I can't uninstall ILivid from the computer

[cmsaad]

ILivid was installed by my mother on her dell laptop. I've run Malwarebytes but it doesn't seem to find anything. I tried to uninstall the program from add/remove program and it appeared to be uninstalled but it is not as I still see the folder on the hard drive. Manually trying to delete the folder does not work as it states I don't have permission to remove it. I ran DDS from a flash drive as I was afraid that ILivid may throw off the results somehow. From what I read online it's a nasty program that is very difficult to remove. I would like some help to remove it from my mom's computer. Attached are the two DDS files. I do have to work tomorrow morning but will try to do what I can if I get an answer by tomorrow afternoon. Thanks in advance for any help you may give me. You guys have helped me out in the past and am forever grateful to the help I get from this forum.

Attach.txt

DDS.txt

[MrCharlie]

Welcome to the forum.

Please run Fix It to restore your host file:

http://support.microsoft.com/kb/972034

Then.............

Please download AdwCleaner from here and save it on your Desktop.

1. Right-click on adwcleaner.exe and select Run As Administrator (for XP just double click) to launch the application.
   
2. Now click on the Search tab.
   
3. Please post the contents of the log-file created in your next post.

Note: The log can also be located at C:\ >> AdwCleaner[XX].txt >> XX <-- Denotes the number of times the application has been ran, so in this should be something like R1.

Please look over what was found, we're going to delete it all in the next step....if there's something you may want to keep...please let me know and I'll explain to why it shouldn't be on your system.

MrC

[cmsaad]

I just saw your reply but am heading out for work. I will do this in the afternoon when I return and post the results.

[cmsaad]

Advantage to owning my own business is I can squeeze time to work at it while at work. Here are the results of adwcleaner. I don't want any of it...looks like it's all related to ilivid.

# AdwCleaner v2.104 - Logfile created 12/31/2012 at 09:32:56

# Updated 29/12/2012 by Xplode

# Operating system : Windows Vista Home Premium Service Pack 2 (32 bits)

# User : Viviane A. Saad - LAPTOP

# Boot Mode : Normal

# Running from : C:\Users\Viviane A. Saad\Desktop\Desktop\Desktop\adwcleaner.exe

# Option [search]

***** [services] *****

***** [Files / Folders] *****

Folder Found : C:\Program Files\Ilivid

Folder Found : C:\Program Files\Windows iLivid Toolbar

Folder Found : C:\ProgramData\boost_interprocess

Folder Found : C:\Users\Viviane A. Saad\AppData\Local\Ilivid Player

Folder Found : C:\Users\Viviane A. Saad\AppData\LocalLow\Searchqutoolbar

Folder Found : C:\Users\Viviane A. Saad\Vivo's Documents\ShopToWin

***** [Registry] *****

Key Found : HKCU\Software\AppDataLow\Software\Freecause

Key Found : HKCU\Software\ilivid

Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Searchqu 406 MediaBar

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{99079A25-328F-4BD4-BE04-00955ACAA0A7}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{99079A25-328F-4BD4-BE04-00955ACAA0A7}

Key Found : HKCU\Software\Zugo

Key Found : HKLM\SOFTWARE\Classes\CLSID\{99079A25-328F-4BD4-BE04-00955ACAA0A7}

Key Found : HKLM\Software\Freeze.com

Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{99079A25-328F-4BD4-BE04-00955ACAA0A7}

Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{99079A25-328F-4BD4-BE04-00955ACAA0A7}

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Searchqu 406 MediaBar

Key Found : HKLM\Software\SearchquMediabarTb

Key Found : HKLM\Software\TENCENT

Key Found : HKU\S-1-5-21-757465141-2304402687-1659264151-1000\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}

Value Found : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{98279C38-DE4B-4BCF-93C9-8EC26069D6F4}]

Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{99079A25-328F-4BD4-BE04-00955ACAA0A7}]

Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [10]

***** [internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16457

[OK] Registry is clean.

-\\ Mozilla Firefox v15.0.1 (en-US)

File : C:\Users\Viviane A. Saad\AppData\Roaming\Mozilla\Firefox\Profiles\agzuma48.default\prefs.js

Found : user_pref("keyword.URL", "hxxp://www.searchqu.com/web?src=ffb&appid=119&systemid=406&sr=0&q=");

-\\ Google Chrome v23.0.1271.97

File : C:\Users\Viviane A. Saad\AppData\Local\Google\Chrome\User Data\Default\Preferences

Found [l.11] : homepage = "hxxp://www.searchqu.com/406",

Found [l.55] : search_url = "hxxp://www.searchqu.com/web?src=crb&appid=119&systemid=406&sr=0&q={searchTerms}",

Found [l.1645] : homepage = "hxxp://www.searchqu.com/406",

*************************

AdwCleaner[R1].txt - [3175 octets] - [31/12/2012 09:32:56]

########## EOF - C:\AdwCleaner[R1].txt - [3235 octets] ##########

[MrCharlie]

Adware found....lets clear it out.....

1. Please re-run AdwCleaner
   
2. Click on Delete button.
   
3. Confirm each time with OK if asked.
   
4. Your computer will be rebooted automatically. A text file will open after the restart. Please post the content of that logfile in your reply.
   

Note: You can find the logfile at C:\AdwCleaner[sn].txt as well - n is the order number.

MrC

[cmsaad]

Here is the post delete file...

# AdwCleaner v2.104 - Logfile created 12/31/2012 at 11:15:51

# Updated 29/12/2012 by Xplode

# Operating system : Windows Vista Home Premium Service Pack 2 (32 bits)

# User : Viviane A. Saad - LAPTOP

# Boot Mode : Normal

# Running from : C:\Users\Viviane A. Saad\Desktop\Desktop\Desktop\adwcleaner.exe

# Option [Delete]

***** [services] *****

***** [Files / Folders] *****

Folder Deleted : C:\Program Files\Ilivid

Folder Deleted : C:\Program Files\Windows iLivid Toolbar

Folder Deleted : C:\ProgramData\boost_interprocess

Folder Deleted : C:\Users\Viviane A. Saad\AppData\Local\Ilivid Player

Folder Deleted : C:\Users\Viviane A. Saad\AppData\LocalLow\Searchqutoolbar

Folder Deleted : C:\Users\Viviane A. Saad\Vivo's Documents\ShopToWin

***** [Registry] *****

Key Deleted : HKCU\Software\AppDataLow\Software\Freecause

Key Deleted : HKCU\Software\ilivid

Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Searchqu 406 MediaBar

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{99079A25-328F-4BD4-BE04-00955ACAA0A7}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{99079A25-328F-4BD4-BE04-00955ACAA0A7}

Key Deleted : HKCU\Software\Zugo

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{99079A25-328F-4BD4-BE04-00955ACAA0A7}

Key Deleted : HKLM\Software\Freeze.com

Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{99079A25-328F-4BD4-BE04-00955ACAA0A7}

Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{99079A25-328F-4BD4-BE04-00955ACAA0A7}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Searchqu 406 MediaBar

Key Deleted : HKLM\Software\SearchquMediabarTb

Key Deleted : HKLM\Software\TENCENT

Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{98279C38-DE4B-4BCF-93C9-8EC26069D6F4}]

Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{99079A25-328F-4BD4-BE04-00955ACAA0A7}]

Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [10]

***** [internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16457

[OK] Registry is clean.

-\\ Mozilla Firefox v15.0.1 (en-US)

File : C:\Users\Viviane A. Saad\AppData\Roaming\Mozilla\Firefox\Profiles\agzuma48.default\prefs.js

C:\Users\Viviane A. Saad\AppData\Roaming\Mozilla\Firefox\Profiles\agzuma48.default\user.js ... Deleted !

Deleted : user_pref("keyword.URL", "hxxp://www.searchqu.com/web?src=ffb&appid=119&systemid=406&sr=0&q=");

-\\ Google Chrome v23.0.1271.97

File : C:\Users\Viviane A. Saad\AppData\Local\Google\Chrome\User Data\Default\Preferences

Deleted [l.11] : homepage = "hxxp://www.searchqu.com/406",

Deleted [l.55] : search_url = "hxxp://www.searchqu.com/web?src=crb&appid=119&systemid=406&sr=0&q={searchTerms}[...]

Deleted [l.1645] : homepage = "hxxp://www.searchqu.com/406",

*************************

AdwCleaner[R1].txt - [3304 octets] - [31/12/2012 09:32:56]

AdwCleaner[s1].txt - [3250 octets] - [31/12/2012 11:15:51]

########## EOF - C:\AdwCleaner[s1].txt - [3310 octets] ##########

[MrCharlie]

How is it?? MrC

[cmsaad]

Thank you so much seems likes it gone!

[MrCharlie]

Great

Please download OTL from one of the links below: (you may already have OTL on the system)

http://oldtimer.geekstogo.com/OTL.exe

http://oldtimer.geekstogo.com/OTL.com

http://www.itxassoci...T-Tools/OTL.exe

Save it to your desktop.

Run OTL and hit the CleanUp button. (This will cleanup the tools and logs used including itself)

Any other programs or logs you can manually delete.

IE: RogueKiller.exe, RKreport.txt, RK_Quarantine folder, C:\FRST, MBAR, etc....AdwCleaner > just run the program and click uninstall.

-------------------------------

Any questions...please post back.

If you think I've helped you, please leave a comment > click on my avatar picture > click Profile Feed.

Take a look at My Preventive Maintenance to avoid being infected again.

Good Luck and Thanks for using the forum, MrC

[LDTate]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!