~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Junkware Removal Tool (JRT) by Malwarebytes Version: 8.0.9 (09.30.2016) Operating System: Windows 7 Ultimate x86 Ran by ISSAM (Administrator) on 09/12/2016 at 1:07:24,04 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ File System: 14 Successfully deleted: C:\Users\ISSAM\AppData\Roaming\Mozilla\Firefox\Profiles\8w83ezy1.default\user.js (File) Successfully deleted: C:\Users\Public\Desktop\google.lnk (Shortcut) Successfully deleted: C:\Users\ISSAM\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\09JH4SS7 (Temporary Internet Files Folder) Successfully deleted: C:\Users\ISSAM\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3YNUOW96 (Temporary Internet Files Folder) Successfully deleted: C:\Users\ISSAM\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F31XZWG9 (Temporary Internet Files Folder) Successfully deleted: C:\Users\ISSAM\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JE1C3V53 (Temporary Internet Files Folder) Successfully deleted: C:\Users\ISSAM\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NZN8RN8X (Temporary Internet Files Folder) Successfully deleted: C:\Users\ISSAM\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RCUN5BK1 (Temporary Internet Files Folder) Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\09JH4SS7 (Temporary Internet Files Folder) Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3YNUOW96 (Temporary Internet Files Folder) Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F31XZWG9 (Temporary Internet Files Folder) Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JE1C3V53 (Temporary Internet Files Folder) Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NZN8RN8X (Temporary Internet Files Folder) Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RCUN5BK1 (Temporary Internet Files Folder) Deleted the following from C:\Users\ISSAM\AppData\Roaming\Mozilla\Firefox\Profiles\8w83ezy1.default\prefs.js user_pref(browser.newtabpage.pinned, [{\url\:\hxxp://www.yandex.ru/?win=241&clid=2100780-004\,\title\:\Яндекс\},{\url\:\hxxp://market.yandex.ru/?from=dist_ user_pref(extensions.vb@yandex.ru.alarms.advertisementCheck, {\expires\:30,\nextInterval\:30,\saved\:1481219980957}); user_pref(extensions.vb@yandex.ru.alarms.backgroundsRotation, {\expires\:1440,\nextInterval\:1440,\saved\:1481155320768}); user_pref(extensions.vb@yandex.ru.alarms.backup, {\expires\:1440,\nextInterval\:1440,\saved\:1481155320807}); user_pref(extensions.vb@yandex.ru.alarms.blacklistSync, {\expires\:1440,\nextInterval\:1440,\saved\:1481155320770}); user_pref(extensions.vb@yandex.ru.alarms.cloudBackgrounds, {\expires\:1440,\nextInterval\:1440,\saved\:1481155320894}); user_pref(extensions.vb@yandex.ru.alarms.dayusePoll, {\expires\:60,\nextInterval\:60,\saved\:1481219980958}); user_pref(extensions.vb@yandex.ru.alarms.dayuseSimple, {\expires\:1440,\nextInterval\:1440,\saved\:1481155320897}); user_pref(extensions.vb@yandex.ru.alarms.experiments, {\expires\:1440,\nextInterval\:1440,\saved\:1481155320773}); user_pref(extensions.vb@yandex.ru.alarms.informers, {\expires\:15,\nextInterval\:15,\saved\:1481219980954}); user_pref(extensions.vb@yandex.ru.alarms.maintenance, {\expires\:2880,\nextInterval\:2880,\saved\:1481149380755}); user_pref(extensions.vb@yandex.ru.alarms.pickup, {\expires\:1440,\nextInterval\:1440,\saved\:1481155320814}); user_pref(extensions.vb@yandex.ru.alarms.refreshSearchExamples, {\expires\:1440,\nextInterval\:1440,\saved\:1481155320809}); user_pref(extensions.vb@yandex.ru.alarms.remote-config, {\expires\:1440,\nextInterval\:1440,\saved\:1481155320765}); user_pref(extensions.vb@yandex.ru.alarms.zen.reload, {\expires\:360,\saved\:1481219995399}); user_pref(extensions.vb@yandex.ru.default.preferedLocale, ru); user_pref(extensions.vb@yandex.ru.getAddons.cache.enabled, false); user_pref(extensions.vb@yandex.ru.guid.value, {8ABDCCB8-F861-4A99-B3F4-612DACDA4590}); user_pref(extensions.vb@yandex.ru.sdk.baseURI, resource://vb-at-yandex-dot-ru/); user_pref(extensions.vb@yandex.ru.sdk.domain, vb-at-yandex-dot-ru); user_pref(extensions.vb@yandex.ru.sdk.load.reason, startup); user_pref(extensions.vb@yandex.ru.sdk.rootURI, jar:file:///C:/Users/ISSAM/AppData/Roaming/Mozilla/Firefox/Profiles/8w83ezy1.default/extensions/vb@yandex.ru.xpi!/); user_pref(extensions.vb@yandex.ru.sdk.version, 2.31.3); user_pref(extensions.vb@yandex.ru.stat.usage.send, false); user_pref(extensions.vb@yandex.ru.status.firstStart, 1471031775189); user_pref(extensions.vb@yandex.ru.status.lastCollect, 1481187537203); user_pref(extensions.vb@yandex.ru.versions.lastAddon, 2.31.3); user_pref(extensions.vb@yandex.ru.versions.lastBuild, 15); user_pref(extensions.xpiState, {\app-profile\:{\eagleget_ffext@eagleget.com\:{\d\:\C:\\\\Users\\\\ISSAM\\\\AppData\\\\Roaming\\\\Mozilla\\\\Firefox\\\\Profiles\\\\8w Registry: 8 Successfully deleted: HKLM\SYSTEM\CurrentControlSet\services\TSCPM (Registry Key) Successfully deleted: HKCU\Software\Microsoft\Internet Explorer\Main\\Start Page (Registry Value) Successfully deleted: HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{093F479D-712E-46CD-9E06-62E734A05F68} (Registry Value) Successfully deleted: HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{91397D20-1446-11D4-8AF4-0040CA1127B6} (Registry Value) Successfully deleted: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} (Registry Key) Successfully deleted: HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2E38825B-8815-42CF-9126-C58BC28D4591} (Registry Key) Successfully deleted: HKLM\Software\Microsoft\Internet Explorer\Main\\Start Page (Registry Value) Successfully deleted: HKLM\Software\Microsoft\Internet Explorer\Toolbar\\{093F479D-712E-46CD-9E06-62E734A05F68} (Registry Value) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Scan was completed on 09/12/2016 at 1:09:54,25 End of JRT log ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~