Trovi Virus - help to remove please

Tousdae said:

I looked at some of the logs above. I have no idea what this Jewel Quest is. And iwin is just a thorn in the side!

I held down shift and scrolled up or down to highlight the info so it should all be there.

This is what happened when I clicked on the ApnRemover.exe

Jewel Quest is a MS game, I think. Where do you see that?

Ok, good - then that's all herdProtect reported. Nothing further down the list when you scroll.

ApnRemover.exe - it's basically saying that it didn't find anything to uninstall.
Go through the link I provided and follow the instructions for each browser you have installed. There might be nothing you have to do, but please check how each is configured with regards to search and homepage.

Let's try this a different way.
Follow steps 1 & 2 only in Hidden Files and Folders - Show or Hide
The picture shows Don't show hidden files, you want Show hidden files.....
The instructions in 2.a are correct, the picture might be confusing.

Once this is set, you can see your Appdata folder.
Navigate to C:\USERS\LI\APPDATA\LOCAL\TEMP
Select Quarantine
press the delete key
Select Askslib.dll
Press the delete key

The temp folder hold intermediate files - it's fairly safe to delete anything in the TEMP folder. Some files might be in use and they won't be deleted until they are released (close the application using it)

Just be sure that you are in the TEMP folder.

I'll look into iWin - I thought it was a bugger, but you have some games that I thought might use it. I'll post what I find in a bit.

Finish up the Ask instructions, then clean up your TEMP folder. By that time I should have something on iWin.

Bill

Here's a guide for removing iWin
How to easily remove iWin Toolbar (Removal Guide)

Part of the cleanup is running malware scanners - yeah... I know... but there is a reason to follow the guide step by step even though you already ran most of the scanners already.

Somewhere along the way, you picked up a new bug - iWin. The only way to be sure that it is removed is to run the scanners in the guide. You can run straight through the guide without waiting for a SF member to look at the logs. It would be great if you post the logs, just for another pair of eyes looking at the output, but just follow the guide - do every step in the order given and iWin should be gone.

Download the scanners from the link given in the guide (remember AdwCleaner - the bogus one - don't do that again!). The links in the guide give you the site you want to download from. Get a fresh version when following the guide. Don't take any shortcuts at this point - you're almost home.

Remember, you can ask any questions you have - but it's easier if you ask first. That way, you don't have to repeat steps in case something was not understood and new issues are created by a misstep.

Bill
.

Tousdae, if you want and actively use tool bars, that's your choice. However, you don't absolutely need them. Think of them as the equivalent of having someone behind you with a notepad writing down every place you visit on the net. All in all, it's best to steer clear of them. They can also introduce new malware to your system without your knowlidge.

Once you have done a clean install, there should be nothing on the system save for the default programs that came from the windows disk. If right after doing a clean install, you import your personal files or install something that has PUP's, you're right back where you started from.

If you want to do a clean install, there is a tutorial on this site. Once you have done that, consult with Slartybart or gregrocker (or me if I'm online) about which software you want to put on the system & provide the link. We can have a look & tell you if it is the site is the actual manufacturers site & look up & see if any unwanted extras are included.

One tip I will give you, when you install something, do NOT use the standard install (usually recommended). It's recommended so that you blindly install it without being aware of the extras it bundles in. Instead, go to the custom install & un-check anything it's trying to slip by you, toolbars, scanners, etc.

Have a look at this link & you'll see just how many PUPs a program might be trying to put on your PC.

How to spot and avoid installing potentially unwanted programs | PCWorld

Reagrding iWin: herdProtect reported iwinarcadelauncher.
I see now where Jewel Quest is - thanks.

I might have pointed you to the wrong solution, but I think it's still part of iWin, even though you don't have the toolbar.
I'll look again to see if there's more information I gave give you.

I've given you a lot, sometimes more words confuse the issue at hand.

One question, one answer might be better in the short term.

Step 1
Follow steps 1 & 2 only in Hidden Files and Folders - Show or Hide
The picture shows Don't show hidden files, you want Show hidden files.....
The instructions in 2.a are correct, the picture might be confusing.

Once this is set, you can see your Appdata folder.
Navigate to C:\USERS\LI\APPDATA\LOCAL\TEMP

Select Quarantine
press the delete key
Select Askslib.dll
Press the delete key

Tousdae said:

Well, Greg had me scan and clean the external hard drive that I keep my files on. I'm thinking because of that I don't need to do your step?

That's only a suggestion to re-install windows. At this point though, since you were re-infected, it's possible that those files on the external HDD are infected again.

You really have to watch out which sites you go to. Firefox has an add on called WOT (Web of Trust). It's not infallible, but it can help.

I have a suggestion. D/L & install Malwarebytes, the free version button is the one you click, but when it is done installing allow the 14 day free trial. This, for the time being, will give you active background scanning of your PC & monitor the websites you go to. Once it's installed, run a full system scan including your external HDD. Hopefully, it can weed out the problems & during the trial period, should you go to a questionable website, it will warn you. You can purchase a license from Malwarebytes should you wish to continue to use the pro features.

What Anti Virus are you using currently?

Please download Junkware Removal Tool Download
Junkware Removal Tool to your desktop.

• Shut down your protection software now to avoid potential conflicts.
• Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
• The tool will open and start scanning your system.
• Please be patient as this can take a while to complete depending on your system's specifications.
• On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
• Post the contents of JRT.txt into your next message.