Cannot uninstall program. (add/remove will NOT work)

[soup]

I am at my wits end.  I musn't have been as careful as I thought and have downloaded a web browser hijacker (it changes your homepage and default search) with some free software.  Have changed the defaults back but I am left with "shopper helper smartbar" (and engine) in add/remove programs, however whatever I try I can not get these entries to go away have tried with other software and add/remove will work it just wont work on this "shopper helper".  Any ideas on what I can do next.  Have used  MSs own 'fixer' it states that this smartbar has been removed but it is still there in the add/remove list.

 

 

[H4X3R]

use "iobit uninstaller" or find the file directory and delete it using "unlocker".

[ttam]

Use program Adwcleaner and JRT

[brighttail]

Here is a page you can use with step by step instructions:

 

http://malwaretips.com/blogs/shopping-helper-smartbar-virus/

 

Good luck.

[soup]

use "iobit uninstaller" or find the file directory and delete it using "unlocker".

 

It's still there, using search I cannot find it.

[soup]

Here is a page you can use with step by step instructions:

 

http://malwaretips.com/blogs/shopping-helper-smartbar-virus/

 

Good luck.

The first part of that is go to add/remove.  Add/remove does NOT work on this entry add/remove works on other stuff so I feel it is not add/remove itself at fault.

[soup]

Use program Adwcleaner and JRT

Nope.  It's still there.

 

I can find nothing it links to, and it is not affecting anything so am of to bed now and shall just ignore it.

[TDP_Equinox]

use revo uninstaller to get rid of it in safe mode, and then use these tools 
ADWCleaner
Adware Removal Tool
Combo Fix
Hitman Pro

Malwarebytes
RogueKiller

and spybot search and destroy 1.6.2

Use them all in safe mode with networking and then reset your browsers.

[Windows98SE]

if you download and run malwarebytes, it'll probably take care of it.

[TDP_Equinox]

if you download and run malwarebytes, it'll probably take care of it.

please do not recommend only running one scan.

It makes me die a little when people say any one scan can remove everything.

You need to run ALL the scans, and even then there is a chance it will come back.

[soup]

if you download and run malwarebytes, it'll probably take care of it.

Did that last night , they're still there

[soup]

Revo uninstaller got it, mucho gracias.

What the fuc flip is going on.with this quoting and...

[TDP_Equinox]

 

Revo uninstaller got it, mucho gracias.

What the fuc flip is going on.with this quoting and...

 

Yay!

>Dem quoting skill doe.

[Windows98SE]

please do not recommend only running one scan.

It makes me die a little when people say any one scan can remove everything.

You need to run ALL the scans, and even then there is a chance it will come back.

You don't NEED to run all scans. If Malwarebytes cleans it up, fine. If it doesn't, then he could continue running the 900 other things you suggested.

[TDP_Equinox]

You don't NEED to run all scans. If Malwarebytes cleans it up, fine. If it doesn't, then he could continue running the 900 other things you suggested.

Just because you don't see the viruses doing something to your computer, does not mean they are not there.

There could be a keylogger that calls home once every few hours, so you do not see the performance hit of it always reporting back. There could be more malware just sitting there dormant for a while. waiting to strike back.

NEVER, EVER, use a computer that was previously infected without FULLY cleaning it out. 

 

If you do not know what you are talking about, please do not make the situation worse by trying to help. thanks.

[TDP_Equinox]

Just because you don't see the viruses doing something to your computer, does not mean they are not there.

There could be a keylogger that calls home once every few hours, so you do not see the performance hit of it always reporting back. There could be more malware just sitting there dormant for a while. waiting to strike back.

NEVER, EVER, use a computer that was previously infected without FULLY cleaning it out. 

It is going to take you an afternoon or two, but that is your fault for getting malware. 

 

If you do not know what you are talking about, please do not make the situation worse by trying to help. thanks.

[Windows98SE]

Just because you don't see the viruses doing something to your computer, does not mean they are not there.

There could be a keylogger that calls home once every few hours, so you do not see the performance hit of it always reporting back. There could be more malware just sitting there dormant for a while. waiting to strike back.

NEVER, EVER, use a computer that was previously infected without FULLY cleaning it out. 

 

So I read this post a few hours ago, and let it sit and fester a bit so I don't fly off the handle while replying to you.

 

I've worked in IT for 15 years. If I get an infected machine, I have three steps I follow:

 

1. Full scan with Malwarebytes

2. Combofix

if the machine still indicates it is infected, I've sank too much time into it and it's time to...

3. Wipe

 

Your suggestions to the OP were complete overkill. Given the information in the original post and few subsequent posts, you can make safe assumptions that:

 

1) The BHO that was installed was likely the only malware installed

2) The BHO was likely disabled and/or uninstalled by the Microsoft cleanup tool

3) The add/remove entry is probably just damaged from #2 and won't go away because it can't close with a proper status code.

 

For sake of simplicity, I suggested Malwarebytes. By itself, Malwarebytes does a pretty solid job of cleaning up serious malware infections and it is smart enough to parse the registry and remove the bad add/remove program options.

 

Before you fire back with "BUT IT COULDVE COME WITH OTHER MALWARE!!!!!!!!!!!":

 

Let's assume the OP has an active malware infection and we have no idea what the scale of the infection is. From experience, I can deduce Malwarebytes can detect/clean about 95% of infections because it doesn't fair well with rootkits. I kick the scan off. It comes back and detects/cleans what it found. I reboot. I kick off Combofix. Let's say Combofix also has the ability to detect 95% of malware. However, you have to remember MB has already scanned and cleaned the machine, so the odds of infection are decreasing exponentially with each subsequent scan. But since no scanner has a detection rate of 100%, one can NEVER guarantee that a machine is clean.

 

After the first one or two scans, you are more or less just WASTING TIME. The overlap in the detection capability between scanners will rapidly approach 99% and you will theoretically never reach 100%.

 

So, to recap, the only way to guarantee a clean machine is to wipe the bastard. The OP indicated that he had a single toolbar infection and you recommended he run 8 tools and then reset his browsers. Complete. Overkill.

 

To steal your words:

 

 

If you do not know what you are talking about, please do not make the situation worse by trying to help. thanks.

 

 

Get off your high horse.

[TDP_Equinox]

So I read this post a few hours ago, and let it sit and fester a bit so I don't fly off the handle while replying to you.

 

I've worked in IT for 15 years. If I get an infected machine, I have three steps I follow:

 

1. Full scan with Malwarebytes

2. Combofix

if the machine still indicates it is infected, I've sank too much time into it and it's time to...

3. Wipe

 

Your suggestions to the OP were complete overkill. Given the information in the original post and few subsequent posts, you can make safe assumptions that:

 

1) The BHO that was installed was likely the only malware installed

2) The BHO was likely disabled and/or uninstalled by the Microsoft cleanup tool

3) The add/remove entry is probably just damaged from #2 and won't go away because it can't close with a proper status code.

 

For sake of simplicity, I suggested Malwarebytes. By itself, Malwarebytes does a pretty solid job of cleaning up serious malware infections and it is smart enough to parse the registry and remove the bad add/remove program options.

 

Before you fire back with "BUT IT COULDVE COME WITH OTHER MALWARE!!!!!!!!!!!":

 

Let's assume the OP has an active malware infection and we have no idea what the scale of the infection is. From experience, I can deduce Malwarebytes can detect/clean about 95% of infections because it doesn't fair well with rootkits. I kick the scan off. It comes back and detects/cleans what it found. I reboot. I kick off Combofix. Let's say Combofix also has the ability to detect 95% of malware. However, you have to remember MB has already scanned and cleaned the machine, so the odds of infection are decreasing exponentially with each subsequent scan. But since no scanner has a detection rate of 100%, one can NEVER guarantee that a machine is clean.

 

After the first one or two scans, you are more or less just WASTING TIME. The overlap in the detection capability between scanners will rapidly approach 99% and you will theoretically never reach 100%.

 

So, to recap, the only way to guarantee a clean machine is to wipe the bastard. The OP indicated that he had a single toolbar infection and you recommended he run 8 tools and then reset his browsers. Complete. Overkill.

 

To steal your words:

 

 

 

 

Get off your high horse.

Oh yeah, REAL calm....

you can work in IT for 50 years, and you will never know everything.

I don't know everything, and you don't know everything. But i do know malware. I know it very well.

I should, seeing as how a large part of my job is removing it.

And i can tell you, that any one scanner does NOT get 90% of things.

It's more like 40%. 

I can tell you, that each and every scanner, down to the last scan, finds at least 10-40 things.

MB finds around 200-800 entries, but i have seen it in the thousands. We have to write down how many they find, for the customer.

ADWCleaner usually finds anywhere from 40-140.

ART usually finds 70-90

Combofix usually finds around 400-750.

Hitman pro finds a lot of lower level stuff, but if you run it first it finds the really bad guys.

Rogue killer finds rootkits and browser hijackers.

The list goes on. 

To say that any one or two can safely clean a computer is just ignorance.

Wiping a computer is the lazy mans way out. 

So, to recap, do not fix the symptoms, fix the CAUSE of the symptoms. 

Would a doctor treat ebola with plastic surgery? No. 

While you were writing a novel, OP marked it as solved.

Get off YOUR high horse, buddy.

[soup]

Wiping a computer is the lazy mans way out. 

 

Thanks again for the solution.

  I do not wirh to take sides in this "willy waving" contest. Suffice to say I can see both approaches.

 

But I would say that yes the nuke~reinstall is the lazy man's way but it is also the only SURE (not five 9s) way.

Also if you are cleaning someone else's system for money, and you guarantee it, quite often the only economical way to go is the N~R route.

Otherwise you MIGHT be called again (FOC this time) when something (very clever and very dormant) comes up after a while.

[TDP_Equinox]

Thanks again for the solution.

  I do not wirh to take sides in this "willy waving" contest. Suffice to say I can see both approaches.

 

But I would say that yes the nuke~reinstall is the lazy man's way but it is also the only SURE (not five 9s) way.

Also if you are cleaning someone else's system for money, and you guarantee it, quite often the only economical way to go is the N~R route.

Otherwise you MIGHT be called again (FOC this time) when something (very clever and very dormant) comes up after a while.

We warranty our virus removals for 7 days, because, lets be honest, people are stupid. 

There is a 100% chance they will be in a few months later, with more malware.

For us, a wipe and reload is not just "you get nothing but updates". We backup their data, wipe the system, do what we call a "pre start" that consists of updates, drivers, run times, libre and other stuff (if they have, say, ms office, we will get the code and email and re install it) settings, browsers with adblock, etc and then we put their data back on. 

So it is often much more of a viable option to try and salvage the OS.

But I'm glad you got it fixed

[soup]

For us, a wipe and reload is not just "you get nothing but updates". We backup their data, wipe the system, do what we call a "pre start" that consists of updates, drivers, run times, libre and other stuff (if they have, say, ms office, we will get the code and email and re install it) settings, browsers with adblock, etc and then we put their data back on.

 

Yup, that is what I meant.

I keep a system image just for this very scenario.

 

 

It was a real case of 'do as I say don't do as I do', as the image was[1] months old.  Not catastrophic to go back to then but a lot less work if the solution/fix was (relatively) quick and painless.

I usually suggest a new image is made monthly or after major changes, guess we all get sloppy.

 

[1] Note the "was" I have made a new image due to all this saga bringing it to mind.

[Windows98SE]

So, to recap, do not fix the symptoms, fix the CAUSE of the symptoms.

Would a doctor treat ebola with plastic surgery? No.

This is the worst analogy I've ever heard, and it's clear you didn't absorb any of what I said.

Godspeed to you and your endeavors. I'm sure your clients will appreciate being billed for hours and hours of redundant work.

[TDP_Equinox]

This is the worst analogy I've ever heard, and it's clear you didn't absorb any of what I said.

Godspeed to you and your endeavors. I'm sure your clients will appreciate being billed for hours and hours of redundant work.

They appreciate a thorough job  

Hour and a half charge, no matter how long it, takes.