Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

ASPCA Reminder by We-Care.com V4.1.22.1 Malware Can't Uninstall


  • This topic is locked This topic is locked
3 replies to this topic

#1 itsmountainman

itsmountainman

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:05:11 PM

Posted 19 April 2014 - 12:14 AM

Hello Bleeping Computer,

 

I was trying to download some freeware (scribus to be exact). When I was trying to download it, I must have clicked a bad link because when I attempted to download it, my Trend Micro blocked the download. I then went to my programs folder to see if I was infected, and sure enough ASPCA Reminder by We-Care.com V4.1.22.1 was installed. It never asked for permmission, and it got around my Trend Micro. I thought nothing of it, and tried to uninstall it. When I clicked uninstall, it has an error pop up saying "The path 'C:\ProgramData\ReadOnlyInstaller.msi' cannot be found. Verify that you have access to this location and try again, or try to find the installation package 'ReadOnlyInstaller.msi' in a folder from which you can install the product ASPCA Reminder by We-Care.com v4.1.22.1." So I searched for ASPCA on my computer, nothing showed up, searched We-Care and got a file called Chromeuninstall.exe or something like that in a folder called We-Care Reminder at the location C:\ProgramData\Microsoft\Windows\Start Menu\Programs\We-Care Reminder running it just said "this refers to a file that no longer exists" and deleted the file. So I decided to downloaded Malwarebytes, run it, it quarantined the suspect  files (We-Care somethinganother, I forget the specifics but it did contain "We-Care" in the file name, no ReadOnlyInstaller.msi), and deleted them. I thought nothing of it. This was a few days ago. Today I suddenly thought to check and see if the program actually uninstalled, and lo-and-behold, it's still there, still giving me the same error. What do I do?



BC AdBot (Login to Remove)

 


m

#2 satchfan

satchfan

  • Malware Response Team
  • 2,638 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Devon, UK
  • Local time:12:11 AM

Posted 19 April 2014 - 02:15 AM

Hello itsmountainman and welcome to Bleeping Computer.

My name is Satchfan and I would be glad to help you with your computer problem.

Please read the following guidelines which will help to make cleaning your machine easier:

  • please follow all instructions in the order posted
  • please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear
  • all logs/reports, etc. must be posted in Notepad. Please ensure that word wrap is unchecked. In Notepad click Format, uncheck Word wrap if it is checked
  • if you don't understand something, please don't hesitate to ask for clarification before proceeding
  • the fixes are specific to your problem and should only be used for this issue on this machine.
  • please reply within 3 days. If you do not reply within this period I will post a reminder but topics with no reply in 4 days will be closed!

IMPORTANT:

Please DO NOT install/uninstall any programs unless asked to.
Please DO NOT run any scans other than those requested

===================================================

Note: Please run these in the order given in the instructions.

===================================================

Download and run AdwCleaner

Download AdwCleaner from here and save it to your desktop.


  • run AdwCleaner
  • when it has finished, select Clean
  • if it asks to reboot, allow the reboot
  • on reboot a log will be produced; please attach the content of the log to your next reply.

===================================================

Download and run Junkware Removal Tool

thisisujrt.gif Please download Junkware Removal Tool to your desktop.

  • shut down your protection software now to avoid potential conflicts.
  • run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator"
  • the tool will open and start scanning your system
  • please be patient as this can take a while to complete depending on your system's specifications
  • on completion, a log (JRT.txt) is saved to your desktop and will automatically open
  • post the contents of JRT.txt into your next message.

===================================================

Run OTL

  • download OTL to your desktop.
  • double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • click Scan all users.
  • under Custom Scan paste this in


    netsvcs
    %SYSTEMDRIVE%\*.exe
    /md5start
    explorer.exe
    winlogon.exe
    Userinit.exe
    svchost.exe
    services.exe
    /md5stop
    %systemroot%\*. /rp /s
    DRIVES
    CREATERESTOREPOINT

     

  • click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan won’t take long.
  • when the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
  • please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.
  • you may need two posts to fit them both in.

Logs to include with next post:

AdwCleaner log
JRT.txt
OTL.txt
Extras.txt


Thanks

Satchfan

 


My help is always free of charge. If you are happy with the help provided, if you wish you can make a donation to buy me a beer.


#3 satchfan

satchfan

  • Malware Response Team
  • 2,638 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Devon, UK
  • Local time:12:11 AM

Posted 22 April 2014 - 01:26 AM

Hi itsmountainman

It has been several days since I replied to your request for help with your computer problems.

Please let me know if you are having problems and still need help.

Thanks

Satchfan


My help is always free of charge. If you are happy with the help provided, if you wish you can make a donation to buy me a beer.


#4 satchfan

satchfan

  • Malware Response Team
  • 2,638 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Devon, UK
  • Local time:12:11 AM

Posted 23 April 2014 - 02:21 AM

Due to the lack of feedback, this topic is now closed.

In the event you still have problems, please send me or any Moderator a Private Message and ask them to reopen this topic within the next 5 days.

Please include a link to your topic in the Private Message. Thank you.

My help is always free of charge. If you are happy with the help provided, if you wish you can make a donation to buy me a beer.





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users