Remove Malware's From This Site !

[LoverOfLove]

I stumbled upon an Medicines named "Windows 10 Permanent Medicines Ultimate 2.5"
This Medicines is present in many distributions here.
this Medicines installs many bullshit potentially unwanted applications, and real malwares and changes DNS settings.

now I must tell you there are two types of application with similar names. one is malware and another one is legit.
though following green one app is false positives and doesn't install any bullshit and does its job,
but red one is a real malware.

Windows 10 Permanent Medicines Ultimate 2.5

Spoiler: Checksums

MD5: 81581b643bb4163285c7ce46aba60515
SHA1: f733b70e13e42731bd24677cb48f30a923936009
SHA256: f59076c054c8202d3ff669aea6fd260005525773b205d8a92d5ff41dfa8fdfba

Windows 10 Pro Permanent Medicines Ultimate 2.2

Spoiler: Checksums

MD5: 3f65ebfbca60977a9f72c0aaa642448a
SHA1: 48369814420037e51fc7c7d158f0d1d737049cad
SHA256: 9e6801bcc8446e92b8875fd23067133db3b4e01f4260989d343f1200d9ea6534

so mods pls remove the app named in red color from this site.

 

[The Rain]

will u submit the link of red one

 

[Uncle Mac]

@

You must be registered for see links

why you make a thread that lacks the bullshit exact details..
Why didnt you TAG the Author on the Thread with issues and wait.. WHY.

Get here real soon or this bullshit will be out before it draws flies

 

[LoverOfLove]

will u submit the link of red one

@

You must be registered for see links

why you make a thread that lacks the bullshit exact details..
Why didnt you TAG the Author on the Thread with issues and wait.. WHY.

Get here real soon or this bullshit will be out before it draws flies

there are many links in this forum for this

You must be registered for see links

various toolkit collection thread and separate dedicated threads are available for this tool. there are just too many and i assume that old versions are infected too. since its too much and uploaded by many. its easy to just post it here and let the mods handle it.
and @TheMacGyver try to be little less mean next time.

 

[Uncle Mac]

there are many links in this forum for this

You must be registered for see links

various toolkit collection thread and separate dedicated threads are available for this tool. there are just too many and i assume that old versions are infected too. since its too much and uploaded by many. its easy to just post it here and let the mods handle it.
and @TheMacGyver try to be little less mean next time.

Wonderful and Nothing mean about doing it the correct way.. Thanks
Thread Complete and Locked..

 

[Uncle Mac]

Thread is open again and waiting for you.

1. Give us thread link.. The Rain and I asked you and you ignored.
2. Also give us the Author to the Thread..
3. Post issues and Images here concerning the Thread that you find
4. Do not post your issues in chat.. Ok.. Thanks...

 

[Hawkeye]

its very rare i see a thread reopened, i think i can honestly say we are waiting @LoverOfLove im sure it does not take this long ?

 

[M4Master]

its very rare i see a thread reopened, i think i can honestly say we are waiting @LoverOfLove im sure it does not take this long ?

We are using a different approach towards people who think of us as people posting virus and malwares...

WhiteDeath and LoverOfLove were having a discussion where I had to intervene for explaining him all the details. As he was not assured, I requested MacGyver to reopen the thread so that we can his research

But rest assured, we won't posting anything which will harm your device in any way

Regards,
M4Master

 

[Uncle Mac]

ofcorse we are not posting bullshits ...im not new in this uploading this ..cauze this guy cant understand what mean trusted source..he focus in something that call ultimate Medicines find virus jesus christ...the antirivus find always virus in kmspico what does mean that kmspico have virus or the windows loader or rain Medicines ...

 

[Hawkeye]

i totally understand false/positives i aint worrying about nothing people just annoy me very much lol Team-OS rules all

 

[LoverOfLove]

here are the results,
@WhiteDeath @M4Master
av is disabled.
i installed this

You must be registered for see links

clicked on desktop link for Medicines and it started to ask for upgrading to version 2.6.
i made sure i didnt leave any checkbox turned on for various apps in installer.
i waited some time to finish the process which is happening in taskbar and my netlimiter network monitor app.
some new apps appeared in start menu. and a cmd process appear in taskbar which is running at 33% for long time and bunch of other processes appeared.
some new folder appeared in weird spellings in program files.

You must be registered for see links

new weird process in task bar

You must be registered for see links

You must be registered for see links

You must be registered for see links

meanwhile chrome home page is changed. to some search engine

i clicked on desktop link for Medicines. and it still asked to upgrade
now i started cleaning with malware bytes. ohh wait. i stopped working
so i used portable version of it and here is the result.

Spoiler: malwarebytes result

Malwarebytes Anti-Malware

You must be registered for see links

Scan Date: 01-04-2018
Scan Time: 04:33 PM
Logfile:
Administrator: Yes

Version: 2.2.1.1043
Malware Database: v2018.03.24.03
Rootkit Database: v2018.03.08.03
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows 10
CPU: x86
File System: NTFS
User: Windows 10

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 159788
Time Elapsed: 8 min, 29 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 16
Adware.IStartSurf, C:\ProgramData\aac55c8cef\c28e8cfab1.exe, 5520, , [f51e3bd5c8f02c0ac17dce268a761de3]
PUP.Optional.GoldClick, C:\Program Files\ProxyGate\Cloud.exe, 6948, , [d0432be58f2986b06c055ec902ff3bc5]
PUP.Optional.GoldClick, C:\Program Files\ProxyGate\PGChk.exe, 6992, , [2ae99f71a6124cea4a739d7a57aa4ab6]
Adware.Linkury, C:\ProgramData\Quoteex\Quoteex.exe, 2528, , [898acc444d6b9e9896ad5999e61c7e82]
PUP.Optional.LogicHandler, C:\ProgramData\Logic Cramble\set.exe, 3808, , [4ac92ae69a1e8da91395633949b78c74]
PUP.Optional.GoldClick, C:\Program Files\ProxyGate\PGNet.exe, 3888, , [c54ec9476e4a85b119a4090ef50cdf21]
RiskWare.Redirector, C:\Users\Windows 10\AppData\Local\GenericTools\GenericTools.exe, 6392, , [e3306ea23d7bb1851926e027d52bc937]
Adware.Social2Search.EncJob, C:\Program Files\aabd558f34bc5323d43237eb005c43e9\efec0f963f3e59a10e13b0f82d5c4b50.exe, 8080, , [71a207098f29ce682fe15a15827ff30d]
Adware.OnlineIO, C:\Program Files\Microleaves\Online Application\Version 2.6.0\Online-Guardian.exe, 7456, , [898ae52b3484be781fecaad1c93848b8]
Adware.OnlineIO, C:\Program Files\Microleaves\Online Application\Version 2.6.0\Online-Guardian.exe, 1976, , [898ae52b3484be781fecaad1c93848b8]
Adware.OnlineIO, C:\Program Files\Microleaves\Online Application\Version 2.6.0\Online-Guardian.exe, 7956, , [898ae52b3484be781fecaad1c93848b8]
Adware.OnlineIO, C:\Program Files\Microleaves\Online Application\Version 2.6.0\Online-Guardian.exe, 6644, , [898ae52b3484be781fecaad1c93848b8]
Adware.OnlineIO, C:\Program Files\Microleaves\Online Application\Version 2.6.0\Online-Guardian.exe, 8008, , [898ae52b3484be781fecaad1c93848b8]
Adware.OnlineIO, C:\Program Files\Microleaves\Online Application\Version 2.6.0\Online-Guardian.exe, 3048, , [898ae52b3484be781fecaad1c93848b8]
PUP.Optional.Linkury.ACMB1, C:\ProgramData\Quoteex\Quoteex.exe, 2528, , [0a09fd13f9bf85b12b40deb0778b07f9]
Adware.Linkury, C:\ProgramData\Logic Cramble\set.exe, 3808, , [9b78d937dfd92e080f7633e73ec308f8]

Modules: 12
PUP.Optional.GoldClick, C:\Program Files\ProxyGate\PGCommon.dll, , [ea29c947d5e377bf7c412dea43be30d0],
Adware.Wajam.TskLnk, C:\Windows\936c6d6866a3c63fce01b0dac13d7738.dll, , [49ca8c84bff913231c2a838d13ed1be5],
RiskWare.Redirector, C:\Users\Windows 10\AppData\Local\GenericTools\libcurl.dll, , [e3306ea23d7bb1851926e027d52bc937],
RiskWare.Redirector, C:\Users\Windows 10\AppData\Local\GenericTools\libeay32.dll, , [e3306ea23d7bb1851926e027d52bc937],
RiskWare.Redirector, C:\Users\Windows 10\AppData\Local\GenericTools\msvcp100.dll, , [e3306ea23d7bb1851926e027d52bc937],
RiskWare.Redirector, C:\Users\Windows 10\AppData\Local\GenericTools\msvcr100.dll, , [e3306ea23d7bb1851926e027d52bc937],
RiskWare.Redirector, C:\Users\Windows 10\AppData\Local\GenericTools\QtCore4.dll, , [e3306ea23d7bb1851926e027d52bc937],
RiskWare.Redirector, C:\Users\Windows 10\AppData\Local\GenericTools\QtGui4.dll, , [e3306ea23d7bb1851926e027d52bc937],
RiskWare.Redirector, C:\Users\Windows 10\AppData\Local\GenericTools\QtNetwork4.dll, , [e3306ea23d7bb1851926e027d52bc937],
RiskWare.Redirector, C:\Users\Windows 10\AppData\Local\GenericTools\QtScript4.dll, , [e3306ea23d7bb1851926e027d52bc937],
RiskWare.Redirector, C:\Users\Windows 10\AppData\Local\GenericTools\ssleay32.dll, , [e3306ea23d7bb1851926e027d52bc937],
Adware.Linkury, C:\ProgramData\Logic Cramble\X86\SQLite.Interop.dll, , [7a991bf5fcbc280ec565771c0bf62dd3],

Registry Keys: 50
Adware.IStartSurf, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\api_wtl_dll, , [f51e3bd5c8f02c0ac17dce268a761de3],
Adware.Wajam.TskLnk, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\936c6d6866a3c63fce01b0dac13d7738, , [49ca8c84bff913231c2a838d13ed1be5],
Adware.Linkury, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\QUOTEEX.EXE, , [898acc444d6b9e9896ad5999e61c7e82],
PUP.Optional.LogicHandler, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\backlh, , [4ac92ae69a1e8da91395633949b78c74],
Adware.Wajam.Generic, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\24ea9943b0503eeecc89c62401b67a23, , [bf5428e818a0c571431aff407a865ca4],
PUP.Optional.GoldClick, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\pgt_svc, , [df34759b4870e650e0dd0611ee13a957],
PUP.Optional.Wajam, HKLM\SOFTWARE\CLASSES\APPID\56BF5154-0B48-4ADB-902A-6C8B12E270D9, , [759e28e8338537ff35fa8471f60bf40c],
Adware.NeoBar, HKLM\SOFTWARE\CLASSES\CLSID\{C0D38E5A-7CF8-4105-8FE8-31B81443A114}, , [cf4431df7a3ea98dd4c7237428d9857b],
Adware.NeoBar, HKLM\SOFTWARE\CLASSES\TYPELIB\{079E0027-6B91-4147-9B20-68EE134E0171}, , [cf4431df7a3ea98dd4c7237428d9857b],
Adware.NeoBar, HKLM\SOFTWARE\CLASSES\INTERFACE\{EB438FB2-0FDA-4DEC-A7B3-5439EF85308C}, , [cf4431df7a3ea98dd4c7237428d9857b],
Adware.NeoBar, HKLM\SOFTWARE\CLASSES\CLSID\{C0D38E5A-7CF8-4105-8FE8-31B81443A114}\INPROCSERVER32, , [cf4431df7a3ea98dd4c7237428d9857b],
Adware.NeoBar, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{C0D38E5A-7CF8-4105-8FE8-31B81443A114}, , [cf4431df7a3ea98dd4c7237428d9857b],
Adware.NeoBar, HKU\S-1-5-21-2098973197-2080944019-1438792929-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{C0D38E5A-7CF8-4105-8FE8-31B81443A114}, , [cf4431df7a3ea98dd4c7237428d9857b],
Adware.Zdengo.Generic, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\aabd558f34bc5323d43237eb005c43e9, , [64aff51b595ff442c49945c83bc80df3],
Adware.Social2Search.EncJob, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\aabd558f34bc5323d43237eb005c43e9, , [71a207098f29ce682fe15a15827ff30d],
PUP.Optional.Linkury.ACMB1, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\Quoteex, , [0a09fd13f9bf85b12b40deb0778b07f9],
PUP.Optional.Linkury.ACMB1, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\QUOTEEX.EXE, , [0a09fd13f9bf85b12b40deb0778b07f9],
Adware.Tuto4PC, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\Multitimer_is1, , [1bf8ee226f498caa419716d87d85d62a],
PUP.Optional.Linkury.ACMB1, HKLM\SOFTWARE\mtQuoteex, , [39da5eb2febab77fc70a3d82cc361de3],
Adware.SearchAwesome, HKLM\SOFTWARE\SrcAAAesom Browser Enhancer, , [6da6ce4224940b2b3801239ac23e2cd4],
PUP.Optional.OnlineIO, HKLM\SOFTWARE\MICROLEAVES\Online Application, , [f320ec24d9df6fc7c8c4ef8313edda26],
Adware.OnlineIO, HKLM\SOFTWARE\MICROLEAVES\Online Application, , [060d24ecad0bb97d4adce09b7a87cb35],
PUP.Optional.OnlineIO, HKLM\SOFTWARE\MICROLEAVES\{5266F634-7B7D-4537-BDDC-98DD6CFCBAA1}, , [6ea53ed27543e254f84bb190a65a56aa],
PUP.Optional.Linkury, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\IELNKSRCH, , [a1724ac6942441f51b230b803cc6f60a],
PUP.Optional.Linkury.ACMB1, HKLM\SOFTWARE\MICROSOFT\TRACING\Quoteex_RASAPI32, , [2fe444cceeca73c384e9ccc20df5ef11],
PUP.Optional.Linkury.ACMB1, HKLM\SOFTWARE\MICROSOFT\TRACING\Quoteex_RASMANCS, , [29ea28e8a31502348ce187070af86c94],
PUP.Optional.OnlineIO, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{114D3D11-2D38-463F-80ED-527EDDA5E8AD}, , [6ba821ef22964fe73bc7c54a50b0ad53],
PUP.Optional.OnlineIO, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{2BD4E004-1581-4F47-9F30-A98EA1C50FA6}, , [e033d0403b7d2a0c39c9bb54a15f2bd5],
PUP.Optional.OnlineIO, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{78E26493-69DD-498F-AD1E-7668C304CF45}, , [f1225eb28f29112542c02ee16e928d73],
PUP.Optional.OnlineIO, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{A4EB4A07-BA53-4E5A-B20B-7B985581FD0A}, , [da398a86ffb9c274ac5630df17e9fe02],
PUP.Optional.OnlineIO, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{D78758E7-6835-4841-827D-D527CAFF8F30}, , [f41f97798632d5612d9edc5ded132bd5],
PUP.Optional.OnlineIO, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{E512CCD7-798F-4A5C-9B28-C173944FCE2D}, , [090af8184078092dfa0833dc6a967c84],
PUP.Optional.OnlineIO, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{FFF66466-4D6A-4152-8460-F00CA7194B52}, , [dd3670a0a41444f20ef4e827916f09f7],
PUP.Optional.OnlineIO, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\Online Application V2G1, , [4bc80b05c6f25ed868b2808fc33d9868],
PUP.Optional.OnlineIO, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\Online Application V2G2, , [4cc712fe793fbc7a9684b15e629e8878],
PUP.Optional.OnlineIO, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\Online Application V2G3, , [f32024ec17a15cdaae6c20efbf410cf4],
PUP.Optional.OnlineIO, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\Online Application V2G4, , [ba59b55b3c7c0b2bb66488878779b24e],
PUP.Optional.OnlineIO, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\Online Application V2G5, , [7a99cb45edcb0a2c011914fba65aac54],
PUP.Optional.OnlineIO, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\Online Application V2G6, , [40d344ccd3e52c0a2eec69a61fe1f40c],
PUP.Optional.OnlineIO, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\Updater_Online_Application, , [040f749c516779bd2d7dff38a55b14ec],
PUP.Optional.Linkury.ACMB1, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SILENTPROCESSEXIT\Quoteex.exe, , [a07341cfa01892a4630b395521e16997],
PUP.Optional.NeoBar.ChrPRST, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\E3605470-291B-44EB-8648-745EE356599A, , [848f67a98f296dc9ecafeb41a060916f],
PUP.Optional.ProxyGate, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{1EC095EE-8CA3-43D6-B9F5-0C55B82ED3D7}}_is1, , [ba5927e99a1e40f6c35cfc80f80944bc],
PUP.Optional.OnlineIO, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{5266F634-7B7D-4537-BDDC-98DD6CFCBAA1}, , [4ac90f0196223204e38aa9bff80959a7],
PUP.Optional.Linkury, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{6C5ADC48-FAC4-4E2B-B17B-DAF2A0E91F2A}, , [c2517d93f5c315211c175702c73bdc24],
Adware.Linkury, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\BACKLH, , [9b78d937dfd92e080f7633e73ec308f8],
PUP.Optional.Linkury.ACMB1, HKU\S-1-5-21-2098973197-2080944019-1438792929-1001\SOFTWARE\mtQuoteex, , [a66d4bc58e2a2511d894f896b84aa55b],
PUP.Optional.Wajam, HKU\S-1-5-21-2098973197-2080944019-1438792929-1001\SOFTWARE\WajIEnhance, , [947f21ef477139fdc99e046439c9bc44],
PUP.Optional.Linkury, HKU\S-1-5-21-2098973197-2080944019-1438792929-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{IELNKSRCH}, , [769dda36ae0a4beb1527d0bbea18c937],
Adware.Linkury.TskLnk, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{6C5ADC48-FAC4-4E2B-B17B-DAF2A0E91F2A}, , [2ae90c04c7f1191d22bac235c53bdc24],

Registry Values: 27
Adware.Tuto4PC, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|Multitimer, "C:\Program Files\Multitimer\Multitimer.exe", , [31e2c34d6157dc5a495f0120d32dc13f]
Adware.Tuto4PC.Generic, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE|zgere3sydni, "C:\Program Files\Fash\3885.exe" 1 3.1522578726.5ac0b526f2ccb, , [29eaaa66b701a69026dcd0ab5da4eb15]
RiskWare.Redirector, HKU\S-1-5-21-2098973197-2080944019-1438792929-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|GenericTools, C:\Users\Windows 10\AppData\Local\GenericTools\GenericTools.exe, , [e3306ea23d7bb1851926e027d52bc937]
PUP.Optional.Linkury, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\ielnksrch|DisplayName, Search the web, , [a1724ac6942441f51b230b803cc6f60a]
PUP.Optional.Linkury.ACMB1, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\ielnksrch|URL,

You must be registered for see links

{searchTerms}, , [45ce55bb8e2a49ed1fe7d3ba61a1e41c]
PUP.Optional.OnlineIO, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{114D3D11-2D38-463F-80ED-527EDDA5E8AD}|Path, \Online Application V2G4, , [6ba821ef22964fe73bc7c54a50b0ad53]
PUP.Optional.OnlineIO, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{2BD4E004-1581-4F47-9F30-A98EA1C50FA6}|Path, \Online Application V2G6, , [e033d0403b7d2a0c39c9bb54a15f2bd5]
PUP.Optional.OnlineIO, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{78E26493-69DD-498F-AD1E-7668C304CF45}|Path, \Online Application V2G1, , [f1225eb28f29112542c02ee16e928d73]
PUP.Optional.OnlineIO, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{A4EB4A07-BA53-4E5A-B20B-7B985581FD0A}|Path, \Online Application V2G2, , [da398a86ffb9c274ac5630df17e9fe02]
PUP.Optional.OnlineIO, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{D78758E7-6835-4841-827D-D527CAFF8F30}|Path, \Updater_Online_Application, , [f41f97798632d5612d9edc5ded132bd5]
PUP.Optional.OnlineIO, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{E512CCD7-798F-4A5C-9B28-C173944FCE2D}|Path, \Online Application V2G3, , [090af8184078092dfa0833dc6a967c84]
PUP.Optional.OnlineIO, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{FFF66466-4D6A-4152-8460-F00CA7194B52}|Path, \Online Application V2G5, , [dd3670a0a41444f20ef4e827916f09f7]
Adware.SearchAwesome, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\aabd558f34bc5323d43237eb005c43e9|DisplayName, SearchAwesome, , [bf5467a965534fe78774dfe7ee120cf4]
Adware.SearchAwesome.Generic, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\aabd558f34bc5323d43237eb005c43e9|Publisher, SearchAwesome, , [7d96937d8d2b989efafe01a9b05132ce]
PUP.Optional.OnlineIO, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{5266F634-7B7D-4537-BDDC-98DD6CFCBAA1}|Contact, [email protected], , [9380c54bb80074c2e38dde52cd339868]
PUP.Optional.OnlineIO, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{5266F634-7B7D-4537-BDDC-98DD6CFCBAA1}|URLInfoAbout,

You must be registered for see links

, , [90835ab6a2161b1b1fd4dc2e3cc47f81]
PUP.Optional.Linkury, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{6C5ADC48-FAC4-4E2B-B17B-DAF2A0E91F2A}|Publisher, Linkury, , [c2517d93f5c315211c175702c73bdc24]
PUP.Optional.ProxyGate, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{1EC095EE-8CA3-43D6-B9F5-0C55B82ED3D7}}_is1|URLInfoAbout,

You must be registered for see links

, , [5eb5e62ab00837ffc9621efbed141ee2]
PUP.Optional.ProxyGate, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{1EC095EE-8CA3-43D6-B9F5-0C55B82ED3D7}}_is1|HelpLink,

You must be registered for see links

, , [080bf11fe0d8350165c6e8316899da26]
PUP.Optional.ProxyGate, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{1EC095EE-8CA3-43D6-B9F5-0C55B82ED3D7}}_is1|URLUpdateInfo,

You must be registered for see links

, , [8b8812fe4b6d270ff932da3f20e1dc24]
Adware.Linkury, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\BACKLH|ImagePath, C:\ProgramData\Logic Cramble\set.exe, , [9b78d937dfd92e080f7633e73ec308f8]
PUP.Optional.Linkury.ACMB1, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\QUOTEEX|ImagePath, C:\ProgramData\\Quoteex\\Quoteex.exe shuz -f "C:\ProgramData\\Quoteex\\Quoteex.dat" -l -a, , [9083af6101b72313620d6f1fc14107f9]
PUP.Optional.Linkury.ACMB1, HKU\S-1-5-21-2098973197-2080944019-1438792929-1001\ENVIRONMENT|SNP,

You must be registered for see links

, , [56bd54bcbcfc3501ebbe9dee17eb20e0]
PUP.Optional.Linkury.ACMB1, HKU\S-1-5-21-2098973197-2080944019-1438792929-1001\ENVIRONMENT|SNF, C:\ProgramData\Quoteexs\snp.sc, , [72a19c747c3ce452d0d8315ae31f1ee2]
PUP.Optional.Linkury, HKU\S-1-5-21-2098973197-2080944019-1438792929-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{ielnksrch}|DisplayName, Search the web, , [769dda36ae0a4beb1527d0bbea18c937]
PUP.Optional.Linkury.ACMB1, HKU\S-1-5-21-2098973197-2080944019-1438792929-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{ielnksrch}|URL,

You must be registered for see links

{searchTerms}, , [d83b77990aae82b4679d90fdcf33e11f]
PUP.Optional.Linkury.ACMB1, HKU\S-1-5-21-2098973197-2080944019-1438792929-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHURL|Default,

You must be registered for see links

{searchTerms}, , [3dd6b15f8b2d4fe7897c78158b77b34d]

Registry Data: 8
PUP.Optional.CouponMarvel, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS|AppInit_DLLs, C:\ProgramData\Quoteex\Alphadex.dll, Good: (), Bad: (C:\ProgramData\Quoteex\Alphadex.dll),,[6ea59c74a711122461c823ba3dc5fb05]
PUP.Optional.Linkury, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES|DefaultScope, {ielnksrch}, Good: ({0633EE93-D776-472f-A0FF-E1416B8B2E3A}), Bad: ({ielnksrch}),,[49caf917f0c8b6803b00b100758d956b]
PUP.Optional.Linkury.ACMB1, HKU\S-1-5-21-2098973197-2080944019-1438792929-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Search Page,

You must be registered for see links

{searchTerms}, Good: (

You must be registered for see links

), Bad: (

You must be registered for see links

{searchTerms}),,[8d863dd313a5a690b093c2efd32f37c9]
PUP.Optional.Linkury.ACMB1, HKU\S-1-5-21-2098973197-2080944019-1438792929-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page,

You must be registered for see links

,,, Good: (

You must be registered for see links

), Bad: (

You must be registered for see links

PUP.Optional.Linkury.ACMB1, HKU\S-1-5-21-2098973197-2080944019-1438792929-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Search Bar,

You must be registered for see links

{searchTerms}, Good: (

You must be registered for see links

), Bad: (

You must be registered for see links

{searchTerms}),,[0e05749cfdbbef47df64b001cd3533cd]
PUP.Optional.Linkury.ACMB1, HKU\S-1-5-21-2098973197-2080944019-1438792929-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|SearchAssistant,

You must be registered for see links

{searchTerms}, Good: (

You must be registered for see links

), Bad: (

You must be registered for see links

{searchTerms}),,[f320e9279622cb6ba79c3c75d92910f0]
PUP.Optional.Linkury.ACMB1, HKU\S-1-5-21-2098973197-2080944019-1438792929-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCH|Default_Search_URL,

You must be registered for see links

{searchTerms}, Good: (

You must be registered for see links

), Bad: (

You must be registered for see links

{searchTerms}),,[b1627d9378402016d66ebdf415ed7e82]
PUP.Optional.Linkury, HKU\S-1-5-21-2098973197-2080944019-1438792929-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES|DefaultScope, {ielnksrch}, Good: ({0633EE93-D776-472f-A0FF-E1416B8B2E3A}), Bad: ({ielnksrch}),,[b65db0604870f1454befe0d1e61c07f9]

Folders: 29
RiskWare.Redirector, C:\Users\Windows 10\AppData\Local\GenericTools, , [e3306ea23d7bb1851926e027d52bc937],
Trojan.Agent, C:\Windows\System32\SSL, , [48cbb060e7d1b680e49f092e728edf21],
Adware.Social2Search.EncJob, C:\Program Files\aabd558f34bc5323d43237eb005c43e9, , [71a207098f29ce682fe15a15827ff30d],
PUP.Optional.ProxyGate.PrxySvrRST, C:\Program Files\ProxyGate, , [031020f06553a294058788eec041926e],
PUP.Optional.ProxyGate.PrxySvrRST, C:\Program Files\ProxyGate\ocx, , [031020f06553a294058788eec041926e],
Adware.OnlineIO, C:\Program Files\Microleaves\Online Application, , [898ae52b3484be781fecaad1c93848b8],
Adware.OnlineIO, C:\Program Files\Microleaves\Online Application\Version 2.6.0, , [898ae52b3484be781fecaad1c93848b8],
Adware.OnlineIO, C:\Program Files\Microleaves, , [898ae52b3484be781fecaad1c93848b8],
PUP.Optional.MirageISO, C:\Users\Public\Documents\XMUpdate, , [b55e23ed467246f062a69f1a00013bc5],
PUP.Optional.Linkury.ACMB1, C:\ProgramData\Quoteex, , [0a09fd13f9bf85b12b40deb0778b07f9],
PUP.Optional.Linkury.ACMB1, C:\ProgramData\Quoteex\ondemand, , [0a09fd13f9bf85b12b40deb0778b07f9],
PUP.Optional.BundleInstaller, C:\Users\Windows 10\AppData\Local\Temp\1046687, , [967d6ea2962236008402538b4bb7d828],
PUP.Optional.BundleInstaller, C:\Users\Windows 10\AppData\Local\Temp\1211453, , [bf545bb5e0d8a88e95f159852ed4dc24],
PUP.Optional.BundleInstaller, C:\Users\Windows 10\AppData\Local\Temp\1274406, , [9281fa16d6e27bbba0e65d811de58d73],
PUP.Optional.BundleInstaller, C:\Users\Windows 10\AppData\Local\Temp\146250, , [848fb858a810a98d1b6b13cb61a12fd1],
PUP.Optional.BundleInstaller, C:\Users\Windows 10\AppData\Local\Temp\2127031, , [37dc818f3e7ad660f195706e1de5db25],
PUP.Optional.BundleInstaller, C:\Users\Windows 10\AppData\Local\Temp\21454781, , [14ff43cda5139e98fa8c14ca56ac32ce],
PUP.Optional.BundleInstaller, C:\Users\Windows 10\AppData\Local\Temp\367500, , [8e856da33385d6602660dfffb64c53ad],
Adware.Tuto4PC, C:\Program Files\Multitimer, , [1bf8ee226f498caa419716d87d85d62a],
PUP.Optional.OnlineIO, C:\Windows\Installer\{5266F634-7B7D-4537-BDDC-98DD6CFCBAA1}, , [0b084fc1388047ef2ba8fe3800000df3],
Adware.OnlineIO, C:\Users\Windows 10\AppData\Roaming\Microleaves, , [45ce0b05378174c2b9b02658b64b4cb4],
Adware.OnlineIO, C:\Users\Windows 10\AppData\Roaming\Microleaves\Online Application 2.7.0, , [45ce0b05378174c2b9b02658b64b4cb4],
Adware.OnlineIO, C:\Users\Windows 10\AppData\Roaming\Microleaves\Online Application 2.7.0\install, , [45ce0b05378174c2b9b02658b64b4cb4],
Adware.OnlineIO, C:\Users\Windows 10\AppData\Roaming\Microleaves\Online Application 2.7.0\install\CFCBAA1, , [45ce0b05378174c2b9b02658b64b4cb4],
Adware.Linkury, C:\ProgramData\Logic Cramble, , [7a991bf5fcbc280ec565771c0bf62dd3],
Adware.Linkury, C:\ProgramData\Logic Cramble\X64, , [7a991bf5fcbc280ec565771c0bf62dd3],
Adware.Linkury, C:\ProgramData\Logic Cramble\X86, , [7a991bf5fcbc280ec565771c0bf62dd3],
Adware.Linkury.TskLnk, C:\Program Files\Common Files\Bamtinzap, , [2ae90c04c7f1191d22bac235c53bdc24],
PUP.Optional.Linkury.Generic, C:\ProgramData\Quoteexs, , [d3400a069b1dfe38ac769e8e2cd5c838],

Files: 165
Adware.IStartSurf, C:\ProgramData\aac55c8cef\c28e8cfab1.exe, , [f51e3bd5c8f02c0ac17dce268a761de3],
Adware.IStartSurf, C:\Users\Windows 10\AppData\Local\Temp\367500\ic-0.3a52101cdac028.exe, , [9c77af619424b0862a145f956f913ec2],
PUP.Optional.GoldClick, C:\Program Files\ProxyGate\Cloud.exe, , [d0432be58f2986b06c055ec902ff3bc5],
PUP.Optional.GoldClick, C:\Program Files\ProxyGate\PGCommon.dll, , [ea29c947d5e377bf7c412dea43be30d0],
PUP.Optional.GoldClick, C:\Program Files\ProxyGate\PGChk.exe, , [2ae99f71a6124cea4a739d7a57aa4ab6],
Adware.IStartSurf, C:\Users\Windows 10\AppData\Local\Temp\1046687\ic-0.72b0862f0c05b4.exe, , [b360a26e883084b2b28c07ed5aa66d93],
Adware.IStartSurf, C:\Users\Windows 10\AppData\Local\Temp\1211453\ic-0.44a889f1d161.exe, , [848f29e7922695a1b688e01403fdca36],
Adware.Wajam.TskLnk, C:\Windows\936c6d6866a3c63fce01b0dac13d7738.dll, , [49ca8c84bff913231c2a838d13ed1be5],
Adware.Linkury, C:\ProgramData\Quoteex\Quoteex.exe, , [898acc444d6b9e9896ad5999e61c7e82],
PUP.Optional.LogicHandler, C:\ProgramData\Logic Cramble\set.exe, , [4ac92ae69a1e8da91395633949b78c74],
Adware.IStartSurf, C:\Users\Windows 10\AppData\Local\Temp\1274406\ic-0.8c463b35df6ee.exe, , [2ae9ca469820ec4a80bec034c23eba46],
Adware.IStartSurf, C:\Users\Windows 10\AppData\Local\Temp\2127031\ic-0.30b54523bd8688.exe, , [bc5743cd7c3cce6819251dd7df21669a],
PUP.Optional.GoldClick, C:\Program Files\ProxyGate\PGNet.exe, , [c54ec9476e4a85b119a4090ef50cdf21],
Adware.Wajam.Generic, C:\Windows\System32\drivers\24ea9943b0503eeecc89c62401b67a23.sys, , [bf5428e818a0c571431aff407a865ca4],
Adware.Tuto4PC, C:\Program Files\Multitimer\Multitimer.exe, , [31e2c34d6157dc5a495f0120d32dc13f],
Adware.Tuto4PC.Generic, C:\Program Files\Fash\3885.exe, , [29eaaa66b701a69026dcd0ab5da4eb15],
PUP.Optional.CouponMarvel, C:\ProgramData\Quoteex\Alphadex.dll, , [6ea59c74a711122461c823ba3dc5fb05],
PUP.Optional.GoldClick, C:\Program Files\ProxyGate\MainService.exe, , [df34759b4870e650e0dd0611ee13a957],
Adware.NeoBar, C:\Program Files\dmpYwNbvAIE\kjg7qrX.dll, , [cf4431df7a3ea98dd4c7237428d9857b],
Adware.Neoreklami, C:\Program Files\dmpYwNbvAIE\GsJvcs.dll, , [cf44e0304672310599aa918936cdbe42],
PUP.Optional.GoldClick, C:\Program Files\ProxyGate\PGHelp.exe, , [51c241cf18a0cf67378616015ba6ca36],
PUP.Optional.GoldClick, C:\Program Files\ProxyGate\PGLog.exe, , [f221f21e9c1c2214972676a19071c739],
PUP.Optional.GoldClick, C:\Program Files\ProxyGate\PGUpd.exe, , [9d764cc4f3c55ed8635aba5d956c11ef],
PUP.Optional.GoldClick, C:\Program Files\ProxyGate\ProxyGate.exe, , [908311ff88306acc7746aa6d4bb69070],
PUP.Optional.GoldClick, C:\Program Files\ProxyGate\Socket.exe, , [35de5fb1c1f759dd4e6f28ef04fdbf41],
PUP.Optional.GoldClick, C:\Program Files\ProxyGate\TrafficMonitor.exe, , [e23121ef0eaa50e64875997e54ad43bd],
Adware.Neoreklami.TskLnk, C:\Program Files\fBAefcjbU\gnshto.dll, , [7d9654bc6256072fb2268e9147ba55ab],
Adware.Neoreklami.TskLnk, C:\Program Files\HroDwsJolcQKhkTVgGR\iEnEJwp.dll, , [13003fd16c4cd3637ef7ccc210f125db],
Adware.Tuto4PC, C:\Users\Windows 10\AppData\Local\Temp\2vpb1eaq0vc.exe, , [51c2bb55c4f4c3737ce9e70aa45eb947],
Adware.IStartSurf, C:\Users\Windows 10\AppData\Local\Temp\146250\ic-0.58970cbde034b4.exe, , [fa19f21e1e9a0d29a19d47ad9868f20e],
Adware.IStartSurf, C:\Users\Windows 10\AppData\Local\Temp\21454781\ic-0.c612704ab6f84.exe, , [858e010f6c4cf640bc82f6feda2604fc],
Adware.Tuto4PC.Generic, C:\Users\Windows 10\AppData\Local\Temp\is-RPRUI.tmp\live.exe, , [f122957bc0f8b87e16ecc0bb768b46ba],
Adware.Linkury, C:\Users\Windows 10\AppData\Local\DonTough.exe, , [f320030d04b459dd61e204ee857d6799],
PUP.Optional.LogicHandler, C:\Users\Windows 10\AppData\Local\Quotein.bin, , [5cb752be397f58dec0e8b5e75ca4bc44],
Adware.Linkury, C:\Users\Windows 10\AppData\Local\San-Zap.exe, , [ae656aa6c8f0f145c97a787a8b7724dc],
PUP.Optional.Linkury, C:\Users\Windows 10\AppData\Local\San-Zap.tst, , [60b30907e2d668ce7590f43b02fe6799],
Adware.Zdengo.Generic, C:\Windows\860ed2512fe683736ddabc7cd324f0b2.exe, , [64aff51b595ff442c49945c83bc80df3],
HackTool.IdleKMS, C:\Windows\SECOH-QAD.exe, , [f51e42ce86320630bf22a0927c8504fc],
RiskWare.Redirector, C:\Users\Windows 10\AppData\Local\GenericTools\GenericTools.exe, , [e3306ea23d7bb1851926e027d52bc937],
RiskWare.Redirector, C:\Users\Windows 10\AppData\Local\GenericTools\libcurl.dll, , [e3306ea23d7bb1851926e027d52bc937],
RiskWare.Redirector, C:\Users\Windows 10\AppData\Local\GenericTools\libeay32.dll, , [e3306ea23d7bb1851926e027d52bc937],
RiskWare.Redirector, C:\Users\Windows 10\AppData\Local\GenericTools\msvcp100.dll, , [e3306ea23d7bb1851926e027d52bc937],
RiskWare.Redirector, C:\Users\Windows 10\AppData\Local\GenericTools\msvcr100.dll, , [e3306ea23d7bb1851926e027d52bc937],
RiskWare.Redirector, C:\Users\Windows 10\AppData\Local\GenericTools\QtCore4.dll, , [e3306ea23d7bb1851926e027d52bc937],
RiskWare.Redirector, C:\Users\Windows 10\AppData\Local\GenericTools\QtGui4.dll, , [e3306ea23d7bb1851926e027d52bc937],
RiskWare.Redirector, C:\Users\Windows 10\AppData\Local\GenericTools\QtNetwork4.dll, , [e3306ea23d7bb1851926e027d52bc937],
RiskWare.Redirector, C:\Users\Windows 10\AppData\Local\GenericTools\QtScript4.dll, , [e3306ea23d7bb1851926e027d52bc937],
RiskWare.Redirector, C:\Users\Windows 10\AppData\Local\GenericTools\ssleay32.dll, , [e3306ea23d7bb1851926e027d52bc937],
PUP.Optional.OnlineIO, C:\Windows\System32\Tasks\Online Application V2G1, , [da39d937a018ae88c55a888712ee41bf],
PUP.Optional.OnlineIO, C:\Windows\System32\Tasks\Online Application V2G2, , [7e95c44cf9bfe650a7785eb1768a26da],
PUP.Optional.OnlineIO, C:\Windows\System32\Tasks\Online Application V2G3, , [4fc4c947a711102657c822ed35cb7d83],
PUP.Optional.OnlineIO, C:\Windows\System32\Tasks\Online Application V2G4, , [0f04848cb602cf674dd2ad629c647f81],
PUP.Optional.OnlineIO, C:\Windows\System32\Tasks\Online Application V2G5, , [b55ef41c991fd95d7ea1e02f42be5fa1],
PUP.Optional.OnlineIO, C:\Windows\System32\Tasks\Online Application V2G6, , [50c3f41c05b3c0760916709f867a59a7],
PUP.Optional.OnlineIO, C:\Windows\Tasks\Updater_Online_Application.job, , [25ee3cd4e0d8191d51901a1c916ff907],
PUP.Optional.OnlineIO, C:\Windows\System32\Tasks\Updater_Online_Application, , [0d06f719595f80b6c81a26108b7555ab],
PUP.Optional.OnlineIO, C:\Windows\Installer\SourceHash{5266F634-7B7D-4537-BDDC-98DD6CFCBAA1}, , [2be810004e6a9a9ceb01e551b34dd12f],
Trojan.Agent, C:\Windows\System32\SSL\xv.db, , [48cbb060e7d1b680e49f092e728edf21],
Trojan.Agent, C:\Windows\System32\SSL\2832fe582f312e7f 2.cer, , [48cbb060e7d1b680e49f092e728edf21],
Trojan.Agent, C:\Windows\System32\SSL\cert.db, , [48cbb060e7d1b680e49f092e728edf21],
PUP.Optional.OnlineIO, C:\Windows\Tasks\Online Application V2G1.job, , [7f94ce42f6c291a5fd29f930639ec63a],
PUP.Optional.OnlineIO, C:\Windows\Tasks\Online Application V2G2.job, , [8093c749efc9c76fca5c60c9c33e04fc],
PUP.Optional.OnlineIO, C:\Windows\Tasks\Online Application V2G3.job, , [ab6816fadcdcd462d155a78248b9867a],
PUP.Optional.OnlineIO, C:\Windows\Tasks\Online Application V2G4.job, , [66adab653484be78879f2bfe9c658878],
PUP.Optional.OnlineIO, C:\Windows\Tasks\Online Application V2G5.job, , [a96ac8484e6a74c2b27482a708f9d62a],
PUP.Optional.OnlineIO, C:\Windows\Tasks\Online Application V2G6.job, , [060d8e828e2a90a6012544e5bb4651af],
Adware.Social2Search.EncJob, C:\Program Files\aabd558f34bc5323d43237eb005c43e9\WBE_uninstall.dat, , [71a207098f29ce682fe15a15827ff30d],
Adware.Social2Search.EncJob, C:\Program Files\aabd558f34bc5323d43237eb005c43e9\25c25e64ac41ef4ebb852201591a491b, , [71a207098f29ce682fe15a15827ff30d],
Adware.Social2Search.EncJob, C:\Program Files\aabd558f34bc5323d43237eb005c43e9\860ed2512fe683736ddabc7cd324f0b2.exe, , [71a207098f29ce682fe15a15827ff30d],
Adware.Social2Search.EncJob, C:\Program Files\aabd558f34bc5323d43237eb005c43e9\cd78e9e6fce75a2f0eb89f77c50f4cf6.ico, , [71a207098f29ce682fe15a15827ff30d],
Adware.Social2Search.EncJob, C:\Program Files\aabd558f34bc5323d43237eb005c43e9\efec0f963f3e59a10e13b0f82d5c4b50.exe, , [71a207098f29ce682fe15a15827ff30d],
Adware.Social2Search.EncJob, C:\Program Files\aabd558f34bc5323d43237eb005c43e9\mozcrt19.dll, , [71a207098f29ce682fe15a15827ff30d],
Adware.Social2Search.EncJob, C:\Program Files\aabd558f34bc5323d43237eb005c43e9\nspr4.dll, , [71a207098f29ce682fe15a15827ff30d],
Adware.Social2Search.EncJob, C:\Program Files\aabd558f34bc5323d43237eb005c43e9\nss3.dll, , [71a207098f29ce682fe15a15827ff30d],
Adware.Social2Search.EncJob, C:\Program Files\aabd558f34bc5323d43237eb005c43e9\plc4.dll, , [71a207098f29ce682fe15a15827ff30d],
Adware.Social2Search.EncJob, C:\Program Files\aabd558f34bc5323d43237eb005c43e9\plds4.dll, , [71a207098f29ce682fe15a15827ff30d],
Adware.Social2Search.EncJob, C:\Program Files\aabd558f34bc5323d43237eb005c43e9\service.dat, , [71a207098f29ce682fe15a15827ff30d],
Adware.Social2Search.EncJob, C:\Program Files\aabd558f34bc5323d43237eb005c43e9\softokn3.dll, , [71a207098f29ce682fe15a15827ff30d],
PUP.Optional.ProxyGate.PrxySvrRST, C:\Program Files\ProxyGate\dns.dat, , [031020f06553a294058788eec041926e],
PUP.Optional.ProxyGate.PrxySvrRST, C:\Program Files\ProxyGate\conf.dat, , [031020f06553a294058788eec041926e],
PUP.Optional.ProxyGate.PrxySvrRST, C:\Program Files\ProxyGate\Config.ini, , [031020f06553a294058788eec041926e],
PUP.Optional.ProxyGate.PrxySvrRST, C:\Program Files\ProxyGate\dbghelp.dll, , [031020f06553a294058788eec041926e],
PUP.Optional.ProxyGate.PrxySvrRST, C:\Program Files\ProxyGate\msvbvm60.dll, , [031020f06553a294058788eec041926e],
PUP.Optional.ProxyGate.PrxySvrRST, C:\Program Files\ProxyGate\newsocket.data, , [031020f06553a294058788eec041926e],
PUP.Optional.ProxyGate.PrxySvrRST, C:\Program Files\ProxyGate\Skin.dll, , [031020f06553a294058788eec041926e],
PUP.Optional.ProxyGate.PrxySvrRST, C:\Program Files\ProxyGate\TrafficMonitor.ini, , [031020f06553a294058788eec041926e],
PUP.Optional.ProxyGate.PrxySvrRST, C:\Program Files\ProxyGate\ocx\mscomctl.ocx, , [031020f06553a294058788eec041926e],
Adware.OnlineIO, C:\Program Files\Microleaves\Online Application\Online Application Updater.exe, , [898ae52b3484be781fecaad1c93848b8],
Adware.OnlineIO, C:\Program Files\Microleaves\Online Application\Online Application Updater.ini, , [898ae52b3484be781fecaad1c93848b8],
Adware.OnlineIO, C:\Program Files\Microleaves\Online Application\Version 2.6.0\Online-Guardian.exe, , [898ae52b3484be781fecaad1c93848b8],
Adware.OnlineIO, C:\Program Files\Microleaves\Online Application\Version 2.6.0\Online.io EULA.url, , [898ae52b3484be781fecaad1c93848b8],
Adware.OnlineIO, C:\Program Files\Microleaves\Online Application\Version 2.6.0\Online.io Privacy.url, , [898ae52b3484be781fecaad1c93848b8],
Adware.OnlineIO, C:\Program Files\Microleaves\Online Application\Version 2.6.0\Uninstall Online Application.lnk, , [898ae52b3484be781fecaad1c93848b8],
Adware.Linkury.Generic, C:\Users\Windows 10\AppData\Local\md.xml, , [aa6909077741d26423d41e6018e93fc1],
Adware.Linkury.Generic, C:\Users\Windows 10\AppData\Local\agent.dat, , [5cb77a9626920a2cb65f85fad031f709],
Adware.Linkury.Generic, C:\Users\Windows 10\AppData\Local\DonTough.tst, , [a172ff11a51360d6bacca7d8e31e58a8],
Adware.Linkury.Generic, C:\Users\Windows 10\AppData\Local\San-Zap.tst, , [5cb79f71892ff93d2f57bec1a160c040],
Adware.Linkury.Generic, C:\Users\Windows 10\AppData\Local\noah.dat, , [ed26957bf2c654e26251344b30d13fc1],
Adware.Linkury.Generic, C:\Users\Windows 10\AppData\Local\uninstall_temp.ico, , [29ead13f3a7ece68f3d7ee91a35ebc44],
PUP.Optional.MirageISO, C:\Users\Public\Documents\XMUpdate\conf.db, , [b55e23ed467246f062a69f1a00013bc5],
Adware.Linkury.Generic, C:\Users\Windows 10\AppData\Local\Main.dat, , [d043848c7e3ab87e494959619968738d],
PUP.Optional.Linkury.ACMB1, C:\Windows\System32\findit.xml, , [16fd32de754360d6a7fe9fec25dd5ca4],
PUP.Optional.Linkury.ACMB1, C:\ProgramData\Quoteex\Bamnix.bin, , [0a09fd13f9bf85b12b40deb0778b07f9],
PUP.Optional.Linkury.ACMB1, C:\ProgramData\Quoteex\Quoteex.dat, , [0a09fd13f9bf85b12b40deb0778b07f9],
PUP.Optional.Linkury.ACMB1, C:\ProgramData\Quoteex\cmmah2zv.xml, , [0a09fd13f9bf85b12b40deb0778b07f9],
PUP.Optional.Linkury.ACMB1, C:\ProgramData\Quoteex\conf.config, , [0a09fd13f9bf85b12b40deb0778b07f9],
PUP.Optional.Linkury.ACMB1, C:\ProgramData\Quoteex\Green-Fax.bin, , [0a09fd13f9bf85b12b40deb0778b07f9],
PUP.Optional.Linkury.ACMB1, C:\ProgramData\Quoteex\Indigotech.dat, , [0a09fd13f9bf85b12b40deb0778b07f9],
PUP.Optional.Linkury.ACMB1, C:\ProgramData\Quoteex\Issing.bin, , [0a09fd13f9bf85b12b40deb0778b07f9],
PUP.Optional.Linkury.ACMB1, C:\ProgramData\Quoteex\md.xml, , [0a09fd13f9bf85b12b40deb0778b07f9],
PUP.Optional.Linkury.ACMB1, C:\ProgramData\Quoteex\Quadlight.bin, , [0a09fd13f9bf85b12b40deb0778b07f9],
PUP.Optional.Linkury.ACMB1, C:\ProgramData\Quoteex\Quocore.bin, , [0a09fd13f9bf85b12b40deb0778b07f9],
PUP.Optional.Linkury.ACMB1, C:\ProgramData\Quoteex\Quoteex.d.dat, , [0a09fd13f9bf85b12b40deb0778b07f9],
PUP.Optional.Linkury.ACMB1, C:\ProgramData\Quoteex\Quoteex.exe, , [0a09fd13f9bf85b12b40deb0778b07f9],
PUP.Optional.Linkury.ACMB1, C:\ProgramData\Quoteex\SanNimtech.exe, , [0a09fd13f9bf85b12b40deb0778b07f9],
PUP.Optional.Linkury.ACMB1, C:\ProgramData\Quoteex\SanNimtech.exe.config, , [0a09fd13f9bf85b12b40deb0778b07f9],
PUP.Optional.Linkury.ACMB1, C:\ProgramData\Quoteex\Techtouch.bin, , [0a09fd13f9bf85b12b40deb0778b07f9],
PUP.Optional.Linkury.ACMB1, C:\ProgramData\Quoteex\Tiptech.bin, , [0a09fd13f9bf85b12b40deb0778b07f9],
PUP.Optional.Linkury.ACMB1, C:\ProgramData\Quoteex\Trancom.dll, , [0a09fd13f9bf85b12b40deb0778b07f9],
PUP.Optional.Linkury.ACMB1, C:\ProgramData\Quoteex\uninstall.dat, , [0a09fd13f9bf85b12b40deb0778b07f9],
PUP.Optional.Linkury.ACMB1, C:\ProgramData\Quoteex\Voltough.exe, , [0a09fd13f9bf85b12b40deb0778b07f9],
PUP.Optional.Linkury.ACMB1, C:\ProgramData\Quoteex\Voltough.exe.config, , [0a09fd13f9bf85b12b40deb0778b07f9],
PUP.Optional.Linkury.ACMB1, C:\ProgramData\Quoteex\VoltTom.dat, , [0a09fd13f9bf85b12b40deb0778b07f9],
PUP.Optional.Linkury.ACMB1, C:\ProgramData\Quoteex\Zertouch.dat, , [0a09fd13f9bf85b12b40deb0778b07f9],
PUP.Optional.BundleInstaller, C:\Users\Windows 10\AppData\Local\Temp\1046687\ic-0.72b0862f0c05b4.exe, , [967d6ea2962236008402538b4bb7d828],
PUP.Optional.BundleInstaller, C:\Users\Windows 10\AppData\Local\Temp\1211453\ic-0.44a889f1d161.exe, , [bf545bb5e0d8a88e95f159852ed4dc24],
PUP.Optional.BundleInstaller, C:\Users\Windows 10\AppData\Local\Temp\1211453\ic-0.af3a51be4ad5c8.exe, , [bf545bb5e0d8a88e95f159852ed4dc24],
PUP.Optional.BundleInstaller, C:\Users\Windows 10\AppData\Local\Temp\1274406\ic-0.8c463b35df6ee.exe, , [9281fa16d6e27bbba0e65d811de58d73],
PUP.Optional.BundleInstaller, C:\Users\Windows 10\AppData\Local\Temp\1274406\ic-0.dc5d0deb4ee98.exe, , [9281fa16d6e27bbba0e65d811de58d73],
PUP.Optional.BundleInstaller, C:\Users\Windows 10\AppData\Local\Temp\1274406\ic-0.ead8536380757.exe, , [9281fa16d6e27bbba0e65d811de58d73],
PUP.Optional.BundleInstaller, C:\Users\Windows 10\AppData\Local\Temp\1274406\kms.exe, , [9281fa16d6e27bbba0e65d811de58d73],
PUP.Optional.BundleInstaller, C:\Users\Windows 10\AppData\Local\Temp\146250\ic-0.58970cbde034b4.exe, , [848fb858a810a98d1b6b13cb61a12fd1],
PUP.Optional.BundleInstaller, C:\Users\Windows 10\AppData\Local\Temp\146250\dlreport, , [848fb858a810a98d1b6b13cb61a12fd1],
PUP.Optional.BundleInstaller, C:\Users\Windows 10\AppData\Local\Temp\2127031\ic-0.30b54523bd8688.exe, , [37dc818f3e7ad660f195706e1de5db25],
PUP.Optional.BundleInstaller, C:\Users\Windows 10\AppData\Local\Temp\2127031\dlreport, , [37dc818f3e7ad660f195706e1de5db25],
PUP.Optional.BundleInstaller, C:\Users\Windows 10\AppData\Local\Temp\2127031\ic-0.ee30e323690d1.exe, , [37dc818f3e7ad660f195706e1de5db25],
PUP.Optional.BundleInstaller, C:\Users\Windows 10\AppData\Local\Temp\21454781\ic-0.c612704ab6f84.exe, , [14ff43cda5139e98fa8c14ca56ac32ce],
PUP.Optional.BundleInstaller, C:\Users\Windows 10\AppData\Local\Temp\367500\ic-0.3a52101cdac028.exe, , [8e856da33385d6602660dfffb64c53ad],
PUP.Optional.BundleInstaller, C:\Users\Windows 10\AppData\Local\Temp\367500\dlreport, , [8e856da33385d6602660dfffb64c53ad],
PUP.Optional.BundleInstaller, C:\Users\Windows 10\AppData\Local\Temp\367500\ic-0.91058d57e638c.exe, , [8e856da33385d6602660dfffb64c53ad],
PUP.Optional.BundleInstaller, C:\Users\Windows 10\AppData\Local\Temp\367500\ic-0.c7aa0d176a7e3.exe, , [8e856da33385d6602660dfffb64c53ad],
Adware.Tuto4PC, C:\Program Files\Multitimer\unins000.dat, , [1bf8ee226f498caa419716d87d85d62a],
Adware.Tuto4PC, C:\Program Files\Multitimer\unins000.exe, , [1bf8ee226f498caa419716d87d85d62a],
Adware.Linkury, C:\ProgramData\Logic Cramble\set.exe, , [9b78d937dfd92e080f7633e73ec308f8],
PUP.Optional.OnlineIO, C:\Windows\Installer\{5266F634-7B7D-4537-BDDC-98DD6CFCBAA1}\online.exe, , [0b084fc1388047ef2ba8fe3800000df3],
PUP.Optional.OnlineIO, C:\Windows\Installer\{5266F634-7B7D-4537-BDDC-98DD6CFCBAA1}\SystemFoldermsiexec.exe, , [0b084fc1388047ef2ba8fe3800000df3],
Adware.OnlineIO, C:\Users\Windows 10\AppData\Roaming\Microleaves\Online Application 2.7.0\install\CFCBAA1\Basic Installer with memory detection.msi, , [45ce0b05378174c2b9b02658b64b4cb4],
Adware.Linkury, C:\ProgramData\Logic Cramble\Config.json, , [7a991bf5fcbc280ec565771c0bf62dd3],
Adware.Linkury, C:\ProgramData\Logic Cramble\set.exe.config, , [7a991bf5fcbc280ec565771c0bf62dd3],
Adware.Linkury, C:\ProgramData\Logic Cramble\System.Data.SQLite.dll, , [7a991bf5fcbc280ec565771c0bf62dd3],
Adware.Linkury, C:\ProgramData\Logic Cramble\System.Data.SQLite.Linq.dll, , [7a991bf5fcbc280ec565771c0bf62dd3],
Adware.Linkury, C:\ProgramData\Logic Cramble\System.Data.SQLite.xml, , [7a991bf5fcbc280ec565771c0bf62dd3],
Adware.Linkury, C:\ProgramData\Logic Cramble\X64\SQLite.Interop.dll, , [7a991bf5fcbc280ec565771c0bf62dd3],
Adware.Linkury, C:\ProgramData\Logic Cramble\X86\SQLite.Interop.dll, , [7a991bf5fcbc280ec565771c0bf62dd3],
Adware.Linkury.TskLnk, C:\Program Files\Common Files\Bamtinzap\InstallationConfiguration.xml, , [2ae90c04c7f1191d22bac235c53bdc24],
Adware.Linkury.TskLnk, C:\Program Files\Common Files\Bamtinzap\uninstall.dat, , [2ae90c04c7f1191d22bac235c53bdc24],
Adware.Linkury.TskLnk, C:\Program Files\Common Files\Bamtinzap\uninstall.exe, , [2ae90c04c7f1191d22bac235c53bdc24],
Adware.Linkury.TskLnk, C:\Program Files\Common Files\Bamtinzap\uninstall.ico, , [2ae90c04c7f1191d22bac235c53bdc24],
PUP.Optional.Linkury.Generic, C:\ProgramData\Quoteexs\ff.HP, , [d3400a069b1dfe38ac769e8e2cd5c838],
PUP.Optional.Linkury.Generic, C:\ProgramData\Quoteexs\ff.NT, , [d3400a069b1dfe38ac769e8e2cd5c838],
PUP.Optional.Linkury.Generic, C:\ProgramData\Quoteexs\snp.sc, , [d3400a069b1dfe38ac769e8e2cd5c838],
Adware.Linkury.Generic, C:\Users\Windows 10\AppData\Local\Config.xml, , [6da6c8487840989ecdbb1c63738e02fe],
Adware.Linkury.TskLnk, C:\Users\Windows 10\AppData\Local\InstallationConfiguration.xml, , [dc371bf5a0186acc4a8d7085728ed52b],
Adware.Linkury.TskLnk, C:\Windows\System32\config\systemprofile\AppData\Local\InstallationConfiguration.xml, , [19fa8f812395e452dbfc37be649c56aa],
Trojan.Agent.Trace, C:\Windows\System32\del.bat, , [f3208888d5e372c40067c96102ff6898],

Physical Sectors: 0
(No malicious items detected)


(end)

after restrt i scanned with adwcleaner

Spoiler: result

# AdwCleaner 7.0.7.0 - Logfile created on Sun Apr 01 11:22:17 2018
# Updated on 2018/18/01 by Malwarebytes
# Database: 2018-03-30.1
# Running on Windows 10 Pro (X86)
# Mode: scan
# Support:

You must be registered for see links

***** [ Services ] *****

No malicious services found.

***** [ Folders ] *****

PUP.Optional.Legacy, C:\Users\Windows 10\AppData\Local\AdvinstAnalytics
PUP.Optional.FastDataX, C:\Users\Windows 10\AppData\Roaming\FastDataX
Adware.NeoBar, C:\Program Files\nzctHtEYomUn
Adware.NeoBar, C:\Program Files\dmpYwNbvAIE
Adware.NeoBar, C:\Program Files\xgpUQycTQqVU2
Adware.NeoBar, C:\Program Files\fBAefcjbU
Adware.NeoBar, C:\Program Files\LhRqTWvAWAkNC
Adware.NeoBar, C:\Program Files\HroDwsJolcQKhkTVgGR
PUP.Optional.SmartBar, C:\Windows\Temp\Smartbar


***** [ Files ] *****

No malicious files found.

***** [ DLL ] *****

No malicious DLLs found.

***** [ WMI ] *****

No malicious WMI found.

***** [ Shortcuts ] *****

No malicious shortcuts found.

***** [ Tasks ] *****

Adware.NeoBar, PpWUtqNAktYcHMPNs2
Adware.NeoBar, XblfzlrMwbeaKro2
Adware.NeoBar, hesymncsXSHUyo
Adware.NeoBar, OXEQaMeQLrItgErZxsR2


***** [ Registry ] *****

Adware.OnlineIO, [Key] - HKLM\SOFTWARE\Microleaves
Adware.DNSUnlocker, [Key] - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\11598763487076930564
PUP.Optional.Microleaves, [Key] - HKU\.DEFAULT\Software\Caphyon\Advanced Updater\{F039D4A9-14D3-4425-A4FA-F2F9D5B0E014}
PUP.Optional.Microleaves, [Key] - HKU\S-1-5-18\Software\Caphyon\Advanced Updater\{F039D4A9-14D3-4425-A4FA-F2F9D5B0E014}
PUP.Optional.Microleaves, [Key] - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\436F6625D7B77354DBCD89DDC6CFAB1A
PUP.Optional.Microleaves, [Key] - HKLM\SOFTWARE\Classes\Installer\Features\436F6625D7B77354DBCD89DDC6CFAB1A
PUP.Optional.Microleaves, [Key] - HKLM\SOFTWARE\Classes\Installer\Products\436F6625D7B77354DBCD89DDC6CFAB1A


***** [ Firefox (and derivatives) ] *****

No malicious Firefox entries.

***** [ Chromium (and derivatives) ] *****

No malicious Chromium entries.

*************************

C:/AdwCleaner/AdwCleaner[S0].txt - [944 B] - [2018/4/1 4:3:23]


########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt ##########

p.s Medicines still didnt work.





now tell me do you think it is still not a pure nasty adware and it is a Medicines?

you guys start to tell things in full confidence without actually trying the program. change this habit.

 

[Uncle Mac]

so this is installed application right? did you know they have add extra in the .exe mean when you install you choose what should installed and why not ..or you just click next next and thats it ? for your google chrome change the main link mean something else installed in your pc using this application..can happend

 

[LoverOfLove]

so this is installed application right? did you know they have add extra in the .exe mean when you install you choose what should installed and why not ..or you just click next next and thats it ?

read again.. i made sure no extra things are selected


and i scanned with malware bytes before this test that everything is clean.

 

[LoverOfLove]

@WhiteDeath why dont you try this on your main rig and post the result... hhh

 

[Uncle Mac]

@WhiteDeath why dont you try this on your main rig and post the result... hhh

i cant run it in my main rig cauze mine have original key lol.if this is true then i will give a warning like i said in chat..

 

[LoverOfLove]

i cant run it in my main rig cauze mine have original key lol.

then try in virtual box

 

[Uncle Mac]

then try in virtual box

that im doing wait

 

[LoverOfLove]

if this is true then i will give a warning like i said in chat..

warning is not enough. this program is a pure adware filled with malwares and nothing else.
if you guys are little bit of serious about this site, you should remove all version of it immediately.

 

[M4Master]

@LoverOfLove kindly upload the zip you have on MEGA or Zippyshare and share the link here....

let me run some tests too

EDIT: are you talking about this one:

You must be registered for see links

 

[Uncle Mac]

warning is not enough. this program is a pure adware filled with malwares and nothing else.
if you guys are little bit of serious about this site, you should remove all version of it immediately.

first of all mine works fine the activation works and is activated..i dont see any news pages or any weird shit in my virtualbox...suggest one application if you looking for more proofs.