Solved HJT a little is help needed

[cottonball]

well48,

Looks like Jacee and I posted at the same time!

Please follow Jacee's instructions regarding Chrome.

Then, please run Malwarebytes Anti-Malware, and Security Check, posting their results.

Thanks!

 

[well48]

Malwarebytes Anti-Malware (Trial) 1.75.0.1300
www.malwarebytes.org
Database version: v2013.09.30.08
Windows 7 x64 NTFS
Internet Explorer 8.0.7600.16385
Tom :: THOMAS-KUSTUSZ [administrator]
Protection: Enabled
9/30/2013 6:00:21 PM
mbam-log-2013-09-30 (18-00-21).txt
Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 195289
Time elapsed: 2 minute(s), 44 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 0
(No malicious items detected)
Registry Values Detected: 0
(No malicious items detected)
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 0
(No malicious items detected)
(end)

 

[well48]

Results of screen317's Security Check version 0.99.74
Windows 7 x64 (UAC is enabled)
Out of date service pack!!
``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Enabled!
avast! Antivirus
Antivirus up to date!
`````````Anti-malware/Other Utilities Check:`````````
Malwarebytes Anti-Malware version 1.75.0.1300
Java 7 Update 40
Adobe Reader 10.1.8 Adobe Reader out of Date!
Google Chrome 28.0.1500.95
Google Chrome 29.0.1547.76
````````Process Check: objlist.exe by Laurent````````
Malwarebytes Anti-Malware mbamservice.exe
Malwarebytes Anti-Malware mbamgui.exe
Malwarebytes' Anti-Malware mbamscheduler.exe
Symantec Norton Online Backup NOBuAgent.exe
AVAST Software Avast AvastSvc.exe
AVAST Software Avast AvastUI.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: 1%
````````````````````End of Log``````````````````````

 

[well48]

Finally managed to get SP1. Anything else?

Thanks for the tip cottonball, "The O23 (file missing) items are a result of the system being 64-bit. HJT plays better with 32-bit systems."

Now I understand and know why I thought HJT screwed up my 7-64 after I deleted all the O23 (file missing) after running HJT. This is the first time I've used HJT in quite awhile.

I'd like to get rid of games, Norton, McAfee and other bloatware. Any suggestions?

 

[well48]

After SP1 and Adobe update Results of screen317's Security Check version 0.99.74
Windows 7 Service Pack 1 x64 (UAC is enabled)
``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Enabled!
avast! Antivirus
Antivirus up to date!
`````````Anti-malware/Other Utilities Check:`````````
Malwarebytes Anti-Malware version 1.75.0.1300
Java 7 Update 40
Adobe Reader XI
Google Chrome 28.0.1500.95
Google Chrome 29.0.1547.76
````````Process Check: objlist.exe by Laurent````````
Malwarebytes Anti-Malware mbamservice.exe
Malwarebytes Anti-Malware mbamgui.exe
Malwarebytes' Anti-Malware mbamscheduler.exe
Symantec Norton Online Backup NOBuAgent.exe
AVAST Software Avast AvastSvc.exe
AVAST Software Avast AvastUI.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: 4%
````````````````````End of Log``````````````````````

 

[well48]

let me know when to mark solved and I greatly appreciate your help with this.

 

[cottonball]

I'd like to get rid of games, Norton, McAfee and other bloatware

:info: Since you already have HJT installed, please go back to the HijackThis program console, and press: Config > Misc Tools > Open Uninstall Manager
Once the Add/Remove Program Manager list appears, click: Save list...

:ar: Please save to the Desktop, and post in your reply. The report shows what there is installed.

By the way, you are running HJT from here:
C:\Users\Tom\Desktop\HijackThis.exe

Although HJT can be run from the location above, obviously, it is not recommended that you do so.

The reason is because of the way HijackThis saves its backups. It creates backup files for entries fixed, and places them in the folder from which it runs!!

If you decide to run HijackThis from a location like the Temp folder, any file older than 7 days gets deleted from the folder, and whenever disc-cleanup is run. Consequently there are no backups to restore if something goes wrong.

It run from the Desktop, the backups are scattered all over, and not in a desirable location.
So, it should be always recommended to create an exclusive folder for HijackThis to reside in and run.

 

[AmericanPharaoh]

I'd like to get rid of games, Norton, McAfee and other bloatware

:info: Since you already have HJT installed, please go back to the HijackThis program console, and press: Config > Misc Tools > Open Uninstall Manager
Once the Add/Remove Program Manager list appears, click: Save list...

:ar: Please save to the Desktop, and post in your reply. The report shows what there is installed.

By the way, you are running HJT from here:
C:\Users\Tom\Desktop\HijackThis.exe

Although HJT can be run from the location above, obviously, it is not recommended that you do so.

The reason is because of the way HijackThis saves its backups. It creates backup files for entries fixed, and places them in the folder from which it runs!!

If you decide to run HijackThis from a location like the Temp folder, any file older than 7 days gets deleted from the folder, and whenever disc-cleanup is run. Consequently there are no backups to restore if something goes wrong.

It run from the Desktop, the backups are scattered all over, and not in a desirable location.
So, it should be always recommended to create an exclusive folder for HijackThis to reside in and run.

Does he want to keep these two toolbars?



O3 - Toolbar: @C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\npwinext.dll,-100 - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\npwinext.dll


O3 - Toolbar: Grab Pro - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Program Files (x86)\Orbitdownloader\GrabPro.dll

Also, Orbitdownloader is loaded with Junkware. Which may of been a lot of the crap you already removed.

 

[well48]

Adobe AIR
Adobe AIR
Adobe Flash Player 11 ActiveX
Adobe Reader XI (11.0.04)
Adobe Shockwave Player 12.0
Agatha Christie - Peril at End House
avast! Free Antivirus
Bejeweled 2 Deluxe
Bing Bar
Bing Bar Platform
Bing Rewards Client Installer
Blackhawk Striker 2
Blasterball 3
Blio
Bounce Symphony
Build-a-lot 2
Cake Mania
Chuzzle Deluxe
CyberLink DVD Suite Deluxe
CyberLink DVD Suite Deluxe
D3DX10
Digital Wireless Camera
Diner Dash 2 Restaurant Rescue
Dora's World Adventure
DVD Menu Pack for HP MediaSmart Video
DVD Menu Pack for HP MediaSmart Video
Escape Rosecliff Island
Farm Frenzy
FATE
Final Drive Nitro
FlashPeak SlimBrowser
Google Chrome
Heroes of Hellas 2 - Olympia
Hewlett-Packard ACLM.NET v1.1.1.0
HP Customer Experience Enhancements
HP Game Console
HP Games
HP MediaSmart DVD
HP MediaSmart DVD
HP MediaSmart Music
HP MediaSmart Music
HP MediaSmart Photo
HP MediaSmart Photo
HP MediaSmart Video
HP MediaSmart Video
HP MediaSmart/TouchSmart Netflix
HP MovieStore
HP MovieStore
HP Setup
HP Setup Manager
HP Support Assistant
HP Update
Intel(R) Graphics Media Accelerator Driver
Java 7 Update 40
Jewel Quest Solitaire 2
Junk Mail filter update
Kobo
LabelPrint
LabelPrint
LightScribe System Software
Malwarebytes Anti-Malware version 1.75.0.1300
Microsoft Default Manager
Microsoft Office 2010
Microsoft Office Click-to-Run 2010
Microsoft Office Starter 2010 - English
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319
Microsoft WSE 3.0 Runtime
Movie Theme Pack for HP MediaSmart Video
Movie Theme Pack for HP MediaSmart Video
MSVCRT
MSVCRT_amd64
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
Mystery P.I. - The London Caper
Norton Online Backup
Orbit Downloader
PDF Complete Special Edition
Penguins!
PhotoNow!
PhotoNow!
PictureMover
Plants vs. Zombies
PlayReady PC Runtime x86
Poker Superstars III
Polar Bowler
Polar Golfer
Power2Go
Power2Go
PowerDirector
PowerDirector
PressReader
Realtek High Definition Audio Driver
Recovery Manager
RoxioNow Player
Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2729449)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2737019)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2742595)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2789642)
SpywareBlaster 5.0
swMSM
TeamViewer 7
Uniden Surveillance System 5.0.0.302
Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217)
Virtual Families
Virtual Villagers 4 - The Tree of Life
VLC media player 1.1.10
Wheel of Fortune 2
Windows Live Communications Platform
Windows Live Essentials
Windows Live Essentials
Windows Live Installer
Windows Live Mail
Windows Live Mail
Windows Live Messenger
Windows Live Messenger
Windows Live Movie Maker
Windows Live Movie Maker
Windows Live Photo Common
Windows Live Photo Common
Windows Live Photo Gallery
Windows Live Photo Gallery
Windows Live PIMT Platform
Windows Live SOXE
Windows Live SOXE Definitions
Windows Live UX Platform
Windows Live UX Platform Language Pack
Windows Live Writer
Windows Live Writer
Windows Live Writer
Windows Live Writer Resources
Zinio Reader 4
Zinio Reader 4
Zuma Deluxe

 

[Layback Bear]

I personally wouldn't have anything Orbit on any computer.
If Orbitdownloader is still there it will just load the computer again with all the junk these good people have helped the OP remove.

 

[well48]

I'd like to get rid of games, Norton, McAfee and other bloatware

:info: Since you already have HJT installed, please go back to the HijackThis program console, and press: Config > Misc Tools > Open Uninstall Manager
Once the Add/Remove Program Manager list appears, click: Save list...

:ar: Please save to the Desktop, and post in your reply. The report shows what there is installed.

By the way, you are running HJT from here:
C:\Users\Tom\Desktop\HijackThis.exe

Although HJT can be run from the location above, obviously, it is not recommended that you do so.

The reason is because of the way HijackThis saves its backups. It creates backup files for entries fixed, and places them in the folder from which it runs!!

If you decide to run HijackThis from a location like the Temp folder, any file older than 7 days gets deleted from the folder, and whenever disc-cleanup is run. Consequently there are no backups to restore if something goes wrong.

It run from the Desktop, the backups are scattered all over, and not in a desirable location.
So, it should be always recommended to create an exclusive folder for HijackThis to reside in and run.

Does he want to keep these two toolbars?



O3 - Toolbar: @C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\npwinext.dll,-100 - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\npwinext.dll


O3 - Toolbar: Grab Pro - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Program Files (x86)\Orbitdownloader\GrabPro.dll

Also, Orbitdownloader is loaded with Junkware. Which may of been a lot of the crap you already removed.

Not a problem deleting toolbars. He can reinstall them if he needs them. I don't even use them on my pc because I think they are all spyware. Even Avast Rep.

I'd like to sort out the MS games from HP. Then delete HP & wildtangent games.

 

[cottonball]

Don't see McAfee on the list.

Also, only see Norton Online Backup. Some Users like to have that. Not sure, but it may come with some HP PCs.

As far as games go, it is up to the owner as to what he wants to keep.

You are getting plenty of good suggestions from everyone that has posted.

 

[well48]

Removed those O3 toolbars

Disabled the MS games. Guess I'll remove games in Prog & Features and see what happens.

He only has this one acct on here. After I get it cleaned up, I'll create a Standard User Acct for him. Then make his desktop on Admin Acct so hideous he'll stay away from it.

 

[Jacee]

He only has this one acct on here. After I get it cleaned up, I'll create a Standard User Acct for him. Then make his desktop on Admin Acct so hideous he'll stay away from it.

What does this mean?? --> "Then make his desktop on Admin Acct so hideous he'll stay away from it"

 

[well48]

It's a friends computer. I don't know how many times I've created a Standard User for him. He gets confused & frustrated because his favorites disappear, so he deletes one.
About 4 months ago I did the same thing for another friend for same reason.
I attached a png of his new Adm Desktop.

Thank you everybody for help.

 

[AmericanPharaoh]

If you don't use Norton Online Backup... get rid of it.

Same with the HP Wild Tangent games.

For now remove Chrome, you can reinstall it later.

Delete these in add/remove programs.

Run CCleaner, run the registry clean, over and over, until there is no more to remove.

Download Auslogic Disk Defrag

Run it in optimized mode, you'll find this setting by clicking the drop down arrow next to defrag button.

Be patience this may take awhile.

Once you get all the games out it will be easier to review you next logs.

Finally, run FRST again and post new logs.

 

[cottonball]

well48,

...run the registry clean, over and over, until there is no more to remove.

Cannot stop you from using a Registry cleaner, however, these programs can 'clean' a computer right into ruination!!

From what I have read, these programs use a certain technology to remove unnecessary Registry entries. However, technology is normally not 100% perfect, and, along with the unnecessary entries, it just takes the removal of one necessary Registry entry for the program to render the computer unstable, and in some cases, useless.

In addition Registry cleaning programs create gaps in the Registry, and the end result is that
the Registry becomes fragmented.

Most Registry experts (i.e. Bobbi Flekman - an outstanding master of the Registry) that work throughout the malware removal forums do not recommend their use.

 

[well48]

I'm a lot leary of registry cleaners after losing a pc to one.

Attached FRST txt

 

[well48]

Repost Addition txt

 

[AmericanPharaoh]

I'm a lot leary of registry cleaners after losing a pc to one.

Attached FRST txt

This log looks much better. I personally don't see any more Nasty entries.

Although, there are still some ( NO NAME - NO FILE) left over entry fragments which can be easily removed.

To make it simple, since you still have HJT installed. Is to run a scan, tick these entries for removal.

Or you can wait until one of our Malware Specialist show up here. Which can assist you future in creating a script (Fixlist.txt) to apply to FRST for removal.

I'm still learning this tool, so would rather let the members with more experience do this step.

Keeping the Bing Bar is up to you. If you use it...keep it.


BHO-x32: Bing Bar BHO - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\npwinext.dll (Microsoft Corporation)

Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
Toolbar: HKCU - No Name - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - No File
Toolbar: HKCU - No Name - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - No File
Toolbar: HKCU - No Name - {91DA5E8A-3318-4F8C-B67E-5964DE3AB546} - No File
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File


John

Will now look over your additional log, and get back to you later.