THISISMALWARE 0 Report post Posted May 27, 2018 (edited) RIGHT NOW! Explain to me how I get rid of "Ad-Aware Web Companion" malware! I don't give you permission to send me emails! Edited May 27, 2018 by THISISMALWARE Quote Share this post Link to post Share on other sites
0 CeciliaB 473 Report post Posted May 27, 2018 Hi, It looks like an uninstallation is ongoing. Please wait until it's finished. Web Companion isn't malware, it's trying to help you protect the computer from malware. Quote Share this post Link to post Share on other sites
0 THISISMALWARE 0 Report post Posted May 29, 2018 Hi, It looks like an uninstallation is ongoing. Please wait until it's finished. Web Companion isn't malware, it's trying to help you protect the computer from malware. No, it's not uninstalling. I have not chosen to install this program. I have probably been tricked to install by a dark pattern. Now i want to get rid of it. But it won't let me. Quote Share this post Link to post Share on other sites
0 CeciliaB 473 Report post Posted May 29, 2018 Many free programs have chosen to install Web Companion during the installation of the program you want to have. According to the rules from adaware software, the installation program has to provide the user with a choice of refuse the installation of Web Companion. If you didn't get such a choice, adaware software appreciates if you can tell them which program you installed. Let us see what's going on in your computer and how to remove Web Companion. Please, download Farbar Recovery Scan Tool (FRST) and save it on the desktop: For 64 bits Windows: http://download.bleepingcomputer.com/farbar/FRST64.exe For 32 bits Windows: http://download.bleepingcomputer.com/farbar/FRST.exe Double click FRST file to run the tool. Read the disclaimer and click Yes to accept it. Click Scan button. When done, FRST will create two (2) logs on the desktop: FRST.txt Addition.txt Please, attach them to your reply. Quote Share this post Link to post Share on other sites
0 THISISMALWARE 0 Report post Posted May 29, 2018 Many free programs have chosen to install Web Companion during the installation of the program you want to have. According to the rules from adaware software, the installation program has to provide the user with a choice of refuse the installation of Web Companion. If you didn't get such a choice, adaware software appreciates if you can tell them which program you installed. Let us see what's going on in your computer and how to remove Web Companion. Please, download Farbar Recovery Scan Tool (FRST) and save it on the desktop: For 64 bits Windows: http://download.bleepingcomputer.com/farbar/FRST64.exe For 32 bits Windows: http://download.bleepingcomputer.com/farbar/FRST.exe Double click FRST file to run the tool. Read the disclaimer and click Yes to accept it. Click Scan button. When done, FRST will create two (2) logs on the desktop: FRST.txt Addition.txt Please, attach them to your reply. That tool gathers information such as all file names in my Documents and Downloads folder. I'am not going to share that information over the internet. Quote Share this post Link to post Share on other sites
0 CeciliaB 473 Report post Posted May 30, 2018 I've never seen all files in someone's My documents, but you can upload the files to a file sharing service (Dropbox, Onedrive, Google Drive etc.) and send the links to the files in a PM to me. Quote Share this post Link to post Share on other sites
0 THISISMALWARE 0 Report post Posted May 30, 2018 (edited) 2 hours ago, CeciliaB said: I've never seen all files in someone's My documents, but you can upload the files to a file sharing service (Dropbox, Onedrive, Google Drive etc.) and send the links to the files in a PM to me. Attached files deleted Edited May 30, 2018 by THISISMALWARE Quote Share this post Link to post Share on other sites
0 CeciliaB 473 Report post Posted May 30, 2018 Thanks for the files. I hope that you haven't deleted any lines that mention Web Companion. Please, move the FRST program from the Downloads folder to the Desktop, otherwise the instructions below won't work. If possible, start the Web Companion program and change the settings for search in Internet Explorer and Firefox to one that isn't handled by Web Companion. I guess that you already have done that for Chrome. Please, start Notepad. Copy all text that is in the box: CreateRestorePoint: CloseProcesses: HKU\S-1-5-21-4260767324-1618741345-2803913681-1001\...\Run: [Web Companion] => C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe [7722600 2018-05-29] (Lavasoft) IE trusted site: HKU\.DEFAULT\...\webcompanion.com -> hxxp://webcompanion.com IE trusted site: HKU\S-1-5-21-4260767324-1618741345-2803913681-1001\...\webcompanion.com -> hxxp://webcompanion.com Reboot: and paste in Notepad. Check that no files have been split on two lines. Save the file as fixlist.txt on the desktop. Exit all programs. Start FRST, please. Click the Fix button. Wait until the tool has finished and the computer has been restarted. It creates a log file, called Fixlog.txt, on the desktop. Please, paste the content of that file in your reply. Web Companion should still be listed as an installed program and has a folder within C:\Program Files (x86). Do you notice Web Companion in any other way? Quote Share this post Link to post Share on other sites
0 THISISMALWARE 0 Report post Posted May 30, 2018 20 minutes ago, CeciliaB said: Thanks for the files. I hope that you haven't deleted any lines that mention Web Companion. Please, move the FRST program from the Downloads folder to the Desktop, otherwise the instructions below won't work. If possible, start the Web Companion program and change the settings for search in Internet Explorer and Firefox to one that isn't handled by Web Companion. I guess that you already have done that for Chrome. Please, start Notepad. Copy all text that is in the box: CreateRestorePoint: CloseProcesses: HKU\S-1-5-21-4260767324-1618741345-2803913681-1001\...\Run: [Web Companion] => C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe [7722600 2018-05-29] (Lavasoft) IE trusted site: HKU\.DEFAULT\...\webcompanion.com -> hxxp://webcompanion.com IE trusted site: HKU\S-1-5-21-4260767324-1618741345-2803913681-1001\...\webcompanion.com -> hxxp://webcompanion.com Reboot: and paste in Notepad. Check that no files have been split on two lines. Save the file as fixlist.txt on the desktop. Exit all programs. Start FRST, please. Click the Fix button. Wait until the tool has finished and the computer has been restarted. It creates a log file, called Fixlog.txt, on the desktop. Please, paste the content of that file in your reply. Web Companion should still be listed as an installed program and has a folder within C:\Program Files (x86). Do you notice Web Companion in any other way? Done. I still can't unistnall the program. Fixlog.txt Quote Share this post Link to post Share on other sites
0 CeciliaB 473 Report post Posted May 30, 2018 2 hours ago, CeciliaB said: Web Companion should still be listed as an installed program and has a folder within C:\Program Files (x86). Do you notice Web Companion in any other way? If the answer to that question is "No", please delete the folder C:\Program Files (x86)\Lavasoft. If that is possible without any errors, restart the computer and try to uninstall Web Companion. If that isn't possible, please tell me which error message you get. Quote Share this post Link to post Share on other sites
0 THISISMALWARE 0 Report post Posted May 31, 2018 The app should not be running. Yet I can't delete the folder. Files in the folder are claimed by some running program. Is the app running under some obscure filename? You know, like malware usually do. And I can't uninstall the app. You know, like malware. If you look at the screenshot in my first post. It's tellling me it's not associated with a program. Can't you tell me what file does the uninstalling and how to run it manually? The file "WebCompanionInstaller.exe" only starts the app. All of this is completely unacceptable. I have made a regular support request but they don't answer me. So once again. Can someone tell me how to uninstall the program. Quote Share this post Link to post Share on other sites
0 CeciliaB 473 Report post Posted May 31, 2018 Please run FRST again and attach the new log files. Don't delete parts of the files since then I might miss some essential information. 1 hour ago, THISISMALWARE said: Can't you tell me what file does the uninstalling and how to run it manually? Sorry, I don't know and I haven't installed Web Companion. But I'll ask my contact person. Quote Share this post Link to post Share on other sites
0 Guest Report post Posted June 24, 2018 I have the EXACT same problem and I agree with the OP - it's completely unacceptable. Legit software does NOT, I repeat NOT, behave like this and it's completely absurd that we as unwitting users (I don't care what you say, if it installs without my knowledge it's at the very least adware and at worst malware) are expected to 1. Try to uninstall the crap, 2. Register a frigging account on the website of the malware owner and 3. Jump through hoops posting information PUBLICLY about our computers to get information on how to uninstall. You KNOW what the issue is but you won't fix it, are you hoping that we'll all just leave the BS excuse for "help" on our computers? This is crap! That being said, since I want the sorry excuse for "helpful software" off my computer this instant I'm posting my log files here because I don't have a frigging choice. Remove them when read. I have removed ****ing Bing from all browsers which I understand is the next step. Move it along. FRST.txt Addition.txt Quote Share this post Link to post Share on other sites
0 CeciliaB 473 Report post Posted June 25, 2018 14 hours ago, Snuzie said: if it installs without my knowledge Well, you must have installed something (probably uTorrent) that started the installation of Web Companion, if you didn't get a choice for the installation of Web Companiion blame the manufacturer of that program that thinks more of the earned money than of your computer. Most users can uninstall Web Companion in the same way as other computer programs. 14 hours ago, Snuzie said: You KNOW what the issue is but you won't fix it I'm a volunteer here, not paid by adaware software, and the only difference between you and me is that I've a few email addresses to persons working with Web Companion. Please, start Notepad. Copy all text that is in the box: CreateRestorePoint: CloseProcesses: HKU\S-1-5-21-741051300-1619859580-3169136444-1000\...\Run: [Web Companion] => C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe [7722600 2018-06-24] (Lavasoft) FF SearchPlugin: C:\Users\Jenny\AppData\Roaming\Mozilla\Firefox\Profiles\5e9nshx3.default-1480451579585-1516624818491\searchplugins\bing-lavasoft-ff59.xml [2018-06-24] R0 gfibto; C:\WINDOWS\System32\drivers\gfibto.sys [14456 2013-09-23] (GFI Software) 2018-06-24 14:45 - 2018-06-24 14:45 - 000000000 ____D C:\Users\Jenny\AppData\Local\Lavasoft 2018-06-24 14:45 - 2018-06-24 14:45 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lavasoft 2018-06-24 14:44 - 2018-06-24 14:44 - 000000000 ____D C:\Users\Jenny\AppData\Roaming\Lavasoft 2018-06-24 14:44 - 2018-06-24 14:44 - 000000000 ____D C:\ProgramData\Lavasoft 2018-06-24 14:44 - 2018-06-24 14:44 - 000000000 ____D C:\Program Files (x86)\Lavasoft IE trusted site: HKU\S-1-5-21-741051300-1619859580-3169136444-1000\...\webcompanion.com -> hxxp://webcompanion.com HKU\S-1-5-21-741051300-1619859580-3169136444-1000\...\StartupApproved\Run: => "Web Companion" Reboot: and paste in Notepad. Check that no files have been split on two lines. Save the file as fixlist.txt on the desktop. Exit all programs. Start FRST, please. Click the Fix button. Wait until the tool has finished. It creates a log file, called Fixlog.txt, on the desktop. Please, paste the content of that file in your reply. Quote Share this post Link to post Share on other sites
0 Guest Report post Posted June 25, 2018 So, you're a volunteer and no employees are actually bothering with unwilling customers. Fair enough, the message is loud and clear. Since you have e-mail addresses to Adaware employees, please tell them that I used Lavasoft products in the past but from now on I'd rather nuke my laptop than run any of them again. The fixlist.txt content (without the information on top, that's way too personal. fixlist content: ***************** CreateRestorePoint: CloseProcesses: HKU\S-1-5-21-741051300-1619859580-3169136444-1000\...\Run: [Web Companion] => C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe [7722600 2018-06-24] (Lavasoft) FF SearchPlugin: C:\Users\Jenny\AppData\Roaming\Mozilla\Firefox\Profiles\5e9nshx3.default-1480451579585-1516624818491\searchplugins\bing-lavasoft-ff59.xml [2018-06-24] R0 gfibto; C:\WINDOWS\System32\drivers\gfibto.sys [14456 2013-09-23] (GFI Software) 2018-06-24 14:45 - 2018-06-24 14:45 - 000000000 ____D C:\Users\Jenny\AppData\Local\Lavasoft 2018-06-24 14:45 - 2018-06-24 14:45 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lavasoft 2018-06-24 14:44 - 2018-06-24 14:44 - 000000000 ____D C:\Users\Jenny\AppData\Roaming\Lavasoft 2018-06-24 14:44 - 2018-06-24 14:44 - 000000000 ____D C:\ProgramData\Lavasoft 2018-06-24 14:44 - 2018-06-24 14:44 - 000000000 ____D C:\Program Files (x86)\Lavasoft IE trusted site: HKU\S-1-5-21-741051300-1619859580-3169136444-1000\...\webcompanion.com -> hxxp://webcompanion.com HKU\S-1-5-21-741051300-1619859580-3169136444-1000\...\StartupApproved\Run: => "Web Companion" Reboot: ***************** Restore point was successfully created. Processes closed successfully. "HKU\S-1-5-21-741051300-1619859580-3169136444-1000\Software\Microsoft\Windows\CurrentVersion\Run\\HKU\S-1-5-21-741051300-1619859580-3169136444-1000\...\Run: [Web" => not found Companion] => C:\Program Files (x86)\Lavasoft\Web => Error: No automatic fix found for this entry. Companion\Application\WebCompanion.exe [7722600 2018-06-24] => Error: No automatic fix found for this entry. (Lavasoft) => Error: No automatic fix found for this entry. "FF SearchPlugin:" => not found "C:\Users\Jenny\AppData\Roaming\Mozilla\Firefox\Profiles\5e9nshx3.default-1480451579585-1516624818491\searchplugins\bing-lavasoft-ff59.xml" => not found [2018-06-24] => Error: No automatic fix found for this entry. gfibto => Unable to stop service. "HKLM\System\CurrentControlSet\Services\gfibto" => removed successfully gfibto => service removed successfully (GFI Software) => Error: No automatic fix found for this entry. "2018-06-24 14:45 - 2018-06-24 14:45 - 000000000 ____D" => not found C:\Users\Jenny\AppData\Local\Lavasoft => moved successfully "2018-06-24 14:45 - 2018-06-24 14:45 - 000000000 ____D" => not found C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lavasoft => moved successfully "2018-06-24 14:44 - 2018-06-24 14:44 - 000000000 ____D" => not found C:\Users\Jenny\AppData\Roaming\Lavasoft => moved successfully "2018-06-24 14:44 - 2018-06-24 14:44 - 000000000 ____D" => not found C:\ProgramData\Lavasoft => moved successfully Symbolic link found: "C:\Program" => "C:\Program Files" "C:\Program" => Symbolic link removed successfully C:\Program => moved successfully Files (x86)\Lavasoft => Error: No automatic fix found for this entry. IE trusted site: => Error: No automatic fix found for this entry. HKU\S-1-5-21-741051300-1619859580-3169136444-1000\...\webcompanion.com => Error: No automatic fix found for this entry. -> hxxp://webcompanion.com => Error: No automatic fix found for this entry. "HKU\S-1-5-21-741051300-1619859580-3169136444-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run\\HKU\S-1-5-21-741051300-1619859580-3169136444-1000\...\StartupApproved\Run:" => not found "HKU\S-1-5-21-741051300-1619859580-3169136444-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\HKU\S-1-5-21-741051300-1619859580-3169136444-1000\...\StartupApproved\Run:" => not found => "Web Companion" => Error: No automatic fix found for this entry. The system needed a reboot. ==== End of Fixlog 12:38:34 ==== Quote Share this post Link to post Share on other sites
0 CeciliaB 473 Report post Posted June 25, 2018 Sorry, please repeat my previous post and make sure that fixlist.txt doesn't contain any line breaks/carriage returns that shouldn't be there. According to the log files several lines in the box has been split in fixlist.txt . For example this single line: FF SearchPlugin: C:\Users\Jenny\AppData\Roaming\Mozilla\Firefox\Profiles\5e9nshx3.default-1480451579585-1516624818491\searchplugins\bing-lavasoft-ff59.xml [2018-06-24] has been divided into three lines in your fixlist.txt: FF SearchPlugin: C:\Users\Jenny\AppData\Roaming\Mozilla\Firefox\Profiles\5e9nshx3.default-1480451579585-1516624818491\searchplugins\bing-lavasoft-ff59.xml [2018-06-24] and the FRST doesn't understand it. Quote Share this post Link to post Share on other sites
0 CeciliaB 473 Report post Posted June 25, 2018 50 minutes ago, Snuzie said: So, you're a volunteer and no employees are actually bothering with unwilling customers There is a support team within the company but they aren't handling the forum. I saw that you'd a free program from Avast installed, if you get a problem with that you'll have to go to the Avast forum and there will be volunteers helping you. That's very common for free programs. Quote Share this post Link to post Share on other sites
0 Guest Report post Posted June 25, 2018 Thank you. I copied the text from the e-mail I received with the content of you reply instead of from the forum, that was most likely the reason. This is the new logfile. fixlist content: ***************** CreateRestorePoint: CloseProcesses: HKU\S-1-5-21-741051300-1619859580-3169136444-1000\...\Run: [Web Companion] => C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe [7722600 2018-06-24] (Lavasoft) FF SearchPlugin: C:\Users\Jenny\AppData\Roaming\Mozilla\Firefox\Profiles\5e9nshx3.default-1480451579585-1516624818491\searchplugins\bing-lavasoft-ff59.xml [2018-06-24] R0 gfibto; C:\WINDOWS\System32\drivers\gfibto.sys [14456 2013-09-23] (GFI Software) 2018-06-24 14:45 - 2018-06-24 14:45 - 000000000 ____D C:\Users\Jenny\AppData\Local\Lavasoft 2018-06-24 14:45 - 2018-06-24 14:45 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lavasoft 2018-06-24 14:44 - 2018-06-24 14:44 - 000000000 ____D C:\Users\Jenny\AppData\Roaming\Lavasoft 2018-06-24 14:44 - 2018-06-24 14:44 - 000000000 ____D C:\ProgramData\Lavasoft 2018-06-24 14:44 - 2018-06-24 14:44 - 000000000 ____D C:\Program Files (x86)\Lavasoft IE trusted site: HKU\S-1-5-21-741051300-1619859580-3169136444-1000\...\webcompanion.com -> hxxp://webcompanion.com HKU\S-1-5-21-741051300-1619859580-3169136444-1000\...\StartupApproved\Run: => "Web Companion" Reboot: ***************** Restore point was successfully created. Processes closed successfully. "HKU\S-1-5-21-741051300-1619859580-3169136444-1000\Software\Microsoft\Windows\CurrentVersion\Run\\Web Companion" => removed successfully "C:\Users\Jenny\AppData\Roaming\Mozilla\Firefox\Profiles\5e9nshx3.default-1480451579585-1516624818491\searchplugins\bing-lavasoft-ff59.xml" => not found gfibto => service not found. "C:\Users\Jenny\AppData\Local\Lavasoft" => not found "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lavasoft" => not found "C:\Users\Jenny\AppData\Roaming\Lavasoft" => not found C:\ProgramData\Lavasoft => moved successfully C:\Program Files (x86)\Lavasoft => moved successfully "HKU\S-1-5-21-741051300-1619859580-3169136444-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\webcompanion.com" => removed successfully "HKU\S-1-5-21-741051300-1619859580-3169136444-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run\\Web Companion" => removed successfully "HKU\S-1-5-21-741051300-1619859580-3169136444-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\Web Companion" => not found The system needed a reboot. ==== End of Fixlog 17:54:54 ==== Quote Share this post Link to post Share on other sites
0 CeciliaB 473 Report post Posted June 25, 2018 I agree, that was probably the reason. Do you notice Web Companion anywhere now? Quote Share this post Link to post Share on other sites
0 Guest Report post Posted June 25, 2018 (edited) No, it's gone now. Thank you for your help. Now, how do I delete my account from this site? I've searched and checked under "Account settings" and "Profile" but cannot find an option to delete the account and I want to do that. Edited June 25, 2018 by Guest Addition to post Quote Share this post Link to post Share on other sites
0 CeciliaB 473 Report post Posted June 25, 2018 You're welcome :) You can't do that yourself, it's only the admins that can delete accounts. I'll send the head admin a message. Quote Share this post Link to post Share on other sites
RIGHT NOW!
Explain to me how I get rid of "Ad-Aware Web Companion" malware!
I don't give you permission to send me emails!

Edited by THISISMALWAREShare this post
Link to post
Share on other sites