Firefox Problems - Untrusted Websites

[Corrine]

You are quite the detective, v_v!  Good work. 

As to creating a restore point first, it is always a good idea before making any changes.  Linda, I suggest you do that and then follow the instructions in the ESET, December 11, 2015 KB3126 article.  FRST will create a restore point before removing the leftovers from Webroot.

[LindaEllis]

Hi v_v and Corrine,

Thank you both, and I apologize for falling behind here in my reply to you both.  Christmas sort of took some time away from me so far today.  Yes, I did contact ESET Customer Care, and have a ticket number with them, but no reply yet from them.  At the time, I guess I did not do the searching as diligently as you have to find those links that you have so kindly shared with me here.  I am taking this one step at a time.  Yes, I am hearing this certificate issue is a problem, but of course I may have a few other 'glitches' beyond ESET to deal with. 

But, I am printing all of these instructions out from you both and going to work on more of them yet.  Thank you and hope you are having a great Christmas today.

[Corrine]

Take your time, Linda, and enjoy the day.  Merry Christmas!

[LindaEllis]

Thank you Corrine, and the same to you and your family.  Thank you for all of your time and help; so much!!  This is a fabulous helpful forum and I am so glad you pointed me to it. 

[LindaEllis]

This is for Corrine, and with regard to your #3 step about Webroot and FRST. 

I had saved these instructions earlier.  The person I bought the computer from just did the regular uninstall of Webroot.  I did not do anything further after that.  I did see some Webroot references like a tool bar I think in IE11 and thought if it is part of Internet Explorer maybe it would mess things up if I completely eradicated it from my computer, so with that thought in mind, I held off going any further to remove any traces of Webroot. 

But, here are the instructions I kept and I wondered should I try to remove what is left of webroot with the WRUpgradetool.exe before doing the FRSTsteps for it? 

"Trouble Installing or Uninstalling?"

"Most install or uninstall errors can be resolved by either uninstalling any previously installed Webroot security software or by running a couple of specialized cleanup utilities first and then reinstalling anew. The following are the recommended steps to follow:
1.   In Windows XP click on the Start button and open the Control Panel, select "Add or Remove Programs", and then select the 'Webroot' security product from the list and click 'Remove'. Restart your computer after the uninstall is complete.

In Windows Vista or Windows 7, click on the Start button and open the Control Panel. You will see either "Uninstall a Program" or "Programs and Features" - double-click whichever option you see. Select the 'Webroot' security product from the list and click 'Uninstall'. Restart your computer after the uninstall is complete.

Note: If you receive an error during this step, please proceed to Step 2; otherwise you may skip ahead to Step 5 below.
2.   Please note: It is highly recommend that you only perform Steps 3 through 6 after first creating a System Restore Point described in this step. Ensuring that the Windows built-in System Restore feature is enabled and that regular restore points are created can be very valuable in the event that restoring to an earlier time is needed.

o   To create a System Restore Point in Windows XP go to Start > All Programs > Accessories > System Tools > System Restore > Create a restore point.
o   In Windows Vista and Windows 7, go to Start > right-click on Computer > choose Properties > Select System protection from the left-hand panel > and choose Create.
3.   After you have created the recommended System Restore Point, download and Save the Webroot WRUpgradeTool.exe upgrade/cleanup tool to your Desktop by clicking here, or by copying and pasting the following URL into your Internet browser's address bar:
http://download.webroot.com/WRUpgradeTool.exe

Note: Running the WRUpgradeTool.exe utility can benefit those that had previously installed or attempted to install Webroot's security software, and may still have residual installed files that may be interfering with the current installation attempt.
4.   Double-click on the Webroot Upgrade/Cleanup tool WRUpgradeTool.exe to run, and follow the prompts to start the uninstall process. The cleanup tool is finished when the last line reads "Removal procedures have been completed." At this point you can click the Close button. If prompted by a dialog box that reads "To complete the cleanup process, you must reboot this computer. Click OK to reboot," please restart you computer now by clicking on the OK button now."

No hurry to answer today, Corrine.  Thanks! 

[Corrine]

Your choice, Linda.  You can create a restore point and download the WRUpgradeTool.exe or go to Step #3 and copy the script and run it as instructed.  FRST will create a restore point, remove the Webroot leftovers and clear temp files.

[LindaEllis]

Hi Corrine.  Thank you.  I remember what you wrote about programs like CCLeaner and I saved the information about not trusting them to 'clean up temp files' so you feel FRST is trustworthy for cleaning up the correct temp files? 

I did create a restore point about an hour ago.  Do you have to wait a day or no before making changes?  I am not sure when the restore will work; if there is a wait time before we know for sure that the computer will restore to that date and time.  Thank you. 

[Corrine]

The System Restore point is immediately available.  Plus, FRST will create a fresh restore point prior to removing the Webroot leftover files.  CCleaner is ok for cookies and temp files but it is not recommended for the registry.  Yes, I most definitely trust FRST for cleaning the correct Temp files, although it is not something I would recommend you attempt on your -- only with the instructions I have provided. 

To save you toggling back to the instructions, I've repeated them below:

Please do the following to run FRST:

Note: If the tool warns you about the version you're using being an outdated version please download and run the updated version.

NOTICE: This script was written specifically for this user. Running it on another machine may cause damage to your operating system

• Open Notepad (Start =>All Programs => Accessories => Notepad).
  
• Copy/Paste the entire contents of the code box below into Notepad.
  

Code Select Expand


start
CreateRestorePoint:
CloseProcesses:
BHO: Webroot Vault -> {c8d5d964-2be8-4c5b-8cf5-6e975aa88504} -> C:\ProgramData\WRData\pkg\LPBar64.dll => No File
BHO-x32: Webroot Vault -> {c8d5d964-2be8-4c5b-8cf5-6e975aa88504} -> C:\ProgramData\WRData\pkg\LPBar.dll => No File
Toolbar: HKLM - Webroot Toolbar - {97ab88ef-346b-4179-a0b1-7445896547a5} - C:\ProgramData\WRData\pkg\LPBar64.dll No File
Toolbar: HKLM-x32 - Webroot Toolbar - {97ab88ef-346b-4179-a0b1-7445896547a5} - C:\ProgramData\WRData\pkg\LPBar.dll No File
C:\ProgramData\WRData
2015-11-15 19:56 - 2015-11-15 19:56 - 10395072 _____ (Webroot Software, Inc.) C:\Program Files (x86)\Common Files\wruninstall.exe
EmptyTemp:
end


• Click Format and ensure Wordwrap is unchecked.
  
• Important:  Save the code to the same folder/directory that FRST.exe is located in, naming it as fixlist.txt
  
• Start FRST in a similar manner to when you ran a scan earlier, but this time when it opens ....
  
  
  
  • Press the Fix button once and wait.
    
  • FRST will process fixlist.txt
    
  • When finished, it will produce a log fixlog.txt in the same folder/directory as FRST64.exe
    
  • Please post the log in your next reply.
    

[LindaEllis]

Hi Corrine.  I have a couple of questions regarding the FRST.exe, don't I first have to find where it is located on my computer before I can save the notepad file to the proper one where it is at?  It seems I only have FRST.exe either as a download or on my desk top.  I typed it in for a search and I am posting my results here.  So, right now I am not sure how to find the folder/directory that FRST is in.  So that is my first question.

So, am I to be running FRST first; or copy and pasting the test in Notepad?  Of course, I can't do that until I find where FRST is located on my computer.   The FRST is on my desktop. 

[LindaEllis]

Okay, I checked and the only place that the FRST was at was in the folder for the desktop, so I saved your code in the notepad by the proper name, etc. and then ran the Fix in the FRST, and the one thing that happened I was not expecting was that I had to do a restart, which I did, but it had asked me to close other files which I didn't know how to do without getting out of it.  So, did the restart, and it seemed to work okay as I am back here now.  Chrome had to be restarted and I lost the tabs that were up there.

So, it created a file and I opened it up and below is the contents from teh Fixlist.txt:

Fix result of Farbar Recovery Scan Tool (x64) Version:23-12-2015
Ran by Customer (2015-12-25 16:30:27) Run:1
Running from C:\Users\Customer\Desktop
Loaded Profiles: Customer (Available Profiles: Customer)
Boot Mode: Normal
==============================================

fixlist content:
*****************
start
CreateRestorePoint:
CloseProcesses:
BHO: Webroot Vault -> {c8d5d964-2be8-4c5b-8cf5-6e975aa88504} -> C:\ProgramData\WRData\pkg\LPBar64.dll => No File
BHO-x32: Webroot Vault -> {c8d5d964-2be8-4c5b-8cf5-6e975aa88504} -> C:\ProgramData\WRData\pkg\LPBar.dll => No File
Toolbar: HKLM - Webroot Toolbar - {97ab88ef-346b-4179-a0b1-7445896547a5} - C:\ProgramData\WRData\pkg\LPBar64.dll No File
Toolbar: HKLM-x32 - Webroot Toolbar - {97ab88ef-346b-4179-a0b1-7445896547a5} - C:\ProgramData\WRData\pkg\LPBar.dll No File
C:\ProgramData\WRData
2015-11-15 19:56 - 2015-11-15 19:56 - 10395072 _____ (Webroot Software, Inc.) C:\Program Files (x86)\Common Files\wruninstall.exe
EmptyTemp:
end
*****************

Restore point was successfully created.
Processes closed successfully.
"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c8d5d964-2be8-4c5b-8cf5-6e975aa88504}" => key removed successfully
"HKCR\CLSID\{c8d5d964-2be8-4c5b-8cf5-6e975aa88504}" => key removed successfully
"HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c8d5d964-2be8-4c5b-8cf5-6e975aa88504}" => key removed successfully
"HKCR\Wow6432Node\CLSID\{c8d5d964-2be8-4c5b-8cf5-6e975aa88504}" => key removed successfully
HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\\{97ab88ef-346b-4179-a0b1-7445896547a5} => value removed successfully
"HKCR\CLSID\{97ab88ef-346b-4179-a0b1-7445896547a5}" => key removed successfully
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\\{97ab88ef-346b-4179-a0b1-7445896547a5} => value removed successfully
"HKCR\Wow6432Node\CLSID\{97ab88ef-346b-4179-a0b1-7445896547a5}" => key removed successfully
"C:\ProgramData\WRData" => not found.
C:\Program Files (x86)\Common Files\wruninstall.exe => moved successfully
EmptyTemp: => 1.7 GB temporary data Removed.


The system needed a reboot.

==== End of Fixlog 16:31:52 ====

[LindaEllis]

For ESET:

Did all of these steps in ESET:

http://support.eset.com/kb3126/?viewlocale=en_US

Went into Firefox, and still no luck with either Family search or my blog. 

I am attaching a screen print showing what I saw when I tried to access my blog.  Familysearch.org isn't coming up either correctly, but it shows that goofy looking screen as before.  I hope ESET people contact me so I can tell them I took these steps now too, and they didn't help.  I also did a restart after I did them. 

[Corrine]

Hi, Linda.

In addition to removing the leftover Webroot files, see what else FRST removed => 1.7 GB temporary data Removed!

Let's take care of removing the tools used:

Please download Delfix from here.

Ensure the following boxes are checked:

• Remove disinfection tools
  
• Create registry backup
  
• Purge system restore
  
  
• Click Run
  

The program will run for a few moments and then notepad will open with a log.   Please paste the log in your next reply.

With it being a holiday, I'm sure ESET support will get to you as quickly as they catch up.  After running Delfix, I think that you should stop at this point and not make any additional changes to your computer.  Then, after you have worked with ESET support, return and let us know the solution since it could help someone else. 

[LindaEllis]

Hi Corrine,

So, I guess we are at the end of the line now with this.  I took all those steps.  Those temporary files, how do I keep them from building up in the future? 

By purging the restore points, does that mean that all of my restore points I had are gone?  Is that okay should I have a new problem now then I don't have an old restore point to go back to? 

Here are the results:

# DelFix v1.011 - Logfile created 25/12/2015 at 19:03:40
# Updated 18/08/2015 by Xplode
# Username : Customer - LINDAJEANLIMESE
# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)

~ Removing disinfection tools ...

Deleted : C:\FRST
Deleted : C:\Users\Customer\Desktop\Addition.txt
Deleted : C:\Users\Customer\Desktop\Fixlog.txt
Deleted : C:\Users\Customer\Desktop\FRST.txt
Deleted : C:\Users\Customer\Desktop\FRST64.exe
Deleted : C:\Users\Customer\Downloads\Addition.txt
Deleted : C:\Users\Customer\Downloads\FRST (1).exe
Deleted : C:\Users\Customer\Downloads\FRST.exe
Deleted : C:\Users\Customer\Downloads\FRST.txt
Deleted : C:\Users\Customer\Downloads\FRST64 (1).exe
Deleted : C:\Users\Customer\Downloads\FRST64.exe
Deleted : C:\Users\Customer\Documents\Downloads\dds(1).scr
Deleted : C:\Users\Customer\Documents\Downloads\SystemLook.exe
Deleted : C:\Users\Customer\Documents\Downloads\SystemLook.txt
Deleted : C:\Users\Customer\Documents\Downloads\TFC.exe

~ Creating registry backup ... OK

~ Cleaning system restore ...

Deleted : RP #30 [Windows Update | 12/15/2015 17:20:02]
Deleted : RP #31 [RESTORE TO DECEBER 16 2015 | 12/16/2015 20:45:12]
Deleted : RP #32 [Windows Update | 12/19/2015 02:38:01]
Deleted : RP #33 [Windows Update | 12/22/2015 23:06:31]
Deleted : RP #34 [Removed Java 8 Update 66 | 12/22/2015 23:52:27]
Deleted : RP #35 [Before Webroot removal | 12/25/2015 18:24:26]
Deleted : RP #37 [Restore Point Created by FRST | 12/25/2015 21:30:30]
Deleted : RP #38 [Windows Update | 12/25/2015 23:11:40]

New restore point created !

########## - EOF - ##########

[Corrine]

Part of the process included:  New restore point created !

Temp files will build up but you can periodically (every couple weeks or so) run TFC, which works on Windows XP/Vista/7 and can run on both a 32-bit and 64-bit OS.  Following are the instructions. 

Download TFC to your desktop

• Open the file and close any other windows.
  
• It will close all programs itself when run, make sure to let it run uninterrupted.
  
• Click the Start button to begin the process. The program should not take long to finish its job
  
• Once its finished it should reboot your machine, if not, do this yourself to ensure a complete clean

Please let us know the results of your ESET support ticket.

[LindaEllis]

Hi Corrine,

Thank you.  I have bumped into this TFC cleaner before actually, but shied away from using it because of some of the comments about problems that others had including how extensions on their files were removed.  I know I spent quite a lot of time making sure the .doc, .docx, extensions were showing, so I would not want to lose those.  I think I'm going to hold off on doing anything with it for awhile since so many of these temp. files were cleaned out today.  I get confused as I see temporary internet files and other temp. files, so I wish I understood all of those better.  Thank you for sharing, Corrine.  Yes, I will report what ESET tells me.  I also posted in Firefox foums just now, but I do not think I will get too much help; surely not as much as I recieved here.