~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Junkware Removal Tool (JRT) by Thisisu Version: 6.1.2 (02.20.2014:1) OS: Windows 8.1 x64 Ran by nathalie on 15/03/2014 at 18:14:36,77 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~ Services ~~~ Registry Values Successfully repaired: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\\Start Page Successfully repaired: [Registry Value] HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main\\Start Page Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Main\\Start Page Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-19\Software\Microsoft\Internet Explorer\Main\\Start Page Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-20\Software\Microsoft\Internet Explorer\Main\\Start Page Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-21-3083540073-2572008181-1471925643-1001\Software\Microsoft\Internet Explorer\Main\\Start Page Successfully deleted: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{D4027C7F-154A-4066-A1AD-4243D8127440} ~~~ Registry Keys Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\protector_dll.protectorbho Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\protector_dll.protectorbho.1 Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\s Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{199E2824-1AB7-4BD6-95D8-AD1DBA13F9B2} Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{95BDB134-4BD3-4296-9427-9E38FE441D76} ~~~ Files ~~~ Folders Successfully deleted: [Folder] "C:\ProgramData\apn" Successfully deleted: [Folder] "C:\ProgramData\systweak" Successfully deleted: [Folder] "C:\Users\nathalie\AppData\Roaming\optimizer pro" Successfully deleted: [Folder] "C:\Users\nathalie\AppData\Roaming\systweak" Successfully deleted: [Folder] "C:\Users\nathalie\appdata\local\software" Successfully deleted: [Folder] "C:\Users\nathalie\appdata\locallow\softonic" Successfully deleted: [Folder] "C:\Program Files (x86)\advanced system protector" Successfully deleted: [Folder] "C:\Program Files (x86)\iminent" Successfully deleted: [Folder] "C:\Program Files (x86)\mypc backup" Successfully deleted: [Folder] "C:\Program Files (x86)\optimizer pro" Successfully deleted: [Folder] "C:\Program Files (x86)\software" Successfully deleted: [Folder] "C:\Users\nathalie\documents\optimizer pro" Successfully deleted: [Folder] "C:\ProgramData\ask" ~~~ FireFox Successfully deleted: [File] C:\Users\nathalie\AppData\Roaming\mozilla\firefox\profiles\qaajlq2b.default\user.js Successfully deleted: [File] C:\Users\nathalie\AppData\Roaming\mozilla\firefox\profiles\qaajlq2b.default\searchplugins\askcom.xml Successfully deleted: [File] C:\Users\nathalie\AppData\Roaming\mozilla\firefox\profiles\qaajlq2b.default\searchplugins\softonic.xml Successfully deleted: [Folder] C:\Users\nathalie\AppData\Roaming\mozilla\firefox\profiles\qaajlq2b.default\extensions\ffxtlbra@softonic.com Successfully deleted: [Folder] C:\Users\nathalie\AppData\Roaming\mozilla\firefox\profiles\qaajlq2b.default\extensions\staged Successfully deleted the following from C:\Users\nathalie\AppData\Roaming\mozilla\firefox\profiles\qaajlq2b.default\prefs.js user_pref("extensions.Softonic.admin", false); user_pref("extensions.Softonic.aflt", "SD"); user_pref("extensions.Softonic.appId", "{7ABBFE1C-E485-44AA-8F36-353751B4124D}"); user_pref("extensions.Softonic.autoRvrt", "false"); user_pref("extensions.Softonic.cntry", "FR"); user_pref("extensions.Softonic.dfltLng", ""); user_pref("extensions.Softonic.dfltSrch", true); user_pref("extensions.Softonic.dnsErr", true); user_pref("extensions.Softonic.dpkLst", "3654782829,1334533236,1121012847,231756876,1895130307,603719297,4288797614,3754950497,426401714,3046281807,752626116,1657571787,322493 user_pref("extensions.Softonic.excTlbr", false); user_pref("extensions.Softonic.ffxUnstlRst", false); user_pref("extensions.Softonic.hdrMd5", "4DBEBD34BE6F1EFCF9E085CE3A498647"); user_pref("extensions.Softonic.hmpg", true); user_pref("extensions.Softonic.hmpgUrl", "hxxp://search.softonic.com/MOY00092/tb_v1?SearchSource=13&cc="); user_pref("extensions.Softonic.hpOld0", "hxxp://www.google.fr/ig"); user_pref("extensions.Softonic.id", "ac971a95000000000000689423448dba"); user_pref("extensions.Softonic.instlDay", "15797"); user_pref("extensions.Softonic.instlRef", "MOY00092"); user_pref("extensions.Softonic.kw_url", "hxxp://search.softonic.com/MOY00092/tb_v1?SearchSource=2&cc=&q="); user_pref("extensions.Softonic.lastB", "hxxp://search.softonic.com/MOY00092/tb_v1?SearchSource=13&cc="); user_pref("extensions.Softonic.lastVrsnTs", "1.8.16.1021:06:43"); user_pref("extensions.Softonic.newTab", true); user_pref("extensions.Softonic.newTabUrl", "hxxp://search.softonic.com/MOY00092/tb_v1?SearchSource=15&cc="); user_pref("extensions.Softonic.pnu_BASEirobinhoodActive", "{\"newVrsn\":\"53\",\"lastVrsn\":\"53\",\"vrsnLoad\":\"\",\"showMsg\":\"false\",\"showSilent\":\"true\",\"msgTs\":0, user_pref("extensions.Softonic.prdct", "Softonic"); user_pref("extensions.Softonic.prtnrId", "softonic"); user_pref("extensions.Softonic.rvrt", "true"); user_pref("extensions.Softonic.sg", "none"); user_pref("extensions.Softonic.smplGrp", "none"); user_pref("extensions.Softonic.srchPrvdr", "Search the web (Softonic)"); user_pref("extensions.Softonic.storage\\storage\\mpvfloatingwindmutex", "208706833170522@@@Sat Mar 15 2014 17:18:22 GMT+0100"); user_pref("extensions.Softonic.storage\\storage\\mpvinpagemutex", "1368614c740bbc515d4ad8592c238fe2@@@Sat Mar 15 2014 18:07:10 GMT+0100"); user_pref("extensions.Softonic.tlbrId", "BASEirobinhoodActive"); user_pref("extensions.Softonic.tlbrSrchUrl", "hxxp://search.softonic.com/MOY00092/tb_v1?SearchSource=1&cc=&q="); user_pref("extensions.Softonic.vrsn", "1.8.16.10"); user_pref("extensions.Softonic.vrsnTs", "1.8.16.1021:06:43"); user_pref("extensions.Softonic.vrsni", "1.8.16.10"); user_pref("extensions.crossrider.bic", "144b132cb7c0b4131cc165be01d438b7"); user_pref("iminent.LayoutId", "1"); user_pref("iminent.ShowThankyouPixel", "0"); user_pref("iminent.adapters", "{\"avg\":{\"CountryCode\":\"FR\",\"NoAds\":false,\"Status\":2,\"expireTime\":\"13944848550051814400\"},\"cnet\":{\"CountryCode\":\"FR\",\"NoAds\ user_pref("iminent.externalScripts", "{\"value\":[{\"addonUid\":\"10bb6277-6b2b-413e-8d82-ad9398543254\",\"name\":\"Dealply\",\"addonId\":1,\"url\":\"//i.iminentjs.info/imitin user_pref("iminent.externalScripts.iRobinHood.IROBPKG", "{\"pkgid\":\"wrDCtMKxwrLCucK0wrjCtMKw\",\"raw_pkgid\":\"150385951\"}"); user_pref("iminent.externalScripts.iRobinHood.irobsettings", "[{\"TM\":\"29212.7\",\"IA\":\"1\",\"HU\":\"hxxp://iminent.donation-tools.org/home.aspx\",\"CC\":\"Fight Cancer\", user_pref("iminent.externalScripts.iRobinHood.menuURL", "hxxp://iminent.donation-tools.org/home.aspx?pkgId=wrDCtMKxwrLCucK0wrjCtMKw"); user_pref("iminent.registerToolbarEvent102", "1394902825229"); user_pref("iminent.registerToolbarEvent109", "1394622107607"); user_pref("iminent.registerToolbarEvent111", "1394622107612"); user_pref("iminent.registerToolbarEvent112", "1394622109315"); user_pref("iminent.registerToolbarEvent122", "1394622107617"); user_pref("iminent.trackExternalScripts1", "1394484856560"); user_pref("iminent.trackExternalScripts2", "1394484856563"); user_pref("iminent.trackExternalScripts3", "1394621527007"); user_pref("iminent.trackingInfo", "{\"state\":0,\"samplingRate\":0}"); user_pref("iminent.version", "8.10.2.1"); user_pref("iminent.versioning", "{\"CurrentVersion\":\"8.10.2.1\",\"InstallEventCTime\":1394484804603,\"InstallEvent\":\"True\"}"); Emptied folder: C:\Users\nathalie\AppData\Roaming\mozilla\firefox\profiles\qaajlq2b.default\minidumps [29 files] ~~~ Event Viewer Logs were cleared ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Scan was completed on 15/03/2014 at 18:19:23,52 End of JRT log ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~