Search hijack and babylon

March 29, 2013 at 16:44:29
Specs: Windows XP Home SP3, 2.13GHz/2GB
I am running into two problems that may or may not be related.
1. Google Chrome searches have been getting hijacked. They are getting redirected to random sites.
2. Whenever I open IE, the default tab opens up with the right page. But if I open a new tab in the browser, it opens with Babylon search page.
I have run Malwarebytes, Hitman Pro, CCleaner. And they each (esp Hitman Pro) found bablyon related items, and some other malware. I deleted them, but the problem remains.
Please help.

See More: Search hijack and babylon

Report •

#1
March 29, 2013 at 18:01:31
Download AdwCleaner from this link:

http://www.bleepingcomputer.com/dow...
AdwCleaner Usage Instructions:
Using AdwCleaner is very simple. Simply download the program and run it. You will then be presented with a screen that contains a Search and Delete button. The Search button will cause AdwCleaner to search your computer for unwanted programs and then display a log showing the various files, folders, and registry entries used by these programs.
To delete these unwanted programs simply click on the Delete button, which will cause AdwCleaner to reboot your computer and remove the files and registry entries associated with the various adware that you are removing. On reboot, AdwCleaner will display a log showing the files, folders, and registry entries that were removed.
Please include the log in your next reply.

Please reply and let us know if our help worked. Your feedback helps others. Maybe you?


Report •

#2
March 30, 2013 at 08:16:29
Posting the response in two parts. Seems to have fixed the problem with new IE tabs showing up with Babylon Search page. But the chrome search is still hijacked.
Part 1/2

# AdwCleaner v2.115 - Logfile created 03/29/2013 at 19:15:31
# Updated 17/03/2013 by Xplode
# Operating system : Microsoft Windows XP Service Pack 3 (32 bits)
# User : Chittij Gupta - GUPTADESKTOP
# Boot Mode : Normal
# Running from : C:\Documents and Settings\Chittij Gupta\My Documents\Downloads\Babylon\adwcleaner.exe
# Option [Delete]


***** [Services] *****


***** [Files / Folders] *****

File Deleted : C:\Documents and Settings\Chittij Gupta\Application Data\Mozilla\Firefox\Profiles\y7k9txci.default\searchplugins\my-web-search.xml
File Deleted : C:\Documents and Settings\Chittij Gupta\Application Data\Mozilla\Firefox\Profiles\y7k9txci.default\searchplugins\safesearch.xml
File Deleted : C:\Documents and Settings\Suprabha Gupta\Application Data\Mozilla\Firefox\Profiles\06bjnqer.default\searchplugins\my-web-search.xml
File Deleted : C:\Documents and Settings\Suresh Gupta\Application Data\Mozilla\Firefox\Profiles\n3dx1cxa.default\searchplugins\my-web-search.xml
File Deleted : C:\Documents and Settings\Suresh Gupta\Application Data\Mozilla\Firefox\Profiles\n3dx1cxa.default\searchplugins\safesearch.xml
File Deleted : C:\Documents and Settings\Suryaa Gupta\Application Data\Mozilla\Firefox\Profiles\0t5rufnk.default\searchplugins\my-web-search.xml
File Deleted : C:\Documents and Settings\Suryaa Gupta\Application Data\Mozilla\Firefox\Profiles\0t5rufnk.default\searchplugins\safesearch.xml
File Deleted : C:\Documents and Settings\Vishal Gupta\Application Data\Mozilla\Firefox\Profiles\1l8g79te.default\searchplugins\Askcom.xml
File Deleted : C:\Documents and Settings\Vishal Gupta\Application Data\Mozilla\Firefox\Profiles\1l8g79te.default\searchplugins\my-web-search.xml
File Deleted : C:\Documents and Settings\Vishal Gupta\Application Data\Mozilla\Firefox\Profiles\1l8g79te.default\searchplugins\safesearch.xml
File Deleted : C:\user.js
Folder Deleted : C:\Documents and Settings\All Users\Application Data\Viewpoint
Folder Deleted : C:\Documents and Settings\Chittij Gupta\Application Data\Mozilla\Firefox\Profiles\y7k9txci.default\extensions\crossriderapp4639@crossrider.com
Folder Deleted : C:\Documents and Settings\Chittij Gupta\Application Data\Viewpoint
Folder Deleted : C:\Documents and Settings\Suresh Gupta\Application Data\Mozilla\Firefox\Profiles\n3dx1cxa.default\extensions\crossriderapp4639@crossrider.com
Folder Deleted : C:\Documents and Settings\Suresh Gupta\Application Data\Viewpoint
Folder Deleted : C:\Documents and Settings\Suryaa Gupta\Application Data\Mozilla\Firefox\Profiles\0t5rufnk.default\extensions\crossriderapp4639@crossrider.com
Folder Deleted : C:\Documents and Settings\Suryaa Gupta\Application Data\Mozilla\Firefox\Profiles\0t5rufnk.default\extensions\staged
Folder Deleted : C:\Documents and Settings\Suryaa Gupta\Application Data\Mozilla\Firefox\Profiles\0t5rufnk.default\FCTB
Folder Deleted : C:\Documents and Settings\Suryaa Gupta\Local Settings\Application Data\SavingsApp
Folder Deleted : C:\Documents and Settings\Suryaa Gupta\My Documents\ShopToWin
Folder Deleted : C:\Documents and Settings\Vishal Gupta\Application Data\Mozilla\Firefox\Profiles\1l8g79te.default\extensions\crossriderapp4639@crossrider.com
Folder Deleted : C:\Program Files\Free Offers from Freeze.com

***** [Registry] *****

Key Deleted : HKCU\Software\AppDataLow\Software\Freecause
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\MenuExt\&Search
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{79A765E1-C399-405B-85AF-466F52E918B0}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{2EECD738-5844-4A99-B4B6-146BF802613B}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{98889811-442D-49DD-99D7-DC866BE87DBC}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D4027C7F-154A-4066-A1AD-4243D8127440}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Key Deleted : HKLM\SOFTWARE\Classes\AxMetaStream.MetaStreamCtl
Key Deleted : HKLM\SOFTWARE\Classes\AxMetaStream.MetaStreamCtl.1
Key Deleted : HKLM\SOFTWARE\Classes\AxMetaStream.MetaStreamCtlSecondary
Key Deleted : HKLM\SOFTWARE\Classes\AxMetaStream.MetaStreamCtlSecondary.1
Key Deleted : HKLM\Software\Freeze.com
Key Deleted : HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{03F998B2-0E00-11D3-A498-00104B6EB52E}
Key Deleted : HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{1B00725B-C455-4DE6-BFB6-AD540AD427CD}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\063A857434EDED11A893800002C0A966
Key Deleted : HKLM\Software\Viewpoint
Key Deleted : HKU\S-1-5-21-4230815625-1522605587-234241610-1007\Software\Microsoft\Internet Explorer\SearchScopes\{AFBCB7E0-F91A-4951-9F31-58FEE57A25C4}
Key Deleted : HKU\S-1-5-21-4230815625-1522605587-234241610-1008\Software\Microsoft\Internet Explorer\SearchScopes\{AFBCB7E0-F91A-4951-9F31-58FEE57A25C4}
Key Deleted : HKU\S-1-5-21-4230815625-1522605587-234241610-1009\Software\Microsoft\Internet Explorer\SearchScopes\{AFBCB7E0-F91A-4951-9F31-58FEE57A25C4}
Key Deleted : HKU\S-1-5-21-4230815625-1522605587-234241610-1010\Software\Microsoft\Internet Explorer\SearchScopes\{AFBCB7E0-F91A-4951-9F31-58FEE57A25C4}
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D4027C7F-154A-4066-A1AD-4243D8127440}]
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{EF99BD32-C1FB-11D2-892F-0090271D4F88}]
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\New Windows\Allow [*.crossrider.com]

***** [Internet Browsers] *****

-\\ Internet Explorer v8.0.6001.18702

Replaced : [HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURls - Tabs] = hxxp://search.babylon.com/?affID=44444&tt=280812_2004_3512_1&babsrc=NT_ss&mntrId=845212a7000000000000001320c678cd --> hxxp://www.google.com

-\\ Mozilla Firefox v16.0.2 (en-US)

File : C:\Documents and Settings\Chittij Gupta\Application Data\Mozilla\Firefox\Profiles\y7k9txci.default\prefs.js

Deleted : user_pref("browser.search.defaultenginename", "My Web Search");
Deleted : user_pref("browser.search.selectedEngine", "My Web Search");
Deleted : user_pref("extensions.crossriderapp4639.4639.InstallationTime", 1338317032);
Deleted : user_pref("extensions.crossriderapp4639.4639.active", true);
Deleted : user_pref("extensions.crossriderapp4639.4639.addressbar", "");
Deleted : user_pref("extensions.crossriderapp4639.4639.affid", "0");
Deleted : user_pref("extensions.crossriderapp4639.4639.backgroundjs", "\n\n\"undefined\"!=typeof _GPL_BG_NEW&&[...]
Deleted : user_pref("extensions.crossriderapp4639.4639.backgroundver", 7);
Deleted : user_pref("extensions.crossriderapp4639.4639.can_run_bg_code", true);
Deleted : user_pref("extensions.crossriderapp4639.4639.certdomaininstaller", "");
Deleted : user_pref("extensions.crossriderapp4639.4639.changeprevious", false);
Deleted : user_pref("extensions.crossriderapp4639.4639.cookie.InstallationTime.expiration", "Fri Feb 01 2030 0[...]
Deleted : user_pref("extensions.crossriderapp4639.4639.cookie.InstallationTime.value", "1338317032");
Deleted : user_pref("extensions.crossriderapp4639.4639.cookie._GPL_aoi.expiration", "Fri Feb 01 2030 00:00:00 [...]
Deleted : user_pref("extensions.crossriderapp4639.4639.cookie._GPL_aoi.value", "1338317032");
Deleted : user_pref("extensions.crossriderapp4639.4639.cookie._GPL_country_code.expiration", "Fri Apr 05 2013 [...]
Deleted : user_pref("extensions.crossriderapp4639.4639.cookie._GPL_country_code.value", "%22US%22");
Deleted : user_pref("extensions.crossriderapp4639.4639.cookie._GPL_crr.expiration", "Fri Feb 01 2030 00:00:00 [...]
Deleted : user_pref("extensions.crossriderapp4639.4639.cookie._GPL_crr.value", "1364595463");
Deleted : user_pref("extensions.crossriderapp4639.4639.cookie._GPL_hotfix20111102645.expiration", "Fri Feb 01 [...]
Deleted : user_pref("extensions.crossriderapp4639.4639.cookie._GPL_hotfix20111102645.value", "%221%22");
Deleted : user_pref("extensions.crossriderapp4639.4639.cookie._GPL_installer_params.expiration", "Fri Feb 01 2[...]
Deleted : user_pref("extensions.crossriderapp4639.4639.cookie._GPL_installer_params.value", "%7B%22source_id%2[...]
Deleted : user_pref("extensions.crossriderapp4639.4639.cookie._GPL_parent_zoneid.expiration", "Fri Feb 01 2030[...]
Deleted : user_pref("extensions.crossriderapp4639.4639.cookie._GPL_parent_zoneid.value", "%2214019%22");
Deleted : user_pref("extensions.crossriderapp4639.4639.cookie._GPL_pc_20120828.expiration", "Fri Feb 01 2030 0[...]
Deleted : user_pref("extensions.crossriderapp4639.4639.cookie._GPL_pc_20120828.value", "1352072728212");
Deleted : user_pref("extensions.crossriderapp4639.4639.cookie._GPL_product_id.expiration", "Fri Feb 01 2030 00[...]
Deleted : user_pref("extensions.crossriderapp4639.4639.cookie._GPL_product_id.value", "%221181%22");
Deleted : user_pref("extensions.crossriderapp4639.4639.cookie._GPL_zoneid.expiration", "Fri Feb 01 2030 00:00:[...]
Deleted : user_pref("extensions.crossriderapp4639.4639.cookie._GPL_zoneid.value", "%2214019%22");
Deleted : user_pref("extensions.crossriderapp4639.4639.cookie.dbtest.expiration", "Fri Feb 01 2030 00:00:00 GM[...]
Deleted : user_pref("extensions.crossriderapp4639.4639.cookie.dbtest.value", "1352072727769");
Deleted : user_pref("extensions.crossriderapp4639.4639.description", "SavingsApp");
Deleted : user_pref("extensions.crossriderapp4639.4639.domain", "");
Deleted : user_pref("extensions.crossriderapp4639.4639.emailsig", "");
Deleted : user_pref("extensions.crossriderapp4639.4639.enablesearch", false);
Deleted : user_pref("extensions.crossriderapp4639.4639.exposesites", "");
Deleted : user_pref("extensions.crossriderapp4639.4639.fbremoteurl", "");
Deleted : user_pref("extensions.crossriderapp4639.4639.group", 0);
Deleted : user_pref("extensions.crossriderapp4639.4639.homepage", "");
Deleted : user_pref("extensions.crossriderapp4639.4639.iframe", false);
Deleted : user_pref("extensions.crossriderapp4639.4639.internaldb.Resources_appVer.expiration", "Fri Feb 01 20[...]
Deleted : user_pref("extensions.crossriderapp4639.4639.internaldb.Resources_appVer.value", "43");
Deleted : user_pref("extensions.crossriderapp4639.4639.internaldb.Resources_lastVersion.expiration", "Fri Feb [...]
Deleted : user_pref("extensions.crossriderapp4639.4639.internaldb.Resources_lastVersion.value", "0");
Deleted : user_pref("extensions.crossriderapp4639.4639.internaldb.Resources_meta.expiration", "Fri Feb 01 2030[...]
Deleted : user_pref("extensions.crossriderapp4639.4639.internaldb.Resources_meta.value", "%7B%7D");
Deleted : user_pref("extensions.crossriderapp4639.4639.internaldb.Resources_nextCheck.expiration", "Fri Mar 29[...]
Deleted : user_pref("extensions.crossriderapp4639.4639.internaldb.Resources_nextCheck.value", "true");
Deleted : user_pref("extensions.crossriderapp4639.4639.internaldb.Resources_queue.expiration", "Fri Feb 01 203[...]
Deleted : user_pref("extensions.crossriderapp4639.4639.internaldb.Resources_queue.value", "%7B%7D");
Deleted : user_pref("extensions.crossriderapp4639.4639.internaldb.Resources_remote_resources.expiration", "Fri[...]
Deleted : user_pref("extensions.crossriderapp4639.4639.internaldb.Resources_remote_resources.value", "%7B%22re[...]
Deleted : user_pref("extensions.crossriderapp4639.4639.js", "\n\nif(\"undefined\"!=typeof _GPL_PLUGIN){var _GP[...]
Deleted : user_pref("extensions.crossriderapp4639.4639.manifesturl", "");
Deleted : user_pref("extensions.crossriderapp4639.4639.name", "SavingsApp");
Deleted : user_pref("extensions.crossriderapp4639.4639.newtab", "");
Deleted : user_pref("extensions.crossriderapp4639.4639.opensearch", "");
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_1.code", "appAPI._cr_config={appID:funct[...]
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_1.name", "base");
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_1.ver", 3);
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_1000014.code", "Array.prototype.indexOf|[...]
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_1000014.name", "GPL Plugin (Loader)");
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_1000014.ver", 7);
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_1000015.code", "var _GPL_BG={vars:{},rul[...]
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_1000015.name", "GPL Background (BG)");
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_1000015.ver", 4);
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_13.code", "(function(a){a.selectedText=f[...]
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_13.name", "CrossriderAppUtils");
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_13.ver", 2);
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_14.code", "if(typeof(appAPI)===\"undefin[...]
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_14.name", "CrossriderUtils");
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_14.ver", 2);
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_15.code", "(function(e){function u(c,b){[...]
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_15.name", "FacebookFFIE");
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_15.ver", 1);
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_16.code", "(function(f,b){if(typeof(b)==[...]
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_16.name", "FFAppAPIWrapper");
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_16.ver", 3);
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_17.code", "if(typeof window!==\"undefine[...]
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_17.name", "jQuery");
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_17.ver", 3);
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_21.code", "var CrossriderDebugManager=(f[...]
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_21.name", "debug");
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_21.ver", 3);
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_22.code", "(function(a){appAPI.queueMana[...]
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_22.name", "resources");
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_22.ver", 2);
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_28.code", "var CrossriderInitializerPlug[...]
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_28.name", "initializer");
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_28.ver", 2);
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_4.code", "/*! jQuery v1.7.1 jquery.com |[...]
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_4.name", "jquery_1_7_1");
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_4.ver", 3);
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_47.code", "(function(){appAPI.ready=func[...]
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_47.name", "resources_background");
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_47.ver", 1);
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins_lists.plugins_0", "17,14,16,47,1000015");
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins_lists.plugins_1", "17,14,13,16,15,4,1,21,22,100[...]
Deleted : user_pref("extensions.crossriderapp4639.4639.pluginsurl", "hxxp://app-static.crossrider.com/plugin/a[...]
Deleted : user_pref("extensions.crossriderapp4639.4639.pluginsversion", 16);
Deleted : user_pref("extensions.crossriderapp4639.4639.premium", true);
Deleted : user_pref("extensions.crossriderapp4639.4639.publisher", "215 Apps");
Deleted : user_pref("extensions.crossriderapp4639.4639.searchstatus", 0);
Deleted : user_pref("extensions.crossriderapp4639.4639.setnewtab", false);
Deleted : user_pref("extensions.crossriderapp4639.4639.settingsurl", "");
Deleted : user_pref("extensions.crossriderapp4639.4639.thankyou", "");
Deleted : user_pref("extensions.crossriderapp4639.4639.updateinterval", 360);
Deleted : user_pref("extensions.crossriderapp4639.4639.ver", 43);
Deleted : user_pref("extensions.crossriderapp4639.adsOldValue", -1);
Deleted : user_pref("extensions.crossriderapp4639.apps", "4639");
Deleted : user_pref("extensions.crossriderapp4639.bic", "13799e9488abecff021dcc5a7c57c910");
Deleted : user_pref("extensions.crossriderapp4639.cid", 4639);
Deleted : user_pref("extensions.crossriderapp4639.firstrun", false);
Deleted : user_pref("extensions.crossriderapp4639.hadappinstalled", true);
Deleted : user_pref("extensions.crossriderapp4639.installationdate", 1338317032);
Deleted : user_pref("extensions.crossriderapp4639.lastcheck", 22743258);
Deleted : user_pref("extensions.crossriderapp4639.lastcheckitem", 22743258);
Deleted : user_pref("extensions.crossriderapp4639.misc.lastBgWorkerTimer", "1343006310334");
Deleted : user_pref("extensions.crossriderapp4639.misc.lastDomWorkerTimer", "1343006310330");
Deleted : user_pref("extensions.crossriderapp4639.modetype", "production");
Deleted : user_pref("extensions.crossriderapp4639.updating", true);
Deleted : user_pref("extensions.enabledAddons", "crossriderapp4639@crossrider.com:0.85.42,nmigbbgsot@nmigbbgso[...]
Deleted : user_pref("extensions.mywebsearch.prevKwdEnabled", true);
Deleted : user_pref("extensions.mywebsearch.prevKwdURL", "hxxp://search.mywebsearch.com/mywebsearch/GGmain.jht[...]
Deleted : user_pref("extensions.toolbar.mindspark._64Members_.homepage", "hxxp://home.mywebsearch.com/index.jh[...]
Deleted : user_pref("keyword.URL", "hxxp://search.mywebsearch.com/mywebsearch/GGmain.jhtml?st=kwd&ptb=EAFF69E5[...]

File : C:\Documents and Settings\Suresh Gupta\Application Data\Mozilla\Firefox\Profiles\n3dx1cxa.default\prefs.js

C:\Documents and Settings\Suresh Gupta\Application Data\Mozilla\Firefox\Profiles\n3dx1cxa.default\user.js ... Deleted !

Deleted : user_pref("browser.search.defaultenginename", "My Web Search");
Deleted : user_pref("extensions.asktb.ff-original-keyword-url", "hxxp://search.mywebsearch.com/mywebsearch/GGm[...]
Deleted : user_pref("extensions.crossriderapp4639.4639.InstallationTime", 1337445036);
Deleted : user_pref("extensions.crossriderapp4639.4639.active", true);
Deleted : user_pref("extensions.crossriderapp4639.4639.addressbar", "");
Deleted : user_pref("extensions.crossriderapp4639.4639.addressbarenhanced", "");
Deleted : user_pref("extensions.crossriderapp4639.4639.affid", "0");
Deleted : user_pref("extensions.crossriderapp4639.4639.backgroundjs", "\n\n//\n");
Deleted : user_pref("extensions.crossriderapp4639.4639.backgroundver", 38);
Deleted : user_pref("extensions.crossriderapp4639.4639.can_run_bg_code", true);
Deleted : user_pref("extensions.crossriderapp4639.4639.certdomaininstaller", "");
Deleted : user_pref("extensions.crossriderapp4639.4639.changeprevious", false);
Deleted : user_pref("extensions.crossriderapp4639.4639.cookie.InstallationTime.expiration", "Fri Feb 01 2030 0[...]
Deleted : user_pref("extensions.crossriderapp4639.4639.cookie.InstallationTime.value", "1337445036");
Deleted : user_pref("extensions.crossriderapp4639.4639.cookie._GPL_aoi.expiration", "Fri Feb 01 2030 00:00:00 [...]
Deleted : user_pref("extensions.crossriderapp4639.4639.cookie._GPL_aoi.value", "1337445036");
Deleted : user_pref("extensions.crossriderapp4639.4639.cookie._GPL_arbitrary_code.expiration", "Sun Mar 24 201[...]
Deleted : user_pref("extensions.crossriderapp4639.4639.cookie._GPL_arbitrary_code.value", "%22/**/%22");
Deleted : user_pref("extensions.crossriderapp4639.4639.cookie._GPL_blocklist.expiration", "Sun Mar 24 2013 13:[...]
Deleted : user_pref("extensions.crossriderapp4639.4639.cookie._GPL_blocklist.value", "%22nonexistantdomain.com[...]
Deleted : user_pref("extensions.crossriderapp4639.4639.cookie._GPL_cf_bu1.expiration", "Fri Feb 01 2030 00:00:[...]
Deleted : user_pref("extensions.crossriderapp4639.4639.cookie._GPL_cf_bu1.value", "1361214961");
Deleted : user_pref("extensions.crossriderapp4639.4639.cookie._GPL_country_code.expiration", "Sun Mar 31 2013 [...]
Deleted : user_pref("extensions.crossriderapp4639.4639.cookie._GPL_country_code.value", "%22US%22");
Deleted : user_pref("extensions.crossriderapp4639.4639.cookie._GPL_crr.expiration", "Fri Feb 01 2030 00:00:00 [...]
Deleted : user_pref("extensions.crossriderapp4639.4639.cookie._GPL_crr.value", "1364148428");
Deleted : user_pref("extensions.crossriderapp4639.4639.cookie._GPL_currenttime.expiration", "Fri Feb 01 2030 0[...]
Deleted : user_pref("extensions.crossriderapp4639.4639.cookie._GPL_currenttime.value", "%221363714869%22");
Deleted : user_pref("extensions.crossriderapp4639.4639.cookie._GPL_hotfix20111102645.expiration", "Fri Feb 01 [...]
Deleted : user_pref("extensions.crossriderapp4639.4639.cookie._GPL_hotfix20111102645.value", "%221%22");
Deleted : user_pref("extensions.crossriderapp4639.4639.cookie._GPL_installer_params.expiration", "Fri Feb 01 2[...]
Deleted : user_pref("extensions.crossriderapp4639.4639.cookie._GPL_installer_params.value", "%7B%22source_id%2[...]
Deleted : user_pref("extensions.crossriderapp4639.4639.cookie._GPL_parent_zoneid.expiration", "Fri Feb 01 2030[...]
Deleted : user_pref("extensions.crossriderapp4639.4639.cookie._GPL_parent_zoneid.value", "%2214019%22");
Deleted : user_pref("extensions.crossriderapp4639.4639.cookie._GPL_pc_20120828.expiration", "Fri Feb 01 2030 0[...]
Deleted : user_pref("extensions.crossriderapp4639.4639.cookie._GPL_pc_20120828.value", "1346182799366");
Deleted : user_pref("extensions.crossriderapp4639.4639.cookie._GPL_product_id.expiration", "Fri Feb 01 2030 00[...]
Deleted : user_pref("extensions.crossriderapp4639.4639.cookie._GPL_product_id.value", "%221181%22");
Deleted : user_pref("extensions.crossriderapp4639.4639.cookie._GPL_zoneid.expiration", "Fri Feb 01 2030 00:00:[...]
Deleted : user_pref("extensions.crossriderapp4639.4639.cookie._GPL_zoneid.value", "%2238053%22");
Deleted : user_pref("extensions.crossriderapp4639.4639.cookie.dbtest.expiration", "Fri Feb 01 2030 00:00:00 GM[...]
Deleted : user_pref("extensions.crossriderapp4639.4639.cookie.dbtest.value", "1346075403677");
Deleted : user_pref("extensions.crossriderapp4639.4639.cookie.lastrequest.expiration", "Fri Feb 01 2030 00:00:[...]
Deleted : user_pref("extensions.crossriderapp4639.4639.cookie.lastrequest.value", "%7B%22path%22%3A%22/%22%2C%[...]
Deleted : user_pref("extensions.crossriderapp4639.4639.description", "SavingsApp");
Deleted : user_pref("extensions.crossriderapp4639.4639.domain", "");
Deleted : user_pref("extensions.crossriderapp4639.4639.emailsig", "");
Deleted : user_pref("extensions.crossriderapp4639.4639.enablesearch", false);
Deleted : user_pref("extensions.crossriderapp4639.4639.exposesites", "");
Deleted : user_pref("extensions.crossriderapp4639.4639.fbremoteurl", "");
Deleted : user_pref("extensions.crossriderapp4639.4639.group", 0);
Deleted : user_pref("extensions.crossriderapp4639.4639.homepage", "");
Deleted : user_pref("extensions.crossriderapp4639.4639.iframe", false);
Deleted : user_pref("extensions.crossriderapp4639.4639.internaldb.Resources_appVer.expiration", "Fri Feb 01 20[...]
Deleted : user_pref("extensions.crossriderapp4639.4639.internaldb.Resources_appVer.value", "89");
Deleted : user_pref("extensions.crossriderapp4639.4639.internaldb.Resources_lastVersion.expiration", "Fri Feb [...]
Deleted : user_pref("extensions.crossriderapp4639.4639.internaldb.Resources_lastVersion.value", "0");
Deleted : user_pref("extensions.crossriderapp4639.4639.internaldb.Resources_meta.expiration", "Fri Feb 01 2030[...]
Deleted : user_pref("extensions.crossriderapp4639.4639.internaldb.Resources_meta.value", "%7B%7D");
Deleted : user_pref("extensions.crossriderapp4639.4639.internaldb.Resources_nextCheck.expiration", "Sun Mar 24[...]
Deleted : user_pref("extensions.crossriderapp4639.4639.internaldb.Resources_nextCheck.value", "true");
Deleted : user_pref("extensions.crossriderapp4639.4639.internaldb.Resources_queue.expiration", "Fri Feb 01 203[...]
Deleted : user_pref("extensions.crossriderapp4639.4639.internaldb.Resources_queue.value", "%7B%7D");
Deleted : user_pref("extensions.crossriderapp4639.4639.internaldb.Resources_remote_resources.expiration", "Fri[...]
Deleted : user_pref("extensions.crossriderapp4639.4639.internaldb.Resources_remote_resources.value", "%7B%22re[...]
Deleted : user_pref("extensions.crossriderapp4639.4639.js", "\n\nif(\"undefined\"!=typeof _GPL_PLUGIN){var _GP[...]
Deleted : user_pref("extensions.crossriderapp4639.4639.manifesturl", "");
Deleted : user_pref("extensions.crossriderapp4639.4639.name", "SavingsApp");
Deleted : user_pref("extensions.crossriderapp4639.4639.newtab", "");
Deleted : user_pref("extensions.crossriderapp4639.4639.opensearch", "");
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_1.code", "appAPI._cr_config={appID:funct[...]
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_1.name", "base");
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_1.ver", 4);
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_1000014.code", "Array.prototype.indexOf|[...]
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_1000014.name", "GPL Plugin (Loader)");
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_1000014.ver", 15);
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_1000015.code", "var a=appAPI.db.getList([...]
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_1000015.name", "GPL Background (BG)");
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_1000015.ver", 35);
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_13.code", "(function(a){a.selectedText=f[...]
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_13.name", "CrossriderAppUtils");
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_13.ver", 2);
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_14.code", "if(typeof(appAPI)===\"undefin[...]
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_14.name", "CrossriderUtils");
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_14.ver", 2);
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_16.code", "if((typeof isBackground===\"u[...]
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_16.name", "FFAppAPIWrapper");
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_16.ver", 5);
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_17.code", "if(typeof window!==\"undefine[...]
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_17.name", "jQuery");
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_17.ver", 3);
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_21.code", "var CrossriderDebugManager=(f[...]
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_21.name", "debug");
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_21.ver", 3);
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_22.code", "(function(a){appAPI.queueMana[...]
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_22.name", "resources");
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_22.ver", 3);
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_28.code", "var CrossriderInitializerPlug[...]
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_28.name", "initializer");
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_28.ver", 2);
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_4.code", "/*! jQuery v1.7.1 jquery.com |[...]
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_4.name", "jquery_1_7_1");
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_4.ver", 3);
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_47.code", "(function(){appAPI.ready=func[...]
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_47.name", "resources_background");
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_47.ver", 2);
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_64.code", "(function(){var h=\"__CR_EMPT[...]
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_64.name", "appApiMessage");
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_64.ver", 1);
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_72.code", "if(appAPI.__should_activate_v[...]
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_72.name", "appApiValidation");
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_72.ver", 2);
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_78.code", "if(typeof jQuery!==\"undefine[...]
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_78.name", "CrossriderInfo");
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_78.ver", 2);
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_98.code", "(function(){var b=\"cr_\"+app[...]
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_98.name", "omniCommands");
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_98.ver", 1);
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins_lists.plugins_0", "4,14,78,16,64,47,72,98,10000[...]
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins_lists.plugins_1", "17,14,78,13,16,64,4,1,21,22,[...]
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins_lists.plugins_5", "4,14,78,13,16,64,47,72");
Deleted : user_pref("extensions.crossriderapp4639.4639.pluginsurl", "hxxp://app-static.crossrider.com/plugin/a[...]
Deleted : user_pref("extensions.crossriderapp4639.4639.pluginsversion", 62);
Deleted : user_pref("extensions.crossriderapp4639.4639.premium", true);
Deleted : user_pref("extensions.crossriderapp4639.4639.publisher", "215 Apps");
Deleted : user_pref("extensions.crossriderapp4639.4639.searchstatus", 0);
Deleted : user_pref("extensions.crossriderapp4639.4639.setnewtab", false);
Deleted : user_pref("extensions.crossriderapp4639.4639.settingsurl", "");
Deleted : user_pref("extensions.crossriderapp4639.4639.thankyou", "");
Deleted : user_pref("extensions.crossriderapp4639.4639.updateinterval", 360);
Deleted : user_pref("extensions.crossriderapp4639.4639.ver", 89);
Deleted : user_pref("extensions.crossriderapp4639.adsOldValue", -1);
Deleted : user_pref("extensions.crossriderapp4639.apps", "4639");
Deleted : user_pref("extensions.crossriderapp4639.bic", "13765efb11fb50906070e8643403ef3b");
Deleted : user_pref("extensions.crossriderapp4639.cid", 4639);
Deleted : user_pref("extensions.crossriderapp4639.firstrun", false);
Deleted : user_pref("extensions.crossriderapp4639.hadappinstalled", true);
Deleted : user_pref("extensions.crossriderapp4639.installationdate", 1337445036);
Deleted : user_pref("extensions.crossriderapp4639.lastcheck", 22735809);
Deleted : user_pref("extensions.crossriderapp4639.lastcheckitem", 22735813);
Deleted : user_pref("extensions.crossriderapp4639.misc.lastBgWorkerTimer", "1339258395572");
Deleted : user_pref("extensions.crossriderapp4639.misc.lastDomWorkerTimer", "1339258395543");
Deleted : user_pref("extensions.crossriderapp4639.modetype", "production");
Deleted : user_pref("extensions.crossriderapp4639.statsDailyCounter", 2);
Deleted : user_pref("extensions.enabledAddons", "crossriderapp4639@crossrider.com:0.91.87,{972ce4c6-7e08-4474-[...]
Deleted : user_pref("extensions.mywebsearch.prevKwdEnabled", true);
Deleted : user_pref("extensions.mywebsearch.prevKwdURL", "hxxp://search.mywebsearch.com/mywebsearch/GGmain.jht[...]
Deleted : user_pref("extensions.toolbar.mindspark._64Members_.homepage", "hxxp://home.mywebsearch.com/index.jh[...]
Deleted : user_pref("keyword.URL", "hxxp://websearch.ask.com/redirect?client=ff&src=kw&tb=X-SD&o=13959&locale=[...]



Report •

#3
March 30, 2013 at 08:17:27
Part 2/2:

File : C:\Documents and Settings\Suryaa Gupta\Application Data\Mozilla\Firefox\Profiles\0t5rufnk.default\prefs.js

C:\Documents and Settings\Suryaa Gupta\Application Data\Mozilla\Firefox\Profiles\0t5rufnk.default\user.js ... Deleted !

Deleted : user_pref("extensions.asktb.ff-original-keyword-url", "hxxp://search.mywebsearch.com/mywebsearch/GGm[...]
Deleted : user_pref("extensions.crossriderapp4639.4639.InstallationThankYouPage", true);
Deleted : user_pref("extensions.crossriderapp4639.4639.InstallationTime", 1337382132);
Deleted : user_pref("extensions.crossriderapp4639.4639.InstallationUserSettings.searchUserConifrmation", false[...]
Deleted : user_pref("extensions.crossriderapp4639.4639.InstallationUserSettings.setHomepage", false);
Deleted : user_pref("extensions.crossriderapp4639.4639.InstallationUserSettings.setNewTab", false);
Deleted : user_pref("extensions.crossriderapp4639.4639.InstallationUserSettings.setSearch", false);
Deleted : user_pref("extensions.crossriderapp4639.4639.active", true);
Deleted : user_pref("extensions.crossriderapp4639.4639.addressbar", "");
Deleted : user_pref("extensions.crossriderapp4639.4639.affid", "0");
Deleted : user_pref("extensions.crossriderapp4639.4639.certdomaininstaller", "");
Deleted : user_pref("extensions.crossriderapp4639.4639.changeprevious", false);
Deleted : user_pref("extensions.crossriderapp4639.4639.cookie.InstallationTime.expiration", "Fri Feb 01 2030 0[...]
Deleted : user_pref("extensions.crossriderapp4639.4639.cookie.InstallationTime.value", "1337382132");
Deleted : user_pref("extensions.crossriderapp4639.4639.cookie.InstallerParams.expiration", "Fri Feb 01 2030 00[...]
Deleted : user_pref("extensions.crossriderapp4639.4639.description", "SavingsApp");
Deleted : user_pref("extensions.crossriderapp4639.4639.domain", "");
Deleted : user_pref("extensions.crossriderapp4639.4639.emailsig", "");
Deleted : user_pref("extensions.crossriderapp4639.4639.enablesearch", false);
Deleted : user_pref("extensions.crossriderapp4639.4639.exposesites", "");
Deleted : user_pref("extensions.crossriderapp4639.4639.fbremoteurl", "");
Deleted : user_pref("extensions.crossriderapp4639.4639.group", 0);
Deleted : user_pref("extensions.crossriderapp4639.4639.homepage", "");
Deleted : user_pref("extensions.crossriderapp4639.4639.iframe", false);
Deleted : user_pref("extensions.crossriderapp4639.4639.internaldb.InstallerIdentifiers.expiration", "Fri Feb 0[...]
Deleted : user_pref("extensions.crossriderapp4639.4639.internaldb.InstallerIdentifiers.value", "%7B%22installe[...]
Deleted : user_pref("extensions.crossriderapp4639.4639.manifesturl", "");
Deleted : user_pref("extensions.crossriderapp4639.4639.name", "SavingsApp");
Deleted : user_pref("extensions.crossriderapp4639.4639.newtab", "");
Deleted : user_pref("extensions.crossriderapp4639.4639.opensearch", "");
Deleted : user_pref("extensions.crossriderapp4639.4639.pluginsurl", "hxxp://app-static.crossrider.com/plugin/a[...]
Deleted : user_pref("extensions.crossriderapp4639.4639.premium", true);
Deleted : user_pref("extensions.crossriderapp4639.4639.publisher", "215 Apps");
Deleted : user_pref("extensions.crossriderapp4639.4639.searchstatus", 0);
Deleted : user_pref("extensions.crossriderapp4639.4639.setnewtab", false);
Deleted : user_pref("extensions.crossriderapp4639.4639.settingsurl", "");
Deleted : user_pref("extensions.crossriderapp4639.4639.thankyou", "hxxp://crossrider.com/thank_you/4639");
Deleted : user_pref("extensions.crossriderapp4639.4639.updateinterval", 360);
Deleted : user_pref("extensions.crossriderapp4639.4639.ver", 0);
Deleted : user_pref("extensions.crossriderapp4639.adsOldValue", -1);
Deleted : user_pref("extensions.crossriderapp4639.bic", "1376234da3f9f228d6418c3f4b413052");
Deleted : user_pref("extensions.crossriderapp4639.firstrun", false);
Deleted : user_pref("extensions.crossriderapp4639.installationdate", 1337382460);
Deleted : user_pref("extensions.crossriderapp4639.lastcheck", 22593576);
Deleted : user_pref("extensions.crossriderapp4639.lastcheckitem", 22593576);
Deleted : user_pref("extensions.crossriderapp4639.misc.lastBgWorkerTimer", "1342569613818");
Deleted : user_pref("extensions.crossriderapp4639.misc.lastDomWorkerTimer", "1342569613817");
Deleted : user_pref("extensions.enabledAddons", "crossriderapp4639@crossrider.com:0.83.14,{5701241f-8b56-a0d4-[...]
Deleted : user_pref("extensions.mywebsearch.prevKwdEnabled", true);
Deleted : user_pref("extensions.mywebsearch.prevKwdURL", "hxxp://search.mywebsearch.com/mywebsearch/GGmain.jht[...]
Deleted : user_pref("extensions.toolbar.mindspark._64Members_.homepage", "hxxp://home.mywebsearch.com/index.jh[...]
Deleted : user_pref("freecause5701241f8b56a0d455d2bd14aeac91fc.AutoSearchEventData", "auto%20search");
Deleted : user_pref("freecause5701241f8b56a0d455d2bd14aeac91fc.ClearCacheDate", 15);
Deleted : user_pref("freecause5701241f8b56a0d455d2bd14aeac91fc.DNSCatch", false);
Deleted : user_pref("freecause5701241f8b56a0d455d2bd14aeac91fc.DisplayEULA", true);
Deleted : user_pref("freecause5701241f8b56a0d455d2bd14aeac91fc.DnsCatchEventData", "dns%20catch");
Deleted : user_pref("freecause5701241f8b56a0d455d2bd14aeac91fc.EBOMode", true);
Deleted : user_pref("freecause5701241f8b56a0d455d2bd14aeac91fc.FirstLaunchShown", true);
Deleted : user_pref("freecause5701241f8b56a0d455d2bd14aeac91fc.InstallDomain", "freecause.com");
Deleted : user_pref("freecause5701241f8b56a0d455d2bd14aeac91fc.InstallType", "standard");
Deleted : user_pref("freecause5701241f8b56a0d455d2bd14aeac91fc.LoadLayoutDate.100685", 15);
Deleted : user_pref("freecause5701241f8b56a0d455d2bd14aeac91fc.NewTabSearchEventData", "tab%20search");
Deleted : user_pref("freecause5701241f8b56a0d455d2bd14aeac91fc.ShowRecommendedOptions", true);
Deleted : user_pref("freecause5701241f8b56a0d455d2bd14aeac91fc.StateReportDate", "1355614532058");
Deleted : user_pref("freecause5701241f8b56a0d455d2bd14aeac91fc.TopRightSearchEventData", "top%20right%20search[...]
Deleted : user_pref("freecause5701241f8b56a0d455d2bd14aeac91fc.beforeInstallSaved", true);
Deleted : user_pref("freecause5701241f8b56a0d455d2bd14aeac91fc.beforeinstall.homepage", "hxxp%3A//www.yahoo.co[...]
Deleted : user_pref("freecause5701241f8b56a0d455d2bd14aeac91fc.beforeinstall.search", "Yahoo");
Deleted : user_pref("freecause5701241f8b56a0d455d2bd14aeac91fc.customNewTab", false);
Deleted : user_pref("freecause5701241f8b56a0d455d2bd14aeac91fc.helpUsImprove", true);
Deleted : user_pref("freecause5701241f8b56a0d455d2bd14aeac91fc.hideOthers", false);
Deleted : user_pref("freecause5701241f8b56a0d455d2bd14aeac91fc.partnerauth", false);
Deleted : user_pref("freecause5701241f8b56a0d455d2bd14aeac91fc.processAddrBar", false);
Deleted : user_pref("freecause5701241f8b56a0d455d2bd14aeac91fc.restoreSearch", false);
Deleted : user_pref("freecause5701241f8b56a0d455d2bd14aeac91fc.searchHistory", true);
Deleted : user_pref("freecause5701241f8b56a0d455d2bd14aeac91fc.session", "93BBAAA6A37A70E4DBB737E60CAB810AAB77[...]
Deleted : user_pref("freecause5701241f8b56a0d455d2bd14aeac91fc.showFirstLaunchOptions", false);
Deleted : user_pref("freecause5701241f8b56a0d455d2bd14aeac91fc.tb_lang", "en");
Deleted : user_pref("freecause5701241f8b56a0d455d2bd14aeac91fc.tool_id", "100685");
Deleted : user_pref("freecause5701241f8b56a0d455d2bd14aeac91fc.user_id", "111950564");
Deleted : user_pref("freecause5701241f8b56a0d455d2bd14aeac91fc.user_key", "4f6d4a2c8c24832523c6cd1a5bbaead74b1[...]
Deleted : user_pref("freecause5701241f8b56a0d455d2bd14aeac91fc.user_layouts", "100685");
Deleted : user_pref("freecause5701241f8b56a0d455d2bd14aeac91fc.user_lnames", "Shop%20to%20Win%2037");
Deleted : user_pref("freecause5701241f8b56a0d455d2bd14aeac91fc.vars.disablecuidinject", "1");
Deleted : user_pref("freecause5701241f8b56a0d455d2bd14aeac91fc.vars.lastcheck", "Tue%20May%2029%202012%2008%3A[...]
Deleted : user_pref("freecause5701241f8b56a0d455d2bd14aeac91fc.xml_service_url", "6bb94bbf55fe2f255901a560824a[...]
Deleted : user_pref("freecause5701241f8b56a0d455d2bd14aeac91fc.yahooSearch", false);
Deleted : user_pref("keyword.URL", "hxxp://websearch.ask.com/redirect?client=ff&src=kw&tb=X-SD&o=13959&locale=[...]

File : C:\Documents and Settings\Suprabha Gupta\Application Data\Mozilla\Firefox\Profiles\06bjnqer.default\prefs.js

C:\Documents and Settings\Suprabha Gupta\Application Data\Mozilla\Firefox\Profiles\06bjnqer.default\user.js ... Deleted !

Deleted : user_pref("browser.search.defaultenginename", "Search the web (Babylon)");
Deleted : user_pref("browser.search.selectedEngine", "Search the web (Babylon)");
Deleted : user_pref("extensions.mywebsearch.prevKwdEnabled", true);
Deleted : user_pref("extensions.mywebsearch.prevKwdURL", "hxxp://search.mywebsearch.com/mywebsearch/GGmain.jht[...]
Deleted : user_pref("extensions.toolbar.mindspark._64Members_.homepage", "hxxp://home.mywebsearch.com/index.jh[...]
Deleted : user_pref("extensions.toolbar.mindspark._64Members_.searchHistory", "2012 national geography bee||as[...]
Deleted : user_pref("keyword.URL", "hxxp://websearch.ask.com/redirect?client=ff&src=kw&tb=X-SD&o=13959&locale=[...]
Deleted : user_pref("browser.search.order.1", "Search the web (Babylon)");
Deleted : user_pref("browser.newtab.url", "hxxp://search.babylon.com/?affID=44444&tt=280812_2004_3512_1&babsrc[...]
Deleted : user_pref("browser.startup.homepage", "hxxp://search.babylon.com/?affID=44444&tt=280812_2004_3512_1&[...]
Deleted : user_pref("extensions.asktb.ff-original-keyword-url", "hxxp://search.babylon.com/?affID=44444&tt=280[...]

File : C:\Documents and Settings\Vishal Gupta\Application Data\Mozilla\Firefox\Profiles\1l8g79te.default\prefs.js

Deleted : user_pref("extensions.asktb.ff-original-keyword-url", "");
Deleted : user_pref("extensions.crossriderapp4639.4639.InstallationTime", 1356702692);
Deleted : user_pref("extensions.crossriderapp4639.4639.active", true);
Deleted : user_pref("extensions.crossriderapp4639.4639.addressbar", "");
Deleted : user_pref("extensions.crossriderapp4639.4639.affid", "0");
Deleted : user_pref("extensions.crossriderapp4639.4639.backgroundjs", "\n\n\"undefined\"!=typeof _GPL_BG_NEW&&[...]
Deleted : user_pref("extensions.crossriderapp4639.4639.backgroundver", 7);
Deleted : user_pref("extensions.crossriderapp4639.4639.can_run_bg_code", true);
Deleted : user_pref("extensions.crossriderapp4639.4639.certdomaininstaller", "");
Deleted : user_pref("extensions.crossriderapp4639.4639.changeprevious", false);
Deleted : user_pref("extensions.crossriderapp4639.4639.cookie.InstallationTime.expiration", "Fri Feb 01 2030 0[...]
Deleted : user_pref("extensions.crossriderapp4639.4639.cookie.InstallationTime.value", "1356702692");
Deleted : user_pref("extensions.crossriderapp4639.4639.description", "SavingsApp");
Deleted : user_pref("extensions.crossriderapp4639.4639.domain", "");
Deleted : user_pref("extensions.crossriderapp4639.4639.emailsig", "");
Deleted : user_pref("extensions.crossriderapp4639.4639.enablesearch", false);
Deleted : user_pref("extensions.crossriderapp4639.4639.exposesites", "");
Deleted : user_pref("extensions.crossriderapp4639.4639.fbremoteurl", "");
Deleted : user_pref("extensions.crossriderapp4639.4639.group", 0);
Deleted : user_pref("extensions.crossriderapp4639.4639.homepage", "");
Deleted : user_pref("extensions.crossriderapp4639.4639.iframe", false);
Deleted : user_pref("extensions.crossriderapp4639.4639.internaldb.Resources_appVer.expiration", "Fri Feb 01 20[...]
Deleted : user_pref("extensions.crossriderapp4639.4639.internaldb.Resources_appVer.value", "50");
Deleted : user_pref("extensions.crossriderapp4639.4639.internaldb.Resources_lastVersion.expiration", "Fri Feb [...]
Deleted : user_pref("extensions.crossriderapp4639.4639.internaldb.Resources_lastVersion.value", "0");
Deleted : user_pref("extensions.crossriderapp4639.4639.internaldb.Resources_meta.expiration", "Fri Feb 01 2030[...]
Deleted : user_pref("extensions.crossriderapp4639.4639.internaldb.Resources_meta.value", "%7B%7D");
Deleted : user_pref("extensions.crossriderapp4639.4639.internaldb.Resources_nextCheck.expiration", "Fri Dec 28[...]
Deleted : user_pref("extensions.crossriderapp4639.4639.internaldb.Resources_nextCheck.value", "true");
Deleted : user_pref("extensions.crossriderapp4639.4639.internaldb.Resources_queue.expiration", "Fri Feb 01 203[...]
Deleted : user_pref("extensions.crossriderapp4639.4639.internaldb.Resources_queue.value", "%7B%7D");
Deleted : user_pref("extensions.crossriderapp4639.4639.js", "\n\nif(\"undefined\"!=typeof _GPL_PLUGIN){var _GP[...]
Deleted : user_pref("extensions.crossriderapp4639.4639.manifesturl", "");
Deleted : user_pref("extensions.crossriderapp4639.4639.name", "SavingsApp");
Deleted : user_pref("extensions.crossriderapp4639.4639.newtab", "");
Deleted : user_pref("extensions.crossriderapp4639.4639.opensearch", "");
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_1.code", "appAPI._cr_config={appID:funct[...]
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_1.name", "base");
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_1.ver", 3);
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_1000014.code", "Array.prototype.indexOf|[...]
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_1000014.name", "GPL Plugin (Loader)");
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_1000014.ver", 10);
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_1000015.code", "var _GPL_BG={vars:{},rul[...]
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_1000015.name", "GPL Background (BG)");
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_1000015.ver", 4);
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_13.code", "(function(a){a.selectedText=f[...]
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_13.name", "CrossriderAppUtils");
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_13.ver", 2);
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_14.code", "if(typeof(appAPI)===\"undefin[...]
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_14.name", "CrossriderUtils");
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_14.ver", 2);
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_15.code", "(function(f){var u={};var e=M[...]
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_15.name", "FacebookFFIE");
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_15.ver", 1);
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_16.code", "if((typeof isBackground===\"u[...]
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_16.name", "FFAppAPIWrapper");
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_16.ver", 4);
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_17.code", "if(typeof window!==\"undefine[...]
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_17.name", "jQuery");
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_17.ver", 3);
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_21.code", "var CrossriderDebugManager=(f[...]
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_21.name", "debug");
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_21.ver", 3);
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_22.code", "(function(a){appAPI.queueMana[...]
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_22.name", "resources");
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_22.ver", 2);
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_28.code", "var CrossriderInitializerPlug[...]
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_28.name", "initializer");
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_28.ver", 2);
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_4.code", "/*! jQuery v1.7.1 jquery.com |[...]
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_4.name", "jquery_1_7_1");
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_4.ver", 3);
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_47.code", "(function(){appAPI.ready=func[...]
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_47.name", "resources_background");
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_47.ver", 1);
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_64.code", "(function(){var h=\"__CR_EMPT[...]
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_64.name", "appApiMessage");
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_64.ver", 1);
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_72.code", "if(appAPI.__should_activate_v[...]
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_72.name", "appApiValidation");
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins.plugin_72.ver", 1);
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins_lists.plugins_0", "17,14,16,64,72,47,1000015");
Deleted : user_pref("extensions.crossriderapp4639.4639.plugins_lists.plugins_1", "17,14,13,16,15,64,72,4,1,21,[...]
Deleted : user_pref("extensions.crossriderapp4639.4639.pluginsurl", "hxxp://app-static.crossrider.com/plugin/a[...]
Deleted : user_pref("extensions.crossriderapp4639.4639.pluginsversion", 23);
Deleted : user_pref("extensions.crossriderapp4639.4639.premium", true);
Deleted : user_pref("extensions.crossriderapp4639.4639.publisher", "215 Apps");
Deleted : user_pref("extensions.crossriderapp4639.4639.searchstatus", 0);
Deleted : user_pref("extensions.crossriderapp4639.4639.setnewtab", false);
Deleted : user_pref("extensions.crossriderapp4639.4639.settingsurl", "");
Deleted : user_pref("extensions.crossriderapp4639.4639.thankyou", "");
Deleted : user_pref("extensions.crossriderapp4639.4639.updateinterval", 360);
Deleted : user_pref("extensions.crossriderapp4639.4639.ver", 50);
Deleted : user_pref("extensions.crossriderapp4639.adsOldValue", -1);
Deleted : user_pref("extensions.crossriderapp4639.apps", "4639");
Deleted : user_pref("extensions.crossriderapp4639.bic", "13be1c83341c806c1c274cf6deffb326");
Deleted : user_pref("extensions.crossriderapp4639.cid", 4639);
Deleted : user_pref("extensions.crossriderapp4639.firstrun", false);
Deleted : user_pref("extensions.crossriderapp4639.hadappinstalled", true);
Deleted : user_pref("extensions.crossriderapp4639.installationdate", 1356702692);
Deleted : user_pref("extensions.crossriderapp4639.lastcheck", 22611712);
Deleted : user_pref("extensions.crossriderapp4639.lastcheckitem", 22611712);
Deleted : user_pref("extensions.enabledAddons", "crossriderapp4639@crossrider.com:0.81.7,{CAFEEFAC-0016-0000-0[...]
Deleted : user_pref("keyword.URL", "hxxp://websearch.ask.com/redirect?client=ff&src=kw&tb=X-SD&o=13959&locale=[...]

-\\ Google Chrome v25.0.1364.172

File : C:\Documents and Settings\Chittij Gupta\Local Settings\Application Data\Google\Chrome\User Data\Default\Preferences

[OK] File is clean.

*************************

AdwCleaner[R1].txt - [53909 octets] - [29/03/2013 19:14:14]
AdwCleaner[S1].txt - [53412 octets] - [29/03/2013 19:15:31]

########## EOF - C:\AdwCleaner[S1].txt - [53473 octets] ##########


Report •

Related Solutions

#4
March 30, 2013 at 11:08:22
vishalg_99,
you probably have an unwanted rootkit installed. Follow the EXACT order of these progs (even if you already tried Malwarebytes) and DO NOT reboot until after the last prog has run
1- rkill.exe
http://www.technibble.com/rkill-rep...
2- tdss killer
http://www.bleepingcomputer.com/dow...
3- Malwarebytes
http://www.filehippo.com/download_m...
4- Malwarebytes rootkit remover
http://www.malwarebytes.org/product...

If that doesn't fix your problem, then do the SAME, ONLY this time in SafeMode

Some HELP in posting on Computing.net plus free progs and instructions 7 Golds


Report •

#5
March 31, 2013 at 19:08:38
Sorry thread has been edited by Justin.
Where were we up to?

Please reply and let us know if our help worked. Your feedback helps others. Maybe you?


Report •

#6
April 1, 2013 at 00:50:45

 Download Junkware Removal Tool from these links:

http://www.bleepingcomputer.com/dow...
http://thisisudax.blogspot.co.nz/20...
Download Junkware Removal Tool to your desktop.
Shut down your protection software now to avoid potential conflicts.
Temporarily disable your antivirus and any antispyware real time protection before performing a scan.
Run the tool by double-clicking it. If you are using Windows Vista or Windows 7, right-click JRT and select Run as Administrator
The tool will open and start scanning your system.
NOTE:Once the scan is complete JRT will shut down your browser with NO warning.
The scan can take a while to complete depending on your system's specifications.
On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
Copy and Paste the JRT.txt log into your next message.

Please reply and let us know if our help worked. Your feedback helps others. Maybe you?


Report •

Ask Question