Lots Of Pup Files And Firefox Hijacking Probs

Hi!

I did all the READ ME FIRST requirements and have attached logs. I'm running Windows 7 Home Premium on a Dell Inspiron N7110 64-bit OS and I use only Firefox. I accidentally fell for the Urgent Firefox Patch - I ALWAYS look at the URL, but for some reason I clicked to download it and now have hijacking probs as well as some other probs for a while. After running all the tools as required, I saw all sorts of PUP files. Can someone look at my log files and tell me what to do? I also tried running Spyhunter and I see it seemed to also add some PUP files. I uninstalled it, then ran Spybot-S&D, then I decided to ask you guys for help since in the past you've always been able to help me! I do know some stuff but touching sensitive registry files is a BIG no-no for me unless I ask someone first.

Thanx for any suggestions/help you can provide!

Dawn (ferretlady3)

 

Ok, I finished all the instructions above but had a few probs. When running JRT got an error message - see attached JPG. I just clicked "OK" and it finished. When running AdwCleaner I did NOT uncheck anything - I only got the log file and closed (was this correct?). Then when running ZHPCleaner it asked to do a scan first (which I did), then clicked repair. When running Rogue Killer I keep getting an error message (see attached JPG) and I just canceled it. Then after running RogueKiller and removing all the files listed below, it did not leave a log file on my desktop for some reason. I DID find a json file in my C:\ProgramData\RogueKiller\Logs folder and there was one dated for the first scan so I saved that. Since I was unable to open it, I looked for a free program to open a json file and found "File Viewer Plus 2" so I downloaded the program and opened the file which would only save as an rtf file so I opened it w/Word and resaved as a txt file. Not sure if this is what you need, but I attached it named RKreport_SCN_10162016_113946.txt which is how I originally found it in my C drive.

Also since I finished running all the programs now my Abobe CS2 GoLive program won't open. Photoshop, Illustrator and InDesign are all working, but since I have my biz on a website, I need the GoLive program to open and change my web pages. Guess I'll just re-install CS2. It does take a bit or work to get it to run on Win7 since it's really a 32-bit program but I prefer to keep using it cuz I know where everything is that I need.

Ok, log files are attached as well as error mess jpgs.

Hope I'm not being stupid here! I'm usually VERY careful what I download and always check the 'custom' tab to be sure I uncheck any other crap that'll be added w/an update or download. I also use Zone Alarm Security Suite and I have always kept it updated as well as running. It's caught a LOT of stuff! I've been using it for yrs ever since someone hacked my PayPal account! It caught a TON of pings to my PC after I first installed it and I like it VERY much!

Thanx again and looks like I'll need to add the rest of the files in another post.

Dawn

 

Here's the rest of the files!

 

Ok, I didn't find
C:\Users\ow\AppData\Local\blekkotb
but I did find it here:
C:\Users\ow\AppData\Roaming\ZHP\Quarantine
I sent you the rest files including the ZHPCleaner.txt file. I was only able to send 5 files at one time. Also, no C:\SearchProtect but that one was also in C:\Users\ow\AppData\Roaming\ZHP\Quarantine
I deleted both from the quarantine file and I just attached the RK second run file too. I copied the highlighted text and saved as you suggested, but I'll let you look at the second RK file that I forgot to attach as well.

 

Ok and the registry files did save successfully!

 

Rerunning Hitman Pro now

 

Oh, I keep getting an error message from my Zone Alarm. I've tried to capture it or write it down but it's only up briefly, then disappears. I'll use my SnagIt next time it comes up. It's saying something about something in the registry is keeping it from making some sort of change (?) I THINK. Lots of writing and I don't even have time to read all of it before it just goes away!

 

Last run of Hitman Pro

 

Sorry I was in a bad accident w/my car and have been trying to get everything taken care of. I copied and saved the info above named fixME.reg, turned off Zone Alarm and then double clicked it. Got the message that it was completed. I tried to attach the jpg, but it won't let me attach any more files. It reads: The keys and values contained in C:\\users\ow\Desktop\fixME.reg have been successfully added to the registry.

Then I re-ran Hitman Pro. Not sure how to attach the log file. Maybe I'll try replying again and it will let me reload it. So far no more issues w/Zone Alarm messages.

 

I just ran Hitman Pro but I can't seem to attache it. It doesn't have the "Attach file" listed below so I will upload it to my website and I think I can attach it from there. Actually I think I can also attach the jpg that it uploaded ok.

 

I keep trying to upload the 2 files but seem to be unable to do so. Why is the Upload file link not showing on my posts?

 

Just copied the whole HitmanPro file:

Code:

HitmanPro 3.7.14.280
www.hitmanpro.com

  Computer name . . . . : OW-PC
  Windows . . . . . . . : 6.1.1.7601.X64/4
  User name . . . . . . : ow-PC\ow
  UAC . . . . . . . . . : Disabled
  License . . . . . . . : Trial (Expired)

  Scan date . . . . . . : 2016-10-22 20:20:48
  Scan mode . . . . . . : Normal
  Scan duration . . . . : 13m 6s
  Disk access mode  . . : Direct disk access (SRB)
  Cloud . . . . . . . . : Internet
  Reboot  . . . . . . . : No

  Threats . . . . . . . : 33
  Traces  . . . . . . . : 42

  Objects scanned . . . : 2,259,532
  Files scanned . . . . : 125,181
  Remnants scanned  . . : 629,749 files / 1,504,602 keys

Malware remnants ____________________________________________________________

  HKLM\SOFTWARE\Classes\Interface\{02F878DF-E2BE-4B85-8CB4-A0D2D4E2ED7F}\ (FindWide)
  HKLM\SOFTWARE\Classes\Interface\{2AF343DD-3102-4F9D-AC95-DCA4C95382C7}\ (FindWide)
  HKLM\SOFTWARE\Classes\Interface\{3137BC14-D8D7-4B67-8FFA-2E0B2E9D541B}\ (FindWide)
  HKLM\SOFTWARE\Classes\Interface\{4CA2AC92-971B-47B1-ACB6-357B552155AC}\ (FindWide)
  HKLM\SOFTWARE\Classes\Interface\{52C5395B-1FCD-47FA-A834-FD830701C2D5}\ (FindWide)
  HKLM\SOFTWARE\Classes\Interface\{5D3DCC39-9233-4330-94E9-DA92BE49CA1A}\ (FindWide)
  HKLM\SOFTWARE\Classes\Interface\{615FACDF-DADB-440D-AC91-8AAB0AE9E3AD}\ (FindWide)
  HKLM\SOFTWARE\Classes\Interface\{655847A1-FA36-46ED-923B-A5CD523696EA}\ (FindWide)
  HKLM\SOFTWARE\Classes\Interface\{762D463B-C45A-456D-A80D-8689C297C91E}\ (FindWide)
  HKLM\SOFTWARE\Classes\Interface\{7A6BE473-7960-44D0-BD54-D23DA76353DF}\ (FindWide)
  HKLM\SOFTWARE\Classes\Interface\{803F550E-BAAE-42BB-8917-64BA0006AB17}\ (FindWide)
  HKLM\SOFTWARE\Classes\Interface\{8D5BC51D-C9D3-43B9-B728-B30677B7C7E8}\ (FindWide)
  HKLM\SOFTWARE\Classes\Interface\{991C9D8D-A789-4DB9-BDFC-5F33398B04BF}\ (FindWide)
  HKLM\SOFTWARE\Classes\Interface\{A5ACC874-D943-483F-A2D1-14598D51F872}\ (FindWide)
  HKLM\SOFTWARE\Classes\Interface\{B0474212-0D9D-4361-90B3-B89D1A44275D}\ (FindWide)
  HKLM\SOFTWARE\Classes\Interface\{BFDE183A-C6FE-41D2-80F9-586C29210AC2}\ (FindWide)
  HKLM\SOFTWARE\Classes\Interface\{D83C83BF-3EDD-4410-ADAB-5295116DD8C7}\ (FindWide)
  HKLM\SOFTWARE\Classes\Interface\{DD260902-9420-4055-A956-9152EB4F3E6A}\ (FindWide)
  HKLM\SOFTWARE\Classes\Interface\{EB1F9F3C-5526-4DAE-BD4B-3EAA7715DA9F}\ (FindWide)
  HKLM\SOFTWARE\Classes\Interface\{EBBC143E-44AC-4B9C-BCCE-9A0E42921F2A}\ (FindWide)
  HKLM\SOFTWARE\Classes\Interface\{F68DC16C-9C2B-455B-8853-7E4D34BAA3F4}\ (FindWide)
  HKLM\SOFTWARE\Classes\Interface\{FBA8498F-B3A0-4942-A2BF-E0CB7BC7E000}\ (FindWide)
  HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{2AF343DD-3102-4F9D-AC95-DCA4C95382C7}\ (FindWide)
  HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{3137BC14-D8D7-4B67-8FFA-2E0B2E9D541B}\ (FindWide)
  HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{4CA2AC92-971B-47B1-ACB6-357B552155AC}\ (FindWide)
  HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{5D3DCC39-9233-4330-94E9-DA92BE49CA1A}\ (FindWide)
  HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{615FACDF-DADB-440D-AC91-8AAB0AE9E3AD}\ (FindWide)
  HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{655847A1-FA36-46ED-923B-A5CD523696EA}\ (FindWide)
  HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{A5ACC874-D943-483F-A2D1-14598D51F872}\ (FindWide)
  HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{B0474212-0D9D-4361-90B3-B89D1A44275D}\ (FindWide)
  HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{BFDE183A-C6FE-41D2-80F9-586C29210AC2}\ (FindWide)
  HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{DD260902-9420-4055-A956-9152EB4F3E6A}\ (FindWide)
  HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{FBA8498F-B3A0-4942-A2BF-E0CB7BC7E000}\ (FindWide)

Potential Unwanted Programs _________________________________________________

  HKLM\SOFTWARE\Classes\AppID\escorTlbr.DLL\ (Funmoods)
  HKLM\SOFTWARE\Classes\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}\ (Funmoods)
  HKLM\SOFTWARE\Classes\c\ (Claro)
  HKLM\SOFTWARE\Classes\Interface\{F1912128-469A-4138-AA26-9699C15BB13E}\ (eShield)
  HKLM\SOFTWARE\Classes\Wow6432Node\AppID\escorTlbr.DLL\ (Funmoods)
  HKLM\SOFTWARE\Classes\Wow6432Node\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}\ (Funmoods)
  HKU\S-1-5-21-1009334687-539450264-314055710-1000\Software\Classes\Wow6432Node\CLSID\{bebbc426-4f16-4567-8fe1-be198c982027}\ (Speedial)
  HKU\S-1-5-21-1009334687-539450264-314055710-1000\Software\IM\ (Sweetpacks)
  HKU\S-1-5-21-1009334687-539450264-314055710-1000_Classes\Wow6432Node\CLSID\{bebbc426-4f16-4567-8fe1-be198c982027}\ (Speedial)

Oh and my Zone Alarm is again coming up w/an error message.

 

FINALLY got the Zone Alarm error message!


So it looks like a CCleaner issue? Should I remove CCleaner and reinstall it?

 

I've downloaded and ran OTM. Actually, after my PC rebooted Notepad came up with the log files in it so I just saved it. No need to have to go and look for it! Then reran Hitman Pro. UAC is still off and I also turned off Zone Alarm for running Hitman Pro.

Oh, and yes, I use Firefox so I guess that's why it won't show the 'attach' link.

Here is the OTM log info:
All processes killed
========== REGISTRY ==========
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{02F878DF-E2BE-4B85-8CB4-A0D2D4E2ED7F}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02F878DF-E2BE-4B85-8CB4-A0D2D4E2ED7F}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2AF343DD-3102-4F9D-AC95-DCA4C95382C7}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2AF343DD-3102-4F9D-AC95-DCA4C95382C7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3137BC14-D8D7-4B67-8FFA-2E0B2E9D541B}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3137BC14-D8D7-4B67-8FFA-2E0B2E9D541B}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4CA2AC92-971B-47B1-ACB6-357B552155AC}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4CA2AC92-971B-47B1-ACB6-357B552155AC}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{52C5395B-1FCD-47FA-A834-FD830701C2D5}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{52C5395B-1FCD-47FA-A834-FD830701C2D5}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5D3DCC39-9233-4330-94E9-DA92BE49CA1A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5D3DCC39-9233-4330-94E9-DA92BE49CA1A}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{615FACDF-DADB-440D-AC91-8AAB0AE9E3AD}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{615FACDF-DADB-440D-AC91-8AAB0AE9E3AD}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{655847A1-FA36-46ED-923B-A5CD523696EA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{655847A1-FA36-46ED-923B-A5CD523696EA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{762D463B-C45A-456D-A80D-8689C297C91E}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{762D463B-C45A-456D-A80D-8689C297C91E}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7A6BE473-7960-44D0-BD54-D23DA76353DF}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7A6BE473-7960-44D0-BD54-D23DA76353DF}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{803F550E-BAAE-42BB-8917-64BA0006AB17}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{803F550E-BAAE-42BB-8917-64BA0006AB17}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8D5BC51D-C9D3-43B9-B728-B30677B7C7E8}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8D5BC51D-C9D3-43B9-B728-B30677B7C7E8}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{991C9D8D-A789-4DB9-BDFC-5F33398B04BF}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{991C9D8D-A789-4DB9-BDFC-5F33398B04BF}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A5ACC874-D943-483F-A2D1-14598D51F872}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A5ACC874-D943-483F-A2D1-14598D51F872}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B0474212-0D9D-4361-90B3-B89D1A44275D}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B0474212-0D9D-4361-90B3-B89D1A44275D}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BFDE183A-C6FE-41D2-80F9-586C29210AC2}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BFDE183A-C6FE-41D2-80F9-586C29210AC2}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D83C83BF-3EDD-4410-ADAB-5295116DD8C7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D83C83BF-3EDD-4410-ADAB-5295116DD8C7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DD260902-9420-4055-A956-9152EB4F3E6A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DD260902-9420-4055-A956-9152EB4F3E6A}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EB1F9F3C-5526-4DAE-BD4B-3EAA7715DA9F}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EB1F9F3C-5526-4DAE-BD4B-3EAA7715DA9F}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EBBC143E-44AC-4B9C-BCCE-9A0E42921F2A}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EBBC143E-44AC-4B9C-BCCE-9A0E42921F2A}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F68DC16C-9C2B-455B-8853-7E4D34BAA3F4}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F68DC16C-9C2B-455B-8853-7E4D34BAA3F4}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FBA8498F-B3A0-4942-A2BF-E0CB7BC7E000}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FBA8498F-B3A0-4942-A2BF-E0CB7BC7E000}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2AF343DD-3102-4F9D-AC95-DCA4C95382C7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2AF343DD-3102-4F9D-AC95-DCA4C95382C7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3137BC14-D8D7-4B67-8FFA-2E0B2E9D541B}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3137BC14-D8D7-4B67-8FFA-2E0B2E9D541B}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4CA2AC92-971B-47B1-ACB6-357B552155AC}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4CA2AC92-971B-47B1-ACB6-357B552155AC}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5D3DCC39-9233-4330-94E9-DA92BE49CA1A}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5D3DCC39-9233-4330-94E9-DA92BE49CA1A}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{615FACDF-DADB-440D-AC91-8AAB0AE9E3AD}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{615FACDF-DADB-440D-AC91-8AAB0AE9E3AD}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{655847A1-FA36-46ED-923B-A5CD523696EA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{655847A1-FA36-46ED-923B-A5CD523696EA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{A5ACC874-D943-483F-A2D1-14598D51F872}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A5ACC874-D943-483F-A2D1-14598D51F872}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B0474212-0D9D-4361-90B3-B89D1A44275D}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B0474212-0D9D-4361-90B3-B89D1A44275D}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{BFDE183A-C6FE-41D2-80F9-586C29210AC2}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BFDE183A-C6FE-41D2-80F9-586C29210AC2}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DD260902-9420-4055-A956-9152EB4F3E6A}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DD260902-9420-4055-A956-9152EB4F3E6A}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FBA8498F-B3A0-4942-A2BF-E0CB7BC7E000}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FBA8498F-B3A0-4942-A2BF-E0CB7BC7E000}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\escorTlbr.DLL\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\c\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F1912128-469A-4138-AA26-9699C15BB13E}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F1912128-469A-4138-AA26-9699C15BB13E}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\AppID\escorTlbr.DLL\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}\ not found.
Registry key HKEY_USERS\S-1-5-21-1009334687-539450264-314055710-1000\Software\Classes\Wow6432Node\CLSID\{bebbc426-4f16-4567-8fe1-be198c982027}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{bebbc426-4f16-4567-8fe1-be198c982027}\ not found.
Registry key HKEY_USERS\S-1-5-21-1009334687-539450264-314055710-1000_Classes\Wow6432Node\CLSID\{bebbc426-4f16-4567-8fe1-be198c982027}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{bebbc426-4f16-4567-8fe1-be198c982027}\ not found.
========== COMMANDS ==========
[EMPTYTEMP]
User: All Users
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 56475 bytes
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
User: ow
->Temp folder emptied: 26678415 bytes
->Temporary Internet Files folder emptied: 42376792 bytes
->Java cache emptied: 48084 bytes
->FireFox cache emptied: 372617957 bytes
->Flash cache emptied: 58948 bytes
User: Public
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 113219 bytes
%systemroot%\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 39068 bytes
%systemroot%\system32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment folder emptied: 753 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 42304676 bytes
%systemroot%\sysnative\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment folder emptied: 749 bytes
RecycleBin emptied: 499518900 bytes
Total Files Cleaned = 938.00 mb
OTM by OldTimer - Version 3.1.21.0 log created on 10242016_153854

Files moved on Reboot...
C:\Users\ow\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
C:\Users\ow\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat moved successfully.
File move failed. C:\Windows\SysWow64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat scheduled to be moved on reboot.
File move failed. C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat scheduled to be moved on reboot.

Registry entries deleted on Reboot...

And here is the Hitman Pro log info:

Code:

HitmanPro 3.7.14.280
www.hitmanpro.com

  Computer name . . . . : OW-PC
  Windows . . . . . . . : 6.1.1.7601.X64/4
  User name . . . . . . : ow-PC\ow
  UAC . . . . . . . . . : Disabled
  License . . . . . . . : Trial (Expired)

  Scan date . . . . . . : 2016-10-24 17:50:44
  Scan mode . . . . . . : Normal
  Scan duration . . . . : 8m 37s
  Disk access mode  . . : Direct disk access (SRB)
  Cloud . . . . . . . . : Internet
  Reboot  . . . . . . . : No

  Threats . . . . . . . : 22
  Traces  . . . . . . . : 24

  Objects scanned . . . : 2,213,530
  Files scanned . . . . : 113,040
  Remnants scanned  . . : 591,767 files / 1,508,723 keys

Malware remnants ____________________________________________________________

  HKLM\SOFTWARE\Classes\Interface\{02F878DF-E2BE-4B85-8CB4-A0D2D4E2ED7F}\ (FindWide)
  HKLM\SOFTWARE\Classes\Interface\{2AF343DD-3102-4F9D-AC95-DCA4C95382C7}\ (FindWide)
  HKLM\SOFTWARE\Classes\Interface\{3137BC14-D8D7-4B67-8FFA-2E0B2E9D541B}\ (FindWide)
  HKLM\SOFTWARE\Classes\Interface\{4CA2AC92-971B-47B1-ACB6-357B552155AC}\ (FindWide)
  HKLM\SOFTWARE\Classes\Interface\{52C5395B-1FCD-47FA-A834-FD830701C2D5}\ (FindWide)
  HKLM\SOFTWARE\Classes\Interface\{5D3DCC39-9233-4330-94E9-DA92BE49CA1A}\ (FindWide)
  HKLM\SOFTWARE\Classes\Interface\{615FACDF-DADB-440D-AC91-8AAB0AE9E3AD}\ (FindWide)
  HKLM\SOFTWARE\Classes\Interface\{655847A1-FA36-46ED-923B-A5CD523696EA}\ (FindWide)
  HKLM\SOFTWARE\Classes\Interface\{762D463B-C45A-456D-A80D-8689C297C91E}\ (FindWide)
  HKLM\SOFTWARE\Classes\Interface\{7A6BE473-7960-44D0-BD54-D23DA76353DF}\ (FindWide)
  HKLM\SOFTWARE\Classes\Interface\{803F550E-BAAE-42BB-8917-64BA0006AB17}\ (FindWide)
  HKLM\SOFTWARE\Classes\Interface\{8D5BC51D-C9D3-43B9-B728-B30677B7C7E8}\ (FindWide)
  HKLM\SOFTWARE\Classes\Interface\{991C9D8D-A789-4DB9-BDFC-5F33398B04BF}\ (FindWide)
  HKLM\SOFTWARE\Classes\Interface\{A5ACC874-D943-483F-A2D1-14598D51F872}\ (FindWide)
  HKLM\SOFTWARE\Classes\Interface\{B0474212-0D9D-4361-90B3-B89D1A44275D}\ (FindWide)
  HKLM\SOFTWARE\Classes\Interface\{BFDE183A-C6FE-41D2-80F9-586C29210AC2}\ (FindWide)
  HKLM\SOFTWARE\Classes\Interface\{D83C83BF-3EDD-4410-ADAB-5295116DD8C7}\ (FindWide)
  HKLM\SOFTWARE\Classes\Interface\{DD260902-9420-4055-A956-9152EB4F3E6A}\ (FindWide)
  HKLM\SOFTWARE\Classes\Interface\{EB1F9F3C-5526-4DAE-BD4B-3EAA7715DA9F}\ (FindWide)
  HKLM\SOFTWARE\Classes\Interface\{EBBC143E-44AC-4B9C-BCCE-9A0E42921F2A}\ (FindWide)
  HKLM\SOFTWARE\Classes\Interface\{F68DC16C-9C2B-455B-8853-7E4D34BAA3F4}\ (FindWide)
  HKLM\SOFTWARE\Classes\Interface\{FBA8498F-B3A0-4942-A2BF-E0CB7BC7E000}\ (FindWide)

Potential Unwanted Programs _________________________________________________

  HKLM\SOFTWARE\Classes\Interface\{F1912128-469A-4138-AA26-9699C15BB13E}\ (eShield)
  HKU\S-1-5-21-1009334687-539450264-314055710-1000\Software\IM\ (Sweetpacks)

I'm going to reboot and try the CCleaner issue now.

 

The suggestion for the CCleaner worked!! No more error message!!

I'm GETTING there! Now I just have to reinstall my Adobe CS2 as the GoLive keeps coming up w/an error message and it closes down. I'm refuse to upgrade to CS6 for a 64bit OS as I know there's work arounds to get CS2 to work on my machine and I know GoLive well - don't want to have to learn Dreamweaver! Just don't have the time as my website store needs daily changes and the new 2017 designs are coming out Nov 1st so I jut don't have the time either. GoLive works jut fine for what I do! I have a question into another site for the work around since I don't remember it and my written instructions are pretty jumbled.

Thanx!!!

Dawn

 

Ran ADWC twice as suggested (actually it had me download a new version because it told me mine was outdated). Both logs are attached (using Internet Exporer to add the logs) and then ran Hitman Pro (still found stuff!) and log is also attached.

Also now have a new error message attached as jpg. I tried looking online for the driver named Nero.MobileSync.msi but haven't been able to find it yet. I guess when I DO find it, I'll need to put in in "C:\DELL\2y65v\install_files\applications\dellmobilesync" It opens jpgs without having to use Photoshop. Something to do w/SyncUp on my PC I guess.

 

Just ran the OTL and then re-ran Hitman Pro. Logs are attached but I still see they're still not gone! What if I manually go into the registry files and remove them? I know how to find them! I've been in the registry before - just follow the paths in the HitmanPro log. Won't be the first time I've manually removed stuff. As long as I have a log file to tell me exactly where to go, I won't have a problem. Oh and the CCleaner issue still comes up sometimes but I'm thinking what if I just reinstall CCleaner after I get rid of all this other stuff and tell it NOT to run in my task manager? As for the other MySyncUp prob, I've done some reading on it and it's not really something I need so I'm just going to remove it using my Control Panel. I can always just use Photoshop to view images. Usually if I want to open an image I'll be doing some sort of change to in in Photoshop anyway. I wasn't really sure what it was until I did the reading about the Nero Mobile Sync program anyway - now I know. AND I found a MUCH better way to install my Adobe CS2 software on Win7 (Cs2 is a 32 bit program but I found a better work around to make it run better on Win7's 64 bit platform - which is the main reason I came to MajorGeeks cuz my Golive program (OLD software, but I know it well and don't wanna spend $1000+ to upgrade plus relearn the newer version) and then the browser high-jacking issue was driving me CRAZY as well!

Should I MANUALLY remove those registry files?

Thanx SOOOOO much for all your help so far!!! Actually my PC is already running faster and starting up faster!! Didn't realize I had SOOOO many issues!

Dawn

 

Hi Kestrel13!

I manually removed the keys from the registry found all in the "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface" folder. I re-ran Hitman Pro after a reboot after removing the first set of keys but now I see it found 2 NEW keys in "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface" folder.

Should I also manually delete these? I'm going to ASK first because I don't wanna delete anything in the registry that I shouldn't!!

Thanx so much again for ALL your help!!!! I wouldn't have a clue as to what I should and SHOULD NOT be doing here! Seems everything is running pretty smoothly now too. I also removed CCleaner from starting up in my task bar so I'm not getting that error message any longer. All I'll need to do now (after possible removing the last 2 keys showing in the Hitman Pro log?) is to re-install Adobe CS2 so's my GoLive will work and I can get working on my website!!

Dawn

 

OK! FINALLY everything looks good! Nothing found w/Hitman Pro after I removed the last 2 reg keys. And my PC id running SOOOOOO much better too!!

So am I out of the woods? Or are there other test programs I should run?

 

Did everything as suggested above - and my Zone Alarm Internet Security Suite comes w/a Firewall so I think I'm covered. Now about the wireless router firewall, I have AT&T and I clicked on my connection box that shows in the task bar to the right. Under Security it has "Security type: WPA2-Personal" under "Encryption type: AES" under Network security key - there is my encrypted numbers and I have "Show characters" UN-checked. I'm thinking I should show the characters and right them down somewhere cuz I've never seen these before - in case I have future probs or something. I then clicked on the "Advanced settings" button and it reads "Enable Federal Information Processing Srtandards (FIPS) compliance for this network" and it is currently UNchecked. Should I leave it that way? And is everything set up correctly for my wireless router? I also reset my UAC manually (Control Panel, User Accounts and Family Safetly, User Accounts, Change User Account Control settings) since MGTools didn't seem to put it back to the default setting of "Don't notify me when I make changes to Windows settings". Maybe I should set this one to "Always notify"? Cuz I do go to unfamiliar sites when I'm doing a search (and I search for ANYTHING and EVERYTHING I want to find out about - BUT staying away from hacker AND porn sites for SURE!), but if I get to somewhere unsafe, usually either my Zone Alarm tells me or Firefox comes up saying something like "This is an unsafe site, Continue at your own risk (or something like that)" or there's a button that says "Get me out of here!" I normally choose the later UNLESS I KNOW it a reputable site that I've used before.

Was VERY surprised to read that Explorer IE is BETTER than Firefox?!?! Hmmmm… Considering switching now.

I have my Windows updates set to 'OFF' because I kept getting that "Windows 10 upgrade" notice in my systray and kept having to manually remove the "KB3035583" update. I do a Windows Update manually every 3 weeks and UNcheck that damn "Windows 10 upgrade" download cuz it bugs me that it's running in my systray! My Zone Alarm software update is always on and set to “hourly”.

I also removed RogueKiller from my Control Panel, Programs, list since I saw it was in there too. I prefer, if I have a problem, to install all the tools listed on the READ ME FIRST page as all fresh downloads.

I read the “How to protect yourself from Malware”, installed the latest version of Java (which I’m pretty sure I already had since last week I got a notification to update my Java) and downloaded/installed Autorun Eater. Was wondering tho, what did the directions mean to “You need to add the C:\Program Files\Autorun Eater\oldmcdonald.exe ( for x 64 >> C:\Program Files (x86)\Autorun Eater\oldmcdonald.exe ) file to the Ignorelist. Not sure what is meant by ‘to the Ignorelist’?

So I think I'm set? Unless I should change some of the settings I asked about above?

Dawn

 

Oh! Ok! Seems everything is running smoothly!!



THANK YOU SOOOOOOO VERY MUCH!!!

Dawn

 

Yikes! Looks like I have another problem now. I just tried to Uninstall Adobe CS2 from my Control Panel and it came up w/the following message - see attached. So I manually deleted it from "Computer, OS(C, Program Files (x86), Adobe CS2" and then there also was a version in "Computer, OS(C, Program Files, Adobe CS2". Both are now deleted. When trying to reinstall the program, it came up w/the same error message. Should I be posting this in another place? Or is this some sort of problem with the actual program I'm trying to install?

Dawn

 

Hmmm... I found the downloads online as Adobe is now giving CS2 away for free. Thinking I would get a 'higher'/'better' version than my original CD's. So I tried the originals and instead of running the Autoplay, I right clicked on the CD player to run the CD1 and I got all these error messages (see attached). Each error message appeared after I clicked "OK" to each one. So now is there something else wrong w/my registry files?

 

Ok, wasn't sure since it was showing error messages about registry files.

Thanx SOOOOO much again for all your help!

Dawn