# -------------------------------

# Malwarebytes AdwCleaner 7.1.0.0

# -------------------------------
# Build: 04-12-2018
# Database: 2018-04-19.1
# Support: https://www.malwarebytes.com/support
#
# -------------------------------
# Mode: Clean
# -------------------------------
# Start: 04-21-2018
# Duration: 00:00:05
# OS: Windows 7 Ultimate
# Cleaned: 91
# Failed: 0

***** [ Services ] *****

Deleted IBUpdaterService

***** [ Folders ] *****

Deleted C:\Program Files (x86)\Conduit

Deleted C:\Program Files (x86)\Tbccint
Deleted C:\Windows\System32\tprb
Deleted C:\Windows\SysWOW64\mjcm
Deleted C:\Windows\SysWOW64\WNLT
Deleted C:\Program Files (x86)\Perion
Deleted C:\Windows\System32\ljkb
Deleted C:\Windows\SysWOW64\jmdp
Deleted C:\Windows\System32\ARFC
Deleted C:\Windows\SysWOW64\ARFC
Deleted C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\ortmp
Deleted C:\Program Files\daugava
Deleted
C:\Windows\System32\config\systemprofile\AppData\LocalLow\COMPANY\PRODUCT
Deleted C:\Windows\System32\config\systemprofile\AppData\LocalLow\{D2020D47-
707D-4E26-B4D9-739C4F4C2E9A}
Deleted C:\ProgramData\apn

***** [ Files ] *****

Deleted C:\Users\CHELO\AppData\LocalLow\SkwConfig.bin
Deleted C:\Windows\System32\ImHttpComm.dll
Deleted C:\Windows\System32\dmwu.exe
Deleted C:\Windows\System32\config\systemprofile\AppData\LocalLow\SweetNT.crx

***** [ DLL ] *****

No malicious DLLs cleaned.

***** [ WMI ] *****

No malicious WMI cleaned.

***** [ Shortcuts ] *****

No malicious shortcuts cleaned.

***** [ Tasks ] *****

No malicious tasks cleaned.

***** [ Registry ] *****

Deleted HKLM\Software\Wow6432Node\Conduit
Deleted HKU\S-1-5-18\Software\Microsoft\Internet
Explorer\InternetRegistry\REGISTRY\USER\S-1-5-18\Software\IB Updater
Deleted HKU\.DEFAULT\Software\Microsoft\Internet
Explorer\InternetRegistry\REGISTRY\USER\S-1-5-18\Software\IB Updater
Deleted HKLM\Software\Wow6432Node\IB Updater
Deleted HKLM\Software\IB Updater
Deleted
HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WNLT
Deleted HKU\S-1-5-18\Software\WNLT
Deleted HKCU\Software\WNLT
Deleted HKU\.DEFAULT\Software\WNLT
Deleted HKLM\Software\WNLT
Deleted HKU\S-1-5-18\Software\ImInstaller
Deleted HKCU\Software\ImInstaller
Deleted HKU\.DEFAULT\Software\ImInstaller
Deleted HKLM\Software\Wow6432Node\Classes\AppID\escorTlbr.DLL
Deleted HKLM\SOFTWARE\Classes\AppID\escorTlbr.DLL
Deleted HKLM\Software\Wow6432Node\Classes\AppID\escort.DLL
Deleted HKLM\SOFTWARE\Classes\AppID\escort.DLL
Deleted HKLM\Software\Wow6432Node\Classes\Interface\{47A1DF02-BCE4-40C3-AE47-
E3EA09A65E4A}
Deleted HKLM\Software\Classes\Interface\{47A1DF02-BCE4-40C3-AE47-
E3EA09A65E4A}
Deleted HKLM\Software\Wow6432Node\Classes\Interface\{FA7B2795-C0C8-4A58-8672-
3F8D80CC0270}
Deleted HKLM\Software\Classes\Interface\{FA7B2795-C0C8-4A58-8672-
3F8D80CC0270}
Deleted HKLM\Software\Wow6432Node\Classes\TypeLib\{1112F282-7099-4624-A439-
DB29D6551552}
Deleted HKLM\Software\Classes\TypeLib\{1112F282-7099-4624-A439-DB29D6551552}
Deleted HKLM\Software\Classes\Interface\{F977D9F2-4BDC-44A6-B508-
7C0284C61EED}
Deleted HKLM\Software\Classes\Interface\{E450067F-1C93-41A7-928E-
07E5C2EEC680}
Deleted HKLM\Software\Classes\Interface\{D5961CC0-B442-4567-8030-
67E241EF4CC2}
Deleted HKLM\Software\Classes\Interface\{CFCD164E-8AC9-478E-9ECC-
B616A932016C}
Deleted HKLM\Software\Classes\Interface\{BF737694-56F6-46FA-9FDC-
FA99A5B25FAD}
Deleted HKLM\Software\Classes\Interface\{ABBB8A9E-D8AF-40D1-94BE-
5175077465FC}
Deleted HKLM\Software\Classes\Interface\{AA41A731-6814-4A70-A6F1-
C0A20FBBFBD5}
Deleted HKLM\Software\Classes\Interface\{A8321AA2-2227-40C7-8525-
6C2F4E1B0EBE}
Deleted HKLM\Software\Classes\Interface\{A36867C6-302D-49FC-9D8E-
1EB037B5F1AB}
Deleted HKLM\Software\Classes\Interface\{771B99AB-636F-4A11-9039-
8DFEB927B061}
Deleted HKLM\Software\Wow6432Node\Classes\AppID\{608D3067-77E8-463D-9084-
908966806826}
Deleted HKLM\Software\Classes\AppID\{608D3067-77E8-463D-9084-908966806826}
Deleted HKLM\Software\Classes\Interface\{45D5B93F-E2ED-4AF2-915E-
DCDDBDA8C33C}
Deleted HKLM\Software\Wow6432Node\Classes\CLSID\{3C471948-F874-49F5-B338-
4F214A2EE0B1}
Deleted HKLM\Software\Classes\Interface\{28ED590D-F5ED-4E05-A87F-
1D759F1C6169}
Deleted HKLM\Software\Classes\Interface\{255E0B2A-D747-4EEF-B7CE-
159D73A3656D}
Deleted HKLM\Software\Classes\Interface\{22B0769F-794B-4422-AC84-
47B123C8986D}
Deleted HKLM\Software\Wow6432Node\Classes\AppID\{09C554C3-109B-483C-A06B-
F14172F1A947}
Deleted HKLM\Software\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}
Deleted HKLM\Software\Wow6432Node\Classes\TypeLib\{4E1E9D45-8BF9-4139-915C-
9F83CC3D5921}
Deleted HKLM\Software\Classes\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
Deleted HKLM\Software\Wow6432Node\Classes\AppID\{4E1E9D45-8BF9-4139-915C-
9F83CC3D5921}
Deleted HKLM\Software\Classes\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
Deleted
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Firew
allRules|{955528F1-6811-4BA0-8C1B-104070A012B3}
Deleted
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Firew
allRules|{5C5BD315-AA9B-4377-A2A2-634AD55DAD78}
Deleted
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Firew
allRules|{1781905F-CAE7-4223-805D-218072B1462C}
Deleted
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Firew
allRules|{0048BB8D-5C5F-428D-9CB0-668E79B2999C}
Deleted
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Firew
allRules|{23042BF4-E863-48F8-A5FF-580B42C9AA80}
Deleted
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Firew
allRules|{2FD1896A-E099-41E1-A5F8-1021D228F16A}
Deleted
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Firew
allRules|{38E4D3D4-677D-4C44-8ED4-395A568B544F}
Deleted
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Firew
allRules|{9A07E6B6-80BC-49EF-AF87-EC334F41B74D}
Deleted
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Firew
allRules|{F8E0F1A6-6060-4E9F-8291-B90930D83029}
Deleted
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Firew
allRules|{82853EB7-E7BD-41C7-BCC3-C2D84E0F52DB}
Deleted HKCU\Software\Microsoft\Internet
Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-684535146-3646003283-3004173810-
1005\Software\SweetIM
Deleted HKU\S-1-5-18\Software\SweetIM
Deleted HKCU\Software\SweetIM
Deleted HKU\.DEFAULT\Software\SweetIM
Deleted HKLM\Software\Wow6432Node\SweetIM
Deleted HKLM\Software\SweetIM
Deleted
HKLM\Software\Wow6432Node\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\F53E693DDA
BF57A88A9B12B608B09B26C0608B74
Deleted
HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\F53E693DDABF57A88A9B12
B608B09B26C0608B74
Deleted
HKLM\Software\Wow6432Node\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\D830B6B893
9ACB4928401060203BB648456BB4F8
Deleted
HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\D830B6B8939ACB49284010
60203BB648456BB4F8
Deleted
HKLM\Software\Wow6432Node\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\A7BD54B233
B5B2F70AF86F5BD1A0C0A772A59FC6
Deleted
HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\A7BD54B233B5B2F70AF86F
5BD1A0C0A772A59FC6

***** [ Chromium (and derivatives) ] *****

Deleted IncrediBar for Chrome�

Deleted New Tab for Chrome
Deleted SweetPacks Chrome Extension

***** [ Chromium URLs ] *****

No malicious Chromium URLs cleaned.

***** [ Firefox (and derivatives) ] *****

No malicious Firefox entries cleaned.

***** [ Firefox URLs ] *****

No malicious Firefox URLs cleaned.

*************************

[+] Delete Tracing Keys

[+] Reset Winsock

*************************

########## EOF - C:\AdwCleaner\Logs\AdwCleaner[C00].txt ##########