Search the Community

What is Special Search Option?The Malwarebytes research team has determined that Special Search Option is a potentially unwanted prgram (PUP) that behaves like adware and a search hijacker. These adware applications display advertisements not originating from the sites you are browsing.How do I know if my computer is affected by Special Search Option?You may see these warnings during install:this entry in your list of installed Programs and Features:these new browser extensions:and changes to your browsers' settings that vary with the type of browser:How did Special Search Option get on my computer?Browser hijackers use different methods for distributing themselves. This particular one was installed by a bundler.How do I remove Special Search Option?Our program Malwarebytes can detect and remove this potentially unwanted program. Please download Malwarebytes to your desktop. Double-click mb3-setup-consumer-{version}.exe and follow the prompts to install the program. Then click Finish. Once the program has fully updated, select Scan Now on the Dashboard. Or select the Threat Scan from the Scan menu. If another update of the definitions is available, it will be implemented before the rest of the scanning procedure. When the scan is complete, make sure that all Threats are selected, and click Remove Selected. Restart your computer when prompted to do so. Is there anything else I need to do to get rid of Special Search Option? No, Malwarebytes removes Special Search Option completely. How would the full version of Malwarebytes help protect me?We hope our application and this guide have helped you eradicate this hijacker.As you can see below the full version of Malwarebytes would have protected you against the Special Search Option adware. It would have blocked the installer before it became too late. Technical details for expertsPossible signs in FRST logs: () C:\Program Files (x86)\Common Files\ThetaSoftQZO\ThetaSoftQZO.exe HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://us.search.yahoo.com/yhs/web?hspart=omr&hsimp=yhs-001&type=863124029&param1={param1} SearchScopes: HKCU -> DefaultScope {1711FC25-F05A-40CE-B859-A0C1CF01FD18} URL = hxxps://us.search.yahoo.com/yhs/search?hspart=omr&hsimp=yhs-001&type=863124029&param1={param2}&p={searchTerms} SearchScopes: HKCU -> {1711FC25-F05A-40CE-B859-A0C1CF01FD18} URL = hxxps://us.search.yahoo.com/yhs/search?hspart=omr&hsimp=yhs-001&type=863124029&param1={param3}&p={searchTerms} FF Homepage: Mozilla\Firefox\Profiles\{profile}.default -> hxxps://us.search.yahoo.com/yhs/web?hspart=omr&hsimp=yhs-001&type=863124029&param1={param4} FF NewTab: Mozilla\Firefox\Profiles\{profile}.default -> hxxps://us.search.yahoo.com/yhs/web?hspart=omr&hsimp=yhs-001&type=863124029&param1={param5} FF NewTabOverride: Mozilla\Firefox\Profiles\{profile}.default -> Enabled: {1e5e51a8-e7e9-4fe1-a683-462422abe05d} FF SearchPlugin: C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\searchplugins\Yahoo power search.xml [2019-01-10] FF HKCU\...\Firefox\Extensions: [{1e5e51a8-e7e9-4fe1-a683-462422abe05d}] - C:\Users\{username}\AppData\Roaming\Mozilla\FireFox\specialsearchoffer-1.1.1-an+fx.xpi FF Extension: (SpecialSearchOffer) - C:\Users\{username}\AppData\Roaming\Mozilla\FireFox\specialsearchoffer-1.1.1-an+fx.xpi [2019-01-10] CHR HomePage: Default -> homepage.ssoextension.com CHR NewTab: Default -> Active:"chrome-extension://mpicjgpamgcnpiacdciefbgahmkhhogc/ntp.html" CHR DefaultSearchURL: Default -> hxxp://search.ssoextension.com/s?q={searchTerms} CHR DefaultSearchKeyword: Default -> ssoextension.com CHR DefaultSuggestURL: Default -> hxxp://suggest.ssoextension.com/suggest?q={searchTerms} CHR Extension: (SpecialSearchOption) - C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\mpicjgpamgcnpiacdciefbgahmkhhogc [2019-01-10] CHR HKCU\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [mpicjgpamgcnpiacdciefbgahmkhhogc] - hxxps://chrome.google.com/webstore/detail/mpicjgpamgcnpiacdciefbgahmkhhogc R2 ThetaSoftQZO; C:\Program Files (x86)\Common Files\ThetaSoftQZO\ThetaSoftQZO.exe [1253968 2019-01-05] () SSOption (HKLM-x32\...\ThetaSoft) (Version: 2.0.9.1 - ThetaSoft.) Significant changes made by the installer: File system details [View: All details] (Selection) --------------------------------------------------- Adds the folder C:\Program Files (x86)\Common Files\ThetaSoftQZO Adds the file ThetaSoftQZO.exe"="1/5/2019 4:30 PM, 1253968 bytes, A Adds the folder C:\Program Files (x86)\ThetaSoft Adds the file uninstall.exe"="1/10/2019 8:25 AM, 151990 bytes, A Adds the folder C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\mpicjgpamgcnpiacdciefbgahmkhhogc\1.1.0_0 Adds the file analytics.js"="9/14/2018 11:58 AM, 384 bytes, A Adds the file background.html"="9/14/2018 11:59 AM, 295 bytes, A Adds the file background.js"="9/14/2018 12:42 PM, 5076 bytes, A Adds the file manifest.json"="1/10/2019 8:31 AM, 1736 bytes, A Adds the file nanoajax.min.js"="9/14/2018 11:51 AM, 685 bytes, A Adds the file ntp.html"="9/14/2018 11:59 AM, 220 bytes, A Adds the file ntp.js"="9/14/2018 12:42 PM, 226 bytes, A Adds the folder C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\mpicjgpamgcnpiacdciefbgahmkhhogc\1.1.0_0\_metadata Adds the file computed_hashes.json"="1/10/2019 8:31 AM, 709 bytes, A Adds the file verified_contents.json"="9/14/2018 11:54 AM, 2192 bytes, A Adds the folder C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\mpicjgpamgcnpiacdciefbgahmkhhogc\1.1.0_0\images Adds the file icon128.png"="1/10/2019 8:31 AM, 9802 bytes, A Adds the file icon32.png"="1/10/2019 8:31 AM, 1838 bytes, A Adds the folder C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mpicjgpamgcnpiacdciefbgahmkhhogc Adds the file 000003.log"="1/10/2019 8:31 AM, 1777 bytes, A Adds the file CURRENT"="1/10/2019 8:31 AM, 16 bytes, A Adds the file LOCK"="1/10/2019 8:31 AM, 0 bytes, A Adds the file LOG"="1/10/2019 8:31 AM, 184 bytes, A Adds the file MANIFEST-000001"="1/10/2019 8:31 AM, 41 bytes, A In the existing folder C:\Users\{username}\AppData\Roaming\Mozilla\Firefox Adds the file specialsearchoffer-1.1.1-an+fx.xpi"="1/10/2019 8:25 AM, 26292 bytes, A Adds the folder C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\searchplugins Adds the file Yahoo power search.xml"="1/10/2019 8:25 AM, 3668 bytes, A Registry details [View: All details] (Selection) ------------------------------------------------ [HKEY_LOCAL_MACHINE\SOFTWARE\SSO] "tm"="REG_DWORD", 1547105132 [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ThetaSoft] "DisplayName"="REG_SZ", "SSOption" "DisplayVersion"="REG_SZ", "2.0.9.1" "Publisher"="REG_SZ", "ThetaSoft." "UninstallString"="REG_SZ", "C:\Program Files (x86)\ThetaSoft\uninstall.exe" [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\SSO] "c"="REG_SZ", "NL" "ci"="REG_SZ", "863124029" "gid"="REG_SZ", "e1b02140e0ed43bca81de6a62d96ecc6" "Ticket"="REG_SZ", "skBqGwWq/3NXEGniMhJVyTr46X3uSTnG4mA0IxeCiQqaj7qspEGhtqSfbFnevdsmR81ZRwjEde9mnk+eInN1lh9ya6hX7QX89l928Dz0Wa4=" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\ThetaSoftQZO] "Description"="REG_SZ", "ThetaSoftQZO" "DisplayName"="REG_SZ", "ThetaSoftQZO" "ErrorControl"="REG_DWORD", 1 "FailureActions"="REG_BINARY, ............d...d...d. "ImagePath"="REG_EXPAND_SZ, "C:\Program Files (x86)\Common Files\ThetaSoftQZO\ThetaSoftQZO.exe -service" "ObjectName"="REG_SZ", "LocalSystem" "Start"="REG_DWORD", 2 "Type"="REG_DWORD", 16 "WOW64"="REG_DWORD", 1 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\ThetaSoftQZO\Security] "Security"="REG_BINARY, ........0................p...."......................... ................................... [HKEY_CURRENT_USER\Software\Google\Chrome\Extensions\mpicjgpamgcnpiacdciefbgahmkhhogc] "path"="REG_SZ", "https://chrome.google.com/webstore/detail/mpicjgpamgcnpiacdciefbgahmkhhogc" "update_url"="REG_SZ", "http://clients2.google.com/service/update2/crx" [HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings] "mpicjgpamgcnpiacdciefbgahmkhhogc"="REG_SZ", "3E92DC46EC9AD070228AD1019A9CE554C39E42C8ED5158CDB13FCA6A56EDD376" [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main] "Start Page" = REG_SZ, "https://us.search.yahoo.com/yhs/web?hspart=omr&hsimp=yhs-001&type=863124029&param1={param4} [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes] "DefaultScope" = REG_SZ, "{1711FC25-F05A-40CE-B859-A0C1CF01FD18}" [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{1711FC25-F05A-40CE-B859-A0C1CF01FD18}] "DisplayName"="REG_SZ", "Yahoo powered search" "FaviconURL"="REG_SZ", "http://storage.stgbssint.com/Images/Search/searchImages/mag.jpg" "SuggestionsURL_JSON"="REG_SZ", "https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command={searchTerms}" "TopResultURLFallback"="REG_SZ", "https://us.search.yahoo.com/yhs/search?hspart=omr&hsimp=yhs-001&type=863124029&param1={param1}&p={searchTerms}" "URL"="REG_SZ", "https://us.search.yahoo.com/yhs/search?hspart=omr&hsimp=yhs-001&type=863124029&param1={param2}&p={searchTerms}" [HKEY_CURRENT_USER\Software\Mozilla\Firefox\extensions] "{1e5e51a8-e7e9-4fe1-a683-462422abe05d}"="REG_SZ", "C:\Users\{username}\AppData\Roaming\Mozilla\FireFox\specialsearchoffer-1.1.1-an+fx.xpi" Malwarebytes log: Malwarebytes www.malwarebytes.com -Log Details- Scan Date: 1/10/19 Scan Time: 8:40 AM Log File: 0dfa29c4-14ab-11e9-9920-00ffdcc6fdfc.json -Software Information- Version: 3.6.1.2711 Components Version: 1.0.482 Update Package Version: 1.0.8706 License: Premium -System Information- OS: Windows 7 Service Pack 1 CPU: x64 File System: NTFS User: {computername}\{username} -Scan Summary- Scan Type: Threat Scan Scan Initiated By: Manual Result: Completed Objects Scanned: 236174 Threats Detected: 42 Threats Quarantined: 42 Time Elapsed: 2 min, 49 sec -Scan Options- Memory: Enabled Startup: Enabled Filesystem: Enabled Archives: Enabled Rootkits: Enabled Heuristics: Enabled PUP: Detect PUM: Detect -Scan Details- Process: 1 Adware.SpecialSearchOffer.Generic, C:\PROGRAM FILES (X86)\COMMON FILES\THETASOFTQZO\THETASOFTQZO.EXE, Quarantined, [223], [622070],1.0.8706 Module: 1 Adware.SpecialSearchOffer.Generic, C:\PROGRAM FILES (X86)\COMMON FILES\THETASOFTQZO\THETASOFTQZO.EXE, Quarantined, [223], [622070],1.0.8706 Registry Key: 3 PUP.Optional.WinYahoo.Generic, HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{1711FC25-F05A-40CE-B859-A0C1CF01FD18}, Quarantined, [226], [622079],1.0.8706 Adware.SpecialSearchOffer.Generic, HKCU\SOFTWARE\GOOGLE\CHROME\EXTENSIONS\mpicjgpamgcnpiacdciefbgahmkhhogc, Quarantined, [223], [622073],1.0.8706 Adware.SpecialSearchOffer.Generic, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\ThetaSoftQZO, Quarantined, [223], [622070],1.0.8706 Registry Value: 4 Adware.SpecialSearchOffer.Generic, HKCU\SOFTWARE\MOZILLA\FIREFOX\EXTENSIONS|{1E5E51A8-E7E9-4FE1-A683-462422ABE05D}, Quarantined, [223], [622080],1.0.8706 PUP.Optional.WinYahoo.Generic, HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{1711FC25-F05A-40CE-B859-A0C1CF01FD18}|URL, Quarantined, [226], [622079],1.0.8706 PUP.Optional.WinYahoo.Generic, HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{1711FC25-F05A-40CE-B859-A0C1CF01FD18}|TOPRESULTURLFALLBACK, Quarantined, [226], [622079],1.0.8706 Adware.SpecialSearchOffer.Generic, HKCU\SOFTWARE\GOOGLE\CHROME\PREFERENCEMACS\Default\extensions.settings|mpicjgpamgcnpiacdciefbgahmkhhogc, Quarantined, [223], [622073],1.0.8706 Registry Data: 1 PUP.Optional.WinYahoo.Generic, HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|START PAGE, Replaced, [226], [622078],1.0.8706 Data Stream: 0 (No malicious items detected) Folder: 5 Adware.SpecialSearchOffer.Generic, C:\USERS\{username}\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Local Extension Settings\mpicjgpamgcnpiacdciefbgahmkhhogc, Quarantined, [223], [622073],1.0.8706 Adware.SpecialSearchOffer.Generic, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\mpicjgpamgcnpiacdciefbgahmkhhogc\1.1.0_0\_metadata, Quarantined, [223], [622073],1.0.8706 Adware.SpecialSearchOffer.Generic, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\mpicjgpamgcnpiacdciefbgahmkhhogc\1.1.0_0\images, Quarantined, [223], [622073],1.0.8706 Adware.SpecialSearchOffer.Generic, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\mpicjgpamgcnpiacdciefbgahmkhhogc\1.1.0_0, Quarantined, [223], [622073],1.0.8706 Adware.SpecialSearchOffer.Generic, C:\USERS\{username}\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\EXTENSIONS\MPICJGPAMGCNPIACDCIEFBGAHMKHHOGC, Quarantined, [223], [622073],1.0.8706 File: 27 Adware.SpecialSearchOffer.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\specialsearchoffer-1.1.1-an+fx.xpi, Quarantined, [223], [622082],1.0.8706 PUP.Optional.WinYahoo, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\{profile}.default\SEARCHPLUGINS\YAHOO POWER SEARCH.XML, Quarantined, [237], [622083],1.0.8706 PUP.Optional.WinYahoo.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\{profile}.default\PREFS.JS, Replaced, [226], [622076],1.0.8706 PUP.Optional.WinYahoo.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\{profile}.default\PREFS.JS, Replaced, [226], [622077],1.0.8706 Adware.SpecialSearchOffer.Generic, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mpicjgpamgcnpiacdciefbgahmkhhogc\000003.log, Quarantined, [223], [622073],1.0.8706 Adware.SpecialSearchOffer.Generic, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mpicjgpamgcnpiacdciefbgahmkhhogc\CURRENT, Quarantined, [223], [622073],1.0.8706 Adware.SpecialSearchOffer.Generic, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mpicjgpamgcnpiacdciefbgahmkhhogc\LOCK, Quarantined, [223], [622073],1.0.8706 Adware.SpecialSearchOffer.Generic, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mpicjgpamgcnpiacdciefbgahmkhhogc\LOG, Quarantined, [223], [622073],1.0.8706 Adware.SpecialSearchOffer.Generic, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mpicjgpamgcnpiacdciefbgahmkhhogc\MANIFEST-000001, Quarantined, [223], [622073],1.0.8706 Adware.SpecialSearchOffer.Generic, C:\USERS\{username}\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Secure Preferences, Replaced, [223], [622073],1.0.8706 Adware.SpecialSearchOffer.Generic, C:\USERS\{username}\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Preferences, Replaced, [223], [622073],1.0.8706 Adware.SpecialSearchOffer.Generic, C:\USERS\{username}\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\EXTENSIONS\MPICJGPAMGCNPIACDCIEFBGAHMKHHOGC\1.1.0_0\MANIFEST.JSON, Quarantined, [223], [622073],1.0.8706 Adware.SpecialSearchOffer.Generic, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\mpicjgpamgcnpiacdciefbgahmkhhogc\1.1.0_0\images\icon128.png, Quarantined, [223], [622073],1.0.8706 Adware.SpecialSearchOffer.Generic, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\mpicjgpamgcnpiacdciefbgahmkhhogc\1.1.0_0\images\icon32.png, Quarantined, [223], [622073],1.0.8706 Adware.SpecialSearchOffer.Generic, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\mpicjgpamgcnpiacdciefbgahmkhhogc\1.1.0_0\_metadata\computed_hashes.json, Quarantined, [223], [622073],1.0.8706 Adware.SpecialSearchOffer.Generic, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\mpicjgpamgcnpiacdciefbgahmkhhogc\1.1.0_0\_metadata\verified_contents.json, Quarantined, [223], [622073],1.0.8706 Adware.SpecialSearchOffer.Generic, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\mpicjgpamgcnpiacdciefbgahmkhhogc\1.1.0_0\analytics.js, Quarantined, [223], [622073],1.0.8706 Adware.SpecialSearchOffer.Generic, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\mpicjgpamgcnpiacdciefbgahmkhhogc\1.1.0_0\background.html, Quarantined, [223], [622073],1.0.8706 Adware.SpecialSearchOffer.Generic, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\mpicjgpamgcnpiacdciefbgahmkhhogc\1.1.0_0\background.js, Quarantined, [223], [622073],1.0.8706 Adware.SpecialSearchOffer.Generic, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\mpicjgpamgcnpiacdciefbgahmkhhogc\1.1.0_0\nanoajax.min.js, Quarantined, [223], [622073],1.0.8706 Adware.SpecialSearchOffer.Generic, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\mpicjgpamgcnpiacdciefbgahmkhhogc\1.1.0_0\ntp.html, Quarantined, [223], [622073],1.0.8706 Adware.SpecialSearchOffer.Generic, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\mpicjgpamgcnpiacdciefbgahmkhhogc\1.1.0_0\ntp.js, Quarantined, [223], [622073],1.0.8706 Adware.SpecialSearchOffer.Generic, C:\PROGRAM FILES (X86)\COMMON FILES\THETASOFTQZO\THETASOFTQZO.EXE, Quarantined, [223], [622070],1.0.8706 Adware.SpecialSearchOffer.Generic, C:\USERS\{username}\DESKTOP\SPECIALSEARCHOPTION.EXE, Quarantined, [223], [622071],1.0.8706 Generic.Malware/Suspicious, C:\USERS\{username}\DESKTOP\SPECIALSEARCHOPTION.EXE, Quarantined, [0], [392686],1.0.8706 Adware.SearchProvide, C:\USERS\{username}\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Secure Preferences, Replaced, [369], [500746],1.0.8706 Adware.SearchProvide, C:\USERS\{username}\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Secure Preferences, Replaced, [369], [500746],1.0.8706 Physical Sector: 0 (No malicious items detected) WMI: 0 (No malicious items detected) (end) As mentioned before the full version of Malwarebytes could have protected your computer against this threat.We use different ways of protecting your computer(s): Dynamically Blocks Malware Sites & Servers Malware Execution Prevention Save yourself the hassle and get protected.

What is Directions.cn?The Malwarebytes research team has determined that Directions.cn is a browser hijacker. These so-called "hijackers" manipulate your browser(s), for example to change your startpage or searchscopes, so that the affected browser visits their site or one of their choice. This one also displays advertisements.How do I know if my computer is affected by Directions.cn?You may see this entry in your list of installed Chrome extensions:and these warnings during install:You will see this newtab page:and you will see this icon in your Chrome menu-bar:How did Directions.cn get on my computer?Browser hijackers use different methods for distributing themselves. This particular one was downloaded from one of their websites:How do I remove Directions.cn?Our program Malwarebytes can detect and remove this potentially unwanted program. Please download Malwarebytes to your desktop. Double-click mb3-setup-consumer-{version}.exe and follow the prompts to install the program. Then click Finish. Once the program has fully updated, select Scan Now on the Dashboard. Or select the Threat Scan from the Scan menu. If another update of the definitions is available, it will be implemented before the rest of the scanning procedure. When the scan is complete, make sure that all Threats are selected, and click Remove Selected. Restart your computer when prompted to do so. Is there anything else I need to do to get rid of Directions.cn? No, Malwarebytes removes Directions.cn completely. How would the full version of Malwarebytes help protect me?We hope our application and this guide have helped you eradicate this hijacker.As you can see below the full version of Malwarebytes would have protected you against the Directions.cn hijacker. It would have blocked the domain promoting the extension: Technical details for expertsPossible signs in FRST logs: CHR Extension: (Directions.cm) - C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkcjncmijlkmlignahmdgbjldkmfiikg [2018-07-31] Alterations made by the installer: File system details [View: All details] (Selection) --------------------------------------------------- Adds the folder C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkcjncmijlkmlignahmdgbjldkmfiikg\1.0.18.608_0 Adds the file background.js"="6/8/2018 2:04 PM, 9831 bytes, A Adds the file content.js"="2/28/2018 4:46 PM, 239 bytes, A Adds the file manifest.json"="7/31/2018 9:10 AM, 1647 bytes, A Adds the file tyContent.js"="6/8/2018 1:31 PM, 266 bytes, A Adds the folder C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkcjncmijlkmlignahmdgbjldkmfiikg\1.0.18.608_0\_metadata Adds the file computed_hashes.json"="7/31/2018 9:10 AM, 23489 bytes, A Adds the file verified_contents.json"="6/8/2018 1:31 PM, 8403 bytes, A Adds the folder C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkcjncmijlkmlignahmdgbjldkmfiikg\1.0.18.608_0\icons Adds the file 128.png"="7/31/2018 9:10 AM, 6512 bytes, A Adds the file 16.png"="7/31/2018 9:10 AM, 668 bytes, A Adds the file 32.png"="7/31/2018 9:10 AM, 1620 bytes, A Adds the file 48.png"="7/31/2018 9:10 AM, 2259 bytes, A Adds the folder C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkcjncmijlkmlignahmdgbjldkmfiikg\1.0.18.608_0\newtab Adds the file analytics.js"="2/28/2018 4:46 PM, 1679 bytes, A Adds the file autocomplete.js"="2/28/2018 4:46 PM, 1557 bytes, A Adds the file blank.css"="2/28/2018 4:46 PM, 12599 bytes, A Adds the file blank.html"="2/28/2018 4:46 PM, 5437 bytes, A Adds the file blank.js"="5/24/2018 2:46 PM, 3742 bytes, A Adds the folder C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkcjncmijlkmlignahmdgbjldkmfiikg\1.0.18.608_0\newtab\css Adds the file font-awesome.css"="2/28/2018 4:46 PM, 35132 bytes, A Adds the folder C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkcjncmijlkmlignahmdgbjldkmfiikg\1.0.18.608_0\newtab\fonts Adds the file fontawesome-webfont.eot"="1/11/2018 3:36 PM, 76518 bytes, A Adds the file fontawesome-webfont.svg"="2/28/2018 4:46 PM, 391622 bytes, A Adds the file fontawesome-webfont.ttf"="1/11/2018 3:36 PM, 152796 bytes, A Adds the file fontawesome-webfont.woff"="1/11/2018 3:36 PM, 90412 bytes, A Adds the file fontawesome-webfont.woff2"="1/11/2018 3:36 PM, 71896 bytes, A Adds the folder C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkcjncmijlkmlignahmdgbjldkmfiikg\1.0.18.608_0\newtab\images Adds the file c-arrow.png"="1/11/2018 3:36 PM, 26749 bytes, A Adds the file dropbox.png"="1/11/2018 3:36 PM, 2062 bytes, A Adds the file evernote.png"="1/11/2018 3:36 PM, 1783 bytes, A Adds the file facebook.png"="1/11/2018 3:36 PM, 1471 bytes, A Adds the file giki.png"="1/11/2018 3:08 PM, 15969 bytes, A Adds the file google.png"="1/11/2018 3:36 PM, 16122 bytes, A Adds the file instargram.png"="1/11/2018 3:36 PM, 1756 bytes, A Adds the file linkin.png"="1/11/2018 3:36 PM, 1600 bytes, A Adds the file logo.png"="1/11/2018 3:36 PM, 2081 bytes, A Adds the file map-bg.jpg"="1/11/2018 3:36 PM, 84566 bytes, A Adds the file mt_logo.png"="1/11/2018 3:36 PM, 11889 bytes, A Adds the file mt_logo_gray.png"="1/11/2018 3:36 PM, 26977 bytes, A Adds the file pb_yahoo.png"="1/11/2018 3:36 PM, 2955 bytes, A Adds the file pinterest.png"="1/11/2018 3:36 PM, 1909 bytes, A Adds the file tumbler.png"="1/11/2018 3:36 PM, 1526 bytes, A Adds the file twitter.png"="1/11/2018 3:36 PM, 1715 bytes, A Adds the file wiki.png"="1/11/2018 3:36 PM, 1847 bytes, A Adds the file yahoo.png"="1/11/2018 3:36 PM, 1759 bytes, A Adds the file youtube.png"="1/11/2018 3:36 PM, 16338 bytes, A Adds the folder C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkcjncmijlkmlignahmdgbjldkmfiikg\1.0.18.608_0\newtab\jquery Adds the file jquery-3.2.1.min.js"="2/28/2018 4:46 PM, 86659 bytes, A Adds the file jquery-ui.css"="2/28/2018 4:46 PM, 31344 bytes, A Adds the file jquery-ui.js"="2/28/2018 4:46 PM, 365673 bytes, A Adds the folder C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkcjncmijlkmlignahmdgbjldkmfiikg\1.0.18.608_0\newtab\jquery\images Adds the file ui-bg_flat_0_aaaaaa_40x100.png"="11/28/2017 11:28 AM, 180 bytes, A Adds the file ui-bg_flat_75_ffffff_40x100.png"="11/28/2017 11:28 AM, 178 bytes, A Adds the file ui-bg_glass_55_fbf9ee_1x400.png"="11/28/2017 11:28 AM, 120 bytes, A Adds the file ui-bg_glass_65_ffffff_1x400.png"="11/28/2017 11:28 AM, 105 bytes, A Adds the file ui-bg_glass_75_dadada_1x400.png"="11/28/2017 11:28 AM, 111 bytes, A Adds the file ui-bg_glass_75_e6e6e6_1x400.png"="11/28/2017 11:28 AM, 110 bytes, A Adds the file ui-bg_glass_95_fef1ec_1x400.png"="11/28/2017 11:28 AM, 119 bytes, A Adds the file ui-bg_highlight-soft_75_cccccc_1x100.png"="11/28/2017 11:28 AM, 101 bytes, A Adds the file ui-icons_222222_256x240.png"="11/28/2017 11:28 AM, 4369 bytes, A Adds the file ui-icons_2e83ff_256x240.png"="11/28/2017 11:28 AM, 4369 bytes, A Adds the file ui-icons_454545_256x240.png"="11/28/2017 11:28 AM, 4369 bytes, A Adds the file ui-icons_888888_256x240.png"="11/28/2017 11:28 AM, 4369 bytes, A Adds the file ui-icons_cd0a0a_256x240.png"="11/28/2017 11:28 AM, 4369 bytes, A Adds the folder C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bkcjncmijlkmlignahmdgbjldkmfiikg Adds the file 000003.log"="7/31/2018 9:10 AM, 267 bytes, A Adds the file CURRENT"="7/31/2018 9:10 AM, 16 bytes, A Adds the file LOCK"="7/31/2018 9:10 AM, 0 bytes, A Adds the file LOG"="7/31/2018 9:11 AM, 412 bytes, A Adds the file LOG.old"="7/31/2018 9:10 AM, 412 bytes, A Adds the file MANIFEST-000001"="7/31/2018 9:10 AM, 41 bytes, A Registry details [View: All details] (Selection) ------------------------------------------------ [HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings] "bkcjncmijlkmlignahmdgbjldkmfiikg"="REG_SZ", "6B52EC17764C87C96B617B71D9F6367E84198D02DA8E7BA7F4644A009DE6CF5D" Malwarebytes log: Malwarebytes www.malwarebytes.com -Log Details- Scan Date: 7/31/18 Scan Time: 9:15 AM Log File: 86ee1e8e-9491-11e8-9fb3-00ffdcc6fdfc.json Administrator: Yes -Software Information- Version: 3.5.1.2522 Components Version: 1.0.391 Update Package Version: 1.0.6135 License: Premium -System Information- OS: Windows 7 Service Pack 1 CPU: x64 File System: NTFS User: {computername}\{username} -Scan Summary- Scan Type: Threat Scan Scan Initiated By: Manual Result: Completed Objects Scanned: 251706 Threats Detected: 75 Threats Quarantined: 75 Time Elapsed: 3 min, 22 sec -Scan Options- Memory: Enabled Startup: Enabled Filesystem: Enabled Archives: Enabled Rootkits: Enabled Heuristics: Enabled PUP: Detect PUM: Detect -Scan Details- Process: 0 (No malicious items detected) Module: 0 (No malicious items detected) Registry Key: 0 (No malicious items detected) Registry Value: 0 (No malicious items detected) Registry Data: 0 (No malicious items detected) Data Stream: 0 (No malicious items detected) Folder: 11 PUP.Optional.WinYahoo, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkcjncmijlkmlignahmdgbjldkmfiikg\1.0.18.608_0\newtab\jquery\images, Quarantined, [249], [546418],1.0.6135 PUP.Optional.WinYahoo, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkcjncmijlkmlignahmdgbjldkmfiikg\1.0.18.608_0\newtab\images, Quarantined, [249], [546418],1.0.6135 PUP.Optional.WinYahoo, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkcjncmijlkmlignahmdgbjldkmfiikg\1.0.18.608_0\newtab\jquery, Quarantined, [249], [546418],1.0.6135 PUP.Optional.WinYahoo, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkcjncmijlkmlignahmdgbjldkmfiikg\1.0.18.608_0\newtab\fonts, Quarantined, [249], [546418],1.0.6135 PUP.Optional.WinYahoo, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkcjncmijlkmlignahmdgbjldkmfiikg\1.0.18.608_0\newtab\css, Quarantined, [249], [546418],1.0.6135 PUP.Optional.WinYahoo, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkcjncmijlkmlignahmdgbjldkmfiikg\1.0.18.608_0\_metadata, Quarantined, [249], [546418],1.0.6135 PUP.Optional.WinYahoo, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkcjncmijlkmlignahmdgbjldkmfiikg\1.0.18.608_0\newtab, Quarantined, [249], [546418],1.0.6135 PUP.Optional.WinYahoo, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkcjncmijlkmlignahmdgbjldkmfiikg\1.0.18.608_0\icons, Quarantined, [249], [546418],1.0.6135 PUP.Optional.WinYahoo, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkcjncmijlkmlignahmdgbjldkmfiikg\1.0.18.608_0, Quarantined, [249], [546418],1.0.6135 PUP.Optional.WinYahoo, C:\USERS\{username}\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Local Extension Settings\bkcjncmijlkmlignahmdgbjldkmfiikg, Quarantined, [249], [546418],1.0.6135 PUP.Optional.WinYahoo, C:\USERS\{username}\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\EXTENSIONS\bkcjncmijlkmlignahmdgbjldkmfiikg, Quarantined, [249], [546418],1.0.6135 File: 64 PUP.Optional.WinYahoo, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkcjncmijlkmlignahmdgbjldkmfiikg\1.0.18.608_0\icons\128.png, Quarantined, [249], [546418],1.0.6135 PUP.Optional.WinYahoo, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkcjncmijlkmlignahmdgbjldkmfiikg\1.0.18.608_0\icons\16.png, Quarantined, [249], [546418],1.0.6135 PUP.Optional.WinYahoo, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkcjncmijlkmlignahmdgbjldkmfiikg\1.0.18.608_0\icons\32.png, Quarantined, [249], [546418],1.0.6135 PUP.Optional.WinYahoo, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkcjncmijlkmlignahmdgbjldkmfiikg\1.0.18.608_0\icons\48.png, Quarantined, [249], [546418],1.0.6135 PUP.Optional.WinYahoo, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkcjncmijlkmlignahmdgbjldkmfiikg\1.0.18.608_0\newtab\css\font-awesome.css, Quarantined, [249], [546418],1.0.6135 PUP.Optional.WinYahoo, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkcjncmijlkmlignahmdgbjldkmfiikg\1.0.18.608_0\newtab\fonts\fontawesome-webfont.eot, Quarantined, [249], [546418],1.0.6135 PUP.Optional.WinYahoo, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkcjncmijlkmlignahmdgbjldkmfiikg\1.0.18.608_0\newtab\fonts\fontawesome-webfont.svg, Quarantined, [249], [546418],1.0.6135 PUP.Optional.WinYahoo, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkcjncmijlkmlignahmdgbjldkmfiikg\1.0.18.608_0\newtab\fonts\fontawesome-webfont.ttf, Quarantined, [249], [546418],1.0.6135 PUP.Optional.WinYahoo, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkcjncmijlkmlignahmdgbjldkmfiikg\1.0.18.608_0\newtab\fonts\fontawesome-webfont.woff, Quarantined, [249], [546418],1.0.6135 PUP.Optional.WinYahoo, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkcjncmijlkmlignahmdgbjldkmfiikg\1.0.18.608_0\newtab\fonts\fontawesome-webfont.woff2, Quarantined, [249], [546418],1.0.6135 PUP.Optional.WinYahoo, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkcjncmijlkmlignahmdgbjldkmfiikg\1.0.18.608_0\newtab\images\c-arrow.png, Quarantined, [249], [546418],1.0.6135 PUP.Optional.WinYahoo, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkcjncmijlkmlignahmdgbjldkmfiikg\1.0.18.608_0\newtab\images\dropbox.png, Quarantined, [249], [546418],1.0.6135 PUP.Optional.WinYahoo, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkcjncmijlkmlignahmdgbjldkmfiikg\1.0.18.608_0\newtab\images\evernote.png, Quarantined, [249], [546418],1.0.6135 PUP.Optional.WinYahoo, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkcjncmijlkmlignahmdgbjldkmfiikg\1.0.18.608_0\newtab\images\facebook.png, Quarantined, [249], [546418],1.0.6135 PUP.Optional.WinYahoo, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkcjncmijlkmlignahmdgbjldkmfiikg\1.0.18.608_0\newtab\images\giki.png, Quarantined, [249], [546418],1.0.6135 PUP.Optional.WinYahoo, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkcjncmijlkmlignahmdgbjldkmfiikg\1.0.18.608_0\newtab\images\google.png, Quarantined, [249], [546418],1.0.6135 PUP.Optional.WinYahoo, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkcjncmijlkmlignahmdgbjldkmfiikg\1.0.18.608_0\newtab\images\instargram.png, Quarantined, [249], [546418],1.0.6135 PUP.Optional.WinYahoo, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkcjncmijlkmlignahmdgbjldkmfiikg\1.0.18.608_0\newtab\images\linkin.png, Quarantined, [249], [546418],1.0.6135 PUP.Optional.WinYahoo, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkcjncmijlkmlignahmdgbjldkmfiikg\1.0.18.608_0\newtab\images\logo.png, Quarantined, [249], [546418],1.0.6135 PUP.Optional.WinYahoo, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkcjncmijlkmlignahmdgbjldkmfiikg\1.0.18.608_0\newtab\images\map-bg.jpg, Quarantined, [249], [546418],1.0.6135 PUP.Optional.WinYahoo, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkcjncmijlkmlignahmdgbjldkmfiikg\1.0.18.608_0\newtab\images\mt_logo.png, Quarantined, [249], [546418],1.0.6135 PUP.Optional.WinYahoo, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkcjncmijlkmlignahmdgbjldkmfiikg\1.0.18.608_0\newtab\images\mt_logo_gray.png, Quarantined, [249], [546418],1.0.6135 PUP.Optional.WinYahoo, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkcjncmijlkmlignahmdgbjldkmfiikg\1.0.18.608_0\newtab\images\pb_yahoo.png, Quarantined, [249], [546418],1.0.6135 PUP.Optional.WinYahoo, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkcjncmijlkmlignahmdgbjldkmfiikg\1.0.18.608_0\newtab\images\pinterest.png, Quarantined, [249], [546418],1.0.6135 PUP.Optional.WinYahoo, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkcjncmijlkmlignahmdgbjldkmfiikg\1.0.18.608_0\newtab\images\tumbler.png, Quarantined, [249], [546418],1.0.6135 PUP.Optional.WinYahoo, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkcjncmijlkmlignahmdgbjldkmfiikg\1.0.18.608_0\newtab\images\twitter.png, Quarantined, [249], [546418],1.0.6135 PUP.Optional.WinYahoo, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkcjncmijlkmlignahmdgbjldkmfiikg\1.0.18.608_0\newtab\images\wiki.png, Quarantined, [249], [546418],1.0.6135 PUP.Optional.WinYahoo, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkcjncmijlkmlignahmdgbjldkmfiikg\1.0.18.608_0\newtab\images\yahoo.png, Quarantined, [249], [546418],1.0.6135 PUP.Optional.WinYahoo, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkcjncmijlkmlignahmdgbjldkmfiikg\1.0.18.608_0\newtab\images\youtube.png, Quarantined, [249], [546418],1.0.6135 PUP.Optional.WinYahoo, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkcjncmijlkmlignahmdgbjldkmfiikg\1.0.18.608_0\newtab\jquery\images\ui-bg_flat_0_aaaaaa_40x100.png, Quarantined, [249], [546418],1.0.6135 PUP.Optional.WinYahoo, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkcjncmijlkmlignahmdgbjldkmfiikg\1.0.18.608_0\newtab\jquery\images\ui-bg_flat_75_ffffff_40x100.png, Quarantined, [249], [546418],1.0.6135 PUP.Optional.WinYahoo, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkcjncmijlkmlignahmdgbjldkmfiikg\1.0.18.608_0\newtab\jquery\images\ui-bg_glass_55_fbf9ee_1x400.png, Quarantined, [249], [546418],1.0.6135 PUP.Optional.WinYahoo, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkcjncmijlkmlignahmdgbjldkmfiikg\1.0.18.608_0\newtab\jquery\images\ui-bg_glass_65_ffffff_1x400.png, Quarantined, [249], [546418],1.0.6135 PUP.Optional.WinYahoo, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkcjncmijlkmlignahmdgbjldkmfiikg\1.0.18.608_0\newtab\jquery\images\ui-bg_glass_75_dadada_1x400.png, Quarantined, [249], [546418],1.0.6135 PUP.Optional.WinYahoo, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkcjncmijlkmlignahmdgbjldkmfiikg\1.0.18.608_0\newtab\jquery\images\ui-bg_glass_75_e6e6e6_1x400.png, Quarantined, [249], [546418],1.0.6135 PUP.Optional.WinYahoo, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkcjncmijlkmlignahmdgbjldkmfiikg\1.0.18.608_0\newtab\jquery\images\ui-bg_glass_95_fef1ec_1x400.png, Quarantined, [249], [546418],1.0.6135 PUP.Optional.WinYahoo, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkcjncmijlkmlignahmdgbjldkmfiikg\1.0.18.608_0\newtab\jquery\images\ui-bg_highlight-soft_75_cccccc_1x100.png, Quarantined, [249], [546418],1.0.6135 PUP.Optional.WinYahoo, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkcjncmijlkmlignahmdgbjldkmfiikg\1.0.18.608_0\newtab\jquery\images\ui-icons_222222_256x240.png, Quarantined, [249], [546418],1.0.6135 PUP.Optional.WinYahoo, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkcjncmijlkmlignahmdgbjldkmfiikg\1.0.18.608_0\newtab\jquery\images\ui-icons_2e83ff_256x240.png, Quarantined, [249], [546418],1.0.6135 PUP.Optional.WinYahoo, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkcjncmijlkmlignahmdgbjldkmfiikg\1.0.18.608_0\newtab\jquery\images\ui-icons_454545_256x240.png, Quarantined, [249], [546418],1.0.6135 PUP.Optional.WinYahoo, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkcjncmijlkmlignahmdgbjldkmfiikg\1.0.18.608_0\newtab\jquery\images\ui-icons_888888_256x240.png, Quarantined, [249], [546418],1.0.6135 PUP.Optional.WinYahoo, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkcjncmijlkmlignahmdgbjldkmfiikg\1.0.18.608_0\newtab\jquery\images\ui-icons_cd0a0a_256x240.png, Quarantined, [249], [546418],1.0.6135 PUP.Optional.WinYahoo, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkcjncmijlkmlignahmdgbjldkmfiikg\1.0.18.608_0\newtab\jquery\jquery-3.2.1.min.js, Quarantined, [249], [546418],1.0.6135 PUP.Optional.WinYahoo, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkcjncmijlkmlignahmdgbjldkmfiikg\1.0.18.608_0\newtab\jquery\jquery-ui.css, Quarantined, [249], [546418],1.0.6135 PUP.Optional.WinYahoo, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkcjncmijlkmlignahmdgbjldkmfiikg\1.0.18.608_0\newtab\jquery\jquery-ui.js, Quarantined, [249], [546418],1.0.6135 PUP.Optional.WinYahoo, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkcjncmijlkmlignahmdgbjldkmfiikg\1.0.18.608_0\newtab\analytics.js, Quarantined, [249], [546418],1.0.6135 PUP.Optional.WinYahoo, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkcjncmijlkmlignahmdgbjldkmfiikg\1.0.18.608_0\newtab\autocomplete.js, Quarantined, [249], [546418],1.0.6135 PUP.Optional.WinYahoo, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkcjncmijlkmlignahmdgbjldkmfiikg\1.0.18.608_0\newtab\blank.css, Quarantined, [249], [546418],1.0.6135 PUP.Optional.WinYahoo, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkcjncmijlkmlignahmdgbjldkmfiikg\1.0.18.608_0\newtab\blank.html, Quarantined, [249], [546418],1.0.6135 PUP.Optional.WinYahoo, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkcjncmijlkmlignahmdgbjldkmfiikg\1.0.18.608_0\newtab\blank.js, Quarantined, [249], [546418],1.0.6135 PUP.Optional.WinYahoo, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkcjncmijlkmlignahmdgbjldkmfiikg\1.0.18.608_0\_metadata\computed_hashes.json, Quarantined, [249], [546418],1.0.6135 PUP.Optional.WinYahoo, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkcjncmijlkmlignahmdgbjldkmfiikg\1.0.18.608_0\_metadata\verified_contents.json, Quarantined, [249], [546418],1.0.6135 PUP.Optional.WinYahoo, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkcjncmijlkmlignahmdgbjldkmfiikg\1.0.18.608_0\background.js, Quarantined, [249], [546418],1.0.6135 PUP.Optional.WinYahoo, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkcjncmijlkmlignahmdgbjldkmfiikg\1.0.18.608_0\content.js, Quarantined, [249], [546418],1.0.6135 PUP.Optional.WinYahoo, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkcjncmijlkmlignahmdgbjldkmfiikg\1.0.18.608_0\manifest.json, Quarantined, [249], [546418],1.0.6135 PUP.Optional.WinYahoo, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkcjncmijlkmlignahmdgbjldkmfiikg\1.0.18.608_0\tyContent.js, Quarantined, [249], [546418],1.0.6135 PUP.Optional.WinYahoo, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bkcjncmijlkmlignahmdgbjldkmfiikg\000003.log, Quarantined, [249], [546418],1.0.6135 PUP.Optional.WinYahoo, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bkcjncmijlkmlignahmdgbjldkmfiikg\CURRENT, Quarantined, [249], [546418],1.0.6135 PUP.Optional.WinYahoo, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bkcjncmijlkmlignahmdgbjldkmfiikg\LOCK, Quarantined, [249], [546418],1.0.6135 PUP.Optional.WinYahoo, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bkcjncmijlkmlignahmdgbjldkmfiikg\LOG, Quarantined, [249], [546418],1.0.6135 PUP.Optional.WinYahoo, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bkcjncmijlkmlignahmdgbjldkmfiikg\LOG.old, Quarantined, [249], [546418],1.0.6135 PUP.Optional.WinYahoo, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bkcjncmijlkmlignahmdgbjldkmfiikg\MANIFEST-000001, Quarantined, [249], [546418],1.0.6135 PUP.Optional.WinYahoo, C:\USERS\{username}\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Secure Preferences, Replaced, [249], [546418],1.0.6135 PUP.Optional.WinYahoo, C:\USERS\{username}\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Preferences, Replaced, [249], [546418],1.0.6135 Physical Sector: 0 (No malicious items detected) WMI: 0 (No malicious items detected) (end) As mentioned before the full version of Malwarebytes could have protected your computer against this threat.We use different ways of protecting your computer(s): Dynamically Blocks Malware Sites & Servers Malware Execution Prevention Save yourself the hassle and get protected.

What is Search Manager?The Malwarebytes research team has determined that Search Manager is a browser hijacker. These so-called "hijackers" manipulate your browser(s), for example to change your startpage or searchscopes, so that the affected browser visits their site or one of their choice. This one also displays advertisements.How do I know if my computer is affected by Search Manager?You may see these Chrome extensions:these warnings during install:this prompt when you click the icon in the Chrome menu bar:and this changed settings:How did Search Manager get on my computer?Browser hijackers use different methods for distributing themselves. This particular one was installed by a bundler posing as a Flash Player update:How do I remove Search Manager?Our program Malwarebytes can detect and remove this potentially unwanted program. Please download Malwarebytes to your desktop. Double-click mb3-setup-consumer-{version}.exe and follow the prompts to install the program. Then click Finish. Once the program has fully updated, select Scan Now on the Dashboard. Or select the Threat Scan from the Scan menu. If another update of the definitions is available, it will be implemented before the rest of the scanning procedure. When the scan is complete, make sure that all Threats are selected, and click Remove Selected. Restart your computer when prompted to do so. Is there anything else I need to do to get rid of Search Manager? No, Malwarebytes removes Search Manager completely. How would the full version of Malwarebytes help protect me?We hope our application and this guide have helped you eradicate this hijacker.As you can see below the full version of Malwarebytes would have protected you against the Search Manager hijacker by blocking the bundler:Technical details for expertsPossible signs in FRST logs: SearchScopes: HKCU -> {518b33ae-375d-712d-6742-d1fe0400268d} URL = hxxps://us.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=bgy_kpf8ace8acsz_18_30_20&param1=1&param2=f%3D4%26b%3DIE%26cc%3Dus%26pa%3Dwingy%26cd%3D2XzuyEtN2Y1L1QzutDzztDtDtByBtBtAyD0DyByCyBtDyCyCtN0D0Tzu0StBtAzyzytN1L2XzuyEtFtByCtFtDtFzyzztN1L1CzutN1L1G1B1V1N2Y1L1Qzu2SyDtDzzzzzy0A0F0AtGtD0CyB0CtG0F0F0DtCtGtD0AzytCtG0C0FyDzytB0EzytAyByE0CtB2QtN1M1F1B2Z1V1N2Y1L1Qzu2StCtDtCyDzz1RyC1StG1RtAyDzztGyEyCyCzztG1T1RzzyDtGyDyCtBzy1StAtBtDtCyBtAyE2QtN0A0LzutDtN1B2Z1V1T1S1NzutN1Q2Z1B1P1RzutCyDtAtByCzztCyCtCyB%26cr%3D977776022%26a%3Dbgy_kpf8ace8acsz_18_30_20%26os_ver%3D6.1%26os%3DWindows%2B7%2BUltimate&p={searchTerms} FF Homepage: hxxps://us.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=bgy_kpf8ace8acsz_18_30_20&param1=1&param2=f%3D1%26b%3DFirefox%26cc%3Dus%26pa%3Dwingy%26cd%3D2XzuyEtN2Y1L1QzutDzztDtDtByBtBtAyD0DyByCyBtDyCyCtN0D0Tzu0StBtAzyzytN1L2XzuyEtFtByCtFtDtFzyzztN1L1CzutN1L1G1B1V1N2Y1L1Qzu2SyDtDzzzzzy0A0F0AtGtD0CyB0CtG0F0F0DtCtGtD0AzytCtG0C0FyDzytB0EzytAyByE0CtB2QtN1M1F1B2Z1V1N2Y1L1Qzu2StCtDtCyDzz1RyC1StG1RtAyDzztGyEyCyCzztG1T1RzzyDtGyDyCtBzy1StAtBtDtCyBtAyE2QtN0A0LzutDtN1B2Z1V1T1S1NzutN1Q2Z1B1P1RzutCyDtAtByCzztCyCtCyB%26cr%3D977776022%26a%3Dbgy_kpf8ace8acsz_18_30_20%26os_ver%3D6.1%26os%3DWindows%2B7%2BUltimate FF SearchPlugin: C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\60l2dg92.default-1519559592148\searchplugins\yahoo! powered search.xml [2018-07-27] CHR DefaultSearchURL: Default -> hxxp://srchbar.com/?q={searchTerms} CHR DefaultSearchKeyword: Default -> sm CHR DefaultSuggestURL: Default -> hxxp://srch.bar/?s={searchTerms} CHR Extension: (Search Manager) - C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce [2018-07-27] CHR Extension: (Search Manager) - C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej [2018-07-27] Significant chnages made by the installer: File system details [View: All details] (Selection) --------------------------------------------------- In the existing folder C:\Users\{username}\AppData\LocalLow\Microsoft\Internet Explorer\Services Adds the file Yahoo! Powered Search.ico"="7/27/2018 10:53 AM, 5406 bytes, A In the existing folder C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\60l2dg92.default-1519559592148 Alters the file prefs.js 7/6/2018 8:33 AM, 12250 bytes, A ==> 7/27/2018 10:53 AM, 12767 bytes, A Adds the file prefs.js.copy"="7/27/2018 10:53 AM, 12767 bytes, A Adds the folder C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\60l2dg92.default-1519559592148\searchplugins Adds the file yahoo! powered search.xml"="7/27/2018 10:53 AM, 1846 bytes, A Registry details [View: All details] (Selection) ------------------------------------------------ [HKEY_CURRENT_USER\Software\csastats\ic\1633c09e3c4d5d39f62fd6a30e2cbf65c3f2365eebb3092eb7afc008daeffd08] "advertisers_ids"="REG_SZ", "554cb9c7b6" "channel"="REG_SZ", "fa4c6bd7a1041373f7d7e4e48a86d46b2e70b2b807d5b6d5e28969e058476090" "hmac_sha256_validation"="REG_SZ", "5b174f6189ecbaeae8488cde1ff5a0ab575af47fc928ad9439fd8136a4ce3a2a" "install_id"="REG_SZ", "1633c09e3c4d5d39f62fd6a30e2cbf65c3f2365eebb3092eb7afc008daeffd08" "install_time_client"="REG_SZ", "20180727105303076" "install_time_server"="REG_SZ", "20180727035305426" "publisher_id"="REG_SZ", "5bce72fa04" "vendor_id"="REG_SZ", "ic" [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main] "Start Page" ==> REG_SZ, "https://us.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=bgy_kpf8ace8acsz_18_30_20" [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes] "DefaultScope" ==> REG_SZ, "{518b33ae-375d-712d-6742-d1fe0400268d}" [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{518b33ae-375d-712d-6742-d1fe0400268d}] "(Default)"="REG_SZ", "Yahoo! Powered Search" "DisplayName"="REG_SZ", "Yahoo! Powered Search" "FaviconPath"="REG_SZ", "C:\Users\{username}\AppData\LocalLow\Microsoft\Internet Explorer\Services\Yahoo! Powered Search.ico" "URL"="REG_SZ", "https://us.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=bgy_kpf8ace8acsz_18_30_20&p={searchTerms}" [HKEY_CURRENT_USER\Software\ProductSetup\Uninstall\0B2U2Z1P0F1P1G1R1P1V0A1Q1Q0O1G] "uninstall"="REG_SZ", "0B2U2Z1P0F1P1G1R1P0M1F1Q2Y1I1P" [HKEY_CURRENT_USER\Software\ProductSetup\Uninstall\0S1P1T1C1R1MtT0P1C1F2X1L1Q1P1QtT1S2UtT0Y1T1M1F1F] Malwarebytes log: Malwarebytes www.malwarebytes.com -Log Details- Scan Date: 7/27/18 Scan Time: 11:03 AM Log File: ff6a7089-917b-11e8-8b9b-00ffdcc6fdfc.json Administrator: Yes -Software Information- Version: 3.5.1.2522 Components Version: 1.0.374 Update Package Version: 1.0.6089 License: Premium -System Information- OS: Windows 7 Service Pack 1 CPU: x64 File System: NTFS User: {computername}\{username} -Scan Summary- Scan Type: Threat Scan Scan Initiated By: Manual Result: Completed Objects Scanned: 252480 Threats Detected: 391 Threats Quarantined: 391 Time Elapsed: 4 min, 15 sec -Scan Options- Memory: Enabled Startup: Enabled Filesystem: Enabled Archives: Enabled Rootkits: Enabled Heuristics: Enabled PUP: Detect PUM: Detect -Scan Details- Process: 0 (No malicious items detected) Module: 0 (No malicious items detected) Registry Key: 7 PUP.Optional.SearchManager, HKLM\SOFTWARE\GOOGLE\CHROME\EXTENSIONS\nahhmpbckpgdidfnmfkfgiflpjijilce, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, HKLM\SOFTWARE\WOW6432NODE\GOOGLE\CHROME\EXTENSIONS\nahhmpbckpgdidfnmfkfgiflpjijilce, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, HKCU\SOFTWARE\GOOGLE\CHROME\EXTENSIONS\nahhmpbckpgdidfnmfkfgiflpjijilce, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, HKLM\SOFTWARE\WOW6432NODE\GOOGLE\CHROME\EXTENSIONS\PILPLLOABDEDFMIALNFCHJOMJMPJCOEJ, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, HKCU\SOFTWARE\GOOGLE\CHROME\EXTENSIONS\PILPLLOABDEDFMIALNFCHJOMJMPJCOEJ, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, HKLM\SOFTWARE\GOOGLE\CHROME\EXTENSIONS\pilplloabdedfmialnfchjomjmpjcoej, Quarantined, [245], [260991],1.0.6089 PUP.Optional.WinYahoo, HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{518b33ae-375d-712d-6742-d1fe0400268d}, Quarantined, [248], [413444],1.0.6089 Registry Value: 1 PUP.Optional.WinYahoo, HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{518b33ae-375d-712d-6742-d1fe0400268d}|URL, Quarantined, [248], [413444],1.0.6089 Registry Data: 0 (No malicious items detected) Data Stream: 0 (No malicious items detected) Folder: 44 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\sitesThumbnails, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\converter, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\weather, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\films, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\icons, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\tiles, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\maps, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\_locales\pt_BR, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\fonts, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\_locales\en, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\_locales\fr, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\_locales\hi, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\_locales\vi, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\skin\icons, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\_metadata, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\_locales, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\vendor, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\skin, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\USERS\{username}\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\EXTENSIONS\nahhmpbckpgdidfnmfkfgiflpjijilce, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\sitesThumbnails, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\converter, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\weather, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\films, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\icons, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\tiles, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\maps, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\_locales\pt_BR, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\fonts, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\_locales\en, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\_locales\fr, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\_locales\hi, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\_locales\vi, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\skin\icons, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\_metadata, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\_locales, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\vendor, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\skin, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\USERS\{username}\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Extensions\PILPLLOABDEDFMIALNFCHJOMJMPJCOEJ, Quarantined, [245], [260991],1.0.6089 File: 339 PUP.Optional.SearchManager, C:\USERS\{username}\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\LOCAL STORAGE\chrome-extension_pilplloabdedfmialnfchjomjmpjcoej_0.localstorage, Quarantined, [245], [453138],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\fonts\HelveticaNeue-Thin.otf, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\fonts\HelveticaNeueLT-Roman.woff, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\fonts\neue-bold.woff, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\fonts\neue.woff, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\converter\close-FF8A5A.svg, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\converter\collection-9B9B9B.svg, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\converter\collection-FF691E.svg, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\converter\doc-icon-FFFFFF.svg, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\converter\error-FF691E.svg, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\converter\pdf-2-doc-9B9B9B.svg, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\converter\pdf-2-doc-FFFFFF.svg, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\converter\pdf-icon-FFFFFF.svg, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\converter\success-FF8A5A.svg, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\converter\tab-arrow-FF691E.svg, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\converter\upload-FF691E.svg, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\films\amazon-FFFFFF.svg, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\films\amazon.svg, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\films\close.svg, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\films\enlarge-000000-FFFFFF.svg, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\films\enlarge-FFCA00-000000.svg, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\films\hulu-FFFFFF.svg, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\films\hulu.svg, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\films\minimize-000000-FFFFFF.svg, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\films\netflix-FFFFFF.svg, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\films\netflix.svg, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\films\refresh-FFFFFF-000000.svg, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\films\shrink-FFCA00-000000.svg, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\films\shuffle-000000.svg, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\films\shuffle-FFFFFF.svg, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\films\vudu-FFFFFF.svg, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\films\vudu.svg, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\icons\128.png, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\icons\16.png, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\icons\48.png, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\icons\close.png, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\icons\favicon.ico, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\icons\trends.svg, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\maps\bing-maps-FFFFFF.svg, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\maps\from-to-icon-8881FF.svg, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\maps\google-maps-FFFFFF.svg, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\maps\location-icon-8881FF.svg, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\maps\search-4A4A4A.svg, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\maps\search-8881FF.svg, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\maps\switch-8881FF.svg, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\maps\tab-arrow-8881FF.svg, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\maps\whereto-logo-8881FF.svg, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\maps\whereto-logo-FFFFFF.svg, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\sitesThumbnails\facebook_tile_v2.png, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\sitesThumbnails\aliexpress.png, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\sitesThumbnails\aliexpress_tile_v2.png, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\sitesThumbnails\amazon.png, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\sitesThumbnails\amazon_tile_v2.png, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\sitesThumbnails\booking.png, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\sitesThumbnails\booking_tile_v2.png, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\sitesThumbnails\ebay.png, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\sitesThumbnails\ebay_tile_v2.png, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\sitesThumbnails\expedia.png, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\sitesThumbnails\expedia_tile_v2.png, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\sitesThumbnails\facebook.png, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\sitesThumbnails\gmail.png, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\sitesThumbnails\gmail_tile_v2.png, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\sitesThumbnails\google-translate-icon-FFFFFF.svg, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\sitesThumbnails\gtranslte.png, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\sitesThumbnails\pinterest.png, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\sitesThumbnails\pinterest_tile_v2.png, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\sitesThumbnails\twitter.png, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\sitesThumbnails\twitter_tile_v2.png, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\sitesThumbnails\wix.png, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\sitesThumbnails\wix_tile_v2.png, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\sitesThumbnails\yahoo.png, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\sitesThumbnails\yahoo_tile_v2.png, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\sitesThumbnails\youtube.png, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\sitesThumbnails\youtube_tile_v2.png, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\tiles\DOC-to-PDF.jpg, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\tiles\PDF-to-DOC.jpg, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\tiles\Translation.jpg, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\tiles\View-PDF.jpg, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\weather\01d.svg, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\weather\01n.svg, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\weather\02d.svg, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\weather\02n.svg, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\weather\03d.svg, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\weather\03n.svg, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\weather\04d.svg, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\weather\04n.svg, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\weather\09d.svg, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\weather\09n.svg, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\weather\10d.svg, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\weather\10n.svg, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\weather\11d.svg, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\weather\11n.svg, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\weather\13d.svg, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\weather\13n.svg, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\weather\50d.svg, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\weather\50n.svg, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\down.png, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\alot.png, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\angle-arrow-down.png, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\bing.png, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\bing_large.png, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\bluesky-bg.jpg, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\brush.png, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\bt.png, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\clock.png, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\cloud.png, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\cupcake-bg.jpg, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\desk-bg.jpg, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\doodle.png, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\enhanced_google.png, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\eyeglass.png, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\eyeglass_transparent.png, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\films-bg.jpg, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\gmx_large.png, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\google.png, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\google_large.png, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\hero-bg.jpg, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\just-the-box-empty.png, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\just-the-box.png, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\mountain-bg.jpg, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\pointer2.png, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\radio-selected.svg, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\radio-unselected.svg, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\sea-bg.jpg, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\search-D7D7D7.svg, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\search-FFFFFF.svg, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\settings.png, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\smallMagnifier.png, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\star-unselected.svg, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\star.svg, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\todoc.png, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\toggle-off.svg, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\toggle-on.svg, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\topdf.png, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\transparent_img.png, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\yahoo.png, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\yahoo.svg, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\yahoo_large.png, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\yandex.png, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\_enhanced_google.png, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\images\_gmx_large.png, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\content\bundle.v0.0.1.min.css, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\skin\icons\16.png, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\vendor\md5.min.js, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\vendor\react-dom.min.js, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\vendor\react-with-addons.min.js, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\_locales\en\messages.json, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\_locales\fr\messages.json, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\_locales\hi\messages.json, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\_locales\pt_BR\messages.json, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\_locales\vi\messages.json, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\_metadata\computed_hashes.json, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\_metadata\verified_contents.json, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\2bfc185be71f44cd73ac81511fc1f5a5.woff, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\b495e340f4ef8924fea0284c1bf9e7ac.woff, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\background.html, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\background.v0.0.1.min.js, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\c5a5cbf4dbcaa7064f2bc77f52101aec.otf, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\client.v0.0.1.min.js, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\common.js.v0.0.1.min.js, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\e5d3501d500d07b0a1e952b0f8a81d78.woff, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\e_.json, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\index.html, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\manifest.json, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\popupTab2.html, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\popupTab2.js, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce\10.1.3.52_0\responseConfig.json, Quarantined, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\USERS\{username}\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Secure Preferences, Replaced, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\USERS\{username}\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Preferences, Replaced, [245], [443378],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\fonts\HelveticaNeue-Thin.otf, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\fonts\HelveticaNeueLT-Roman.woff, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\fonts\neue-bold.woff, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\fonts\neue.woff, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\converter\close-FF8A5A.svg, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\converter\collection-9B9B9B.svg, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\converter\collection-FF691E.svg, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\converter\doc-icon-FFFFFF.svg, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\converter\error-FF691E.svg, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\converter\pdf-2-doc-9B9B9B.svg, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\converter\pdf-2-doc-FFFFFF.svg, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\converter\pdf-icon-FFFFFF.svg, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\converter\success-FF8A5A.svg, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\converter\tab-arrow-FF691E.svg, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\converter\upload-FF691E.svg, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\films\amazon-FFFFFF.svg, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\films\amazon.svg, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\films\close.svg, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\films\enlarge-000000-FFFFFF.svg, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\films\enlarge-FFCA00-000000.svg, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\films\hulu-FFFFFF.svg, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\films\hulu.svg, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\films\minimize-000000-FFFFFF.svg, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\films\netflix-FFFFFF.svg, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\films\netflix.svg, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\films\refresh-FFFFFF-000000.svg, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\films\shrink-FFCA00-000000.svg, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\films\shuffle-000000.svg, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\films\shuffle-FFFFFF.svg, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\films\vudu-FFFFFF.svg, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\films\vudu.svg, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\icons\128.png, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\icons\16.png, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\icons\48.png, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\icons\close.png, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\icons\favicon.ico, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\icons\trends.svg, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\maps\bing-maps-FFFFFF.svg, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\maps\from-to-icon-8881FF.svg, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\maps\google-maps-FFFFFF.svg, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\maps\location-icon-8881FF.svg, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\maps\search-4A4A4A.svg, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\maps\search-8881FF.svg, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\maps\switch-8881FF.svg, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\maps\tab-arrow-8881FF.svg, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\maps\whereto-logo-8881FF.svg, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\maps\whereto-logo-FFFFFF.svg, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\sitesThumbnails\facebook_tile_v2.png, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\sitesThumbnails\aliexpress.png, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\sitesThumbnails\aliexpress_tile_v2.png, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\sitesThumbnails\amazon.png, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\sitesThumbnails\amazon_tile_v2.png, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\sitesThumbnails\booking.png, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\sitesThumbnails\booking_tile_v2.png, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\sitesThumbnails\ebay.png, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\sitesThumbnails\ebay_tile_v2.png, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\sitesThumbnails\expedia.png, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\sitesThumbnails\expedia_tile_v2.png, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\sitesThumbnails\facebook.png, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\sitesThumbnails\gmail.png, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\sitesThumbnails\gmail_tile_v2.png, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\sitesThumbnails\google-translate-icon-FFFFFF.svg, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\sitesThumbnails\gtranslte.png, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\sitesThumbnails\pinterest.png, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\sitesThumbnails\pinterest_tile_v2.png, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\sitesThumbnails\twitter.png, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\sitesThumbnails\twitter_tile_v2.png, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\sitesThumbnails\wix.png, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\sitesThumbnails\wix_tile_v2.png, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\sitesThumbnails\yahoo.png, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\sitesThumbnails\yahoo_tile_v2.png, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\sitesThumbnails\youtube.png, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\sitesThumbnails\youtube_tile_v2.png, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\tiles\DOC-to-PDF.jpg, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\tiles\PDF-to-DOC.jpg, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\tiles\Translation.jpg, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\tiles\View-PDF.jpg, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\weather\01d.svg, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\weather\01n.svg, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\weather\02d.svg, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\weather\02n.svg, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\weather\03d.svg, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\weather\03n.svg, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\weather\04d.svg, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\weather\04n.svg, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\weather\09d.svg, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\weather\09n.svg, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\weather\10d.svg, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\weather\10n.svg, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\weather\11d.svg, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\weather\11n.svg, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\weather\13d.svg, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\weather\13n.svg, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\weather\50d.svg, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\weather\50n.svg, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\down.png, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\alot.png, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\angle-arrow-down.png, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\bing.png, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\bing_large.png, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\bluesky-bg.jpg, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\brush.png, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\bt.png, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\clock.png, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\cloud.png, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\cupcake-bg.jpg, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\desk-bg.jpg, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\doodle.png, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\enhanced_google.png, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\eyeglass.png, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\eyeglass_transparent.png, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\films-bg.jpg, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\gmx_large.png, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\google.png, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\google_large.png, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\hero-bg.jpg, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\just-the-box-empty.png, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\just-the-box.png, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\mountain-bg.jpg, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\pointer2.png, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\radio-selected.svg, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\radio-unselected.svg, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\sea-bg.jpg, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\search-D7D7D7.svg, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\search-FFFFFF.svg, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\settings.png, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\smallMagnifier.png, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\star-unselected.svg, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\star.svg, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\todoc.png, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\toggle-off.svg, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\toggle-on.svg, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\topdf.png, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\transparent_img.png, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\yahoo.png, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\yahoo.svg, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\yahoo_large.png, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\yandex.png, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\_enhanced_google.png, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\images\_gmx_large.png, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\content\bundle.v0.0.1.min.css, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\skin\icons\16.png, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\vendor\md5.min.js, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\vendor\react-dom.min.js, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\vendor\react-with-addons.min.js, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\_locales\en\messages.json, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\_locales\fr\messages.json, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\_locales\hi\messages.json, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\_locales\pt_BR\messages.json, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\_locales\vi\messages.json, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\_metadata\verified_contents.json, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\2bfc185be71f44cd73ac81511fc1f5a5.woff, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\b495e340f4ef8924fea0284c1bf9e7ac.woff, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\background.html, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\background.v0.0.1.min.js, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\c5a5cbf4dbcaa7064f2bc77f52101aec.otf, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\client.v0.0.1.min.js, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\common.js.v0.0.1.min.js, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\e5d3501d500d07b0a1e952b0f8a81d78.woff, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\e_.json, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\index.html, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\manifest.json, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\popupTab2.html, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\popupTab2.js, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.3.54_0\responseConfig.json, Quarantined, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\USERS\{username}\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Secure Preferences, Replaced, [245], [260991],1.0.6089 PUP.Optional.SearchManager, C:\USERS\{username}\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Preferences, Replaced, [245], [260991],1.0.6089 PUP.Optional.WinYahoo, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\60L2DG92.DEFAULT-1519559592148\PREFS.JS, Replaced, [248], [413431],1.0.6089 PUP.Optional.WinYahoo, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\60L2DG92.DEFAULT-1519559592148\SEARCHPLUGINS\YAHOO! POWERED SEARCH.XML, Quarantined, [248], [413427],1.0.6089 PUP.Optional.InstallCore.Generic, C:\USERS\{username}\DESKTOP\MPP_SETUP_1820095530.EXE, Quarantined, [6192], [511843],1.0.6089 Physical Sector: 0 (No malicious items detected) WMI: 0 (No malicious items detected) (end) As mentioned before the full version of Malwarebytes could have protected your computer against this threat.We use different ways of protecting your computer(s): Dynamically Blocks Malware Sites & Servers Malware Execution Prevention Save yourself the hassle and get protected.

What is System Diagnostics?The Malwarebytes research team has determined that System Diagnostics is a "system optimizer". These so-called "system optimizers" use intentional false positives to convince users that their systems have problems. Then they try to sell you their software, claiming it will remove these problems.More information can be found on our Malwarebytes Labs blog.How do I know if I am infected with System Diagnostics?This is how the main screen of the system optimizer looks:You will find these icons in your taskbar, your startmenu, and on your desktop:and see this warning during install:and these screens during "operations":You may see this entry in your list of installed programs:How did System Diagnostics get on my computer?These so-called system optimizers use different methods of getting installed. This particular one was pushed by fake online scanners.How do I remove System Diagnostics?Our program Malwarebytes can detect and remove this potentially unwanted application. Please download Malwarebytes to your desktop. Double-click mb3-setup-consumer-{version}.exe and follow the prompts to install the program. Then click Finish. Once the program has fully updated, select Scan Now on the Dashboard. Or select the Threat Scan from the Scan menu. If another update of the definitions is available, it will be implemented before the rest of the scanning procedure. When the scan is complete, make sure that all Threats are selected, and click Remove Selected. Restart your computer when prompted to do so. Is there anything else I need to do to get rid of System Diagnostics? No, Malwarebytes removes System Diagnostics completely. The shortcut called System Diagnostics on the desktop can be deleted if it belonged to the system optimizer. How would the full version of Malwarebytes help protect me?We hope our application and this guide have helped you eradicate this system optimizer.As you can see below the full version of Malwarebytes would have protected you against the System Diagnostics installer. It would have warned you before the application could install itself, giving you a chance to stop it before it became too late. and we block access to their domain: Technical details for expertsYou may see these entries in FRST logs: (SystemDiagnostics.com) C:\Program Files (x86)\System Diagnostics\PCDUI.exe C:\Users\Public\Desktop\System Diagnostics.lnk C:\Users\{username}\AppData\Roaming\SystemDiagnostics.com C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Diagnostics C:\Program Files (x86)\System Diagnostics C:\Users\{username}\Desktop\sysdsetupsite.exe System Diagnostics (HKLM-x32\...\75C0CFDE-332C-4C62-9264-418F03AE2CD8_is1) (Version: 1.0.0.0 - pccheckuppro.com) Alterations made by the installer: File system details [View: All details] (Selection) --------------------------------------------------- Adds the folder C:\Program Files (x86)\System Diagnostics Adds the file AMPIEDecoder.dll"="1/28/2016 4:33 PM, 166912 bytes, A Adds the file HtmlRenderer.dll"="5/6/2015 10:38 AM, 221696 bytes, A Adds the file HtmlRenderer.WinForms.dll"="5/6/2015 10:38 AM, 60416 bytes, A Adds the file Interop.IWshRuntimeLibrary.dll"="6/13/2017 8:55 PM, 55528 bytes, A Adds the file Interop.WUApiLib.dll"="2/12/2016 2:18 PM, 86016 bytes, A Adds the file Microsoft.TeamFoundation.Common.dll"="3/14/2013 11:05 PM, 680064 bytes, A Adds the file NAudio.dll"="3/5/2015 6:56 PM, 471040 bytes, A Adds the file Newtonsoft.Json.dll"="9/18/2015 6:21 PM, 465408 bytes, A Adds the file PCDEngine.dll"="6/13/2017 8:49 PM, 674304 bytes, A Adds the file PCDRes.dll"="6/6/2017 12:46 PM, 1848320 bytes, A Adds the file PCDUI.exe"="6/13/2017 8:55 PM, 1219816 bytes, A Adds the file PCDUI.exe.config"="6/6/2017 1:28 PM, 3398 bytes, A Adds the file System.Data.SQLite.DLL"="5/7/2015 4:37 PM, 290816 bytes, A Adds the file System.Data.SQLite.Linq.dll"="5/7/2015 4:37 PM, 196608 bytes, A Adds the file System.Threading.dll"="1/22/2016 9:15 PM, 387408 bytes, A Adds the file TAFactory.IconPack.dll"="7/17/2012 9:33 PM, 36864 bytes, A Adds the file unins000.dat"="5/11/2018 8:15 AM, 77053 bytes, A Adds the file unins000.exe"="5/11/2018 8:15 AM, 1264360 bytes, A Adds the file unins000.msg"="5/11/2018 8:15 AM, 22701 bytes, A Adds the folder C:\Program Files (x86)\System Diagnostics\langs Adds the file english_apc_en.ini"="5/15/2017 5:24 PM, 66374 bytes, A Adds the folder C:\Program Files (x86)\System Diagnostics\x64 Adds the file SQLite.Interop.dll"="5/7/2015 4:37 PM, 1175552 bytes, A Adds the folder C:\Program Files (x86)\System Diagnostics\x86 Adds the file SQLite.Interop.dll"="5/7/2015 4:37 PM, 854528 bytes, A Adds the folder C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Diagnostics Adds the file Buy System Diagnostics.lnk"="5/11/2018 8:15 AM, 1088 bytes, A Adds the file System Diagnostics.lnk"="5/11/2018 8:15 AM, 1076 bytes, A Adds the folder C:\Users\{username}\AppData\Roaming\SystemDiagnostics.com\System Diagnostics Adds the file Errorlog.txt"="5/11/2018 8:16 AM, 418 bytes, A Adds the folder C:\Users\{username}\AppData\Roaming\SystemDiagnostics.com\System Diagnostics\smico In the existing folder C:\Users\Public\Desktop Adds the file System Diagnostics.lnk"="5/11/2018 8:15 AM, 1058 bytes, A Registry details [View: All details] (Selection) ------------------------------------------------ [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\75C0CFDE-332C-4C62-9264-418F03AE2CD8_is1] "DisplayIcon"="REG_SZ", "C:\Program Files (x86)\System Diagnostics\PCDUI.exe" "DisplayName"="REG_SZ", "System Diagnostics" "DisplayVersion"="REG_SZ", "1.0.0.0" "EstimatedSize"="REG_DWORD", 9985 "Inno Setup: App Path"="REG_SZ", "C:\Program Files (x86)\System Diagnostics" "Inno Setup: Icon Group"="REG_SZ", "System Diagnostics" "Inno Setup: Language"="REG_SZ", "en" "Inno Setup: Setup Version"="REG_SZ", "5.5.9 (u)" "Inno Setup: User"="REG_SZ", "{username}" "InstallDate"="REG_SZ", "20180511" "InstallLocation"="REG_SZ", "C:\Program Files (x86)\System Diagnostics\" "MajorVersion"="REG_DWORD", 1 "MinorVersion"="REG_DWORD", 0 "NoModify"="REG_DWORD", 1 "NoRepair"="REG_DWORD", 1 "Publisher"="REG_SZ", "pccheckuppro.com" "QuietUninstallString"="REG_SZ", ""C:\Program Files (x86)\System Diagnostics\unins000.exe" /SILENT" "UninstallString"="REG_SZ", ""C:\Program Files (x86)\System Diagnostics\unins000.exe"" "VersionMajor"="REG_DWORD", 1 "VersionMinor"="REG_DWORD", 0 [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\pcv-vars] "affiliateid"="REG_SZ", "" "country"="REG_SZ", "" "efophone"="REG_SZ", "(855)-392-7237" "LangCode"="REG_SZ", "en" "phone"="REG_SZ", "(877)-883-7061" "pxl"="REG_SZ", "" "showefono"="REG_DWORD", 1 "utm_campaign"="REG_SZ", "sysd" "utm_medium"="REG_SZ", "sysd" "utm_pubid"="REG_SZ", "" "utm_source"="REG_SZ", "sysd" "x-at"="REG_SZ", "" "x-context"="REG_SZ", "" [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\SystemDiagnostics.com\System Diagnostics] "affiliateid"="REG_SZ", "" "affired"="REG_DWORD", 1 "afterInstallUrl"="REG_SZ", "http://www.pccheckuppro.com/apc/afterinstall/?" "cbkpoff"="REG_DWORD", 1 "country"="REG_SZ", "" "cta"="REG_DWORD", 0 "delay"="REG_DWORD", 0 "EmailURL"="REG_SZ", "support@pccheckuppro.com" "expired"="REG_DWORD", 0 "Installstring"="REG_SZ", "C:\Program Files (x86)\System Diagnostics" "isphone"="REG_DWORD", 1 "issilent"="REG_DWORD", 0 "LangCode"="REG_SZ", "en" "lcname"="REG_SZ", "Tech Live Connect" "msl"="REG_DWORD", 1 "ovoffdis"="REG_DWORD", 0 "phone"="REG_SZ", "(877)-883-7061" "Phone_at"="REG_SZ", "(800)-180-0926" "Phone_au"="REG_SZ", "1800-764-389" "Phone_ch"="REG_SZ", "(800)-180-0926" "Phone_de"="REG_SZ", "(800)-180-0926" "Phone_fr"="REG_SZ", "(334)-88627945" "Phone_gb"="REG_SZ", "(800)-404-8430" "Phone_lu"="REG_SZ", "(800)-180-0926" "Phone_uk"="REG_SZ", "(800)-404-8430" "Phone_us"="REG_SZ", "(877)-883-7061" "playsound"="REG_DWORD", 1 "prereg"="REG_DWORD", 0 "PurchaseURL"="REG_SZ", "http://www.pccheckuppro.com/sysd/price.asp?" "pxl"="REG_SZ", "" "reg"="REG_DWORD", 0 "RenewURL"="REG_SZ", "http://www.pccheckuppro.com/sysd/renewal.asp?" "showtn"="REG_DWORD", 0 "supporturl"="REG_SZ", "http://www.pccheckuppro.com/help/" "utm_campaign"="REG_SZ", "sysd" "utm_medium"="REG_SZ", "sysd" "utm_source"="REG_SZ", "sysd" "WebURL"="REG_SZ", "http://www.pccheckuppro.com/" "x-at"="REG_SZ", "" "x-context"="REG_SZ", "" [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\U3lzdGVtRGlhZ25vc3RpY3MuY29t\U3lzdGVtIERpYWdub3N0aWNz\ACT] "data"="REG_BINARY, ..................................................................................................................................................................................................................................................................................................................................... [HKEY_CURRENT_USER\Software\SystemDiagnostics.com\System Diagnostics] "affiliateid"="REG_SZ", "" "Installstring"="REG_SZ", "C:\Program Files (x86)\System Diagnostics" "LangCode"="REG_SZ", "en" "pxl"="REG_SZ", "" "utm_campaign"="REG_SZ", "sysd" "utm_medium"="REG_SZ", "sysd" "utm_pubid"="REG_SZ", "" "utm_source"="REG_SZ", "sysd" "x-at"="REG_SZ", "" "x-context"="REG_SZ", "" [HKEY_CURRENT_USER\Software\SystemDiagnostics.com\System Diagnostics\1.0.0.0] Malwarebytes log: Malwarebytes www.malwarebytes.com -Log Details- Scan Date: 5/11/18 Scan Time: 8:19 AM Log File: 498020c7-54e3-11e8-a1d9-080027235d76.json Administrator: Yes -Software Information- Version: 3.3.1.2183 Components Version: 1.0.262 Update Package Version: 1.0.5066 License: Premium -System Information- OS: Windows 7 Service Pack 1 CPU: x64 File System: NTFS User: {computername}\{username} -Scan Summary- Scan Type: Threat Scan Result: Completed Objects Scanned: 239265 Threats Detected: 37 Threats Quarantined: 37 Time Elapsed: 2 min, 35 sec -Scan Options- Memory: Enabled Startup: Enabled Filesystem: Enabled Archives: Enabled Rootkits: Enabled Heuristics: Enabled PUP: Detect PUM: Detect -Scan Details- Process: 0 (No malicious items detected) Module: 0 (No malicious items detected) Registry Key: 4 PUP.Optional.PCVARK, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\75C0CFDE-332C-4C62-9264-418F03AE2CD8_is1, Quarantined, [401], [520044],1.0.5066 PUP.Optional.PCVARK, HKCU\SOFTWARE\SystemDiagnostics.com, Quarantined, [401], [520053],1.0.5066 PUP.Optional.PCVARK, HKLM\SOFTWARE\WOW6432NODE\SystemDiagnostics.com, Quarantined, [401], [520052],1.0.5066 PUP.Optional.WinYahoo, HKLM\SOFTWARE\WOW6432NODE\PCV-VARS, Quarantined, [246], [254813],1.0.5066 Registry Value: 1 PUP.Optional.WinYahoo, HKLM\SOFTWARE\WOW6432NODE\PCV-VARS|AFFILIATEID, Quarantined, [246], [254813],1.0.5066 Registry Data: 0 (No malicious items detected) Data Stream: 0 (No malicious items detected) Folder: 7 PUP.Optional.PCVARK, C:\Program Files (x86)\System Diagnostics\langs, Quarantined, [401], [520044],1.0.5066 PUP.Optional.PCVARK, C:\Program Files (x86)\System Diagnostics\x64, Quarantined, [401], [520044],1.0.5066 PUP.Optional.PCVARK, C:\Program Files (x86)\System Diagnostics\x86, Quarantined, [401], [520044],1.0.5066 PUP.Optional.PCVARK, C:\PROGRAM FILES (X86)\SYSTEM DIAGNOSTICS, Quarantined, [401], [520044],1.0.5066 PUP.Optional.PCVARK, C:\Users\{username}\AppData\Roaming\SystemDiagnostics.com\System Diagnostics\smico, Quarantined, [401], [520045],1.0.5066 PUP.Optional.PCVARK, C:\Users\{username}\AppData\Roaming\SystemDiagnostics.com\System Diagnostics, Quarantined, [401], [520045],1.0.5066 PUP.Optional.PCVARK, C:\USERS\{username}\APPDATA\ROAMING\SYSTEMDIAGNOSTICS.COM, Quarantined, [401], [520045],1.0.5066 File: 25 PUP.Optional.PCVARK, C:\PROGRAM FILES (X86)\SYSTEM DIAGNOSTICS\UNINS000.DAT, Quarantined, [401], [520044],1.0.5066 PUP.Optional.PCVARK, C:\Program Files (x86)\System Diagnostics\langs\english_apc_en.ini, Quarantined, [401], [520044],1.0.5066 PUP.Optional.PCVARK, C:\Program Files (x86)\System Diagnostics\x64\SQLite.Interop.dll, Quarantined, [401], [520044],1.0.5066 PUP.Optional.PCVARK, C:\Program Files (x86)\System Diagnostics\x86\SQLite.Interop.dll, Quarantined, [401], [520044],1.0.5066 PUP.Optional.PCVARK, C:\Program Files (x86)\System Diagnostics\PCDEngine.dll, Quarantined, [401], [520044],1.0.5066 PUP.Optional.PCVARK, C:\Program Files (x86)\System Diagnostics\AMPIEDecoder.dll, Quarantined, [401], [520044],1.0.5066 PUP.Optional.PCVARK, C:\Program Files (x86)\System Diagnostics\HtmlRenderer.dll, Quarantined, [401], [520044],1.0.5066 PUP.Optional.PCVARK, C:\Program Files (x86)\System Diagnostics\HtmlRenderer.WinForms.dll, Quarantined, [401], [520044],1.0.5066 PUP.Optional.PCVARK, C:\Program Files (x86)\System Diagnostics\Interop.IWshRuntimeLibrary.dll, Quarantined, [401], [520044],1.0.5066 PUP.Optional.PCVARK, C:\Program Files (x86)\System Diagnostics\Interop.WUApiLib.dll, Quarantined, [401], [520044],1.0.5066 PUP.Optional.PCVARK, C:\Program Files (x86)\System Diagnostics\Microsoft.TeamFoundation.Common.dll, Quarantined, [401], [520044],1.0.5066 PUP.Optional.PCVARK, C:\Program Files (x86)\System Diagnostics\NAudio.dll, Quarantined, [401], [520044],1.0.5066 PUP.Optional.PCVARK, C:\Program Files (x86)\System Diagnostics\Newtonsoft.Json.dll, Quarantined, [401], [520044],1.0.5066 PUP.Optional.PCVARK, C:\Program Files (x86)\System Diagnostics\PCDRes.dll, Quarantined, [401], [520044],1.0.5066 PUP.Optional.PCVARK, C:\Program Files (x86)\System Diagnostics\PCDUI.exe, Quarantined, [401], [520044],1.0.5066 PUP.Optional.PCVARK, C:\Program Files (x86)\System Diagnostics\PCDUI.exe.config, Quarantined, [401], [520044],1.0.5066 PUP.Optional.PCVARK, C:\Program Files (x86)\System Diagnostics\System.Data.SQLite.DLL, Quarantined, [401], [520044],1.0.5066 PUP.Optional.PCVARK, C:\Program Files (x86)\System Diagnostics\System.Data.SQLite.Linq.dll, Quarantined, [401], [520044],1.0.5066 PUP.Optional.PCVARK, C:\Program Files (x86)\System Diagnostics\System.Threading.dll, Quarantined, [401], [520044],1.0.5066 PUP.Optional.PCVARK, C:\Program Files (x86)\System Diagnostics\TAFactory.IconPack.dll, Quarantined, [401], [520044],1.0.5066 PUP.Optional.PCVARK, C:\Program Files (x86)\System Diagnostics\unins000.exe, Quarantined, [401], [520044],1.0.5066 PUP.Optional.PCVARK, C:\Program Files (x86)\System Diagnostics\unins000.msg, Quarantined, [401], [520044],1.0.5066 PUP.Optional.PCVARK, C:\Users\{username}\AppData\Roaming\SystemDiagnostics.com\System Diagnostics\Errorlog.txt, Quarantined, [401], [520045],1.0.5066 PUP.Optional.PCVARK, C:\USERS\{username}\DESKTOP\SYSDSETUPSITE.EXE, Quarantined, [401], [516157],1.0.5066 PUP.Optional.PCVARK, C:\USERS\{username}\DOWNLOADS\UNCONFIRMED 397119.CRDOWNLOAD, Quarantined, [401], [516157],1.0.5066 Physical Sector: 0 (No malicious items detected) (end) As mentioned before the full version of Malwarebytes could have protected your computer against this threat.We use different ways of protecting your computer(s): Dynamically Blocks Malware Sites & Servers Malware Execution Prevention Save yourself the hassle and get protected.

Every morning I open my computer to the MB scan showing it quarantined pup.optional.winyahoo . Nothing I do will get rid of it. I have run FRST and have attached the results in two files along with the MB scan Please help, thanks. Addition.txt FRST.txt MB scan.txt

What is Nix Player? The Malwarebytes research team has determined that Nix Player is a bundler. This so-called bundler installed a browser hijacker. Hijackers manipulate your browser(s), for example to change your startpage or searchscopes, so that the affected browser visits their site or one of their choice. How do I know if my computer is affected by Nix Player? You may see this entry in your list of installed software: and these warnings during install: this browser extension: these changed settings: and you will see these icons in your startmenu and on your desktop: This is the mains screen of the program: How did Nix Player get on my computer? Bundlers use different methods for distributing themselves. This particular one was offered as a "necessary" media player. How do I remove Nix Player? Our program Malwarebytes can detect and remove this potentially unwanted program. Please download Malwarebytes to your desktop. Double-click mb3-setup-consumer-{version}.exe and follow the prompts to install the program. Then click Finish. Once the program has fully updated, select Scan Now on the Dashboard. Or select the Threat Scan from the Scan menu. If another update of the definitions is available, it will be implemented before the rest of the scanning procedure. When the scan is complete, make sure that all Threats are selected, and click Remove Selected. Restart your computer when prompted to do so. Is there anything else I need to do to get rid of Nix Player? No, Malwarebytes removes Nix Player completely. The shortcut called Nix Player on the desktop can be deleted if it belonged to the potentially unwanted program. How would the full version of Malwarebytes help protect me? We hope our application and this guide have helped you eradicate this hijacker. As you can see below the full version of Malwarebytes would have protected you against the Nix Player hijacker. It would have warned you before the application could install itself, giving you a chance to stop it before it became too late. and we would have blocked the download of the installer: Technical details for experts Possible signs in FRST logs: FF NewTab: about:newtab FF DefaultSearchEngine: Yahoo! Powered Search FF SelectedSearchEngine: Yahoo! Powered Search FF Homepage: hxxps://{cc}.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=bgy_bboi_17_48_ssg01&param1=1&param2={Firefox} FF Keyword.URL: user_pref("keyword.URL", true); FF SearchPlugin: C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\searchplugins\yahoo! powered search.xml [2017-11-30] FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}.xpi [2017-11-30] [not signed] CHR DefaultSearchURL: Default -> hxxp://srchbar.com/?q={searchTerms} CHR DefaultSuggestURL: Default -> hxxp://srch.bar/?s={searchTerms} CHR Extension: (Search Manager) - C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej [2017-11-30] CHR HKLM\...\Chrome\Extension: [pilplloabdedfmialnfchjomjmpjcoej] - hxxps://clients2.google.com/service/update2/crx CHR HKCU\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [pilplloabdedfmialnfchjomjmpjcoej] - hxxps://clients2.google.com/service/update2/crx CHR HKLM-x32\...\Chrome\Extension: [pilplloabdedfmialnfchjomjmpjcoej] - hxxps://clients2.google.com/service/update2/crx C:\Users\{username}\Desktop\Nix Player.lnk C:\Users\{username}\AppData\Roaming\Nix Player C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Nix Player (Nix Player ) C:\Users\{username}\Downloads\Nix_Player [1].exe Nix Player (HKCU\...\{EBD7166E-C6A6-4b68-80CA-CA08108C76EE} Nix Player_is1) (Version: 1.0.0.0 - Nix Player) Significant alterations made by the installer: File system details [View: All details] (Selection) --------------------------------------------------- Adds the folder C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0 Adds the file 2bfc185be71f44cd73ac81511fc1f5a5.woff"="11/27/2017 11:30 AM, 48112 bytes, A Adds the file b495e340f4ef8924fea0284c1bf9e7ac.woff"="11/27/2017 11:30 AM, 14492 bytes, A Adds the file background.html"="11/27/2017 11:30 AM, 534 bytes, A Adds the file background.v0.0.1.min.js"="11/27/2017 11:30 AM, 3383 bytes, A Adds the file c5a5cbf4dbcaa7064f2bc77f52101aec.otf"="11/27/2017 11:30 AM, 24888 bytes, A Adds the file client.v0.0.1.min.js"="11/27/2017 11:30 AM, 324009 bytes, A Adds the file common.js"="11/27/2017 11:30 AM, 392960 bytes, A Adds the file e_.json"="11/27/2017 11:30 AM, 110 bytes, A Adds the file e5d3501d500d07b0a1e952b0f8a81d78.woff"="11/27/2017 11:30 AM, 16320 bytes, A Adds the file index.html"="11/27/2017 11:30 AM, 1397 bytes, A Adds the file manifest.json"="11/30/2017 10:29 AM, 2232 bytes, A Adds the file popupTab2.html"="11/27/2017 11:30 AM, 3424 bytes, A Adds the file popupTab2.js"="11/27/2017 11:30 AM, 7635 bytes, A Adds the file responseConfig.json"="11/27/2017 11:30 AM, 149704 bytes, A Adds the folder C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\_locales Adds the folder C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\_metadata Adds the file verified_contents.json"="11/27/2017 11:30 AM, 15997 bytes, A Adds the folder C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content Adds the file bundle.v0.0.1.min.css"="11/27/2017 11:30 AM, 4169 bytes, A Adds the folder C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\fonts Adds the file HelveticaNeueLT-Roman.woff"="11/27/2017 11:30 AM, 16320 bytes, A Adds the file HelveticaNeue-Thin.otf"="11/27/2017 11:30 AM, 24888 bytes, A Adds the file neue.woff"="11/27/2017 11:30 AM, 14492 bytes, A Adds the file neue-bold.woff"="11/27/2017 11:30 AM, 48112 bytes, A Adds the folder C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images Adds the folder C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\skin\icons Adds the file 16.png"="11/27/2017 11:30 AM, 615 bytes, A Adds the folder C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\vendor Adds the file md5.min.js"="11/27/2017 11:30 AM, 8209 bytes, A Adds the file react-dom.min.js"="11/27/2017 11:30 AM, 709 bytes, A Adds the file react-with-addons.min.js"="11/27/2017 11:30 AM, 160185 bytes, A Adds the file underscore-min.js"="11/27/2017 11:30 AM, 16449 bytes, A In the existing folder C:\Users\{username}\AppData\LocalLow\Microsoft\Internet Explorer\Services Adds the file searchy.ico"="11/30/2017 10:28 AM, 5430 bytes, A Adds the folder C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Nix Player Adds the file Nix Player.lnk"="11/30/2017 10:30 AM, 1873 bytes, A Adds the folder C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\searchplugins Adds the file yahoo! powered search.xml"="11/30/2017 10:28 AM, 1595 bytes, A Adds the folder C:\Users\{username}\AppData\Roaming\Nix Player Adds the file FlvPlayer.Core.dll"="11/22/2017 7:10 PM, 44544 bytes, A Adds the file FlvPlayer.Wpf.dll"="11/22/2017 7:10 PM, 35840 bytes, A Adds the file Nix Player.exe"="11/22/2017 7:10 PM, 140288 bytes, A Adds the file unins000.dat"="11/30/2017 10:30 AM, 24107 bytes, A Adds the file unins000.exe"="11/30/2017 10:29 AM, 742053 bytes, A Adds the file Vlc.DotNet.Core.Interops.dll"="11/20/2017 6:34 PM, 94208 bytes, A Adds the folder C:\Users\{username}\AppData\Roaming\Nix Player\Libraries Adds the file axvlc.dll"="6/4/2017 4:41 PM, 416256 bytes, A Adds the file axvlc.dll.manifest"="6/4/2017 4:41 PM, 304 bytes, A Adds the file libvlc.dll"="6/4/2017 4:41 PM, 111104 bytes, A Adds the file libvlccore.dll"="6/4/2017 4:41 PM, 2285056 bytes, A Adds the file npvlc.dll"="6/4/2017 4:41 PM, 305152 bytes, A Adds the file npvlc.dll.manifest"="6/4/2017 4:41 PM, 304 bytes, A Adds the folder C:\Users\{username}\AppData\Roaming\Nix Player\Libraries\plugins Adds the file plugins.dat"="11/30/2017 10:32 AM, 41062 bytes, A Adds the folder C:\Users\{username}\AppData\Roaming\Nix Player\Libraries\plugins\access Adds the file libfilesystem_plugin.dll"="6/4/2017 4:41 PM, 43520 bytes, A Adds the folder C:\Users\{username}\AppData\Roaming\Nix Player\Libraries\plugins\access_output Adds the file libaccess_output_file_plugin.dll"="6/4/2017 4:41 PM, 35840 bytes, A Adds the folder C:\Users\{username}\AppData\Roaming\Nix Player\Libraries\plugins\audio_filter Adds the file liba52tofloat32_plugin.dll"="6/4/2017 4:41 PM, 69120 bytes, A Adds the file liba52tospdif_plugin.dll"="6/4/2017 4:41 PM, 34816 bytes, A Adds the file libaudio_format_plugin.dll"="6/4/2017 4:41 PM, 45568 bytes, A Adds the file libaudiobargraph_a_plugin.dll"="6/4/2017 4:41 PM, 41472 bytes, A Adds the file libchorus_flanger_plugin.dll"="6/4/2017 4:41 PM, 39424 bytes, A Adds the file libcompressor_plugin.dll"="6/4/2017 4:41 PM, 42496 bytes, A Adds the file libconverter_fixed_plugin.dll"="6/4/2017 4:41 PM, 36864 bytes, A Adds the file libdolby_surround_decoder_plugin.dll"="6/4/2017 4:41 PM, 36352 bytes, A Adds the file libdtstofloat32_plugin.dll"="6/4/2017 4:41 PM, 182272 bytes, A Adds the file libdtstospdif_plugin.dll"="6/4/2017 4:41 PM, 36864 bytes, A Adds the file libequalizer_plugin.dll"="6/4/2017 4:41 PM, 46592 bytes, A Adds the file libheadphone_channel_mixer_plugin.dll"="6/4/2017 4:41 PM, 41472 bytes, A Adds the file libkaraoke_plugin.dll"="6/4/2017 4:41 PM, 34304 bytes, A Adds the file libmono_plugin.dll"="6/4/2017 4:41 PM, 42496 bytes, A Adds the file libmpgatofixed32_plugin.dll"="6/4/2017 4:41 PM, 135168 bytes, A Adds the file libnormvol_plugin.dll"="6/4/2017 4:41 PM, 37376 bytes, A Adds the file libparam_eq_plugin.dll"="6/4/2017 4:41 PM, 38912 bytes, A Adds the file libsamplerate_plugin.dll"="6/4/2017 4:41 PM, 1518080 bytes, A Adds the file libscaletempo_plugin.dll"="6/4/2017 4:41 PM, 40960 bytes, A Adds the file libsimple_channel_mixer_plugin.dll"="6/4/2017 4:41 PM, 38400 bytes, A Adds the file libspatializer_plugin.dll"="6/4/2017 4:41 PM, 107520 bytes, A Adds the file libspeex_resampler_plugin.dll"="6/4/2017 4:41 PM, 46592 bytes, A Adds the file libtrivial_channel_mixer_plugin.dll"="6/4/2017 4:41 PM, 36352 bytes, A Adds the file libugly_resampler_plugin.dll"="6/4/2017 4:41 PM, 35328 bytes, A Adds the folder C:\Users\{username}\AppData\Roaming\Nix Player\Libraries\plugins\audio_mixer Adds the file libfixed32_mixer_plugin.dll"="6/4/2017 4:41 PM, 34816 bytes, A Adds the file libfloat32_mixer_plugin.dll"="6/4/2017 4:41 PM, 33792 bytes, A Adds the folder C:\Users\{username}\AppData\Roaming\Nix Player\Libraries\plugins\audio_output Adds the file libaout_directx_plugin.dll"="6/4/2017 4:41 PM, 49664 bytes, A Adds the file libwaveout_plugin.dll"="6/4/2017 4:41 PM, 51200 bytes, A Adds the folder C:\Users\{username}\AppData\Roaming\Nix Player\Libraries\plugins\codec Adds the file libavcodec_plugin.dll"="6/4/2017 4:41 PM, 9532416 bytes, A Adds the folder C:\Users\{username}\AppData\Roaming\Nix Player\Libraries\plugins\video_filter Adds the file libswscale_plugin.dll"="6/4/2017 4:41 PM, 370688 bytes, A Adds the folder C:\Users\{username}\AppData\Roaming\Nix Player\Libraries\plugins\video_output Adds the file libvmem_plugin.dll"="6/4/2017 4:41 PM, 38912 bytes, A In the existing folder C:\Users\{username}\Desktop Adds the file Nix Player.lnk"="11/30/2017 10:30 AM, 1881 bytes, A Registry details [View: All details] (Selection) ------------------------------------------------ [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{82D7B48B-A67F-D833-CBE7-FDDBEF8F0143}] "aflt"="REG_SZ", "bgy_bboi_17_48_ssg01" "c_ver"="REG_SZ", "3.26.2.59" "cd"="REG_SZ", "2XzuyEtN2Y1L1QzutDzztDtDtByByByDtDtBzyyByBtDyCyCtN0D0Tzu0StBtCyCtDtN1L2XzutAtFtByCtFtBtFyDzytN1L1Czu1StN1L1G1B1V1N2Y1L1Qzu2SyB0AtByBtD0B0EyEtGyDyByDyBtGtA0B0FtBtGtCtCyE0DtGtB0E0E0FtC0AtAyD0A0A0BtD2QtN1M1F1B2Z1V1N2Y1L1Qzu2SzyyCtBtAzyzztByEtGtDyB0C0FtGyE0ByCyCtG0AzztB0AtGtB0EtA0Ezz0Fzz0AyEtC0DtB2QtN0A0LzutD" "cr"="REG_SZ", "1761208239" "DT"="REG_SZ", "S2160" "insDate"="REG_SZ", "20171130102837668" "instlRef"="REG_SZ", "b" "st_ver"="REG_SZ", "3.6.0.0" [HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions\pilplloabdedfmialnfchjomjmpjcoej] "install_parameter"="REG_SZ", "ew0KCSJhZmx0IjogImJneV9iYm9pXzE3XzQ4X3NzZzAxIiwKCSJjciI6IjE3NjEyMDgyMzkiLAoJImNkIjoiMlh6dXlFdE4yWTFMMVF6dXREenp0RHREdEJ5QnlCeUR0RHRCenl5QnlCdER5Q3lDdE4wRDBUenUwU3RCdEN5Q3REdE4xTDJYenV0QXRGdEJ5Q3RGdEJ0RnlEenl0TjFMMUN6dTFTdE4xTDFHMUIxVjFOMlkxTDFRenUyU3lCMEF0QnlCdEQwQjBFeUV0R3lEeUJ5RHlCdEd0QTBCMEZ0QnRHdEN0Q3lFMER0R3RCMEUwRTBGdEMwQXRBeUQwQTBBMEJ0RDJRdE4xTTFGMUIyWjFWMU4yWTFMMVF6dTJTenl5Q3RCdEF6eXp6dEJ5RXRHdER5QjBDMEZ0R3lFMEJ5Q3lDdEcwQXp6dEIwQXRHdEIwRXRBMEV6ejBGenowQXlFdEMwRHRCMlF0TjBBMEx6dXREIiwKCSJ5Y2MiOiJubCIsCgkicGFyYW0yIjoiJmI9Q2hyb21lJmNjPW5sJnBhPXdpbmd5JmNkPTJYenV5RXROMlkxTDFRenV0RHp6dER0RHRCeUJ5QnlEdER0Qnp5eUJ5QnREeUN5Q3ROMEQwVHp1MFN0QnRDeUN0RHROMUwyWHp1dEF0RnRCeUN0RnRCdEZ5RHp5dE4xTDFDenUxU3ROMUwxRzFCMVYxTjJZMUwxUXp1MlN5QjBBdEJ5QnREMEIwRXlFdEd5RHlCeUR5QnRHdEEwQjBGdEJ0R3RDdEN5RTBEdEd0QjBFMEUwRnRDMEF0QXlEMEEwQTBCdEQyUXROMU0xRjFCMloxVjFOMlkxTDFRenUyU3p5eUN0QnRBenl6enRCeUV0R3REeUIwQzBGdEd5RTBCeUN5Q3RHMEF6enRCMEF0R3RCMEV0QTBFenowRnp6MEF5RXRDMER0QjJRdE4wQTBMenV0RCZjcj0xNzYxMjA4MjM5JmE9Ymd5X2Jib2lfMTdfNDhfc3NnMDEmb3NfdmVyPTYuMSZvcz1XaW5kb3dzKzcrVWx0aW1hdGUiLAoJImNjIjoibmwiLAoJImNfdmVyIjoiMy4yNi4yLjU5IiwKCSJyZWdfdHMiOiIxNTEyMDM3NzQyIgoKfQ==" "update_url"="REG_SZ", "https://clients2.google.com/service/update2/crx" [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\pilplloabdedfmialnfchjomjmpjcoej] "install_parameter"="REG_SZ", "ew0KCSJhZmx0IjogImJneV9iYm9pXzE3XzQ4X3NzZzAxIiwKCSJjciI6IjE3NjEyMDgyMzkiLAoJImNkIjoiMlh6dXlFdE4yWTFMMVF6dXREenp0RHREdEJ5QnlCeUR0RHRCenl5QnlCdER5Q3lDdE4wRDBUenUwU3RCdEN5Q3REdE4xTDJYenV0QXRGdEJ5Q3RGdEJ0RnlEenl0TjFMMUN6dTFTdE4xTDFHMUIxVjFOMlkxTDFRenUyU3lCMEF0QnlCdEQwQjBFeUV0R3lEeUJ5RHlCdEd0QTBCMEZ0QnRHdEN0Q3lFMER0R3RCMEUwRTBGdEMwQXRBeUQwQTBBMEJ0RDJRdE4xTTFGMUIyWjFWMU4yWTFMMVF6dTJTenl5Q3RCdEF6eXp6dEJ5RXRHdER5QjBDMEZ0R3lFMEJ5Q3lDdEcwQXp6dEIwQXRHdEIwRXRBMEV6ejBGenowQXlFdEMwRHRCMlF0TjBBMEx6dXREIiwKCSJ5Y2MiOiJubCIsCgkicGFyYW0yIjoiJmI9Q2hyb21lJmNjPW5sJnBhPXdpbmd5JmNkPTJYenV5RXROMlkxTDFRenV0RHp6dER0RHRCeUJ5QnlEdER0Qnp5eUJ5QnREeUN5Q3ROMEQwVHp1MFN0QnRDeUN0RHROMUwyWHp1dEF0RnRCeUN0RnRCdEZ5RHp5dE4xTDFDenUxU3ROMUwxRzFCMVYxTjJZMUwxUXp1MlN5QjBBdEJ5QnREMEIwRXlFdEd5RHlCeUR5QnRHdEEwQjBGdEJ0R3RDdEN5RTBEdEd0QjBFMEUwRnRDMEF0QXlEMEEwQTBCdEQyUXROMU0xRjFCMloxVjFOMlkxTDFRenUyU3p5eUN0QnRBenl6enRCeUV0R3REeUIwQzBGdEd5RTBCeUN5Q3RHMEF6enRCMEF0R3RCMEV0QTBFenowRnp6MEF5RXRDMER0QjJRdE4wQTBMenV0RCZjcj0xNzYxMjA4MjM5JmE9Ymd5X2Jib2lfMTdfNDhfc3NnMDEmb3NfdmVyPTYuMSZvcz1XaW5kb3dzKzcrVWx0aW1hdGUiLAoJImNjIjoibmwiLAoJImNfdmVyIjoiMy4yNi4yLjU5IiwKCSJyZWdfdHMiOiIxNTEyMDM3NzQyIgoKfQ==" "update_url"="REG_SZ", "https://clients2.google.com/service/update2/crx" [HKEY_CURRENT_USER\Software\csastats\ic\0001b697c1f9893aedbfdf6cba3203491bdd733a18fd2b6869d551e874153226] "advertisers_ids"="REG_SZ", "554cb9c7b6" "channel"="REG_SZ", "c2356069e9d1e79ca924378153cfbbfb4d4416b1f99d41a2940bfdb66c5319db" "hmac_sha256_validation"="REG_SZ", "e1524acfa490c565e7793ac737ce8aace113643aceb4479e6aac2fdee2e91e68" "install_id"="REG_SZ", "0001b697c1f9893aedbfdf6cba3203491bdd733a18fd2b6869d551e874153226" "install_time_client"="REG_SZ", "20171130102729172" "install_time_server"="REG_SZ", "20171130042736550" "publisher_id"="REG_SZ", "4a890e7444" "vendor_id"="REG_SZ", "ic" [HKEY_CURRENT_USER\Software\Google\Chrome\Extensions\pilplloabdedfmialnfchjomjmpjcoej] "install_parameter"="REG_SZ", "ew0KCSJhZmx0IjogImJneV9iYm9pXzE3XzQ4X3NzZzAxIiwKCSJjciI6IjE3NjEyMDgyMzkiLAoJImNkIjoiMlh6dXlFdE4yWTFMMVF6dXREenp0RHREdEJ5QnlCeUR0RHRCenl5QnlCdER5Q3lDdE4wRDBUenUwU3RCdEN5Q3REdE4xTDJYenV0QXRGdEJ5Q3RGdEJ0RnlEenl0TjFMMUN6dTFTdE4xTDFHMUIxVjFOMlkxTDFRenUyU3lCMEF0QnlCdEQwQjBFeUV0R3lEeUJ5RHlCdEd0QTBCMEZ0QnRHdEN0Q3lFMER0R3RCMEUwRTBGdEMwQXRBeUQwQTBBMEJ0RDJRdE4xTTFGMUIyWjFWMU4yWTFMMVF6dTJTenl5Q3RCdEF6eXp6dEJ5RXRHdER5QjBDMEZ0R3lFMEJ5Q3lDdEcwQXp6dEIwQXRHdEIwRXRBMEV6ejBGenowQXlFdEMwRHRCMlF0TjBBMEx6dXREIiwKCSJ5Y2MiOiJubCIsCgkicGFyYW0yIjoiJmI9Q2hyb21lJmNjPW5sJnBhPXdpbmd5JmNkPTJYenV5RXROMlkxTDFRenV0RHp6dER0RHRCeUJ5QnlEdER0Qnp5eUJ5QnREeUN5Q3ROMEQwVHp1MFN0QnRDeUN0RHROMUwyWHp1dEF0RnRCeUN0RnRCdEZ5RHp5dE4xTDFDenUxU3ROMUwxRzFCMVYxTjJZMUwxUXp1MlN5QjBBdEJ5QnREMEIwRXlFdEd5RHlCeUR5QnRHdEEwQjBGdEJ0R3RDdEN5RTBEdEd0QjBFMEUwRnRDMEF0QXlEMEEwQTBCdEQyUXROMU0xRjFCMloxVjFOMlkxTDFRenUyU3p5eUN0QnRBenl6enRCeUV0R3REeUIwQzBGdEd5RTBCeUN5Q3RHMEF6enRCMEF0R3RCMEV0QTBFenowRnp6MEF5RXRDMER0QjJRdE4wQTBMenV0RCZjcj0xNzYxMjA4MjM5JmE9Ymd5X2Jib2lfMTdfNDhfc3NnMDEmb3NfdmVyPTYuMSZvcz1XaW5kb3dzKzcrVWx0aW1hdGUiLAoJImNjIjoibmwiLAoJImNfdmVyIjoiMy4yNi4yLjU5IiwKCSJyZWdfdHMiOiIxNTEyMDM3NzQyIgoKfQ==" "update_url"="REG_SZ", "https://clients2.google.com/service/update2/crx" [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\{EBD7166E-C6A6-4b68-80CA-CA08108C76EE} Nix Player_is1] "DisplayIcon"="REG_SZ", "C:\Users\{username}\AppData\Roaming\Nix Player\Nix Player.exe" "DisplayName"="REG_SZ", "Nix Player" "DisplayVersion"="REG_SZ", "1.0.0.0" "EstimatedSize"="REG_DWORD", 16758 "Inno Setup: App Path"="REG_SZ", "C:\Users\{username}\AppData\Roaming\Nix Player" "Inno Setup: Deselected Tasks"="REG_SZ", "" "Inno Setup: Icon Group"="REG_SZ", "Nix Player" "Inno Setup: Language"="REG_SZ", "en" "Inno Setup: Selected Tasks"="REG_SZ", "desktopicon" "Inno Setup: Setup Version"="REG_SZ", "5.5.8 (a)" "Inno Setup: User"="REG_SZ", "{username}" "InstallDate"="REG_SZ", "20171130" "InstallLocation"="REG_SZ", "C:\Users\{username}\AppData\Roaming\Nix Player\" "MajorVersion"="REG_DWORD", 1 "MinorVersion"="REG_DWORD", 0 "NoModify"="REG_DWORD", 1 "NoRepair"="REG_DWORD", 1 "Publisher"="REG_SZ", "Nix Player" "QuietUninstallString"="REG_SZ", ""C:\Users\{username}\AppData\Roaming\Nix Player\unins000.exe" /SILENT" "UninstallString"="REG_SZ", ""C:\Users\{username}\AppData\Roaming\Nix Player\unins000.exe"" [HKEY_CURRENT_USER\Software\undefined] "Nix_Player [1].exe"="REG_SZ", "1512034148483,http://cdn.bridgeaccesspoint.com/Nix_Player.exe" Malwarebytes log: Malwarebytes www.malwarebytes.com -Log Details- Scan Date: 11/30/17 Scan Time: 11:26 AM Log File: ea295588-d5b8-11e7-ae87-080027750297.json Administrator: Yes -Software Information- Version: 3.3.1.2183 Components Version: 1.0.236 Update Package Version: 1.0.3379 License: Premium -System Information- OS: Windows 7 Service Pack 1 CPU: x64 File System: NTFS User: {computername}\{username} -Scan Summary- Scan Type: Threat Scan Result: Completed Objects Scanned: 335741 Threats Detected: 143 Threats Quarantined: 143 Time Elapsed: 2 min, 4 sec -Scan Options- Memory: Enabled Startup: Enabled Filesystem: Enabled Archives: Enabled Rootkits: Disabled Heuristics: Enabled PUP: Detect PUM: Detect -Scan Details- Process: 0 (No malicious items detected) Module: 0 (No malicious items detected) Registry Key: 5 PUP.Optional.InstallCore, HKCU\SOFTWARE\csastats, Delete-on-Reboot, [2], [260986],1.0.3379 PUP.Optional.SearchManager, HKLM\SOFTWARE\WOW6432NODE\GOOGLE\CHROME\EXTENSIONS\PILPLLOABDEDFMIALNFCHJOMJMPJCOEJ, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, HKCU\SOFTWARE\GOOGLE\CHROME\EXTENSIONS\PILPLLOABDEDFMIALNFCHJOMJMPJCOEJ, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, HKLM\SOFTWARE\GOOGLE\CHROME\EXTENSIONS\pilplloabdedfmialnfchjomjmpjcoej, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.ProductSetup, HKCU\SOFTWARE\PRODUCTSETUP, Delete-on-Reboot, [14409], [242047],1.0.3379 Registry Value: 1 PUP.Optional.ProductSetup, HKCU\SOFTWARE\PRODUCTSETUP|TB, Delete-on-Reboot, [14409], [242047],1.0.3379 Registry Data: 0 (No malicious items detected) Data Stream: 0 (No malicious items detected) Folder: 19 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\sitesThumbnails, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\weather, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\icons, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\tiles, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\_locales\pt_BR, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\fonts, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\_locales\en, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\_locales\fr, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\_locales\hi, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\_locales\vi, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\skin\icons, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\_metadata, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\_locales, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\vendor, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\skin, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej, Delete-on-Reboot, [529], [260991],1.0.3379 File: 118 PUP.Optional.SearchManager, C:\USERS\{username}\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Secure Preferences, Replaced, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\USERS\{username}\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Preferences, Replaced, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\fonts\HelveticaNeue-Thin.otf, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\fonts\HelveticaNeueLT-Roman.woff, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\fonts\neue-bold.woff, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\fonts\neue.woff, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\icons\128.png, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\icons\16.png, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\icons\48.png, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\icons\close.png, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\icons\favicon.ico, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\icons\trends.svg, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\sitesThumbnails\amazon_tile_v2.png, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\sitesThumbnails\booking_tile_v2.png, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\sitesThumbnails\ebay.png, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\sitesThumbnails\ebay_tile_v2.png, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\sitesThumbnails\facebook.png, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\sitesThumbnails\facebook_tile_v2.png, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\sitesThumbnails\gmail.png, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\sitesThumbnails\gmail_tile_v2.png, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\sitesThumbnails\gtranslte.png, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\sitesThumbnails\pinterest.png, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\sitesThumbnails\twitter.png, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\sitesThumbnails\twitter_tile_v2.png, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\sitesThumbnails\yahoo.png, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\sitesThumbnails\yahoo_tile_v2.png, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\sitesThumbnails\youtube.png, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\sitesThumbnails\youtube_tile_v2.png, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\tiles\DOC-to-PDF.jpg, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\tiles\PDF-to-DOC.jpg, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\tiles\Translation.jpg, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\tiles\View-PDF.jpg, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\weather\01d.svg, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\weather\01n.svg, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\weather\02d.svg, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\weather\02n.svg, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\weather\03d.svg, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\weather\03n.svg, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\weather\04d.svg, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\weather\04n.svg, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\weather\09d.svg, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\weather\09n.svg, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\weather\10d.svg, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\weather\10n.svg, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\weather\11d.svg, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\weather\11n.svg, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\weather\13d.svg, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\weather\13n.svg, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\weather\50d.svg, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\weather\50n.svg, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\eyeglass.png, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\angle-arrow-down.png, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\bing.png, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\bing_large.png, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\bluesky-bg.jpg, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\brush.png, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\bt.png, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\clock.png, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\cloud.png, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\cupcake-bg.jpg, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\desk-bg.jpg, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\doodle.png, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\down.png, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\enhanced_google.png, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\gmx_large.png, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\google.png, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\google_large.png, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\hero-bg.jpg, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\just-the-box-empty.png, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\just-the-box.png, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\mountain-bg.jpg, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\pointer2.png, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\radio-selected.svg, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\radio-unselected.svg, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\sea-bg.jpg, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\settings.png, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\smallMagnifier.png, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\star-unselected.svg, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\star.svg, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\todoc.png, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\toggle-off.svg, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\toggle-on.svg, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\topdf.png, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\transparent_img.png, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\yahoo.png, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\yahoo.svg, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\yahoo_large.png, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\yandex.png, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\bundle.v0.0.1.min.css, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\skin\icons\16.png, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\vendor\md5.min.js, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\vendor\react-dom.min.js, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\vendor\react-with-addons.min.js, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\vendor\underscore-min.js, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\_locales\en\messages.json, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\_locales\fr\messages.json, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\_locales\hi\messages.json, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\_locales\pt_BR\messages.json, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\_locales\vi\messages.json, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\_metadata\verified_contents.json, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\2bfc185be71f44cd73ac81511fc1f5a5.woff, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\b495e340f4ef8924fea0284c1bf9e7ac.woff, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\background.html, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\background.v0.0.1.min.js, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\c5a5cbf4dbcaa7064f2bc77f52101aec.otf, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\client.v0.0.1.min.js, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\common.js, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\e5d3501d500d07b0a1e952b0f8a81d78.woff, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\e_.json, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\index.html, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\manifest.json, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\popupTab2.html, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\popupTab2.js, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\responseConfig.json, Delete-on-Reboot, [529], [260991],1.0.3379 PUP.Optional.SearchManager, C:\USERS\{username}\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\LOCAL STORAGE\chrome-extension_pilplloabdedfmialnfchjomjmpjcoej_0.localstorage, Delete-on-Reboot, [529], [453138],1.0.3379 PUP.Optional.WinYahoo, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\{profile}.default\PREFS.JS, Replaced, [63], [413431],1.0.3379 PUP.Optional.WinYahoo, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\{profile}.default\SEARCHPLUGINS\YAHOO! POWERED SEARCH.XML, Delete-on-Reboot, [63], [413427],1.0.3379 PUP.Optional.InstallCore, C:\USERS\{username}\DESKTOP\NIX_PLAYER.EXE, Delete-on-Reboot, [2], [461898],1.0.3379 Physical Sector: 0 (No malicious items detected) (end) As mentioned before the full version of Malwarebytes could have protected your computer against this threat. We use different ways of protecting your computer(s): Dynamically Blocks Malware Sites & Servers Malware Execution Prevention Save yourself the hassle and get protected.