Jump to content

Key Removal Help

ophelia_hall
 Share

Recommended Posts

ophelia_hall

ophelia_hall

Posted
Posted

So, after researching it appears as if I have the HappySales extension, and possibly other Malware issues. I had already deleted others prior to this, but I was unable to delete the current program. Malwarebytes helped clean up a few issues, but even after a full scan which lasted several hours it could not find anymore issues. I currently have AdwCleaner installed and it claims that various keys are in need of deletion. I am not knowledgeable enough to know which keys should be deleted or saved. I was hoping to get some answers from people who were more familiar with these issues. Here is a copy of my Registry keys Adw wants to get rid of:

 

***** [ Registry ] *****
 
Data Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyOverride] - <local>;192.168.*.*
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{4640FDE1-B83A-4376-84ED-86F86BEE2D41}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{4820778D-AB0D-6D18-C316-52A6A0E1D507}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{79A765E1-C399-405B-85AF-466F52E918B0}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{97BBECCF-B1FD-4010-8D4B-EFC9E3CCEECF}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{AD11DADE-C597-45D9-D8C5-1D2EB0B89613}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\conduitEngine
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{0974BA1E-64EC-11DE-B2A5-E43756D89593}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D4027C7F-154A-4066-A1AD-4243D8127440}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{0974BA1E-64EC-11DE-B2A5-E43756D89593}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
Key Found : HKLM\SOFTWARE\{12A61307-94CD-4F8E-94BC-918E511FAA81}
Key Found : HKLM\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}
Key Found : HKLM\SOFTWARE\cdba62c5-eb56-6ee5-0fa3-4738d70c4397
Key Found : HKLM\SOFTWARE\Classes\AppID\{A7DDCBDE-5C86-415C-8A37-763AE183E7E4}
Key Found : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
Key Found : HKLM\SOFTWARE\Classes\AppID\WMHelper.DLL
Key Found : HKLM\SOFTWARE\Classes\CLSID\{058F0E48-61CA-4964-9FBA-1978A1BB060D}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{0974BA1E-64EC-11DE-B2A5-E43756D89593}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{18F33C35-8EF2-40D7-8BA4-932B0121B472}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{27BF8F8D-58B8-D41C-F913-B7EEB57EF6F6}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{99066096-8989-4612-841F-621A01D54AD7}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{EEE6C35D-6118-11DC-9C72-001320C79847}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{FE9271F2-6EFD-44B0-A826-84C829536E93}
Key Found : HKLM\SOFTWARE\Classes\Prod.cap
Key Found : HKLM\SOFTWARE\Classes\Toolbar.CT2418376
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{41F978F3-431A-4464-A789-5C0692D562FB}
Key Found : HKLM\SOFTWARE\Classes\WMHelperiMesh.WMHelper
Key Found : HKLM\SOFTWARE\Classes\WMHelperiMesh.WMHelper.1
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EEE6C367-6118-11DC-9C72-001320C79847}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0E12F736682067FDE4D1158D5940A82E
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1A24B5BB8521B03E0C8D908F5ABC0AE6
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2B0D56C4F4C46D844A57FFED6F0D2852
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\49D4375FE41653242AEA4C969E4E65E0
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6AA0923513360135B272E8289C5F13FA
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6F7467AF8F29C134CBBAB394ECCFDE96
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\922525DCC5199162F8935747CA3D8E59
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BCDA179D619B91648538E3394CAC94CC
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D677B1A9671D4D4004F6F2A4469E86EA
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DD1402A9DD4215A43ABDE169A41AFA0E
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E36E114A0EAD2AD46B381D23AD69CDDF
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EF8E618DB3AEDFBB384561B5C548F65E
Key Found : HKU\.DEFAULT\Software\ImInstaller
 
 
If anyone can tell me what I should or shouldn't get rid of, I would be deeply grateful. If this fails to fix the issue, then I will create a separate topic involving the Farbar reports.
Link to post
Share on other sites
TwinHeadedEagle

TwinHeadedEagle

Posted
Posted

Hello,

    

 

They call me TwinHeadedEagle around here, and I'll try to help your with your issue.

 

     

    

Before we start please read and note the following:

  • We're primarily oriented on malware removal here, so you must know that some issues just cannot be solved and you must be prepared for this. Some tools we use here will remove your browser search history, so backup your important links and all the files whose loss is unacceptable.
  • Limit your internet access to posting here, some infections just wait to steal typed-in passwords.
  • Please be patient. I know it is frustrating when your PC isn't working properly, but malware removal takes time. Keep in mind that private life gets in the way too. Note that we may live in totally different time zones, what may cause some delays between answers.
  • Don't run any scripts or tools on your own, unsupervised usage may cause more harm than good.
  • Do not paste the logs in your posts, attachments make my work easier. There is a More reply options button, that gives you Upload Files option below which you can use to attach your reports. Always attach reports from all tools.
  • Always execute my instructions in given order. If for some reason you cannot completely follow one instruction, inform me about that.
  • Do not ask for help for your business PC. Companies are making revenue via computers, so it is good thing to pay someone to repair it.
  • If I don't hear from you within 3 days from this initial or any subsequent post, then this thread will be closed.
:excl: I can't foresee everything, so if anything not covered in my instructions happens, please stop and inform me!

:excl: There are no silly questions. Never be afraid to ask if in doubt!

 

 

 

  warning.gif Rules and policies

 

We won't support any piracy.

That being told, if any evidence of illegal OS, software, cracks/keygens or any other will be revealed, any further assistance will be suspended. If you are aware that there is this kind of stuff on your machine, remove it before proceeding!

The same applies to any use of P2P software: uTorrent, BitTorrent, Vuze, Kazaa, Ares... We don't provide any help for P2P, except for their removal. All P2P software has to be uninstalled or at least fully disabled before proceeding!

 

Failure to follow these guidelines will result with closing your topic and withdrawning any assistance.

 

 

Please download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them.

Only one of them will run on your system, that will be the right version.

  • Double-click to run it. When the tool opens click Yes to disclaimer.
  • Press Scan button.
  • It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
  • The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.
Link to post
Share on other sites
TwinHeadedEagle

TwinHeadedEagle

Posted
Posted

51a612a8b27e2-Zoek.png Scan with ZOEK

Please download ZOEK by Smeenk and save it to your desktop (preferred version is the *.exe one)

Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

  • Right-click on 51a612a8b27e2-Zoek.png icon and select RunAsAdmin.jpg Run as Administrator to start the tool.
  • Wait patiently until the main console will appear, it may take a minute or two.
  • In the main box please paste in the following script:

    createsrpoint;autoclean;emptyalltemp;ipconfig /flushdns;b
  • Make sure that Scan All Users option is checked.
  • Push Run Script and wait patiently. The scan may take a couple of minutes.
  • When the scan completes, a zoek-results logfile should open in notepad.
  • If a reboot is needed, it will be opened after it. You may also find it at your main drive (usually C:\ drive)
Post its content into your next reply.
Link to post
Share on other sites
ophelia_hall

ophelia_hall

Posted
  • Author
Posted
Here is the information given by the program you linked. Sorry for the wait!

 

Zoek.exe v5.0.0.0 Updated 08-April-2015

Tool run by Radio Star on Tue 04/21/2015 at 20:00:46.24.

Microsoft® Windows Vista™ Home Basic  6.0.6002 Service Pack 2 x86

Running in: Normal Mode Internet Access Detected

Launched: C:\Users\Radio Star\Downloads\zoek.exe [scan all users] [script inserted] 

 

==== System Restore Info ======================

 

4/21/2015 8:03:32 PM Zoek.exe System Restore Point Created Successfully.

 

==== Empty Folders Check ======================

 

C:\Program Files\epson deleted successfully

C:\Program Files\NCWest deleted successfully

C:\Program Files\SEGA deleted successfully

C:\Program Files\TomTom DesktopSuite deleted successfully

C:\Program Files\VideoLAN deleted successfully

C:\Program Files\Common Files\Symantec Shared deleted successfully

C:\PROGRA~2\Dumps deleted successfully

C:\PROGRA~2\Symantec deleted successfully

C:\Users\Radio Star\AppData\Roaming\QuickScan deleted successfully

C:\Users\Radio Star\AppData\Roaming\uTorrent deleted successfully

 

==== Deleting CLSID Registry Keys ======================

 

HKEY_USERS\S-1-5-21-3749791044-2603657649-1157988785-1001\Software\Microsoft\Internet Explorer\SearchScopes\{37498E4A-9119-48EA-A536-90055D041DB9} deleted successfully

HKEY_USERS\S-1-5-21-3749791044-2603657649-1157988785-1001\Software\Microsoft\Internet Explorer\SearchScopes\{6C394565-2D87-4640-9DF4-226F331F0B76} deleted successfully

HKEY_USERS\S-1-5-21-3749791044-2603657649-1157988785-1001\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8E66592B-8E7C-4A14-88A5-8BF21032F651} deleted successfully

HKEY_USERS\S-1-5-21-3749791044-2603657649-1157988785-1001\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B4256A73-837C-4195-BD10-0ADEE51BEFF6} deleted successfully

HKEY_USERS\S-1-5-21-3749791044-2603657649-1157988785-1001\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0A900DF-9611-4446-86BD-4B1D47E7DB2A} deleted successfully

HKEY_USERS\S-1-5-21-3749791044-2603657649-1157988785-1001\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{FFB06D79-D749-4094-9418-62609762F2F9} deleted successfully

 

==== Deleting CLSID Registry Values ======================

 

 

==== Deleting Services ======================

 

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\wltrysvc deleted successfully

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wltrysvc deleted successfully

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Eventlog\Application\wltrysvc deleted successfully

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\wltrysvc deleted successfully

 

==== FireFox Fix ======================

 

ProfilePath: C:\Users\RADIOS~1\AppData\Roaming\Mozilla\Firefox\Profiles\c3782g0p.default

 

user.js not found

---- Lines extensions.AGM5598RjntnfCcY removed from prefs.js ----

user_pref("extensions.AGM5598RjntnfCcY.epoch", "1426652736");


---- Lines extensions.Nx9nY8o4N2iHZ6hI removed from prefs.js ----

user_pref("extensions.Nx9nY8o4N2iHZ6hI.epoch", "1426652735");


---- FireFox user.js and prefs.js backups ---- 

 

prefs_20150421_0821_.backup

 

ProfilePath: C:\Users\RADIOS~1\AppData\Roaming\TomTom\HOME\Profiles\myflghu4.default

 

user.js not found

---- FireFox user.js and prefs.js backups ---- 

 

prefs_20150421_0821_.backup

 

==== Batch Command(s) Run By Tool======================

 

 

==== Deleting Files \ Folders ======================

 

C:\Program Files\epson not found

C:\Program Files\NCWest not found

C:\Program Files\SEGA not found

C:\Program Files\TomTom DesktopSuite not found

C:\Program Files\VideoLAN not found

C:\PROGRA~2\iemfiemmfbpeodmblmhmkdpaechfbnbb deleted

C:\PROGRA~2\{a21eb6eb-a092-c091-a21e-eb6eba09dbae} deleted

C:\PROGRA~2\8378752446505119266 deleted

C:\PROGRA~2\Overwolf deleted

C:\Users\Radio Star\AppData\Roaming\appdataFr3.bin deleted

C:\PROGRA~2\UpdaterLog.txt deleted

C:\PROGRA~2\SPL3151.tmp deleted

C:\PROGRA~2\SPLA211.tmp deleted

C:\PROGRA~2\hash.dat deleted

C:\PROGRA~2\Yahoo! deleted

C:\PROGRA~2\Package Cache deleted

C:\Users\Radio Star\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMVU.lnk deleted

C:\Users\Radio Star\AppData\LocalLow\bearsharetb deleted

C:\Windows\system32\config\systemprofile\AppData\LocalLow\AVG Security Toolbar deleted

C:\Windows\wininit.ini deleted

C:\Windows\tasks\iMeshNAG.job deleted

C:\Windows\system32\config\systemprofile\Searches deleted

C:\Windows\System32\AI_RecycleBin deleted

 

==== Firefox Start and Search pages ======================

 

ProfilePath: C:\Users\RADIOS~1\AppData\Roaming\Mozilla\Firefox\Profiles\c3782g0p.default

user_pref("browser.search.defaultenginename", "Yahoo!");

user_pref("browser.search.selectedEngine", "Yahoo!");

 

==== Firefox Extensions Registry ======================

 

[HKEY_LOCAL_MACHINE\Software\Mozilla\Firefox\Extensions]

"{DF153AFF-6948-45d7-AC98-4FC4AF8A08E2}"="C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext" [12/24/2013 06:25 PM]

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Mozilla\Firefox\Extensions]

"{7D4F1959-3F72-49d5-8E59-F02F8AA6815D}"="C:\Program Files\Updater By SweetPacks\Firefox" []

 

==== Firefox Extensions ======================

 

ProfilePath: C:\Users\RADIOS~1\AppData\Roaming\Mozilla\Firefox\Profiles\c3782g0p.default

- RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext

 

ProfilePath: C:\Users\RADIOS~1\AppData\Roaming\TomTom\HOME\Profiles\myflghu4.default

- Undetermined - C:\Program Files\TomTom HOME 2\xul\extensions\MapShare-status@tomtom.com

- Undetermined - C:\Program Files\TomTom HOME 2\xul\extensions\baseTheme@tomtom.com

 

AppDir: C:\Program Files\Mozilla Firefox

- Default - %AppDir%\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

 

==== Firefox Plugins ======================

 

Profilepath: C:\Users\Radio Star\AppData\Roaming\Mozilla\Firefox\Profiles\c3782g0p.default

D7492728A4C06EC99B10F8219B1F31F5 - C:\Program Files\Java\jre1.8.0_40\bin\plugin2\npjp2.dll - Java Platform SE 8 U40

F47B4F0D0DF0C28759B60CF0B0090A11 - C:\Program Files\Java\jre1.8.0_40\bin\dtplugin\npdeployJava1.dll - Java Deployment Toolkit 8.0.400.25

98137411B9C632095F919E2CE70B288A - C:\Program Files\Google\Update\1.3.26.9\npGoogleUpdate3.dll - Google Update

98137411B9C632095F919E2CE70B288A - C:\Users\Radio Star\AppData\Local\Google\Update\1.3.26.9\npGoogleUpdate3.dll - Google Update

12B7772C549B1A9A7AC2C0062F1582FF - C:\Windows\system32\Adobe\Director\np32dsw_1214154.dll - Shockwave for Director / Shockwave for Director

3AC6EB13465EE217D715521DB8D1259F - C:\Program Files\Perfect World Entertainment\Arc\Plugins\npArcPluginFF.dll - ArcPlugin

84FE63868C1AE2005EB0431A6939C8A0 - C:\Program Files\DivX\DivX Web Player\npdivx32.dll - DivX Plus Web Player

005EBE4A4E6E9C9A7967F6C3F413C1DF - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll - Adobe Acrobat

421CB2C1010522B3BF7C00725520B844 - C:\Program Files\Adobe\Reader 11.0\Reader\browser\nppdf32.dll - Adobe Acrobat

79039398587F475ADA606D1A3B740A63 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll - DivX VOD Helper Plug-in

893BF7D2261C56C24F813405D9D018E0 - c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll - Silverlight Plug-In

F6D12679B9112358AC705A1308156F59 - C:\Users\Radio Star\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll - Unity Player

3A9E1940B4459CC97FDCBB24FCB69004 - c:\program files\real\realplayer\Netscape6\nppl3260.dll - RealPlayer G2 LiveConnect-Enabled Plug-In (32-bit)

0FCEAA7D12B7B0BA825E5C770B1DCA48 - c:\program files\real\realplayer\Netscape6\nprpplugin.dll - RealPlayer Download Plugin

BE126CB7049E89ED6F3038016668B502 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll - RealNetworks RealDownloader Chrome Background Extension Plug-In (32-bit)

EAC427FEF96A13058C1ACD17C38966CF - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll - RealNetworks RealDownloader PepperFlashVideoShim Plug-In (32-bit)

96B3689320E9B16EDF38B7A5001C35F0 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll - RealNetworks RealDownloader HTML5VideoShim Plug-In (32-bit)

F8CB60A5ACA5D73807ECBD9942A8BCB7 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll - RealDownloader Plugin

43BD6F8F1FD22EE1363173D8EDF1A594 - C:\Users\Radio Star\AppData\Roaming\gentek\npthinclient.dll - Thinclient

555E65306A5D3A5978BE74E1DD62CDD9 - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll - RealNetworks Chrome Background Extension Plug-In (32-bit)

E32771B0AE3F18CEFFC12D682025238A - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll - RealPlayer HTML5VideoShim Plug-In (32-bit)

36FBE76F4F51396B0F70FC95CD7481D2 - C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll - Pando Web Plugin

6D657ABADF217DBB17CF0A0AF44A7E29 - C:\ProgramData\NexonUS\NGM\npNxGameUS.dll - Nexon Game Controller

B502C8BC301556EC6B3723ACC427933C - C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll - WacomTabletPlugin

C517E5EA7CEE783F3681F62D2A362E5B - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll - Windows Live? Photo Gallery

CECCA408E6FE54A9211A7C09A106D9FD - C:\Program Files\Total Immersion\DFusionHomeWebPlugIn\NPDFusionWebFirefox.dll - D'Fusion @Home Web Plug-In (3.10.17859)

FADBAA4892BD10FDE52D8546AE03AE2B - C:\Program Files\TabletPlugins\npwacom.dll - Wacom Dynamic Link Library

751D1B9C432A642E1AC0AC3FFF2B2816 - C:\Users\Radio Star\AppData\Roaming\Kalydo\KalydoPlayer\npkalydo.dll - Kalydo Player Plugin for Mozilla

AB87EEFFD18F2BAAFC274E7075EA6C67 - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll - Windows Presentation Foundation / Windows Presentation Foundation

8DA2ED6B04EA33F2EAE8BA883F903729 - c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrlui.dll - Microsoft® Silverlight

 

 

==== Chromium Look ======================

 

HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions

idhngdhcfkoamngbedgpaokgjbnpdiji - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Chrome\Ext\realdownloader.crx[08/14/2013 04:24 PM]

 

HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\Extensions

lmjegmlicamnimmfhcmpkclmigmmcbeh - No path found[]

 

Homestuck Trickster - Radio Star\AppData\Local\Google\Chrome\User Data\Default\Extensions\fnnbeficjghlonnjgikbhojafhgemcbe

XKit - Radio Star\AppData\Local\Google\Chrome\User Data\Default\Extensions\fpfgeeomkfdefkckijiabdbogjkdaecd

Shield For Chrome - Radio Star\AppData\Local\Google\Chrome\User Data\Default\Extensions\gceighgadbamgchioaofojlblndjcggh

BetaFish Adblocker - Radio Star\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom

Mississippi University for Women - MUW - Radio Star\AppData\Local\Google\Chrome\User Data\Default\Extensions\kciepkphepmdfljggckklmdlfdcfbblj

StayFocusd - Radio Star\AppData\Local\Google\Chrome\User Data\Default\Extensions\laankejkbhbdhmipfmgcngdelahlfoji

Google Drive App Launcher - Radio Star\AppData\Local\Google\Chrome\User Data\Default\Extensions\lmjegmlicamnimmfhcmpkclmigmmcbeh

MSPA Notifier - Radio Star\AppData\Local\Google\Chrome\User Data\Default\Extensions\nclackehnjikcjeijdihkafcefjgnmmi

WeatherBug - Radio Star\AppData\Local\Google\Chrome\User Data\Default\Extensions\njkkjobcechefaoknodniidfjapgfoco

Tumblr Savior - Radio Star\AppData\Local\Google\Chrome\User Data\Default\Extensions\oefddkjnflmjbclpnnoegglmmdfkidip

ScriptSafe - Radio Star\AppData\Local\Google\Chrome\User Data\Default\Extensions\oiigbmnaadbkfbmpbfijlflahbdbdgdf

Outlook.com - Radio Star\AppData\Local\Google\Chrome\User Data\Default\Extensions\pfpeapihoiogbcmdmnibeplnikfnhoge

 

==== Chromium Startpages ======================

 

C:\Users\Radio Star\AppData\Local\Google\Chrome\User Data\Default\Preferences


 

 

==== Chromium Fix ======================

 

C:\Users\Radio Star\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_static.re-markit00.re-markit.co_0.localstorage deleted successfully

C:\Users\Radio Star\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_static.re-markit00.re-markit.co_0.localstorage-journal deleted successfully

C:\Users\Radio Star\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_static.re-markit00.re-markit.co_0.localstorage deleted successfully

C:\Users\Radio Star\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_static.re-markit00.re-markit.co_0.localstorage-journal deleted successfully

 

==== Set IE to Default ======================

 

Old Values:

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AboutURLs]

"Tabs"="res://ieframe.dll/tabswelcome.htm"

 

New Values:

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AboutURLs]

"Tabs"="about:newtab"

 

==== All HKCU SearchScopes ======================

 

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes

"DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"

{012E1000-F331-11DB-8314-0800200C9A66} Google  Url="http://www.google.com/search?q={searchTerms}"

{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing  Url="http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC"


 

==== Deleting CLSID Registry Keys ======================

 

HKEY_USERS\S-1-5-21-3749791044-2603657649-1157988785-1001\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1017A80C-6F09-4548-A84D-EDD6AC9525F0} deleted successfully

HKEY_USERS\S-1-5-21-3749791044-2603657649-1157988785-1001\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{1017A80C-6F09-4548-A84D-EDD6AC9525F0} deleted successfully

HKEY_USERS\S-1-5-21-3749791044-2603657649-1157988785-1001\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D2C5E510-BE6D-42CC-9F61-E4F939078474} deleted successfully

HKEY_USERS\S-1-5-21-3749791044-2603657649-1157988785-1001\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D2C5E510-BE6D-42CC-9F61-E4F939078474} deleted successfully

HKEY_CLASSES_ROOT\CLSID\{1017A80C-6F09-4548-A84D-EDD6AC9525F0} deleted successfully

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1017A80C-6F09-4548-A84D-EDD6AC9525F0} deleted successfully

HKEY_CLASSES_ROOT\CLSID\{D2C5E510-BE6D-42CC-9F61-E4F939078474} deleted successfully

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D2C5E510-BE6D-42CC-9F61-E4F939078474} deleted successfully

 

==== Deleting CLSID Registry Values ======================

 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\!{1017A80C-6F09-4548-A84D-EDD6AC9525F0} deleted successfully

HKEY_LOCAL_MACHINE\software\Wow6432Node\mozilla\Firefox\extensions\{7D4F1959-3F72-49d5-8E59-F02F8AA6815D} deleted successfully

 

==== Deleting Registry Keys ======================

 

HKEY_LOCAL_MACHINE\Software\Policies\Google deleted successfully

 

==== Empty IE Cache ======================

 

C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

C:\Users\Radio Star\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully

C:\Users\Radio Star\AppData\Local\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 emptied successfully

C:\Windows\serviceprofiles\networkservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

C:\Windows\serviceprofiles\Localservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

C:\Users\Radio Star\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot

 

==== Empty FireFox Cache ======================

 

C:\Users\Radio Star\AppData\Local\Mozilla\Firefox\Profiles\c3782g0p.default\cache2 emptied successfully

 

==== Empty Chrome Cache ======================

 

C:\Users\Radio Star\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully

 

==== Empty All Flash Cache ======================

 

Flash Cache Emptied Successfully

 

==== Empty All Java Cache ======================

 

Java Cache cleared successfully

 

==== C:\zoek_backup content ======================

 

C:\zoek_backup (files=120 folders=38 40193218 bytes)

 

==== Empty Temp Folders ======================

 

C:\Users\Ayumi\AppData\Local\Temp emptied successfully

C:\Users\Default\AppData\Local\Temp emptied successfully

C:\Users\Default User\AppData\Local\Temp emptied successfully

C:\Users\Radio Star\AppData\Local\Temp will be emptied at reboot

C:\Windows\system32\config\systemprofile\AppData\Local\Temp emptied successfully

C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp emptied successfully

C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully

C:\Windows\Temp will be emptied at reboot

 

==== After Reboot ======================

 

==== Empty Temp Folders ======================

 

C:\Windows\Temp successfully emptied

C:\Users\RADIOS~1\AppData\Local\Temp successfully emptied

 

==== Empty Recycle Bin ======================

 

C:\$RECYCLE.BIN successfully emptied

 

==== Deleting Files / Folders ======================

 

"C:\Users\Radio Star\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat" deleted

"C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat" not deleted

"C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat" not deleted

 

==== EOF on Tue 04/21/2015 at 21:27:49.71 ======================
Link to post
Share on other sites
ophelia_hall

ophelia_hall

Posted
  • Author
Posted

It is still the same. I also randomly got the Extreme Blocker extension downloaded at some point today or yesterday (and I did not go to any shady websites). The HappySales tabs (I believe that is it) is still popping up when I click links. Referring to the original reason I posted this, I ran adwcleaner again and there are still the registry keys it wanted me to delete. Should I delete them or are some of them ones I need to keep? I attached the log report for you to look at. 

AdwCleanerR6.txt

Link to post
Share on other sites
TwinHeadedEagle

TwinHeadedEagle

Posted
Posted

Yes, please remove everything Adwcleaner founds.

 

 

FRST.gif Scan with Farbar Recovery Scan Tool

 

Please re-run Farbar Recovery Scan Tool to give me a fresh look at your system.

  • Right-click on FRST.gif icon and select RunAsAdmin.jpg Run as Administrator to start the tool.

    (XP users click run after receipt of Windows Security Warning - Open File).

  • Make sure that Addition option is checked.
  • Press Scan button and wait.
  • The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.
Please upload them into your next reply.
Link to post
Share on other sites
TwinHeadedEagle

TwinHeadedEagle

Posted
Posted

Glad I could help. We will delete all used tools and I'll give you some tips to harden your security and learn how to protect yourself :)
 
 

Recommended reading:

 
 
icon_exclaim.gifMUST READ - security tips:

icon_exclaim.gifMUST READ - general maintenance:

The Importance of Software Updating:

 

 
In order to stay protected it is very important that you regularly update all of your software. Cybercriminals depend on the apathy of users around software updates to keep their malicious endeavor running.
 
Operating systems, such as Windows, and applications, such as Adobe Reader or JAVA, are used by tens of millions of computers and devices around the world, making them a huge target for cybercriminals. Downloading updates and installing them can sometimes be tedious, but the advantages you get from the updates are certainly worth it.

Recommended additional software:

 
 
icon_arrow.gifCCleaner - to clean unneeded temporary files.
icon_arrow.gifMalwarebytes' Anti-Malware - to scan your system from time to time in search for malware.
icon_arrow.gifMalwarebytes' Anti-Exploit - to prevent plenty of mostly exploited vulnerabilities.
icon_arrow.gifMcShield - to prevent infections spread by removable media.
icon_arrow.gifUnchecky - to prevent from installing additional foistware, implemented in legitimate installations.
icon_arrow.gifAdblock - to surf the web without annoying ads! 
 
 

Post-cleanup procedures:

 

 
Download DelFix by Xplode and save it to your desktop.

  • Run the tool by right click on the 51a5ce45263de-delfix.png icon and Run as administrator option.
  • Make sure that these ones are checked:
    • Remove disinfection tools
    • Purge system restore
    • Reset system settings
  • Push Run.
  • The program will run for a few seconds and display a notepad report. You do not need to attach it.

The tool will also record healthy state of registry and make a backup using ERUNT program in %windir%\ERUNT\DelFix
Tool deletes old system restore points and create a fresh system restore point after cleaning. 
 
 
 


My help is free for everybody.

If you're happy with the help provided and/or wish to buy me a beer for the assistance you received, then you can consider a donation: 
btn_donateCC_LG.gif

 

Thank you!

 
 
Stay safe,
TwinHeadedEagle   :)

Link to post
Share on other sites
  • 2 weeks later...
  • Root Admin
AdvancedSetup

AdvancedSetup

Posted
  • Root Admin
Posted

Glad we could help. :)

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

Link to post
Share on other sites
Guest
This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.