# AdwCleaner 7.0.7.

0 - Logfile created on Sun Feb 04 19:37:24 2018

# Updated on 2018/18/01 by Malwarebytes
# Running on Windows 10 Pro (X64)
# Mode: clean
# Support: https://www.malwarebytes.com/support

***** [ Services ] *****

Deleted: backlh
Deleted: tiser

***** [ Folders ] *****

Deleted: C:\Users\All Users\Documents\XMUpdate

Deleted: C:\Users\Public\Documents\XMUpdate
Deleted: C:\ProgramData\CupCheck
Deleted: C:\ProgramData\Application Data\CupCheck
Deleted: C:\Users\All Users\CupCheck
Deleted: C:\Program Files (x86)\ShutdownTime
Deleted: C:\ProgramData\Logic Cramble
Deleted: C:\ProgramData\Application Data\Logic Cramble
Deleted: C:\Users\All Users\Logic Cramble
Deleted: C:\ProgramData\\tiser
Deleted: C:\Users\user\AppData\Roaming\gplyra
Deleted: C:\Users\user\AppData\Roaming\FastDataX
Deleted: C:\Users\user\AppData\Local\AdService
Deleted: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Healer
Deleted: C:\Users\user\AppData\Roaming\System Healer
Deleted: C:\Program Files (x86)\SystemHealer
Deleted: C:\Users\user\AppData\Local\SystemHealer
Deleted: C:\Windows\\rss
Deleted: C:\Windows\Temp\Smartbar
Deleted: C:\ProgramData\Quoteexs
Deleted: C:\ProgramData\Application Data\Quoteexs
Deleted: C:\Users\All Users\Quoteexs
Deleted: C:\ProgramData\DreamScreen
Deleted: C:\ProgramData\Application Data\DreamScreen
Deleted: C:\Users\All Users\DreamScreen
Deleted: C:\Users\user\AppData\Roaming\DreamScreen
Deleted: C:\ProgramData\DreamCompress
Deleted: C:\ProgramData\Application Data\DreamCompress
Deleted: C:\Users\All Users\DreamCompress
Deleted: C:\\Users\Public\Documents\XMUpdate
Deleted: C:\ProgramData\1d4bf1d0-1e51-1
Deleted: C:\ProgramData\1d4bf1d0-7465-0
Deleted: C:\ProgramData\a3522b14-5867-1
Deleted: C:\ProgramData\a3522b14-65d3-0

***** [ Files ] *****

Deleted: C:\Users\user\AppData\Local\Main.dat
Deleted:
C:\Windows\System32\config\systemprofile\appdata\local\installationconfiguration.xm
l
Deleted: C:\Users\user\appdata\local\installationconfiguration.xml
Deleted: C:\Windows\System32\config\systemprofile\AppData\Local\PO.DB
Deleted: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\PO.DB
Deleted: C:\Users\user\AppData\Local\PO.DB
Deleted: C:\Users\user\AppData\Local\Temp\YeapUserInfo.ini
Deleted: C:\Users\user\Desktop\Launch System Healer.lnk
Deleted: C:\ProgramData\\_tmp.exe
Deleted: C:\Windows\System32\findit.xml
Deleted: C:\Windows\SysWOW64\findit.xml

***** [ DLL ] *****

No malicious DLLs cleaned.

***** [ WMI ] *****

No malicious WMI cleaned.

***** [ Shortcuts ] *****

No malicious shortcuts cleaned.

***** [ Tasks ] *****

Deleted: LaCieS
Deleted: ShadowsocksS
Deleted: SystemHealer Task
Deleted: System Healer Monitor
Deleted: snf
Deleted: snp
Deleted: psv_Dongtex
Deleted: psv_FreshLab
Deleted: psv_SaltHatstock
Deleted: psv_TrippleTouch
Deleted: psv_Truekix

***** [ Registry ] *****

Deleted: [Value] -
HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER|
ENABLESHELLEXECUTEHOOKS
Deleted: [Value] - HKU\S-1-5-21-3794814720-1420163045-2405730453-
1001\Software\Microsoft\Internet Explorer\SearchScopes|DefaultScope
Deleted: [Value] - HKU\S-1-5-21-3794814720-1420163045-2405730453-
1001\Software\Microsoft\Internet Explorer\SearchScopes|DefaultScope
Deleted: [Value] - HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes|
DefaultScope
Deleted: [Key] - HKU\S-1-5-21-3794814720-1420163045-2405730453-1000\Software\PopWnd
Deleted: [Key] - HKCU\Software\PopWnd
Deleted: [Key] - HKLM\SOFTWARE\Microsoft\DMunversion
Deleted: [Value] - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|gplyra
Deleted: [Key] - HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{ielnksrch}
Deleted: [Value] - HKU\S-1-5-21-3794814720-1420163045-2405730453-
1000\Software\Microsoft\Windows\CurrentVersion\Run|msiql
Deleted: [Value] - HKCU\Software\Microsoft\Windows\CurrentVersion\Run|msiql
Deleted: [Key] - HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Application
Deleted: [Key] - HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application
Deleted: [Key] - HKU\S-1-5-21-3794814720-1420163045-2405730453-
1000\Software\YeaDesktop
Deleted: [Key] - HKCU\Software\YeaDesktop
Deleted: [Value] - HKLM\SOFTWARE\MICROSOFT\INTERNET
EXPLORER\MAIN\FEATURECONTROL\FEATURE_BROWSER_EMULATION|YeaDesktop.exe
Deleted: [Value] - HKLM\SOFTWARE\Microsoft\Internet
Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION|YeaDesktop.exe
Deleted: [Key] - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\gplyra
Deleted: [Key] - HKU\S-1-5-21-3794814720-1420163045-2405730453-
1000\Software\FastDataX
Deleted: [Key] - HKCU\Software\FastDataX
Deleted: [Key] - HKU\S-1-5-21-3794814720-1420163045-2405730453-1000\Software\System
Healer
Deleted: [Key] - HKCU\Software\System Healer
Deleted: [Key] - HKU\S-1-5-21-3794814720-1420163045-2405730453-
1000\Software\MICROSOFT\wewewe
Deleted: [Key] - HKCU\Software\MICROSOFT\wewewe
Deleted: [Key] - HKLM\SOFTWARE\mtQuoteex
Deleted: [Key] - HKU\S-1-5-21-3794814720-1420163045-2405730453-
1000\Software\mtQuoteex
Deleted: [Key] - HKCU\Software\mtQuoteex
Deleted: [Key] - HKLM\SOFTWARE\MICROSOFT\WINDOWS
NT\CURRENTVERSION\SILENTPROCESSEXIT\Quoteex.exe
Deleted: [Key] - HKU\S-1-5-21-3794814720-1420163045-2405730453-
1000\Software\Microsoft\BigTime
Deleted: [Key] - HKCU\Software\Microsoft\BigTime
Deleted: [Key] - HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\IELNKSRCH
Deleted: [Key] - HKU\S-1-5-21-3794814720-1420163045-2405730453-1000\Software\drpsu
Deleted: [Key] - HKCU\Software\drpsu
Deleted: [Key] - HKLM\SOFTWARE\mtQuoteex
Deleted: [Key] - HKU\S-1-5-21-3794814720-1420163045-2405730453-
1000\Software\mtQuoteex
Deleted: [Key] - HKCU\Software\mtQuoteex
Deleted: [Key] - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File
Execution Options\Quoteex.exe
Deleted: [Key] -
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\11598763487076930564
Deleted: [Key] - HKU\S-1-5-21-3794814720-1420163045-2405730453-
1000\Software\SetupCompany
Deleted: [Key] - HKCU\Software\SetupCompany

***** [ Firefox (and derivatives) ] *****

Startpage deleted: C:\ProgramData\Quoteexs\ff.HP

***** [ Chromium (and derivatives) ] *****

Plugin deleted: Chrome Cleaner Pro -

Plugin deleted: Handy Tab -
Plugin deleted: Bazz Search SafeFinder -

*************************

::Tracing keys deleted

::Winsock settings cleared
::Image File Execution Options%s keys deleted
::Prefetch files deleted
::Proxy settings cleared
::TCP/IP settings cleared
::Firewall rules cleared
::IPSec settings cleared
::BITS queue cleared
::IE policies deleted
::Chrome policies deleted
::Hosts file cleared
::Additional Actions: 0

*************************

C:/AdwCleaner/AdwCleaner[S0].txt - [7991 B] - [2018/2/4 19:35:36]

########## EOF - C:\AdwCleaner\AdwCleaner[C0].txt ##########