What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Help, my desktop if infected! [Solved]

14 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16 last edited

Run this fix and post the log and let me know how your system is behaving now

 

 

Your running FRST64 from your Downloads folder, our tools and scanners work more efficiently when run from the Desktop in lieu of being buried in some folder, so go to your Downloads folder and look for FRST64, right click on it and select CUT, then come back to your Desktop and right click on a blank space and select PASTE, then we will have FRST64 exactly where we want it to be.

 

 

Open notepad , Go to Start –> All Programs –> Accessories –> Notepad.
Please copy the entire contents Inside of the code box below beginning with START and ending with END
(To do this highlight the contents of the box, right click on it and select copy. Right-click in the open notepad and select Paste).
Name the file Fixlist.txt , Save it to your desktop where you have FRST/FRST64 or the fix wont work. Right Click on FRST/FRST64 and select RUN AS ADMINISTRATOR Then click on >FIX< (Not Scan) It won't take long, after your computer reboots you will find a FIXLOG.TXT on your desktop, post it please
 
Start
CloseProcesses:
CreateRestorePoint: 
(Octoshape ApS) C:\Users\saturn89\AppData\Roaming\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe
HKU\S-1-5-21-817363288-272500718-2324346864-1000\…\Run: [Octoshape Streaming Services] => C:\Users\saturn89\AppData\Roaming\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe [500016 2014-08-01] (Octoshape ApS)
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
Winsock: Catalog5 04 C:\WINDOWS\system32\NLAapi.dll [65024 2015-10-30] (Microsoft Corporation) ATTENTION: LibraryPath should be "C:\WINDOWS)\system32\NLAapi.dll"
ManualProxies:
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-817363288-272500718-2324346864-1000 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
FF Plugin HKU\S-1-5-21-817363288-272500718-2324346864-1000: @octoshape.com/Octoshape Streaming Services,version=1.0 -> C:\Users\saturn89\AppData\Roaming\Octoshape\Octoshape Streaming Services\sua-1401100-0-npoctoshape.dll [2014-01-10] (Octoshape ApS)
Task: {099BCFF3-FC03-4A31-B557-8EC54CE75BC3} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> No File <==== ATTENTION
Task: {43F14216-DD7A-41F1-BA79-52BB49C3BFD2} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> No File <==== ATTENTION
Task: {9167EBFD-C120-453E-B5D7-4A2ABCFF258B} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> No File <==== ATTENTION
Task: {98BF98F8-ED4B-48C0-BD1B-F96E6C0A936F} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> No File <==== ATTENTION
Task: {9F256DB5-B508-4906-B569-CA656C2AE747} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> No File <==== ATTENTION
Task: {BC890042-9FBC-4F81-A017-B02E312C64A2} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> No File <==== ATTENTION
Task: {E1C16E16-0B00-4388-9072-B3151EF1B355} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> No File <==== ATTENTION
Task: {EEBC27FB-3026-4CEA-8079-402251BD4154} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> No File <==== ATTENTION
Task: {F38C68B4-65D7-4A61-9434-54C68A9C5B4F} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> No File <==== ATTENTION
Task: {FDDEDF02-6BF8-4A09-9126-4895EB8A49F4} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> No File <==== ATTENTION
IE trusted site: HKU\S-1-5-21-817363288-272500718-2324346864-1000\…\driversupport.com -> hxxp://apps.driversupport.com
IE trusted site: HKU\S-1-5-21-817363288-272500718-2324346864-1000\…\driversupport.com -> hxxps://apps.driversupport.com
FirewallRules: [TCP Query User{D4C76E1E-B5F2-44D0-84F1-76EC194B95E4}C:\users\saturn89\appdata\roaming\octoshape\octoshape streaming services\octoshapeclient.exe] => (Allow) C:\users\saturn89\appdata\roaming\octoshape\octoshape streaming services\octoshapeclient.exe
FirewallRules: [UDP Query User{6CB58E30-A987-40DD-9E7F-2CFAAFABC7AD}C:\users\saturn89\appdata\roaming\octoshape\octoshape streaming services\octoshapeclient.exe] => (Allow) C:\users\saturn89\appdata\roaming\octoshape\octoshape streaming services\octoshapeclient.exe
Hosts:
CMD: ipconfig /flushdns
EmptyTemp:
End
 
NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

 

 
 
Post #17

Well, I'm doing something wrong, not sure what.  I have FRST and Fixlist.txt saved to the desktop.  I right click FRST, then click fix and a screen pops up:

 

No fixlist.txt found.

 

The fixlist.txt should be in the same folder/directory the tool is located.

Post #18 last edited

My bad, I was looking at the original FRST log and not the second one you posted, you have the 32 bit version , so you have FRST and not FRST64. So just delete FRST64 and go into your downloads folder and look for FRST, right click on it and select CUT, come back to your desktop and right click on a blank space and select PASTE . Also make sure you spelled Fixlist correctly and that its Fixlist.txt and not Fixlist.txt.txt. 

 

Also I see it listed in your downloads folder as FRST(1).exe, right click on it and select RENAME and delete (1) so that it just says FRST.exe

Post #19

I tried to rename FRST but it didn't work, not sure why.  I went to the internal folders and found FRST(1) and FRST, tried both but nothing seems to work.  I correctly spelled Fixlist as well so I'm doing something wrong but I'm sure what.  With your help I'll figure it out, and thanks again for your help, it's much appreciated.

Post #20 last edited

Sorry your still having problems, lets do this, first look for either FRST or FRST64 in your Download folder and delete them.  Also delete your copy of FRST on your desktop and also delete Fixlist.

 

Then go here and download a fresh copy of the 32 bit version of FRST, make sure its the 32 bit version and not the 64 bit, download it directly to your desktop. If you cant do that then let it download to your Downloads folder.

 

http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/

 

I am attaching Fixlist for you , download it to wherever you downloaded FRST, hopefully the desktop but if not let it download to your downloads folder , just as long as FRST and Fixlist are in the same place.  Then open FRST by right clicking on it and select RUN AS ADMINISTRATOR, when it opens click on FIX (Not Scan)

Attachments:

Post #21

Still having problems.  BTW, I running window 10, which was upgraded from 7, if that is a variable.  The system will not let me download to the desktop for either file.  FRST is found in the download folder and Fixlist is found in the temp folder: C:\Users\saturn89\AppData\Local\Temp.  I tried moving Fix..to the download folder and got the error message again.  I tried saving both to the desktop and that didn't work either.  I have downloaded and deleted a few times now, still won't work.  Should I empty the recycle bin?

Post #22

Good Morning

 

You can delete the Recycle Bin, thats fine. Before you do delete Fixlist and any copies you have of FRST in any location that there in. Why Fixlist downloaded to a temp directory is strange.  You have Windows 10 but the 32 bit version, the 64 bit version is more efficient but to upgrade to 64 bit would take some work, when where done if you want to do that our windows team can help you.

 

You have Firefox as your default browser, open it and on the top go to Tools > Options and look for where it says to Save Files, click on browse and select your Desktop, then ok your way out. 

 

Then try downloading  a fresh copy of FRST ( remember you need the 32 bit version ) You can go my previous post for the download link and also to download Fixlist. If you changed Firefox correctly they should both download to the desktop. Then give the fix another shot

Post #23

Ha……….success!  It worked!  I see the my error with Fixlist.  When it asked I wanted to do with the file I opened it with Notepad (default), when I should have hit the next button, Save. 

I still see this when I open Firefox for the first time:

 

Index of file:///C:/Program Files/Mozilla Firefox/

I hit the home button and it's back to normal.  I don't know if this is a problem or not but I can live with it.

Post #25

Minor detail………yes I did run the fix and here is the Fixlog:

 

Fix result of Farbar Recovery Scan Tool (x86) Version:18-04-2016
Ran by [removed] (2016-04-24 05:02:44) Run:1
Running from C:\Users\[removed]\Desktop
[removed] Boot Mode: Normal

==============================================

fixlist content:
*****************
Start
CloseProcesses:
CreateRestorePoint:
(Octoshape ApS) C:\Users\saturn89\AppData\Roaming\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe
HKU\S-1-5-21-817363288-272500718-2324346864-1000\…\Run: [Octoshape Streaming Services] => C:\Users\saturn89\AppData\Roaming\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe [500016 2014-08-01] (Octoshape ApS)
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
Winsock: Catalog5 04 C:\WINDOWS\system32\NLAapi.dll [65024 2015-10-30] (Microsoft Corporation) ATTENTION: LibraryPath should be "C:\WINDOWS)\system32\NLAapi.dll"
ManualProxies:
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-817363288-272500718-2324346864-1000 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
FF Plugin HKU\S-1-5-21-817363288-272500718-2324346864-1000: @octoshape.com/Octoshape Streaming Services,version=1.0 -> C:\Users\saturn89\AppData\Roaming\Octoshape\Octoshape Streaming Services\sua-1401100-0-npoctoshape.dll [2014-01-10] (Octoshape ApS)
Task: {099BCFF3-FC03-4A31-B557-8EC54CE75BC3} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> No File <==== ATTENTION
Task: {43F14216-DD7A-41F1-BA79-52BB49C3BFD2} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> No File <==== ATTENTION
Task: {9167EBFD-C120-453E-B5D7-4A2ABCFF258B} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> No File <==== ATTENTION
Task: {98BF98F8-ED4B-48C0-BD1B-F96E6C0A936F} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> No File <==== ATTENTION
Task: {9F256DB5-B508-4906-B569-CA656C2AE747} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> No File <==== ATTENTION
Task: {BC890042-9FBC-4F81-A017-B02E312C64A2} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> No File <==== ATTENTION
Task: {E1C16E16-0B00-4388-9072-B3151EF1B355} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> No File <==== ATTENTION
Task: {EEBC27FB-3026-4CEA-8079-402251BD4154} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> No File <==== ATTENTION
Task: {F38C68B4-65D7-4A61-9434-54C68A9C5B4F} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> No File <==== ATTENTION
Task: {FDDEDF02-6BF8-4A09-9126-4895EB8A49F4} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> No File <==== ATTENTION
IE trusted site: HKU\S-1-5-21-817363288-272500718-2324346864-1000\…\driversupport.com -> hxxp://apps.driversupport.com
IE trusted site: HKU\S-1-5-21-817363288-272500718-2324346864-1000\…\driversupport.com -> hxxps://apps.driversupport.com
FirewallRules: [TCP Query User{D4C76E1E-B5F2-44D0-84F1-76EC194B95E4}C:\users\saturn89\appdata\roaming\octoshape\octoshape streaming services\octoshapeclient.exe] => (Allow) C:\users\saturn89\appdata\roaming\octoshape\octoshape streaming services\octoshapeclient.exe
FirewallRules: [UDP Query User{6CB58E30-A987-40DD-9E7F-2CFAAFABC7AD}C:\users\saturn89\appdata\roaming\octoshape\octoshape streaming services\octoshapeclient.exe] => (Allow) C:\users\saturn89\appdata\roaming\octoshape\octoshape streaming services\octoshapeclient.exe
Hosts:
CMD: ipconfig /flushdns
EmptyTemp:
End
*****************

Processes closed successfully.
Restore point was successfully created.
C:\Users\saturn89\AppData\Roaming\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe
C:\Users\saturn89\AppData\Roaming\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe => No running process found
HKU\S-1-5-21-817363288-272500718-2324346864-1000\Software\Microsoft\Windows\CurrentVersion\Run\\Octoshape Streaming Services => value removed successfully.
"HKLM\SOFTWARE\Policies\Google" => key removed successfully.
Winsock: Catalog5 000000000004\\LibraryPath => restored successfully (%SystemRoot%\system32\NLAapi.dll)
HKLM\SYSTEM\CurrentControlSet\services\NlaSvc\Parameters\Internet\ManualProxies\\ => value removed successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value restored successfully
HKU\S-1-5-21-817363288-272500718-2324346864-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value removed successfully.
"HKU\S-1-5-21-817363288-272500718-2324346864-1000\Software\MozillaPlugins\@octoshape.com/Octoshape Streaming Services,version=1.0" => key removed successfully.
C:\Users\saturn89\AppData\Roaming\Octoshape\Octoshape Streaming Services\sua-1401100-0-npoctoshape.dll => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{099BCFF3-FC03-4A31-B557-8EC54CE75BC3}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{099BCFF3-FC03-4A31-B557-8EC54CE75BC3}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{43F14216-DD7A-41F1-BA79-52BB49C3BFD2}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{43F14216-DD7A-41F1-BA79-52BB49C3BFD2}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\gwx\launchtrayprocess" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{9167EBFD-C120-453E-B5D7-4A2ABCFF258B}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{9167EBFD-C120-453E-B5D7-4A2ABCFF258B}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{98BF98F8-ED4B-48C0-BD1B-F96E6C0A936F}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{98BF98F8-ED4B-48C0-BD1B-F96E6C0A936F}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\gwx\refreshgwxconfig" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{9F256DB5-B508-4906-B569-CA656C2AE747}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{9F256DB5-B508-4906-B569-CA656C2AE747}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\Time-5d" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{BC890042-9FBC-4F81-A017-B02E312C64A2}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{BC890042-9FBC-4F81-A017-B02E312C64A2}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{E1C16E16-0B00-4388-9072-B3151EF1B355}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{E1C16E16-0B00-4388-9072-B3151EF1B355}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\gwx\refreshgwxcontent" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{EEBC27FB-3026-4CEA-8079-402251BD4154}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{EEBC27FB-3026-4CEA-8079-402251BD4154}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{F38C68B4-65D7-4A61-9434-54C68A9C5B4F}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F38C68B4-65D7-4A61-9434-54C68A9C5B4F}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{FDDEDF02-6BF8-4A09-9126-4895EB8A49F4}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{FDDEDF02-6BF8-4A09-9126-4895EB8A49F4}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\Logon-5d" => key removed successfully.
"HKU\S-1-5-21-817363288-272500718-2324346864-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\driversupport.com" => key removed successfully.
HKU\S-1-5-21-817363288-272500718-2324346864-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\driversupport.com => key not found.
HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\TCP Query User{D4C76E1E-B5F2-44D0-84F1-76EC194B95E4}C:\users\saturn89\appdata\roaming\octoshape\octoshape streaming services\octoshapeclient.exe => value removed successfully.
HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\UDP Query User{6CB58E30-A987-40DD-9E7F-2CFAAFABC7AD}C:\users\saturn89\appdata\roaming\octoshape\octoshape streaming services\octoshapeclient.exe => value removed successfully.
C:\Windows\System32\Drivers\etc\hosts => moved successfully
Hosts restored successfully.

=========  ipconfig /flushdns =========


Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

========= End of CMD: =========

EmptyTemp: => 1.9 GB temporary data Removed.


The system needed a reboot.

==== End of Fixlog 05:07:30 ====

Post #26

:thumbup:

 

Lets make sure there is nothing else lurking

 

 

Please run this Free Online Virus Scanner from ESET
  •  
  • Please be patient, depending on your system the scan can complete in 30 minutes and on others much longer.
  • You want the Online One-Time Scan
  • Note: It will run using Internet Explorer, Firefox or Chome.
  • Tick the box next to YES, I accept the Terms of Use.
  • Click Start
  • When asked, allow the activex control to install
  • Click Start
  • Make sure that the option Remove found threats is NOT TICKED, and the option Scan unwanted applications is checked
  • Click Scan
  • Wait for the scan to finish
  • Use notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
  • Copy and paste that log as a reply to this topic
 
 
Post #27

Another comedy of errors on my part, but a good result, so far anyway.  I tried to open the free online ESET virus scanner from Firefox but it didn't work initially so I downloaded the 30-day trial and used that.  It found one threat and I tried to copy the three logs but the system wouldn't let me do that.  I went back the free one, downloaded it, ran the scan and found and fixed the threat!  I re-did it and realized I didn't go the "advanced" part and stop it from fixing the threat, scanned again but it didn't find anything, so I don't have a log for you.  I'm still trying to figure out the trial software so I can't bring up that log at this point.  I don't see the file screen when I open Firefox anymore so that got cleaned up.  I think everything is ok at this point and the ESET system seems pretty impressive at this point.

Thanks again for all your help, it is much appreciated.

Post #28

Well, looks like everything is ok for you, thats good.  ESET is a great Anti Virus program, you may want to think about keeping it and uninstalling Avast, but this is up to you

 

 

Double click on AdwCleaner.exe to run the tool again.
  • Click on the Uninstall button.
  • Click Yes when asked are you sure you want to uninstall.
  • Both AdwCleaner.exe, its folder and all logs will be removed.
    •  
     
    ==========================================================
     
     
    Please download DelFix and save the file to your Desktop.
     
    [external image: DelFix_zps139e2ea1.jpg]
     
    • Windows XP Double Click DelFix.exe to run the program. 
    • Windows Vista > Win 7 > Win 8 Right Click on DelFix.exe and select RUN AS ADMINISTRATOR 
    • Checkmark " Remove Disinfection Tools"
    • Click the Run button
      •  
      This will remove the specialised tools we used to clean your system. Any leftover logs, files, folders or tools remaining on your Desktop which were not removed can be deleted manually
       
       
       
       
      So How did I get infected in the first place <– Some reading for you to keep yourself safe online
       
       
      Safe Surfn
      Ken

      Ask AI

      AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

      Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI