Hi, Recently I found a strange ad program on firefox where it would highlight random words and if I mouse over it, it would give me an ad somewhat relating to that word. Anyways, I found the addon called vid-saver and removed it. Since I know I never installed it, I scanned my computer with MBAM and my Kaspersky Internet Security. Kasperksy came up clean but MBAM had some registry keys and PUP's linked to the vid-saver thing. Do you guys know if this is potentially dangerous or should I just delete it and act like nothing ever happened? I put the log down below. Malwarebytes Anti-Malware 1.65.1.1000 www.malwarebytes.org Database version: v2012.11.03.02 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 9.0.8112.16421 Jason :: JASONSBUILD [administrator] 11/2/2012 9:40:05 PM mbam-log-2012-11-03 (08-02-18).txt Scan type: Full scan (C:\|) Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 592370 Time elapsed: 6 hour(s), 46 minute(s), 23 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 12 HKCR\CLSID\{11111111-1111-1111-1111-110011341191} (PUP.GamePlayLab) -> No action taken. HKCR\TypeLib\{44444444-4444-4444-4444-440044344491} (PUP.GamePlayLab) -> No action taken. HKCR\Interface\{55555555-5555-5555-5555-550055345591} (PUP.GamePlayLab) -> No action taken. HKCR\CrossriderApp0003491.BHO.1 (PUP.GamePlayLab) -> No action taken. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11111111-1111-1111-1111-110011341191} (PUP.GamePlayLab) -> No action taken. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{11111111-1111-1111-1111-110011341191} (PUP.GamePlayLab) -> No action taken. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{11111111-1111-1111-1111-110011341191} (PUP.GamePlayLab) -> No action taken. HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{11111111-1111-1111-1111-110011341191} (PUP.GamePlayLab) -> No action taken. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110011341191} (PUP.GamePlayLab) -> No action taken. HKCR\CrossriderApp0003491.BHO (PUP.GamePlayLab) -> No action taken. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Vid-Saver (Adware.GamePlayLabs) -> No action taken. HKCU\SOFTWARE\INSTALLEDBROWSEREXTENSIONS\215 APPS (PUP.CrossFire.SA) -> No action taken. Registry Values Detected: 1 HKCU\Software\InstalledBrowserExtensions\215 Apps|3491 (PUP.CrossFire.SA) -> Data: Vid-Saver -> No action taken. Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 3 C:\Program Files (x86)\Vid-Saver\Vid-Saver.dll (PUP.GamePlayLab) -> No action taken. C:\Program Files (x86)\Vid-Saver\Uninstall.exe (Adware.GamePlayLabs) -> No action taken. C:\Users\Jason\AppData\Local\Temp\setup_vidsaver.exe (PUP.GamePlaysLab) -> No action taken. (end)
