Jump to content

Change Mode

Malware for 6 Days - Nothing is Helping


nadalotta
 Share

Recommended Posts

p.s. Am I able to send emails (gmail) with attachments yet? Also, what about updating my iphone? I've been staying away from my computer to update/upgrade my iphone because I was worried that somehow a virus or malware/adware might get into it.

 

Thanks!

 

EDITED TO ADD: I'M GOING TO RUN HOUSE CALL AGAIN TO SEE WHAT POPS UP. FINGERS CROSSED!!

Edited by nadalotta
Link to comment
Share on other sites

  • Replies 131
  • Created
  • Last Reply

Top Posters In This Topic

p.s. Am I able to send emails (gmail) with attachments yet? Also, what about updating my iphone? I've been staying away from my computer to update/upgrade my iphone because I was worried that somehow a virus or malware/adware might get into it.

 

I don't know about updating your iphone, as I don't have one. I'm also not sure about sending gmail with attachments :huh: I didn't know that was one of your problems.

 

Tell me how your computer is running now.

Link to comment
Share on other sites

It looks okay ... except we haven't totally removed IOBit yet

 

c:\users\Donna\AppData\Roaming\1H1Q1V1N1N1O1RRoaming\1H1Q1V1N1N1O1R < which is 'Advanced Sytstem care by IOBit'
FF - ExtSQL: 2014-10-10 02:30; ascsurfingprotection@iobit.com;

 

Download Ccleaner "free" https://www.piriform.com/ccleaner/download. Do NOT accept any 'bundled tool bars' or software.

Click on the 'Registry' (on the left )... and remove everything for IObit. Be sure to click on the "backup" it will be saved as a "CC # .... just name it.

ccleaner registry.jpg

Link to comment
Share on other sites

OMG, HouseCall shows no problems!!!

 

I already have CCleaner although I have to update it. (Edited to add: I didn't feel like handing over $20+ to something I won't be doing very often - if I'm supposed to use it weekly or something, please let me know)

 

Madam, I clicked on that first link (began with ascs) and it lead to a gmail page so I could send an email to them. Is this what you want me to do? Also, I typed: c:\users\Donna\AppData\Roaming\1H1Q1V1N1N1O1RRoaming\1H1Q1V1N1N1O1R and received an error that Windows couldn't find it and to check spelling and try again.

 

Does it matter which part that I work on first? I wonder if I'm supposed to work on deleting iObit by manually typing in all of those characters which has AppData\Roaming| etc etc (including a bunch of numbers in it) before going to the Registry Cleaner.

 

So I went to the Registry Cleaner and unclicked everything except Applications. (I'm worried because I previously saw IObit Toolbar and wanted to just delete it but I held back.

 

I hope you're still around - thank you either way - if not, we'll talk tomorrow, I hope.

Edited by nadalotta
Link to comment
Share on other sites

Madam, but I'm not going out on my own. Believe me, I'm not! Well, the only thing was to run House Calls. That's all!

 

You said for me to type: c:\users\Donna\AppData\Roaming\1H1Q1V1N1N1O1RRoaming\1H1Q1V1N1N1O1R

I did this but received an error message saying it's wrong and to check spelling.

 

I thought you wanted me to type: ascsurfingprotection@iobit.com so I did but then my gmail popped up with those words in the TO section.

 

OOOhhhhhhhhhhhhhh - I thought you wanted me to download CCleaner (which I already have). I just looked again and maybe you want me to because I need the updated new one. I'll go and do that.

 

Please understand I'm not one of those people who ask for help and then disappear when they think they're doing fine.

 

p.s. I love your icon!

Edited by nadalotta
Link to comment
Share on other sites

You don't need to type anything in .... just use Ccleaner. click on the registry, click on Applications (uncheck everything else), then click 'scan for issues'.

 

I'm hoping that all items concerning IObit will be found, because you uninstalled it using their uninstaller. If issues are found, click the 'fix all selected issues'.

 

Please let me know how this goes.

Link to comment
Share on other sites

Hello Madam,

 

Ooooooohhh! Thank you - I'm on my way!

 

 

 

Hmmmm.... no issues yet I saw IObit Tool Bar earlier.

 

So then I decided to check out CC a little more and I went to TOOLS > UNINSTALL and there was Iobit Toolbar. So it's there but not on Applications.

 

Should I go to the Tools>Uninstall or is there another way to go? Or should I update CCleaner ($20) and then try again. I'm not cheap but I don't use CC so that's why I'm asking.

 

Thanks!

 

Edited to add 2:00 PST I went ahead and bought the $25 pro version of CCleaner - still no difference. After all of this, I'm going to read about CCleaner - it's probably something I could/should have used previously.

Edited by nadalotta
Link to comment
Share on other sites

Oh my dear ... you can get CCleaner for free: http://filehippo.com/download_ccleaner/ version 4.19.4867

Just be sure to uncheck any "bundled" apps when installing!!!

Click yes to create a 'shortcut' and yes to 'notify you of updates'. Don't click yes to anything else. Click on the big green button and save it to your 'downloads' folder. Right click the icon and choose to run as Administrator from the dropdown box.

 

Now, as far as going to ..."TOOLS > UNINSTALL Iobit Toolbar" .... YES, indeed uninstall that sucker :mrgreen:

 

Hopefully we're getting someplace now.

Link to comment
Share on other sites

:pullhair: Wahhhhhhhhh!

 

I went to Tools, Uninstall, highlighted the IObit Toolbar and then clicked Run Uninstaller (Other options were Rename Entry and Delete Entry)

 

Then a gray box appeared - a Windows Installer with:

The feature you are trying to use is on a network resource that is unavailable.

Click OK to try again, or enter an alternate path to a folder containing the installation package 'iobitapps Toolbar .msi' in the box below.

 

Use Source:

 

C:\Users\Donna\AppData\Local\Temp\{ED170A52-B8CC-4CBE-AAB8-DA99CE2AB04F}\

 

To the right of the Use Source is a Browse button. ARRRRRRRRRRRRRRRGH!

 

BTW, I grabbed the Window Installer gray box to move it in a corner and, behind it, was another gray box - the Windows Installer, "Preparing to Remove" and there's a cancel button; however, I can't do anything with that because it's hanging.

Link to comment
Share on other sites

To enable the viewing of Hidden files follow these steps:

1. Close all programs so that you are at your desktop.
2. Click on the Start button. This is the small round button with the Windows flag in the lower left corner.
3. Click on the Control Panel menu option.
4. When the control panel opens you can either be in Classic View or Control Panel Home
view:

If you are in the Classic View do the following:
1. Double-click on the Folder Options icon.
2. Click on the View tab.
3. Go to step 5.

If you are in the Control Panel Home view do the following:
1. Click on the Appearance and Personalization link .
2. Click on Show Hidden Files or Folders.
3. Go to step 5.

5. Under the Hidden files and folders section select the radio button labeled Show hidden files and folders.
6. Remove the checkmark from the checkbox labeled Hide extensions for known file types.
7. Remove the checkmark from the checkbox labeled Hide protected operating system files.
8. Press the Apply button and then the OK button and shutdown My Computer.
9. Now Windows Vista is configured to show all hidden files.

 

Now, look for C:\Users\Donna\AppData\Local\Temp\{ED170A52-B8CC-4CBE-AAB8-DA99CE2AB04F} and delete that temp file.

Next, empty the recycle bin. Reboot/restart your computer.

 

Please re-hide Hidden files by doing the opposite of the above!

Link to comment
Share on other sites

Uh oh!

 

The Show Hidden Files and Folders radio circle thing was already checked; None of the boxes under that you mentioned were checked.

 

I'm going to look for that file - if I find it, do I just go ahead and delete it, empty recycle bin then re-boot?

 

 

Thanks again!

 

EDITED TO ADD: And................ I couldn't delete that file because Windows couldn't locate it, check my spelling, yada yada yada!!! BTW, I just clicked on Start All Programs and there's Iobit Freeware there. I clicked on it and it opened to a page where it's listed for sale. Jeez - I have iobit coming out of my ears!

p.s. I deleted the Iobit Freeware from the Start Programs.

Edited by nadalotta
Link to comment
Share on other sites

Okay .... this is getting to be too much of a head ache!

Download the 'free' version of Revo Uninstaller http://www.revouninstaller.com/revo_uninstaller_free_download.html

 

Once again, DO NOT let any bundled apps get in ... uncheck all when clicking this remover to install!

 

I don't want you to use this for anything other than IObit removal. It can cause damage, if used otherwise ;)

Link to comment
Share on other sites

OK, well, I downloaded Reno but couldn't find where to unclick on programs - all I saw where I could buy Freeware or Pro so I chose the former.

 

I found iobit Apps Toolware v9.7 and clicked to uninstall. Then a window came up with 4 different ways to uninstall. YIKES. I chose #3 and it's running now.

 

In the meantime, the Windows installer with the use source and all finally awoke and wants to know if its safe to remove the product. It's the one with the Use Source of a gazillion numbers and letters. What do I do with those?

 

Thanks!

Link to comment
Share on other sites

Do you have a button that says "Scanning for leftovers after the standard uninstall"? If so that would be a safe one to use.

 

These all need to be removed (if found):

 

c:\users\Donna\AppData\Roaming\1H1Q1V1N1N1O1R

c:\program files\Common Files\IObit

FF - ExtSQL: 2014-10-10 02:30; ascsurfingprotection@iobit.com;

c:\users\Donna\AppData\Roaming\Mozilla\Firefox\Profiles\ilt58l3p.default\extensions\ascsurfingprotection@iobit.com

Advanced System Care 8 by IObit
Smart Defrag 3
Surfing Protection by iObit

c:\program files\iobit\liveupdate\liveupdate.exe
IObit Apps Toolbar v9.7

C:\Users\Donna\AppData\Local\Temp\{ED170A52-B8CC-4CBE-AAB8-DA99CE2AB04F} <<--- this is the source

 

Don't remove anything else .... just IOBit junk!

Link to comment
Share on other sites

Oh crap, while on Revo, I saw iObit Toolbr and clicked on just that - I was so excited to see the word iObit!

 

So all of what you wrote above are on the Revo Uninstaller? OMG, can it be just this now? Yay!

 

 

Do you remember the hanging Windows Installer that I couldn't find on my computer last night? Can I just cancel it then? It's on my desktop.

Edited by nadalotta
Link to comment
Share on other sites

It's still uninstalling the iObit Apps Toolware v9.7. When I saw that, I jumped on it to uninstall. I thought that's all that was there. A window popped up with:

 

1. Uninstall - IObit Apps Toolbar v9.7

 

Then there were 4 green buttons numbered 1-4

1: Creating System Restore Point - done!

2. Analyzing the application's data before uninstalling it.

3. Starting the application's built-in uninstaller.

4. After the application's installer has finished, press the "Next" button to start scanning for leftover files, folders and registry items.

 

So after this finishes and if none of the other items you wrote about in #67 pop up then do you want me to go through Revo again, highlight those other items and then run the Uninstall together?

 

2. Also, I have so extra open windows at the bottom of my screen. CCleaner and the two Windows Installer from CCleaner - can I delete them? (Right click and delete)

 

3. Since it's taking so long for Revo to uninstall IObit Toolbar, I opened Task Manager and deja vu. Under Performance, CPU Usage is 3% and Memory 2.10 GB. To the right of that are the bars for CPU Usage History and Physical Memory Usage History. The former has those green up and down lines but they are at the bottom of it with a few spikes. The Physical Memory Usage History with the blue line, well that blue line is a straight one - kind of like in a medical show where the doc says the patient is dead. I have 107 Processes - isn't that the problem? I don't know where all of those processes are! I looked at what's on my task bar and cut my weather watcher program and Control Center for my printer. There are two notifications of Java and Window Updates but I haven't touched them.

 

Soooooooooooooooooooo..... I really appreciate everything you've been doing but hopefully we're near the end - I hate bugging you! Thank you.

Edited by nadalotta
Link to comment
Share on other sites

Close all Windows except Revo.

 

I would let Revo do it's thing. Let it create a 'back-up'. You'll know if everthing is okay after a few days of using the computer.

 

I'm not sure what CC is showing, so don't delete anything. You can click on "fix" and it will create a backup in your Documents...but please write down the installer numbers/names first and let me know what they are.

Link to comment
Share on other sites

I closed the extra windows and, suddenly, Revo wasn't stuck. I clicked Next on the page and:

 

SCANNING FOR LEFTOVER INFORMATION

Scanning for leftover items completed. Pres "Nest" button to see the results!

 

OOOhhh as I was typing this, it finished so I'm going to press NEXT.

 

WHOAAAAA!!!!!!!!!! It found 146 items!

 

the next page was titled FOUND OVER REGISTRY ITEMS

Note: Please carefully verify the bolded items! Only checked bolded items and their subitems will be deleted.

 

There was: My Computer> HKEY_CKASSES_ROOT > INSTALLER > FEATURES and then there us a blue puzzle piece with these numbers in bold:

C:\Users\Donna\AppData\Local\Temp\{ED170A52-B8CC-4CBE-AAB8-DA99CE2AB04F}\

 

After Features there's:

PRODUCTS and under it is the blue puzzle piece and this number 903C920E1244B01498A0032D8E8ED2C0

I saw it had a + next to the numbers so I clicked in and there were three items in bold with boxes to the left that can be checked (or not) and they were CORE, TOOLBARFF and TOOLBARIE

Then under that, there is UPGRADE CODES and under that is the blue puzzle piece and these numbers: A450291D6543EA640AA7B6912B067307

 

Going down the page, I saw the folder "Folders" with a + to the left so I clicked it. All highlighted were all the following:

 

C:\Program Files\IObit Apps Toolbar\ - 1

C:\Program Files\IObit Apps Toolbar\FF\

C:\Program Files\IObit Apps Toolbar\FF\chrome\

C:\Program Files\IObit Apps Toolbar\FF\components\

C:\Program Files\IObit Apps Toolbar\IE\

C:\Program Files\IObit Apps Toolbar\IE\9.7\

C:\Program Files\IObit Apps Toolbar\Res\

C:\Program Files\IObit Apps Toolbar\Res\Lang\

 

Wow, those were hiding in the folder!

C:\Program Files\IObit Apps Toolbar\

and that's where it differs. I don't want to keep typing C:\Program Files\ so keep it in mind please. Here's the rest:

 

Madam, there's a lot more of that - clicking on the boxes and finding bold things relating to iObit. Do you want me to list them all here? There's no cut & pasting.

 

BTW, if I had originally looked for the items you listed, would I have avoided all of this?

 

Thank you again for your help!

 

Also, I left the CCleaner alone until the Revo Uninstaller stuff is done. (CCleaner hasn't deleted anything)

Edited by nadalotta
Link to comment
Share on other sites

Madam, I hit the cancel key then chose option #2 which was less invasive than #3. When it asked if I were sure, a Windows Installer popped up saying it's on a network resource that's unavailable. Click OK to try again or enter an alternate path to a folder containing the installation package 'iobitsapps Toolbar.msi' in the box below:

C:\Users\Donna\AppData\Local\Temp\{ED170A52-B8CC-4CBE-AAB8-DA99CE2AB04F}\

 

I recognized the above code from post #67:

 

There was: My Computer> HKEY_CKASSES_ROOT > INSTALLER > FEATURES and then there us a blue puzzle piece with these numbers in bold:

C:\Users\Donna\AppData\Local\Temp\{ED170A52-B8CC-4CBE-AAB8-DA99CE2AB04F}\

 

So should I delete that one line or close everything up since the malware is gone?

 

Thanks!

Link to comment
Share on other sites

 Share


×
×
  • Create New...