TELL ME HOW TO UNISTALL THIS

[THISISMALWARE 0]

RIGHT NOW!

Explain to me how I get rid of "Ad-Aware Web Companion" malware!

I don't give you permission to send me emails!

 

Edited May 27, 2018 by THISISMALWARE

[CeciliaB 463]

Hi,

It looks like an uninstallation is ongoing. Please wait until it's finished.

Web Companion isn't malware, it's trying to help you protect the computer from malware.

[THISISMALWARE 0]

 

Hi,

It looks like an uninstallation is ongoing. Please wait until it's finished.

Web Companion isn't malware, it's trying to help you protect the computer from malware.

No, it's not uninstalling.

I have not chosen to install this program. I have probably been tricked to install by a dark pattern. Now i want to get rid of it. But it won't let me.

[CeciliaB 463]

Many free programs have chosen to install Web Companion during the installation of the program you want to have. According to the rules from adaware software, the installation program has to provide the user with a choice of refuse the installation of Web Companion. If you didn't get such a choice, adaware software appreciates if you can tell them which program you installed.

Let us see what's going on in your computer and how to remove Web Companion.

Please, download Farbar Recovery Scan Tool (FRST) and save it on the desktop:
For 64 bits Windows: http://download.bleepingcomputer.com/farbar/FRST64.exe
For 32 bits Windows: http://download.bleepingcomputer.com/farbar/FRST.exe

Double click FRST file to run the tool.
Read the disclaimer and click Yes to accept it.
Click Scan button.

When done, FRST will create two (2) logs on the desktop:

• FRST.txt
• Addition.txt

Please, attach them to your reply.

[THISISMALWARE 0]

 

Many free programs have chosen to install Web Companion during the installation of the program you want to have. According to the rules from adaware software, the installation program has to provide the user with a choice of refuse the installation of Web Companion. If you didn't get such a choice, adaware software appreciates if you can tell them which program you installed.

Let us see what's going on in your computer and how to remove Web Companion.

Please, download Farbar Recovery Scan Tool (FRST) and save it on the desktop:
For 64 bits Windows: http://download.bleepingcomputer.com/farbar/FRST64.exe
For 32 bits Windows: http://download.bleepingcomputer.com/farbar/FRST.exe

Double click FRST file to run the tool.
Read the disclaimer and click Yes to accept it.
Click Scan button.

When done, FRST will create two (2) logs on the desktop:

• FRST.txt
• Addition.txt

Please, attach them to your reply.

That tool gathers information such as all file names in my Documents and Downloads folder. I'am not going to share that information over the internet.

[CeciliaB 463]

I've never seen all files in someone's My documents, but you can upload the files to a file sharing service (Dropbox, Onedrive, Google Drive etc.)  and send the links to the files in a PM to me.

[THISISMALWARE 0]

2 hours ago, CeciliaB said:

I've never seen all files in someone's My documents, but you can upload the files to a file sharing service (Dropbox, Onedrive, Google Drive etc.)  and send the links to the files in a PM to me.

Attached files deleted

 

 

Edited May 30, 2018 by THISISMALWARE

[CeciliaB 463]

Thanks for the files.
I hope that you haven't deleted any lines that mention Web Companion.

Please, move the FRST program from the Downloads folder to the Desktop, otherwise the instructions below won't work.

If possible, start the Web Companion program and change the settings for search in Internet Explorer and Firefox to one that isn't handled by Web Companion. I guess that you already have done that for Chrome.

Please, start Notepad.
Copy all text that is in the box:

CreateRestorePoint:
CloseProcesses:
HKU\S-1-5-21-4260767324-1618741345-2803913681-1001\...\Run: [Web Companion] => C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe [7722600 2018-05-29] (Lavasoft)
IE trusted site: HKU\.DEFAULT\...\webcompanion.com -> hxxp://webcompanion.com
IE trusted site: HKU\S-1-5-21-4260767324-1618741345-2803913681-1001\...\webcompanion.com -> hxxp://webcompanion.com
Reboot:

and paste in Notepad. Check that no files have been split on two lines.
Save the file as fixlist.txt on the desktop.

Exit all programs.
Start FRST, please.
Click the Fix button.
Wait until the tool has finished and the computer has been restarted.

It creates a log file, called Fixlog.txt, on the desktop.
Please, paste the content of that file in your reply.

Web Companion should still be listed as an installed program and has a folder within C:\Program Files (x86).

Do you notice Web Companion in any other way?

[THISISMALWARE 0]

20 minutes ago, CeciliaB said:

Thanks for the files.
I hope that you haven't deleted any lines that mention Web Companion.

Please, move the FRST program from the Downloads folder to the Desktop, otherwise the instructions below won't work.

If possible, start the Web Companion program and change the settings for search in Internet Explorer and Firefox to one that isn't handled by Web Companion. I guess that you already have done that for Chrome.

Please, start Notepad.
Copy all text that is in the box:

CreateRestorePoint:
CloseProcesses:
HKU\S-1-5-21-4260767324-1618741345-2803913681-1001\...\Run: [Web Companion] => C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe [7722600 2018-05-29] (Lavasoft)
IE trusted site: HKU\.DEFAULT\...\webcompanion.com -> hxxp://webcompanion.com
IE trusted site: HKU\S-1-5-21-4260767324-1618741345-2803913681-1001\...\webcompanion.com -> hxxp://webcompanion.com
Reboot:

and paste in Notepad. Check that no files have been split on two lines.
Save the file as fixlist.txt on the desktop.

Exit all programs.
Start FRST, please.
Click the Fix button.
Wait until the tool has finished and the computer has been restarted.

It creates a log file, called Fixlog.txt, on the desktop.
Please, paste the content of that file in your reply.

Web Companion should still be listed as an installed program and has a folder within C:\Program Files (x86).

Do you notice Web Companion in any other way?

Done. I still can't unistnall the program.

Fixlog.txt

[CeciliaB 463]

2 hours ago, CeciliaB said:

Web Companion should still be listed as an installed program and has a folder within C:\Program Files (x86).
Do you notice Web Companion in any other way?

If the answer to that question is "No", please delete the folder C:\Program Files (x86)\Lavasoft.
If that is possible without any errors, restart the computer and try to uninstall Web Companion.
If that isn't possible, please tell me which error message you get.

[THISISMALWARE 0]

The app should not be running. Yet I can't delete the folder. Files in the folder are claimed by some running program. Is the app running under some obscure filename? You know, like malware usually do.

And I can't uninstall the app. You know, like malware. If you look at the screenshot in my first post. It's tellling me it's not associated with a program. Can't you tell me what file does the uninstalling and how to run it manually? The file "WebCompanionInstaller.exe" only starts the app.

All of this is completely unacceptable. I have made a regular support request but they don't answer me. So once again. Can someone tell me how to uninstall the program.

[CeciliaB 463]

Please run FRST again and attach the new log files. Don't delete parts of the files since then I might miss some essential information.

 

1 hour ago, THISISMALWARE said:

Can't you tell me what file does the uninstalling and how to run it manually?

Sorry, I don't know and I haven't installed Web Companion. But I'll ask my contact person.

[Guest]

I have the EXACT same problem and I agree with the OP - it's completely unacceptable. Legit software does NOT, I repeat NOT, behave like this and it's completely absurd that we as unwitting users (I don't care what you say, if it installs without my knowledge it's at the very least adware and at worst malware) are expected to 1. Try to uninstall the crap, 2. Register a frigging account on the website of the malware owner and 3. Jump through hoops posting information PUBLICLY about our computers to get information on how to uninstall.

You KNOW what the issue is but you won't fix it, are you hoping that we'll all just leave the BS excuse for "help" on our computers? This is crap! That being said, since I want the sorry excuse for "helpful software" off my computer this instant I'm posting my log files here because I don't have a frigging choice. Remove them when read.

I have removed ****ing Bing from all browsers which I understand is the next step. Move it along.

 

FRST.txt

Addition.txt

[CeciliaB 463]

14 hours ago, Snuzie said:

if it installs without my knowledge

Well, you must have installed something (probably uTorrent) that started the installation of Web Companion, if you didn't get a choice for the installation of Web Companiion blame the manufacturer of that program that thinks more of the earned money than of your computer.

Most users can uninstall Web Companion in the same way as other computer programs.

 

14 hours ago, Snuzie said:

You KNOW what the issue is but you won't fix it

I'm a volunteer here, not paid by adaware software, and the only difference between you and me is that I've a few email addresses to persons working with Web Companion.

 

Please, start Notepad.
Copy all text that is in the box:

CreateRestorePoint:
CloseProcesses:
HKU\S-1-5-21-741051300-1619859580-3169136444-1000\...\Run: [Web Companion] => C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe [7722600 2018-06-24] (Lavasoft)
FF SearchPlugin: C:\Users\Jenny\AppData\Roaming\Mozilla\Firefox\Profiles\5e9nshx3.default-1480451579585-1516624818491\searchplugins\bing-lavasoft-ff59.xml [2018-06-24]
R0 gfibto; C:\WINDOWS\System32\drivers\gfibto.sys [14456 2013-09-23] (GFI Software)
2018-06-24 14:45 - 2018-06-24 14:45 - 000000000 ____D C:\Users\Jenny\AppData\Local\Lavasoft
2018-06-24 14:45 - 2018-06-24 14:45 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lavasoft
2018-06-24 14:44 - 2018-06-24 14:44 - 000000000 ____D C:\Users\Jenny\AppData\Roaming\Lavasoft
2018-06-24 14:44 - 2018-06-24 14:44 - 000000000 ____D C:\ProgramData\Lavasoft
2018-06-24 14:44 - 2018-06-24 14:44 - 000000000 ____D C:\Program Files (x86)\Lavasoft
IE trusted site: HKU\S-1-5-21-741051300-1619859580-3169136444-1000\...\webcompanion.com -> hxxp://webcompanion.com
HKU\S-1-5-21-741051300-1619859580-3169136444-1000\...\StartupApproved\Run: => "Web Companion"
Reboot:

and paste in Notepad. Check that no files have been split on two lines.
Save the file as fixlist.txt on the desktop.

Exit all programs.
Start FRST, please.
Click the Fix button.
Wait until the tool has finished.

It creates a log file, called Fixlog.txt, on the desktop.
Please, paste the content of that file in your reply.

[Guest]

So, you're a volunteer and no employees are actually bothering with unwilling customers. Fair enough, the message is loud and clear. Since you have e-mail addresses to Adaware employees, please tell them that I used Lavasoft products in the past but from now on I'd rather nuke my laptop than run any of them again.

The fixlist.txt content (without the information on top, that's way too personal.

fixlist content:
*****************

CreateRestorePoint:
CloseProcesses:
HKU\S-1-5-21-741051300-1619859580-3169136444-1000\...\Run: [Web
Companion] => C:\Program Files (x86)\Lavasoft\Web
Companion\Application\WebCompanion.exe [7722600 2018-06-24]
(Lavasoft)
FF SearchPlugin:
C:\Users\Jenny\AppData\Roaming\Mozilla\Firefox\Profiles\5e9nshx3.default-1480451579585-1516624818491\searchplugins\bing-lavasoft-ff59.xml
[2018-06-24]
R0 gfibto; C:\WINDOWS\System32\drivers\gfibto.sys [14456 2013-09-23]
(GFI Software)
2018-06-24 14:45 - 2018-06-24 14:45 - 000000000 ____D
C:\Users\Jenny\AppData\Local\Lavasoft
2018-06-24 14:45 - 2018-06-24 14:45 - 000000000 ____D
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lavasoft
2018-06-24 14:44 - 2018-06-24 14:44 - 000000000 ____D
C:\Users\Jenny\AppData\Roaming\Lavasoft
2018-06-24 14:44 - 2018-06-24 14:44 - 000000000 ____D
C:\ProgramData\Lavasoft
2018-06-24 14:44 - 2018-06-24 14:44 - 000000000 ____D C:\Program
Files (x86)\Lavasoft
IE trusted site:
HKU\S-1-5-21-741051300-1619859580-3169136444-1000\...\webcompanion.com
-> hxxp://webcompanion.com
HKU\S-1-5-21-741051300-1619859580-3169136444-1000\...\StartupApproved\Run:
=> "Web Companion"
Reboot:

*****************

Restore point was successfully created.
Processes closed successfully.
"HKU\S-1-5-21-741051300-1619859580-3169136444-1000\Software\Microsoft\Windows\CurrentVersion\Run\\HKU\S-1-5-21-741051300-1619859580-3169136444-1000\...\Run: [Web" => not found
Companion] => C:\Program Files (x86)\Lavasoft\Web => Error: No automatic fix found for this entry.
Companion\Application\WebCompanion.exe [7722600 2018-06-24] => Error: No automatic fix found for this entry.
(Lavasoft) => Error: No automatic fix found for this entry.
"FF SearchPlugin:" => not found
"C:\Users\Jenny\AppData\Roaming\Mozilla\Firefox\Profiles\5e9nshx3.default-1480451579585-1516624818491\searchplugins\bing-lavasoft-ff59.xml" => not found
[2018-06-24] => Error: No automatic fix found for this entry.
gfibto => Unable to stop service.
"HKLM\System\CurrentControlSet\Services\gfibto" => removed successfully
gfibto => service removed successfully
(GFI Software) => Error: No automatic fix found for this entry.
"2018-06-24 14:45 - 2018-06-24 14:45 - 000000000 ____D" => not found
C:\Users\Jenny\AppData\Local\Lavasoft => moved successfully
"2018-06-24 14:45 - 2018-06-24 14:45 - 000000000 ____D" => not found
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lavasoft => moved successfully
"2018-06-24 14:44 - 2018-06-24 14:44 - 000000000 ____D" => not found
C:\Users\Jenny\AppData\Roaming\Lavasoft => moved successfully
"2018-06-24 14:44 - 2018-06-24 14:44 - 000000000 ____D" => not found
C:\ProgramData\Lavasoft => moved successfully
Symbolic link found: "C:\Program" => "C:\Program Files"
"C:\Program" => Symbolic link removed successfully
C:\Program => moved successfully
Files (x86)\Lavasoft => Error: No automatic fix found for this entry.
IE trusted site: => Error: No automatic fix found for this entry.
HKU\S-1-5-21-741051300-1619859580-3169136444-1000\...\webcompanion.com => Error: No automatic fix found for this entry.
-> hxxp://webcompanion.com => Error: No automatic fix found for this entry.
"HKU\S-1-5-21-741051300-1619859580-3169136444-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run\\HKU\S-1-5-21-741051300-1619859580-3169136444-1000\...\StartupApproved\Run:" => not found
"HKU\S-1-5-21-741051300-1619859580-3169136444-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\HKU\S-1-5-21-741051300-1619859580-3169136444-1000\...\StartupApproved\Run:" => not found
=> "Web Companion" => Error: No automatic fix found for this entry.

The system needed a reboot.

==== End of Fixlog 12:38:34 ====

[CeciliaB 463]

Sorry, please repeat my previous post and make sure that fixlist.txt  doesn't contain any line breaks/carriage returns that shouldn't be there. According to the log files several lines in the box has been split in fixlist.txt .

For example this single line:

FF SearchPlugin: C:\Users\Jenny\AppData\Roaming\Mozilla\Firefox\Profiles\5e9nshx3.default-1480451579585-1516624818491\searchplugins\bing-lavasoft-ff59.xml [2018-06-24]

has been divided into three lines in your fixlist.txt:

FF SearchPlugin:
C:\Users\Jenny\AppData\Roaming\Mozilla\Firefox\Profiles\5e9nshx3.default-1480451579585-1516624818491\searchplugins\bing-lavasoft-ff59.xml
[2018-06-24]

and the FRST doesn't understand it.

[CeciliaB 463]

50 minutes ago, Snuzie said:

So, you're a volunteer and no employees are actually bothering with unwilling customers

There is a support team within the company but they aren't handling the forum. I saw that you'd a free program from Avast installed, if you get a problem with that you'll have to go to the Avast forum and there will be volunteers helping you. That's very common for free programs.

[Guest]

Thank you. I copied the text from the e-mail I received with the content of you reply instead of from the forum, that was most likely the reason. This is the new logfile.

 

fixlist content:
*****************
CreateRestorePoint:
CloseProcesses:
HKU\S-1-5-21-741051300-1619859580-3169136444-1000\...\Run: [Web Companion] => C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe [7722600 2018-06-24] (Lavasoft)
FF SearchPlugin: C:\Users\Jenny\AppData\Roaming\Mozilla\Firefox\Profiles\5e9nshx3.default-1480451579585-1516624818491\searchplugins\bing-lavasoft-ff59.xml [2018-06-24]
R0 gfibto; C:\WINDOWS\System32\drivers\gfibto.sys [14456 2013-09-23] (GFI Software)
2018-06-24 14:45 - 2018-06-24 14:45 - 000000000 ____D C:\Users\Jenny\AppData\Local\Lavasoft
2018-06-24 14:45 - 2018-06-24 14:45 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lavasoft
2018-06-24 14:44 - 2018-06-24 14:44 - 000000000 ____D C:\Users\Jenny\AppData\Roaming\Lavasoft
2018-06-24 14:44 - 2018-06-24 14:44 - 000000000 ____D C:\ProgramData\Lavasoft
2018-06-24 14:44 - 2018-06-24 14:44 - 000000000 ____D C:\Program Files (x86)\Lavasoft
IE trusted site: HKU\S-1-5-21-741051300-1619859580-3169136444-1000\...\webcompanion.com -> hxxp://webcompanion.com
HKU\S-1-5-21-741051300-1619859580-3169136444-1000\...\StartupApproved\Run: => "Web Companion"
Reboot:
*****************

Restore point was successfully created.
Processes closed successfully.
"HKU\S-1-5-21-741051300-1619859580-3169136444-1000\Software\Microsoft\Windows\CurrentVersion\Run\\Web Companion" => removed successfully
"C:\Users\Jenny\AppData\Roaming\Mozilla\Firefox\Profiles\5e9nshx3.default-1480451579585-1516624818491\searchplugins\bing-lavasoft-ff59.xml" => not found
gfibto => service not found.
"C:\Users\Jenny\AppData\Local\Lavasoft" => not found
"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lavasoft" => not found
"C:\Users\Jenny\AppData\Roaming\Lavasoft" => not found
C:\ProgramData\Lavasoft => moved successfully
C:\Program Files (x86)\Lavasoft => moved successfully
"HKU\S-1-5-21-741051300-1619859580-3169136444-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\webcompanion.com" => removed successfully
"HKU\S-1-5-21-741051300-1619859580-3169136444-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run\\Web Companion" => removed successfully
"HKU\S-1-5-21-741051300-1619859580-3169136444-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\Web Companion" => not found

The system needed a reboot.

==== End of Fixlog 17:54:54 ====

[CeciliaB 463]

I agree, that was probably the reason.

Do you notice Web Companion anywhere now?

[Guest]

No, it's gone now. Thank you for your help. Now, how do I delete my account from this site? I've searched and checked under "Account settings" and "Profile" but cannot find an option to delete the account and I want to do that.

Edited June 25, 2018 by Guest
Addition to post

[CeciliaB 463]

You're welcome :)

You can't do that yourself, it's only the admins that can delete accounts. I'll send the head admin a message.