Please Help get rid of totaladperformance & tradeadexchange in Chr

This was the report from Rkill from a few days ago.  When I tried to fix it

Just a follow up.  I am still testing this out.  So far it hasn't reoccurred.  I will slowly begin to add back a few of my extensions to see if they are corrupt.

Encouraging so far then.

Once you are happy, we should run an on line anti-virus scan to make sure we haven't missed any bits and pieces. I will give you some instructions for that.

Finally, all going well, we will remove the tools we have been using.

Ok this is what I can figure out for the most part.  I started to get the same error again.  But what I did was install the 3 extensions.  Out of the 3 extensions, I'm not sure which one is the culprit.

Adblock Plus 1.9.1

Video Downloader 1.0.4.8

Video Downloader Super 6.2.0

When I unstalled them and reset Chrome.  The redirect errors stop.  It has been 36 hours with no redirects.

I would replace Adblock Plus with this:

Download Adblock edge to prevent unwanted pop up adds. This one doesn't have sponsored adds whitelisted.

Adblock Plus has sponsored adds nowadays.

As far as the other two are concerned there are a number of Video Downloader ones that are bad. AdwCleaner usually picks them up but not always. Really a matter of testing them.

Also, when you get a moment it might be worth running another scan with FRST. Check the Addition.txt box and post back the two logs generated. FRST.txt and Addition.txt.

I will have a look and see if anything else jumps out at me.

I will re-run all tests today and post outcomes.  Thank you for the patience.

Look forward to hearing from you.

Hello again Matt M11,

Looks like you have had a ZeroAccess infection at some point. There are remnants there but I don't see the active files.

Perhaps ComboFix removed it.

Moving on

Please uninstall the following adware/tracking/malware programs:

Splashtop Streamer
Splashtop Software Updater
Advanced SystemCare 8

And
Consider uninstalling the following if they are the free version as they come bundled with adware:

IObit Malware Fighter 3
IObit Uninstaller

After that

Open notepad.

Please copy the contents of the code box below.

To do this highlight (click in the box and press Ctrl + A) the contents of the box and right click on it. Paste this into the open notepad. Save it to the Desktop as fixlist.txt.

Alternatively type the contents of the box into notepad and save it to your desktop as fixlist.txt.

NOTE. It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work.
 

C:\Users\Matts Windows7\AppData\Local\{98a3383a-d721-6367-f3cf-6c5bf885b02d}
C:\Users\Matts Windows7\AppData\Local\{98a3383a-d721-6367-f3cf-6c5bf885b02d}\@
HKLM-x32\…\Run: [] => [X]
AppInit_DLLs-x32:  acaptuser32.dll => "acaptuser32.dll" File not found
ShellIconOverlayIdentifiers: [GDriveSharedOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44} =>  No File
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
Toolbar: HKLM - No Name - {9f6b5cc3-5c7b-4b5c-97af-19dec1e380e5} -  No File
Toolbar: HKU\S-1-5-21-3123964009-4157677460-2703354282-1000 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File
FF Extension: Video DownloadHelper - C:\Users\Matts Windows7\AppData\Roaming\Mozilla\Firefox\Profiles\hbgszlrn.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}.xpi [2015-08-23]
FF Extension: Adblock Plus - C:\Users\Matts Windows7\AppData\Roaming\Mozilla\Firefox\Profiles\hbgszlrn.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2015-02-18]
CHR Extension: (Video Downloader) - C:\Users\Matts Windows7\AppData\Local\Google\Chrome\User Data\Default\Extensions\hnmpgleggfcndpeflbjhpjfckfmojnpo [2015-02-10]
S1 SBRE; no ImagePath
Hosts:
Reg: reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
Reg: reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
RemoveProxy:
CMD: bitsadmin /reset /allusers
CMD: ipconfig /flushdns
EmptyTemp:

This script is specifically written for the infection on this person's computer. It should NOT to be used on another machine. It may cause serious damage even to the point of rendering the computer unusable.

Run FRST/FRST64 and press the Fix button just once and wait.
The tool will make a log on the Desktop (Fixlog.txt). Please post it to your reply.

Finally in this post

Please run another FRST scan with the Addition.txt box ticked and post back the two logs generated - FRST.txt and Addition.txt.

So when you return please post

• Fixlog.txt
• FRST.txt
• Addition.txt