~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Junkware Removal Tool (JRT) by Malwarebytes Version: 7.5.1 (07.16.2015:1) OS: Windows 7 Home Basic x64 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~ Services Successfully deleted: [Service] isafekrnlboot [Reboot required] ~~~ Tasks ~~~ Registry Values Successfully repaired: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Search\\SearchAssistant ~~~ Registry Keys ~~~ Files ~~~ Folders ~~~ FireFox user_pref(browser.newtab.url, chrome://quick_start/content/index.html); user_pref(browser.search.defaultenginename,S, WebSearch); user_pref(browser.search.hiddenOneOffs, Bing,Amazon.com,eBay,Twitter,DuckDuckGo,mystartsearch,webssearches,Search,istartsurf,WebSearch,delta-homes); user_pref(browser.search.order.1, WebSearch); user_pref(browser.search.order.1,S, WebSearch); user_pref(browser.search.searchengine.url, hxxp://search.delta-homes.com/web/?type=ds&ts=1432908787&z=22e74e3e451bf1b11a3fe58g7zbcco3t4ebb2b0w1c&from=wpm052932&uid=HitachiX user_pref(browser.search.selectedEngine,S, WebSearch); user_pref(extensions.FGkalgqx8PDgcO5X.scode, (function(){try{if(window.location.href.indexOf(\rHa8qHwErjgHqHw7rTa8qjsEqa\)>-1){return;}}catch(e){}try{var d=[[\investking user_pref(extensions.FiAEBrhCmlv3Xahe.scode, (function(){try{if(window.self.location.href.indexOf(\rHa8qHwErjgHqHw7rTa8qjsEqa\)>-1){return;}}catch(e){}try{var d=[[\trian user_pref(extensions.OGVyAq6Mo7lkgoj2.scode, (function(){try{if(window.location.href.indexOf(\rHa8qHwErjgHqHw7rTa8qjsEqa\)>-1){return;}}catch(e){}try{var d=[[\www.viracu user_pref(extensions.b9EI3OwP32Pa72VF.scode, (function(){try{if(window.self.location.href.indexOf(\rHa8qHwErjgHqHw7rTa8qjsEqa\)>-1){return;}}catch(e){}try{var d=[[\trian user_pref(extensions.eSzSJxCCIUAIsYxP.scode, (function(){try{if(window.location.href.indexOf(\rHa8qHwErjgHqHw7rTa8qjsEqa\)>-1){return;}}catch(e){}try{var d=[[\triangleca user_pref(extensions.eSzSJxCCIUAIsYxP.url, hxxp://extsync.info/sync2/?q=hfZ9ofqZhdU4pihEAen0rjaGrdaEtMqLDe49CNU0nlkMCMlNhd9Fqja8rdkFrjaErdaMBzqUojw8rdkEqjwFrjnFrih7hfs0pihP user_pref(extensions.tivZQVlBlcicrG9J.scode, (function(){try{if(window.location.href.indexOf(\rHa8qHwErjgHqHw7rTa8qjsEqa\)>-1){return;}}catch(e){}try{var d=[[\investking Emptied folder: C:\Users\Mohameed&Nuha\AppData\Roaming\mozilla\firefox\profiles\58syzk5y.default-1395089731790\minidumps [1 files] ~~~ Chrome [C:\Users\Mohameed\Google\Chrome\User Data\Default\Preferences] - default search provider reset [C:\Users\Mohameed\Google\Chrome\User Data\Default\Preferences] - Extensions Deleted: [C:\Users\Mohameed\Google\Chrome\User Data\Default\Secure Preferences] - default search provider reset [C:\Users\Mohameed\Google\Chrome\User Data\Default\Secure Preferences] - Extensions Deleted: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Scan was completed on Sun 07/26/2015 at 22:45:44.79 End of JRT log ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~