Remove PC Defender Plus

PC Defender Plus is a fake antivirus which will infect the computer after a Trojan opens a backdoor on the computer. Normally this program is installed to the computer without the permission of the users when they visit some websites. PC Defender Plus start automatically when the computer boot. It will scan the infected computer and shows that the computer has been infected by many malwares. In fact, the computer is infected by itself! Then, PC Defender Plus will persuade the user to purchase the license in order to activate it. This fake antivirus should be removed immediately.

PC Defender Plus provide fake features such as Scan Results, Internet Security, Personal Security, Proactive Defense, Firewall etc. All of them cannot protect computer from any kind of malware.

PC Defender Plus can be removed by stopping its processes [random].exe and the user should remember to kill the file. The registry settings should be restored by following the removal guide below.

PC Defender Plus must be removed from your computer immediately!

Removal Guide
Kill Process
(How to kill a process effectively?)
[random].exe

Delete Registry

HKEY_CLASSES_ROOT\.exe "(Default)" = "[random]"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\pcdfdata
HKEY_CURRENT_USER\Software\Classes\.exe\shell\open\command "(Default)" = ""%CommonAppData%\pcdfdata\[random].exe" /ex "%1" %*"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "pcdfsvc" = "%CommonAppData%\pcdfdata\[random].exe /min"


Remove Folders and Files

%AllUsersProfile%\Desktop\PC Defender Plus.lnk
%CommonAppData%\pcdfdata\
%CommonAppData%\pcdfdata\app.ico
%CommonAppData%\pcdfdata\config.bin
%CommonAppData%\pcdfdata\defs.bin
%CommonAppData%\pcdfdata\[random].exe
%CommonAppData%\pcdfdata\support.ico
%CommonAppData%\pcdfdata\uninst.ico
%CommonAppData%\pcdfdata\vl.bin
%CommonStartMenu%\Programs\PC Defender Plus\
%CommonStartMenu%\Programs\PC Defender Plus\PC Defender Plus Help and Support.lnk
%CommonStartMenu%\Programs\PC Defender Plus\PC Defender Plus.lnk
%CommonStartMenu%\Programs\PC Defender Plus\Remove PC Defender Plus.lnk

Remove Fake Antivirus 1.89

Remove Fake Antivirus is used to remove the most popular fake antiviruses. What is fake antivirus? This is a type of virus/malwares which disguises itself to be an antivirus. It infects your computer when you accidentally click a link in a website which will download the malware into your computer and run automatically when your windows boot. It scan the infected computer and produces fake alert warnings. It convinces you that your computer is in danger and urge you to purchase a useless copy of the fake antivirus. These fake antiviruses must be removed immediately.

Remove Fake Antivirus 1.89 is used to remove:

1. PC Defender Plus
2. Windows Proprietary Advisor
3. Windows Smart Warden
4. Home Malware Cleaner
5. Strong Malware Defender
6. AV Security 2012
7. Data Recovery
8. Wolfram Antivirus
9. Security Protection
10. Windows Antivirus 2011
11. Mega Antivirus 2012
12. AVG Antivirus 2011
13. PC Security 2011
14. ThinkPoint
15. ThinkSmart
16. Antivirus 8
17. Security Tool
18. My Security Shield
19. Antivirus 7
20. Antivirus GT
21. Defense Center
22. Protection Center
23. Sysinternals Antivirus
24. Security Master AV
25. CleanUp Antivirus
26. Security Toolbar
27. Digital Protection
28. XP Smart Security 2010
29. Antivirus Suite
30. Vista Security Tool 2010
31. Total XP Security
32. Security Central
33. Security Antivirus
34. Total PC Defender 2010
35. Vista Antivirus Pro 2010
36. Your PC Protector
37. Vista Internet Security 2010
38. XP Guardian
39. Vista Guardian 2010
40. Antivirus Soft
41. XP Internet Security 2010
42. Antivir 2010
43. Live PC Care
44. Malware Defense
45. Internet Security 2010
46. Desktop Defender 2010
47. Antivirus Live
48. Personal Security
49. Cyber Security
50. Alpha Antivirus
51. Windows Enterprise Suite
52. Security Center
53. Control Center
54. Braviax
55. Windows Police Pro
56. Antivirus Pro 2010
57. PC Antispyware 2010
58. FraudTool.MalwareProtector.d
59. Winshield2009.com
60. Green AV
61. Windows Protection Suite
62. Total Security 2009
63. Windows System Suite
64. Antivirus BEST
65. System Security
66. Personal Antivirus
67. System Security 2009
68. Malware Doctor
69. Antivirus System Pro
70. WinPC Defender
71. Anti-Virus-1
72. Spyware Guard 2008
73. System Guard 2009
74. Antivirus 2009
75. Antivirus 2010
76. Antivirus Pro 2009
77. Antivirus 360
78. MS Antispyware 2009
79. IGuardPC or I Guard PC
80. Additional Guard

(all of them are fake antivirus which are
viruses or trojans) and other fake antivirus from your computer.

Remove Fake Antivirus is used to remove
fake antivirus which are viruses or trojans.

CLICK HERE TO DOWNLOAD
Latest updated :
Link I Link II
md5: 60a2b3bf70ded56a1e9cce2384012070
Pad File 1: rfa.xml
Pad File 2: rfa.xml

Recent Posts

• Remove PC Defender Plus
• Remove Advanced System Protector
• Remove XP Antivirus Pro 2013
• Remove Vista Antivirus Pro 2013
• Remove Win 7 Antivirus Pro 2013
• Remove Vista Security Pro 2013
• Remove XP Antispyware Pro 2013
• Remove Vista Antispyware Pro 2013
• Remove Win 7 Antispyware Pro 2013
• Remove Windows Protection Maintenance
• Remove Win 8 Home Security 2013
• Remove Win 8 Antivirus 2013
• Remove Win 8 Antispyware 2013
• Remove Win 8 Security Suite 2013
• Remove Micorsoft Essential Security Pro 2013
• Remove Vista Total Security 2013
• Remove Win 7 Total Security 2013
• Remove File Restore
• Remove Win 7 Security 2013
• Remove Windows Antipiracy Virus
• Remove XP Internet Security 2013
• Remove XP Antispyware 2013
• Remove Win 7 Home Security 2013
• Remove XP Security 2013
• Remove Vista Security 2013
• Remove Vista Antispyware 2013
• Remove Win 8 Defender 2013
• Remove XP Home Security 2013
• Remove Win 7 Antispyware 2013
• Remove Win 7 Internet Security 2013
• Remove XP Defender 2013
• Remove System Progressive Protection
• Remove Galileo System Cleaner
• Remove Great Antispy 2012
• Remove Win 8 Security System
• Remove PC Utility Kit
• Remove Windows Secure Workshop
• Remove Windows Safety Series
• Remove Windows Secure Workstation
• Remove Windows Anti-Malware Patch
• Remove Windows Virtual Security
• Remove Windows Antivirus Release
• Remove Windows Interactive Safety
• Remove Windows Ultimate Safeguard
• Remove Windows Antivirus Machine
• Remove Windows Ultra-Antivirus
• Remove Quick Heal Antivirus Plus 2009
• Remove Windows Active Guard
• Remove Windows Security System
• Remove Windows Security Renewal
• Remove Windows Home Patron
• Remove Windows Virtual Firewall
• Remove Windows Premium Defender
• Remove Windows Web Combat
• Remove Windows Virtual Angel
• Remove Windows Profound Security
• Remove Windows Expert Series
• Remove Windows Virus Hunter
• Remove Windows Web Commander
• Remove Windows Interactive Security
• Remove Windows Proprietary Advisor
• Remove Windows Privacy Extension
• Remove Windows Custom Management
• Remove Windows Premium Console

Remove Advanced System Protector

Advanced System Protector is a fake antivirus program which intend to urge the user whose computer is infected by Advanced System Protector to purchase the full version of Advanced System Protector. Advanced System Protector produces fake alert in order to cheat the user. Advanced System Protector installs into the computer without the confirmation of the user and configure itself to start automatically when windows boot. Advanced System Protector will then scan the computer and state that there are many malware in the computer and ask the user to purchase full version of Advanced System Protector to remove all the malwares. Advanced System Protector is highly likely to block genuine scanning software and hijack your web browser through a proxy server.

Advanced System Protector can be remove by stopping the process hee.exe and remove the file by using Emsisoft HiJackFree. Then the user should remove the registries entries added and modified by Advanced System Protector according to the removal guide stated below.

Advanced System Protector should be removed immediately!

Advanced System Protector Removal Guide
Kill Process
(How to kill a process effectively?)
[random].exe

Delete Registry
HKEY_CURRENT_USER\Software\Classes\.exe | Content Type = "application/x-msdownload"
HKEY_CURRENT_USER\Software\Classes\.exe | @ = "pezfile"
HKEY_CURRENT_USER\Software\Classes\.exe\shell\open\command | IsolatedCommand = ""%1? %*"
HKEY_CURRENT_USER\Software\Classes\.exe\shell\open\command | @ = ""%AppData%\hee.exe" /START "%1? %*"
HKEY_CURRENT_USER\Software\Classes\pezfile\shell\open\command | IsolatedCommand = ""%1? %*"
HKEY_CURRENT_USER\Software\Classes\pezfile\shell\open\command | @ = ""%AppData%\hee.exe" /START "%1? %*"
HKEY_CURRENT_USER\Software\Classes\.exe\shell\start\command
HKEY_CURRENT_USER\Software\Classes\.exe\shell\start
HKEY_CURRENT_USER\Software\Classes\.exe\shell\runas\command
HKEY_CURRENT_USER\Software\Classes\.exe\shell\runas
HKEY_CURRENT_USER\Software\Classes\.exe\shell\open\command
HKEY_CURRENT_USER\Software\Classes\.exe\shell\open
HKEY_CURRENT_USER\Software\Classes\.exe\shell
HKEY_CURRENT_USER\Software\Classes\.exe\DefaultIcon
HKEY_CURRENT_USER\Software\Classes\.exe
HKEY_CURRENT_USER\Software\Classes\pezfile\shell\open\command
HKEY_CURRENT_USER\Software\Classes\pezfile\shell\open
HKEY_CURRENT_USER\Software\Classes\pezfile\shell
HKEY_CURRENT_USER\Software\Classes\pezfile\shell\start\command
HKEY_CURRENT_USER\Software\Classes\pezfile\shell\start
HKEY_CURRENT_USER\Software\Classes\pezfile\shell\runas\command
HKEY_CURRENT_USER\Software\Classes\pezfile\shell\runas
HKEY_CURRENT_USER\Software\Classes\pezfile\DefaultIcon
HKEY_CURRENT_USER\Software\Classes\pezfile

Remove Folders and Files
%AppData%\[random].exe

Remove XP Antivirus Pro 2013

XP Antivirus Pro 2013 is a fake antivirus program created to urge the user to buy the full version of XP Antivirus Pro 2013 in order to earn some profit. Don't ever buy it as it is a cheat! XP Antivirus Pro 2013 install itself into the computer without confirmation of the users and it start automatically when the windows boot. XP Antivirus Pro 2013 produce fake virus warning alert consistently to force the user to purchase the full version so that to remove the malwares. XP Antivirus Pro 2013 is nothing more than a scam and plagiarized antispyware program

XP Antivirus Pro 2013 provide fake features such as Perform Scan, Internet Security, Personal Security, Proactive Defense, Firewall, Configuration, Complete PC Protection,  Automating Updating, Protection against bank account fraud, Self-protection from malware, Update Now, Scan Now etc. All of them cannot protect the computer from any kind of malware.

XP Antivirus Pro 2013 can be removed by using Emsisoft HiJackFree to stop the processes and kill the files from the hard drive. Then, the user has to restore the registry entries added and modified by XP Antivirus Pro 2013. Finally, all the file related to XP Antivirus Pro 2013 must be deleted from the hard drive. All of them has been shown in the removal guide below.

XP Antivirus Pro 2013 should be removed immediately!
XP Antivirus Pro 2013 Removal Guide
Kill Process
[random].exe

Delete Registry
KEY_CURRENT_USER\Software\Classes\.exe "(Default)" = "[random]"
HKEY_CURRENT_USER\Software\Classes\.exe\shell\open\command "(Default)" = "%LocalAppData%\[random].exe" -a "%1" %*"
HKEY_CURRENT_USER\Software\Classes\.exe\shell\open\command "IsolatedCommand" = ""%1" %*"
HKEY_CURRENT_USER\Software\Classes\.exe\shell\runas\command "(Default)" = ""%1" %*"
HKEY_CURRENT_USER\Software\Classes\.exe\shell\runas\command "IsolatedCommand" = ""%1" %*"
HKEY_CURRENT_USER\Software\Classes\[random] "(Default)" = "Application"
HKEY_CURRENT_USER\Software\Classes\[random] "Content Type" = "application/x-msdownload"
HKEY_CURRENT_USER\Software\Classes\[random]\DefaultIcon "(Default)" = "%1"
HKEY_CURRENT_USER\Software\Classes\[random]\shell\open\command "(Default)" = ""%LocalAppData%\[random].exe" -a "%1" %*"
HKEY_CURRENT_USER\Software\Classes\[random]\shell\open\command "IsolatedCommand" = ""%1" %*"
HKEY_CURRENT_USER\Software\Classes\[random]\shell\runas\command "(Default)" = ""%1" %*"
HKEY_CURRENT_USER\Software\Classes\[random]\shell\runas\command "IsolatedCommand" = ""%1" %*"
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command "(Default)" = "%LocalAppData%\[random].exe" -a "C:\Program Files\Mozilla Firefox\firefox.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\safemode\command "(Default)" = "%LocalAppData%\[random].exe" -a "C:\Program Files\Mozilla Firefox\firefox.exe" -safe-mode
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command "(Default)" = "%LocalAppData%\[random].exe" -a "C:\Program Files\Internet Explorer\iexplore.exe"

Remove Folders and Files
%CommonAppData%\[random]
%LocalAppData%\[random]
%LocalAppData%\[random].exe
%Temp%\[random]
%UserProfile%\Templates\[random]

Remove Vista Security Pro 2013

Vista Security Pro 2013 is a fake antivirus program created to urge the user to buy the full version of Vista Security Pro 2013 in order to earn some profit. Don't ever buy it as it is a cheat! Vista Security Pro 2013 install itself into the computer without confirmation of the users and it start automatically when the windows boot. Vista Security Pro 2013 produce fake virus warning alert consistently to force the user to purchase the full version so that to remove the malwares. Vista Security Pro 2013 is nothing more than a scam and plagiarized antispyware program

Vista Security Pro 2013 provide fake features such as Perform Scan, Internet Security, Personal Security, Proactive Defense, Firewall, Configuration, Complete PC Protection,  Automating Updating, Protection against bank account fraud, Self-protection from malware, Update Now, Scan Now etc. All of them cannot protect the computer from any kind of malware.

Vista Security Pro 2013 can be removed by using Emsisoft HiJackFree to stop the processes and kill the files from the hard drive. Then, the user has to restore the registry entries added and modified by Vista Security Pro 2013. Finally, all the file related to Vista Security Pro 2013 must be deleted from the hard drive. All of them has been shown in the removal guide below.

Vista Security Pro 2013 should be removed immediately!
Vista Security Pro 2013 Removal Guide
Kill Process
[random].exe

Delete Registry
KEY_CURRENT_USER\Software\Classes\.exe "(Default)" = "[random]"
HKEY_CURRENT_USER\Software\Classes\.exe\shell\open\command "(Default)" = "%LocalAppData%\[random].exe" -a "%1" %*"
HKEY_CURRENT_USER\Software\Classes\.exe\shell\open\command "IsolatedCommand" = ""%1" %*"
HKEY_CURRENT_USER\Software\Classes\.exe\shell\runas\command "(Default)" = ""%1" %*"
HKEY_CURRENT_USER\Software\Classes\.exe\shell\runas\command "IsolatedCommand" = ""%1" %*"
HKEY_CURRENT_USER\Software\Classes\[random] "(Default)" = "Application"
HKEY_CURRENT_USER\Software\Classes\[random] "Content Type" = "application/x-msdownload"
HKEY_CURRENT_USER\Software\Classes\[random]\DefaultIcon "(Default)" = "%1"
HKEY_CURRENT_USER\Software\Classes\[random]\shell\open\command "(Default)" = ""%LocalAppData%\[random].exe" -a "%1" %*"
HKEY_CURRENT_USER\Software\Classes\[random]\shell\open\command "IsolatedCommand" = ""%1" %*"
HKEY_CURRENT_USER\Software\Classes\[random]\shell\runas\command "(Default)" = ""%1" %*"
HKEY_CURRENT_USER\Software\Classes\[random]\shell\runas\command "IsolatedCommand" = ""%1" %*"
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command "(Default)" = "%LocalAppData%\[random].exe" -a "C:\Program Files\Mozilla Firefox\firefox.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\safemode\command "(Default)" = "%LocalAppData%\[random].exe" -a "C:\Program Files\Mozilla Firefox\firefox.exe" -safe-mode
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command "(Default)" = "%LocalAppData%\[random].exe" -a "C:\Program Files\Internet Explorer\iexplore.exe"

Remove Folders and Files
%CommonAppData%\[random]
%LocalAppData%\[random]
%LocalAppData%\[random].exe
%Temp%\[random]
%UserProfile%\Templates\[random]

Remove Win 7 Antivirus Pro 2013

Win 7 Antivirus Pro 2013 is a fake antivirus program created to urge the user to buy the full version of Win 7 Antivirus Pro 2013 in order to earn some profit. Don't ever buy it as it is a cheat! Win 7 Antivirus Pro 2013 install itself into the computer without confirmation of the users and it start automatically when the windows boot. Win 7 Antivirus Pro 2013 produce fake virus warning alert consistently to force the user to purchase the full version so that to remove the malwares. Win 7 Antivirus Pro 2013 is nothing more than a scam and plagiarized antispyware program

Win 7 Antivirus Pro 2013 provide fake features such as Perform Scan, Internet Security, Personal Security, Proactive Defense, Firewall, Configuration, Complete PC Protection,  Automating Updating, Protection against bank account fraud, Self-protection from malware, Update Now, Scan Now etc. All of them cannot protect the computer from any kind of malware.

Win 7 Antivirus Pro 2013 can be removed by using Emsisoft HiJackFree to stop the processes and kill the files from the hard drive. Then, the user has to restore the registry entries added and modified by Win 7 Antivirus Pro 2013. Finally, all the file related to Win 7 Antivirus Pro 2013 must be deleted from the hard drive. All of them has been shown in the removal guide below.

Win 7 Antivirus Pro 2013 should be removed immediately!
Win 7 Antivirus Pro 2013 Removal Guide
Kill Process
[random].exe

Delete Registry
KEY_CURRENT_USER\Software\Classes\.exe "(Default)" = "[random]"
HKEY_CURRENT_USER\Software\Classes\.exe\shell\open\command "(Default)" = "%LocalAppData%\[random].exe" -a "%1" %*"
HKEY_CURRENT_USER\Software\Classes\.exe\shell\open\command "IsolatedCommand" = ""%1" %*"
HKEY_CURRENT_USER\Software\Classes\.exe\shell\runas\command "(Default)" = ""%1" %*"
HKEY_CURRENT_USER\Software\Classes\.exe\shell\runas\command "IsolatedCommand" = ""%1" %*"
HKEY_CURRENT_USER\Software\Classes\[random] "(Default)" = "Application"
HKEY_CURRENT_USER\Software\Classes\[random] "Content Type" = "application/x-msdownload"
HKEY_CURRENT_USER\Software\Classes\[random]\DefaultIcon "(Default)" = "%1"
HKEY_CURRENT_USER\Software\Classes\[random]\shell\open\command "(Default)" = ""%LocalAppData%\[random].exe" -a "%1" %*"
HKEY_CURRENT_USER\Software\Classes\[random]\shell\open\command "IsolatedCommand" = ""%1" %*"
HKEY_CURRENT_USER\Software\Classes\[random]\shell\runas\command "(Default)" = ""%1" %*"
HKEY_CURRENT_USER\Software\Classes\[random]\shell\runas\command "IsolatedCommand" = ""%1" %*"
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command "(Default)" = "%LocalAppData%\[random].exe" -a "C:\Program Files\Mozilla Firefox\firefox.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\safemode\command "(Default)" = "%LocalAppData%\[random].exe" -a "C:\Program Files\Mozilla Firefox\firefox.exe" -safe-mode
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command "(Default)" = "%LocalAppData%\[random].exe" -a "C:\Program Files\Internet Explorer\iexplore.exe"

Remove Folders and Files
%CommonAppData%\[random]
%LocalAppData%\[random]
%LocalAppData%\[random].exe
%Temp%\[random]
%UserProfile%\Templates\[random]

Remove Vista Antivirus Pro 2013

Vista Antivirus Pro 2013 is a fake antivirus program created to urge the user to buy the full version of Vista Antivirus Pro 2013 in order to earn some profit. Don't ever buy it as it is a cheat! Vista Antivirus Pro 2013 install itself into the computer without confirmation of the users and it start automatically when the windows boot. Vista Antivirus Pro 2013 produce fake virus warning alert consistently to force the user to purchase the full version so that to remove the malwares. Vista Antivirus Pro 2013 is nothing more than a scam and plagiarized antispyware program

Vista Antivirus Pro 2013 provide fake features such as Perform Scan, Internet Security, Personal Security, Proactive Defense, Firewall, Configuration, Complete PC Protection,  Automating Updating, Protection against bank account fraud, Self-protection from malware, Update Now, Scan Now etc. All of them cannot protect the computer from any kind of malware.

Vista Antivirus Pro 2013 can be removed by using Emsisoft HiJackFree to stop the processes and kill the files from the hard drive. Then, the user has to restore the registry entries added and modified by Vista Antivirus Pro 2013. Finally, all the file related to Vista Antivirus Pro 2013 must be deleted from the hard drive. All of them has been shown in the removal guide below.

Vista Antivirus Pro 2013 should be removed immediately!
Vista Antivirus Pro 2013 Removal Guide
Kill Process
[random].exe

Delete Registry
KEY_CURRENT_USER\Software\Classes\.exe "(Default)" = "[random]"
HKEY_CURRENT_USER\Software\Classes\.exe\shell\open\command "(Default)" = "%LocalAppData%\[random].exe" -a "%1" %*"
HKEY_CURRENT_USER\Software\Classes\.exe\shell\open\command "IsolatedCommand" = ""%1" %*"
HKEY_CURRENT_USER\Software\Classes\.exe\shell\runas\command "(Default)" = ""%1" %*"
HKEY_CURRENT_USER\Software\Classes\.exe\shell\runas\command "IsolatedCommand" = ""%1" %*"
HKEY_CURRENT_USER\Software\Classes\[random] "(Default)" = "Application"
HKEY_CURRENT_USER\Software\Classes\[random] "Content Type" = "application/x-msdownload"
HKEY_CURRENT_USER\Software\Classes\[random]\DefaultIcon "(Default)" = "%1"
HKEY_CURRENT_USER\Software\Classes\[random]\shell\open\command "(Default)" = ""%LocalAppData%\[random].exe" -a "%1" %*"
HKEY_CURRENT_USER\Software\Classes\[random]\shell\open\command "IsolatedCommand" = ""%1" %*"
HKEY_CURRENT_USER\Software\Classes\[random]\shell\runas\command "(Default)" = ""%1" %*"
HKEY_CURRENT_USER\Software\Classes\[random]\shell\runas\command "IsolatedCommand" = ""%1" %*"
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command "(Default)" = "%LocalAppData%\[random].exe" -a "C:\Program Files\Mozilla Firefox\firefox.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\safemode\command "(Default)" = "%LocalAppData%\[random].exe" -a "C:\Program Files\Mozilla Firefox\firefox.exe" -safe-mode
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command "(Default)" = "%LocalAppData%\[random].exe" -a "C:\Program Files\Internet Explorer\iexplore.exe"

Remove Folders and Files
%CommonAppData%\[random]
%LocalAppData%\[random]
%LocalAppData%\[random].exe
%Temp%\[random]
%UserProfile%\Templates\[random]