~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Junkware Removal Tool (JRT) by Thisisu Version: 6.0.8 (11.05.

2013:1) OS: Windows 7 Ultimate x86 Ran by riwanti on 11/12/2013 at 19:16:40,27 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

~~~ Registry Values Successfully repaired: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Int ernet Explorer\Main\\Start Page Successfully repaired: [Registry Value] HKEY_USERS\.DEFAULT\Software\Microsoft\I nternet Explorer\Main\\Start Page Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-18\Software\Microsoft\I nternet Explorer\Main\\Start Page Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-19\Software\Microsoft\I nternet Explorer\Main\\Start Page Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-20\Software\Microsoft\I nternet Explorer\Main\\Start Page Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-21-4247993484-125918029 8-1409416275-1000\Software\Microsoft\Internet Explorer\Main\\Start Page Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\In ternet Explorer\Main\\Start Page

~~~ Registry Keys Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\AppDataLow\sprot ector Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Traci ng\au__rasapi32 Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Traci ng\au__rasmancs Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Traci ng\torchsetupfull_rasapi32 Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Traci ng\torchsetupfull_rasmancs Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Intern et Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2001} Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Intern et Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2102} Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Intern et Explorer\SearchScopes\{BB74DE59-BC4C-4172-9AC4-73315F71CFFE} Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Inter net Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2001} Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Inter net Explorer\SearchScopes\{BB74DE59-BC4C-4172-9AC4-73315F71CFFE}

~~~ Files

~~~ Folders Successfully deleted: [Folder] "C:\Users\riwanti\appdata\local\torch"

~~~ FireFox Successfully deleted: [File] C:\Users\riwanti\AppData\Roaming\mozilla\firefox\pr ofiles\vfhearco.default-1385781745186\searchplugins\websearch.xml Successfully deleted the following from C:\Users\riwanti\AppData\Roaming\mozilla \firefox\profiles\vfhearco.default-1385781745186\prefs.js user_pref("aol_toolbar.default.homepage.check", false); user_pref("aol_toolbar.default.search.check", false); user_pref("browser.search.defaultenginename,S", "WebSearch"); user_pref("browser.search.defaulturl", "hxxp://websearch.searchbomb.info/?pid=29 8&r=2013/12/04&hid=6335905983099743324&lg=EN&cc=ID&unqvl=42&l=1&q="); user_pref("browser.search.order.1", "WebSearch"); user_pref("browser.search.order.1,S", "WebSearch"); user_pref("browser.search.selectedEngine,S", "WebSearch"); user_pref("browser.startup.homepage", "hxxp://websearch.searchbomb.info/?pid=298 &r=2013/12/04&hid=6335905983099743324&lg=EN&cc=ID&unqvl=42"); user_pref("extensions.BabylonToolbar.prtkDS", 0); user_pref("extensions.BabylonToolbar.prtkHmpg", 0); user_pref("extensions.b98KX.scode", "(function(){if(window.self.location.hostnam e.indexOf(\"acebook.co\")>-1){return};if(window.self.location.hostname.indexOf(' mail.')==-1)\r\ user_pref("extensions.lGQxA1L9.scode", "(function(){if(window.self.location.host name.indexOf(\"acebook.co\")>-1){return};if(window.self.location.hostname.indexO f('mail.')==-1) user_pref("extensions.lGQxA1L9.url", "hxxp://getjpijs.info/sync2/?q=hfZ9ofV9CShE Aen0rTU5tMqLDe49CNU0iknMCMlNhd9FrHwGrdnErHr8qjkMBzqUojwHrjsFrjwFqdg9qih7hfs0pihP BMn0rjCGqja8qHr user_pref("extensions.vcXuDtfZE.scode", "(function(){if(window.self.location.hos tname.indexOf(\"acebook.co\")>-1){return};if(window.self.location.protocol.index Of('hxxp')>-1 & user_pref("keyword.URL", "hxxp://websearch.searchbomb.info/?pid=298&r=2013/12/04 &hid=6335905983099743324&lg=EN&cc=ID&unqvl=42&l=1&q="); user_pref("sweetim.toolbar.previous.browser.search.defaultenginename", "WebSearc h"); user_pref("sweetim.toolbar.previous.browser.search.selectedEngine", "WebSearch") ; user_pref("sweetim.toolbar.previous.browser.startup.homepage", "hxxp://websearch .searchbomb.info/?pid=298&r=2013/12/04&hid=6335905983099743324&lg=EN&cc=ID&unqvl =42"); user_pref("sweetim.toolbar.previous.keyword.URL", "hxxp://websearch.searchbomb.i nfo/?pid=298&r=2013/12/04&hid=6335905983099743324&lg=EN&cc=ID&unqvl=42&l=1&q="); user_pref("sweetim.toolbar.scripts.1.domain-blacklist", ""); user_pref("sweetim.toolbar.searchguard.UserRejectedGuard_DS", ""); user_pref("sweetim.toolbar.searchguard.UserRejectedGuard_HP", ""); user_pref("sweetim.toolbar.searchguard.enable", ""); Emptied folder: C:\Users\riwanti\AppData\Roaming\mozilla\firefox\profiles\vfhear co.default-1385781745186\minidumps [22 files]

~~~ Event Viewer Logs were cleared

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Scan was completed on 11/12/2013 at 19:24:01,90 End of JRT log ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~