======= REPORT FROM AD-REMOVER 2.0.0.2,G | ONLY XP/VISTA/7 ======= Updated by TeamXscript on 12/04/11 Contact: AdRemover[DOT]contact[AT]gmail[DOT]com website: http://www.teamxscript.org C:\Program Files\Ad-Remover\main.exe (SCAN [1]) -> Launched at 21:19:18 on 22/09/2011, Normal boot Microsoft Windows XP Home Edition Dodatek Service Pack 3 (X86) Kosturkiewicz Marcin@BIGMK ( ) ============== SEARCH ============== Folder found: C:\Documents and Settings\All Users\Dane aplikacji\PopCap Games Folder found: C:\Documents and Settings\Kosturkiewicz Marcin\Menu Start\Programy\TorrentSpeeder Folder found: C:\Program Files\TorrentSpeeder Folder found: C:\Documents and Settings\All Users\Dane aplikacji\Trymedia Folder found: C:\Program Files\Trymedia -- File opened: C:\Documents and Settings\Kosturkiewicz Marcin\Dane aplikacji\Mozilla\FireFox\Profiles\4vlat66x.default\Prefs.js -- Line found: user_pref("extensions.mywebsearch.openSearchURL", "hxxp://search.mywebsearch.com/mywebsearch/opensea... Line found: user_pref("extensions.mywebsearch.prevKwdEnabled", true); Line found: user_pref("extensions.mywebsearch.prevKwdURL", "chrome://browser-region/locale/region.properties"); -- File closed -- Key found: HKLM\Software\Classes\CLSID\{799391D3-EB86-4bac-9BD3-CBFEA58A0E15} Key found: HKLM\Software\Classes\CLSID\{D858DAFC-9573-4811-B323-7011A3AA7E61} Key found: HKLM\Software\Classes\Interface\{48C9E279-C48C-48C1-9AFC-E4E9E5E5E350} Key found: HKLM\Software\Classes\Interface\{5106ED5C-7245-4F5A-ABCA-67B0C15333D2} Key found: HKLM\Software\Classes\Interface\{8203FEE5-918A-43C5-BFE0-34B4159FD2E4} Key found: HKLM\Software\Classes\Interface\{83369246-C6EF-4138-982A-664A62B463E4} Key found: HKLM\Software\Classes\Interface\{956999E9-A0BE-48C9-9BCC-5A7D3E31BF97} Key found: HKLM\Software\Classes\Interface\{99E0EEE5-14C5-46D3-878B-7DA2663E1A92} Key found: HKLM\Software\PopCap Key found: HKLM\Software\Trymedia Systems Key found: HKCU\Software\AutocompleteProBHO Key found: HKCU\Software\PopCap Key found: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu\Programs\GamesBar Key found: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu\Programs\TorrentSpeeder ============== ADDITIONNAL SCAN ============== **** Mozilla Firefox Version [6.0.2 (pl)] **** HKLM_MozillaPlugins\@oberon-media.com/ONCAdapter (x) Searchplugins\allegro-pl.xml (hxxp://www.allegro.pl/search.php?string={searchTerms}&sourceid=Mozilla-search) Searchplugins\fbc-pl.xml (hxxp://fbc.pionier.net.pl/owoc/results) Searchplugins\merlin-pl.xml (hxxp://www.merlin.com.pl/frontend/search?sourceid=Mozilla-search&fraza={searchTerms}&skad=crhhxmkohb) Searchplugins\pwn-pl.xml (hxxp://encyklopedia.pwn.pl/szukaj.php?co={searchTerms}) Searchplugins\wikipedia-pl.xml (hxxp://pl.wikipedia.org/wiki/Specjalna:Szukaj) Searchplugins\wp-pl.xml (hxxp://szukaj.wp.pl/szukaj.html?z=T&r=T&szukaj={searchTerms}) Components\browsercomps.dll (Mozilla Foundation) Components\GooglePlusVideosXPCOM.dll (?) -- C:\Documents and Settings\Kosturkiewicz Marcin\Dane aplikacji\Mozilla\FireFox\Profiles\4vlat66x.default -- Extensions\gamesbar@oberon-media.com (Oberon GamesBar) Prefs.js - browser.download.dir, C:\\Documents and Settings\\Kosturkiewicz Marcin\\Moje dokumenty Prefs.js - browser.download.lastDir, C:\\Documents and Settings\\Kosturkiewicz Marcin\\Moje dokumenty\\Moje obrazy Prefs.js - browser.search.selectedEngine, bing Prefs.js - browser.startup.homepage, hxxp://www.google.pl/ Prefs.js - browser.startup.homepage_override.buildID, 20110902133214 Prefs.js - browser.startup.homepage_override.mstone, rv:6.0.2 ======================================== **** Internet Explorer Version [8.0.6001.18702] **** HKCU_Main|Search Page - hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKCU_Main|Start Page - hxxp://start.msn.iplay.com/?o=shp HKLM_Main|Default_Page_URL - hxxp://go.microsoft.com/fwlink/?LinkId=69157 HKLM_Main|Default_Search_URL - hxxp://go.microsoft.com/fwlink/?LinkId=54896 HKLM_Main|Search Page - hxxp://go.microsoft.com/fwlink/?LinkId=54896 HKLM_Main|Start Page - hxxp://go.microsoft.com/fwlink/?LinkId=69157 HKCU_SearchScopes\{36377DD7-B3EB-42f5-986F-680BAF59BA9D} - "bing" (hxxp://start.msn.iplay.com/searchresultsredirect.aspx?o=chrome&q={searchTerms}) HKLM_Toolbar|{8E5E2654-AD2D-48bf-AC2D-D17F00898D06} (C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll) HKLM_ElevationPolicy\{2EEE97E4-259B-4ec9-BC9A-A41F5DD7E282} - C:\Program Files\SmarThru 4\WebSaver.exe (?) HKLM_ElevationPolicy\{803E07A7-F4C1-4b55-81C0-21D9F6D75F49} - C:\Program Files\Common Files\Oberon Media\Parts\1.0.0.14\OberonParts.exe (?) HKLM_ElevationPolicy\{A6E2003F-95C5-4591-BA9A-0093080FDB5C} - C:\Program Files\Common Files\Oberon Media\OberonBroker\1.0.0.76\OberonBroker.exe (?) HKCU_Extensions\{5941A0E4-56C1-4a49-9B18-05762CAC5F9B} - "SmarThru4 Web Capture" (C:\Program Files\SmarThru 4\WebCapture.dll,209) HKCU_Extensions\{A07BFEF7-DD11-4937-B23B-E70C11D2EDF4} - "SmarThru4 Przechwyć zaznaczenie" (C:\Program Files\SmarThru 4\WebCapture.dll,210) HKCU_Extensions\{E753A93F-2367-4978-BFA0-83048C1E61CB} - "SmarThru4 Zapisz jako HTML" (C:\Program Files\SmarThru 4\WebCapture.dll,208) HKCU_Extensions\{F1F53366-3E11-47ab-BF84-580C94F9C9AD} - "SmarThru4 Zapisz zaznaczony tekst" (C:\Program Files\SmarThru 4\WebCapture.dll,206) HKLM_Extensions\{2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - "Create Mobile Favorite" (C:\PROGRA~1\MI3AA1~1\INetRepl.dll,210) HKLM_Extensions\{2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - "?" (?) HKLM_Extensions\{e2e2dd38-d088-4134-82b7-f2ba38496583} - "?" (?) BHO\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - "avast! WebRep" (C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll) ======================================== C:\Program Files\Ad-Remover\Quarantine: 0 File(s) C:\Program Files\Ad-Remover\Backup: 0 File(s) C:\Ad-Report-SCAN[1].txt - 22/09/2011 21:19:23 (3726 Byte(s)) End at: 21:20:09, 22/09/2011 ============== E.O.F ==============