Hi Severac, thank you for helping me. I don't have access to my uncle's computer all the time so it may take me a few days to reply to you.
Kaspersky found found 4 files with Trojan-Dropper.MSWord.Agent.fg, 1 file with Backdoor.Win32.Riler.g and one file with Trojan-Downloader.WMA.FakeDRM.bj.
Here is the rkill log:
Rkill 2.8.2 by Lawrence Abrams (Grinler)
Copyright 2008-2015 BleepingComputer.com
More Information about Rkill can be found at this link:
Program started at: 11/30/2015 05:26:50 PM in x86 mode.
Windows Version: Windows Vista Home Basic Service Pack 2
Checking for Windows services to stop:
* No malware services found to stop.
Checking for processes to terminate:
* No malware processes found to kill.
Checking Registry for malware related settings:
* No issues found in the Registry.
Resetting .EXE, .COM, & .BAT associations in the Windows Registry.
Performing miscellaneous checks:
* No issues found.
Checking Windows Service Integrity:
* Windows Defender (WinDefend) is not Running.
Startup Type set to: Manual
Searching for Missing Digital Signatures:
* No issues found.
Checking HOSTS File:
* HOSTS file entries found:
127.0.0.1 localhost
Program finished at: 11/30/2015 05:32:24 PM
Execution time: 0 hours(s), 5 minute(s), and 33 seconds(s)
Here is the MBAM log:
Malwarebytes Anti-Malware
www.malwarebytes.org
Scan Date: 03/12/2015
Scan Time: 5:20:21 PM
Logfile:
Administrator: Yes
Version: 2.2.0.1024
Malware Database: v2015.12.03.05
Rootkit Database: v2015.11.26.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled
OS: Windows Vista Service Pack 2
CPU: x86
File System: NTFS
User: Dorwang
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 356174
Time Elapsed: 23 min, 38 sec
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled
Processes: 0
(No malicious items detected)
Modules: 0
(No malicious items detected)
Registry Keys: 8
PUP.Optional.MindSpark, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{0328B630-EA94-4FA3-9F27-8250B6324DDB}, , [3180356b7516fc3ae98cd6c27a8948b8],
PUP.Optional.MindSpark, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{22714877-95E3-480E-A313-4EC440965E4F}, , [e7cae5bbf19a57df92e37028768d7f81],
PUP.Optional.MindSpark, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{89CC5A31-B592-4BB3-82F5-BD8ACA3E0BF0}, , [b4fdc5db9deec4727cf9d7c1887bf30d],
PUP.Optional.MyWebSearch, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{A5B9C0F5-5616-47CD-A95F-E43B488FACCF}, , [dad7b9e7781394a241893268b3502ad6],
PUP.Optional.ASK.Gen, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{4F524A2D-5637-4300-76A7-A758B70C2300}, , [357ce9b73c4f69cd1773af0a23e0ff01],
PUP.Optional.APNToolBar.Gen, HKU\S-1-5-18\SOFTWARE\AskPartnerNetwork, , [3978831d3c4f2d09d181277a956da65a],
PUP.Optional.MindSpark, HKU\S-1-5-21-3889539913-3550952296-1423814129-1000\SOFTWARE\APPDATALOW\SOFTWARE\TelevisionFanatic, , [f3be326ed4b78caa140e326507fc07f9],
PUP.Optional.MyWebSearch, HKU\S-1-5-21-3889539913-3550952296-1423814129-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{A5B9C0F5-5616-47CD-A95F-E43B488FACCF}, , [476a4c54800b77bfebdeddbde71c44bc],
Registry Values: 7
PUP.Optional.MindSpark, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{0328B630-EA94-4FA3-9F27-8250B6324DDB}|AppPath, C:\Program Files\TelevisionFanatic\bar\1.bin, , [3180356b7516fc3ae98cd6c27a8948b8]
PUP.Optional.MindSpark, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{22714877-95e3-480e-a313-4ec440965e4f}|AppPath, C:\Program Files\TelevisionFanatic\bar\1.bin, , [e7cae5bbf19a57df92e37028768d7f81]
PUP.Optional.MindSpark, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{89CC5A31-B592-4BB3-82F5-BD8ACA3E0BF0}|AppPath, C:\Program Files\TelevisionFanatic\bar\1.bin, , [b4fdc5db9deec4727cf9d7c1887bf30d]
PUP.Optional.APNToolBar.Gen, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|ApnTBMon, "C:\Program Files\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe", , [436e8a160388a98d3a1a9c05fa08c739]
PUP.Optional.ASK.Gen, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{4F524A2D-5637-4300-76A7-A758B70C2300}|InstallSource, C:\ProgramData\APN\APN-Stub\ORJ-V7C\, , [357ce9b73c4f69cd1773af0a23e0ff01]
Registry Data: 0
(No malicious items detected)
Folders: 37
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\HeadlineAlley_29, , [0ea33b65fd8ea19586734d48996a13ed],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\InboxAce_1g, , [8a27455b602b24126c8de1b4887bd32d],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\InternetSpeedTracker_9t, , [3a77b6eae3a883b3a455563f8e75768a],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\MyTransitGuide_b7, , [525f4b5527648da9e712b4e1659e32ce],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\PConverter_dz, , [7140841ca3e8c373d9207f166a99ca36],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\RadioRage_4j, , [6b469c0487040d2925d45243a95ab54b],
PUP.Optional.APNToolBar.Gen, C:\ProgramData\APN\APN-Stub, , [c9e86c34ff8cf640791aee7d47bb54ac],
PUP.Optional.APNToolBar.Gen, C:\ProgramData\AskPartnerNetwork, , [7c35bee2fd8e25115a3a4229be443dc3],
PUP.Optional.APNToolBar.Gen, C:\ProgramData\AskPartnerNetwork\Toolbar, , [7c35bee2fd8e25115a3a4229be443dc3],
PUP.Optional.APNToolBar.Gen, C:\ProgramData\AskPartnerNetwork\Toolbar\ORJ-V7C, , [7c35bee2fd8e25115a3a4229be443dc3],
PUP.Optional.APNToolBar.Gen, C:\ProgramData\AskPartnerNetwork\Toolbar\ORJ-V7C\Updater, , [7c35bee2fd8e25115a3a4229be443dc3],
PUP.Optional.APNToolBar.Gen, C:\ProgramData\AskPartnerNetwork\Toolbar\ORJ-V7C\Updater\Config, , [7c35bee2fd8e25115a3a4229be443dc3],
PUP.Optional.APNToolBar.Gen, C:\ProgramData\AskPartnerNetwork\Toolbar\ORJ-V7C\Updater\Response, , [7c35bee2fd8e25115a3a4229be443dc3],
PUP.Optional.APNToolBar.Gen, C:\Users\Dorwang\AppData\Local\AskPartnerNetwork, , [cae7ecb44645092d0d88f57632d0bc44],
PUP.Optional.APNToolBar.Gen, C:\Users\Dorwang\AppData\Local\AskPartnerNetwork\Toolbar, , [cae7ecb44645092d0d88f57632d0bc44],
PUP.Optional.APNToolBar.Gen, C:\Users\Dorwang\AppData\Local\AskPartnerNetwork\Toolbar\Updater, , [cae7ecb44645092d0d88f57632d0bc44],
PUP.Optional.APNToolBar.Gen, C:\Users\Dorwang\AppData\Local\AskPartnerNetwork\Toolbar\Updater\IDC, , [cae7ecb44645092d0d88f57632d0bc44],
PUP.Optional.APNToolBar.Gen, C:\Program Files\AskPartnerNetwork, , [3081861a771493a35b3ba4c7b64c25db],
PUP.Optional.APNToolBar.Gen, C:\Program Files\AskPartnerNetwork\Toolbar, , [3081861a771493a35b3ba4c7b64c25db],
PUP.Optional.APNToolBar.Gen, C:\Program Files\AskPartnerNetwork\Toolbar\Updater, , [3081861a771493a35b3ba4c7b64c25db],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\FilmFanatic, , [d0e19907325939fd446a651ffc06f30d],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\Local\TelevisionFanatic, , [238e2a7666250b2baa6aa8dd57abc739],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\bar, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\bar\Cache, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\bar\History, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\bar\ie9mesg, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\bar\ie9mesg\COMMON, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\bar\Settings, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\TelevisionFanatic, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\TelevisionFanatic\Cache, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.ASK.Gen, C:\Users\Dorwang\AppData\Local\temp\APN-Stub, , [2b864c54d8b37eb826cd4355a85af808],
PUP.Optional.ASK.Gen, C:\Users\Dorwang\AppData\Local\temp\APN-Stub\ORJ-V7-SAT, , [2b864c54d8b37eb826cd4355a85af808],
PUP.Optional.ASK.Gen, C:\Users\Dorwang\AppData\Local\temp\APN-Stub\ORJ-V7C, , [2b864c54d8b37eb826cd4355a85af808],
PUP.Optional.ASK.Gen, C:\Windows\temp\APN-Stub, , [7e338c14107b43f32cc7d7c1bb476c94],
PUP.Optional.ASK.Gen, C:\Windows\temp\APN-Stub\ORJ-V7-SAT, , [7e338c14107b43f32cc7d7c1bb476c94],
PUP.Optional.ASK.Gen, C:\Windows\temp\APN-Stub\ORJ-V7C, , [7e338c14107b43f32cc7d7c1bb476c94],
Files: 168
PUP.Optional.APNToolBar, C:\$RECYCLE.BIN\S-1-5-21-3889539913-3550952296-1423814129-1000\$RTOPVF5.exe, , [04ad49572b60c571b0a9f732847d4db3],
PUP.Optional.APNToolBar, C:\Users\Dorwang\AppData\Local\temp\APNSetup.exe, , [1a97a8f89cef75c11d3c34f58d740df3],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\HeadlineAlley_29\32F31A25-AAE3-4EAD-AAD3-47F902B052E3.sqlite, , [0ea33b65fd8ea19586734d48996a13ed],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\InboxAce_1g\C27BBB19-AC7C-42E8-95F8-ED00108D888C.sqlite, , [8a27455b602b24126c8de1b4887bd32d],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\InternetSpeedTracker_9t\199D50AF-E37A-4A42-B2E0-0CA8C2580860.sqlite, , [3a77b6eae3a883b3a455563f8e75768a],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\MyTransitGuide_b7\70073776-D81C-4EFC-BE36-A9F054EB010D.sqlite, , [525f4b5527648da9e712b4e1659e32ce],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\PConverter_dz\C69887C9-21CB-4FF6-B5CA-E4CACC86E59A.sqlite, , [7140841ca3e8c373d9207f166a99ca36],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\RadioRage_4j\309C1C29-3B95-40B6-8459-911A8EDCCD69.sqlite, , [6b469c0487040d2925d45243a95ab54b],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\searchplugins\ask-web-search.xml, , [4f62dac67c0f66d056a43a5b18eb6799],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\FilmFanatic\FD66F147-92BE-4819-95AF-AD9F38F72465.sqlite, , [d0e19907325939fd446a651ffc06f30d],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\Local\TelevisionFanatic\AB4AD811-7D70-4A3E-A4C0-0D08082F48A5.sqlite, , [238e2a7666250b2baa6aa8dd57abc739],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\bar\Cache\0007F640, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\bar\Cache\00081370, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\bar\Cache\00081BF8.bmp, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\bar\Cache\00081FB0.bmp, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\bar\Cache\00082358.bmp, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\bar\Cache\000826B2.bmp, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\bar\Cache\00082D66.bmp, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\bar\Cache\00083B79.bmp, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\bar\Cache\00083EE3.bmp, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\bar\Cache\00084AA6.bmp, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\bar\Cache\000851A8.bmp, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\bar\Cache\000858E8.bmp, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\bar\Cache\00085FDB.bmp, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\bar\Cache\00086631.bmp, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\bar\Cache\00086BCC.jhtml, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\bar\Cache\00088A54, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\bar\Cache\0008A42A.bmp, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\bar\Cache\0024208B, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\bar\Cache\003FCCA2, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\bar\Cache\files.ini, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\bar\History\search3, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\bar\ie9mesg\COMMON\btmarrow.png, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\bar\ie9mesg\COMMON\cancel.png, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\bar\ie9mesg\COMMON\config.js, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\bar\ie9mesg\COMMON\continue.png, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\bar\ie9mesg\COMMON\dispatch.js, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\bar\ie9mesg\COMMON\divider.png, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\bar\ie9mesg\COMMON\gcancel.png, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\bar\ie9mesg\COMMON\index.htm, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\bar\ie9mesg\COMMON\infobar.js, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\bar\ie9mesg\COMMON\jquery.js, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\bar\ie9mesg\COMMON\la.png, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\bar\ie9mesg\COMMON\lbcs.png, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\bar\ie9mesg\COMMON\lbms.png, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\bar\ie9mesg\COMMON\lca.png, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\bar\ie9mesg\COMMON\lcfc.png, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\bar\ie9mesg\COMMON\lcm.png, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\bar\ie9mesg\COMMON\lcs.png, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\bar\ie9mesg\COMMON\lcso.png, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\bar\ie9mesg\COMMON\lctn.png, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\bar\ie9mesg\COMMON\ldb.png, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\bar\ie9mesg\COMMON\ldbg.png, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\bar\ie9mesg\COMMON\lddg.png, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\bar\ie9mesg\COMMON\lff.png, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\bar\ie9mesg\COMMON\lffb.png, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\bar\ie9mesg\COMMON\lg.png, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\bar\ie9mesg\COMMON\lgs.png, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\bar\ie9mesg\COMMON\lgw.png, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\bar\ie9mesg\COMMON\lha.png, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\bar\ie9mesg\COMMON\lhp.png, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\bar\ie9mesg\COMMON\lia.png, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\bar\ie9mesg\COMMON\liwon.png, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\bar\ie9mesg\COMMON\lkazulah.png, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\bar\ie9mesg\COMMON\lmd.png, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\bar\ie9mesg\COMMON\lmfc.png, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\bar\ie9mesg\COMMON\lmh.png, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\bar\ie9mesg\COMMON\lmma.png, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\bar\ie9mesg\COMMON\lmosh.png, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\bar\ie9mesg\COMMON\lmwf.png, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\bar\ie9mesg\COMMON\lmws.png, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\bar\ie9mesg\COMMON\lobm.png, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\bar\ie9mesg\COMMON\loryte.png, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\bar\ie9mesg\COMMON\lpss.png, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\bar\ie9mesg\COMMON\lqc.png, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\bar\ie9mesg\COMMON\lrb.png, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\bar\ie9mesg\COMMON\lrg.png, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\bar\ie9mesg\COMMON\lrr.png, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\bar\ie9mesg\COMMON\lsc.png, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\bar\ie9mesg\COMMON\lscr.png, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\bar\ie9mesg\COMMON\lsi.png, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\bar\ie9mesg\COMMON\lssd.png, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\bar\ie9mesg\COMMON\ltrs.png, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\bar\ie9mesg\COMMON\ltvf.png, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\bar\ie9mesg\COMMON\lvs.png, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\bar\ie9mesg\COMMON\lwb.png, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\bar\ie9mesg\COMMON\lwf.png, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\bar\ie9mesg\COMMON\lzwinky.png, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\bar\ie9mesg\COMMON\ok.png, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\bar\ie9mesg\COMMON\overlay.js, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\bar\ie9mesg\COMMON\pid.js, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\bar\ie9mesg\COMMON\qstring.js, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\bar\ie9mesg\COMMON\shield.png, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\bar\ie9mesg\COMMON\spacer.swf, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\bar\ie9mesg\COMMON\toolbar.js, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\bar\ie9mesg\COMMON\yelgrey.png, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\bar\ie9mesg\COMMON\yellowbg.png, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\bar\ie9mesg\COMMON\zEnable.css, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\bar\ie9mesg\COMMON\zEnable.htm, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\bar\ie9mesg\COMMON\zEnable.js, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\bar\Settings\prevcfg2.htm, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\bar\Settings\setting3.htm, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\bar\Settings\setting3.htm.bak, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\bar\Settings\s_w1.dat, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\bar\Settings\s_w1.dat.bak, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\bar\Settings\s_w2.dat, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\bar\Settings\s_w2.dat.bak, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\TelevisionFanatic\Cache\PopupProperties207941130.html, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\TelevisionFanatic\Cache\PopupProperties207941137.html, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\TelevisionFanatic\Cache\PopupProperties207941142.html, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\TelevisionFanatic\Cache\Radio.html, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.MindSpark, C:\Users\Dorwang\AppData\LocalLow\TelevisionFanatic\TelevisionFanatic\Cache\VideosAffinityBtn.html, , [a50cedb343489a9ce77a374fc63c42be],
PUP.Optional.ASK.Gen, C:\Users\Dorwang\AppData\Local\temp\APN-Stub\ORJ-V7-SAT\Msi086097c6-6cc8-4e2b-84a0-59f50771b157.log, , [2b864c54d8b37eb826cd4355a85af808],
PUP.Optional.ASK.Gen, C:\Users\Dorwang\AppData\Local\temp\APN-Stub\ORJ-V7-SAT\Stb086097c6-6cc8-4e2b-84a0-59f50771b157.log, , [2b864c54d8b37eb826cd4355a85af808],
PUP.Optional.ASK.Gen, C:\Users\Dorwang\AppData\Local\temp\APN-Stub\ORJ-V7C\Msi06e0d16c-1e1b-4216-987e-c21608ff9b66.log, , [2b864c54d8b37eb826cd4355a85af808],
PUP.Optional.ASK.Gen, C:\Users\Dorwang\AppData\Local\temp\APN-Stub\ORJ-V7C\Stb06e0d16c-1e1b-4216-987e-c21608ff9b66.log, , [2b864c54d8b37eb826cd4355a85af808],
PUP.Optional.ASK.Gen, C:\Windows\temp\APN-Stub\ORJ-V7-SAT\Msi156b4724-b193-426a-9fae-0f915bfe8e3b.log, , [7e338c14107b43f32cc7d7c1bb476c94],
PUP.Optional.ASK.Gen, C:\Windows\temp\APN-Stub\ORJ-V7-SAT\Msi18532346-f77e-4e98-afb4-cc514d9924d2.log, , [7e338c14107b43f32cc7d7c1bb476c94],
PUP.Optional.ASK.Gen, C:\Windows\temp\APN-Stub\ORJ-V7-SAT\Msi2c79fafe-0022-4134-99a7-12cd4ada868c.log, , [7e338c14107b43f32cc7d7c1bb476c94],
PUP.Optional.ASK.Gen, C:\Windows\temp\APN-Stub\ORJ-V7-SAT\Msi4753cba1-369e-431b-bc65-bf6ce4cd9dbc.log, , [7e338c14107b43f32cc7d7c1bb476c94],
PUP.Optional.ASK.Gen, C:\Windows\temp\APN-Stub\ORJ-V7-SAT\Msi54cb8047-1dbf-413c-97ab-e850ffece3b8.log, , [7e338c14107b43f32cc7d7c1bb476c94],
PUP.Optional.ASK.Gen, C:\Windows\temp\APN-Stub\ORJ-V7-SAT\Msi5852c0ac-ab63-46dc-ac4f-4b9815952a20.log, , [7e338c14107b43f32cc7d7c1bb476c94],
PUP.Optional.ASK.Gen, C:\Windows\temp\APN-Stub\ORJ-V7-SAT\Msi5dcc722d-de88-4068-ab6d-f75703dfda25.log, , [7e338c14107b43f32cc7d7c1bb476c94],
PUP.Optional.ASK.Gen, C:\Windows\temp\APN-Stub\ORJ-V7-SAT\Msi68ad5e69-98dc-4524-9e8e-24f9d8e54375.log, , [7e338c14107b43f32cc7d7c1bb476c94],
PUP.Optional.ASK.Gen, C:\Windows\temp\APN-Stub\ORJ-V7-SAT\Msi9109e24e-b1ce-4b29-8725-9f6eba9aacba.log, , [7e338c14107b43f32cc7d7c1bb476c94],
PUP.Optional.ASK.Gen, C:\Windows\temp\APN-Stub\ORJ-V7-SAT\Msia31c42a6-21d0-4e4a-811e-b223cd364464.log, , [7e338c14107b43f32cc7d7c1bb476c94],
PUP.Optional.ASK.Gen, C:\Windows\temp\APN-Stub\ORJ-V7-SAT\Msia9c203f7-0a2d-45ec-b9b9-594ea5315685.log, , [7e338c14107b43f32cc7d7c1bb476c94],
PUP.Optional.ASK.Gen, C:\Windows\temp\APN-Stub\ORJ-V7-SAT\Msiafc4438f-6226-4fcd-a211-2f406b83e882.log, , [7e338c14107b43f32cc7d7c1bb476c94],
PUP.Optional.ASK.Gen, C:\Windows\temp\APN-Stub\ORJ-V7-SAT\Msib90054db-9932-4128-a5db-6aef08c10056.log, , [7e338c14107b43f32cc7d7c1bb476c94],
PUP.Optional.ASK.Gen, C:\Windows\temp\APN-Stub\ORJ-V7-SAT\Msic22147cf-d9a6-4f85-8aa0-b900aab9f1ef.log, , [7e338c14107b43f32cc7d7c1bb476c94],
PUP.Optional.ASK.Gen, C:\Windows\temp\APN-Stub\ORJ-V7-SAT\Msic8a338d4-fd22-461a-96cf-a9859e603e6e.log, , [7e338c14107b43f32cc7d7c1bb476c94],
PUP.Optional.ASK.Gen, C:\Windows\temp\APN-Stub\ORJ-V7-SAT\Msic9922992-0a3f-46bd-8f98-2bdf93c36b75.log, , [7e338c14107b43f32cc7d7c1bb476c94],
PUP.Optional.ASK.Gen, C:\Windows\temp\APN-Stub\ORJ-V7-SAT\Msidbf9f63e-faea-410c-ab32-07bb61535d61.log, , [7e338c14107b43f32cc7d7c1bb476c94],
PUP.Optional.ASK.Gen, C:\Windows\temp\APN-Stub\ORJ-V7-SAT\Msiffd8dd0b-cb49-4899-86c8-f944c5d0d56b.log, , [7e338c14107b43f32cc7d7c1bb476c94],
PUP.Optional.ASK.Gen, C:\Windows\temp\APN-Stub\ORJ-V7-SAT\Stb156b4724-b193-426a-9fae-0f915bfe8e3b.log, , [7e338c14107b43f32cc7d7c1bb476c94],
PUP.Optional.ASK.Gen, C:\Windows\temp\APN-Stub\ORJ-V7-SAT\Stb18532346-f77e-4e98-afb4-cc514d9924d2.log, , [7e338c14107b43f32cc7d7c1bb476c94],
PUP.Optional.ASK.Gen, C:\Windows\temp\APN-Stub\ORJ-V7-SAT\Stb2c79fafe-0022-4134-99a7-12cd4ada868c.log, , [7e338c14107b43f32cc7d7c1bb476c94],
PUP.Optional.ASK.Gen, C:\Windows\temp\APN-Stub\ORJ-V7-SAT\Stb4753cba1-369e-431b-bc65-bf6ce4cd9dbc.log, , [7e338c14107b43f32cc7d7c1bb476c94],
PUP.Optional.ASK.Gen, C:\Windows\temp\APN-Stub\ORJ-V7-SAT\Stb54cb8047-1dbf-413c-97ab-e850ffece3b8.log, , [7e338c14107b43f32cc7d7c1bb476c94],
PUP.Optional.ASK.Gen, C:\Windows\temp\APN-Stub\ORJ-V7-SAT\Stb5852c0ac-ab63-46dc-ac4f-4b9815952a20.log, , [7e338c14107b43f32cc7d7c1bb476c94],
PUP.Optional.ASK.Gen, C:\Windows\temp\APN-Stub\ORJ-V7-SAT\Stb5dcc722d-de88-4068-ab6d-f75703dfda25.log, , [7e338c14107b43f32cc7d7c1bb476c94],
PUP.Optional.ASK.Gen, C:\Windows\temp\APN-Stub\ORJ-V7-SAT\Stb68ad5e69-98dc-4524-9e8e-24f9d8e54375.log, , [7e338c14107b43f32cc7d7c1bb476c94],
PUP.Optional.ASK.Gen, C:\Windows\temp\APN-Stub\ORJ-V7-SAT\Stb83285c52-d654-48d3-b6e5-e382cf023d5f.log, , [7e338c14107b43f32cc7d7c1bb476c94],
PUP.Optional.ASK.Gen, C:\Windows\temp\APN-Stub\ORJ-V7-SAT\Stb9109e24e-b1ce-4b29-8725-9f6eba9aacba.log, , [7e338c14107b43f32cc7d7c1bb476c94],
PUP.Optional.ASK.Gen, C:\Windows\temp\APN-Stub\ORJ-V7-SAT\Stba31c42a6-21d0-4e4a-811e-b223cd364464.log, , [7e338c14107b43f32cc7d7c1bb476c94],
PUP.Optional.ASK.Gen, C:\Windows\temp\APN-Stub\ORJ-V7-SAT\Stba9c203f7-0a2d-45ec-b9b9-594ea5315685.log, , [7e338c14107b43f32cc7d7c1bb476c94],
PUP.Optional.ASK.Gen, C:\Windows\temp\APN-Stub\ORJ-V7-SAT\Stbafc4438f-6226-4fcd-a211-2f406b83e882.log, , [7e338c14107b43f32cc7d7c1bb476c94],
PUP.Optional.ASK.Gen, C:\Windows\temp\APN-Stub\ORJ-V7-SAT\Stbb600548f-d7f6-4d1c-81f1-d947a69d78fe.log, , [7e338c14107b43f32cc7d7c1bb476c94],
PUP.Optional.ASK.Gen, C:\Windows\temp\APN-Stub\ORJ-V7-SAT\Stbb90054db-9932-4128-a5db-6aef08c10056.log, , [7e338c14107b43f32cc7d7c1bb476c94],
PUP.Optional.ASK.Gen, C:\Windows\temp\APN-Stub\ORJ-V7-SAT\Stbc22147cf-d9a6-4f85-8aa0-b900aab9f1ef.log, , [7e338c14107b43f32cc7d7c1bb476c94],
PUP.Optional.ASK.Gen, C:\Windows\temp\APN-Stub\ORJ-V7-SAT\Stbc8a338d4-fd22-461a-96cf-a9859e603e6e.log, , [7e338c14107b43f32cc7d7c1bb476c94],
PUP.Optional.ASK.Gen, C:\Windows\temp\APN-Stub\ORJ-V7-SAT\Stbc9922992-0a3f-46bd-8f98-2bdf93c36b75.log, , [7e338c14107b43f32cc7d7c1bb476c94],
PUP.Optional.ASK.Gen, C:\Windows\temp\APN-Stub\ORJ-V7-SAT\Stbdbf9f63e-faea-410c-ab32-07bb61535d61.log, , [7e338c14107b43f32cc7d7c1bb476c94],
PUP.Optional.ASK.Gen, C:\Windows\temp\APN-Stub\ORJ-V7-SAT\Stbffd8dd0b-cb49-4899-86c8-f944c5d0d56b.log, , [7e338c14107b43f32cc7d7c1bb476c94],
PUP.Optional.ASK.Gen, C:\Windows\temp\APN-Stub\ORJ-V7C\Msi018b2ff5-0245-4f91-9359-576de1edc3b5.log, , [7e338c14107b43f32cc7d7c1bb476c94],
PUP.Optional.ASK.Gen, C:\Windows\temp\APN-Stub\ORJ-V7C\Msi3ac6428f-237c-46bf-a131-49f628b6e633.log, , [7e338c14107b43f32cc7d7c1bb476c94],
PUP.Optional.ASK.Gen, C:\Windows\temp\APN-Stub\ORJ-V7C\Msi57894c83-5e09-41f9-bb3e-99f87138ed15.log, , [7e338c14107b43f32cc7d7c1bb476c94],
PUP.Optional.ASK.Gen, C:\Windows\temp\APN-Stub\ORJ-V7C\Msi94e4e066-3deb-4b3f-b80f-2d903bd8db14.log, , [7e338c14107b43f32cc7d7c1bb476c94],
PUP.Optional.ASK.Gen, C:\Windows\temp\APN-Stub\ORJ-V7C\Msi980feb22-2200-4056-8254-cdc17a7b7bf4.log, , [7e338c14107b43f32cc7d7c1bb476c94],
PUP.Optional.ASK.Gen, C:\Windows\temp\APN-Stub\ORJ-V7C\Msiaa79e6e2-8b6b-41d2-9d0f-509eb9b64844.log, , [7e338c14107b43f32cc7d7c1bb476c94],
PUP.Optional.ASK.Gen, C:\Windows\temp\APN-Stub\ORJ-V7C\Stb018b2ff5-0245-4f91-9359-576de1edc3b5.log, , [7e338c14107b43f32cc7d7c1bb476c94],
PUP.Optional.ASK.Gen, C:\Windows\temp\APN-Stub\ORJ-V7C\Stb3ac6428f-237c-46bf-a131-49f628b6e633.log, , [7e338c14107b43f32cc7d7c1bb476c94],
PUP.Optional.ASK.Gen, C:\Windows\temp\APN-Stub\ORJ-V7C\Stb57894c83-5e09-41f9-bb3e-99f87138ed15.log, , [7e338c14107b43f32cc7d7c1bb476c94],
PUP.Optional.ASK.Gen, C:\Windows\temp\APN-Stub\ORJ-V7C\Stb94e4e066-3deb-4b3f-b80f-2d903bd8db14.log, , [7e338c14107b43f32cc7d7c1bb476c94],
PUP.Optional.ASK.Gen, C:\Windows\temp\APN-Stub\ORJ-V7C\Stb980feb22-2200-4056-8254-cdc17a7b7bf4.log, , [7e338c14107b43f32cc7d7c1bb476c94],
PUP.Optional.ASK.Gen, C:\Windows\temp\APN-Stub\ORJ-V7C\Stbaa79e6e2-8b6b-41d2-9d0f-509eb9b64844.log, , [7e338c14107b43f32cc7d7c1bb476c94],
PUP.Optional.ASK, C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js, Good: (browser.startup.homepage", "
https://www.malwarebytes.org/restorebrowser/), Bad: (browser.startup.homepage.prev", "http://home.tb.ask.com), ,[4d64613f632860d6f85aacf364a01fe1]
PUP.Optional.ASK, C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js, Good: (browser.startup.homepage", "
https://www.malwarebytes.org/restorebrowser/), Bad: (browser.startup.homepage.tb", "http://home.tb.ask.com), ,[139e7d23692251e5c88afaa5b84c748c]
Physical Sectors: 0
(No malicious items detected)
(end)
Here is the adwcleaner log:
# AdwCleaner v5.023 - Logfile created 03/12/2015 at 19:06:37
# Updated 30/11/2015 by Xplode
# Database : 2015-12-03.1 [Server]
# Operating system : Windows Vista Home Basic Service Pack 2 (x86)
# Username : Dorwang - DORWANG-PC
# Running from : C:\Users\Dorwang\Desktop\AdwCleaner.exe
# Option : Cleaning
***** [ Services ] *****
[x] Service Not Deleted : YahooAUService
[-] Service Deleted : vToolbarUpdater14.0.1
***** [ Folders ] *****
[x] Folder Not Deleted : C:\Program Files\Common Files\AVG Secure Search
[-] Folder Deleted : C:\ProgramData\apn
[-] Folder Deleted : C:\Users\Dorwang\AppData\LocalLow\HPAppData
[-] Folder Deleted : C:\Users\Dorwang\AppData\LocalLow\Yahoo!\Companion
***** [ Files ] *****
***** [ DLLs ] *****
***** [ Shortcuts ] *****
***** [ Scheduled tasks ] *****
***** [ Registry ] *****
[-] Key Deleted : HKLM\SOFTWARE\Classes\protector_dll.protectorbho
[-] Key Deleted : HKLM\SOFTWARE\Classes\protector_dll.protectorbho.1
[-] Key Deleted : HKLM\SOFTWARE\Classes\YBrowserToolbar.YBrowserToolbar.1
[-] Key Deleted : HKLM\SOFTWARE\Classes\YBrowserToolbar.YBrowserToolbar
[-] Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{B8445FED-900C-4137-AD15-DDD2F6306B62}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{BB27DF2F-6F05-4A42-9FFD-14696D795750}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{0510789C-5E5D-4FA3-A3EF-2D56FDE5090A}
[!] Key Not Deleted : HKLM\SOFTWARE\Classes\Interface\{B8445FED-900C-4137-AD15-DDD2F6306B62}
[-] Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{A3866408-A46D-4421-816F-F34D7247A046}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{2FF49ED5-A3EF-410B-918E-97DECEB5996D}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{CCC7A320-B3CA-4199-B1A6-9F516DD69829}
[-] Key Deleted : HKCU\Software\YahooPartnerToolbar
[-] Key Deleted : HKCU\Software\Yahoo\Companion
[-] Key Deleted : HKCU\Software\Yahoo\YFriendsBar
[-] Key Deleted : HKCU\Software\AppDataLow\Software\Yahoo\Companion
[-] Key Deleted : HKLM\SOFTWARE\Yahoo\Companion
[x] Key Not Deleted : HKU\.DEFAULT\Software\AVG Secure Search
[x] Key Not Deleted : HKU\.DEFAULT\Software\AVG Security Toolbar
[-] Key Deleted : HKU\.DEFAULT\Software\IGearSettings
[x] Key Not Deleted : HKU\.DEFAULT\Software\Avg Secure Update
[x] Key Not Deleted : HKU\.DEFAULT\Software\AppDataLow\Software\AVG Security Toolbar
[-] Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{C929138B-62CC-4754-B4A5-6162BE88A6F6}
[-] Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{CCC7A320-B3CA-4199-B1A6-9F516DD69829}
[-] Data Restored : HKCU\Software\Microsoft\Internet Explorer\SearchScopes [DefaultScope]
***** [ Web browsers ] *****
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("browser.search.hiddenOneOffs", "Ask Web Search");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("browser.search.selectedEngine", "Ask Web Search");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.enabledItems", "{54d0da58-64e7-4408-be1f-72659f70fcbe}:3.10.0.1,{9dbb9aeb-5a16-4989-a66f-c0f1c909d647}:3.10.0.1,{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}:6.0.17,{CAFEEFAC-0016-0000-[...]
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark.Mindspark.MindsparkFF_.browser.version.last", "42.0");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark.Mindspark.MindsparkFF_.toolbar.versionChanged", false);
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark.MindsparkFF_.lssState", "{\"previousLocales\":[\"en-GB\",\"en\"],\"supportedLocales\":[\"de\",\"es\",\"pt\",\"ja\",\"en\"],\"defaultLocale\":\"en\",\"supportedL[...]
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._1gMembers_.BUTTON_STRUCTURE", "[{\"b\":212025602,\"c\":\"mindspark.magnify\",\"p\":\"L.0\"},{\"b\":212025603,\"p\":\"L.0.0\"},{\"b\":212025605,\"p\":\"L.0.1\"}[...]
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._1gMembers_.browser.search.defaultenginename.prev", "Ask Search");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._1gMembers_.browser.search.defaultenginename.savedPrev", "true");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._1gMembers_.browser.search.defaultenginename.tb", "Ask Web Search");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._1gMembers_.browser.search.selectedEngine.prev", "Ask Search");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._1gMembers_.browser.search.selectedEngine.savedPrev", "true");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._1gMembers_.browser.search.selectedEngine.tb", "Ask Web Search");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._1gMembers_.browser.startup.homepage", "hxxps://www.malwarebytes.org/restorebrowser//index.jhtml?ptb=C27BBB19-AC7C-42E8-95F8-ED00108D888C&n=780c7632&p2=^YO^xdm0[...]
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._1gMembers_.browser.startup.homepage.savedPrev", "true");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._1gMembers_.browser.startup.page.savedPrev", 1);
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._1gMembers_.browser.startup.page.tb", 1);
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._1gMembers_.browser.version.last", "40.0");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._1gMembers_.competitorDNS", "{\"comment\":\"refresh every 1 week (7*24*60*60*1000)\",\"refreshPeriod\":604800000,\"list\":[{\"url\":\"hxxp://www.dnsrsearch.com/[...]
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._1gMembers_.firstKnownVersion", "6.66.4.33693");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._1gMembers_.homepage", "hxxp://home.tb.ask.com/index.jhtml?ptb=C27BBB19-AC7C-42E8-95F8-ED00108D888C&n=780c7632&p2=^YO^xdm057^YYA^ca&si=245288");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._1gMembers_.hp.enabled", true);
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._1gMembers_.hp.guardType", "HPR");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._1gMembers_.initialized", true);
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._1gMembers_.installKeysSource", "LocalStorage");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._1gMembers_.installType", "XPI");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._1gMembers_.installation.contextKey", "");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._1gMembers_.installation.dlpCountryCode", "CA");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._1gMembers_.installation.installDate", "2014082610");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._1gMembers_.installation.partnerId", "^YO^xdm057^YYA^ca");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._1gMembers_.installation.partnerSubId", "245288");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._1gMembers_.installation.pixelUrl", "hxxp://inboxace.dl.tb.ask.com/install_pixels.jhtml?partner=^YO^xdm057^YYA^ca&coId=b9c1e43f69254bcc91d3aa6713b82b29");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._1gMembers_.installation.success", true);
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._1gMembers_.installation.toolbarId", "C27BBB19-AC7C-42E8-95F8-ED00108D888C");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._1gMembers_.isCompliantUninstallImplementation", true);
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._1gMembers_.lastActivePing", "1448317410775");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._1gMembers_.lastKnownVersion", "1.0.1.16857");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._1gMembers_.options.defaultSearch", true);
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._1gMembers_.options.homePageEnabled", true);
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._1gMembers_.options.keywordEnabled", true);
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._1gMembers_.options.tabEnabled", true);
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._1gMembers_.partnerPixelFired", true);
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._1gMembers_.searchHistory", "bold and beautiful daly soap operabold and beautiful daily soap opera");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._1gMembers_.successUrl", "hxxp://www.mail-login.net/install_complete.php?k=h");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._1gMembers_.toolbar.versionChanged", false);
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._1gMembers_.toolbarCollapsed", false);
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._1gMembers_.weather.location", "M3H+M");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._29Members_.BUTTON_STRUCTURE", "[{\"b\":224623911,\"p\":\"L.0\"},{\"b\":224623912,\"p\":\"L.0.0\"},{\"b\":224623917,\"p\":\"L.0.1\"},{\"b\":224623878,\"p\":\"L.[...]
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._29Members_.browser.search.defaultenginename.prev", "Ask Web Search");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._29Members_.browser.search.defaultenginename.savedPrev", "true");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._29Members_.browser.search.defaultenginename.savedUndo", "true");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._29Members_.browser.search.defaultenginename.tb", "Ask Web Search");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._29Members_.browser.search.defaultenginename.undo", "Ask Web Search");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._29Members_.browser.search.selectedEngine.savedUndo", "true");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._29Members_.browser.search.selectedEngine.tb", "Ask Web Search");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._29Members_.browser.search.selectedEngine.undo", "Ask Web Search");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._29Members_.browser.startup.homepage", "hxxps://www.malwarebytes.org/restorebrowser//index.jhtml?ptb=32F31A25-AAE3-4EAD-AAD3-47F902B052E3&n=781c262d&p2=^Z5^xdm2[...]
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._29Members_.browser.startup.homepage.savedPrev", "true");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._29Members_.browser.startup.page.savedPrev", 1);
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._29Members_.browser.startup.page.tb", 1);
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._29Members_.browser.version.last", "42.0");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._29Members_.competitorDNS", "{\"comment\":\"refresh every 1 week (7*24*60*60*1000)\",\"refreshPeriod\":604800000,\"list\":[{\"url\":\"hxxp://www.dnsrsearch.com/[...]
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._29Members_.firstKnownVersion", "7.18.8.36689");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._29Members_.homepage", "hxxp://home.tb.ask.com/index.jhtml?ptb=32F31A25-AAE3-4EAD-AAD3-47F902B052E3&n=781c262d&p2=^Z5^xdm291^LAENCA^ca&si=XXXXXXXXXX");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._29Members_.hp.enabled", true);
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._29Members_.hp.guardType", "HPR");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._29Members_.initialized", true);
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._29Members_.installKeysSource", "Cookies");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._29Members_.installType", "XPI");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._29Members_.installation.contextKey", "");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._29Members_.installation.dlpCountryCode", "CA");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._29Members_.installation.installDate", "2015110701");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._29Members_.installation.partnerId", "^Z5^xdm291^LAENCA^ca");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._29Members_.installation.partnerSubId", "XXXXXXXXXX");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._29Members_.installation.pixelUrl", "hxxp://www.headlinealley.com/install_pixels.jhtml?partner=^Z5^xdm291^LAENCA^ca&sub_id=XXXXXXXXXX&coId=21d32be261724a6d958fd[...]
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._29Members_.installation.success", true);
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._29Members_.installation.toolbarId", "32F31A25-AAE3-4EAD-AAD3-47F902B052E3");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._29Members_.isCompliantUninstallImplementation", true);
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._29Members_.lastActivePing", "1448317410863");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._29Members_.lastKnownVersion", "7.18.8.36689");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._29Members_.options.defaultSearch", true);
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._29Members_.options.homePageEnabled", true);
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._29Members_.options.keywordEnabled", false);
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._29Members_.options.tabEnabled", false);
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._29Members_.partnerPixelFired", true);
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._29Members_.successUrl", "hxxp://www.headlinealley.com/installComplete.jhtml");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._29Members_.toolbarCollapsed", false);
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._4jMembers_.BUTTON_STRUCTURE", "[{\"b\":224623000,\"c\":\"mindspark.magnify\",\"p\":\"L.0\"},{\"b\":224623001,\"c\":\"mindspark.entersearchterms\",\"p\":\"L.0.0[...]
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._4jMembers_.browser.search.defaultenginename.prev", "Ask Web Search");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._4jMembers_.browser.search.defaultenginename.savedPrev", "true");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._4jMembers_.browser.search.defaultenginename.tb", "Ask Web Search");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._4jMembers_.browser.search.selectedEngine.prev", "Ask Web Search");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._4jMembers_.browser.search.selectedEngine.savedPrev", "true");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._4jMembers_.browser.search.selectedEngine.tb", "Ask Web Search");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._4jMembers_.browser.startup.homepage", "hxxps://www.malwarebytes.org/restorebrowser//index.jhtml?ptb=309C1C29-3B95-40B6-8459-911A8EDCCD69&n=781bfd34&p2=^ZX^xdm0[...]
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._4jMembers_.browser.startup.homepage.savedPrev", "true");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._4jMembers_.browser.startup.page.savedPrev", 1);
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._4jMembers_.browser.startup.page.tb", 1);
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._4jMembers_.browser.version.last", "42.0");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._4jMembers_.competitorDNS", "{\"comment\":\"refresh every 1 week (7*24*60*60*1000)\",\"refreshPeriod\":604800000,\"list\":[{\"url\":\"hxxp://www.dnsrsearch.com/[...]
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._4jMembers_.firstKnownVersion", "7.18.7.29998");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._4jMembers_.homepage", "hxxp://home.tb.ask.com/index.jhtml?ptb=309C1C29-3B95-40B6-8459-911A8EDCCD69&n=781bfd34&p2=^ZX^xdm019^LAENCA^ca&si=CMKnxMCepMgCFZSMaQodvA[...]
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._4jMembers_.hp.enabled", true);
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._4jMembers_.hp.guardType", "HPR");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._4jMembers_.initialized", true);
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._4jMembers_.installKeysSource", "Cookies");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._4jMembers_.installType", "XPI");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._4jMembers_.installation.contextKey", "");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._4jMembers_.installation.dlpCountryCode", "CA");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._4jMembers_.installation.installDate", "2015100212");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._4jMembers_.installation.partnerId", "^ZX^xdm019^LAENCA^ca");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._4jMembers_.installation.partnerSubId", "CMKnxMCepMgCFZSMaQodvA4N5A");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._4jMembers_.installation.pixelUrl", "hxxp://download.radiorage.com/install_pixels.jhtml?partner=^ZX^xdm019^LAENCA^ca&sub_id=CMKnxMCepMgCFZSMaQodvA4N5A&coId=5623[...]
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._4jMembers_.installation.success", true);
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._4jMembers_.installation.toolbarId", "309C1C29-3B95-40B6-8459-911A8EDCCD69");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._4jMembers_.isCompliantUninstallImplementation", true);
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._4jMembers_.lastActivePing", "1448317410848");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._4jMembers_.lastKnownVersion", "7.18.8.36724");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._4jMembers_.options.defaultSearch", true);
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._4jMembers_.options.homePageEnabled", true);
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._4jMembers_.options.keywordEnabled", true);
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._4jMembers_.options.tabEnabled", true);
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._4jMembers_.partnerPixelFired", true);
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._4jMembers_.searchHistory", "voice of tibet norway");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._4jMembers_.successUrl", "hxxp://download.radiorage.com/installComplete.jhtml");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._4jMembers_.toolbar.versionChanged", false);
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._4jMembers_.toolbarCollapsed", false);
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._64Members_.hp.enabled", true);
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._64Members_.hp.lastGuardTime", 1939069430);
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._64Members_.hp.numGuards", 1);
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._64Members_.initialized", true);
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._64Members_.installation.contextKey", "");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._64Members_.installation.installDate", "2012080912");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._64Members_.installation.partnerId", "^XP^xdm255^LENCA^ca");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._64Members_.installation.partnerSubId", "");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._64Members_.installation.success", true);
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._64Members_.installation.toolbarId", "AB4AD811-7D70-4A3E-A4C0-0D08082F48A5");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._64Members_.lastActivePing", "1359141171755");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._64Members_.options.defaultSearch", true);
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._64Members_.options.homePageEnabled", true);
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._64Members_.options.keywordEnabled", true);
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._64Members_.options.tabEnabled", false);
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._64Members_.searchHistory", "Summeryoung and restless soap opera scoopsfind poker lotto winning numbers olgfind poker lotto winning numbers olg 9-2-12[...]
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._64Members_.weather.location", "M3H+M");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._9tMembers_.BUTTON_STRUCTURE", "[{\"b\":222853326,\"c\":\"mindspark.magnify\",\"p\":\"L.0\"},{\"b\":222853327,\"c\":\"mindspark.entersearchterms\",\"p\":\"L.0.0[...]
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._9tMembers_.browser.search.defaultenginename.prev", "Ask Web Search");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._9tMembers_.browser.search.defaultenginename.savedPrev", "true");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._9tMembers_.browser.search.defaultenginename.tb", "Ask Web Search");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._9tMembers_.browser.search.selectedEngine.prev", "Google");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._9tMembers_.browser.search.selectedEngine.savedPrev", "true");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._9tMembers_.browser.search.selectedEngine.tb", "Ask Web Search");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._9tMembers_.browser.startup.homepage", "hxxps://www.malwarebytes.org/restorebrowser//index.jhtml?ptb=199D50AF-E37A-4A42-B2E0-0CA8C2580860&n=780d0eea&p2=^BBQ^xdm[...]
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._9tMembers_.browser.startup.homepage.savedPrev", "true");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._9tMembers_.browser.startup.page.savedPrev", 1);
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._9tMembers_.browser.startup.page.tb", 1);
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._9tMembers_.browser.version.last", "42.0");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._9tMembers_.competitorDNS", "{\"comment\":\"refresh every 1 week (7*24*60*60*1000)\",\"refreshPeriod\":604800000,\"list\":[{\"url\":\"hxxp://www.dnsrsearch.com/[...]
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._9tMembers_.firstKnownVersion", "6.83.5.43458");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._9tMembers_.homepage", "hxxp://home.tb.ask.com/index.jhtml?ptb=199D50AF-E37A-4A42-B2E0-0CA8C2580860&n=780d0eea&p2=^BBQ^xdm188^S11599^ca&si=downloadispeed");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._9tMembers_.hp.enabled", true);
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._9tMembers_.hp.guardType", "HPR");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._9tMembers_.initialized", true);
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._9tMembers_.installKeysSource", "LocalStorage");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._9tMembers_.installType", "XPI");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._9tMembers_.installation.contextKey", "");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._9tMembers_.installation.dlpCountryCode", "CA");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._9tMembers_.installation.installDate", "2014121706");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._9tMembers_.installation.partnerId", "^BBQ^xdm188^S11599^ca");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._9tMembers_.installation.partnerSubId", "downloadispeed");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._9tMembers_.installation.pixelUrl", "hxxp://free.internetspeedtracker.com/install_pixels.jhtml?partner=^BBQ^xdm188^S11599^ca&sub_id=downloadispeed&coId=8cd9a34a[...]
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._9tMembers_.installation.success", true);
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._9tMembers_.installation.toolbarId", "199D50AF-E37A-4A42-B2E0-0CA8C2580860");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._9tMembers_.isCompliantUninstallImplementation", true);
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._9tMembers_.lastActivePing", "1448317410818");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._9tMembers_.lastKnownVersion", "7.18.7.55626");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._9tMembers_.options.defaultSearch", true);
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._9tMembers_.options.homePageEnabled", true);
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._9tMembers_.options.keywordEnabled", true);
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._9tMembers_.options.tabEnabled", true);
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._9tMembers_.partnerPixelFired", true);
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._9tMembers_.successUrl", "hxxp://downloadispeed.com/thankyou.php");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._9tMembers_.toolbar.versionChanged", false);
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._9tMembers_.toolbarCollapsed", false);
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._9tMembers_.weather.location", "N7L+N");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._b7Members_.BUTTON_STRUCTURE", "[{\"b\":224531912,\"c\":\"mindspark.magnify\",\"p\":\"L.0\"},{\"b\":224531913,\"c\":\"mindspark.entersearchterms\",\"p\":\"L.0.0[...]
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._b7Members_.browser.search.defaultenginename.prev", "Ask Web Search");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._b7Members_.browser.search.defaultenginename.savedPrev", "true");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._b7Members_.browser.search.defaultenginename.tb", "Ask Web Search");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._b7Members_.browser.search.selectedEngine.prev", "Ask Web Search");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._b7Members_.browser.search.selectedEngine.savedPrev", "true");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._b7Members_.browser.search.selectedEngine.tb", "Ask Web Search");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._b7Members_.browser.startup.homepage", "hxxps://www.malwarebytes.org/restorebrowser//index.jhtml?ptb=70073776-D81C-4EFC-BE36-A9F054EB010D&n=781bdcc6&p2=^BNH^xdm[...]
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._b7Members_.browser.startup.homepage.savedPrev", "true");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._b7Members_.browser.startup.page.savedPrev", 1);
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._b7Members_.browser.startup.page.tb", 1);
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._b7Members_.browser.version.last", "42.0");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._b7Members_.competitorDNS", "{\"comment\":\"refresh every 1 week (7*24*60*60*1000)\",\"refreshPeriod\":604800000,\"list\":[{\"url\":\"hxxp://www.dnsrsearch.com/[...]
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._b7Members_.firstKnownVersion", "7.23.7.36636");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._b7Members_.homepage", "hxxp://home.tb.ask.com/index.jhtml?ptb=70073776-D81C-4EFC-BE36-A9F054EB010D&n=781bdcc6&p2=^BNH^xdm137^YYA^ca&si=CD15543_1435-PN8Mw");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._b7Members_.hp.enabled", true);
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._b7Members_.hp.guardType", "HPR");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._b7Members_.initialized", true);
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._b7Members_.installKeysSource", "Cookies");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._b7Members_.installType", "XPI");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._b7Members_.installation.contextKey", "");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._b7Members_.installation.dlpCountryCode", "CA");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._b7Members_.installation.installDate", "2015091910");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._b7Members_.installation.partnerId", "^BNH^xdm137^YYA^ca");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._b7Members_.installation.partnerSubId", "CD15543_1435-PN8Mw");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._b7Members_.installation.pixelUrl", "hxxp://www.mytransitguide.com/install_pixels.jhtml?partner=^BNH^xdm137^YYA^ca&sub_id=CD15543_1435-PN8Mw&coId=5bc7e798e1cf44[...]
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._b7Members_.installation.success", true);
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._b7Members_.installation.toolbarId", "70073776-D81C-4EFC-BE36-A9F054EB010D");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._b7Members_.lastActivePing", "1448317409837");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._b7Members_.lastKnownVersion", "7.23.7.36636");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._b7Members_.options.defaultSearch", true);
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._b7Members_.options.homePageEnabled", true);
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._b7Members_.options.keywordEnabled", true);
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._b7Members_.options.tabEnabled", true);
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._b7Members_.partnerPixelFired", true);
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._b7Members_.successUrl", "hxxp://www.mytransitguide.com/installComplete.jhtml");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._b7Members_.toolbar.versionChanged", false);
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._b7Members_.toolbarCollapsed", false);
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._dzMembers_.BUTTON_STRUCTURE", "[{\"b\":224511887,\"c\":\"mindspark.magnify\",\"p\":\"L.0\"},{\"b\":224511888,\"c\":\"mindspark.entersearchterms\",\"p\":\"L.0.0[...]
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._dzMembers_.browser.search.defaultenginename.prev", "Ask Web Search");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._dzMembers_.browser.search.defaultenginename.savedPrev", "true");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._dzMembers_.browser.search.defaultenginename.tb", "Ask Web Search");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._dzMembers_.browser.search.selectedEngine.prev", "Ask Web Search");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._dzMembers_.browser.search.selectedEngine.savedPrev", "true");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._dzMembers_.browser.search.selectedEngine.tb", "Ask Web Search");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._dzMembers_.browser.startup.homepage", "hxxps://www.malwarebytes.org/restorebrowser//index.jhtml?ptb=C69887C9-21CB-4FF6-B5CA-E4CACC86E59A&n=781b8abd&p2=^BYC^xdm[...]
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._dzMembers_.browser.startup.homepage.savedPrev", "true");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._dzMembers_.browser.startup.page.prev", 0);
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._dzMembers_.browser.startup.page.savedPrev", 1);
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._dzMembers_.browser.startup.page.tb", 1);
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._dzMembers_.browser.version.last", "42.0");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._dzMembers_.competitorDNS", "{\"comment\":\"refresh every 1 week (7*24*60*60*1000)\",\"refreshPeriod\":604800000,\"list\":[{\"url\":\"hxxp://www.dnsrsearch.com/[...]
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._dzMembers_.firstKnownVersion", "7.18.7.21446");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._dzMembers_.homepage", "hxxp://home.tb.ask.com/index.jhtml?ptb=C69887C9-21CB-4FF6-B5CA-E4CACC86E59A&n=781b8abd&p2=^BYC^xdm021^YYA^ca");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._dzMembers_.hp.enabled", true);
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._dzMembers_.hp.guardType", "HPR");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._dzMembers_.initialized", true);
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._dzMembers_.installKeysSource", "LocalStorage");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._dzMembers_.installType", "XPI");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._dzMembers_.installation.contextKey", "");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._dzMembers_.installation.dlpCountryCode", "CA");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._dzMembers_.installation.installDate", "2015070909");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._dzMembers_.installation.partnerId", "^BYC^xdm021^YYA^ca");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._dzMembers_.installation.partnerSubId", "");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._dzMembers_.installation.pixelUrl", "hxxp://www.pconverter.com/install_pixels.jhtml?partner=^BYC^xdm021^YYA^ca&coId=38862f9027c1428d82d6a71dd4128481&tbGuid=C698[...]
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._dzMembers_.installation.success", true);
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._dzMembers_.installation.toolbarId", "C69887C9-21CB-4FF6-B5CA-E4CACC86E59A");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._dzMembers_.isCompliantUninstallImplementation", true);
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._dzMembers_.lastActivePing", "1448317410832");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._dzMembers_.lastKnownVersion", "7.18.8.36159");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._dzMembers_.options.defaultSearch", true);
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._dzMembers_.options.homePageEnabled", true);
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._dzMembers_.options.keywordEnabled", true);
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._dzMembers_.options.tabEnabled", true);
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._dzMembers_.partnerPixelFired", true);
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._dzMembers_.searchHistory", "www.dalailama.comStep 1: Click Update to update a plugin.");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._dzMembers_.successUrl", "hxxp://www.pconverter.com/installComplete.jhtml");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._dzMembers_.toolbar.versionChanged", false);
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._dzMembers_.toolbarCollapsed", false);
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._paMembers_.BUTTON_STRUCTURE", "[{\"b\":224540453,\"c\":\"mindspark.magnify\",\"p\":\"L.0\"},{\"b\":224540454,\"c\":\"mindspark.entersearchterms\",\"p\":\"L.0.0[...]
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._paMembers_.browser.search.defaultenginename.prev", "Ask Search");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._paMembers_.browser.search.defaultenginename.savedPrev", "true");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._paMembers_.browser.search.defaultenginename.tb", "Ask Web Search");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._paMembers_.browser.search.selectedEngine.prev", "Ask Search");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._paMembers_.browser.search.selectedEngine.savedPrev", "true");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._paMembers_.browser.search.selectedEngine.tb", "Ask Web Search");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._paMembers_.browser.startup.homepage", "hxxps://www.malwarebytes.org/restorebrowser//index.jhtml?ptb=FD66F147-92BE-4819-95AF-AD9F38F72465&n=780bb1ae&p2=^Z1^xdm1[...]
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._paMembers_.browser.startup.homepage.savedPrev", "true");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._paMembers_.browser.startup.page.savedPrev", 1);
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._paMembers_.browser.startup.page.tb", 1);
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._paMembers_.browser.version.last", "42.0");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._paMembers_.competitorDNS", "{\"comment\":\"refresh every 1 week (7*24*60*60*1000)\",\"refreshPeriod\":604800000,\"list\":[{\"url\":\"hxxp://www.dnsrsearch.com/[...]
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._paMembers_.firstKnownVersion", "6.20.3.33706");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._paMembers_.homepage", "hxxp://home.tb.ask.com/index.jhtml?ptb=FD66F147-92BE-4819-95AF-AD9F38F72465&n=780bb1ae&p2=^Z1^xdm135^YYA^ca&si=trailerclips-2-3");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._paMembers_.hp.enabled", true);
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._paMembers_.hp.guardType", "HPG");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._paMembers_.initialized", true);
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._paMembers_.installKeysSource", "LocalStorage");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._paMembers_.installType", "XPI");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._paMembers_.installation.contextKey", "");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._paMembers_.installation.dlpCountryCode", "CA");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._paMembers_.installation.installDate", "2014032302");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._paMembers_.installation.partnerId", "^Z1^xdm135^YYA^ca");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._paMembers_.installation.partnerSubId", "trailerclips-2-3");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._paMembers_.installation.pixelUrl", "hxxp://filmfanatic2.dl.tb.ask.com/install_pixels.jhtml?partner=^Z1^xdm135^YYA^ca&coId=fe8a56826aaf44b1bb483e5135229e6b&cake[...]
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._paMembers_.installation.success", true);
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._paMembers_.installation.toolbarId", "FD66F147-92BE-4819-95AF-AD9F38F72465");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._paMembers_.isCompliantUninstallImplementation", true);
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._paMembers_.lastActivePing", "1448317410803");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._paMembers_.lastKnownVersion", "7.18.7.8322");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._paMembers_.options.defaultSearch", true);
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._paMembers_.options.homePageEnabled", true);
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._paMembers_.options.keywordEnabled", true);
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._paMembers_.options.tabEnabled", true);
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._paMembers_.partnerPixelFired", true);
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._paMembers_.searchHistory", "voice of tibet norwayutube indian moviesbollywood hindi movieshow much indian ruppees for a canadian dollerwww.faindian v[...]
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._paMembers_.successUrl", "hxxp://www.trailerclips.com//?download=complete&v=hdr");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._paMembers_.toolbar.versionChanged", false);
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._paMembers_.toolbarCollapsed", false);
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._paMembers_.weather.location", "M3H+M");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark.hp.enabled", true);
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark.hp.enabled.guid", "headlinealley@mindspark.com");
[-] [C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark.lastInstalled", "headlinealley@mindspark.com");
*************************
:: "Tracing" keys removed
*************************
C:\AdwCleaner[S1].txt - [38656 bytes] - [25/01/2013 16:48:59]
########## EOF - C:\AdwCleaner\AdwCleaner[C1].txt - [70864 bytes] ##########
Here is the JRT log
Junkware Removal Tool (JRT) by Malwarebytes
Version: 8.0.1 (11.24.2015)
Operating System: Windows Vista Home Basic x86
Ran by Dorwang (Administrator) on 03/12/2015 at 20:13:49.15
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
File System: 2
Successfully deleted: C:\Users\Dorwang\Appdata\LocalLow\AVGTOOLBAR (Folder)
Successfully deleted: C:\Users\Dorwang\AppData\Roaming\getrighttogo (Folder)
Deleted the following from C:\Users\Dorwang\AppData\Roaming\Mozilla\Firefox\Profiles\03y78rau.default\prefs.js
user_pref(extensions.toolbar.mindspark.lastInstalled, headlinealley@mindspark.com);
Registry: 5
Successfully deleted: HKLM\SYSTEM\CurrentControlSet\services\YahooAUService (Registry Key)
Successfully deleted: HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{CCC7A320-B3CA-4199-B1A6-9F516DD69829} (Registry Key)
Successfully deleted: HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D} (Registry Key)
Successfully deleted: HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CA6319C0-31B7-401E-A518-A07C3DB8F777} (Registry Key)
Successfully deleted: HKLM\Software\Microsoft\Internet Explorer\Search\\SearchAssistant (Registry Value)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 03/12/2015 at 20:18:33.46
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~