIg0cFPDu_Xozpfm67ZcOL2l75-bVpruz0sE5gXCz6D1Le9iQ2XsbrqABGF8tlE5rMXis2F5E1V0Q,&q={searchTerms}, Quarantined, [ac8fe4da801a043265de7d4fe51d39c7]
PUP.Optional.Linkury, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{47098264-60CB-43BA-960F-15484FAFCDB0}|Publisher, Linkury, Quarantined, [62d9b90523779e985112e5c32fd449b7]
PUP.Optional.Linkury.ACMB1, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\SAFEFINDER|ImagePath, C:\ProgramData\\SafeFinder\\SafeFinder.exe shuz -f "C:\ProgramData\\SafeFinder\\SafeFinder.dat" -l -a, Quarantined, [dd5e5b63099175c1d7277d8193701de3]
PUP.Optional.Linkury, HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{ielnksrch}|DisplayName, Search the web, Quarantined, [83b8308eebafc76f56669a593cc719e7]
PUP.Optional.Linkury.ACMB1, HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{ielnksrch}|URL, http://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRbPPu-brYsVApIPOERS58GcQeivu6iPL1Ne74nne9omldl6NEnXgUnm5V1HwDNYEApmRO7x45JUfiBePj2SfeEuXuiXuTJiudSgPGRyfAvkotptyR-vsRxaIg0cFPDu_Xozpfm67ZcOL2l75-bVpruz0sE5gXCz6D1Le9iQ2XsbrqABGF8tlE5rMXis2F5E1V0Q,&q={searchTerms}, Quarantined, [c279615da6f412246df1df172ad91be5]
PUP.Optional.Linkury.ACMB1, HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHURL|Default, http://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRbPPu-brYsVApIPOERS58GcQeivu6iPL1Ne74nne9omldl6NEnXgUnm5V1HwDNYEApmRO7x45JUfiBePj2SfeEuXuiXuTJiudSgPGRyfAvkotptyR-vsRxaIg0cFPDu_Xozpfm67ZcOL2l75-bVpruz0sE5gXCz6D1Le9iQ2XsbrqABGF8tlE5rMXis2F5E1V0Q,&q={searchTerms}, Quarantined, [7cbfe6d818821224da853fb740c3f10f]

Registry Data: 9
PUP.Optional.Linkury, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS|AppInit_DLLs, C:\ProgramData\SafeFinder\Bluefax.dll, Good: (), Bad: (C:\ProgramData\SafeFinder\Bluefax.dll),Replaced,[c477833b4a507abca94a41a502ffcc34]
PUP.Optional.Linkury, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS|AppInit_DLLs, C:\ProgramData\SafeFinder\Tougheco.dll, Good: (), Bad: (C:\ProgramData\SafeFinder\Tougheco.dll),Replaced,[6ecdf8c61d7d35013f50c8ee19e81de3]
PUP.Optional.Linkury, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES|DefaultScope, {ielnksrch}, Good: ({0633EE93-D776-472f-A0FF-E1416B8B2E3A}), Bad: ({ielnksrch}),Replaced,[a398b30b98020c2a0ee65b1d61a3bd43]
PUP.Optional.Linkury.ACMB1, HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Search Page, http://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRbPPu-brYsVApIPOERS58GcQeivu6iPL1Ne74nne9omldl6NEnXgUnm5V1HwDNYEApmRO7x45JUfiBePj2SfeEuXuiXuTJiudSgPGRyfAvkotptyR-vsRxaIg0cFPDu_Xozpfm67ZcOL2l75-bVpruz0sE5gXCz6D1Le9iQ2XsbrqABGF8tlE5rMXis2F5E1V0Q,&q={searchTerms}, Good: (www.google.com), Bad: (http://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRbPPu-brYsVApIPOERS58GcQeivu6iPL1Ne74nne9omldl6NEnXgUnm5V1HwDNYEApmRO7x45JUfiBePj2SfeEuXuiXuTJiudSgPGRyfAvkotptyR-vsRxaIg0cFPDu_Xozpfm67ZcOL2l75-bVpruz0sE5gXCz6D1Le9iQ2XsbrqABGF8tlE5rMXis2F5E1V0Q,&q={searchTerms}),Replaced,[b7843886cad0d462da223048ca3a827e]
PUP.Optional.Linkury.ACMB1, HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, http://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRbPPu-brYsVApIPOERS58GcQeivu6iPL1Ne74nne9omldl6NEnXgUnm5V1HwDNYEApmRO7x45JUfiBePj2SfeEuXuiXuTJiudSgPGRCZciw56u8F4OmHlUQh95h8Pc8ba5PjQ8E-hUucQPDy8nG-nIK_2MTjCqjbuXDpgXzEesHAlHzlhDIV6WmmzOzGNXJJOJM,, Good: (www.google.com), Bad: (http://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRbPPu-brYsVApIPOERS58GcQeivu6iPL1Ne74nne9omldl6NEnXgUnm5V1HwDNYEApmRO7x45JUfiBePj2SfeEuXuiXuTJiudSgPGRCZciw56u8F4OmHlUQh95h8Pc8ba5PjQ8E-hUucQPDy8nG-nIK_2MTjCqjbuXDpgXzEesHAlHzlhDIV6WmmzOzGNXJJOJM,),Replaced,[9ba0f3cb86143df9a15bea8ee91bb050]
PUP.Optional.Linkury.ACMB1, HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Search Bar, http://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRbPPu-brYsVApIPOERS58GcQeivu6iPL1Ne74nne9omldl6NEnXgUnm5V1HwDNYEApmRO7x45JUfiBePj2SfeEuXuiXuTJiudSgPGRyfAvkotptyR-vsRxaIg0cFPDu_Xozpfm67ZcOL2l75-bVpruz0sE5gXCz6D1Le9iQ2XsbrqABGF8tlE5rMXis2F5E1V0Q,&q={searchTerms}, Good: (www.google.com), Bad: (http://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRbPPu-brYsVApIPOERS58GcQeivu6iPL1Ne74nne9omldl6NEnXgUnm5V1HwDNYEApmRO7x45JUfiBePj2SfeEuXuiXuTJiudSgPGRyfAvkotptyR-vsRxaIg0cFPDu_Xozpfm67ZcOL2l75-bVpruz0sE5gXCz6D1Le9iQ2XsbrqABGF8tlE5rMXis2F5E1V0Q,&q={searchTerms}),Replaced,[86b5536b4c4ec17549b38eeaed1734cc]
PUP.Optional.Linkury.ACMB1, HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|SearchAssistant, http://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRbPPu-brYsVApIPOERS58GcQeivu6iPL1Ne74nne9omldl6NEnXgUnm5V1HwDNYEApmRO7x45JUfiBePj2SfeEuXuiXuTJiudSgPGRyfAvkotptyR-vsRxaIg0cFPDu_Xozpfm67ZcOL2l75-bVpruz0sE5gXCz6D1Le9iQ2XsbrqABGF8tlE5rMXis2F5E1V0Q,&q={searchTerms}, Good: (www.google.com), Bad: (http://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRbPPu-brYsVApIPOERS58GcQeivu6iPL1Ne74nne9omldl6NEnXgUnm5V1HwDNYEApmRO7x45JUfiBePj2SfeEuXuiXuTJiudSgPGRyfAvkotptyR-vsRxaIg0cFPDu_Xozpfm67ZcOL2l75-bVpruz0sE5gXCz6D1Le9iQ2XsbrqABGF8tlE5rMXis2F5E1V0Q,&q={searchTerms}),Replaced,[44f7368897033df9d12b7ff9f11359a7]
PUP.Optional.Linkury.ACMB1, HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCH|Default_Search_URL, http://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRbPPu-brYsVApIPOERS58GcQeivu6iPL1Ne74nne9omldl6NEnXgUnm5V1HwDNYEApmRO7x45JUfiBePj2SfeEuXuiXuTJiudSgPGRyfAvkotptyR-vsRxaIg0cFPDu_Xozpfm67ZcOL2l75-bVpruz0sE5gXCz6D1Le9iQ2XsbrqABGF8tlE5rMXis2F5E1V0Q,&q={searchTerms}, Good: (www.google.com), Bad: (http://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRbPPu-brYsVApIPOERS58GcQeivu6iPL1Ne74nne9omldl6NEnXgUnm5V1HwDNYEApmRO7x45JUfiBePj2SfeEuXuiXuTJiudSgPGRyfAvkotptyR-vsRxaIg0cFPDu_Xozpfm67ZcOL2l75-bVpruz0sE5gXCz6D1Le9iQ2XsbrqABGF8tlE5rMXis2F5E1V0Q,&q={searchTerms}),Replaced,[12296757a3f7c373f00d631512f2c040]
PUP.Optional.Linkury, HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES|DefaultScope, {ielnksrch}, Good: ({0633EE93-D776-472f-A0FF-E1416B8B2E3A}), Bad: ({ielnksrch}),Replaced,[97a4813d356589ad2ac992e643c156aa]

Folders: 6
PUP.Optional.Linkury, C:\Windows\Temp\Smartbar, Quarantined, [61daf2ccd9c159dd704bda19e91aee12], 
PUP.Optional.Linkury.ACMB1, C:\ProgramData\SafeFinder, Delete-on-Reboot, [97a4a717a8f2b87ead4bda240af912ee], 
PUP.Optional.Linkury.ACMB1, C:\ProgramData\SafeFinder\ondemand, Quarantined, [97a4a717a8f2b87ead4bda240af912ee], 
PUP.Optional.Linkury.ACMB1, C:\ProgramData\SafeFinder\temp, Quarantined, [97a4a717a8f2b87ead4bda240af912ee], 
PUP.Optional.Linkury.ACMB1, C:\Program Files (x86)\Common Files\Greenbam, Quarantined, [dc5f7549a6f4ba7ce57ce7b537cd3dc3], 
PUP.Optional.Linkury.ACMB1, C:\ProgramData\SafeFinders, Quarantined, [7ac19e205b3f6fc7e99f9c00b64eb848], 

Files: 49
PUP.Optional.Linkury, C:\ProgramData\SafeFinder\SafeFinder.exe, Delete-on-Reboot, [fd3e2995f8a2ad892e874b5de51ca759], 
PUP.Optional.Linkury, C:\Program Files (x86)\ProductUI\Startup.exe, Delete-on-Reboot, [9aa18f2f683245f1f6d0a0c114ec9868], 
PUP.Optional.Linkury, C:\ProgramData\SafeFinder\Bluefax.dll, Quarantined, [c477833b4a507abca94a41a502ffcc34], 
PUP.Optional.Linkury, C:\ProgramData\SafeFinder\Tougheco.dll, Quarantined, [6ecdf8c61d7d35013f50c8ee19e81de3], 
PUP.Optional.Linkury, C:\ProgramData\SafeFinder\Faxtax.exe, Quarantined, [211afcc2079356e0747fd5110ff28e72], 
PUP.Optional.Linkury, C:\ProgramData\SafeFinder\IceRunin.exe, Quarantined, [c07bf6c81c7e4aecd10b503adf22dc24], 
PUP.Optional.Linkury, C:\ProgramData\SafeFinder\Unadox.exe, Quarantined, [de5d5a646436ca6c7183e8fe29d8dc24], 
PUP.Optional.Linkury, C:\Users\{username}\AppData\Roaming\Blackstring.exe, Quarantined, [2417d9e53961a88e7b3a4167c63ba45c], 
PUP.Optional.Linkury, C:\Users\{username}\AppData\Roaming\LaDax.bin, Quarantined, [d3687f3f198170c61bab045d857bac54], 
PUP.Optional.Linkury, C:\Users\{username}\Desktop\SafeFinder.exe, Quarantined, [19224b736c2ee84e5bef42715ba93fc1], 
PUP.Optional.Linkury, C:\Users\{username}\AppData\Roaming\md.xml, Quarantined, [ac8ff7c7326849ed7686a648a3609e62], 
PUP.Optional.Linkury, C:\Users\{username}\AppData\Roaming\noah.dat, Quarantined, [d16a2e900c8ee84e24d9f4fa739022de], 
PUP.Optional.Linkury, C:\Users\{username}\AppData\Roaming\uninstall_temp.ico, Quarantined, [f2494d713565af87fe00797560a3f709], 
PUP.Optional.Linkury, C:\Windows\Temp\Smartbar\GoldGolux.ico, Quarantined, [61daf2ccd9c159dd704bda19e91aee12], 
PUP.Optional.Linkury, C:\Windows\Temp\Smartbar\Mat-Air.ico, Quarantined, [61daf2ccd9c159dd704bda19e91aee12], 
PUP.Optional.Linkury, C:\Windows\Temp\Smartbar\Quotelight.ico, Quarantined, [61daf2ccd9c159dd704bda19e91aee12], 
PUP.Optional.Linkury.ACMB1, C:\Windows\SysWOW64\findit.xml, Quarantined, [e8536f4fa8f21422790aee069a69b947], 
PUP.Optional.Linkury.Gen, C:\Users\{username}\AppData\Roaming\Blackstring.tst, Quarantined, [3704704e23779e98575559a351b223dd], 
PUP.Optional.Linkury.ACMB1, C:\ProgramData\SafeFinder\uninstall.dat, Quarantined, [97a4a717a8f2b87ead4bda240af912ee], 
PUP.Optional.Linkury.ACMB1, C:\ProgramData\SafeFinder\conf.config, Quarantined, [97a4a717a8f2b87ead4bda240af912ee], 
PUP.Optional.Linkury.ACMB1, C:\ProgramData\SafeFinder\Config.xml, Quarantined, [97a4a717a8f2b87ead4bda240af912ee], 
PUP.Optional.Linkury.ACMB1, C:\ProgramData\SafeFinder\Faxtax.exe.config, Quarantined, [97a4a717a8f2b87ead4bda240af912ee], 
PUP.Optional.Linkury.ACMB1, C:\ProgramData\SafeFinder\Free-Tip.dat, Quarantined, [97a4a717a8f2b87ead4bda240af912ee], 
PUP.Optional.Linkury.ACMB1, C:\ProgramData\SafeFinder\IceRunin.exe.config, Quarantined, [97a4a717a8f2b87ead4bda240af912ee], 
PUP.Optional.Linkury.ACMB1, C:\ProgramData\SafeFinder\Lathome.bin, Quarantined, [97a4a717a8f2b87ead4bda240af912ee], 
PUP.Optional.Linkury.ACMB1, C:\ProgramData\SafeFinder\Lathome.bin.bck, Quarantined, [97a4a717a8f2b87ead4bda240af912ee], 
PUP.Optional.Linkury.ACMB1, C:\ProgramData\SafeFinder\md.xml, Quarantined, [97a4a717a8f2b87ead4bda240af912ee], 
PUP.Optional.Linkury.ACMB1, C:\ProgramData\SafeFinder\NewRoning.bin, Quarantined, [97a4a717a8f2b87ead4bda240af912ee], 
PUP.Optional.Linkury.ACMB1, C:\ProgramData\SafeFinder\RedAnit.bin, Quarantined, [97a4a717a8f2b87ead4bda240af912ee], 
PUP.Optional.Linkury.ACMB1, C:\ProgramData\SafeFinder\SafeFinder.d.dat, Delete-on-Reboot, [97a4a717a8f2b87ead4bda240af912ee], 
PUP.Optional.Linkury.ACMB1, C:\ProgramData\SafeFinder\SafeFinder.dat, Delete-on-Reboot, [97a4a717a8f2b87ead4bda240af912ee], 
PUP.Optional.Linkury.ACMB1, C:\ProgramData\SafeFinder\Sandax.bin, Quarantined, [97a4a717a8f2b87ead4bda240af912ee], 
PUP.Optional.Linkury.ACMB1, C:\ProgramData\SafeFinder\Scotin.bin, Quarantined, [97a4a717a8f2b87ead4bda240af912ee], 
PUP.Optional.Linkury.ACMB1, C:\ProgramData\SafeFinder\Soltanfan.bin, Quarantined, [97a4a717a8f2b87ead4bda240af912ee], 
PUP.Optional.Linkury.ACMB1, C:\ProgramData\SafeFinder\Superdamhome.bin, Quarantined, [97a4a717a8f2b87ead4bda240af912ee], 
PUP.Optional.Linkury.ACMB1, C:\ProgramData\SafeFinder\Truecore.dat, Quarantined, [97a4a717a8f2b87ead4bda240af912ee], 
PUP.Optional.Linkury.ACMB1, C:\ProgramData\SafeFinder\Unadox.exe.config, Quarantined, [97a4a717a8f2b87ead4bda240af912ee], 
PUP.Optional.Linkury.ACMB1, C:\Program Files (x86)\Common Files\Greenbam\InstallationConfiguration.xml, Quarantined, [dc5f7549a6f4ba7ce57ce7b537cd3dc3], 
PUP.Optional.Linkury.ACMB1, C:\Program Files (x86)\Common Files\Greenbam\uninstall.dat, Quarantined, [dc5f7549a6f4ba7ce57ce7b537cd3dc3], 
PUP.Optional.Linkury.ACMB1, C:\Program Files (x86)\Common Files\Greenbam\uninstall.exe, Quarantined, [dc5f7549a6f4ba7ce57ce7b537cd3dc3], 
PUP.Optional.Linkury.ACMB1, C:\Program Files (x86)\Common Files\Greenbam\uninstall.ico, Quarantined, [dc5f7549a6f4ba7ce57ce7b537cd3dc3], 
PUP.Optional.Linkury.ACMB1, C:\ProgramData\SafeFinders\ff.HP, Quarantined, [7ac19e205b3f6fc7e99f9c00b64eb848], 
PUP.Optional.Linkury.ACMB1, C:\ProgramData\SafeFinders\ff.NT, Quarantined, [7ac19e205b3f6fc7e99f9c00b64eb848], 
PUP.Optional.Linkury.ACMB1, C:\Users\MBAM\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\prefs.js, Good: (), Bad: (user_pref("browser.newtab.url", "C:\ProgramData\SafeFinders\ff.NT");), Replaced,[e8533589d8c2f5415be5128bc73d4db3]
PUP.Optional.Linkury.ACMB1, C:\Users\MBAM\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\prefs.js, Good: (user_pref("browser.startup.homepage", "https://www.malwarebytes.org/restorebrowser/), Bad: (user_pref("browser.startup.homepage", "C:\ProgramData\SafeFinders\ff.HP), Replaced,[300b6f4f980244f2cf6fbde2788c40c0]
PUP.Optional.Linkury.ACMB1, C:\Users\{username}\AppData\Roaming\Config.xml, Quarantined, [66d5b608dbbf0d294d0b1e7e6e96fe02], 
PUP.Optional.Linkury.ACMB1, C:\Users\{username}\AppData\Roaming\InstallationConfiguration.xml, Quarantined, [ef4cd0ee6d2dac8a5603524af3117b85], 
PUP.Optional.Linkury.ACMB1, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\prefs.js, Good: (), Bad: (user_pref("browser.newtab.url", "C:\\ProgramData\\SafeFinders\\ff.NT");), Replaced,[c77489351e7c55e1df61e8b5cb398080]
PUP.Optional.Linkury.ACMB1, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\prefs.js, Good: (user_pref("browser.startup.homepage", "https://www.malwarebytes.org/restorebrowser/), Bad: (user_pref("browser.startup.homepage", "C:\\ProgramData\\SafeFinders\\ff.HP), Replaced,[c774edd1c8d2979f3fff6c3351b3b749]

Physical Sectors: 0
(No malicious items detected)


(end)
As mentioned before the full version of Malwarebytes Anti-Malware could have protected your computer against this threat.
We use different ways of protecting your computer(s):
  • Dynamically Blocks Malware Sites & Servers
  • Malware Execution Prevention
Save yourself the hassle and get protected.
  • 0

Advertisements

Back to Malware Removal Guides and Tutorials


0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

  1. Geeks to Go Community
  2. → Security
  3. → Malware Removal Guides and Tutorials

As Featured On:

featured
Malware Removal How to Guides Windows 7 System Building Download Files Register welcome

Never used a forum? Learn how.