Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

FBI MoneyPak Virus [Solved]


  • This topic is locked This topic is locked

#16
Brober

Brober

    Member

  • Topic Starter
  • Member
  • PipPip
  • 26 posts
Okay, so I ran the final step and it rebooted, but the only thing that is coming up is OTL and everything else is just a black screen
  • 0

Advertisements


#17
Essexboy

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
Reboot one more time please
  • 0

#18
Brober

Brober

    Member

  • Topic Starter
  • Member
  • PipPip
  • 26 posts
TDSS killer log

11:00:21.0784 4100 TDSS rootkit removing tool 2.8.15.0 Oct 31 2012 21:47:35
11:00:23.0812 4100 ============================================================
11:00:23.0812 4100 Current date / time: 2012/11/11 11:00:23.0812
11:00:23.0812 4100 SystemInfo:
11:00:23.0812 4100
11:00:23.0812 4100 OS Version: 6.1.7601 ServicePack: 1.0
11:00:23.0812 4100 Product type: Workstation
11:00:23.0812 4100 ComputerName: BLAKESCOMPUTER
11:00:23.0812 4100 UserName: Blake
11:00:23.0812 4100 Windows directory: C:\Windows
11:00:23.0812 4100 System windows directory: C:\Windows
11:00:23.0812 4100 Running under WOW64
11:00:23.0812 4100 Processor architecture: Intel x64
11:00:23.0812 4100 Number of processors: 2
11:00:23.0812 4100 Page size: 0x1000
11:00:23.0812 4100 Boot type: Normal boot
11:00:23.0812 4100 ============================================================
11:00:28.0332 4100 Drive \Device\Harddisk0\DR0 - Size: 0x7470C06000 (465.76 Gb), SectorSize: 0x200, Cylinders: 0xED81, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
11:00:28.0342 4100 ============================================================
11:00:28.0342 4100 \Device\Harddisk0\DR0:
11:00:28.0342 4100 MBR partitions:
11:00:28.0342 4100 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x139C5, BlocksNum 0x1D4C000
11:00:28.0342 4100 \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x1D5F9C5, BlocksNum 0x38625E6B
11:00:28.0342 4100 ============================================================
11:00:28.0372 4100 C: <-> \Device\Harddisk0\DR0\Partition2
11:00:28.0372 4100 ============================================================
11:00:28.0372 4100 Initialize success
11:00:28.0372 4100 ============================================================

Adware Cleaner log


# AdwCleaner v2.007 - Logfile created 11/11/2012 at 10:37:25
# Updated 06/11/2012 by Xplode
# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)
# User : Blake - BLAKESCOMPUTER
# Boot Mode : Normal
# Running from : C:\Users\Blake\Downloads\adwcleaner.exe
# Option [Delete]


***** [Services] *****

Stopped & Deleted : Sidekick Manager

***** [Files / Folders] *****

Deleted on reboot : C:\ProgramData\Sidekick Manager
File Deleted : C:\Program Files (x86)\Mozilla Firefox\searchplugins\avg-secure-search.xml
File Deleted : C:\Users\Blake\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_home.sweetim.com_0.localstorage
File Deleted : C:\Users\Blake\AppData\Roaming\Mozilla\Firefox\Profiles\vvylvmlg.default\searchplugins\Askcom.xml
File Deleted : C:\Users\Blake\AppData\Roaming\Mozilla\Firefox\Profiles\vvylvmlg.default\searchplugins\bProtect.xml
File Deleted : C:\Users\Blake\AppData\Roaming\Mozilla\Firefox\Profiles\vvylvmlg.default\searchplugins\Conduit.xml
Folder Deleted : C:\Program Files (x86)\Conduit
Folder Deleted : C:\Program Files (x86)\Savings Sidekick
Folder Deleted : C:\ProgramData\IBUpdaterService
Folder Deleted : C:\ProgramData\InstallMate
Folder Deleted : C:\ProgramData\Premium
Folder Deleted : C:\ProgramData\Tarma Installer
Folder Deleted : C:\Users\Blake\AppData\Local\Conduit
Folder Deleted : C:\Users\Blake\AppData\Local\Savings Sidekick
Folder Deleted : C:\Users\Blake\AppData\LocalLow\Conduit
Folder Deleted : C:\Users\Blake\AppData\LocalLow\SweetIM
Folder Deleted : C:\Users\Blake\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Sidekick Manager
Folder Deleted : C:\Users\Blake\AppData\Roaming\Mozilla\Firefox\Profiles\vvylvmlg.default\ConduitCommon
Folder Deleted : C:\Users\Blake\AppData\Roaming\Mozilla\Firefox\Profiles\vvylvmlg.default\CT2405280
Folder Deleted : C:\Users\Blake\AppData\Roaming\Mozilla\Firefox\Profiles\vvylvmlg.default\extensions\{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3}
Folder Deleted : C:\Users\Blake\AppData\Roaming\Mozilla\Firefox\Profiles\vvylvmlg.default\extensions\[email protected]
Folder Deleted : C:\Users\Blake\AppData\Roaming\Mozilla\Firefox\Profiles\vvylvmlg.default\FCTB
Folder Deleted : C:\Users\Blake\AppData\Roaming\Mozilla\Firefox\Profiles\vvylvmlg.default\SweetIMToolbarData

***** [Registry] *****

Key Deleted : HKCU\Software\AppDataLow\Software\Conduit
Key Deleted : HKCU\Software\AppDataLow\Software\ConduitSearchScopes
Key Deleted : HKCU\Software\AppDataLow\Software\Crossrider
Key Deleted : HKCU\Software\AppDataLow\Software\Savings Sidekick
Key Deleted : HKCU\Software\AppDataLow\Software\SmartBar
Key Deleted : HKCU\Software\bProtector
Key Deleted : HKCU\Software\DataMngr
Key Deleted : HKCU\Software\DataMngr_Toolbar
Key Deleted : HKCU\Software\IGearSettings
Key Deleted : HKCU\Software\InstalledBrowserExtensions
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\bProtectSettings
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D4027C7F-154A-4066-A1AD-4243D8127440}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{00000000-6E41-4FD3-8538-502F5495E5FC}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35D-6118-11DC-9C72-001320C79847}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Deleted : HKCU\Software\Softonic
Key Deleted : HKCU\Software\Zugo
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Deleted : HKLM\Software\bProtector
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{7E8A36EA-2501-4ED3-A3C8-CFA9143FB169}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{CFDAFE39-20CE-451D-BD45-A37452F39CF0}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\YontooIEClient.DLL
Key Deleted : HKLM\SOFTWARE\Classes\FCSB000063445.JSOptionsImpl
Key Deleted : HKLM\SOFTWARE\Classes\FCSB000063445.JSOptionsImpl.1
Key Deleted : HKLM\SOFTWARE\Classes\FCSB000063445.Shopping
Key Deleted : HKLM\SOFTWARE\Classes\FCSB000063445.Shopping.1
Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.BandObject
Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.BandObject.1
Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT2790392
Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT3227982
Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.ToolbarHelperObject
Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.ToolbarHelperObject.1
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{6857AC4A-95B4-4E2C-B2D2-8A235FCCEF4A}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}
Key Deleted : HKLM\SOFTWARE\Classes\YontooIEClient.Api
Key Deleted : HKLM\SOFTWARE\Classes\YontooIEClient.Api.1
Key Deleted : HKLM\SOFTWARE\Classes\YontooIEClient.Layers
Key Deleted : HKLM\Software\Conduit
Key Deleted : HKLM\Software\DataMngr
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{22222222-2222-2222-2222-220022502260}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{33333333-3333-3333-3333-330033503360}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{7E84186E-B5DE-4226-8A66-6E49C6B511B4}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{99066096-8989-4612-841F-621A01D54AD7}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{CC5AD34C-6F10-4CB3-B74A-C2DD4D5060A3}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{FE9271F2-6EFD-44B0-A826-84C829536E93}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{1C888195-0160-4883-91B7-294C0CE2F277}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{66666666-6666-6666-6666-660066506660}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{77777777-7777-7777-7777-770077507760}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{99ACA0F7-D864-45CB-8C40-FD42A077E7CA}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\dhdepfaagokllfmhfbcfmocaeigmoebo
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\niapdbllcanepiiimjjndipklodoedlc
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{15D2D75C-9CB2-4EFD-BAD7-B9B4CB4BC693}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Savings Sidekick
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{1C888195-0160-4883-91B7-294C0CE2F277}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{55555555-5555-5555-5555-550055505560}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660066506660}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{77777777-7777-7777-7777-770077507760}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{99ACA0F7-D864-45CB-8C40-FD42A077E7CA}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}
Key Deleted : HKLM\SOFTWARE\Tarma Installer
Value Deleted : HKCU\Software\Mozilla\Firefox\Extensions [{b64982b1-d112-42b5-b1e4-d3867c4533f8}]

***** [Internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16421

Replaced : [HKCU\Software\Microsoft\Internet Explorer\Main - Start Page] = hxxp://search.conduit.com?SearchSource=10&ctid=CT3227982 --> hxxp://www.google.com
Deleted : [HKCU\Software\Microsoft\Internet Explorer\Main - bProtector Start Page]

-\\ Mozilla Firefox v16.0.2 (en-US)

Profile name : default
File : C:\Users\Blake\AppData\Roaming\Mozilla\Firefox\Profiles\vvylvmlg.default\prefs.js

C:\Users\Blake\AppData\Roaming\Mozilla\Firefox\Profiles\vvylvmlg.default\user.js ... Deleted !

Deleted : user_pref("CT2405280..clientLogIsEnabled", false);
Deleted : user_pref("CT2405280..clientLogServiceUrl", "hxxp://clientlog.users.conduit.com/ClientDiagnostics.as[...]
Deleted : user_pref("CT2405280..uninstallLogServiceUrl", "hxxp://uninstall.users.conduit.com/Uninstall.asmx/Re[...]
Deleted : user_pref("CT2405280.ALLOW_SHOWING_HIDDEN_TOOLBAR", false);
Deleted : user_pref("CT2405280.AboutPrivacyUrl", "hxxp://www.conduit.com/privacy/Default.aspx");
Deleted : user_pref("CT2405280.AppTrackingLastCheckTime", "Sat Aug 18 2012 15:13:20 GMT-0500 (Central Daylight[...]
Deleted : user_pref("CT2405280.BrowserCompStateIsOpen_129659301444269038", true);
Deleted : user_pref("CT2405280.BrowserCompStateIsOpen_129774179987157757", true);
Deleted : user_pref("CT2405280.BrowserCompStateIsOpen_129784483889712321", true);
Deleted : user_pref("CT2405280.BrowserCompStateIsOpen_129791224268491262", true);
Deleted : user_pref("CT2405280.CT2405280", "CT2405280");
Deleted : user_pref("CT2405280.CurrentServerDate", "11-11-2012");
Deleted : user_pref("CT2405280.DSInstall", false);
Deleted : user_pref("CT2405280.DialogsAlignMode", "LTR");
Deleted : user_pref("CT2405280.DialogsGetterLastCheckTime", "Sat Nov 10 2012 20:57:00 GMT-0600 (Central Standa[...]
Deleted : user_pref("CT2405280.DownloadReferralCookieData", "");
Deleted : user_pref("CT2405280.EMailNotifierPollDate", "Wed May 16 2012 18:05:02 GMT-0500 (Central Daylight Ti[...]
Deleted : user_pref("CT2405280.FirstServerDate", "7-12-2011");
Deleted : user_pref("CT2405280.FirstTime", true);
Deleted : user_pref("CT2405280.FirstTimeFF3", true);
Deleted : user_pref("CT2405280.FixPageNotFoundErrors", false);
Deleted : user_pref("CT2405280.GroupingServerCheckInterval", 1440);
Deleted : user_pref("CT2405280.GroupingServiceUrl", "hxxp://grouping.services.conduit.com/");
Deleted : user_pref("CT2405280.HPInstall", false);
Deleted : user_pref("CT2405280.HasUserGlobalKeys", true);
Deleted : user_pref("CT2405280.Initialize", true);
Deleted : user_pref("CT2405280.InitializeCommonPrefs", true);
Deleted : user_pref("CT2405280.InstallationAndCookieDataSentCount", 3);
Deleted : user_pref("CT2405280.InstallationType", "Unknown");
Deleted : user_pref("CT2405280.InstalledDate", "Tue Dec 06 2011 18:49:11 GMT-0600 (Central Standard Time)");
Deleted : user_pref("CT2405280.InvalidateCache", false);
Deleted : user_pref("CT2405280.IsAlertDBUpdated", true);
Deleted : user_pref("CT2405280.IsGrouping", false);
Deleted : user_pref("CT2405280.IsInitSetupIni", true);
Deleted : user_pref("CT2405280.IsMulticommunity", false);
Deleted : user_pref("CT2405280.IsOpenThankYouPage", true);
Deleted : user_pref("CT2405280.IsOpenUninstallPage", true);
Deleted : user_pref("CT2405280.LanguagePackLastCheckTime", "Sat Nov 10 2012 20:57:20 GMT-0600 (Central Standar[...]
Deleted : user_pref("CT2405280.LanguagePackReloadIntervalMM", 1440);
Deleted : user_pref("CT2405280.LanguagePackServiceUrl", "hxxp://translation.users.conduit.com/Translation.ashx[...]
Deleted : user_pref("CT2405280.LastLogin_3.10.0.1", "Tue Apr 17 2012 18:30:54 GMT-0500 (Central Daylight Time)[...]
Deleted : user_pref("CT2405280.LastLogin_3.12.0.7", "Wed Apr 25 2012 18:37:58 GMT-0500 (Central Daylight Time)[...]
Deleted : user_pref("CT2405280.LastLogin_3.12.2.3", "Wed May 30 2012 22:17:14 GMT-0500 (Central Daylight Time)[...]
Deleted : user_pref("CT2405280.LastLogin_3.13.0.6", "Sun Jul 15 2012 15:38:54 GMT-0500 (Central Daylight Time)[...]
Deleted : user_pref("CT2405280.LastLogin_3.14.1.0", "Mon Aug 27 2012 14:39:25 GMT-0500 (Central Daylight Time)[...]
Deleted : user_pref("CT2405280.LastLogin_3.15.1.0", "Sun Nov 11 2012 10:13:20 GMT-0600 (Central Standard Time)[...]
Deleted : user_pref("CT2405280.LastLogin_3.8.1.0", "Tue Jan 10 2012 21:23:58 GMT-0600 (Central Standard Time)"[...]
Deleted : user_pref("CT2405280.LastLogin_3.9.0.3", "Tue Mar 06 2012 19:37:55 GMT-0600 (Central Standard Time)"[...]
Deleted : user_pref("CT2405280.LatestVersion", "3.16.0.3");
Deleted : user_pref("CT2405280.Locale", "en-us");
Deleted : user_pref("CT2405280.MCDetectTooltipHeight", "83");
Deleted : user_pref("CT2405280.MCDetectTooltipUrl", "hxxp://@[email protected]/rank/tooltip/?version=1");
Deleted : user_pref("CT2405280.MCDetectTooltipWidth", "295");
Deleted : user_pref("CT2405280.MyStuffEnabledAtInstallation", true);
Deleted : user_pref("CT2405280.OriginalFirstVersion", "3.8.1.0");
Deleted : user_pref("CT2405280.RadioIsPodcast", false);
Deleted : user_pref("CT2405280.RadioLastCheckTime", "Wed May 16 2012 18:05:03 GMT-0500 (Central Daylight Time)[...]
Deleted : user_pref("CT2405280.RadioLastUpdateIPServer", "3");
Deleted : user_pref("CT2405280.RadioLastUpdateServer", "129167775315800000");
Deleted : user_pref("CT2405280.RadioMediaID", "20503713");
Deleted : user_pref("CT2405280.RadioMediaType", "Media Player");
Deleted : user_pref("CT2405280.RadioMenuSelectedID", "EBRadioMenu_CT240528020503713");
Deleted : user_pref("CT2405280.RadioShrinkedFromSetup", false);
Deleted : user_pref("CT2405280.RadioStationName", "Virgin%20Radio%20Classic%20Rock");
Deleted : user_pref("CT2405280.RadioStationURL", "hxxp://www.smgradio.com/core/audio/wmp/live.asx?service=vcbb[...]
Deleted : user_pref("CT2405280.SHRINK_TOOLBAR", 1);
Deleted : user_pref("CT2405280.SearchBoxWidth", 100);
Deleted : user_pref("CT2405280.SearchCaption", "Softonic-Eng7 Customized Web Search");
Deleted : user_pref("CT2405280.SearchFromAddressBarIsInit", true);
Deleted : user_pref("CT2405280.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT240[...]
Deleted : user_pref("CT2405280.SearchInNewTabEnabled", true);
Deleted : user_pref("CT2405280.SearchInNewTabIntervalMM", 1440);
Deleted : user_pref("CT2405280.SearchInNewTabLastCheckTime", "Sat Nov 10 2012 20:57:07 GMT-0600 (Central Stand[...]
Deleted : user_pref("CT2405280.SearchInNewTabServiceUrl", "hxxp://newtab.conduit-hosting.com/newtab/?ctid=EB_T[...]
Deleted : user_pref("CT2405280.SearchInNewTabUsageUrl", "hxxp://usage.hosting.toolbar.conduit-services.com/usa[...]
Deleted : user_pref("CT2405280.SendProtectorDataViaLogin", true);
Deleted : user_pref("CT2405280.ServiceMapLastCheckTime", "Sat Nov 10 2012 20:57:20 GMT-0600 (Central Standard [...]
Deleted : user_pref("CT2405280.SettingsLastCheckTime", "Sun Nov 11 2012 10:13:18 GMT-0600 (Central Standard Ti[...]
Deleted : user_pref("CT2405280.SettingsLastUpdate", "1352141592");
Deleted : user_pref("CT2405280.TBHomePageUrl", "hxxp://search.conduit.com/?ctid=CT2405280&SearchSource=13");
Deleted : user_pref("CT2405280.ThirdPartyComponentsInterval", 504);
Deleted : user_pref("CT2405280.ThirdPartyComponentsLastCheck", "Tue Oct 30 2012 18:49:13 GMT-0500 (Central Day[...]
Deleted : user_pref("CT2405280.ThirdPartyComponentsLastUpdate", "1331805997");
Deleted : user_pref("CT2405280.ToolbarShrinkedFromSetup", false);
Deleted : user_pref("CT2405280.TrusteLinkUrl", "hxxp://trust.conduit.com/CT2405280");
Deleted : user_pref("CT2405280.TrustedApiDomains", "conduit.com,conduit-hosting.com,conduit-services.com,clien[...]
Deleted : user_pref("CT2405280.UserID", "UN66808639067620094");
Deleted : user_pref("CT2405280.ValidationData_Search", 2);
Deleted : user_pref("CT2405280.ValidationData_Toolbar", 2);
Deleted : user_pref("CT2405280.WeatherNetwork", "");
Deleted : user_pref("CT2405280.WeatherPollDate", "Wed May 16 2012 22:25:06 GMT-0500 (Central Daylight Time)");
Deleted : user_pref("CT2405280.WeatherUnit", "F");
Deleted : user_pref("CT2405280.alertChannelId", "799768");
Deleted : user_pref("CT2405280.backendstorage.autocompletepro_enable", "31");
Deleted : user_pref("CT2405280.backendstorage.autocompletepro_enable_auto", "31");
Deleted : user_pref("CT2405280.backendstorage.cb_firstuse0100", "31");
Deleted : user_pref("CT2405280.backendstorage.cb_user_id_000", "43423636303633303437353734325F46697265666F78")[...]
Deleted : user_pref("CT2405280.backendstorage.cbcountry_000", "5553");
Deleted : user_pref("CT2405280.backendstorage.cbfirsttime", "4D6F6E2041707220303920323031322031313A34393A31322[...]
Deleted : user_pref("CT2405280.backendstorage.ct2405280ads1", "25374225323261647325323225334125354225374225323[...]
Deleted : user_pref("CT2405280.backendstorage.ct2405280current_term", "");
Deleted : user_pref("CT2405280.backendstorage.ct2405280isadsdisabled", "66616C7365");
Deleted : user_pref("CT2405280.backendstorage.ct2405280sdate", "2D31");
Deleted : user_pref("CT2405280.backendstorage.hxxp://api10_thetrafficstat_net.pid2", "633562393533333039616131[...]
Deleted : user_pref("CT2405280.backendstorage.hxxp://api15_thetrafficstat_net.pid2", "633562393533333039616131[...]
Deleted : user_pref("CT2405280.backendstorage.hxxp://api16_thetrafficstat_net.pid2", "633562393533333039616131[...]
Deleted : user_pref("CT2405280.backendstorage.hxxp://api18_thetrafficstat_net.pid2", "633562393533333039616131[...]
Deleted : user_pref("CT2405280.backendstorage.hxxp://api19_thetrafficstat_net.pid2", "633562393533333039616131[...]
Deleted : user_pref("CT2405280.backendstorage.hxxp://api20_thetrafficstat_net.pid2", "633562393533333039616131[...]
Deleted : user_pref("CT2405280.backendstorage.hxxp://api21_thetrafficstat_net.pid2", "633562393533333039616131[...]
Deleted : user_pref("CT2405280.backendstorage.hxxp://api22_thetrafficstat_net.pid2", "633562393533333039616131[...]
Deleted : user_pref("CT2405280.backendstorage.hxxp://api25_thetrafficstat_net.pid2", "633562393533333039616131[...]
Deleted : user_pref("CT2405280.backendstorage.hxxp://api26_thetrafficstat_net.pid2", "633562393533333039616131[...]
Deleted : user_pref("CT2405280.backendstorage.hxxp://api28_thetrafficstat_net.pid2", "626661326662656662383733[...]
Deleted : user_pref("CT2405280.backendstorage.hxxp://api29_thetrafficstat_net.pid2", "626661326662656662383733[...]
Deleted : user_pref("CT2405280.backendstorage.hxxp://api30_thetrafficstat_net.pid2", "626661326662656662383733[...]
Deleted : user_pref("CT2405280.backendstorage.hxxp://api31_thetrafficstat_net.pid2", "626661326662656662383733[...]
Deleted : user_pref("CT2405280.backendstorage.hxxp://api32_thetrafficstat_net.pid2", "626661326662656662383733[...]
Deleted : user_pref("CT2405280.backendstorage.hxxp://api6_thetrafficstat_net.pid2", "6335623935333330396161313[...]
Deleted : user_pref("CT2405280.backendstorage.printitgreenstatus", "74727565");
Deleted : user_pref("CT2405280.backendstorage.shoppingapp.gk.exipres", "546875204D617920313720323031322032303A[...]
Deleted : user_pref("CT2405280.backendstorage.shoppingapp.gk.geolocation", "756E6974656420737461746573");
Deleted : user_pref("CT2405280.backendstorage.url_history0001", "687474703A2F2F7777772E667572616666696E6974792[...]
Deleted : user_pref("CT2405280.components.1000034", false);
Deleted : user_pref("CT2405280.components.1000082", false);
Deleted : user_pref("CT2405280.components.1000234", false);
Deleted : user_pref("CT2405280.components.129460356363731287", false);
Deleted : user_pref("CT2405280.components.129460356364043788", false);
Deleted : user_pref("CT2405280.components.129530456275961869", false);
Deleted : user_pref("CT2405280.components.129530456401347705", false);
Deleted : user_pref("CT2405280.components.129635774053319306", false);
Deleted : user_pref("CT2405280.components.129659301444269038", false);
Deleted : user_pref("CT2405280.components.129774179987157757", false);
Deleted : user_pref("CT2405280.components.129784483889712321", false);
Deleted : user_pref("CT2405280.components.129791224268491262", false);
Deleted : user_pref("CT2405280.components.4483181016027223104", false);
Deleted : user_pref("CT2405280.components.7794790390421175448", false);
Deleted : user_pref("CT2405280.generalConfigFromLogin", "{\"ApiMaxAlerts\":\"12\",\"SocialDomains\":\"social.c[...]
Deleted : user_pref("CT2405280.globalFirstTimeInfoLastCheckTime", "Thu Nov 08 2012 20:47:55 GMT-0600 (Central [...]
Deleted : user_pref("CT2405280.homepageProtectorEnableByLogin", true);
Deleted : user_pref("CT2405280.initDone", true);
Deleted : user_pref("CT2405280.isAppTrackingManagerOn", false);
Deleted : user_pref("CT2405280.isFirstRadioInstallation", false);
Deleted : user_pref("CT2405280.myStuffEnabled", true);
Deleted : user_pref("CT2405280.myStuffPublihserMinWidth", 400);
Deleted : user_pref("CT2405280.myStuffSearchUrl", "hxxp://Apps.conduit.com/search?q=SEARCH_TERM&SearchSourceOr[...]
Deleted : user_pref("CT2405280.myStuffServiceIntervalMM", 1440);
Deleted : user_pref("CT2405280.myStuffServiceUrl", "hxxp://mystuff.conduit-services.com/MyStuffService.ashx?Co[...]
Deleted : user_pref("CT2405280.oldAppsList", "128325851945531999,128310509462438058,111,129791224268491262,129[...]
Deleted : user_pref("CT2405280.revertSettingsEnabled", false);
Deleted : user_pref("CT2405280.searchProtectorDialogDelayInSec", 10);
Deleted : user_pref("CT2405280.searchProtectorEnableByLogin", true);
Deleted : user_pref("CT2405280.testingCtid", "");
Deleted : user_pref("CT2405280.toolbarAppMetaDataLastCheckTime", "Sat Nov 10 2012 20:57:22 GMT-0600 (Central S[...]
Deleted : user_pref("CT2405280.toolbarContextMenuLastCheckTime", "Tue Oct 30 2012 18:49:19 GMT-0500 (Central D[...]
Deleted : user_pref("CT2405280.usagesFlag", 2);
Deleted : user_pref("CT2790392..clientLogIsEnabled", true);
Deleted : user_pref("CT2790392..clientLogServiceUrl", "hxxp://clientlog.users.conduit.com/ClientDiagnostics.as[...]
Deleted : user_pref("CT2790392..uninstallLogServiceUrl", "hxxp://uninstall.users.conduit.com/Uninstall.asmx/Re[...]
Deleted : user_pref("CT2790392.ALLOW_SHOWING_HIDDEN_TOOLBAR", false);
Deleted : user_pref("CT2790392.AboutPrivacyUrl", "hxxp://www.conduit.com/privacy/Default.aspx");
Deleted : user_pref("CT2790392.AppTrackingLastCheckTime", "Mon Nov 28 2011 16:24:13 GMT-0600 (Central Standard[...]
Deleted : user_pref("CT2790392.BrowserCompStateIsOpen_129633547190125290", true);
Deleted : user_pref("CT2790392.CTID", "CT2790392");
Deleted : user_pref("CT2790392.CurrentServerDate", "6-12-2011");
Deleted : user_pref("CT2790392.DSChangedManually", false);
Deleted : user_pref("CT2790392.DSInstall", true);
Deleted : user_pref("CT2790392.DialogsAlignMode", "LTR");
Deleted : user_pref("CT2790392.DialogsGetterLastCheckTime", "Sun Dec 04 2011 19:29:29 GMT-0600 (Central Standa[...]
Deleted : user_pref("CT2790392.DownloadReferralCookieData", "");
Deleted : user_pref("CT2790392.EMailNotifierPollDate", "Mon Dec 05 2011 22:07:33 GMT-0600 (Central Standard Ti[...]
Deleted : user_pref("CT2790392.FeedLastCount129313977501788460", 480);
Deleted : user_pref("CT2790392.FeedPollDate129313974171006416", "Mon Dec 05 2011 21:07:30 GMT-0600 (Central St[...]
Deleted : user_pref("CT2790392.FeedPollDate129313975698350231", "Mon Dec 05 2011 21:07:30 GMT-0600 (Central St[...]
Deleted : user_pref("CT2790392.FeedPollDate129313976370850190", "Mon Dec 05 2011 21:07:30 GMT-0600 (Central St[...]
Deleted : user_pref("CT2790392.FeedPollDate129313976648818968", "Mon Dec 05 2011 21:07:30 GMT-0600 (Central St[...]
Deleted : user_pref("CT2790392.FeedPollDate129313977444757117", "Mon Dec 05 2011 21:07:30 GMT-0600 (Central St[...]
Deleted : user_pref("CT2790392.FeedPollDate129313980389131455", "Mon Dec 05 2011 21:07:30 GMT-0600 (Central St[...]
Deleted : user_pref("CT2790392.FeedPollDate129313980655381977", "Mon Dec 05 2011 21:07:30 GMT-0600 (Central St[...]
Deleted : user_pref("CT2790392.FeedPollDate129313980886163259", "Mon Dec 05 2011 21:07:31 GMT-0600 (Central St[...]
Deleted : user_pref("CT2790392.FeedPollDate129313981234756535", "Mon Dec 05 2011 21:07:31 GMT-0600 (Central St[...]
Deleted : user_pref("CT2790392.FeedPollDate129313983226631720", "Mon Dec 05 2011 21:07:31 GMT-0600 (Central St[...]
Deleted : user_pref("CT2790392.FeedPollDate129313983607725691", "Mon Dec 05 2011 21:07:31 GMT-0600 (Central St[...]
Deleted : user_pref("CT2790392.FeedTTL129313974171006416", 10);
Deleted : user_pref("CT2790392.FeedTTL129313977444757117", 15);
Deleted : user_pref("CT2790392.FeedTTL129313980655381977", 5);
Deleted : user_pref("CT2790392.FeedTTL129313981234756535", 5);
Deleted : user_pref("CT2790392.FirstServerDate", "15-11-2011");
Deleted : user_pref("CT2790392.FirstTime", true);
Deleted : user_pref("CT2790392.FirstTimeFF3", true);
Deleted : user_pref("CT2790392.FixPageNotFoundErrors", false);
Deleted : user_pref("CT2790392.GroupingServerCheckInterval", 1440);
Deleted : user_pref("CT2790392.GroupingServiceUrl", "hxxp://grouping.services.conduit.com/");
Deleted : user_pref("CT2790392.HPInstall", true);
Deleted : user_pref("CT2790392.HasUserGlobalKeys", true);
Deleted : user_pref("CT2790392.HomePageProtectorEnabled", true);
Deleted : user_pref("CT2790392.HomepageBeforeUnload", "hxxp://search.conduit.com/?ctid=CT2790392&SearchSource=[...]
Deleted : user_pref("CT2790392.Initialize", true);
Deleted : user_pref("CT2790392.InitializeCommonPrefs", true);
Deleted : user_pref("CT2790392.InstallationAndCookieDataSentCount", 3);
Deleted : user_pref("CT2790392.InstallationType", "UnknownIntegration");
Deleted : user_pref("CT2790392.InstalledDate", "Mon Nov 14 2011 18:02:41 GMT-0600 (Central Standard Time)");
Deleted : user_pref("CT2790392.IsAlertDBUpdated", true);
Deleted : user_pref("CT2790392.IsGrouping", false);
Deleted : user_pref("CT2790392.IsInitSetupIni", true);
Deleted : user_pref("CT2790392.IsMulticommunity", false);
Deleted : user_pref("CT2790392.IsOpenThankYouPage", true);
Deleted : user_pref("CT2790392.IsOpenUninstallPage", false);
Deleted : user_pref("CT2790392.IsProtectorsInit", true);
Deleted : user_pref("CT2790392.LanguagePackLastCheckTime", "Mon Dec 05 2011 17:07:30 GMT-0600 (Central Standar[...]
Deleted : user_pref("CT2790392.LanguagePackReloadIntervalMM", 1440);
Deleted : user_pref("CT2790392.LanguagePackServiceUrl", "hxxp://translation.users.conduit.com/Translation.ashx[...]
Deleted : user_pref("CT2790392.LastLogin_3.8.0.8", "Mon Dec 05 2011 20:20:08 GMT-0600 (Central Standard Time)"[...]
Deleted : user_pref("CT2790392.LatestVersion", "3.8.1.0");
Deleted : user_pref("CT2790392.Locale", "en");
Deleted : user_pref("CT2790392.MCDetectTooltipHeight", "83");
Deleted : user_pref("CT2790392.MCDetectTooltipUrl", "hxxp://@[email protected]/rank/tooltip/?version=1");
Deleted : user_pref("CT2790392.MCDetectTooltipWidth", "295");
Deleted : user_pref("CT2790392.MyStuffEnabledAtInstallation", true);
Deleted : user_pref("CT2790392.OriginalFirstVersion", "3.8.0.8");
Deleted : user_pref("CT2790392.SavedHomepage", "hxxp://home.sweetim.com");
Deleted : user_pref("CT2790392.SearchCaption", " ");
Deleted : user_pref("CT2790392.SearchEngineBeforeUnload", "Ask.com");
Deleted : user_pref("CT2790392.SearchFromAddressBarIsInit", true);
Deleted : user_pref("CT2790392.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT279[...]
Deleted : user_pref("CT2790392.SearchInNewTabEnabled", true);
Deleted : user_pref("CT2790392.SearchInNewTabIntervalMM", 1440);
Deleted : user_pref("CT2790392.SearchInNewTabLastCheckTime", "Mon Dec 05 2011 17:07:29 GMT-0600 (Central Stand[...]
Deleted : user_pref("CT2790392.SearchInNewTabServiceUrl", "hxxp://newtab.conduit-hosting.com/newtab/?ctid=EB_T[...]
Deleted : user_pref("CT2790392.SearchInNewTabUsageUrl", "hxxp://usage.hosting.toolbar.conduit-services.com/usa[...]
Deleted : user_pref("CT2790392.SearchProtectorEnabled", true);
Deleted : user_pref("CT2790392.SearchProtectorToolbarDisabled", false);
Deleted : user_pref("CT2790392.SendProtectorDataViaLogin", true);
Deleted : user_pref("CT2790392.ServiceMapLastCheckTime", "Mon Dec 05 2011 17:07:30 GMT-0600 (Central Standard [...]
Deleted : user_pref("CT2790392.SettingsLastCheckTime", "Mon Dec 05 2011 16:20:05 GMT-0600 (Central Standard Ti[...]
Deleted : user_pref("CT2790392.SettingsLastUpdate", "1321891544");
Deleted : user_pref("CT2790392.TBHomePageUrl", "hxxp://search.conduit.com/?ctid=CT2790392&SearchSource=13");
Deleted : user_pref("CT2790392.ThirdPartyComponentsInterval", 504);
Deleted : user_pref("CT2790392.ThirdPartyComponentsLastCheck", "Mon Nov 14 2011 18:02:40 GMT-0600 (Central Sta[...]
Deleted : user_pref("CT2790392.ThirdPartyComponentsLastUpdate", "1312887586");
Deleted : user_pref("CT2790392.ToolbarShrinkedFromSetup", false);
Deleted : user_pref("CT2790392.TrusteLinkUrl", "hxxp://trust.conduit.com/CT2790392");
Deleted : user_pref("CT2790392.TrustedApiDomains", "conduit.com,conduit-hosting.com,conduit-services.com,clien[...]
Deleted : user_pref("CT2790392.UserID", "UN35828793572501954");
Deleted : user_pref("CT2790392.WeatherNetwork", "");
Deleted : user_pref("CT2790392.WeatherPollDate", "Mon Dec 05 2011 22:07:34 GMT-0600 (Central Standard Time)");
Deleted : user_pref("CT2790392.WeatherUnit", "C");
Deleted : user_pref("CT2790392.alertChannelId", "1182482");
Deleted : user_pref("CT2790392.backendstorage.cbfirsttime", "4D6F6E204E6F7620313420323031312031383A30323A34372[...]
Deleted : user_pref("CT2790392.backendstorage.pairingkey", "38333833464235424632354543463241323931373330423533[...]
Deleted : user_pref("CT2790392.backendstorage.scriptsource", "687474703A2F2F3132372E302E302E313A31303030302F67[...]
Deleted : user_pref("CT2790392.backendstorage.url_history", "687474703A2F2F7777772E776F7777696B692E636F6D2F526[...]
Deleted : user_pref("CT2790392.backendstorage.url_history_time", "31333233313338353239323032");
Deleted : user_pref("CT2790392.backendstorage.uttorrents", "7B226275696C64223A32353638322C226C6162656C223A5B5D[...]
Deleted : user_pref("CT2790392.generalConfigFromLogin", "{\"ApiMaxAlerts\":\"12\",\"SocialDomains\":\"social.c[...]
Deleted : user_pref("CT2790392.globalFirstTimeInfoLastCheckTime", "Mon Dec 05 2011 20:20:08 GMT-0600 (Central [...]
Deleted : user_pref("CT2790392.homepageProtectorEnableByLogin", true);
Deleted : user_pref("CT2790392.initDone", true);
Deleted : user_pref("CT2790392.isAppTrackingManagerOn", true);
Deleted : user_pref("CT2790392.myStuffEnabled", true);
Deleted : user_pref("CT2790392.myStuffPublihserMinWidth", 400);
Deleted : user_pref("CT2790392.myStuffSearchUrl", "hxxp://Apps.conduit.com/search?q=SEARCH_TERM&SearchSourceOr[...]
Deleted : user_pref("CT2790392.myStuffServiceIntervalMM", 1440);
Deleted : user_pref("CT2790392.myStuffServiceUrl", "hxxp://mystuff.conduit-services.com/MyStuffService.ashx?Co[...]
Deleted : user_pref("CT2790392.oldAppsList", "129298377186075601,129298377186388102,1000234,129298377186544355[...]
Deleted : user_pref("CT2790392.revertSettingsEnabled", false);
Deleted : user_pref("CT2790392.searchProtectorDialogDelayInSec", 10);
Deleted : user_pref("CT2790392.searchProtectorEnableByLogin", true);
Deleted : user_pref("CT2790392.testingCtid", "");
Deleted : user_pref("CT2790392.toolbarAppMetaDataLastCheckTime", "Mon Dec 05 2011 17:07:33 GMT-0600 (Central S[...]
Deleted : user_pref("CT2790392.toolbarContextMenuLastCheckTime", "Mon Nov 28 2011 18:02:45 GMT-0600 (Central S[...]
Deleted : user_pref("CT2790392.usagesFlag", 1);
Deleted : user_pref("CT3227982..clientLogIsEnabled", false);
Deleted : user_pref("CT3227982..clientLogServiceUrl", "hxxp://clientlog.users.conduit.com/ClientDiagnostics.as[...]
Deleted : user_pref("CT3227982..uninstallLogServiceUrl", "hxxp://uninstall.users.conduit.com/Uninstall.asmx/Re[...]
Deleted : user_pref("CT3227982.ALLOW_SHOWING_HIDDEN_TOOLBAR", false);
Deleted : user_pref("CT3227982.AboutPrivacyUrl", "hxxp://www.conduit.com/privacy/Default.aspx");
Deleted : user_pref("CT3227982.AppTrackingLastCheckTime", "Mon Sep 17 2012 15:50:02 GMT-0500 (Central Daylight[...]
Deleted : user_pref("CT3227982.BrowserCompStateIsOpen_9221552460232570768", true);
Deleted : user_pref("CT3227982.CTID", "CT3227982");
Deleted : user_pref("CT3227982.CurrentServerDate", "11-11-2012");
Deleted : user_pref("CT3227982.DSChangedManually", false);
Deleted : user_pref("CT3227982.DSInstall", true);
Deleted : user_pref("CT3227982.DSProtectChoice", true);
Deleted : user_pref("CT3227982.DSProtectCount", 37);
Deleted : user_pref("CT3227982.DialogsAlignMode", "LTR");
Deleted : user_pref("CT3227982.DialogsGetterLastCheckTime", "Sat Nov 10 2012 20:57:06 GMT-0600 (Central Standa[...]
Deleted : user_pref("CT3227982.DownloadReferralCookieData", "");
Deleted : user_pref("CT3227982.FirstServerDate", "30-7-2012");
Deleted : user_pref("CT3227982.FirstTime", true);
Deleted : user_pref("CT3227982.FirstTimeFF3", true);
Deleted : user_pref("CT3227982.FirstTimeHiddenVer", true);
Deleted : user_pref("CT3227982.FixPageNotFoundErrors", true);
Deleted : user_pref("CT3227982.GroupingServerCheckInterval", 1440);
Deleted : user_pref("CT3227982.GroupingServiceUrl", "hxxp://grouping.services.conduit.com/");
Deleted : user_pref("CT3227982.HPInstall", true);
Deleted : user_pref("CT3227982.HasUserGlobalKeys", true);
Deleted : user_pref("CT3227982.HomePageProtectorEnabled", false);
Deleted : user_pref("CT3227982.HomepageBeforeUnload", "hxxp://isearch.avg.com?cid=%7B8ba96d6b-ea06-4231-b43b-b[...]
Deleted : user_pref("CT3227982.Initialize", true);
Deleted : user_pref("CT3227982.InitializeCommonPrefs", true);
Deleted : user_pref("CT3227982.InstallationAndCookieDataSentCount", 3);
Deleted : user_pref("CT3227982.InstallationId", "installbrain");
Deleted : user_pref("CT3227982.InstallationType", "ConduitNSISIntegration");
Deleted : user_pref("CT3227982.InstalledDate", "Mon Jul 30 2012 00:29:11 GMT-0500 (Central Daylight Time)");
Deleted : user_pref("CT3227982.InvalidateCache", false);
Deleted : user_pref("CT3227982.IsAlertDBUpdated", true);
Deleted : user_pref("CT3227982.IsGrouping", false);
Deleted : user_pref("CT3227982.IsInitSetupIni", true);
Deleted : user_pref("CT3227982.IsMulticommunity", false);
Deleted : user_pref("CT3227982.IsOpenThankYouPage", false);
Deleted : user_pref("CT3227982.IsOpenUninstallPage", true);
Deleted : user_pref("CT3227982.IsProtectorsInit", true);
Deleted : user_pref("CT3227982.LanguagePackLastCheckTime", "Sat Nov 10 2012 20:57:22 GMT-0600 (Central Standar[...]
Deleted : user_pref("CT3227982.LanguagePackReloadIntervalMM", 1440);
Deleted : user_pref("CT3227982.LanguagePackServiceUrl", "hxxp://translation.users.conduit.com/Translation.ashx[...]
Deleted : user_pref("CT3227982.LastLogin_3.15.0.0", "Mon Aug 27 2012 14:39:25 GMT-0500 (Central Daylight Time)[...]
Deleted : user_pref("CT3227982.LastLogin_3.15.1.0", "Sun Nov 11 2012 10:13:18 GMT-0600 (Central Standard Time)[...]
Deleted : user_pref("CT3227982.LatestVersion", "3.15.1.0");
Deleted : user_pref("CT3227982.Locale", "en");
Deleted : user_pref("CT3227982.MCDetectTooltipHeight", "83");
Deleted : user_pref("CT3227982.MCDetectTooltipUrl", "hxxp://@[email protected]/rank/tooltip/?version=1");
Deleted : user_pref("CT3227982.MCDetectTooltipWidth", "295");
Deleted : user_pref("CT3227982.MyStuffEnabledAtInstallation", true);
Deleted : user_pref("CT3227982.OriginalFirstVersion", "3.15.0.0");
Deleted : user_pref("CT3227982.RadioIsPodcast", false);
Deleted : user_pref("CT3227982.RadioLastCheckTime", "Sat Nov 10 2012 20:57:29 GMT-0600 (Central Standard Time)[...]
Deleted : user_pref("CT3227982.RadioLastUpdateIPServer", "3");
Deleted : user_pref("CT3227982.RadioLastUpdateServer", "3");
Deleted : user_pref("CT3227982.RadioMediaID", "9962");
Deleted : user_pref("CT3227982.RadioMediaType", "Media Player");
Deleted : user_pref("CT3227982.RadioMenuSelectedID", "EBRadioMenu_CT32279829962");
Deleted : user_pref("CT3227982.RadioShrinkedFromSetup", false);
Deleted : user_pref("CT3227982.RadioStationName", "California%20Rock");
Deleted : user_pref("CT3227982.RadioStationURL", "hxxp://feedlive.net/california.asx");
Deleted : user_pref("CT3227982.SavedHomepage", "hxxp://isearch.avg.com?cid=%7B8ba96d6b-ea06-4231-b43b-bebe15ce[...]
Deleted : user_pref("CT3227982.SearchCaption", "appbario8 Customized Web Search");
Deleted : user_pref("CT3227982.SearchEngineBeforeUnload", "AVG Secure Search");
Deleted : user_pref("CT3227982.SearchFromAddressBarIsInit", true);
Deleted : user_pref("CT3227982.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT322[...]
Deleted : user_pref("CT3227982.SearchInNewTabEnabled", true);
Deleted : user_pref("CT3227982.SearchInNewTabIntervalMM", 1440);
Deleted : user_pref("CT3227982.SearchInNewTabLastCheckTime", "Sat Nov 10 2012 20:57:07 GMT-0600 (Central Stand[...]
Deleted : user_pref("CT3227982.SearchInNewTabServiceUrl", "hxxp://newtab.conduit-hosting.com/newtab/?ctid=EB_T[...]
Deleted : user_pref("CT3227982.SearchProtectorEnabled", true);
Deleted : user_pref("CT3227982.SearchProtectorToolbarDisabled", false);
Deleted : user_pref("CT3227982.SendProtectorDataViaLogin", true);
Deleted : user_pref("CT3227982.ServiceMapLastCheckTime", "Sat Nov 10 2012 20:57:20 GMT-0600 (Central Standard [...]
Deleted : user_pref("CT3227982.SettingsLastCheckTime", "Sun Nov 11 2012 10:13:16 GMT-0600 (Central Standard Ti[...]
Deleted : user_pref("CT3227982.SettingsLastUpdate", "1352141592");
Deleted : user_pref("CT3227982.TBHomePageUrl", "hxxp://search.conduit.com/?ctid=CT3227982&SearchSource=13");
Deleted : user_pref("CT3227982.ThirdPartyComponentsInterval", 504);
Deleted : user_pref("CT3227982.ThirdPartyComponentsLastCheck", "Tue Oct 30 2012 18:49:13 GMT-0500 (Central Day[...]
Deleted : user_pref("CT3227982.ThirdPartyComponentsLastUpdate", "1331805997");
Deleted : user_pref("CT3227982.ToolbarShrinkedFromSetup", false);
Deleted : user_pref("CT3227982.TrusteLinkUrl", "hxxp://trust.conduit.com/CT3227982");
Deleted : user_pref("CT3227982.TrustedApiDomains", "conduit.com,conduit-hosting.com,conduit-services.com,clien[...]
Deleted : user_pref("CT3227982.UserID", "UN89131977991723577");
Deleted : user_pref("CT3227982.ValidationData_Search", 1);
Deleted : user_pref("CT3227982.ValidationData_Toolbar", 2);
Deleted : user_pref("CT3227982.alertChannelId", "1663751");
Deleted : user_pref("CT3227982.autoDisableScopes", 0);
Deleted : user_pref("CT3227982.backendstorage.alertnotificationglobaltrigger", "62446179");
Deleted : user_pref("CT3227982.backendstorage.bday_app_heartbit", "31333531353532383332373338");
Deleted : user_pref("CT3227982.backendstorage.bday_firsttimealert", "6E6F");
Deleted : user_pref("CT3227982.backendstorage.bday_install", "796573");
Deleted : user_pref("CT3227982.backendstorage.bday_installdate", "32392D39");
Deleted : user_pref("CT3227982.backendstorage.bday_installfromtoolbar", "796573");
Deleted : user_pref("CT3227982.backendstorage.bday_show_time", "32392D39");
Deleted : user_pref("CT3227982.backendstorage.birthdayreminderv41_lang", "454E");
Deleted : user_pref("CT3227982.backendstorage.ct3227982ads1", "25374225323261647325323225334125354225374225323[...]
Deleted : user_pref("CT3227982.backendstorage.ct3227982current_term", "6925323532376D2B6261636B696E672B7570");
Deleted : user_pref("CT3227982.backendstorage.ct3227982sdate", "3131");
Deleted : user_pref("CT3227982.generalConfigFromLogin", "{\"ApiMaxAlerts\":\"12\",\"SocialDomains\":\"social.c[...]
Deleted : user_pref("CT3227982.globalFirstTimeInfoLastCheckTime", "Thu Nov 08 2012 20:47:55 GMT-0600 (Central [...]
Deleted : user_pref("CT3227982.homepageProtectorEnableByLogin", true);
Deleted : user_pref("CT3227982.initDone", true);
Deleted : user_pref("CT3227982.isAppTrackingManagerOn", false);
Deleted : user_pref("CT3227982.isFirstRadioInstallation", false);
Deleted : user_pref("CT3227982.myStuffEnabled", true);
Deleted : user_pref("CT3227982.myStuffPublihserMinWidth", 400);
Deleted : user_pref("CT3227982.myStuffSearchUrl", "hxxp://Apps.conduit.com/search?q=SEARCH_TERM&SearchSourceOr[...]
Deleted : user_pref("CT3227982.myStuffServiceIntervalMM", 1440);
Deleted : user_pref("CT3227982.myStuffServiceUrl", "hxxp://mystuff.conduit-services.com/MyStuffService.ashx?Co[...]
Deleted : user_pref("CT3227982.navigateToUrlOnSearch", false);
Deleted : user_pref("CT3227982.oldAppsList", "129837883711381002,129837883713256003,111,129837883713568504,129[...]
Deleted : user_pref("CT3227982.revertSettingsEnabled", false);
Deleted : user_pref("CT3227982.searchProtectorDialogDelayInSec", 10);
Deleted : user_pref("CT3227982.searchProtectorEnableByLogin", true);
Deleted : user_pref("CT3227982.testingCtid", "");
Deleted : user_pref("CT3227982.toolbarAppMetaDataLastCheckTime", "Sat Nov 10 2012 20:57:22 GMT-0600 (Central S[...]
Deleted : user_pref("CT3227982.toolbarContextMenuLastCheckTime", "Tue Oct 30 2012 18:49:19 GMT-0500 (Central D[...]
Deleted : user_pref("CT3227982.usagesFlag", 2);
Deleted : user_pref("CommunityToolbar.ConduitHomepagesList", "hxxp://search.conduit.com/?ctid=CT2790392&Search[...]
Deleted : user_pref("CommunityToolbar.ConduitSearchList", " ,appbario8 Customized Web Search");
Deleted : user_pref("CommunityToolbar.ETag.hxxp://Settings.toolbar.search.conduit.com/root/CT2405280/CT2405280[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://Settings.toolbar.search.conduit.com/root/CT2790392/CT2790392[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://Settings.toolbar.search.conduit.com/root/CT3227982/CT3227982[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/root/1182482/1178159/US", "\"0\"[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/root/1663751/1656277/US", "\"0\"[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/root/799768/795587/US", "\"0\"")[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://appsmetadata.toolbar.conduit-services.com/?ctid=CT2405280", [...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://appsmetadata.toolbar.conduit-services.com/?ctid=CT2790392", [...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://appsmetadata.toolbar.conduit-services.com/?ctid=CT3227982", [...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=GottenApps&lo[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=GottenApps&lo[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=OtherApps&loc[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=OtherApps&loc[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=SharedApps&lo[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=SharedApps&lo[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=Toolbar&local[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=Toolbar&local[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.alert.conduit-services.com/alert/dlg.pkg", "\[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.10[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.12[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.12[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.13[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.14[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.15[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.15[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.8.[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.8.[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.9.[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://servicemap.conduit-services.com/Toolbar/?ownerId=CT2405280",[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://servicemap.conduit-services.com/Toolbar/?ownerId=CT2790392",[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://servicemap.conduit-services.com/Toolbar/?ownerId=CT3227982",[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://settings.toolbar.conduit-services.com/?ctid=CT2790392&octid=[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://storage.conduit.com/BankImages/RadioSkins/StarFleet/equalize[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://storage.conduit.com/BankImages/RadioSkins/StarFleet/minimize[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://storage.conduit.com/BankImages/RadioSkins/StarFleet/play.gif[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://storage.conduit.com/BankImages/RadioSkins/StarFleet/stop.gif[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://storage.conduit.com/BankImages/RadioSkins/StarFleet/vol.gif"[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://translation.toolbar.conduit-services.com/?locale=en", "\"c22[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://translation.toolbar.conduit-services.com/?locale=en-us", "\"[...]
Deleted : user_pref("CommunityToolbar.LatestLibsPath", "file:///C:\\Users\\Blake\\AppData\\Roaming\\Mozilla\\F[...]
Deleted : user_pref("CommunityToolbar.LatestToolbarVersionInstalled", "3.15.1.0");
Deleted : user_pref("CommunityToolbar.ToolbarsList", "CT2790392,CT2405280,CT3227982");
Deleted : user_pref("CommunityToolbar.ToolbarsList2", "CT2790392,CT2405280,CT3227982");
Deleted : user_pref("CommunityToolbar.ToolbarsList4", "CT2790392,CT2405280,CT3227982");
Deleted : user_pref("CommunityToolbar.facebook.settingsLastCheckTime", "Mon Dec 05 2011 17:07:30 GMT-0600 (Cen[...]
Deleted : user_pref("CommunityToolbar.globalUserId", "eba6a5b5-d2d3-42fd-a1c3-3e7b9210886b");
Deleted : user_pref("CommunityToolbar.isAlertUrlAddedToFeedItemTable", true);
Deleted : user_pref("CommunityToolbar.isClickActionAddedToFeedItemTable", true);
Deleted : user_pref("CommunityToolbar.keywordURLSelectedCTID", "CT3227982");
Deleted : user_pref("CommunityToolbar.notifications.alertDialogsGetterLastCheckTime", "Tue Nov 06 2012 19:41:0[...]
Deleted : user_pref("CommunityToolbar.notifications.alertEnabled", true);
Deleted : user_pref("CommunityToolbar.notifications.alertInfoInterval", 1440);
Deleted : user_pref("CommunityToolbar.notifications.alertInfoLastCheckTime", "Sat Nov 10 2012 20:57:17 GMT-060[...]
Deleted : user_pref("CommunityToolbar.notifications.clientsServerUrl", "hxxp://alert.client.conduit.com");
Deleted : user_pref("CommunityToolbar.notifications.firstTimeAlertShown", true);
Deleted : user_pref("CommunityToolbar.notifications.locale", "en");
Deleted : user_pref("CommunityToolbar.notifications.loginIntervalMin", 1440);
Deleted : user_pref("CommunityToolbar.notifications.loginLastCheckTime", "Sat Nov 10 2012 20:57:10 GMT-0600 (C[...]
Deleted : user_pref("CommunityToolbar.notifications.loginLastUpdateTime", "1313487611");
Deleted : user_pref("CommunityToolbar.notifications.messageShowTimeSec", 20);
Deleted : user_pref("CommunityToolbar.notifications.servicesServerUrl", "hxxp://alert.services.conduit.com");
Deleted : user_pref("CommunityToolbar.notifications.showTrayIcon", false);
Deleted : user_pref("CommunityToolbar.notifications.userCloseIntervalMin", 300);
Deleted : user_pref("CommunityToolbar.notifications.userId", "19c425ad-e5ef-4f6d-acee-a29a5c2cfb9a");
Deleted : user_pref("CommunityToolbar.originalHomepage", "hxxp://home.sweetim.com");
Deleted : user_pref("CommunityToolbar.originalSearchEngine", "SweetIM Search");
Deleted : user_pref("browser.search.defaultengine", "Ask.com");
Deleted : user_pref("browser.search.defaultthis.engineName", "appbario8 Customized Web Search");
Deleted : user_pref("browser.search.defaulturl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3227982&Sea[...]
Deleted : user_pref("browser.search.order.2", "Ask.com");
Deleted : user_pref("browser.search.selectedEngine", "AVG Secure Search");
Deleted : user_pref("browser.startup.homepage", "hxxp://isearch.avg.com?cid=%7B8ba96d6b-ea06-4231-b43b-bebe15c[...]
Deleted : user_pref("extensions.crossriderapp5060.5060.InstallationThankYouPage", true);
Deleted : user_pref("extensions.crossriderapp5060.5060.InstallationTime", 1343625955);
Deleted : user_pref("extensions.crossriderapp5060.5060.InstallationUserSettings.searchUserConifrmation", false[...]
Deleted : user_pref("extensions.crossriderapp5060.5060.InstallationUserSettings.setHomepage", false);
Deleted : user_pref("extensions.crossriderapp5060.5060.InstallationUserSettings.setNewTab", false);
Deleted : user_pref("extensions.crossriderapp5060.5060.InstallationUserSettings.setSearch", false);
Deleted : user_pref("extensions.crossriderapp5060.5060.active", true);
Deleted : user_pref("extensions.crossriderapp5060.5060.addressbar", "");
Deleted : user_pref("extensions.crossriderapp5060.5060.affid", "0");
Deleted : user_pref("extensions.crossriderapp5060.5060.backgroundjs", "\n\n\"undefined\"!=typeof _GPL_BG_NEW&&[...]
Deleted : user_pref("extensions.crossriderapp5060.5060.backgroundver", 7);
Deleted : user_pref("extensions.crossriderapp5060.5060.can_run_bg_code", true);
Deleted : user_pref("extensions.crossriderapp5060.5060.certdomaininstaller", "");
Deleted : user_pref("extensions.crossriderapp5060.5060.changeprevious", false);
Deleted : user_pref("extensions.crossriderapp5060.5060.cookie.InstallationTime.expiration", "Fri Feb 01 2030 0[...]
Deleted : user_pref("extensions.crossriderapp5060.5060.cookie.InstallationTime.value", "1343625955");
Deleted : user_pref("extensions.crossriderapp5060.5060.cookie.InstallerParams.expiration", "Fri Feb 01 2030 00[...]
Deleted : user_pref("extensions.crossriderapp5060.5060.cookie._GPL_aoi.expiration", "Fri Feb 01 2030 00:00:00 [...]
Deleted : user_pref("extensions.crossriderapp5060.5060.cookie._GPL_aoi.value", "1343625955");
Deleted : user_pref("extensions.crossriderapp5060.5060.cookie._GPL_blocklist.expiration", "Sun Nov 11 2012 10:[...]
Deleted : user_pref("extensions.crossriderapp5060.5060.cookie._GPL_blocklist.value", "%22nonexistantdomain.com[...]
Deleted : user_pref("extensions.crossriderapp5060.5060.cookie._GPL_country_code.expiration", "Tue Nov 13 2012 [...]
Deleted : user_pref("extensions.crossriderapp5060.5060.cookie._GPL_country_code.value", "%22US%22");
Deleted : user_pref("extensions.crossriderapp5060.5060.cookie._GPL_crr.expiration", "Fri Feb 01 2030 00:00:00 [...]
Deleted : user_pref("extensions.crossriderapp5060.5060.cookie._GPL_crr.value", "1352650395");
Deleted : user_pref("extensions.crossriderapp5060.5060.cookie._GPL_hotfix20111102645.expiration", "Fri Feb 01 [...]
Deleted : user_pref("extensions.crossriderapp5060.5060.cookie._GPL_hotfix20111102645.value", "%221%22");
Deleted : user_pref("extensions.crossriderapp5060.5060.cookie._GPL_installer_params.expiration", "Fri Feb 01 2[...]
Deleted : user_pref("extensions.crossriderapp5060.5060.cookie._GPL_installer_params.value", "%7B%22source_id%2[...]
Deleted : user_pref("extensions.crossriderapp5060.5060.cookie._GPL_parent_zoneid.expiration", "Fri Feb 01 2030[...]
Deleted : user_pref("extensions.crossriderapp5060.5060.cookie._GPL_parent_zoneid.value", "%2214019%22");
Deleted : user_pref("extensions.crossriderapp5060.5060.cookie._GPL_pc_20120828.expiration", "Fri Feb 01 2030 0[...]
Deleted : user_pref("extensions.crossriderapp5060.5060.cookie._GPL_pc_20120828.value", "1347915102365");
Deleted : user_pref("extensions.crossriderapp5060.5060.cookie._GPL_product_id.expiration", "Fri Feb 01 2030 00[...]
Deleted : user_pref("extensions.crossriderapp5060.5060.cookie._GPL_product_id.value", "%221224%22");
Deleted : user_pref("extensions.crossriderapp5060.5060.cookie._GPL_zoneid.expiration", "Fri Feb 01 2030 00:00:[...]
Deleted : user_pref("extensions.crossriderapp5060.5060.cookie._GPL_zoneid.value", "%2261911%22");
Deleted : user_pref("extensions.crossriderapp5060.5060.cookie.dbtest.expiration", "Fri Feb 01 2030 00:00:00 GM[...]
Deleted : user_pref("extensions.crossriderapp5060.5060.cookie.dbtest.value", "1347915101442");
Deleted : user_pref("extensions.crossriderapp5060.5060.description", "Savings Sidekick");
Deleted : user_pref("extensions.crossriderapp5060.5060.domain", "");
Deleted : user_pref("extensions.crossriderapp5060.5060.emailsig", "");
Deleted : user_pref("extensions.crossriderapp5060.5060.enablesearch", false);
Deleted : user_pref("extensions.crossriderapp5060.5060.exposesites", "");
Deleted : user_pref("extensions.crossriderapp5060.5060.fbremoteurl", "");
Deleted : user_pref("extensions.crossriderapp5060.5060.group", 0);
Deleted : user_pref("extensions.crossriderapp5060.5060.homepage", "");
Deleted : user_pref("extensions.crossriderapp5060.5060.iframe", false);
Deleted : user_pref("extensions.crossriderapp5060.5060.internaldb.InstallerIdentifiers.expiration", "Fri Feb 0[...]
Deleted : user_pref("extensions.crossriderapp5060.5060.internaldb.InstallerIdentifiers.value", "%7B%22installe[...]
Deleted : user_pref("extensions.crossriderapp5060.5060.internaldb.Resources_appVer.expiration", "Fri Feb 01 20[...]
Deleted : user_pref("extensions.crossriderapp5060.5060.internaldb.Resources_appVer.value", "37");
Deleted : user_pref("extensions.crossriderapp5060.5060.internaldb.Resources_lastVersion.expiration", "Fri Feb [...]
Deleted : user_pref("extensions.crossriderapp5060.5060.internaldb.Resources_lastVersion.value", "0");
Deleted : user_pref("extensions.crossriderapp5060.5060.internaldb.Resources_meta.expiration", "Fri Feb 01 2030[...]
Deleted : user_pref("extensions.crossriderapp5060.5060.internaldb.Resources_meta.value", "%7B%7D");
Deleted : user_pref("extensions.crossriderapp5060.5060.internaldb.Resources_nextCheck.expiration", "Sun Nov 11[...]
Deleted : user_pref("extensions.crossriderapp5060.5060.internaldb.Resources_nextCheck.value", "true");
Deleted : user_pref("extensions.crossriderapp5060.5060.internaldb.Resources_queue.expiration", "Fri Feb 01 203[...]
Deleted : user_pref("extensions.crossriderapp5060.5060.internaldb.Resources_queue.value", "%7B%7D");
Deleted : user_pref("extensions.crossriderapp5060.5060.internaldb.Resources_remote_resources.expiration", "Fri[...]
Deleted : user_pref("extensions.crossriderapp5060.5060.internaldb.Resources_remote_resources.value", "%7B%22re[...]
Deleted : user_pref("extensions.crossriderapp5060.5060.js", "\n\nif(\"undefined\"!=typeof _GPL_PLUGIN){var _GP[...]
Deleted : user_pref("extensions.crossriderapp5060.5060.manifesturl", "");
Deleted : user_pref("extensions.crossriderapp5060.5060.name", "Savings Sidekick");
Deleted : user_pref("extensions.crossriderapp5060.5060.newtab", "");
Deleted : user_pref("extensions.crossriderapp5060.5060.opensearch", "");
Deleted : user_pref("extensions.crossriderapp5060.5060.plugins.plugin_1.code", "appAPI._cr_config={appID:funct[...]
Deleted : user_pref("extensions.crossriderapp5060.5060.plugins.plugin_1.name", "base");
Deleted : user_pref("extensions.crossriderapp5060.5060.plugins.plugin_1.ver", 3);
Deleted : user_pref("extensions.crossriderapp5060.5060.plugins.plugin_1000014.code", "Array.prototype.indexOf|[...]
Deleted : user_pref("extensions.crossriderapp5060.5060.plugins.plugin_1000014.name", "GPL Plugin (Loader)");
Deleted : user_pref("extensions.crossriderapp5060.5060.plugins.plugin_1000014.ver", 7);
Deleted : user_pref("extensions.crossriderapp5060.5060.plugins.plugin_1000015.code", "var _GPL_BG={vars:{},rul[...]
Deleted : user_pref("extensions.crossriderapp5060.5060.plugins.plugin_1000015.name", "GPL Background (BG)");
Deleted : user_pref("extensions.crossriderapp5060.5060.plugins.plugin_1000015.ver", 4);
Deleted : user_pref("extensions.crossriderapp5060.5060.plugins.plugin_13.code", "(function(a){a.selectedText=f[...]
Deleted : user_pref("extensions.crossriderapp5060.5060.plugins.plugin_13.name", "CrossriderAppUtils");
Deleted : user_pref("extensions.crossriderapp5060.5060.plugins.plugin_13.ver", 2);
Deleted : user_pref("extensions.crossriderapp5060.5060.plugins.plugin_14.code", "if(typeof(appAPI)===\"undefin[...]
Deleted : user_pref("extensions.crossriderapp5060.5060.plugins.plugin_14.name", "CrossriderUtils");
Deleted : user_pref("extensions.crossriderapp5060.5060.plugins.plugin_14.ver", 2);
Deleted : user_pref("extensions.crossriderapp5060.5060.plugins.plugin_15.code", "(function(f){var u={};var e=M[...]
Deleted : user_pref("extensions.crossriderapp5060.5060.plugins.plugin_15.name", "FacebookFFIE");
Deleted : user_pref("extensions.crossriderapp5060.5060.plugins.plugin_15.ver", 1);
Deleted : user_pref("extensions.crossriderapp5060.5060.plugins.plugin_16.code", "(function(f,b){if(typeof(b)==[...]
Deleted : user_pref("extensions.crossriderapp5060.5060.plugins.plugin_16.name", "FFAppAPIWrapper");
Deleted : user_pref("extensions.crossriderapp5060.5060.plugins.plugin_16.ver", 3);
Deleted : user_pref("extensions.crossriderapp5060.5060.plugins.plugin_17.code", "if(typeof window!==\"undefine[...]
Deleted : user_pref("extensions.crossriderapp5060.5060.plugins.plugin_17.name", "jQuery");
Deleted : user_pref("extensions.crossriderapp5060.5060.plugins.plugin_17.ver", 3);
Deleted : user_pref("extensions.crossriderapp5060.5060.plugins.plugin_21.code", "var CrossriderDebugManager=(f[...]
Deleted : user_pref("extensions.crossriderapp5060.5060.plugins.plugin_21.name", "debug");
Deleted : user_pref("extensions.crossriderapp5060.5060.plugins.plugin_21.ver", 3);
Deleted : user_pref("extensions.crossriderapp5060.5060.plugins.plugin_22.code", "(function(a){appAPI.queueMana[...]
Deleted : user_pref("extensions.crossriderapp5060.5060.plugins.plugin_22.name", "resources");
Deleted : user_pref("extensions.crossriderapp5060.5060.plugins.plugin_22.ver", 2);
Deleted : user_pref("extensions.crossriderapp5060.5060.plugins.plugin_28.code", "var CrossriderInitializerPlug[...]
Deleted : user_pref("extensions.crossriderapp5060.5060.plugins.plugin_28.name", "initializer");
Deleted : user_pref("extensions.crossriderapp5060.5060.plugins.plugin_28.ver", 2);
Deleted : user_pref("extensions.crossriderapp5060.5060.plugins.plugin_4.code", "/*! jQuery v1.7.1 jquery.com |[...]
Deleted : user_pref("extensions.crossriderapp5060.5060.plugins.plugin_4.name", "jquery_1_7_1");
Deleted : user_pref("extensions.crossriderapp5060.5060.plugins.plugin_4.ver", 3);
Deleted : user_pref("extensions.crossriderapp5060.5060.plugins.plugin_47.code", "(function(){appAPI.ready=func[...]
Deleted : user_pref("extensions.crossriderapp5060.5060.plugins.plugin_47.name", "resources_background");
Deleted : user_pref("extensions.crossriderapp5060.5060.plugins.plugin_47.ver", 1);
Deleted : user_pref("extensions.crossriderapp5060.5060.plugins_lists.plugins_0", "17,14,16,47,1000015");
Deleted : user_pref("extensions.crossriderapp5060.5060.plugins_lists.plugins_1", "17,14,13,16,15,4,1,21,22,100[...]
Deleted : user_pref("extensions.crossriderapp5060.5060.pluginsurl", "hxxp://app-static.crossrider.com/plugin/a[...]
Deleted : user_pref("extensions.crossriderapp5060.5060.pluginsversion", 15);
Deleted : user_pref("extensions.crossriderapp5060.5060.premium", true);
Deleted : user_pref("extensions.crossriderapp5060.5060.publisher", "215 Apps");
Deleted : user_pref("extensions.crossriderapp5060.5060.searchstatus", 0);
Deleted : user_pref("extensions.crossriderapp5060.5060.setnewtab", false);
Deleted : user_pref("extensions.crossriderapp5060.5060.settingsurl", "");
Deleted : user_pref("extensions.crossriderapp5060.5060.thankyou", "");
Deleted : user_pref("extensions.crossriderapp5060.5060.updateinterval", 360);
Deleted : user_pref("extensions.crossriderapp5060.5060.ver", 37);
Deleted : user_pref("extensions.crossriderapp5060.adsOldValue", -1);
Deleted : user_pref("extensions.crossriderapp5060.apps", "5060");
Deleted : user_pref("extensions.crossriderapp5060.bic", "138d65c259799797b9010a90dee2ba36");
Deleted : user_pref("extensions.crossriderapp5060.cid", 5060);
Deleted : user_pref("extensions.crossriderapp5060.firstrun", false);
Deleted : user_pref("extensions.crossriderapp5060.hadappinstalled", true);
Deleted : user_pref("extensions.crossriderapp5060.installationdate", 1343626160);
Deleted : user_pref("extensions.crossriderapp5060.lastcheck", 22544173);
Deleted : user_pref("extensions.crossriderapp5060.lastcheckitem", 22544174);
Deleted : user_pref("extensions.crossriderapp5060.misc.lastBgWorkerTimer", "1343688966806");
Deleted : user_pref("extensions.crossriderapp5060.misc.lastDomWorkerTimer", "1343688966761");
Deleted : user_pref("extensions.crossriderapp5060.modetype", "production");

-\\ Google Chrome v [Unable to get version]

File : C:\Users\Blake\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] File is clean.

*************************

AdwCleaner[R1].txt - [61133 octets] - [11/11/2012 10:36:58]
AdwCleaner[S2].txt - [62311 octets] - [11/11/2012 10:37:25]

########## EOF - C:\AdwCleaner[S2].txt - [62372 octets] ##########




I'm currently re-running OTL
  • 0

#19
Essexboy

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
Could you post the log at C:\TDSSKiller date time please
  • 0

#20
Brober

Brober

    Member

  • Topic Starter
  • Member
  • PipPip
  • 26 posts
This one?


11:00:21.0784 4100 TDSS rootkit removing tool 2.8.15.0 Oct 31 2012 21:47:35
11:00:23.0812 4100 ============================================================
11:00:23.0812 4100 Current date / time: 2012/11/11 11:00:23.0812
11:00:23.0812 4100 SystemInfo:
11:00:23.0812 4100
11:00:23.0812 4100 OS Version: 6.1.7601 ServicePack: 1.0
11:00:23.0812 4100 Product type: Workstation
11:00:23.0812 4100 ComputerName: BLAKESCOMPUTER
11:00:23.0812 4100 UserName: Blake
11:00:23.0812 4100 Windows directory: C:\Windows
11:00:23.0812 4100 System windows directory: C:\Windows
11:00:23.0812 4100 Running under WOW64
11:00:23.0812 4100 Processor architecture: Intel x64
11:00:23.0812 4100 Number of processors: 2
11:00:23.0812 4100 Page size: 0x1000
11:00:23.0812 4100 Boot type: Normal boot
11:00:23.0812 4100 ============================================================
11:00:28.0332 4100 Drive \Device\Harddisk0\DR0 - Size: 0x7470C06000 (465.76 Gb), SectorSize: 0x200, Cylinders: 0xED81, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
11:00:28.0342 4100 ============================================================
11:00:28.0342 4100 \Device\Harddisk0\DR0:
11:00:28.0342 4100 MBR partitions:
11:00:28.0342 4100 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x139C5, BlocksNum 0x1D4C000
11:00:28.0342 4100 \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x1D5F9C5, BlocksNum 0x38625E6B
11:00:28.0342 4100 ============================================================
11:00:28.0372 4100 C: <-> \Device\Harddisk0\DR0\Partition2
11:00:28.0372 4100 ============================================================
11:00:28.0372 4100 Initialize success
11:00:28.0372 4100 ============================================================
11:00:39.0745 4140 Deinitialize success



I also have the OTL log

All processes killed
========== OTL ==========
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer| /E : value set successfully!
HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer| /E : value set successfully!
HKU\S-1-5-21-1208415163-1426477439-3879862694-1000\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page Restore| /E : value set successfully!
Registry value HKEY_USERS\S-1-5-21-1208415163-1426477439-3879862694-1000\Software\Microsoft\Internet Explorer\URLSearchHooks\\{0cc09160-108c-4759-bab1-5c12c216e005} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0cc09160-108c-4759-bab1-5c12c216e005}\ not found.
Prefs.js: "appbario8 Customized Web Search" removed from browser.search.order.1
Prefs.js: [email protected]:0.85.36 removed from extensions.enabledAddons
Prefs.js: "127.0.0.1" removed from network.proxy.http
Prefs.js: 63212 removed from network.proxy.http_port
Folder C:\Users\Blake\AppData\Roaming\Mozilla\Firefox\Profiles\vvylvmlg.default\extensions\{0cc09160-108c-4759-bab1-5c12c216e005}\ not found.
Folder C:\Users\Blake\AppData\Roaming\Mozilla\Firefox\Profiles\vvylvmlg.default\extensions\{4ac80c6c-0a1b-4b3a-ad7e-8a6d8f5e6928}\ not found.
Folder C:\Users\Blake\AppData\Roaming\Mozilla\Firefox\Profiles\vvylvmlg.default\extensions\[email protected]\ not found.
Folder C:\Users\Blake\AppData\Roaming\Mozilla\Firefox\Profiles\vvylvmlg.default\extensions\[email protected]\chrome\content\extensionCode\ not found.
C:\Users\Blake\AppData\Roaming\Mozilla\Firefox\Profiles\vvylvmlg.default\searchplugins\bProtect.xml moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{65C3061D-4456-415A-B97C-1C14099AB2FF}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65C3061D-4456-415A-B97C-1C14099AB2FF}\ not found.
File C:\Program Files (x86)\Shop to Win 15\Shop to Win 15.dll not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{99E00A4C-D35E-11DD-BA95-9B6A56D89593}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{99E00A4C-D35E-11DD-BA95-9B6A56D89593}\ not found.
64bit-Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{D0F4A166-B8D4-48b8-9D63-80849FE137CB} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D0F4A166-B8D4-48b8-9D63-80849FE137CB}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked not found.
Registry value HKEY_USERS\S-1-5-21-1208415163-1426477439-3879862694-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{0CC09160-108C-4759-BAB1-5C12C216E005} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0CC09160-108C-4759-BAB1-5C12C216E005}\ not found.
Registry value HKEY_USERS\S-1-5-21-1208415163-1426477439-3879862694-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{21FA44EF-376D-4D53-9B0F-8A89D3229068} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{21FA44EF-376D-4D53-9B0F-8A89D3229068}\ not found.
Registry value HKEY_USERS\S-1-5-21-1208415163-1426477439-3879862694-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{88C7F2AA-F93F-432C-8F0E-B7D85967A527} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{88C7F2AA-F93F-432C-8F0E-B7D85967A527}\ not found.
Registry value HKEY_USERS\S-1-5-21-1208415163-1426477439-3879862694-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{D4027C7F-154A-4066-A1AD-4243D8127440} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found.
Registry key HKEY_USERS\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Restrictions\ not found.
Registry key HKEY_USERS\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Restrictions\ not found.
Registry key HKEY_USERS\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Restrictions\ not found.
Registry key HKEY_USERS\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Restrictions\ not found.
Registry key HKEY_USERS\S-1-5-21-1208415163-1426477439-3879862694-1000\Software\Policies\Microsoft\Internet Explorer\Restrictions\ not found.
File C:\Users\Blake\AppData\Local\72k4p013x70ahajy7lp2f1cog0p4xvm1 not found.
File C:\ProgramData\72k4p013x70ahajy7lp2f1cog0p4xvm1 not found.
========== FILES ==========
File\Folder C:\Users\Blake\AppData\Local\Google\Chrome\User Data\Default\Extensions\dhdepfaagokllfmhfbcfmocaeigmoebo not found.
========== COMMANDS ==========
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

[EMPTYTEMP]

User: All Users

User: Blake
->Temp folder emptied: 47303 bytes
->Temporary Internet Files folder emptied: 480605 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 13554079 bytes
->Google Chrome cache emptied: 0 bytes
->Apple Safari cache emptied: 0 bytes
->Flash cache emptied: 893 bytes

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 608 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 32902 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 13.00 mb

Restore point Set: OTL Restore Point

OTL by OldTimer - Version 3.2.69.0 log created on 11112012_110329

Files\Folders moved on Reboot...
C:\Users\Blake\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

PendingFileRenameOperations files...

Registry entries deleted on Reboot...
  • 0

#21
Essexboy

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
No the one I am after is a lot longer than that.. Did TDSSKiller detect anything on the first run ?

How is the computer behaving now ?
  • 0

#22
Brober

Brober

    Member

  • Topic Starter
  • Member
  • PipPip
  • 26 posts
It did not, the computer is running normally at the moment, but I haven't been able to see my icons ever since I could get on to it
  • 0

#23
Essexboy

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
Rogue killer did not restore them all ?

Could you right click on the desktop
Select View
Select show desktop icons
  • 0

#24
Brober

Brober

    Member

  • Topic Starter
  • Member
  • PipPip
  • 26 posts
Oh okay, that did it!
  • 0

#25
Essexboy

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
So what problems are outstanding ?
  • 0

Advertisements


#26
Brober

Brober

    Member

  • Topic Starter
  • Member
  • PipPip
  • 26 posts
I don't notice any problems anymore, everything is running as it did before the virus
  • 0

#27
Essexboy

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
Subject to no further problems :)

I will remove my tools now and give some recommendations, but, I would like you to run for 24 hours or so and come back if you have any problems

Now the best part of the day ----- Your log now appears clean :thumbsup:

A good workman always cleans up after himself so..The following will implement some cleanup procedures as well as reset System Restore points:

Remove ComboFix
  • Hold down the Windows key + R on your keyboard. This will display the Run dialogue box
  • In the Run box, type in ComboFix /Uninstall
    (Notice the space between the "x" and "/")
    then click OK

    Posted Image
  • Follow the prompts on the screen
  • A message should appear confirming that ComboFix was uninstalled

Run OTL and hit the cleanup button. It will remove all the programmes we have used plus itself.

We will now confirm that your hidden files are set to that, as some of the tools I use will change that
  • Click Start.
  • Open My Computer.
  • Select the Tools menu and click Folder Options.
  • Select the View Tab.
  • Under the Hidden files and folders heading select Do not show hidden files and folders.
  • Click Yes to confirm.
  • Click OK.

Posted Image Your Java is out of date.
Older versions have vulnerabilities that malware can use to infect your system.
Please follow these steps to remove older version of Java components and upgrade the application.

Upgrading Java:
  • Go to this site and click Do I have Java
  • It will check your current version and then offer to update to the latest version


Now that you are clean, to help protect your computer in the future I recommend that you get the following free programmes:

Posted Image Malwarebytes.

Update and run weekly to keep your system clean

Download and install FileHippo update checker and run it monthly it will show you which programmes on your system need updating and give a download link

If you use on-line banking then as an added layer of protection install Trusteer Rapport

It is critical to have both a firewall and anti virus to protect your system and to keep them updated. To keep your operating system up to date visit
To learn more about how to protect yourself while on the internet read our little guide How did I get infected in the first place ?Keep safe :wave:
  • 0

#28
Brober

Brober

    Member

  • Topic Starter
  • Member
  • PipPip
  • 26 posts
I can't thank you enough man, I was originally going to take my computer to a shop and get it fixed which would have cost money. Thank you for all of your help! :happy:
  • 0

#29
Essexboy

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
My pleasure :)
  • 0

#30
Essexboy

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
Since this issue appears to be resolved ... this Topic has been closed. Glad we could help. :)

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP