Solved cannot uninstall pdflite!

[sdowney717]

Keeps complaining saying close the web browser, but the web browser is not open.
So I have to use task manager to kill the uninstall.

 

[sdowney717]

PDFlite - CNET Download.com
download.cnet.com/PDFlite/3000-18497_4-75445408.html
Download.com
Rating: 2.5 - ‎27 reviews - ‎Windows
May 14, 2013 - PDFlite can be used to read any PDF file. ... Cannot uninstall program unless you put your computer to safe mode. Summary. Just don't do it.

Seems lots of folks can uninstall it either.

 

[Callender]

Take a look at this info:

PDFlite 0.8 by Amnis Technology Ltd - Should I Remove It?

It looks like it installs extras into your browser.

What browsers do you have installed? In any event try disabling the plugin in each browser before attempting removal.

Also try running portable GeekUninstaller

 

[sdowney717]

I use Chrome mostly.
I looked into Chrome extensions but dont see anything PDF related.

 

[sdowney717]

Revo Uninstaller Download
I used revo uninstaller and got rid of it, 383 files.
Running Revo, still brings up the failing 'shut down your browsers' to which I ran task manager again to kill pdflite uninstaller, then revo finished the job. Also interesting is when Revo was getting ready to delete those files, Avast popped up and said 383 files which used to be associated with PDFLite where no longer needed and a waste of space.

I think PDFLite deliberately makes an uninstaller which does not work.
I also ran ADWCleaner and JRT and they found PDF malware type references.

# AdwCleaner v5.007 - Logfile created 14/09/2015 at 06:30:26
# Updated 08/09/2015 by Xplode
# Database : 2015-09-10.1 [Server]
# Operating system : Windows 7 Ultimate Service Pack 1 (x64)
# Username : scott - SCOTTUPSTAIRSWI
# Running from : C:\Users\scott\Downloads\AdwCleaner.exe
# Option : Cleaning
# Support : http://toolslib.net/forum

***** [ Services ] *****


***** [ Folders ] *****

[-] Folder Deleted : C:\Program Files (x86)\Conduit
[-] Folder Deleted : C:\Program Files (x86)\MyPC Backup
[-] Folder Deleted : C:\Users\scott\AppData\Local\Conduit
[-] Folder Deleted : C:\Users\scott\AppData\Local\NativeMessaging
[-] Folder Deleted : C:\Users\scott\AppData\LocalLow\Conduit
[-] Folder Deleted : C:\Users\scott\AppData\Roaming\pdfforge

***** [ Files ] *****

[-] File Deleted : C:\Users\scott\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_microsoft-visual-basic.en.softonic.com_0.localstorage
[-] File Deleted : C:\Users\scott\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_microsoft-visual-basic.en.softonic.com_0.localstorage-journal
[-] File Deleted : C:\Users\scott\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_mp.weixin.qq.com_0.localstorage
[-] File Deleted : C:\Users\scott\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_mp.weixin.qq.com_0.localstorage-journal
[-] File Deleted : C:\Users\scott\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_office-pdf-printer.en.softonic.com_0.localstorage
[-] File Deleted : C:\Users\scott\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_office-pdf-printer.en.softonic.com_0.localstorage-journal

***** [ Shortcuts ] *****


***** [ Scheduled tasks ] *****

[-] Task Deleted : BackgroundContainer Startup Task

***** [ Registry ] *****

[-] Value Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [BackgroundContainer]
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IECT3288691
[-] Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT3288691
[-] Key Deleted : HKCU\Software\Google\Chrome\Extensions\pkmpcdbgnfjfeelcpebpkflcmbkclfho
[-] Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\pkmpcdbgnfjfeelcpebpkflcmbkclfho
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{F83D1872-D9FF-47F8-B5A0-49CC51E24EE8}
[-] Key Deleted : HKCU\Software\Conduit
[-] Key Deleted : HKCU\Software\PRODUCTSETUP
[-] Key Deleted : HKCU\Software\AppDataLow\Toolbar
[-] Key Deleted : HKCU\Software\AppDataLow\Software\BackgroundContainer
[-] Key Deleted : HKCU\Software\AppDataLow\Software\ConduitSearchScopes
[-] Key Deleted : HKLM\SOFTWARE\Conduit
[!] Key Not Deleted : [x64] HKCU\Software\Conduit
[!] Key Not Deleted : [x64] HKCU\Software\PRODUCTSETUP
[!] Key Not Deleted : HKU\S-1-5-21-1976689320-954829173-217345078-1002\Software\AppDataLow\Software\BackgroundContainer
[!] Key Not Deleted : HKU\S-1-5-21-1976689320-954829173-217345078-1002\Software\AppDataLow\Software\ConduitSearchScopes
[-] Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2855F6F0-9400-4A6C-94A5-E5564321564D}
[!] Key Not Deleted : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2855F6F0-9400-4A6C-94A5-E5564321564D}
[!] Key Not Deleted : HKU\S-1-5-21-1976689320-954829173-217345078-1002\Software\Microsoft\Internet Explorer\SearchScopes\{2855F6F0-9400-4A6C-94A5-E5564321564D}

***** [ Web browsers ] *****


*************************

:: Winsock settings cleared

########## EOF - C:\AdwCleaner\AdwCleaner[C1].txt - [3590 bytes] ##########

I ran JRT after ADWCleaner and it found more stuff

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 7.6.1 (09.08.2015:1)
OS: Windows 7 Ultimate x64
Ran by scott on Mon 09/14/2015 at  6:36:07.16
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Tasks



~~~ Registry Values

Successfully repaired: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-19\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-20\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-21-1976689320-954829173-217345078-1002\Software\Microsoft\Internet Explorer\Main\\Start Page



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{06E08260-0695-4EC1-A74B-1310D8899D93}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{77e8143b-6759-416e-b521-82cfed75150b}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06E08260-0695-4EC1-A74B-1310D8899D93}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{77e8143b-6759-416e-b521-82cfed75150b}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{06E08260-0695-4EC1-A74B-1310D8899D93}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{77e8143b-6759-416e-b521-82cfed75150b}



~~~ Files

Successfully deleted: [File] C:\Program Files (x86)\GUT8A45.tmp



~~~ Folders



~~~ Chrome


[C:\Users\scott\Appdata\Local\Google\Chrome\User Data\Default\Preferences] - default search provider reset

[C:\Users\scott\Appdata\Local\Google\Chrome\User Data\Default\Preferences] - Extensions Deleted:

[C:\Users\scott\Appdata\Local\Google\Chrome\User Data\Default\Secure Preferences] - default search provider reset

[C:\Users\scott\Appdata\Local\Google\Chrome\User Data\Default\Secure Preferences] - Extensions Deleted:
[]





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Mon 09/14/2015 at  6:40:39.97
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

JRT mentions removing Chrome extensions, looking at before and after, under tools, the same 3 extensions are still there in the list, so must be hidden different kind of extensions in Chrome.

 

[Callender]

Well if Revo got rid of it - great. You might want to check this out:

Uninstall PDFLite - Free and open source PDF viewer and PDF printer - PDF liteFree and open source PDF viewer and PDF printer – PDF lite

Check if those programs are still installed. It seems that the tools you ran removed Conduit but check anyway.

On another note I hope you know that Revo Uninstaller Free is only for removing 32bit programs. There's no support for removal of 64bit programs in the free version. Geek Uninstaller is free and has 64bit support.

 

[sdowney717]

Revo got rid of it, I just displayed the earlier scan results of ADWCleaner and JRT tools.

I tried to install geek uninstaller, but Avast stops the install says it is malware. Seems most everything is bundled with malware.

 

[sdowney717]

So went here cnet - Thank you for downloading GeekUninstaller from CNET Download.com
seemed to be unencumbered with crudware, but when running it instantly says, new version, and loads it's installer web page, same one that has malware in.

 

[Callender]

Pretty much anyone here will tell you to avoid CNET downloads. I wonder why you didn't use the link in this post.

Here it is again: GeekUnistaller

 

[sdowney717]

Your link Download | GeekUninstaller is malware, Avast stops the installer dead, as I said in the above post.
So I went looking for another link, CNET takes you back to that malware download,

 

[Callender]

I'll check when I get home.

In the meantime see this info on CNET.

https://billmullins.wordpress.com/2012/01/19/take-your-modified-application-installer-and-shove-it/

Scans of the GeekUnistaller download show clean for me. Are you sure you used the correct download link?

 

[sdowney717]

Ok thanks, I just tried it and seems to be ok accordingly Avast did nothing.
The program that I was getting was called installer.exe which was malware.

It is very odd, I am pretty sure I had clicked that pointed out link, maybe a fake geekunintaller web page was what I had clicked on after searching with google, because it looks just like the page you showed me, installer.exe downloaded, not geek.zip file.

 

[Callender]

No worries. I was concerned that the file was currently being bundled with something nasty. All scans show clean for me. Tried corporate grade AV at work and no detection.

Downloaded a fresh copy. Here's the results.

​

​

​

I would suggest that although you seem to have run the right tools to clean up - if you notice any further problems get help in the System Security thread from a malware removal expert.

EDIT:

I'm not critical of REVO. It works great but only with 32bit program uninstallation. You need the paid version for 64bit program uninstallation.

 

[MadMax64]

Geek uninstaller

Take a look at this info:

PDFlite 0.8 by Amnis Technology Ltd - Should I Remove It?

It looks like it installs extras into your browser.

What browsers do you have installed? In any event try disabling the plugin in each browser before attempting removal.

Also try running portable GeekUninstaller

This helped great. Thanks a bunch.

 

[judhud]

I have the same problem with Lavasoft Web Companion. I think it came up installed with Bitorrent or uTorrent but I have never been asked about any additional offers during the installation process. I have tried almost everything to delete it.