Browsers Crash, Executable files stall or crash

**jmarket** · 11-14-2016, 07:24 PM

Hi there Paul Let’s you started shall we?

ZHP Scan.

Please download Zhp Cleaner to your desktop. Right Click the icon and select run as administrator.

Once you have started the program, you will need to click the scanner button.

[IMG alt="EgsT69u" width="602px" height="129px"]https://windowsinstructed.com/wp-content/uploads/2015/06/EgsT69u.png[/IMG]

The program will close all open browsers!
3. Once the scan is completed, the you will want to click the Repair button.
[URL unfurl="true"]http://windowsinstructed.com/wp-content/uploads/2015/06/6QJjV50.png[/URL]

At the end of the process you may be asked to reboot your machine. After you reboot a report will open on your desktop.
Copy and paste the report here in your next reply.

Zoek Scan

Disable your antivirus prior to this scan.
Download Zoek
Save the file to your desktop.
Right click Zoek.exe and run as administrator. (Xp Users double click)
Copy and paste the items in red below and paste them into Zoek.

createsrpoint;
emptyfolderscheck;delete
emptyclsid;
emptyalltemp;
ipconfig /flushdns;b
ResetHosts;
autoclean;

Now hit the run script button.
The log will appear after a reboot, also you can find it on the C: drive.
Post the log in your next reply.

**paulwb** · 11-14-2016, 08:37 PM

Thanks for the quick reply.
I ran ZHP cleaner, total bug count 33.
Clicked Repair, and it started to scan again, now stuck at 96% for 30 minutes, while the bug count rises, currently at 25.
Is this normal? Is it in repair mode, on its way to repairing the 33 found earlier?

**jmarket** · 11-14-2016, 08:52 PM

Originally posted by Paul Simoes

Is this normal? Is it in repair mode, on its way to repairing the 33 found earlier?

Sometimes ZHP Cleaner can take a while depending on the total # of items found as well as the speed of your computer. If it’s sticking, try running it in Safe Mode.

If that doesn’t work either, skip it and move on to the Zoek scan

**paulwb** · 11-14-2016, 10:17 PM

Hi jmarket,
OK thanks. It wasn’t clear if the repair process was under way. The repair was successful.
Below are the ZHP & Zoek logs …

~ ZHPCleaner v2016.11.14.193 by Nicolas Coolman (2016/11/14)
~ Run by psimoes (Administrator) (14/11/2016 14:55:34)
~ Web: https://www.nicolascoolman.com
~ Blog: https://www.anti-malware.top
~ Facebook : ZHP
~ State version : Version OK
~ Type : Repair
~ Report : C:\Users\psimoes\Desktop\ZHPCleaner.txt
~ Quarantine : C:\Users\psimoes\AppData\Roaming\ZHP\ZHPCleaner_Qu arantine.txt
~ UAC : Activate
~ Boot Mode : Normal (Normal boot)
Windows VISTA, 32-bit Service Pack 2 (Build 6002)

—\ Services (0)
~ No malicious or unnecessary items found.

—\ Browser internet (1)
REPLACED Opera URL: {“ab_testing”:{“uid”:“QzRGMTc4NTYtMjY0Ri00REU1LUEw MzItNThEOTg2NzI0QkYw”},“autofill”:{"wallet_import_[…] =>Adware.Sambreel

—\ Hosts file (1)
~ The hosts file is legitimate (1)

—\ Scheduled automatic tasks. (0)
~ No malicious or unnecessary items found.

—\ Explorer ( File, Folder) (30)
MOVED file: C:\Windows\Installer\wix{308B6AEA-DE50-4666-996D-0FA461719D6B}.SchedServiceConfig.rmi =>.Superfluous.Empty
MOVED file: C:\Windows\Installer\wix{3911CF56-9EF2-39BA-846A-C27BD3CD0685}.SchedServiceConfig.rmi =>.Superfluous.Empty
MOVED file: C:\Windows\Installer\wix{3C3901C5-3455-3E0A-A214-0B093A5070A6}.SchedServiceConfig.rmi =>.Superfluous.Empty
MOVED file: C:\Windows\Installer\wix{4903D172-DCCB-392F-93A3-34CA9D47FE3D}.SchedServiceConfig.rmi =>.Superfluous.Empty
MOVED file: C:\Windows\Installer\wix{CCA1EEA3-555E-4D05-AC46-4B49C6C5D887}.SchedServiceConfig.rmi =>.Superfluous.Empty
MOVED file: C:\Users\psimoes\Downloads\Android Apps\PopcornTime-5.4.exe [Popcorn Time - Popcorn Time Setup] =>.Superfluous.PopcornTime
MOVED folder: C:\ProgramData{3276BE95_AF08_429F_A64F_CA64CB79BCF 6} =>Heuristic.Suspect
MOVED folder: C:\Program Files\QuickTime =>Riskware.QuickTime
MOVED folder: C:\Users\psimoes\AppData\Local\Google\Chrome\User Data\Default\File System\008 =>PUP.Optional.DomaIQ
MOVED folder: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime =>Riskware.QuickTime
MOVED folder: C:\Users\psimoes\AppData\Local{0874CFEB-46BA-48A7-B323-3F248E2A9D2C} =>.Superfluous.Empty
MOVED folder: C:\Users\psimoes\AppData\Local{1D0683B0-E87A-4F6C-817C-6B6FB0DBFBFB} =>.Superfluous.Empty
MOVED folder: C:\Users\psimoes\AppData\Local{33653CAF-5422-495F-80D4-DFB50403B443} =>.Superfluous.Empty
MOVED folder: C:\Users\psimoes\AppData\Local{3E54A680-E6DA-49BE-86E5-3D593FE0490D} =>.Superfluous.Empty
MOVED folder: C:\Users\psimoes\AppData\Local{3F01CD36-A73A-4250-A198-0B4AEC9BD7E0} =>.Superfluous.Empty
MOVED folder: C:\Users\psimoes\AppData\Local{413831D1-1316-4252-81D6-A1DF48FFAAFC} =>.Superfluous.Empty
MOVED folder: C:\Users\psimoes\AppData\Local{531198E2-06D2-4349-AFD4-C4F540ED3328} =>.Superfluous.Empty
MOVED folder: C:\Users\psimoes\AppData\Local{545D1F99-2D75-4119-B2C5-A06F9E8E2824} =>.Superfluous.Empty
MOVED folder: C:\Users\psimoes\AppData\Local{6D46D35E-1DDE-4B8B-89A3-E27AE5D9B70B} =>.Superfluous.Empty
MOVED folder: C:\Users\psimoes\AppData\Local{89BD34DC-36EE-4159-A41A-137CB894103B} =>.Superfluous.Empty
MOVED folder: C:\Users\psimoes\AppData\Local{A49468BD-99A5-466B-A56D-AA37F2E140AC} =>.Superfluous.Empty
MOVED folder: C:\Users\psimoes\AppData\Local{A6C835F9-3D04-4574-8701-0AA8A1206FE1} =>.Superfluous.Empty
MOVED folder: C:\Users\psimoes\AppData\Local{A9693926-F907-4666-8DB9-82CA018B6D99} =>.Superfluous.Empty
MOVED folder: C:\Users\psimoes\AppData\Local{AB814BA9-6A52-4ECE-9573-3FC5D8E31AEC} =>.Superfluous.Empty
MOVED folder: C:\Users\psimoes\AppData\Local{C42D5C08-0E58-459C-837E-4C41FCD8F1BD} =>.Superfluous.Empty
MOVED folder: C:\Users\psimoes\AppData\Local{D25F0319-D7A8-48C1-9496-6F309BE412C5} =>.Superfluous.Empty
MOVED folder: C:\Users\psimoes\AppData\Local{E287512F-5B4F-4332-838A-2609852F8DD9} =>.Superfluous.Empty
MOVED folder: C:\Users\psimoes\AppData\Local{E6A6AD84-DC5B-4087-9E59-D6FC298AC3F7} =>.Superfluous.Empty
MOVED folder: C:\Users\psimoes\AppData\Local{E8909DFA-19EC-4A8F-B88D-013D56ABB973} =>.Superfluous.Empty
MOVED folder: C:\Users\psimoes\AppData\Local{FF413783-784D-44ED-AAEF-E27675D2464D} =>.Superfluous.Empty

—\ Registry ( Key, Value, Data) (1)
DELETED key*: HKLM\SOFTWARE\Unlocker\OpenCandy =>Adware.OpenCandy

—\ Summary of the elements found (7)
https://www.nicolascoolman.com/fr/pu...onal-sambreel/ =>Adware.Sambreel
Blog - Nicolas Coolman =>.Superfluous.Empty
https://www.anti-malware.top/2016/09...s-popcorntime/ =>.Superfluous.PopcornTime
Redirecting... =>Heuristic.Suspect
Redirecting... =>Riskware.QuickTime
https://www.nicolascoolman.com/fr/adware-domaiq/ =>PUP.Optional.DomaIQ
https://www.nicolascoolman.com/fr/re...et_infections/ =>Adware.OpenCandy

—\ Other deletions. (12)
~ Registry Keys Tracing deleted (12)
~ Remove the old reports ZHPCleaner. (0)

—\ Result of repair
~ Repair carried out successfully

—\ Statistics
~ Items scanned : 790
~ Items found : 0
~ Items cancelled : 0
~ Items repaired : 32

~ End of clean in 00h58mn27s
~====================

Zoek.exe v5.0.0.1 Updated 19-September-2016
Tool run by psimoes on 14/11/2016 at 16:18:42.12.
Microsoft® Windows Vista™ Home Premium 6.0.6002 Service Pack 2 x86
Running in: Safe Mode NETWORK Internet Access Detected
Launched: C:\Users\psimoes\Desktop\zoek.exe [Scan all users] [Script inserted]

==== System Restore Info ======================

==== Reset Hosts File ======================
[HEADING=1]Copyright (c) 1993-2006 Microsoft Corp.[/HEADING]
[HEADING=1]This is a sample HOSTS file used by Microsoft TCP/IP for Windows.[/HEADING]
[HEADING=1]This file contains the mappings of IP addresses to host names. Each[/HEADING]
[HEADING=1]entry should be kept on an individual line. The IP address should[/HEADING]
[HEADING=1]be placed in the first column followed by the corresponding host name.[/HEADING]
[HEADING=1]The IP address and the host name should be separated by at least one[/HEADING]
[HEADING=1]space.[/HEADING]
[HEADING=1]Additionally, comments (such as these) may be inserted on individual[/HEADING]
[HEADING=1]lines or following the machine name denoted by a ‘#’ symbol.[/HEADING]
[HEADING=1]For example:[/HEADING]
[HEADING=1]102.54.94.97 rhino.acme.com # source server[/HEADING]
[HEADING=1]38.25.63.10 x.acme.com # x client host[/HEADING]
127.0.0.1 localhost
::1 localhost

==== Empty Folders Check ======================

C:\Program Files\Tweaking.com deleted successfully
C:\Program Files\Common Files\MicroWorld deleted successfully
C:\PROGRA~2\Oracle deleted successfully
C:\Users\Guest\AppData\Roaming\Apple Computer deleted successfully
C:\Users\psimoes\AppData\Roaming\JAM Software deleted successfully
C:\Users\psimoes\AppData\Roaming\Media Player Classic deleted successfully
C:\Users\psimoes\AppData\Roaming\SkypePM deleted successfully
C:\Users\psimoes\AppData\Roaming\Windows Live Writer deleted successfully
C:\Users\torrents\AppData\Roaming\Apple Computer deleted successfully
C:\Users\torrents\AppData\Roaming\Google deleted successfully
C:\Users\psimoes\AppData\Local\Downloaded Installations deleted successfully
C:\Users\psimoes\AppData\Local\FSDART deleted successfully
C:\Users\psimoes\AppData\Local\Skype deleted successfully
C:\Users\torrents\AppData\Local{0A37DD66-17E4-4654-B151-1A26F2A96828} deleted successfully
C:\Users\torrents\AppData\Local{0B6F107D-F2CE-4CA8-8AD5-DB8ABC72D1E5} deleted successfully
C:\Users\torrents\AppData\Local{0E39A969-7D56-4B65-95AA-5C882C6602F9} deleted successfully
C:\Users\torrents\AppData\Local{1FDE68B8-951C-4A51-A93E-F1D66AE04090} deleted successfully
C:\Users\torrents\AppData\Local{214F433E-2134-436B-B363-54049233701D} deleted successfully
C:\Users\torrents\AppData\Local{2B464EDD-249F-44E9-84EE-325F99BA1058} deleted successfully
C:\Users\torrents\AppData\Local{2FB85267-A6B0-4190-A051-D4D4C1A6AA43} deleted successfully
C:\Users\torrents\AppData\Local{2FD89FA8-6573-4A96-B5D7-4C3F8BBCFD13} deleted successfully
C:\Users\torrents\AppData\Local{3136722F-B1D1-4F2C-92E9-8555A1322CC0} deleted successfully
C:\Users\torrents\AppData\Local{3140949C-A842-42E6-975C-EB87FCB8EE2B} deleted successfully
C:\Users\torrents\AppData\Local{331194C8-A41A-4CE7-8B7D-55B3171617EB} deleted successfully
C:\Users\torrents\AppData\Local{344BA392-42A2-4859-AE10-E999215FF8E9} deleted successfully
C:\Users\torrents\AppData\Local{358E2A08-0899-4FE2-9870-F6B3509DACD7} deleted successfully
C:\Users\torrents\AppData\Local{359750A4-75BE-4368-9EB1-3C1DE6E3D54E} deleted successfully
C:\Users\torrents\AppData\Local{3FAF0087-8840-4B92-B04A-2EDBC5B6804A} deleted successfully
C:\Users\torrents\AppData\Local{4C5154E0-4B95-48DE-9DB7-B8FDCFA6ED01} deleted successfully
C:\Users\torrents\AppData\Local{4F07F52C-274E-4C20-A666-E1C070E54A48} deleted successfully
C:\Users\torrents\AppData\Local{5765A1B0-875B-4E57-B98C-1BE6722F47C5} deleted successfully
C:\Users\torrents\AppData\Local{5CE51B4A-E0F5-40E3-8DEF-B54485A1A411} deleted successfully
C:\Users\torrents\AppData\Local{5FA25ACC-0FFC-4937-B7B5-6A202868998F} deleted successfully
C:\Users\torrents\AppData\Local{6073A68F-401D-4427-A024-BA813B059670} deleted successfully
C:\Users\torrents\AppData\Local{65648A3C-3DB0-4D2A-8E9E-5B51BAA2404D} deleted successfully
C:\Users\torrents\AppData\Local{67499C0A-1B95-4A17-95C4-F8A0D91C3DEC} deleted successfully
C:\Users\torrents\AppData\Local{68A98603-40E7-492A-B4F0-2DC6E059BDF9} deleted successfully
C:\Users\torrents\AppData\Local{6CFC1921-E76B-4EF5-B535-ED8F70D3A8BF} deleted successfully
C:\Users\torrents\AppData\Local{6EB9A3F8-78DB-48E1-8A4E-876209CC4C39} deleted successfully
C:\Users\torrents\AppData\Local{6FB7EADD-BB26-443E-AFCB-AD015F453593} deleted successfully
C:\Users\torrents\AppData\Local{71A6C0EE-436F-4D74-9109-6A393C9BBAD8} deleted successfully
C:\Users\torrents\AppData\Local{755F3813-611E-4EC3-9B92-9C7344865CED} deleted successfully
C:\Users\torrents\AppData\Local{7B2F88D1-1D5D-4D39-9F52-18BBCB8E9A13} deleted successfully
C:\Users\torrents\AppData\Local{7E93AAE5-D03F-4650-B4EC-537A69AC08AD} deleted successfully
C:\Users\torrents\AppData\Local{85E07806-366D-48BD-BBA0-9D080EE589F6} deleted successfully
C:\Users\torrents\AppData\Local{87D17032-6377-424B-896B-7575FDE53C8A} deleted successfully
C:\Users\torrents\AppData\Local{88DB861A-CFE3-4380-9121-0CB7D522E3A0} deleted successfully
C:\Users\torrents\AppData\Local{8B39BCDC-D196-414D-8386-F18D3973D7D4} deleted successfully
C:\Users\torrents\AppData\Local{8C1FFCE6-83AB-4141-B278-779159F8144A} deleted successfully
C:\Users\torrents\AppData\Local{9E00F062-00C6-4672-8D03-84E2ACF8F91B} deleted successfully
C:\Users\torrents\AppData\Local{9E550A50-8A63-4A43-AD43-2B29AFC01498} deleted successfully
C:\Users\torrents\AppData\Local{A4C29529-2296-4245-B493-DE961F91123F} deleted successfully
C:\Users\torrents\AppData\Local{A89E34E3-C409-4096-BD11-9D0BFA85884C} deleted successfully
C:\Users\torrents\AppData\Local{AA2A1E82-5CA2-4838-BAF3-F97A4D89663B} deleted successfully
C:\Users\torrents\AppData\Local{B0785BDD-6C32-472D-96A6-59DAA791CAC7} deleted successfully
C:\Users\torrents\AppData\Local{B1655C30-6372-4D0A-A0FA-2BE23E72283A} deleted successfully
C:\Users\torrents\AppData\Local{B492D19B-7289-4876-BCEB-4E1F3DE6E6A3} deleted successfully
C:\Users\torrents\AppData\Local{BD3F5A03-6F83-4CEB-8935-CD66701D1703} deleted successfully
C:\Users\torrents\AppData\Local{C6F73A72-159F-45B2-B208-E54558EFE04D} deleted successfully
C:\Users\torrents\AppData\Local{CB3FC6A7-5053-424C-A027-D4096E71F09F} deleted successfully
C:\Users\torrents\AppData\Local{D1281A4A-560B-4461-8F7C-B2F4979C6E28} deleted successfully
C:\Users\torrents\AppData\Local{D6B0651B-DBAD-4A5E-8876-CB60BAC4E177} deleted successfully
C:\Users\torrents\AppData\Local{DAADFAE0-51E8-4AC5-A434-7A8CEFEC25C7} deleted successfully
C:\Users\torrents\AppData\Local{DD55A1CA-EA2D-4758-A7F8-9DB91C27B4C8} deleted successfully
C:\Users\torrents\AppData\Local{DFDD1532-190F-4335-AD11-5EAC086068BD} deleted successfully
C:\Users\torrents\AppData\Local{E479EE4B-73C8-4795-8D65-8217326E29DF} deleted successfully
C:\Users\torrents\AppData\Local{E62D77A7-1540-4163-8D40-AAB4CC595DB5} deleted successfully
C:\Users\torrents\AppData\Local{E78501C0-1C99-4278-B5C2-4318EAB5B0B3} deleted successfully
C:\Users\torrents\AppData\Local{EA2447D0-0F46-4255-8E7A-424AEAEE2C99} deleted successfully
C:\Users\torrents\AppData\Local{F324F794-1DA0-454C-9458-FE140F57FE6B} deleted successfully
C:\Users\torrents\AppData\Local{F3395637-9E2E-4E42-B992-E62A74AE0235} deleted successfully
C:\Users\torrents\AppData\Local{FA31F46F-0328-4348-9E8D-30BD4FD1FF1D} deleted successfully
C:\Users\torrents\AppData\Local{FC0CA199-F2D7-4E1A-AB14-0489408CCCA7} deleted successfully
C:\Users\torrents\AppData\Local{FEDDB565-A261-478C-B924-18D89D2CAF3C} deleted successfully

==== Deleting CLSID Registry Keys ======================

HKEY_USERS\S-1-5-21-3399307451-3074549587-1771456082-1000\Software\Microsoft\Windows\CurrentVersion\Ext \Stats{AF69DE43-7D58-4638-B6FA-CE66B5AD205D} deleted successfully
HKEY_USERS\S-1-5-21-3399307451-3074549587-1771456082-1000\Software\Microsoft\Windows\CurrentVersion\Ext \Settings{AF69DE43-7D58-4638-B6FA-CE66B5AD205D} deleted successfully
HKEY_USERS\S-1-5-21-3399307451-3074549587-1771456082-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy{F4E39681-15F8-4fda-B8A3-B5C98378F2F3} deleted successfully
HKEY_CLASSES_ROOT\CLSID{AF69DE43-7D58-4638-B6FA-CE66B5AD205D} deleted successfully

==== Deleting CLSID Registry Values ======================

HKEY_USERS\S-1-5-21-3399307451-3074549587-1771456082-1000\Software\Microsoft\Internet Explorer\Approved Extensions{AF69DE43-7D58-4638-B6FA-CE66B5AD205D} deleted successfully
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\Explorer\ShellExecuteHooks{AEB6717E-7E19-11d0-97EE-00C04FD91972} deleted successfully

==== Deleting Services ======================

==== FireFox Fix ======================

ProfilePath: C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Pro files\hnnfnerz.default

user.js not found
---- FireFox user.js and prefs.js backups ----

prefs_112016_0443_.backup

ProfilePath: C:\Users\psimoes\AppData\Roaming\Mozilla\Firefox\P rofiles\9yk1vrhk.default

user.js not found
---- FireFox user.js and prefs.js backups ----

prefs_112016_0443_.backup

ProfilePath: C:\Users\torrents\AppData\Roaming\Mozilla\Firefox\ Profiles\z9ph3vjm.default

user.js not found
---- Lines yahoo removed from prefs.js ----
user_pref(“extensions.wrc.SearchRules.yahoo.com.st yle”, ".WRCN {display:none} .sm-hd .WRCN, .sm-links .WRCN, .res h3 > .WRCN {display:inline url("IM
user_pref(“extensions.wrc.SearchRules.yahoo.com.ur l”, “^http(s)?\:\/\/((.)+\.)?search\.yahoo\.com\/(.)*”);
---- Lines finder removed from prefs.js ----
user_pref(“browser.startup.homepage”, " http://adultfriendfinder.com/|http://www.hornymatches.com/ ");
---- Lines Search-Results removed from prefs.js ----
user_pref(“extensions.wrc.SearchRules.rambler.ru.s tyle”, ".WRCN {display:none} .search-results .title + .WRCN {display:inline url("IMAGE") right no
---- FireFox user.js and prefs.js backups ----

prefs_112016_0443_.backup

==== Batch Command(s) Run By Tool======================

==== Deleting Files \ Folders ======================

C:\Program Files\Tweaking.com not found
C:\Program Files\stinger deleted
C:\Windows\system32\appdata deleted
C:\Program Files\GUTC12.tmp deleted
C:\Program Files\GUMC11.tmp deleted
C:\Program Files\IdealDVDCopy deleted
C:\Program Files\pandasecuritytb deleted
C:\PROGRA~2\IdealSoftware deleted
C:\PROGRA~2{429CAD59-35B1-4DBC-BB6D-1DB246563521} deleted
C:\Users\psimoes\AppData\Local{ACABC2F9-44A4-4E51-B14F-01A564E7E99E} deleted
C:\Users\psimoes\AppData\Local\IdealSoftware deleted
C:\Users\psimoes\AppData\LocalLow\pandasecuritytb deleted
C:\Windows\system32\GroupPolicy\Machine deleted
C:\Windows\system32\GroupPolicy\User deleted
C:\Windows\system32\GroupPolicy\gpt.ini deleted
C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Pro files\hnnfnerz.default\pandasecuritytb deleted
C:\Users\psimoes\AppData\Roaming\Mozilla\Firefox\P rofiles\9yk1vrhk.default\pandasecuritytb deleted
C:\Users\torrents\AppData\Roaming\Mozilla\Firefox\ Profiles\z9ph3vjm.default\pandasecuritytb deleted
“C:\Users\psimoes\AppData\Roaming\Mozilla\Firefox\ Profiles\9yk1vrhk.default\searchplugins\yahoo-avast.xml” deleted
“C:\Users\psimoes\AppData\Roaming\Mozilla\Firefox\ Profiles\9yk1vrhk.default\searchplugins\yahoo-avast.xml” deleted

==== Firefox Extensions ======================

ProfilePath: C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Pro files\hnnfnerz.default

Undetermined - C:\Program Files\Mozilla Firefox\extensions{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
Undetermined - C:\Program Files\Mozilla Firefox\extensions{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
Undetermined - C:\Program Files\Mozilla Firefox\extensions{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
Undetermined - C:\Program Files\Mozilla Firefox\extensions{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
Microsoft .NET Framework Assistant - %ProfilePath%\extensions{20a82645-c095-46ed-80e3-08825760534b}
Panda Security Toolbar - %ProfilePath%\extensions{B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4}.xpi

ProfilePath: C:\Users\psimoes\AppData\Roaming\Mozilla\Firefox\P rofiles\9yk1vrhk.default

Firefox Hotfix - %ProfilePath%\extensions\firefox-hotfix@mozilla.org.xpi
Panda Security Toolbar - %ProfilePath%\extensions{B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4}.xpi

ProfilePath: C:\Users\torrents\AppData\Roaming\Mozilla\Firefox\ Profiles\z9ph3vjm.default

Microsoft .NET Framework Assistant - %ProfilePath%\extensions{20a82645-c095-46ed-80e3-08825760534b}.xpi
Panda Security Toolbar - %ProfilePath%\extensions{B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4}.xpi

AppDir: C:\Program Files\Mozilla Firefox

Undetermined - %AppDir%\browser\extensions{972ce4c6-7e08-4474-a285-3208198ce6fd}.xpi

==== Firefox Plugins ======================

Profilepath: C:\Users\psimoes\AppData\Roaming\Mozilla\Firefox\P rofiles\9yk1vrhk.default
F169116C1BA501AB4D0D66D41FF496B5 - C:\Program Files\Adobe\Reader 10.0\Reader\browser\nppdf32.dll - Adobe Acrobat
FC5D7AF1FC3A63782E19B375E2312D1C - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll - Adobe Acrobat
3EE8AE0ECFE5D79DE1737A855AD1E84C - C:\Program Files\Google\Update\1.3.31.5\npGoogleUpdate3.dll - Google Update
AB87EEFFD18F2BAAFC274E7075EA6C67 - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll - Windows Presentation Foundation / Windows Presentation Foundation
A5C14075B571AF1C9592595BE724D9D2 - C:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll - Silverlight Plug-In
14D06C3796CE3F6BA8F43CDF3AD65D76 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll - Java™ Platform SE 7 U67
0A6E5E3BEF374AA2F47071E7374EAD7B - C:\Program Files\Java\jre7\bin\dtplugin\npdeployJava1.dll - Java Deployment Toolkit 7.0.670.1
5B4DA1113F240C3F06FFF9D52761528B - C:\Program Files\Google\Picasa3\npPicasa3.dll - Picasa
2658CE01D183BC62E7C46A1C9969632E - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll - iTunes Application Detector
83FCFA3C1E0D7523C21CCFBF336D2687 - C:\Windows\system32\Macromed\Flash\NPSWF32_23_0_0_ 207.dll - Shockwave Flash
3EE8AE0ECFE5D79DE1737A855AD1E84C - C:\Users\psimoes\AppData\Local\Google\Update\1.3.3 1.5\npGoogleUpdate3.dll - Google Update
3CD19649B2C3023D65E67C056457A2BC - C:\Users\psimoes\AppData\Local\Facebook\Video\Skyp e\npFacebookVideoCalling.dll - Facebook Video Calling Plugin
E3B4EA121F7BDEB0F6366E2BA9608CB5 - C:\Users\psimoes\AppData\Local\Citrix\Plugins\104\ npappdetector.dll - Citrix Online Web Deployment Plugin 1.0.0.104
5E8CA71295BD5C4EACC805FDAACAF5AF - C:\Users\psimoes\AppData\Roaming\Mozilla\plugins\n patgpc.dll - ActiveTouch General Plugin Container
20FF20FBC1F20ADEC0AD6AF98ABE9545 - C:\Users\psimoes\AppData\Roaming\Mozilla\plugins\n pgoogletalk.dll - Google Talk Plugin
57D28190C994AD5E9B1007FB2259393A - C:\Users\psimoes\AppData\Roaming\Mozilla\plugins\n po1d.dll - Google Talk Plugin Video Renderer
2AA3703D87E1327A2290C9D416D89A28 - C:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrlui.dll - Microsoft® Silverlight

==== Chromium Look ======================

Google Chrome Version: 46.0.2490.86

HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensio ns
fagakgcelolinfnkfgekcnedpaklfcok - No path found

Google Voice Search Hotword (Beta) - psimoes\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmn hjmhfn
StartPage Search Engine - psimoes\AppData\Local\Google\Chrome\User Data\Default\Extensions\choepknhbopmendmnohbaemeae emnaom
Thesaurus.com - Synonyms and Antonyms - psimoes\AppData\Local\Google\Chrome\User Data\Default\Extensions\clljlcapeomdokpgadmegpabak ieebci
Learn Italian - psimoes\AppData\Local\Google\Chrome\User Data\Default\Extensions\dadgddaepklpemjojmnhgdjmmk mefihe
Trading Dashboard to Fructify your Money - psimoes\AppData\Local\Google\Chrome\User Data\Default\Extensions\egfjlnahigndmbebpdhnnkcfna hhhglp
Zoho Invoice and Time Tracking - psimoes\AppData\Local\Google\Chrome\User Data\Default\Extensions\ehmnelfmlmpladgddfgghoaigj hfkhdj
Learn Portuguese - psimoes\AppData\Local\Google\Chrome\User Data\Default\Extensions\iaichpenkdlohcjgagagapnegb jmfnfh
Yesware Reports - psimoes\AppData\Local\Google\Chrome\User Data\Default\Extensions\kiciehannidbjakcefendokamk jnolhg
Boomerang for Gmail - psimoes\AppData\Local\Google\Chrome\User Data\Default\Extensions\mdanidgdpmkimeiiojknlnekbl gmpdll
Vend - psimoes\AppData\Local\Google\Chrome\User Data\Default\Extensions\meddmiakkfjlledfhjljjjdeba jikafa
Learn Spanish - psimoes\AppData\Local\Google\Chrome\User Data\Default\Extensions\pmcdjmebmeoobmdghjbjhbifoo cbcmaj

==== Chromium Startpages ======================

C:\Users\psimoes\AppData\Roaming\Opera Software\Opera Stable\Preferences
“startup_urls”: [ " https://www.google.fr/ " ],

==== Chromium Fix ======================

C:\Users\psimoes\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_c.betrad.com_0.localstorage deleted successfully
C:\Users\psimoes\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_c.betrad.com_0.localstorage-journal deleted successfully

==== Set IE to Default ======================

Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
“Search Bar”=" Upgrade to Google Chrome "
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AboutURLs]
“Tabs”=“res://ieframe.dll/tabswelcome.htm”

New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
“Start Page”=" MSN "
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
“Search Bar”=" Search - Microsoft Bing "
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AboutURLs]
“Tabs”=“about:newtab”

==== All HKLM and HKCU SearchScopes ======================

HKLM\SearchScopes “DefaultScope”=“{67C334C0-408D-4E6D-B5A7-0ADD6AFFA252}”
HKLM\SearchScopes{67C334C0-408D-4E6D-B5A7-0ADD6AFFA252} - Google {searchTerms}&sourceid=ie7&rls=com.microsoft:{lang uage}:{referrer:source}&ie={inputEncoding?}&oe={ou tputEncoding?}
HKCU\SearchScopes “DefaultScope”=“{67C334C0-408D-4E6D-B5A7-0ADD6AFFA252}”
HKCU\SearchScopes{012E1000-F331-11DB-8314-0800200C9A66} - Google {searchTerms}
HKCU\SearchScopes{67C334C0-408D-4E6D-B5A7-0ADD6AFFA252} - Google {searchTerms}&sourceid=ie7&rls=com.microsoft:{lang uage}:{referrer:source}&ie={inputEncoding?}&oe={ou tputEncoding?}&rlz=1I7GGLL_en

==== Deleting CLSID Registry Keys ======================

HKEY_USERS\S-1-5-21-3399307451-3074549587-1771456082-1000\Software\Microsoft\Windows\CurrentVersion\Ext \Stats{B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4} deleted successfully
HKEY_USERS\S-1-5-21-3399307451-3074549587-1771456082-1000\Software\Microsoft\Windows\CurrentVersion\Ext \Settings{B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4} deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy{B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4} deleted successfully
HKEY_CLASSES_ROOT\CLSID{B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4} deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Explorer\Browser Helper Objects{B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4} deleted successfully

==== Deleting CLSID Registry Values ======================

HKEY_USERS\S-1-5-21-3399307451-3074549587-1771456082-1000\Software\Microsoft\Internet Explorer\URLSearchHooks{B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4} deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar{B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4} deleted successfully

==== Deleting Registry Keys ======================

HKEY_CURRENT_USER\Software\Policies\Google deleted successfully
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task deleted successfully

==== Empty IE Cache ======================

C:\Users\psimoes\AppData\Local\Microsoft\Windows\T emporary Internet Files\Low\Content.IE5 emptied successfully
C:\Users\psimoes\AppData\Local\temp\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\psimoes\AppData\Local\temp(49)\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\AppData\L ocal\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\AppData\L ocal\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\AppData\L ocal\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\AppData\L ocal\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\AppData\L ocal\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\AppData\L ocal\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\AppData\L ocal\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\AppData\L ocal\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\AppData\L ocal\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\AppData\L ocal\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\AppData\L ocal\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\AppData\L ocal\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\AppData\L ocal\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\AppData\L ocal\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\AppData\L ocal\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\AppData\L ocal\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\AppData\L ocal\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\AppData\L ocal\Application Data\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\AppData\L ocal\Application Data\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\AppData\L ocal\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\AppData\L ocal\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\Local Settings\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\Local Settings\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\Local Settings\Application Data\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\Local Settings\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\networkservice\AppData\ Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Lo cal\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Lo cal\Temp\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\AppData\L ocal\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\AppData\L ocal\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\AppData\L ocal\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\AppData\L ocal\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\AppData\L ocal\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\AppData\L ocal\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\AppData\L ocal\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\AppData\L ocal\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\AppData\L ocal\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\AppData\L ocal\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\AppData\L ocal\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\AppData\L ocal\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\AppData\L ocal\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\AppData\L ocal\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\AppData\L ocal\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\AppData\L ocal\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\AppData\L ocal\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\AppData\L ocal\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\AppData\L ocal\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\AppData\L ocal\Application Data\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\AppData\L ocal\Application Data\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\AppData\L ocal\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\AppData\L ocal\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\Local Settings\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\Local Settings\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\Local Settings\Application Data\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\Local Settings\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Users\psimoes\AppData\Local\Microsoft\Windows\T emporary Internet Files\Content.IE5\index.dat will be deleted at reboot
C:\Windows\system32\config\systemprofile\AppData\L ocal\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
C:\Windows\system32\config\systemprofile\AppData\L ocal\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\desktop.ini will be deleted at reboot
C:\Windows\system32\config\systemprofile\AppData\L ocal\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\index.dat will be deleted at reboot
C:\Windows\system32\config\systemprofile\AppData\L ocal\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
C:\Windows\system32\config\systemprofile\AppData\L ocal\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\desktop.ini will be deleted at reboot
C:\Windows\system32\config\systemprofile\AppData\L ocal\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\index.dat will be deleted at reboot
C:\Windows\system32\config\systemprofile\AppData\L ocal\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
C:\Windows\system32\config\systemprofile\AppData\L ocal\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
C:\Windows\system32\config\systemprofile\AppData\L ocal\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
C:\Windows\system32\config\systemprofile\AppData\L ocal\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
C:\Windows\system32\config\systemprofile\AppData\L ocal\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
C:\Windows\system32\config\systemprofile\AppData\L ocal\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
C:\Windows\system32\config\systemprofile\AppData\L ocal\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
C:\Windows\system32\config\systemprofile\AppData\L ocal\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
C:\Windows\system32\config\systemprofile\AppData\L ocal\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
C:\Windows\system32\config\systemprofile\AppData\L ocal\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
C:\Windows\system32\config\systemprofile\AppData\L ocal\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
C:\Windows\system32\config\systemprofile\AppData\L ocal\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
C:\Windows\system32\config\systemprofile\AppData\L ocal\Application Data\Application Data\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
C:\Windows\system32\config\systemprofile\AppData\L ocal\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
C:\Windows\system32\config\systemprofile\AppData\L ocal\Application Data\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
C:\Windows\system32\config\systemprofile\AppData\L ocal\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
C:\Windows\system32\config\systemprofile\AppData\L ocal\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
C:\Windows\system32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
C:\Windows\system32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
C:\Windows\system32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
C:\Windows\system32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
C:\Windows\system32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
C:\Windows\system32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
C:\Windows\system32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
C:\Windows\system32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
C:\Windows\system32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
C:\Windows\system32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
C:\Windows\system32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
C:\Windows\system32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
C:\Windows\system32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
C:\Windows\system32\config\systemprofile\Local Settings\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
C:\Windows\system32\config\systemprofile\Local Settings\Application Data\Application Data\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
C:\Windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
C:\Windows\system32\config\systemprofile\Local Settings\Application Data\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
C:\Windows\system32\config\systemprofile\Local Settings\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
C:\Windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
C:\Windows\system32\config\systemprofile\AppData\L ocal\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
C:\Windows\system32\config\systemprofile\AppData\L ocal\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
C:\Windows\system32\config\systemprofile\AppData\L ocal\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
C:\Windows\system32\config\systemprofile\AppData\L ocal\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
C:\Windows\system32\config\systemprofile\AppData\L ocal\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
C:\Windows\system32\config\systemprofile\AppData\L ocal\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
C:\Windows\system32\config\systemprofile\AppData\L ocal\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
C:\Windows\system32\config\systemprofile\AppData\L ocal\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
C:\Windows\system32\config\systemprofile\AppData\L ocal\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
C:\Windows\system32\config\systemprofile\AppData\L ocal\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
C:\Windows\system32\config\systemprofile\AppData\L ocal\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
C:\Windows\system32\config\systemprofile\AppData\L ocal\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
C:\Windows\system32\config\systemprofile\AppData\L ocal\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
C:\Windows\system32\config\systemprofile\AppData\L ocal\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
C:\Windows\system32\config\systemprofile\AppData\L ocal\Application Data\Application Data\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
C:\Windows\system32\config\systemprofile\AppData\L ocal\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
C:\Windows\system32\config\systemprofile\AppData\L ocal\Application Data\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
C:\Windows\system32\config\systemprofile\AppData\L ocal\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
C:\Windows\system32\config\systemprofile\AppData\L ocal\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
C:\Windows\system32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
C:\Windows\system32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
C:\Windows\system32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
C:\Windows\system32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
C:\Windows\system32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
C:\Windows\system32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
C:\Windows\system32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
C:\Windows\system32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
C:\Windows\system32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
C:\Windows\system32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
C:\Windows\system32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
C:\Windows\system32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
C:\Windows\system32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
C:\Windows\system32\config\systemprofile\Local Settings\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
C:\Windows\system32\config\systemprofile\Local Settings\Application Data\Application Data\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
C:\Windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
C:\Windows\system32\config\systemprofile\Local Settings\Application Data\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
C:\Windows\system32\config\systemprofile\Local Settings\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
C:\Windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot

==== Empty FireFox Cache ======================

C:\Users\psimoes\AppData\Local\Mozilla\Firefox\Pro files\9yk1vrhk.default\cache2 emptied successfully

==== Empty Chrome Cache ======================

C:\Users\psimoes\AppData\Local\Opera Software\Opera Stable\Cache emptied successfully
C:\Users\psimoes\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully

==== Empty All Flash Cache ======================

Flash Cache Emptied Successfully

==== Empty All Java Cache ======================

Java Cache cleared successfully

==== C:\zoek_backup content ======================

C:\zoek_backup (files=4040 folders=64 41490763 bytes)

==== Empty Temp Folders ======================

C:\Users\Default\AppData\Local\temp emptied successfully
C:\Users\Default User\AppData\Local\temp emptied successfully
C:\Users\Guest\AppData\Local\temp emptied successfully
C:\Users\psimoes\AppData\Local\temp will be emptied at reboot
C:\Users\Public\AppData\Local\temp emptied successfully
C:\Users\torrents\AppData\Local\temp emptied successfully
C:\Windows\serviceprofiles\networkservice\AppData\ Local\Temp emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Lo cal\Temp emptied successfully
C:\Windows\Temp will be emptied at reboot

**jmarket** · 11-14-2016, 10:45 PM

I will have @Malnutrition and @DonnaB analyze your FRST log. In the meantime, how is your system running right now?

**jmarket** · 11-14-2016, 11:25 PM

I see some concerns in your log file regarding adware.

We will need a log from AdwCleaner for further information.

Please download a copy of AdwCleaner from HERE, it is important to download it to your desktop.

Once downloaded to the desktop AdwCleaner will create an icon [ATTACH]828[/ATTACH]
Should you receive any security warnings or your User Account Control warning appears whilst you are using this application you can safely allow AdwCleaner to continue.

Before running AdwCleaner please ensure all other programs and browsers are closed, then double left click the icon to open it.

AdwCleaner will open, click the scan button to start searching.

[ATTACH]829[/ATTACH]

The scan may take some time to complete, and when it has any malware found will be automatically selected for quarantining. Click the “Cleaning” button.

[ATTACH]830[/ATTACH]

After a few seconds a message should tell you your computer will now reboot. Allow the reboot.

When the computer restarts a log file will be displayed, but if its closed for any reason before copying the contents, you will find a copy of the file if you navigate to C:\AdwCleaner[s#].txt

[ATTACH]831[/ATTACH]

Please Copy and Paste the contents of the log file with your next reply.

**paulwb** · 11-14-2016, 11:27 PM

Originally posted by jmarket

I will have @Malnutrition analyze your FRST log. In the meantime, how is your system running right now?

Thank you.
I’ve opened all browsers and various websites, none have crashed so far.
However, pages load slow, as if struggling with graphics content. PC boot time is also much slower.

**paulwb** · 11-15-2016, 12:37 AM

Here are the AdwCleaner log files C3 & S3 …
[HEADING=1]AdwCleaner v6.030 - Logfile created 14/11/2016 at 19:13:34[/HEADING]
[HEADING=1]Updated on 19/10/2016 by Malwarebytes[/HEADING]
[HEADING=1]Database : 2016-11-14.1 [Server][/HEADING]
[HEADING=1]Operating System : Windows Vista ™ Home Premium Service Pack 2 (X86)[/HEADING]
[HEADING=1]Username : psimoes - PS-TOSHIBA[/HEADING]
[HEADING=1]Running from : C:\Users\psimoes\Desktop\adwcleaner_6.030.exe[/HEADING]
[HEADING=1]Mode: Clean[/HEADING]
[HEADING=1]Support : hxxps://www.malwarebytes.com/support[/HEADING]
***** [ Services ] *****

***** [ Folders ] *****

[-] Folder deleted: C:\Users\psimoes\AppData\Local\Google\Chrome\User Data\Default\Extensions\oadboiipflhobonjjffjbfekfj cgkhco

***** [ Files ] *****

[-] File deleted: C:\Users\psimoes\AppData\Roaming\Mozilla\Firefox\P rofiles\9yk1vrhk.default\extensions{B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4}.xpi
[-] File deleted: C:\Users\torrents\AppData\Roaming\Mozilla\Firefox\ Profiles\z9ph3vjm.default\extensions{B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4}.xpi
[-] File deleted: C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Pro files\hnnfnerz.default\extensions{B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4}.xpi

***** [ DLL ] *****

***** [ WMI ] *****

***** [ Shortcuts ] *****

***** [ Scheduled Tasks ] *****

***** [ Registry ] *****

[-] Key deleted: HKLM\SOFTWARE\Classes\PCSuiteContactsView
[-] Key deleted: HKLM\SOFTWARE\Classes\PCSuiteMessagesView
[-] Key deleted: HKLM\SOFTWARE\Classes\protector_dll.Protector
[-] Key deleted: HKLM\SOFTWARE\Classes\protector_dll.Protector.1
[-] Key deleted: HKLM\SOFTWARE\Classes\protector_dll.ProtectorLib
[-] Key deleted: HKLM\SOFTWARE\Classes\protector_dll.ProtectorLib.1

***** [ Web browsers ] *****

[-] Chrome preferences cleaned: “extensions.wrc.SearchRules.rambler.ru.url” - “^hxxp\:\/\/nova\.rambler\.ru\/.+”
[-] [C:\Users\psimoes\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Deleted: www.yahoo.com
[-] [C:\Users\psimoes\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Deleted: ask.com
[-] [C:\Users\psimoes\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Deleted: pricegrabber.com
[-] [C:\Users\psimoes\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Deleted: fido.ca
[-] [C:\Users\psimoes\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Deleted: okayfreedom.en.softonic.com
[-] [C:\Users\psimoes\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Deleted: debut-video-capture.en.softonic.com
[-] [C:\Users\psimoes\AppData\Local\Google\Chrome\User Data\Default] [extension] Deleted: oadboiipflhobonjjffjbfekfjcgkhco

:: “Tracing” keys deleted
:: Winsock settings cleared

C:\AdwCleaner\AdwCleaner[C2].txt - [1330 Bytes] - [30/08/2015 17:02:57]
C:\AdwCleaner\AdwCleaner[C3].txt - [2808 Bytes] - [14/11/2016 19:13:34]
C:\AdwCleaner\AdwCleaner[R0].txt - [2362 Bytes] - [07/06/2015 17:30:00]
C:\AdwCleaner\AdwCleaner[S0].txt - [2470 Bytes] - [07/06/2015 17:45:56]
C:\AdwCleaner\AdwCleaner[S2].txt - [14422 Bytes] - [30/08/2015 16:51:48]
C:\AdwCleaner\AdwCleaner[S3].txt - [3218 Bytes] - [14/11/2016 18:41:11]

########## EOF - C:\AdwCleaner\AdwCleaner[C3].txt - [3174 Bytes] ##########
[HEADING=1]AdwCleaner v6.030 - Logfile created 14/11/2016 at 18:41:11[/HEADING]
[HEADING=1]Updated on 19/10/2016 by Malwarebytes[/HEADING]
[HEADING=1]Database : 2016-11-14.1 [Server][/HEADING]
[HEADING=1]Operating System : Windows Vista ™ Home Premium Service Pack 2 (X86)[/HEADING]
[HEADING=1]Username : psimoes - PS-TOSHIBA[/HEADING]
[HEADING=1]Running from : C:\Users\psimoes\Desktop\adwcleaner_6.030.exe[/HEADING]
[HEADING=1]Mode: Scan[/HEADING]
[HEADING=1]Support : https://www.malwarebytes.com/support[/HEADING]
***** [ Services ] *****

No malicious services found.
***** [ Folders ] *****

Folder Found: C:\Users\psimoes\AppData\Local\Google\Chrome\User Data\Default\Extensions\oadboiipflhobonjjffjbfekfj cgkhco

***** [ Files ] *****

File Found: C:\Users\psimoes\AppData\Roaming\Mozilla\Firefox\P rofiles\9yk1vrhk.default\extensions{B821BF60-5C2D-41EB-92DC-

3E4CCD3A22E4}.xpi
File Found: C:\Users\torrents\AppData\Roaming\Mozilla\Firefox\ Profiles\z9ph3vjm.default\extensions{B821BF60-5C2D-41EB-92DC-

3E4CCD3A22E4}.xpi
File Found: C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Pro files\hnnfnerz.default\extensions{B821BF60-5C2D-41EB-92DC-

3E4CCD3A22E4}.xpi

***** [ DLL ] *****

No malicious DLLs found.

***** [ WMI ] *****

No malicious keys found.

***** [ Shortcuts ] *****

No infected shortcut found.

***** [ Scheduled Tasks ] *****

No malicious task found.

***** [ Registry ] *****

Key Found: HKLM\SOFTWARE\Classes\PCSuiteContactsView
Key Found: HKLM\SOFTWARE\Classes\PCSuiteMessagesView
Key Found: HKLM\SOFTWARE\Classes\protector_dll.Protector
Key Found: HKLM\SOFTWARE\Classes\protector_dll.Protector.1
Key Found: HKLM\SOFTWARE\Classes\protector_dll.ProtectorLib
Key Found: HKLM\SOFTWARE\Classes\protector_dll.ProtectorLib.1

***** [ Web browsers ] *****

Firefox pref Found: [C:\Users\torrents\AppData\Roaming\Mozilla\Firefox\ Profiles\z9ph3vjm.default\prefs.js] -

“extensions.wrc.SearchRules.rambler.ru.url” - “^hxxp\:\/\/nova\.rambler\.ru\/.+”
Chrome pref Found: [C:\Users\psimoes\AppData\Local\Google\Chrome\User Data\Default\Web data] - www.yahoo.com
Chrome pref Found: [C:\Users\psimoes\AppData\Local\Google\Chrome\User Data\Default\Web data] - ask.com
Chrome pref Found: [C:\Users\psimoes\AppData\Local\Google\Chrome\User Data\Default\Web data] - pricegrabber.com
Chrome pref Found: [C:\Users\psimoes\AppData\Local\Google\Chrome\User Data\Default\Web data] - fido.ca
Chrome pref Found: [C:\Users\psimoes\AppData\Local\Google\Chrome\User Data\Default\Web data] - okayfreedom.en.softonic.com
Chrome pref Found: [C:\Users\psimoes\AppData\Local\Google\Chrome\User Data\Default\Web data] - debut-video-capture.en.softonic.com
Chrome pref Found: [C:\Users\psimoes\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences ] - oadboiipflhobonjjffjbfekfjcgkhco

C:\AdwCleaner\AdwCleaner[C2].txt - [1330 Bytes] - [30/08/2015 17:02:57]
C:\AdwCleaner\AdwCleaner[R0].txt - [2362 Bytes] - [07/06/2015 17:30:00]
C:\AdwCleaner\AdwCleaner[S0].txt - [2470 Bytes] - [07/06/2015 17:45:56]
C:\AdwCleaner\AdwCleaner[S2].txt - [14422 Bytes] - [30/08/2015 16:51:48]
C:\AdwCleaner\AdwCleaner[S3].txt - [3066 Bytes] - [14/11/2016 18:41:11]

########## EOF - C:\AdwCleaner\AdwCleaner[S3].txt - [3139 Bytes] ##########

**jmarket** · 11-15-2016, 01:26 AM

Reboot your computer and see if it pages render faster now Sometimes it may take another reboot for the cache to rebuild. That’s probably why you’re experiencing slowness.

**paulwb** · 11-15-2016, 02:19 AM

It’s a little better. From start up to the login screen ~ 3m 15s, from login to desktop icons appearing etc ~ 2m.

Several of the detected files found in the ZHP scan ( 33 found in total ) also appeared in the AdwCleaner scan run aftwards, 18 bugs found. So the ZHP repair did not work completely. It ran quite slowly during the repair phase and appeared to be “fighting” another process.

I don’t think the malware is completely gone… maybe run AdwCleaner again, but in Safe Mode?
What do you recommend?

**jmarket** · 11-15-2016, 02:35 PM

Go ahead and run Adwcleaner again and post its log files

**paulwb** · 11-15-2016, 03:22 PM

OK, here they are… the files in the Web Browsers section were previously deleted but are showing up again.
[HEADING=1]AdwCleaner v6.030 - Logfile created 15/11/2016 at 09:59:13[/HEADING]
[HEADING=1]Updated on 19/10/2016 by Malwarebytes[/HEADING]
[HEADING=1]Database : 2016-11-15.1 [Server][/HEADING]
[HEADING=1]Operating System : Windows Vista ™ Home Premium Service Pack 2 (X86)[/HEADING]
[HEADING=1]Username : psimoes - PS-TOSHIBA[/HEADING]
[HEADING=1]Running from : C:\Users\psimoes\Desktop\adwcleaner_6.030.exe[/HEADING]
[HEADING=1]Mode: Clean[/HEADING]
[HEADING=1]Support : hxxps://www.malwarebytes.com/support[/HEADING]
***** [ Services ] *****

***** [ Folders ] *****

***** [ Files ] *****

***** [ DLL ] *****

***** [ WMI ] *****

***** [ Shortcuts ] *****

***** [ Scheduled Tasks ] *****

***** [ Registry ] *****

***** [ Web browsers ] *****

[-] [C:\Users\psimoes\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Deleted: pricegrabber.com
[-] [C:\Users\psimoes\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Deleted: fido.ca
[-] [C:\Users\psimoes\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Deleted: www.yahoo.com
[-] [C:\Users\psimoes\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Deleted: ask.com
[-] [C:\Users\psimoes\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Deleted: okayfreedom.en.softonic.com
[-] [C:\Users\psimoes\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Deleted: debut-video-capture.en.softonic.com
[-] [C:\Users\psimoes\AppData\Local\Google\Chrome\User Data\Default] [extension] Deleted: oadboiipflhobonjjffjbfekfjcgkhco

:: “Tracing” keys deleted
:: Winsock settings cleared

C:\AdwCleaner\AdwCleaner[C2].txt - [1330 Bytes] - [30/08/2015 17:02:57]
C:\AdwCleaner\AdwCleaner[C3].txt - [3253 Bytes] - [14/11/2016 19:13:34]
C:\AdwCleaner\AdwCleaner[C4].txt - [1803 Bytes] - [15/11/2016 09:59:13]
C:\AdwCleaner\AdwCleaner[R0].txt - [2362 Bytes] - [07/06/2015 17:30:00]
C:\AdwCleaner\AdwCleaner[S0].txt - [2470 Bytes] - [07/06/2015 17:45:56]
C:\AdwCleaner\AdwCleaner[S2].txt - [14422 Bytes] - [30/08/2015 16:51:48]
C:\AdwCleaner\AdwCleaner[S3].txt - [3218 Bytes] - [14/11/2016 18:41:11]
C:\AdwCleaner\AdwCleaner[S4].txt - [2401 Bytes] - [15/11/2016 09:57:13]

########## EOF - C:\AdwCleaner\AdwCleaner[C4].txt - [2242 Bytes] ##########

**jmarket** · 11-15-2016, 06:41 PM

To eliminate any further malware, please do the following:

Please download the free trial of Zemana HERE. Save it to somewhere you can find, double click the downloaded file and start the installation. Accept the default install options and you can safely ignore any security warnings and allow Accept the default install options and you can safely ignore any security warnings and allow Zemana to complete the install. Once completed click the new desktop icon [ATTACH]786[/ATTACH] to open the program. If Zemana opens and informs of any available updates allow it to so. Next change Zemana’s default from “Smart Scan” to Deep Scan as shown below.

[ATTACH]780[/ATTACH]

Then click scan

[ATTACH]782[/ATTACH]

When the scan is complete allow Zemana to Quarantine any infections found by clicking Next

[ATTACH]783[/ATTACH]

Once the infections are quarantined a message box will indicate success, then click the logs icon as below.

[ATTACH]784[/ATTACH]

Select the latest scan and choose Open Report from the upper menu. or simply double left click on the scan just run.

[ATTACH]785[/ATTACH]

The log will open as a text file. Please Copy and Paste the contents of that file in your next post

We need you to run Malwarebytes Anti-Malware (MBAM) to get a log. Please download the free version of Malwarebytes HERE

Save the file to somewhere you can easily find it. Double click the saved file to start the install, accept any security warnings that may appear and after the install click the new desktop icon [ATTACH]787[/ATTACH] to start the program. We need to modify a couple of things with MalwareBytes before we use it so please follow the steps below.

[ul]
[li]If the dashboard is not already displayed select it.[/li][/ul]
[ul]
[li]Then select Update to get the latest definition database.[/li][/ul]
[ATTACH]788[/ATTACH]

[ul]
[li]Next we need to change a scanning option, select Settings on the main menu[/li][/ul]
[ul]
[li]Then Detection and Protection on the left.[/li][/ul]
[ul]
[li]Then select Scan for rootkits in the detection options, as well as the other two options already checked.[/li][/ul]
[ATTACH]789[/ATTACH]

Now return to Dashboard on the main menu and select Scan Now at the bottom of the screen.

[ATTACH]790[/ATTACH]

[ul]
[li]Allow Malwarebytes to scan your system. It may take some time depending on how much data loaded onto your hard drive. When the scan is finished any threats will be listed for action. Ensure all threats are selected, and click Remove Selected[/li][/ul]

[ATTACH]791[/ATTACH]

A dialogue box may open and ask to restart the computer, if so select Yes

[ATTACH]792[/ATTACH]

Once the computer restarts open Malwarebytes again and select History on the menu bar, Application logs, then click the scan just completed, then click Export, choose text file. Name the text file and select a location, preferably the desktop and close Malwarebytes.

[ATTACH]793[/ATTACH]

Please copy and paste the contents of the text file in your next post

**paulwb** · 11-15-2016, 07:44 PM

Hi jmarket,
All of the images you posted are broken and not being displayed.
How do you switch from Smart Scan to Deep Scan in Zemana? i’ve checked all over and don’t see the option.
Did a quick search online & ver 2.15 shows the option to select Smart or Deep Scan on the lower right hand side of screen just above the Scan button.

i’m running the Smart Scan now… Zemana ver 2.60.189.1

Browsers Crash, Executable files stall or crash

Browsers Crash, Executable files stall or crash

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment