Malware Removal Forums

FileParade + very slow startup and shutdown

stephenabyers · 2015-02-01T01:55:25+00:00

I am having trouble uninstalling FileParade Bundle and also having very slow startups and shutdowns. Thanks for your help. DDS (Ver_2012-11-20.01) - NTFS_AMD64 Internet Explorer: 11.0.9600.17496 BrowserJavaVersion: 11.25.2 Run by [redacted] at 20:45:42 on 2015-01-31 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.16301.12995 [GMT -5:00] . AV: AVG AntiVirus Free Edition 2014 *Enabled/Updated* {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} SP: Spybot - Search and Destroy *Disabled/Outdated* {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0} SP: AVG AntiVirus Free Edition 2014 *Enabled/Updated* {B5F5C120-2089-702E-0001-553BB0D5A664} . ============== Running Processes =============== . c:\PROGRA~2\AVG\AVG2014\avgrsa.exe C:\Program Files (x86)\AVG\AVG2014\avgcsrva.exe C:\windows\system32\lsm.exe C:\windows\system32\svchost.exe -k DcomLaunch C:\windows\system32\svchost.exe -k RPCSS C:\windows\System32\svchost.exe -k LocalS

7 min read

✨ The volunteers who helped with this thread aren't active anymore, but you can still get a personalized answer — click Ask AI below.

stephenabyers

February 7, 2015, 2:24 PM UTC

ESET Log:

C:\$Recycle.Bin\S-1-5-21-4008453203-116359934-4206298802-1001\$R1D7663.dll a variant of Win32/Toolbar.Conduit.B potentially unwanted application
C:\$Recycle.Bin\S-1-5-21-4008453203-116359934-4206298802-1001\$ROQCY1S.dll a variant of Win32/Toolbar.Conduit.B potentially unwanted application
C:\$Recycle.Bin\S-1-5-21-4008453203-116359934-4206298802-1001\$R01O1LI.tmp\Helper.dll a variant of Win32/Toolbar.SearchSuite.W potentially unwanted application
C:\$Recycle.Bin\S-1-5-21-4008453203-116359934-4206298802-1001\$RBTBAGX.tmp\Helper.dll a variant of Win32/Toolbar.SearchSuite.W potentially unwanted application
C:\$Recycle.Bin\S-1-5-21-4008453203-116359934-4206298802-1001\$RVNSNZ4.tmp\Helper.dll a variant of Win32/Toolbar.SearchSuite.W potentially unwanted application
C:\Users\Admin\Downloads\ccsetup415.exe Win32/Bundled.Toolbar.Google.D potentially unsafe application
C:\Windows\Installer\MSI47EB.tmp a variant of Win32/Bundled.Toolbar.Ask.F potentially unsafe application
C:\Windows\System32\Adobe\Shockwave 11\gt.exe Win32/Bundled.Toolbar.Google.D potentially unsafe application
C:\Windows\System32\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Extensions\pacgpkgadgmibnhpdidcnfafllnmeomc\10.31.4.510_0\APISupport\APISupport.dll a variant of Win32/Conduit.SearchProtect.P potentially unwanted application
C:\Windows\System32\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Extensions\pacgpkgadgmibnhpdidcnfafllnmeomc\10.31.4.510_0\nativeMessaging\TBMessagingHost.exe a variant of Win32/Toolbar.Conduit.AH potentially unwanted application
C:\Windows\System32\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Extensions\pacgpkgadgmibnhpdidcnfafllnmeomc\10.31.4.510_0\plugins\ChromeApiPlugin.dll a variant of Win32/Conduit.SearchProtect.N potentially unwanted application
C:\Windows\SysWOW64\Adobe\Shockwave 11\gt.exe Win32/Bundled.Toolbar.Google.D potentially unsafe application
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Extensions\pacgpkgadgmibnhpdidcnfafllnmeomc\10.31.4.510_0\APISupport\APISupport.dll a variant of Win32/Conduit.SearchProtect.P potentially unwanted application
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Extensions\pacgpkgadgmibnhpdidcnfafllnmeomc\10.31.4.510_0\nativeMessaging\TBMessagingHost.exe a variant of Win32/Toolbar.Conduit.AH potentially unwanted application
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Extensions\pacgpkgadgmibnhpdidcnfafllnmeomc\10.31.4.510_0\plugins\ChromeApiPlugin.dll a variant of Win32/Conduit.SearchProtect.N potentially unwanted application

Gary R Administrator

February 7, 2015, 10:30 PM UTC

Click Start
Type notepad.exe in the search programs and files box and click Enter.
A blank Notepad page should open.
- Copy/Paste the contents of the code box below into Notepad (don't include Code: Select all).

SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =

SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =

SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =

SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =

SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =

SearchScopes: HKU\S-1-5-21-4008453203-116359934-4206298802-1003 -> {15D6AACC-F402-4335-8BD8-20BB5E8A8DB5} URL =

BHO: No Name -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> No File

C:\Users\Admin\Downloads\ccsetup415.exe

C:\Windows\Installer\MSI47EB.tmp

C:\Windows\System32\Adobe\Shockwave 11\gt.exe

C:\Windows\System32\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Extensions\pacgpkgadgmibnhpdidcnfafllnmeomc\10.31.4.510_0\APISupport\APISupport.dll

C:\Windows\System32\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Extensions\pacgpkgadgmibnhpdidcnfafllnmeomc\10.31.4.510_0\nativeMessaging\TBMessagingHost.exe

C:\Windows\System32\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Extensions\pacgpkgadgmibnhpdidcnfafllnmeomc\10.31.4.510_0\plugins\ChromeApiPlugin.dll

C:\Windows\SysWOW64\Adobe\Shockwave 11\gt.exe

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Extensions\pacgpkgadgmibnhpdidcnfafllnmeomc\10.31.4.510_0\APISupport\APISupport.dll

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Extensions\pacgpkgadgmibnhpdidcnfafllnmeomc\10.31.4.510_0\nativeMessaging\TBMessagingHost.exe

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Extensions\pacgpkgadgmibnhpdidcnfafllnmeomc\10.31.4.510_0\plugins\ChromeApiPlugin.dll

EmptyTemp:

Save it to the same folder/directory that FRST.exe is in, naming it as fixlist.txt

NOTICE: This script was written specifically for this user. Running it on another machine may cause damage to your operating system

Start FRST in a similar manner to when you ran a scan earlier, but this time when it opens ....
- Press the Fix button once and wait.
- FRST will process fixlist.txt
- When finished, it will produce a log fixlog.txt in the same folder/directory as FRST64.exe
- Please post me the log
- Please let me know how your computer is behaving now.

stephenabyers

February 7, 2015, 11:44 PM UTC

So grateful for your help, Gary.

Should I be concerned that Java 6 Update 45 is still showing in the Control Panel -> Programs list?
I think things feel pretty good.
Fixlog shown below...

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 07-02-2015
Ran by [redacted] at 2015-02-07 18:28:59 Run:3
Running from C:\Users\[redacted]\Desktop
[redacted]
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-4008453203-116359934-4206298802-1003 -> {15D6AACC-F402-4335-8BD8-20BB5E8A8DB5} URL =
BHO: No Name -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> No File
C:\Users\Admin\Downloads\ccsetup415.exe
C:\Windows\Installer\MSI47EB.tmp
C:\Windows\System32\Adobe\Shockwave 11\gt.exe
C:\Windows\System32\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Extensions\pacgpkgadgmibnhpdidcnfafllnmeomc\10.31.4.510_0\APISupport\APISupport.dll
C:\Windows\System32\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Extensions\pacgpkgadgmibnhpdidcnfafllnmeomc\10.31.4.510_0\nativeMessaging\TBMessagingHost.exe
C:\Windows\System32\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Extensions\pacgpkgadgmibnhpdidcnfafllnmeomc\10.31.4.510_0\plugins\ChromeApiPlugin.dll
C:\Windows\SysWOW64\Adobe\Shockwave 11\gt.exe
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Extensions\pacgpkgadgmibnhpdidcnfafllnmeomc\10.31.4.510_0\APISupport\APISupport.dll
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Extensions\pacgpkgadgmibnhpdidcnfafllnmeomc\10.31.4.510_0\nativeMessaging\TBMessagingHost.exe
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Extensions\pacgpkgadgmibnhpdidcnfafllnmeomc\10.31.4.510_0\plugins\ChromeApiPlugin.dll
EmptyTemp:
*****************

HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully.
HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
"HKU\S-1-5-21-4008453203-116359934-4206298802-1003\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{15D6AACC-F402-4335-8BD8-20BB5E8A8DB5}" => Key deleted successfully.
HKCR\CLSID\{15D6AACC-F402-4335-8BD8-20BB5E8A8DB5} => Key not found.
"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}" => Key deleted successfully.
HKCR\CLSID\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} => Key not found.
C:\Users\Admin\Downloads\ccsetup415.exe => Moved successfully.
C:\Windows\Installer\MSI47EB.tmp => Moved successfully.
"C:\Windows\System32\Adobe\Shockwave 11\gt.exe" => File/Directory not found.
"C:\Windows\System32\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Extensions\pacgpkgadgmibnhpdidcnfafllnmeomc\10.31.4.510_0\APISupport\APISupport.dll" => File/Directory not found.
"C:\Windows\System32\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Extensions\pacgpkgadgmibnhpdidcnfafllnmeomc\10.31.4.510_0\nativeMessaging\TBMessagingHost.exe" => File/Directory not found.
"C:\Windows\System32\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Extensions\pacgpkgadgmibnhpdidcnfafllnmeomc\10.31.4.510_0\plugins\ChromeApiPlugin.dll" => File/Directory not found.
C:\Windows\SysWOW64\Adobe\Shockwave 11\gt.exe => Moved successfully.
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Extensions\pacgpkgadgmibnhpdidcnfafllnmeomc\10.31.4.510_0\APISupport\APISupport.dll => Moved successfully.
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Extensions\pacgpkgadgmibnhpdidcnfafllnmeomc\10.31.4.510_0\nativeMessaging\TBMessagingHost.exe => Moved successfully.
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Extensions\pacgpkgadgmibnhpdidcnfafllnmeomc\10.31.4.510_0\plugins\ChromeApiPlugin.dll => Moved successfully.
EmptyTemp: => Removed 43.5 MB temporary data.

The system needed a reboot.

==== End of Fixlog 18:31:29 ====

Gary R Administrator

February 8, 2015, 12:39 AM UTC

Try removing the old Java version using the Java uninstaller tool ... https://www.java.com/en/download/faq/un ... olinfo.xml ... please let me know if it is successful.

stephenabyers

February 8, 2015, 1:20 PM UTC

I tried the tool but it didn't have any success. However, I just tried the normal uninstall under Control Panel -> Programs again, and this time I think it worked. Thanks for the fantastic help!!

Gary R Administrator

February 8, 2015, 4:06 PM UTC

Good, I'm glad you seem to have got it uninstalled anyway.

Time to remove the programs we've been using to clean your computer, then I'll make a few suggestions about computer security.

First ...

Please download delfix and save it to your desktop.
Right-click on delfix.exe and select " Run as administrator " to run it.
Check all the boxes then click on Run.
Once it has finished, a notepad file named DelFix.txt will open. Post the contents of this notepad in your next reply.
The log can also be located at the root of the system drive, C:\DelFix.txt.

Then ...

Please read the article below which will give you a few suggestions for how to minimise your chances of getting another infection.

Computer Security - a short guide to staying safer online

Gary R Administrator

February 15, 2015, 6:15 AM UTC

This topic is now closed

✨ Ask AI about this thread

No ads, no affiliate links — generated on request from this thread's own archived content, not written by forum staff. Never run a scan/removal tool as a self-service step if the original thread describes it being done under a helper's direct supervision, and don't include your name, email, or other personal details in a follow-up question. See our privacy page for details on how this works.