Ultra Adware Killer 2.0.1.0

[Trajet]

Wow, this is one ferocious beast.

I had become quite blasé about using previous versions of this tool as I knew what it would do.

This latest version is picking up "trusted" programs like Norton Identity Safe, Epson E-Web Print, Blue Iris ActiveX Control, and the like.

I'm finding I have to be very careful as not to uninstall a legitimate program that is safe.

Is there anyway to have a whitelist to save having to untick the same programs each time I run the tool on PCs?

[Fred]

Hi Trajet. May I know in which tab are those detected?

Thanks.

[Trajet]

here is the logfile;

###### Ultra adware killer scan report ######

Ultra Adware Killer version: 2.0.0.0 (64bits).
UAK database number: 1014.
Windows version: Windows 7 Home Premium Service Pack 1 64 bits
Internet Explorer version: 11.00.9600.16428 (winblue_gdr.131013-1700)
Mozilla Firefox version: 37.0.2

Scan started by user: *********.
Option "Scan all users": Checked.
Scan start time: 2015/04/27 15:13:52.

Note: Registry paths may contain prefixes for better identification of the corresponding registry key:

HKLM32: The 32 bit portion of the HKEY_LOCAL_MACHINE key, in 64 bit Windows versions.
HKLM64: The 64 bit portion of the HKEY_LOCAL_MACHINE key, in 64 bit Windows versions.
@<User name>: The corresponding user's registry key (HKEY_USERS\<User sid>).


->Programs scan :

Detected program: Software Updater
Uninstall key: HKLM32\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{FA7EE274-7370-43B7-9A45-A39B17CCCDC5}
Folder path: MsiExec.exe /X{FA7EE274-7370-43B7-9A45-A39B17CCCDC5}
User name : (All users)
Item state: Checked



->Internet Explorer scan:

IE home and search pages:

Internet explorer search providers:

Internet Explorer Ad-ons:

Name: Norton Identity Safe Toolbar
User name: (All users)
File: C:\Program Files (x86)\Norton Identity Safe\Engine64\2014.7.11.42\coIEPlg.dll
Item state: Checked

Name: E-Web Print
User name: (All users)
File: C:\Program Files (x86)\Epson Software\E-Web Print\ewps_tb.dll
Item state: Checked

Name: Norton Toolbar
User name: (All users)
File: C:\Program Files (x86)\Norton 360\Engine64\21.7.0.11\coIEPlg.dll
Item state: Checked

Name: Media Go Detector Plug-in
User name: *********
File: C:\Program Files (x86)\Sony\Media Go\npMediaGoDetector.dll
Item state: Checked

Name: E-Web Print
User name: *********
File: C:\Program Files (x86)\Epson Software\E-Web Print\ewps_tb.dll
Item state: Checked

Name: {2670000A-7350-4F3C-8081-5663EE0C6C49}
User name: *********
File: The CLSID key for this Ad-on does not exist.
Item state: Checked

Name: Norton Identity Protection
User name: *********
File: C:\Program Files (x86)\Norton 360\Engine64\21.7.0.11\coIEPlg.dll
Item state: Checked

Name: Norton Vulnerability Protection
User name: *********
File: C:\Program Files (x86)\Norton 360\Engine\21.7.0.11\IPS\IPSBHO.DLL
Item state: Checked

Name: Java(tm) Plug-In SSV Helper
User name: *********
File: The CLSID key for this Ad-on does not exist.
Item state: Checked

Name: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA}
User name: *********
File: The CLSID key for this Ad-on does not exist.
Item state: Checked

Name: Norton Toolbar
User name: *********
File: C:\Program Files (x86)\Norton 360\Engine64\21.7.0.11\coIEPlg.dll
Item state: Checked

Name: Norton Identity Safe Toolbar
User name: *********
File: C:\Program Files (x86)\Norton Identity Safe\Engine64\2014.7.11.42\coIEPlg.dll
Item state: Checked

Name: E-Web Print
User name: *********
File: C:\Program Files (x86)\Epson Software\E-Web Print\ewps_tb.dll
Item state: Checked

Name: Norton Identity Protection
User name: *********
File: C:\Program Files (x86)\Norton Identity Safe\Engine64\2014.7.11.42\coIEPlg.dll
Item state: Checked

Name: Java(tm) Plug-In 2 SSV Helper
User name: *********
File: The CLSID key for this Ad-on does not exist.
Item state: Checked

Name: XCast Control
User name: *********
File: C:\Program Files (x86)\Blue Iris ActiveX Control\XCast.ocx
Item state: Checked

Name: Norton Identity Protection
User name: (All users)
File: C:\Program Files (x86)\Norton 360\Engine64\21.7.0.11\coIEPlg.dll
Item state: Checked

Name: Norton Identity Protection
User name: (All users)
File: C:\Program Files (x86)\Norton Identity Safe\Engine64\2014.7.11.42\coIEPlg.dll
Item state: Checked

Name: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B}
User name: (All users)
File: The CLSID key for this Ad-on does not exist.
Item state: Checked

Name: {166B1BCA-3F9C-11CF-8075-444553540000}
User name: (All users)
File: The CLSID key for this Ad-on does not exist.
Item state: Checked

Name: {233C1507-6A77-46A4-9443-F871F945D258}
User name: (All users)
File: The CLSID key for this Ad-on does not exist.
Item state: Checked

Name: {4063BE15-3B08-470D-A0D5-B37161CFFD69}
User name: (All users)
File: The CLSID key for this Ad-on does not exist.
Item state: Checked

Name: isInstalled Class
User name: (All users)
File: C:\Program Files\Java\jre1.8.0_40\bin\wsdetect.dll
Item state: Checked

Name: Java(tm) Plug-In SSV Helper
User name: (All users)
File: The CLSID key for this Ad-on does not exist.
Item state: Checked

Name: {CA8A9780-280D-11CF-A24D-444553540000}
User name: (All users)
File: The CLSID key for this Ad-on does not exist.
Item state: Checked

Name: {CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA}
User name: (All users)
File: The CLSID key for this Ad-on does not exist.
Item state: Checked

Name: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBC}
User name: (All users)
File: The CLSID key for this Ad-on does not exist.
Item state: Checked

Name: {CFCDAA03-8BE4-11cf-B84B-0020AFBBCCFA}
User name: (All users)
File: The CLSID key for this Ad-on does not exist.
Item state: Checked

Name: {D27CDB6E-AE6D-11cf-96B8-444553540000}
User name: (All users)
File: The CLSID key for this Ad-on does not exist.
Item state: Checked

Name: Norton Vulnerability Protection
User name: (All users)
File: C:\Program Files (x86)\Norton 360\Engine\21.7.0.11\IPS\IPSBHO.DLL
Item state: Checked

Name: Java(tm) Plug-In 2 SSV Helper
User name: (All users)
File: The CLSID key for this Ad-on does not exist.
Item state: Checked

Name: CRLPNUpld Object
User name: (All users)
File: The CLSID key for this Ad-on does not exist.
Item state: Checked

Name: {0D012ABD-CEED-11D2-9C76-00105AA73033}
User name: (All users)
File: The CLSID key for this Ad-on does not exist.
Item state: Checked

Name: {12a0d4c1-4d44-4fb6-bdba-a7aabfda7e75}
User name: (All users)
File: The CLSID key for this Ad-on does not exist.
Item state: Checked

Name: CRecord Object
User name: (All users)
File: The CLSID key for this Ad-on does not exist.
Item state: Checked

Name: {56A58823-AE99-11D5-B90B-0050DACD1F75}
User name: (All users)
File: The CLSID key for this Ad-on does not exist.
Item state: Checked

Name: {5dcf3f4a-fda4-46a9-9129-47dd0cc8243f}
User name: (All users)
File: The CLSID key for this Ad-on does not exist.
Item state: Checked

Name: WildTangent WTApp Namespace Detector
User name: (All users)
File: C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\wtapp_PresenceDetector.dll
Item state: Checked

Name: {9E385F0A-0BA2-430C-96AA-4399C5E40F6C}
User name: (All users)
File: The CLSID key for this Ad-on does not exist.
Item state: Checked

Name: SharePoint OpenDocuments Class
User name: (All users)
File: The CLSID key for this Ad-on does not exist.
Item state: Checked

Name: SharePoint OpenDocuments Class
User name: (All users)
File: The CLSID key for this Ad-on does not exist.
Item state: Checked

Name: SharePoint Stssync Handler
User name: (All users)
File: The CLSID key for this Ad-on does not exist.
Item state: Checked

Name: {E01D1C6A-4F40-11D3-8958-00105A272DCF}
User name: (All users)
File: The CLSID key for this Ad-on does not exist.
Item state: Checked

Internet Explorer shortcuts scan:

Internet Explorer and Shell reset options:


->Mozilla Firefox scan:

Firefox Search Plugins:

Plugin name: DuckDuckGo
User name: SYSTEM
Path: C:\Program Files (x86)\Mozilla Firefox\browser\searchplugins\ddg.xml
Item state: Checked

Firefox shortcuts scan:

Firefox Reset Options:

Option name: Reset Firefox Ad-ons
User name: *********
Path: C:\Users\*********\AppData\Roaming\Mozilla\Firefox\Profiles\xixwxpr1.default-1412320414229\addons.json
Item state: unchecked

Option name: Reset Firefox Extensions
User name: *********
Path: C:\Users\*********\AppData\Roaming\Mozilla\Firefox\Profiles\rcqdmf1a.default-1371559582027\extensions
Item state: unchecked

Option name: Reset Firefox User Search Providers
User name: *********
Path: C:\Users\*********\AppData\Roaming\Mozilla\Firefox\Profiles\xixwxpr1.default-1412320414229\searchplugins
Item state: Checked

Option name: Reset Firefox Settings
User name: *********
Path: C:\Users\*********\AppData\Roaming\Mozilla\Firefox\Profiles\xixwxpr1.default-1412320414229\prefs.js
Item state: Checked


->End of scans

Scan end time: 2015/04/27 15:14:07.
Scan duration: 14 seconds.

The scan completed successfully.


############ End of report 18007 bytes ############

[Fred]

Trajet, What UAK detected there were Internet Explorer ad-ons. It would remove those ad-ons from the browser, but not the associated programs. removing the AD-ONs improves the browser's speed and since most of them (if not all) are useless, users will only benefit from this feature.

You see, I had some complaints in previous versions from users saying UAK removed programs they had paid for. They wouldn't know what to uncheck in order to keep those programs. Can't blame them. If I wanted to keep a program, it would be very hard to find out what to uncheck.

So I went back to the drawing board, and made it all different, or should I say, properly. The problem is that the previous definitions became useless, in the new approach, because they were random entries, not associated with any program. I had to create new definitions from scratch, and obviously, there's still much work to be done.

I also mentioned in the UAK's help page that the browser detection needs more work. I will add a whitelist function as you suggested and improve the ad-on detection method.

Thanks for reporting.

[Trajet]

Thanks Fred, the log file was from my own PC. I have seen the power of good it has done on a customers infected PC. Malware removal is certainly becoming easier and quicker using the UVK tool.

[wmmiller]

Hi guys,

Are we talking about a white list that one sets up and not something that just white lists what users request? I personally like that it detects what it does because what one user uses and thinks are useful may not be for many. The word Norton triggered my radar. I know many people use Norton for this and that but for me Norton is on my never again list. Thanks for listening.

Bill

Edit: after re reading this thread. I see that is what we are talking about and feel it’s a great idea. Great idea and request Trajet.

[Charger440]

I personally think there should be a global white list BUT make it locally user editable. I also agree with Bill in that I think Norton (and McAfee) is, shall we say, less than desirable. Neither one have been a viable option for years. As far as toolbars go, imo there is no use for them what so ever.

It's been talked about before but I do think uak and uvk should make an effort not interfere with programs like Quickbooks that are very important to the clients that have them. It is true that we can manually check that but we use uvk to make our lives easier and if all we have to is a quick then it saves time not having to uncheck something. This fits right in with white listing.

[wmmiller]

Many good points have been brought up here. Is far as I’m concerned, I think you guys that are working on several computers on a daily basis should work together to get things the way it works best for your situations since I do this on a limited bases. Basically what I’m trying to say is that I like to toss in my two cents but in the end you guys & Fred that are doing this all the time should be the deciders.

Bill

[Charger440]

Bill

I have seen you come up with several good ideas and point out bugs that other people missed. Your opinion matters too!

[Brink]

I've got no love for Norton or McCrappy either. (whoops - did I really say that? LOL)
An a white list would be useful. The ability to edit it or even choose whether or not to use it would be a great feature.