Jump to content

Removal instructions for Nix Player

Metallica
 Share

Recommended Posts

  • Staff
Metallica

Metallica

Posted
  • Staff
Posted
What is Nix Player?

The Malwarebytes research team has determined that Nix Player is a bundler. This so-called bundler installed a browser hijacker. Hijackers manipulate your browser(s), for example to change your startpage or searchscopes, so that the affected browser visits their site or one of their choice.

How do I know if my computer is affected by Nix Player?

You may see this entry in your list of installed software:

warning4.png

and these warnings during install:

warning2.png

warning5.png

this browser extension:

warning6.png

these changed settings:

warning7.png

and you will see these icons in your startmenu and on your desktop:

icons.png

This is the mains screen of the program:

main.png

How did Nix Player get on my computer?

Bundlers use different methods for distributing themselves. This particular one was offered as a "necessary" media player.

website.png

How do I remove Nix Player?

Our program Malwarebytes can detect and remove this potentially unwanted program.
  • Please download Malwarebytes to your desktop.
  • Double-click mb3-setup-consumer-{version}.exe and follow the prompts to install the program.
  • Then click Finish.
  • Once the program has fully updated, select Scan Now on the Dashboard. Or select the Threat Scan from the Scan menu.
  • If another update of the definitions is available, it will be implemented before the rest of the scanning procedure.
  • When the scan is complete, make sure that all Threats are selected, and click Remove Selected.
  • Restart your computer when prompted to do so.
Is there anything else I need to do to get rid of Nix Player?
  • No, Malwarebytes removes Nix Player completely.
  • The shortcut called Nix Player on the desktop can be deleted if it belonged to the potentially unwanted program.
How would the full version of Malwarebytes help protect me?

We hope our application and this guide have helped you eradicate this hijacker.

As you can see below the full version of Malwarebytes would have protected you against the Nix Player hijacker. It would have warned you before the application could install itself, giving you a chance to stop it before it became too late.
 

protection1.png


and we would have blocked the download of the installer:
 

protection2.png


Technical details for experts

Possible signs in FRST logs:
  
 FF NewTab: about:newtab
 FF DefaultSearchEngine: Yahoo! Powered Search
 FF SelectedSearchEngine: Yahoo! Powered Search
 FF Homepage: hxxps://{cc}.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=bgy_bboi_17_48_ssg01&param1=1&param2={Firefox}
 FF Keyword.URL: user_pref("keyword.URL", true);
 FF SearchPlugin: C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\searchplugins\yahoo! powered search.xml [2017-11-30]
 FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}.xpi [2017-11-30] [not signed]
 CHR DefaultSearchURL: Default -> hxxp://srchbar.com/?q={searchTerms}
 CHR DefaultSuggestURL: Default -> hxxp://srch.bar/?s={searchTerms}
 CHR Extension: (Search Manager) - C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej [2017-11-30]
 CHR HKLM\...\Chrome\Extension: [pilplloabdedfmialnfchjomjmpjcoej] - hxxps://clients2.google.com/service/update2/crx
 CHR HKCU\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [pilplloabdedfmialnfchjomjmpjcoej] - hxxps://clients2.google.com/service/update2/crx
 CHR HKLM-x32\...\Chrome\Extension: [pilplloabdedfmialnfchjomjmpjcoej] - hxxps://clients2.google.com/service/update2/crx
 C:\Users\{username}\Desktop\Nix Player.lnk
 C:\Users\{username}\AppData\Roaming\Nix Player
 C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Nix Player
 (Nix Player ) C:\Users\{username}\Downloads\Nix_Player [1].exe

Nix Player (HKCU\...\{EBD7166E-C6A6-4b68-80CA-CA08108C76EE} Nix Player_is1) (Version: 1.0.0.0 - Nix Player)
Significant alterations made by the installer:
  

File system details [View: All details] (Selection)
---------------------------------------------------
    Adds the folder C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0
       Adds the file 2bfc185be71f44cd73ac81511fc1f5a5.woff"="11/27/2017 11:30 AM, 48112 bytes, A
       Adds the file b495e340f4ef8924fea0284c1bf9e7ac.woff"="11/27/2017 11:30 AM, 14492 bytes, A
       Adds the file background.html"="11/27/2017 11:30 AM, 534 bytes, A
       Adds the file background.v0.0.1.min.js"="11/27/2017 11:30 AM, 3383 bytes, A
       Adds the file c5a5cbf4dbcaa7064f2bc77f52101aec.otf"="11/27/2017 11:30 AM, 24888 bytes, A
       Adds the file client.v0.0.1.min.js"="11/27/2017 11:30 AM, 324009 bytes, A
       Adds the file common.js"="11/27/2017 11:30 AM, 392960 bytes, A
       Adds the file e_.json"="11/27/2017 11:30 AM, 110 bytes, A
       Adds the file e5d3501d500d07b0a1e952b0f8a81d78.woff"="11/27/2017 11:30 AM, 16320 bytes, A
       Adds the file index.html"="11/27/2017 11:30 AM, 1397 bytes, A
       Adds the file manifest.json"="11/30/2017 10:29 AM, 2232 bytes, A
       Adds the file popupTab2.html"="11/27/2017 11:30 AM, 3424 bytes, A
       Adds the file popupTab2.js"="11/27/2017 11:30 AM, 7635 bytes, A
       Adds the file responseConfig.json"="11/27/2017 11:30 AM, 149704 bytes, A
    Adds the folder C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\_locales
    Adds the folder C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\_metadata
       Adds the file verified_contents.json"="11/27/2017 11:30 AM, 15997 bytes, A
    Adds the folder C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content
       Adds the file bundle.v0.0.1.min.css"="11/27/2017 11:30 AM, 4169 bytes, A
    Adds the folder C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\fonts
       Adds the file HelveticaNeueLT-Roman.woff"="11/27/2017 11:30 AM, 16320 bytes, A
       Adds the file HelveticaNeue-Thin.otf"="11/27/2017 11:30 AM, 24888 bytes, A
       Adds the file neue.woff"="11/27/2017 11:30 AM, 14492 bytes, A
       Adds the file neue-bold.woff"="11/27/2017 11:30 AM, 48112 bytes, A
    Adds the folder C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images
    Adds the folder C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\skin\icons
       Adds the file 16.png"="11/27/2017 11:30 AM, 615 bytes, A
    Adds the folder C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\vendor
       Adds the file md5.min.js"="11/27/2017 11:30 AM, 8209 bytes, A
       Adds the file react-dom.min.js"="11/27/2017 11:30 AM, 709 bytes, A
       Adds the file react-with-addons.min.js"="11/27/2017 11:30 AM, 160185 bytes, A
       Adds the file underscore-min.js"="11/27/2017 11:30 AM, 16449 bytes, A
    In the existing folder C:\Users\{username}\AppData\LocalLow\Microsoft\Internet Explorer\Services
       Adds the file searchy.ico"="11/30/2017 10:28 AM, 5430 bytes, A
    Adds the folder C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Nix Player
       Adds the file Nix Player.lnk"="11/30/2017 10:30 AM, 1873 bytes, A
    Adds the folder C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\searchplugins
       Adds the file yahoo! powered search.xml"="11/30/2017 10:28 AM, 1595 bytes, A
    Adds the folder C:\Users\{username}\AppData\Roaming\Nix Player
       Adds the file FlvPlayer.Core.dll"="11/22/2017 7:10 PM, 44544 bytes, A
       Adds the file FlvPlayer.Wpf.dll"="11/22/2017 7:10 PM, 35840 bytes, A
       Adds the file Nix Player.exe"="11/22/2017 7:10 PM, 140288 bytes, A
       Adds the file unins000.dat"="11/30/2017 10:30 AM, 24107 bytes, A
       Adds the file unins000.exe"="11/30/2017 10:29 AM, 742053 bytes, A
       Adds the file Vlc.DotNet.Core.Interops.dll"="11/20/2017 6:34 PM, 94208 bytes, A
    Adds the folder C:\Users\{username}\AppData\Roaming\Nix Player\Libraries
       Adds the file axvlc.dll"="6/4/2017 4:41 PM, 416256 bytes, A
       Adds the file axvlc.dll.manifest"="6/4/2017 4:41 PM, 304 bytes, A
       Adds the file libvlc.dll"="6/4/2017 4:41 PM, 111104 bytes, A
       Adds the file libvlccore.dll"="6/4/2017 4:41 PM, 2285056 bytes, A
       Adds the file npvlc.dll"="6/4/2017 4:41 PM, 305152 bytes, A
       Adds the file npvlc.dll.manifest"="6/4/2017 4:41 PM, 304 bytes, A
    Adds the folder C:\Users\{username}\AppData\Roaming\Nix Player\Libraries\plugins
       Adds the file plugins.dat"="11/30/2017 10:32 AM, 41062 bytes, A
    Adds the folder C:\Users\{username}\AppData\Roaming\Nix Player\Libraries\plugins\access
       Adds the file libfilesystem_plugin.dll"="6/4/2017 4:41 PM, 43520 bytes, A
    Adds the folder C:\Users\{username}\AppData\Roaming\Nix Player\Libraries\plugins\access_output
       Adds the file libaccess_output_file_plugin.dll"="6/4/2017 4:41 PM, 35840 bytes, A
    Adds the folder C:\Users\{username}\AppData\Roaming\Nix Player\Libraries\plugins\audio_filter
       Adds the file liba52tofloat32_plugin.dll"="6/4/2017 4:41 PM, 69120 bytes, A
       Adds the file liba52tospdif_plugin.dll"="6/4/2017 4:41 PM, 34816 bytes, A
       Adds the file libaudio_format_plugin.dll"="6/4/2017 4:41 PM, 45568 bytes, A
       Adds the file libaudiobargraph_a_plugin.dll"="6/4/2017 4:41 PM, 41472 bytes, A
       Adds the file libchorus_flanger_plugin.dll"="6/4/2017 4:41 PM, 39424 bytes, A
       Adds the file libcompressor_plugin.dll"="6/4/2017 4:41 PM, 42496 bytes, A
       Adds the file libconverter_fixed_plugin.dll"="6/4/2017 4:41 PM, 36864 bytes, A
       Adds the file libdolby_surround_decoder_plugin.dll"="6/4/2017 4:41 PM, 36352 bytes, A
       Adds the file libdtstofloat32_plugin.dll"="6/4/2017 4:41 PM, 182272 bytes, A
       Adds the file libdtstospdif_plugin.dll"="6/4/2017 4:41 PM, 36864 bytes, A
       Adds the file libequalizer_plugin.dll"="6/4/2017 4:41 PM, 46592 bytes, A
       Adds the file libheadphone_channel_mixer_plugin.dll"="6/4/2017 4:41 PM, 41472 bytes, A
       Adds the file libkaraoke_plugin.dll"="6/4/2017 4:41 PM, 34304 bytes, A
       Adds the file libmono_plugin.dll"="6/4/2017 4:41 PM, 42496 bytes, A
       Adds the file libmpgatofixed32_plugin.dll"="6/4/2017 4:41 PM, 135168 bytes, A
       Adds the file libnormvol_plugin.dll"="6/4/2017 4:41 PM, 37376 bytes, A
       Adds the file libparam_eq_plugin.dll"="6/4/2017 4:41 PM, 38912 bytes, A
       Adds the file libsamplerate_plugin.dll"="6/4/2017 4:41 PM, 1518080 bytes, A
       Adds the file libscaletempo_plugin.dll"="6/4/2017 4:41 PM, 40960 bytes, A
       Adds the file libsimple_channel_mixer_plugin.dll"="6/4/2017 4:41 PM, 38400 bytes, A
       Adds the file libspatializer_plugin.dll"="6/4/2017 4:41 PM, 107520 bytes, A
       Adds the file libspeex_resampler_plugin.dll"="6/4/2017 4:41 PM, 46592 bytes, A
       Adds the file libtrivial_channel_mixer_plugin.dll"="6/4/2017 4:41 PM, 36352 bytes, A
       Adds the file libugly_resampler_plugin.dll"="6/4/2017 4:41 PM, 35328 bytes, A
    Adds the folder C:\Users\{username}\AppData\Roaming\Nix Player\Libraries\plugins\audio_mixer
       Adds the file libfixed32_mixer_plugin.dll"="6/4/2017 4:41 PM, 34816 bytes, A
       Adds the file libfloat32_mixer_plugin.dll"="6/4/2017 4:41 PM, 33792 bytes, A
    Adds the folder C:\Users\{username}\AppData\Roaming\Nix Player\Libraries\plugins\audio_output
       Adds the file libaout_directx_plugin.dll"="6/4/2017 4:41 PM, 49664 bytes, A
       Adds the file libwaveout_plugin.dll"="6/4/2017 4:41 PM, 51200 bytes, A
    Adds the folder C:\Users\{username}\AppData\Roaming\Nix Player\Libraries\plugins\codec
       Adds the file libavcodec_plugin.dll"="6/4/2017 4:41 PM, 9532416 bytes, A
    Adds the folder C:\Users\{username}\AppData\Roaming\Nix Player\Libraries\plugins\video_filter
       Adds the file libswscale_plugin.dll"="6/4/2017 4:41 PM, 370688 bytes, A
    Adds the folder C:\Users\{username}\AppData\Roaming\Nix Player\Libraries\plugins\video_output
       Adds the file libvmem_plugin.dll"="6/4/2017 4:41 PM, 38912 bytes, A
    In the existing folder C:\Users\{username}\Desktop
       Adds the file Nix Player.lnk"="11/30/2017 10:30 AM, 1881 bytes, A

Registry details [View: All details] (Selection)
------------------------------------------------
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{82D7B48B-A67F-D833-CBE7-FDDBEF8F0143}]
       "aflt"="REG_SZ", "bgy_bboi_17_48_ssg01"
       "c_ver"="REG_SZ", "3.26.2.59"
       "cd"="REG_SZ", "2XzuyEtN2Y1L1QzutDzztDtDtByByByDtDtBzyyByBtDyCyCtN0D0Tzu0StBtCyCtDtN1L2XzutAtFtByCtFtBtFyDzytN1L1Czu1StN1L1G1B1V1N2Y1L1Qzu2SyB0AtByBtD0B0EyEtGyDyByDyBtGtA0B0FtBtGtCtCyE0DtGtB0E0E0FtC0AtAyD0A0A0BtD2QtN1M1F1B2Z1V1N2Y1L1Qzu2SzyyCtBtAzyzztByEtGtDyB0C0FtGyE0ByCyCtG0AzztB0AtGtB0EtA0Ezz0Fzz0AyEtC0DtB2QtN0A0LzutD"
       "cr"="REG_SZ", "1761208239"
       "DT"="REG_SZ", "S2160"
       "insDate"="REG_SZ", "20171130102837668"
       "instlRef"="REG_SZ", "b"
       "st_ver"="REG_SZ", "3.6.0.0"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions\pilplloabdedfmialnfchjomjmpjcoej]
       "install_parameter"="REG_SZ", "ew0KCSJhZmx0IjogImJneV9iYm9pXzE3XzQ4X3NzZzAxIiwKCSJjciI6IjE3NjEyMDgyMzkiLAoJImNkIjoiMlh6dXlFdE4yWTFMMVF6dXREenp0RHREdEJ5QnlCeUR0RHRCenl5QnlCdER5Q3lDdE4wRDBUenUwU3RCdEN5Q3REdE4xTDJYenV0QXRGdEJ5Q3RGdEJ0RnlEenl0TjFMMUN6dTFTdE4xTDFHMUIxVjFOMlkxTDFRenUyU3lCMEF0QnlCdEQwQjBFeUV0R3lEeUJ5RHlCdEd0QTBCMEZ0QnRHdEN0Q3lFMER0R3RCMEUwRTBGdEMwQXRBeUQwQTBBMEJ0RDJRdE4xTTFGMUIyWjFWMU4yWTFMMVF6dTJTenl5Q3RCdEF6eXp6dEJ5RXRHdER5QjBDMEZ0R3lFMEJ5Q3lDdEcwQXp6dEIwQXRHdEIwRXRBMEV6ejBGenowQXlFdEMwRHRCMlF0TjBBMEx6dXREIiwKCSJ5Y2MiOiJubCIsCgkicGFyYW0yIjoiJmI9Q2hyb21lJmNjPW5sJnBhPXdpbmd5JmNkPTJYenV5RXROMlkxTDFRenV0RHp6dER0RHRCeUJ5QnlEdER0Qnp5eUJ5QnREeUN5Q3ROMEQwVHp1MFN0QnRDeUN0RHROMUwyWHp1dEF0RnRCeUN0RnRCdEZ5RHp5dE4xTDFDenUxU3ROMUwxRzFCMVYxTjJZMUwxUXp1MlN5QjBBdEJ5QnREMEIwRXlFdEd5RHlCeUR5QnRHdEEwQjBGdEJ0R3RDdEN5RTBEdEd0QjBFMEUwRnRDMEF0QXlEMEEwQTBCdEQyUXROMU0xRjFCMloxVjFOMlkxTDFRenUyU3p5eUN0QnRBenl6enRCeUV0R3REeUIwQzBGdEd5RTBCeUN5Q3RHMEF6enRCMEF0R3RCMEV0QTBFenowRnp6MEF5RXRDMER0QjJRdE4wQTBMenV0RCZjcj0xNzYxMjA4MjM5JmE9Ymd5X2Jib2lfMTdfNDhfc3NnMDEmb3NfdmVyPTYuMSZvcz1XaW5kb3dzKzcrVWx0aW1hdGUiLAoJImNjIjoibmwiLAoJImNfdmVyIjoiMy4yNi4yLjU5IiwKCSJyZWdfdHMiOiIxNTEyMDM3NzQyIgoKfQ=="
       "update_url"="REG_SZ", "https://clients2.google.com/service/update2/crx"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\pilplloabdedfmialnfchjomjmpjcoej]
       "install_parameter"="REG_SZ", "ew0KCSJhZmx0IjogImJneV9iYm9pXzE3XzQ4X3NzZzAxIiwKCSJjciI6IjE3NjEyMDgyMzkiLAoJImNkIjoiMlh6dXlFdE4yWTFMMVF6dXREenp0RHREdEJ5QnlCeUR0RHRCenl5QnlCdER5Q3lDdE4wRDBUenUwU3RCdEN5Q3REdE4xTDJYenV0QXRGdEJ5Q3RGdEJ0RnlEenl0TjFMMUN6dTFTdE4xTDFHMUIxVjFOMlkxTDFRenUyU3lCMEF0QnlCdEQwQjBFeUV0R3lEeUJ5RHlCdEd0QTBCMEZ0QnRHdEN0Q3lFMER0R3RCMEUwRTBGdEMwQXRBeUQwQTBBMEJ0RDJRdE4xTTFGMUIyWjFWMU4yWTFMMVF6dTJTenl5Q3RCdEF6eXp6dEJ5RXRHdER5QjBDMEZ0R3lFMEJ5Q3lDdEcwQXp6dEIwQXRHdEIwRXRBMEV6ejBGenowQXlFdEMwRHRCMlF0TjBBMEx6dXREIiwKCSJ5Y2MiOiJubCIsCgkicGFyYW0yIjoiJmI9Q2hyb21lJmNjPW5sJnBhPXdpbmd5JmNkPTJYenV5RXROMlkxTDFRenV0RHp6dER0RHRCeUJ5QnlEdER0Qnp5eUJ5QnREeUN5Q3ROMEQwVHp1MFN0QnRDeUN0RHROMUwyWHp1dEF0RnRCeUN0RnRCdEZ5RHp5dE4xTDFDenUxU3ROMUwxRzFCMVYxTjJZMUwxUXp1MlN5QjBBdEJ5QnREMEIwRXlFdEd5RHlCeUR5QnRHdEEwQjBGdEJ0R3RDdEN5RTBEdEd0QjBFMEUwRnRDMEF0QXlEMEEwQTBCdEQyUXROMU0xRjFCMloxVjFOMlkxTDFRenUyU3p5eUN0QnRBenl6enRCeUV0R3REeUIwQzBGdEd5RTBCeUN5Q3RHMEF6enRCMEF0R3RCMEV0QTBFenowRnp6MEF5RXRDMER0QjJRdE4wQTBMenV0RCZjcj0xNzYxMjA4MjM5JmE9Ymd5X2Jib2lfMTdfNDhfc3NnMDEmb3NfdmVyPTYuMSZvcz1XaW5kb3dzKzcrVWx0aW1hdGUiLAoJImNjIjoibmwiLAoJImNfdmVyIjoiMy4yNi4yLjU5IiwKCSJyZWdfdHMiOiIxNTEyMDM3NzQyIgoKfQ=="
       "update_url"="REG_SZ", "https://clients2.google.com/service/update2/crx"
    [HKEY_CURRENT_USER\Software\csastats\ic\0001b697c1f9893aedbfdf6cba3203491bdd733a18fd2b6869d551e874153226]
       "advertisers_ids"="REG_SZ", "554cb9c7b6"
       "channel"="REG_SZ", "c2356069e9d1e79ca924378153cfbbfb4d4416b1f99d41a2940bfdb66c5319db"
       "hmac_sha256_validation"="REG_SZ", "e1524acfa490c565e7793ac737ce8aace113643aceb4479e6aac2fdee2e91e68"
       "install_id"="REG_SZ", "0001b697c1f9893aedbfdf6cba3203491bdd733a18fd2b6869d551e874153226"
       "install_time_client"="REG_SZ", "20171130102729172"
       "install_time_server"="REG_SZ", "20171130042736550"
       "publisher_id"="REG_SZ", "4a890e7444"
       "vendor_id"="REG_SZ", "ic"
    [HKEY_CURRENT_USER\Software\Google\Chrome\Extensions\pilplloabdedfmialnfchjomjmpjcoej]
       "install_parameter"="REG_SZ", "ew0KCSJhZmx0IjogImJneV9iYm9pXzE3XzQ4X3NzZzAxIiwKCSJjciI6IjE3NjEyMDgyMzkiLAoJImNkIjoiMlh6dXlFdE4yWTFMMVF6dXREenp0RHREdEJ5QnlCeUR0RHRCenl5QnlCdER5Q3lDdE4wRDBUenUwU3RCdEN5Q3REdE4xTDJYenV0QXRGdEJ5Q3RGdEJ0RnlEenl0TjFMMUN6dTFTdE4xTDFHMUIxVjFOMlkxTDFRenUyU3lCMEF0QnlCdEQwQjBFeUV0R3lEeUJ5RHlCdEd0QTBCMEZ0QnRHdEN0Q3lFMER0R3RCMEUwRTBGdEMwQXRBeUQwQTBBMEJ0RDJRdE4xTTFGMUIyWjFWMU4yWTFMMVF6dTJTenl5Q3RCdEF6eXp6dEJ5RXRHdER5QjBDMEZ0R3lFMEJ5Q3lDdEcwQXp6dEIwQXRHdEIwRXRBMEV6ejBGenowQXlFdEMwRHRCMlF0TjBBMEx6dXREIiwKCSJ5Y2MiOiJubCIsCgkicGFyYW0yIjoiJmI9Q2hyb21lJmNjPW5sJnBhPXdpbmd5JmNkPTJYenV5RXROMlkxTDFRenV0RHp6dER0RHRCeUJ5QnlEdER0Qnp5eUJ5QnREeUN5Q3ROMEQwVHp1MFN0QnRDeUN0RHROMUwyWHp1dEF0RnRCeUN0RnRCdEZ5RHp5dE4xTDFDenUxU3ROMUwxRzFCMVYxTjJZMUwxUXp1MlN5QjBBdEJ5QnREMEIwRXlFdEd5RHlCeUR5QnRHdEEwQjBGdEJ0R3RDdEN5RTBEdEd0QjBFMEUwRnRDMEF0QXlEMEEwQTBCdEQyUXROMU0xRjFCMloxVjFOMlkxTDFRenUyU3p5eUN0QnRBenl6enRCeUV0R3REeUIwQzBGdEd5RTBCeUN5Q3RHMEF6enRCMEF0R3RCMEV0QTBFenowRnp6MEF5RXRDMER0QjJRdE4wQTBMenV0RCZjcj0xNzYxMjA4MjM5JmE9Ymd5X2Jib2lfMTdfNDhfc3NnMDEmb3NfdmVyPTYuMSZvcz1XaW5kb3dzKzcrVWx0aW1hdGUiLAoJImNjIjoibmwiLAoJImNfdmVyIjoiMy4yNi4yLjU5IiwKCSJyZWdfdHMiOiIxNTEyMDM3NzQyIgoKfQ=="
       "update_url"="REG_SZ", "https://clients2.google.com/service/update2/crx"
    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\{EBD7166E-C6A6-4b68-80CA-CA08108C76EE} Nix Player_is1]
       "DisplayIcon"="REG_SZ", "C:\Users\{username}\AppData\Roaming\Nix Player\Nix Player.exe"
       "DisplayName"="REG_SZ", "Nix Player"
       "DisplayVersion"="REG_SZ", "1.0.0.0"
       "EstimatedSize"="REG_DWORD", 16758
       "Inno Setup: App Path"="REG_SZ", "C:\Users\{username}\AppData\Roaming\Nix Player"
       "Inno Setup: Deselected Tasks"="REG_SZ", ""
       "Inno Setup: Icon Group"="REG_SZ", "Nix Player"
       "Inno Setup: Language"="REG_SZ", "en"
       "Inno Setup: Selected Tasks"="REG_SZ", "desktopicon"
       "Inno Setup: Setup Version"="REG_SZ", "5.5.8 (a)"
       "Inno Setup: User"="REG_SZ", "{username}"
       "InstallDate"="REG_SZ", "20171130"
       "InstallLocation"="REG_SZ", "C:\Users\{username}\AppData\Roaming\Nix Player\"
       "MajorVersion"="REG_DWORD", 1
       "MinorVersion"="REG_DWORD", 0
       "NoModify"="REG_DWORD", 1
       "NoRepair"="REG_DWORD", 1
       "Publisher"="REG_SZ", "Nix Player"
       "QuietUninstallString"="REG_SZ", ""C:\Users\{username}\AppData\Roaming\Nix Player\unins000.exe" /SILENT"
       "UninstallString"="REG_SZ", ""C:\Users\{username}\AppData\Roaming\Nix Player\unins000.exe""
    [HKEY_CURRENT_USER\Software\undefined]
       "Nix_Player [1].exe"="REG_SZ", "1512034148483,http://cdn.bridgeaccesspoint.com/Nix_Player.exe"
Malwarebytes log:
  
Malwarebytes
www.malwarebytes.com

-Log Details-
Scan Date: 11/30/17
Scan Time: 11:26 AM
Log File: ea295588-d5b8-11e7-ae87-080027750297.json
Administrator: Yes

-Software Information-
Version: 3.3.1.2183
Components Version: 1.0.236
Update Package Version: 1.0.3379
License: Premium

-System Information-
OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: {computername}\{username}

-Scan Summary-
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 335741
Threats Detected: 143
Threats Quarantined: 143
Time Elapsed: 2 min, 4 sec

-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Detect
PUM: Detect

-Scan Details-
Process: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registry Key: 5
PUP.Optional.InstallCore, HKCU\SOFTWARE\csastats, Delete-on-Reboot, [2], [260986],1.0.3379
PUP.Optional.SearchManager, HKLM\SOFTWARE\WOW6432NODE\GOOGLE\CHROME\EXTENSIONS\PILPLLOABDEDFMIALNFCHJOMJMPJCOEJ, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, HKCU\SOFTWARE\GOOGLE\CHROME\EXTENSIONS\PILPLLOABDEDFMIALNFCHJOMJMPJCOEJ, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, HKLM\SOFTWARE\GOOGLE\CHROME\EXTENSIONS\pilplloabdedfmialnfchjomjmpjcoej, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.ProductSetup, HKCU\SOFTWARE\PRODUCTSETUP, Delete-on-Reboot, [14409], [242047],1.0.3379

Registry Value: 1
PUP.Optional.ProductSetup, HKCU\SOFTWARE\PRODUCTSETUP|TB, Delete-on-Reboot, [14409], [242047],1.0.3379

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 19
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\sitesThumbnails, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\weather, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\icons, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\tiles, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\_locales\pt_BR, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\fonts, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\_locales\en, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\_locales\fr, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\_locales\hi, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\_locales\vi, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\skin\icons, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\_metadata, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\_locales, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\vendor, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\skin, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej, Delete-on-Reboot, [529], [260991],1.0.3379

File: 118
PUP.Optional.SearchManager, C:\USERS\{username}\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Secure Preferences, Replaced, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\USERS\{username}\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Preferences, Replaced, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\fonts\HelveticaNeue-Thin.otf, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\fonts\HelveticaNeueLT-Roman.woff, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\fonts\neue-bold.woff, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\fonts\neue.woff, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\icons\128.png, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\icons\16.png, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\icons\48.png, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\icons\close.png, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\icons\favicon.ico, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\icons\trends.svg, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\sitesThumbnails\amazon_tile_v2.png, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\sitesThumbnails\booking_tile_v2.png, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\sitesThumbnails\ebay.png, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\sitesThumbnails\ebay_tile_v2.png, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\sitesThumbnails\facebook.png, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\sitesThumbnails\facebook_tile_v2.png, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\sitesThumbnails\gmail.png, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\sitesThumbnails\gmail_tile_v2.png, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\sitesThumbnails\gtranslte.png, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\sitesThumbnails\pinterest.png, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\sitesThumbnails\twitter.png, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\sitesThumbnails\twitter_tile_v2.png, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\sitesThumbnails\yahoo.png, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\sitesThumbnails\yahoo_tile_v2.png, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\sitesThumbnails\youtube.png, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\sitesThumbnails\youtube_tile_v2.png, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\tiles\DOC-to-PDF.jpg, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\tiles\PDF-to-DOC.jpg, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\tiles\Translation.jpg, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\tiles\View-PDF.jpg, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\weather\01d.svg, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\weather\01n.svg, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\weather\02d.svg, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\weather\02n.svg, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\weather\03d.svg, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\weather\03n.svg, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\weather\04d.svg, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\weather\04n.svg, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\weather\09d.svg, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\weather\09n.svg, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\weather\10d.svg, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\weather\10n.svg, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\weather\11d.svg, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\weather\11n.svg, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\weather\13d.svg, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\weather\13n.svg, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\weather\50d.svg, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\weather\50n.svg, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\eyeglass.png, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\angle-arrow-down.png, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\bing.png, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\bing_large.png, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\bluesky-bg.jpg, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\brush.png, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\bt.png, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\clock.png, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\cloud.png, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\cupcake-bg.jpg, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\desk-bg.jpg, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\doodle.png, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\down.png, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\enhanced_google.png, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\gmx_large.png, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\google.png, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\google_large.png, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\hero-bg.jpg, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\just-the-box-empty.png, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\just-the-box.png, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\mountain-bg.jpg, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\pointer2.png, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\radio-selected.svg, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\radio-unselected.svg, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\sea-bg.jpg, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\settings.png, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\smallMagnifier.png, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\star-unselected.svg, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\star.svg, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\todoc.png, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\toggle-off.svg, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\toggle-on.svg, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\topdf.png, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\transparent_img.png, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\yahoo.png, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\yahoo.svg, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\yahoo_large.png, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\images\yandex.png, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\content\bundle.v0.0.1.min.css, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\skin\icons\16.png, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\vendor\md5.min.js, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\vendor\react-dom.min.js, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\vendor\react-with-addons.min.js, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\vendor\underscore-min.js, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\_locales\en\messages.json, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\_locales\fr\messages.json, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\_locales\hi\messages.json, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\_locales\pt_BR\messages.json, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\_locales\vi\messages.json, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\_metadata\verified_contents.json, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\2bfc185be71f44cd73ac81511fc1f5a5.woff, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\b495e340f4ef8924fea0284c1bf9e7ac.woff, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\background.html, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\background.v0.0.1.min.js, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\c5a5cbf4dbcaa7064f2bc77f52101aec.otf, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\client.v0.0.1.min.js, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\common.js, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\e5d3501d500d07b0a1e952b0f8a81d78.woff, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\e_.json, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\index.html, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\manifest.json, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\popupTab2.html, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\popupTab2.js, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.2.53_0\responseConfig.json, Delete-on-Reboot, [529], [260991],1.0.3379
PUP.Optional.SearchManager, C:\USERS\{username}\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\LOCAL STORAGE\chrome-extension_pilplloabdedfmialnfchjomjmpjcoej_0.localstorage, Delete-on-Reboot, [529], [453138],1.0.3379
PUP.Optional.WinYahoo, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\{profile}.default\PREFS.JS, Replaced, [63], [413431],1.0.3379
PUP.Optional.WinYahoo, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\{profile}.default\SEARCHPLUGINS\YAHOO! POWERED SEARCH.XML, Delete-on-Reboot, [63], [413427],1.0.3379
PUP.Optional.InstallCore, C:\USERS\{username}\DESKTOP\NIX_PLAYER.EXE, Delete-on-Reboot, [2], [461898],1.0.3379

Physical Sector: 0
(No malicious items detected)


(end)
As mentioned before the full version of Malwarebytes could have protected your computer against this threat.
We use different ways of protecting your computer(s):
  • Dynamically Blocks Malware Sites & Servers
  • Malware Execution Prevention
Save yourself the hassle and get protected.
Link to post
Share on other sites
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.

  I accept