Jump to content

not scanning all profiles or removing uninstall info


Recommended Posts

not scanning all profiles for issues in appdata, and not removing uninstall info from the reg.

example, all the mindspark tool bars.... it will remove the BHO and the folder, but not any of the reg info from uninstaller, so it "looks" like its still installed

i had to write a script to go back and clean up..

 

reg query HKLM\software\classes\installer\products /f "Mindspark" /s | find "HKEY_LOCAL_MACHINE" >> %TEMP%\X.txt 2>NUL
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Mindspark" /s | find "HKEY_LOCAL_MACHINE" >> %TEMP%\X.txt 2>NUL
reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Mindspark" /s | find "HKEY_LOCAL_MACHINE" >> %TEMP%\X.txt 2>NUL
reg query HKEY_CLASSES_ROOT\Installer\Products /f "Mindspark" /s | find "HKEY_LOCAL_MACHINE" >> %TEMP%\X.txt 2>NUL
reg query HKLM\SOFTWARE\Classes\Installer\Features /f "Mindspark" /s | find "HKEY_LOCAL_MACHINE" >> %TEMP%\X.txt 2>NUL

for /f "tokens=* delims= " %%a in (%TEMP%\X.txt) do reg delete "%%a" /f

 

Link to post
Share on other sites

  • 2 weeks later...

so far, the ones ive run into were MindSpark toolbars... 

i use this script to kill the services now before running JRT, this makes sure it can delete the program folder..

wmic service where "name like 'UnzipApp%%'" call stopservice
wmic SERVICE where "name like 'UnzipApp%%'" delete

wmic service where "name like 'Coupon%%'" call stopservice
wmic SERVICE where "name like 'Coupon%%'" delete

wmic service where "name like 'WeatherBlink%%'" call stopservice
wmic SERVICE where "name like 'WeatherBlink%%'" delete

wmic service where "name like 'Utility Chest%%'" call stopservice
wmic SERVICE where "name like 'Utility Chest%%'" delete

wmic service where "name like 'MapsGalaxy%%'" call stopservice 
wmic SERVICE where "name like 'MapsGalaxy%%'" delete

wmic service where "name like 'onlinemap%%'" call stopservice
wmic SERVICE where "name like 'onlinemap%%'" delete

Edited by Russr
Link to post
Share on other sites

  • 1 year later...
On 7/14/2018 at 5:55 PM, joypebble said:

Can some kind soul tell this way-too-"senior" how to use this information to  get rid of an infected FireFox 60.0.1 (Mac)  of a default search page "Weatherblink?"

Greetings,

Unfortunately since Macs are so different from Windows, the tools and methods for removing threats from Windows don't apply to Macs.  However we do offer free expert assistance with cleaning up infected systems, including Macs.  Just create a new topic in our Mac malware removal area by clicking here and describe the issues you're having and one of our malware removal specialists who deals with Mac malware will assist you as soon as they are available.

While you are waiting, you can try to install the free version of Malwarebytes for Mac from here to see if it is able to detect and remove the threats afflicting your browser.  If not, or if other issues remain, go ahead and post in the link I provided for the malware removal area and they will make sure that you receive the help you need to get your system cleaned.

Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.