#

#
#
#
#
#
#
#

AdwCleaner v5.020 - Logfile created 13/11/2015 at 20:20:33

Updated 13/11/2015 by Xplode
Database : 2015-11-13.3 [Server]
Operating system : Windows 10 Education (x64)
Username : mahmoud - DESKTOP-OITVTJS
Running from : C:\Users\mahmoud\Downloads\adwcleaner_5.020.exe
Option : Cleaning
Support : http://toolslib.net/forum

***** [ Services ] *****

***** [ Folders ] *****
[-] Folder Deleted : C:\Program Files (x86)\Common Files\a95f8535-bd08-4370-a6e0
-814924c0d5f0
[-] Folder Deleted : C:\ProgramData\a95f8535-bd08-4370-a6e0-814924c0d5f0
***** [ Files ] *****
[-] File Deleted : C:\Users\mahmoud\AppData\Roaming\Mozilla\Firefox\Profiles\dva
kzzb9.default\user.js
[-] File Deleted : C:\Users\mahmoud\AppData\Roaming\Mozilla\Firefox\Profiles\dva
kzzb9.default\searchplugins\yahoo.xml
***** [ DLLs ] *****
***** [ Shortcuts ] *****
***** [ Scheduled tasks ] *****
***** [ Registry ] *****
[-] Key Deleted
F55}
[-] Key Deleted
E56}
[-] Key Deleted
160}
[-] Key Deleted
1CD}
[-] Key Deleted
556}
[-] Key Deleted
EE8}
[-] Key Deleted
C8957BE}
[-] Key Deleted
8AC8FFE}
[-] Key Deleted
604A06A}
[-] Key Deleted
4E2ED7F}
[-] Key Deleted
701C2D5}
[-] Key Deleted
297C91E}

: HKLM\SOFTWARE\Classes\AppID\{20B9C05C-99C9-4BAB-B596-FB0C0E1C9
: HKLM\SOFTWARE\Classes\AppID\{4D076AB4-7562-427A-B5D2-BD96E19DE
: HKCU\Software\Classes\CLSID\{A2DF06F9-A21A-44A8-8A99-8B9C84F29
: HKLM\SOFTWARE\Classes\CLSID\{20E1481B-E285-4ABC-ADC7-AE24842B8
: HKLM\SOFTWARE\Classes\CLSID\{826D7151-8D99-434B-8540-082B8C2AE
: HKLM\SOFTWARE\Classes\CLSID\{F83D1872-D9FF-47F8-B5A0-49CC51E24
: HKLM\SOFTWARE\Classes\Interface\{0194532A-A99C-4337-937E-2A452
: HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED14
: HKLM\SOFTWARE\Classes\Interface\{0FEB2313-F89B-4AC6-8153-84025
: HKLM\SOFTWARE\Classes\Interface\{02F878DF-E2BE-4B85-8CB4-A0D2D
: HKLM\SOFTWARE\Classes\Interface\{52C5395B-1FCD-47FA-A834-FD830
: HKLM\SOFTWARE\Classes\Interface\{762D463B-C45A-456D-A80D-8689C

[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{7A6BE473-7960-44D0-BD54-D23DA

76353DF}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{803F550E-BAAE-42BB-8917-64BA0
006AB17}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{8D5BC51D-C9D3-43B9-B728-B3067
7B7C7E8}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{991C9D8D-A789-4DB9-BDFC-5F333
98B04BF}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{B0474212-0D9D-4361-90B3-B89D1
A44275D}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{D83C83BF-3EDD-4410-ADAB-52951
16DD8C7}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{DD260902-9420-4055-A956-9152E
B4F3E6A}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{EB1F9F3C-5526-4DAE-BD4B-3EAA7
715DA9F}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{F1912128-469A-4138-AA26-9699C
15BB13E}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{F68DC16C-9C2B-455B-8853-7E4D3
4BAA3F4}
[-] Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{11549FE4-7C5A-4C17-9FC3-56FC516
2A994}
[-] Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{92E5039E-FF1E-4AFB-8F24-87592D2
0C383}
[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DEDA
F650-12B8-48F5-A843-BBA100716106}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\Elevation
Policy\{72A6AB0F-2FA8-4C73-9FCB-1E62A608F001}
[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{0194532A-A99C-4337-937E
-2A452C8957BE}
[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C
-1ED148AC8FFE}
[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{0FEB2313-F89B-4AC6-8153
-84025604A06A}
[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{02F878DF-E2BE-4B85-8CB4
-A0D2D4E2ED7F}
[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{2AF343DD-3102-4F9D-AC95
-DCA4C95382C7}
[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{3137BC14-D8D7-4B67-8FFA
-2E0B2E9D541B}
[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{4CA2AC92-971B-47B1-ACB6
-357B552155AC}
[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{52C5395B-1FCD-47FA-A834
-FD830701C2D5}
[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{5D3DCC39-9233-4330-94E9
-DA92BE49CA1A}
[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{615FACDF-DADB-440D-AC91
-8AAB0AE9E3AD}
[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{762D463B-C45A-456D-A80D
-8689C297C91E}
[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{7A6BE473-7960-44D0-BD54
-D23DA76353DF}
[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{803F550E-BAAE-42BB-8917
-64BA0006AB17}
[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{8D5BC51D-C9D3-43B9-B728
-B30677B7C7E8}
[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{991C9D8D-A789-4DB9-BDFC
-5F33398B04BF}
[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{A5ACC874-D943-483F-A2D1
-14598D51F872}

[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{B0474212-0D9D-4361-90B3

-B89D1A44275D}
[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{BFDE183A-C6FE-41D2-80F9
-586C29210AC2}
[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{D83C83BF-3EDD-4410-ADAB
-5295116DD8C7}
[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{DD260902-9420-4055-A956
-9152EB4F3E6A}
[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{EB1F9F3C-5526-4DAE-BD4B
-3EAA7715DA9F}
[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{F1912128-469A-4138-AA26
-9699C15BB13E}
[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{F68DC16C-9C2B-455B-8853
-7E4D34BAA3F4}
[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{FBA8498F-B3A0-4942-A2BF
-E0CB7BC7E000}
[-] Key Deleted : HKCU\Software\TNT2
[-] Key Deleted : HKCU\Software\Tny_Cassiopesa
[-] Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{3216AB
2F-D3B8-4EAE-9DC0-2FEE732D9EC4}
[-] Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{9143e9
21-7c9a-4d27-ac43-eaccc78cc55a}
[-] Data Restored : HKCU\Software\Microsoft\Internet Explorer\SearchScopes [Defa
ultScope]
***** [ Web browsers ] *****
[-] [C:\Users\mahmoud\AppData\Roaming\Mozilla\Firefox\Profiles\dvakzzb9.default\
prefs.js] [Preference] Deleted : user_pref("browser.search.defaultenginename", "
eShield Safe Web");
[-] [C:\Users\mahmoud\AppData\Roaming\Mozilla\Firefox\Profiles\dvakzzb9.default\
prefs.js] [Preference] Deleted : user_pref("browser.search.selectedEngine", "eSh
ield Safe Web");
[-] [C:\Users\mahmoud\AppData\Roaming\Mozilla\Firefox\Profiles\dvakzzb9.default\
prefs.js] [Preference] Deleted : user_pref("browser.startup.homepage", "hxxp://s
ervices.eshield.com/general/newhometab.php?hometab=home&partner=11481&guid={543F
C693-B576-493D-83E4-16997E5C0DE2}&i=");
[-] [C:\Users\mahmoud\AppData\Roaming\Mozilla\Firefox\Profiles\dvakzzb9.default\
prefs.js] [Preference] Deleted : user_pref("keyword.URL", "hxxp://search.eshield
.com/serp?guid={543FC693-B576-493D-83E4-16997E5C0DE2}&action=default_search&k=")
;
[-] [C:\Users\mahmoud\AppData\Roaming\Mozilla\Firefox\Profiles\dvakzzb9.default\
prefs.js] [Preference] Deleted : user_pref("plugin.state.npconduitfirefoxplugin"
, 0);
[-] [C:\Users\mahmoud\AppData\Local\Google\Chrome\User Data\Default\Web Data] [S
earch Provider] Deleted : aol.com
[-] [C:\Users\mahmoud\AppData\Local\Google\Chrome\User Data\Default\Web Data] [S
earch Provider] Deleted : ask.com
[-] [C:\Users\mahmoud\AppData\Local\Google\Chrome\User Data\Default\Secure Prefe
rences] [Homepage] Deleted : hxxp://www.cassiopessa.com/?f=1&a=csp_tight2_15_43&
cd=2XzuyEtN2Y1L1Qzu0Bzz0A0CyC0FyBtDyEyD0C0FzytBtCtCtN0D0Tzu0StCtAzzzztN1L2XzutAt
FtCtBtFyDtFtDtN1L1CzutN1L1G1B1V1N2Y1L1Qzu2SyEyC0EyE0DyDyBtAtGyD0AtCtBtG0DtCtBzyt
GtD0ByC0EtGzzyCyEzytAyE0BtBzzyDyC0F2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0CzyyE0E0CtDyEzytGt
B0AyCtAtGyEtCyCyEtG0BtDyB0FtGyByDtByE0Fzz0ByDzytDzz0B2QtN0A0LzutD&cr=302840471&i
r=
[-] [C:\Users\mahmoud\AppData\Local\Chromium\User Data\Default\Web Data] [Search
Provider] Deleted : cassiopesa
[-] [C:\Users\mahmoud\AppData\Local\Chromium\User Data\Default\Secure Preference
s] [Startup_URLs] Deleted : hxxp://www.cassiopessa.com/?f=7&a=csp_tight2_15_43&c
d=2XzuyEtN2Y1L1Qzu0Bzz0A0CyC0FyBtDyEyD0C0FzytBtCtCtN0D0Tzu0StCtAzzzztN1L2XzutAtF

tCtBtFyDtFtDtN1L1CzutN1L1G1B1V1N2Y1L1Qzu2SyEyC0EyE0DyDyBtAtGyD0AtCtBtG0DtCtBzytG
tD0ByC0EtGzzyCyEzytAyE0BtBzzyDyC0F2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0CzyyE0E0CtDyEzytGtB
0AyCtAtGyEtCyCyEtG0BtDyB0FtGyByDtByE0Fzz0ByDzytDzz0B2QtN0A0LzutD&cr=302840471&ir
=&uref=chmm
[-] [C:\Users\mahmoud\AppData\Local\Chromium\User Data\Default\Secure Preference
s] [Homepage] Deleted : hxxp://www.cassiopessa.com/?f=1&a=csp_tight2_15_43&cd=2X
zuyEtN2Y1L1Qzu0Bzz0A0CyC0FyBtDyEyD0C0FzytBtCtCtN0D0Tzu0StCtAzzzztN1L2XzutAtFtCtB
tFyDtFtDtN1L1CzutN1L1G1B1V1N2Y1L1Qzu2SyEyC0EyE0DyDyBtAtGyD0AtCtBtG0DtCtBzytGtD0B
yC0EtGzzyCyEzytAyE0BtBzzyDyC0F2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0CzyyE0E0CtDyEzytGtB0AyC
tAtGyEtCyCyEtG0BtDyB0FtGyByDtByE0Fzz0ByDzytDzz0B2QtN0A0LzutD&cr=302840471&ir=&ur
ef=chmm
*************************
:: "Tracing" keys removed
:: Winsock settings cleared
########## EOF - C:\AdwCleaner\AdwCleaner[C1].txt - [8912 bytes] ##########