# AdwCleaner v6.

021 - Logfile created 07/12/2016 at 00:08:33

# Updated on 06/10/2016 by ToolsLib
# Database : 2016-10-18.1 [Local]
# Operating System : Windows 10 Pro (X64)
# Username : welcome - DESKTOP-K68NGJB
# Running from : C:\Users\welcome\Downloads\AdwCleaner.exe
# Mode: Scan
# Support : https://toolslib.net/forum

***** [ Services ] *****

Service Found: Policies

Service Found: GoogleChromeUpService
Service Found: BugFixxer
Service Found: WindowsSecurity
Service Found: MaohaWifiNetPro
Service Found: MaohaWifiSvr

***** [ Folders ] *****

Folder Found: C:\Program Files (x86)\61DB1CB9-1481021873-E611-B27E-EC8EB50EB431

Folder Found: C:\Users\welcome\AppData\Roaming\Note-up
Folder Found: C:\Users\welcome\AppData\Roaming\VDI
Folder Found: C:\Users\welcome\AppData\Roaming\Microsoft\Windows\Start
Menu\ByteFence
Folder Found: C:\ProgramData\Windows Security
Folder Found: C:\ProgramData\Thunder Network
Folder Found: C:\ProgramData\Application Data\Windows Security
Folder Found: C:\ProgramData\Application Data\Thunder Network
Folder Found: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MaohaWiFi
Folder Found: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MaohaWifi
Folder Found: C:\Program Files (x86)\OtherSearch
Folder Found: C:\Program Files (x86)\DPower
Folder Found: C:\Windows\BugFixxer
Folder Found: C:\Program Files (x86)\DPower

***** [ Files ] *****

File Found: C:\Windows\SysNative\drivers\1a9a3100dc53b8338434a861c73ba7c3.sys

File Found: C:\Users\welcome\AppData\Roaming\Microsoft\Internet Explorer\Quick
Launch\MaohaWiFi.lnk
File Found: C:\ProgramData\service.exe
File Found: C:\ProgramData\Application Data\service.exe
File Found: C:\ProgramData\service.exe

***** [ DLL ] *****

No malicious DLLs found.

***** [ WMI ] *****

Key Found: : \root\subscription\\ActiveScriptEventConsumer [ASEC]

***** [ Shortcuts ] *****

No infected shortcut found.

***** [ Scheduled Tasks ] *****

No malicious task found.

***** [ Registry ] *****

Key Found: HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Application\Policies

Key Found: [x64]
HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Application\Policies
Key Found: HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Application\SYSSECURE
Key Found: [x64]
HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Application\SYSSECURE
Key Found:
HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Application\GoogleChromeUpService
Key Found: [x64]
HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Application\GoogleChromeUpService
Key Found: HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Application\BugFixxer
Key Found: [x64]
HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Application\BugFixxer
Key Found: HKU\S-1-5-21-1168519326-309544570-3247456480-1001\Software\Installer
Key Found: HKU\S-1-5-21-1168519326-309544570-3247456480-1001\Software\PRODUCTSETUP
Key Found: HKU\S-1-5-21-1168519326-309544570-3247456480-1001\Software\csastats
Key Found: HKU\S-1-5-21-1168519326-309544570-3247456480-1001\Software\Maoha
Key Found: HKU\S-1-5-21-1168519326-309544570-3247456480-1001\Software\VDI
Key Found: HKCU\Software\Installer
Key Found: HKCU\Software\PRODUCTSETUP
Key Found: HKCU\Software\csastats
Key Found: HKCU\Software\Maoha
Key Found: HKCU\Software\VDI
Key Found: HKLM\SOFTWARE\SkypeUpdateEx
Key Found: HKLM\SOFTWARE\youndooSoftware
Key Found: HKLM\SOFTWARE\OtherSearch
Key Found: HKLM\SOFTWARE\Maoha
Key Found: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ASPackage
Key Found: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\YSPackage
Key Found: [x64] HKCU\Software\Installer
Key Found: [x64] HKCU\Software\PRODUCTSETUP
Key Found: [x64] HKCU\Software\csastats
Key Found: [x64] HKCU\Software\Maoha
Key Found: [x64] HKCU\Software\VDI
Data Found: HKU\S-1-5-21-1168519326-309544570-3247456480-
1001\Software\Microsoft\Internet Explorer\Main [Search Page] - hxxp://
%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?
p=mKO_AwFzXIpYRaHdGKA1J11u
Data Found: HKU\S-1-5-21-1168519326-309544570-3247456480-
1001\Software\Microsoft\Internet Explorer\Main [Search Bar] - hxxp://
%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?
p=mKO_AwFzXIpYRaHdGKA1J11uX
Data Found: HKU\S-1-5-21-1168519326-309544570-3247456480-
1001\Software\Microsoft\Internet Explorer\Main [SearchAssistant] - hxxp://
%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKA1
Data Found: HKU\S-1-5-21-1168519326-309544570-3247456480-
1001\Software\Microsoft\Internet Explorer\Search [Default_Search_URL] - hxxp://
%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaH
Data Found: HKU\S-1-5-21-1168519326-309544570-3247456480-
1001\Software\Microsoft\Internet Explorer\SearchUrl [Default] - hxxp://
%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?
p=mKO_AwFzXIpYRaHdGKA1J11
Data Found: HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchUrl [Default] -
hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?
p=mKO_AwFzXIpYRaHdGKA1J11uXjiR7YVSkPeiIOUF2GuZQz4GqlsvEv1SCWl-546Oh4Xo
Data Found: HKCU\Software\Microsoft\Internet Explorer\Main [Search Page] - hxxp://
%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?
p=mKO_AwFzXIpYRaHdGKA1J11uXjiR7YVSkPeiIOUF2GuZQz4GqlsvEv1SCWl-546Oh4Xo4
Data Found: HKCU\Software\Microsoft\Internet Explorer\Main [Search Bar] - hxxp://
%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?
p=mKO_AwFzXIpYRaHdGKA1J11uXjiR7YVSkPeiIOUF2GuZQz4GqlsvEv1SCWl-546Oh4Xo4W
Data Found: HKCU\Software\Microsoft\Internet Explorer\Main [SearchAssistant] -
hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?
p=mKO_AwFzXIpYRaHdGKA1J11uXjiR7YVSkPeiIOUF2GuZQz4GqlsvEv1SCWl-546Oh
Data Found: HKCU\Software\Microsoft\Internet Explorer\Search [Default_Search_URL]
- hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?
p=mKO_AwFzXIpYRaHdGKA1J11uXjiR7YVSkPeiIOUF2GuZQz4GqlsvEv1SCWl-
Data Found: HKCU\Software\Microsoft\Internet Explorer\SearchUrl [Default] -
hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?
p=mKO_AwFzXIpYRaHdGKA1J11uXjiR7YVSkPeiIOUF2GuZQz4GqlsvEv1SCWl-546Oh4Xo
Data Found: [x64] HKCU\Software\Microsoft\Internet Explorer\Main [Search Page] -
hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?
p=mKO_AwFzXIpYRaHdGKA1J11uXjiR7YVSkPeiIOUF2GuZQz4GqlsvEv1SCWl-546Oh4X
Data Found: [x64] HKCU\Software\Microsoft\Internet Explorer\Main [Search Bar] -
hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?
p=mKO_AwFzXIpYRaHdGKA1J11uXjiR7YVSkPeiIOUF2GuZQz4GqlsvEv1SCWl-546Oh4Xo
Data Found: [x64] HKCU\Software\Microsoft\Internet Explorer\Main [SearchAssistant]
- hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?
p=mKO_AwFzXIpYRaHdGKA1J11uXjiR7YVSkPeiIOUF2GuZQz4GqlsvEv1SCWl-546
Data Found: [x64] HKCU\Software\Microsoft\Internet Explorer\Search
[Default_Search_URL] - hxxp://%66%65%65%64.%73%6F%6E%69%63-
%73%65%61%72%63%68.%63%6F%6D/?
p=mKO_AwFzXIpYRaHdGKA1J11uXjiR7YVSkPeiIOUF2GuZQz4GqlsvEv1SCW
Data Found: [x64] HKCU\Software\Microsoft\Internet Explorer\SearchUrl [Default] -
hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?
p=mKO_AwFzXIpYRaHdGKA1J11uXjiR7YVSkPeiIOUF2GuZQz4GqlsvEv1SCWl-546Oh4
Key Found: HKU\S-1-5-21-1168519326-309544570-3247456480-
1001\Software\Microsoft\Internet Explorer\SearchScopes\{D2D73A08-70B6-49F9-BAE2-
185BD617E4EC}
Key Found: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{D2D73A08-70B6-
49F9-BAE2-185BD617E4EC}
Value Found: HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes [DefaultScope]
Key Found: [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{D2D73A08-
70B6-49F9-BAE2-185BD617E4EC}
Key Found: HKCU\Software\Microsoft\Internet Explorer\DOMStorage\castplatform.com
Key Found: HKCU\Software\Microsoft\Internet
Explorer\DOMStorage\cdn.castplatform.com
Key Found: HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\www-
searching.com
Key Found: HKCU\Software\Classes\Local
Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.m
icrosoftedge_8wekyb3d8bbwe\Children\001\Internet
Explorer\EdpDomStorage\piroga.space
Key Found: HKCU\Software\Classes\Local
Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.m
icrosoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\www-
searching.com
Key Found: HKCU\Software\Classes\Local
Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.m
icrosoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\piroga.space
Key Found: HKCU\Software\Classes\Local
Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.m
icrosoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\www-
searching.com
Key Found: [x64] HKCU\Software\Microsoft\Internet
Explorer\DOMStorage\castplatform.com
Key Found: [x64] HKCU\Software\Microsoft\Internet
Explorer\DOMStorage\cdn.castplatform.com
Key Found: [x64] HKCU\Software\Microsoft\Internet
Explorer\LowRegistry\DOMStorage\www-searching.com
Key Found: [x64] HKCU\Software\Classes\Local
Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.m
icrosoftedge_8wekyb3d8bbwe\Children\001\Internet
Explorer\EdpDomStorage\piroga.space
Key Found: [x64] HKCU\Software\Classes\Local
Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.m
icrosoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\www-
searching.c
Key Found: [x64] HKCU\Software\Classes\Local
Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.m
icrosoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\piroga.space
Key Found: [x64] HKCU\Software\Classes\Local
Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.m
icrosoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\www-
searching.com
Value Found: [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
[SpaceSoundPro]
Value Found: HKU\S-1-5-21-1168519326-309544570-3247456480-
1001\Software\Microsoft\Windows\CurrentVersion\Run [msiql]
Value Found: HKCU\Software\Microsoft\Windows\CurrentVersion\Run [msiql]
Value Found: [x64] HKCU\Software\Microsoft\Windows\CurrentVersion\Run [msiql]
Key Found: HKLM\SOFTWARE\CLASSES\APPID\56BF5154-0B48-4ADB-902A-6C8B12E270D9

***** [ Web browsers ] *****

No malicious Firefox based browser items found.

No malicious Chromium based browser items found.

*************************

C:\AdwCleaner\AdwCleaner[C0].txt - [5990 Bytes] - [19/10/2016 12:05:25]

C:\AdwCleaner\AdwCleaner[S0].txt - [3464 Bytes] - [30/09/2016 05:58:42]
C:\AdwCleaner\AdwCleaner[S1].txt - [5519 Bytes] - [19/10/2016 12:03:58]
C:\AdwCleaner\AdwCleaner[S2].txt - [10794 Bytes] - [07/12/2016 00:08:33]

########## EOF - C:\AdwCleaner\AdwCleaner[S2].txt - [10868 Bytes] ##########