Jump to content

Removal instructions for Free_Ven


Recommended Posts

  • Staff

What is Free_Ven?

The Malwarebytes research team has determined that Free_Ven is a browser hijacker. These so-called "hijackers" manipulate your browser(s), for example to change your startpage or searchscopes, so that the affected browser visits their site or one of their choice. This one also displays advertisements.

How do I know if my computer is affected by Free_Ven?

You may see this Firefox add-on:

warning1.png

these tasks in your Task Scheduler:

warning3.png

and this entry in your list of installed programs:

warning4.png

How did Free_Ven get on my computer?

Browser hijackers use different methods for distributing themselves. This particular one was bundled with other software.

How do I remove Free_Ven?

Our program Malwarebytes Anti-Malware can detect and remove this potentially unwanted application.

  • Please download Malwarebytes Anti-Malware to your desktop.
  • Double-click mbam-setup-version.exe and follow the prompts to install the program.
  • At the end, be sure a check-mark is placed next to the following:
    • Enable free trial of Malwarebytes Anti-Malware Premium
    • Launch Malwarebytes Anti-Malware
  • Then click Finish.
  • If an update is found, you will be prompted to download and install the latest version.
  • Once the program has loaded, select Scan Now. Or select the Threat Scan from the Scan menu.
  • When the scan is complete, make sure that all Threats are selected, and click Remove Selected.
  • Restart your computer when prompted to do so.
Is there anything else I need to do to get rid of Free_Ven?
  • No, Malwarebytes' Anti-Malware removes Free_Ven completely.
  • This PUP creates some scheduled tasks. You can read here how to check for and, if necessary, remove Scheduled Tasks.
How would the full version of Malwarebytes Anti-Malware help protect me?

We hope our application and this guide have helped you eradicate this hijacker.

As you can see below the full version of Malwarebytes Anti-Malware would have protected you against the Free_Ven hijacker. It would have warned you before the application could install itself, giving you a chance to stop it before it became too late.

protection1.png

and it stops the connections the browser hijacker tries to make:

protection2.png

Technical details for experts

No visible signs in a HijackThis log

You may see these entries in FRST logs:

 FF Extension: free_ven - C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com [2015-11-30] [not signed] C:\Windows\System32\Tasks\7a2cc1a0-fbfe-48ac-a0e6-ccca560b5371-5_user C:\Windows\System32\Tasks\7a2cc1a0-fbfe-48ac-a0e6-ccca560b5371-5 C:\Windows\Tasks\7a2cc1a0-fbfe-48ac-a0e6-ccca560b5371-5_user.job C:\Windows\Tasks\7a2cc1a0-fbfe-48ac-a0e6-ccca560b5371-5.job C:\Program Files (x86)\free_venfree_ven (HKLM-x32\...\free_ven) (Version: 1.36.01.22 - freeven) <==== ATTENTIONTask: {B7671EB4-D484-4733-A06C-4569D3653CBF} - System32\Tasks\7a2cc1a0-fbfe-48ac-a0e6-ccca560b5371-5_user => C:\Program Files (x86)\free_ven\7a2cc1a0-fbfe-48ac-a0e6-ccca560b5371-5.exe [2015-11-30] (freeven) <==== ATTENTIONTask: {DCFD7ABF-2F7F-4FB6-A5E5-A901302055FE} - System32\Tasks\7a2cc1a0-fbfe-48ac-a0e6-ccca560b5371-5 => C:\Program Files (x86)\free_ven\7a2cc1a0-fbfe-48ac-a0e6-ccca560b5371-5.exe [2015-11-30] (freeven) <==== ATTENTIONTask: C:\Windows\Tasks\7a2cc1a0-fbfe-48ac-a0e6-ccca560b5371-5.job => C:\Program Files (x86)\free_ven\7a2cc1a0-fbfe-48ac-a0e6-ccca560b5371-5.exe <==== ATTENTIONTask: C:\Windows\Tasks\7a2cc1a0-fbfe-48ac-a0e6-ccca560b5371-5_user.job => C:\Program Files (x86)\free_ven\7a2cc1a0-fbfe-48ac-a0e6-ccca560b5371-5.exe <==== ATTENTION
Alterations made by the installer:

File system details [View: All details] (Selection)---------------------------------------------------    Adds the folder C:\Program Files (x86)\free_ven       Adds the file 7a2cc1a0-fbfe-48ac-a0e6-ccca560b5371.xpi"="30/11/2015 08:51, 387075 bytes, A       Adds the file 7a2cc1a0-fbfe-48ac-a0e6-ccca560b5371-4.exe"="30/11/2015 08:51, 1441792 bytes, A       Adds the file 7a2cc1a0-fbfe-48ac-a0e6-ccca560b5371-5.exe"="30/11/2015 08:51, 1042944 bytes, A       Adds the file Uninstall.exe"="30/11/2015 08:51, 116736 bytes, A       Adds the file utils.exe"="30/11/2015 08:51, 1969403 bytes, A    Adds the folder C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com       Adds the file chrome.manifest"="30/11/2015 08:51, 732 bytes, A       Adds the file install.rdf"="30/11/2015 08:51, 1340 bytes, A    Adds the folder C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\chrome    Adds the folder C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\defaults\preferences       Adds the file prefs.js"="30/11/2015 08:51, 3965 bytes, A    Adds the folder C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\extensionData    Adds the folder C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\locale    Adds the folder C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\skin    In the existing folder C:\Windows\System32\Tasks       Adds the file 7a2cc1a0-fbfe-48ac-a0e6-ccca560b5371-5"="30/11/2015 08:51, 5458 bytes, A       Adds the file 7a2cc1a0-fbfe-48ac-a0e6-ccca560b5371-5_user"="30/11/2015 08:51, 5470 bytes, A    In the existing folder C:\Windows\Tasks       Adds the file 7a2cc1a0-fbfe-48ac-a0e6-ccca560b5371-5.job"="30/11/2015 08:51, 2428 bytes, A       Adds the file 7a2cc1a0-fbfe-48ac-a0e6-ccca560b5371-5_user.job"="30/11/2015 08:51, 2428 bytes, ARegistry details [View: All details] (Selection)------------------------------------------------    [HKEY_LOCAL_MACHINE\SOFTWARE\InstalledBrowserExtensions\21636]       "51680"="REG_SZ", "free_ven"    [HKEY_LOCAL_MACHINE\SOFTWARE\InstalledBrowserExtensions\21636\Status]       "Installed"="REG_DWORD", 1    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\CompatibilityAdapter\Signatures]       "7a2cc1a0-fbfe-48ac-a0e6-ccca560b5371-5.job"="REG_BINARY, ................................       "7a2cc1a0-fbfe-48ac-a0e6-ccca560b5371-5.job.fp"="REG_DWORD", 1970835184       "7a2cc1a0-fbfe-48ac-a0e6-ccca560b5371-5_user.job"="REG_BINARY, ................................       "7a2cc1a0-fbfe-48ac-a0e6-ccca560b5371-5_user.job.fp"="REG_DWORD", -199222638    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\AppDataLow\Software\Crossrider]       "Bic"="REG_SZ", "2f2bc621a7c304774b7408716c3e8213IE"       "Verifier"="REG_SZ", "6ef6eac254a7632839836d3cb24698df"    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\free_ven\accz1T9yecQICLFqs7Bo/kiDiLd2mRmqJ4a0TBJm2cCttLxf0B1zOXV22WrxrlAAZC6RPjvlN5wM4fs/9f5Shp/RyNJQH49oF9xO08uTbBpb9TEab9KYidHUlnEDutDdjOfC36SYTBwu/3AKYcvgxAN42jvIcjs1ENYdPuv0bTg=]       "n5qExiS2YeKOjhICpRoU4nP8p+M5li4yNngoX50bN/CTavNFfndeN9pRhvwzD1TpAxZR7RPXh8vgpEFHcbB3EDtmkJsxqeMBKYGFgw5gZaG+KKqzzeBXjkIecz3UmW/obUsak9ooTyuSkwfjirH85DV8X+GOqfysqHaGr3pGO6w="="REG_DWORD", 1    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\free_ven\cM0INLOYK5P8MkFkk1tsjBU4T9l3WPd/Qgdxsyh2E0T/BsAwH/k4Rj2EECZZt1ciMemylkjG3679hOmWo6NEywfKpo/9YrXZCYGVNTvY7cBYRPGBhDBiKpic6/3P93C+AESPcnUsFgZIIiEY8QMd5WwgJUrF70ZzuCeStu2ai+o=]       "DY60/WIjKrT37w6bupJIdS0/U9hv6nGuXt66KOEjZWnFhb2BC7E8nVALLvLF2lHR7KhvussUyYUip4LyWQu6tIe8sjJ8KfnHNntrqP5UpggHuZd/zMIApAJdgg3+VfwthwSq7zqkyzX04ZwsNZuoz1AOBkLBkwS2vRj40ye3pWI="="REG_DWORD", 1    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\free_ven\Installer]       "BundledFirefox"="REG_DWORD", 1    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\InstalledBrowserExtensions\21636]       "51680"="REG_SZ", "free_ven"    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\InstalledBrowserExtensions\21636\Status]       "Installed"="REG_DWORD", 1    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\free_ven]       "CrAppId"="REG_SZ", "51680"       "CrPublisherId"="REG_SZ", "21636"       "DisplayIcon"="REG_SZ", "C:\Program Files (x86)\free_ven\utils.exe"       "DisplayName"="REG_SZ", "free_ven"       "DisplayVersion"="REG_SZ", "1.36.01.22"       "Publisher"="REG_SZ", "freeven"       "UninstallString"="REG_SZ", "C:\Program Files (x86)\free_ven\Uninstall.exe /fcp=1  "    [HKEY_CURRENT_USER\Software\AppDataLow\Software\Crossrider]       "Bic"="REG_SZ", "2f2bc621a7c304774b7408716c3e8213IE"       "Verifier"="REG_SZ", "6ef6eac254a7632839836d3cb24698df"    [HKEY_CURRENT_USER\Software\InstalledBrowserExtensions\21636]       "51680"="REG_SZ", "free_ven"    [HKEY_CURRENT_USER\Software\InstalledBrowserExtensions\21636\Status]       "Installed"="REG_DWORD", 1    [HKEY_CURRENT_USER\Software\InstalledBrowserExtensions\freeven]       "51680"="REG_SZ", "free_ven"
Malwarebytes Anti-Malware log:

Malwarebytes Anti-Malwarewww.malwarebytes.orgScan Date: 30/11/2015Scan Time: 08:59Logfile: mbamFree_Ven.txtAdministrator: YesVersion: 2.2.0.1020Malware Database: v2015.11.30.01Rootkit Database: v2015.11.26.01License: PremiumMalware Protection: DisabledMalicious Website Protection: EnabledSelf-protection: DisabledOS: Windows 7 Service Pack 1CPU: x64File System: NTFSUser: {username}Scan Type: Threat ScanResult: CompletedObjects Scanned: 310402Time Elapsed: 4 min, 35 secMemory: EnabledStartup: EnabledFilesystem: EnabledArchives: EnabledRootkits: EnabledHeuristics: EnabledPUP: EnabledPUM: EnabledProcesses: 0(No malicious items detected)Modules: 0(No malicious items detected)Registry Keys: 10PUP.Optional.CrossRider, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\free_ven, Quarantined, [de4b7a0af39894a294f775394eb32bd5], PUP.Optional.CrossRider, HKLM\SOFTWARE\INSTALLEDBROWSEREXTENSIONS\21636, Quarantined, [6dbc8ef6c3c88da9823eb7c7b44fda26], PUP.Optional.CrossRider, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\7a2cc1a0-fbfe-48ac-a0e6-ccca560b5371-5, Delete-on-Reboot, [33f67014abe01b1b299c007e4db68977], PUP.Optional.CrossRider, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\7a2cc1a0-fbfe-48ac-a0e6-ccca560b5371-5_user, Delete-on-Reboot, [191089fb8cff60d63a8b6618ef14867a], PUP.Optional.Freeven, HKLM\SOFTWARE\WOW6432NODE\free_ven, Quarantined, [3dec7d07cbc0eb4bf9b1dda848bb7c84], PUP.Optional.CrossRider, HKLM\SOFTWARE\WOW6432NODE\APPDATALOW\SOFTWARE\Crossrider, Quarantined, [c861e79d860555e1dcdbafcf49bac33d], PUP.Optional.CrossRider, HKLM\SOFTWARE\WOW6432NODE\INSTALLEDBROWSEREXTENSIONS\21636, Quarantined, [a08960242c5fc670269af787e3203dc3], PUP.Optional.CrossRider, HKCU\SOFTWARE\APPDATALOW\SOFTWARE\Crossrider, Quarantined, [5ecbabd9afdc75c1cdc54c312ed56c94], PUP.Optional.CrossRider, HKCU\SOFTWARE\INSTALLEDBROWSEREXTENSIONS\21636, Quarantined, [89a0ff857912ba7cf8aedaa37d86e31d], PUP.Optional.CrossRider, HKCU\SOFTWARE\INSTALLEDBROWSEREXTENSIONS\freeven, Quarantined, [bf6a44403b5075c1c22ec1bcc93a956b], Registry Values: 0(No malicious items detected)Registry Data: 0(No malicious items detected)Folders: 14PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\skin, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\chrome, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\chrome\content, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\chrome\content\api, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\chrome\content\core, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\defaults, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\defaults\preferences, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\extensionData, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\extensionData\plugins, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\extensionData\userCode, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\locale, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\locale\en-US, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.Freeven, C:\Program Files (x86)\free_ven, Quarantined, [0722f490b3d8072f444ae199d13121df], Files: 118PUP.Optional.Freeven, C:\Users\{username}\Desktop\Tpiqtavqlkqsv.exe, Quarantined, [b970364edfac350147fcf03a8f72eb15], PUP.Optional.Freeven, C:\Program Files (x86)\free_ven\7a2cc1a0-fbfe-48ac-a0e6-ccca560b5371-4.exe, Quarantined, [17122b5955362214a89b23077a87956b], PUP.Optional.Freeven, C:\Program Files (x86)\free_ven\7a2cc1a0-fbfe-48ac-a0e6-ccca560b5371-5.exe, Quarantined, [f633abd9e4a7d165073ccb5f12efd729], PUP.Optional.CrossRider, C:\Program Files (x86)\free_ven\Uninstall.exe, Quarantined, [de4b7a0af39894a294f775394eb32bd5], PUP.Optional.Freeven, C:\Program Files (x86)\free_ven\utils.exe, Quarantined, [b4750084c2c9a98d89ba70baf20fc43c], PUP.Optional.CrossRider, C:\Windows\System32\Tasks\7a2cc1a0-fbfe-48ac-a0e6-ccca560b5371-5, Quarantined, [c762572d9bf0171fc24fb2bd8e75827e], PUP.Optional.CrossRider, C:\Windows\System32\Tasks\7a2cc1a0-fbfe-48ac-a0e6-ccca560b5371-5_user, Quarantined, [c663285c59320b2bf12019568b78b947], PUP.Optional.CrossRider, C:\Windows\Tasks\7a2cc1a0-fbfe-48ac-a0e6-ccca560b5371-5.job, Quarantined, [c366b1d34a412b0bd53d9cd3ca39b44c], PUP.Optional.CrossRider, C:\Windows\Tasks\7a2cc1a0-fbfe-48ac-a0e6-ccca560b5371-5_user.job, Quarantined, [9a8fc5bf89020234cd45d09fd62d15eb], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\skin\crossrider_statusbar.png, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\skin\button1.png, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\skin\button2.png, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\skin\button3.png, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\skin\button4.png, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\skin\button5.png, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\skin\icon128.png, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\skin\icon16.png, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\skin\icon24.png, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\skin\icon48.png, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\skin\panelarrow-up.png, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\skin\popup.html, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\skin\skin.css, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\skin\update.css, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\chrome.manifest, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\install.rdf, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\chrome\content\17af4ba44b595a1086c2e42f0d82c67e.js, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\chrome\content\438ec1bcd44387da243df5909bdb94d3.js, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\chrome\content\56ee162639911368bfcda12cfd8d2a13.js, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\chrome\content\59f7519f0fe0987caecb758777051ab9.js, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\chrome\content\6fd04f456706f20aef26a96cfcc86c76.js, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\chrome\content\7cd0ac0e95a0dd3eed54676661471c86.js, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\chrome\content\background.html, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\chrome\content\browser.xul, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\chrome\content\dialog.js, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\chrome\content\ffCoreFilesIndex.txt, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\chrome\content\options.js, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\chrome\content\options.xul, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\chrome\content\search_dialog.xul, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\chrome\content\api\6223bf8695f9817b74d1ba8751b27354.js, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\chrome\content\api\03b83b28ebbd969043e7e982e21ebfe4.js, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\chrome\content\api\1846f6d164ee52a9b8d6902b1a10e2a0.js, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\chrome\content\api\2aa31ba46d904a397ac742bdc640db52.js, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\chrome\content\api\2c0571a096827bbdd5ea3e4f98de0fbb.js, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\chrome\content\api\34d6676c443b28faa7637daaf260af0b.js, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\chrome\content\api\47791be47ea4359d91d0ebd8d2826260.js, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\chrome\content\api\49b2a33a8d9ef843de6df5f845ba592e.js, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\chrome\content\api\53329a3b081c8c8200df6913dc9f1a24.js, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\chrome\content\api\62277eb68bb29433a2e415c083f0fbce.js, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\chrome\content\api\799a4aa348378cdf38adfc47392cd68b.js, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\chrome\content\api\82012993a23cc487dee4a998f2e8c6a5.js, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\chrome\content\api\9c53cf3b481a789b1fec6379e6b39b64.js, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\chrome\content\api\a0890c89e1361ea7ab51ad83b010e1ee.js, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\chrome\content\api\d2680c2683b7416dc2f99f7e37ef7fbf.js, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\chrome\content\api\fcec3a031e011e790245e274f5297e2e.js, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\chrome\content\core\057ca3788d165da49ccd1f48c590a2ff.js, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\chrome\content\core\0fa845f138c783cab8abe8ff27bc59b5.js, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\chrome\content\core\160e88d9bdef707780b1bd01e5b7b959.js, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\chrome\content\core\20b227d3998fe436d2b9b45353647f69.js, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\chrome\content\core\222175b811c2991aaaba6d403be3affd.js, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\chrome\content\core\3cbf41f15a68fb1cf053417e36396956.js, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\chrome\content\core\49b8bf6abdf9a1fb1603aee916c23de2.js, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\chrome\content\core\4e14c6ca92422f9a5b25800465cadb74.js, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\chrome\content\core\6b1f8ca8482524a6d9f93c27feba3336.js, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\chrome\content\core\71809e6c3ec5db169f45628e97a4fafc.js, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\chrome\content\core\7273ad94e1a929cf7ebb1baa9279ca20.js, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\chrome\content\core\7b17120fa64a9df9e96bb1b6fed1b591.js, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\chrome\content\core\80b4100c1c38efb8172f52251fe75fdf.js, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\chrome\content\core\92a3aefbd0164450f5504043a00ffe07.js, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\chrome\content\core\99f7666bbfdfda2b217462420064f0b7.js, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\chrome\content\core\cf1ff3e102a0b3297c7621e14becf63b.js, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\chrome\content\core\d6f8fe081ed8b6a587d557ce4fa85c5f.js, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\chrome\content\core\dc4b8ac8fa51ea337b0ca34b03620ba0.js, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\chrome\content\core\eaa06baf5ab4c9730cf784a486636889.js, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\chrome\content\core\fd5ffe78dca932771d597bebfe00709a.js, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\chrome\content\core\installer.js, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\defaults\preferences\prefs.js, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\extensionData\manifest.xml, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\extensionData\plugins.json, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\extensionData\plugins\102.js, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\extensionData\plugins\13.js, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\extensionData\plugins\14.js, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\extensionData\plugins\16.js, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\extensionData\plugins\17.js, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\extensionData\plugins\180.js, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\extensionData\plugins\184.js, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\extensionData\plugins\192.js, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\extensionData\plugins\193.js, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\extensionData\plugins\220.js, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\extensionData\plugins\221.js, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\extensionData\plugins\223.js, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\extensionData\plugins\226.js, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\extensionData\plugins\230.js, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\extensionData\plugins\233.js, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\extensionData\plugins\244.js, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\extensionData\plugins\246.js, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\extensionData\plugins\253.js, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\extensionData\plugins\260.js, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\extensionData\plugins\273.js, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\extensionData\plugins\281.js, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\extensionData\plugins\311.js, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\extensionData\plugins\345.js, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\extensionData\plugins\354.js, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\extensionData\plugins\376.js, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\extensionData\plugins\385.js, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\extensionData\plugins\390.js, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\extensionData\plugins\391.js, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\extensionData\plugins\4.js, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\extensionData\plugins\47.js, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\extensionData\plugins\64.js, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\extensionData\plugins\7.js, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\extensionData\plugins\78.js, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\extensionData\plugins\9.js, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\extensionData\plugins\91.js, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\extensionData\userCode\background.js, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\extensionData\userCode\extension.js, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\d43e4d33-1c9f-4167-9600-b4929087f116@3cc778fb-659e-4988-abd4-592fc6b8806a.com\locale\en-US\translations.dtd, Quarantined, [ec3d99ebc5c6b77fab4563180af98e72], PUP.Optional.Freeven, C:\Program Files (x86)\free_ven\7a2cc1a0-fbfe-48ac-a0e6-ccca560b5371.xpi, Quarantined, [0722f490b3d8072f444ae199d13121df], PUP.Optional.CrossRider, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\prefs.js, Good: (), Bad: (user_pref("extensions.crossrider.bic", "1515760af6e9b3c95e88587c97e1cf96"), Replaced,[7eab98ec7219152191f24b460004e818]Physical Sectors: 0(No malicious items detected)(end)
As mentioned before the full version of Malwarebytes Anti-Malware could have protected your computer against this threat.

We use different ways of protecting your computer(s):

  • Dynamically Blocks Malware Sites & Servers
  • Malware Execution Prevention
Save yourself the hassle and get protected.
Link to post
Share on other sites

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.