O.T. - How can I delete Firefox add-on

Mark Twain wrote:
Hello Paul,

I decided to give it another try
and this time Notepad appeared but
it wasn't there previously.

http://i57.tinypic.com/2pyyx6d.jpg

also denied:

http://i58.tinypic.com/rw8l8h.jpg

Robert

Now, how strange is that ?

You should be the owner of that file.

Maybe some software, like your AV is doing that ?

I hope you have exited Firefox, before attempting
to edit prefs.js. That would put Firefox off the
hook, if Firefox wasn't running.

I've never had a problem getting to prefs.js,
but I have different software loaded on my
computer than you.

*******

OK, we can add a command to your Windows 7 right-click
context menu.

http://www.sevenforums.com/tutorials...-shortcut.html

# This file *adds* Takeown to the context menu.
# Download and save it. Right-click the file and select "Merge"
# to add the registry changes.

http://www.sevenforums.com/attachmen...ntext_menu.reg

# And this file *removes* Takeown from the context menu.
# Save this file for a rainy day, if for any reason you want it gone.
# Download and save it. Like the other file, you right-click the file
# and select "Merge" to remove the registry changes.

http://www.sevenforums.com/attachmen...ntext_menu.reg

You might need to logout and login again, for that
to take effect. (Try it and see. If the entry is not
present in the Context Menu, then you'll know it needs
some logout or reboot "help".) I don't know if it happens
immediately, because we'd be relying on Microsoft to re-read
the registry.

Now, when you locate "prefs.js" of your Firefox folder,
click the file to select it, then right-click to bring
up the Context Menu. The context menu should look like
this, and it should appear like the left-most one. You'll
have a new TakeOwn command.

http://www.sevenforums.com/attachmen...ut-example.jpg

This should work for some things (where your membership
in the Administrators group gives you control). It's
possible things owned by TrustedInstaller, it won't
work. But, it's better to have this command as an option,
than to not have it.

Do *not* apply that to the entire C: drive. This is
a tool for fixing "small problems", not for trashing
all the permissions on the computer.

Once you've run TakeOwn, try Notepad again, using
your newly added "Open" entry that just showed up.

*******

To understand how Takeown works, this guy shows the
two commands involved. So there is also a command
line equivalent you could use. But the Context Menu
is *so* much easier.

This is just background reading material. You can
ignore from here on if you want. You don't need to
do this, but this is available to help with future
Windows 7 problems.

http://blogs.msdn.com/b/tims/archive...deletable.aspx

takeown /f %1 /r /d y
icacls %1 /grant administrators:F /t

In the example, the %1 is the filename.

Have fun,
Paul

"Mark Twain" wrote in message
...

I tried it again and this is what it gave me:

http://i57.tinypic.com/keae10.jpg

Robert
Sorry to hear that it didn't work. Worth a shot.
Does sound like a hijacking, overall.
Have you tried uninstalling and reinstalling FF? Use their uninstaller. Save
your bookmarks.
https://support.mozilla.org/en-US/kb...-your-computer
Have you tried disabling all add-ons etc in FF?
Try dl'ing MalwareBytes Anti-Malware (usually called MBAM by those that use
it) from Malwarebytes.org. Download the free version and try the Trial Pro
version after you install it and update it.
Do a Custom scan (takes around an hour) and Configure it for your main
drive, checkmark in all four Custom scanning options, and select 'Warn user
about detections' in the two boxes below the other ones.
Perhaps it will find something that AdwCleaner didn't.
Long thread, so I'm not sure if you already tried it or not.
Best of luck,
--
Buffalo

Hello Paul,

Just to make sure, I ran Agent Ransack again, closed FF
and then attempted to open the file with Notebook and
again it failed. I do have Microsoft Word if you think it
would work.

I had no problems whatsoever that I was aware of until
this new version of FF came out and then it seems all this
stuff started to happen.

Also today I had this pop-up for a download of Nvidia,

http://i59.tinypic.com/2cgn3te.jpg

considering all that's been happening I opted not to download.
Which is also why I declined the Adobe download. I tried
looking for Adobe updates on my system but apparently you have
to go to the homepage. I haven't had very good luck in
picking the correct downloads. The last time I did I got
infected. I haven't checked for Nvidia.

I tried your first link and followed your instructions and this is
what it gave me:

http://i57.tinypic.com/29ghdgh.jpg

Robert

No, I have not tried uninstalling and reinstalling FF
and just how do I save all my bookmarks? I don't know
how to disable add-ons.

I do have FF free version and I tried the Pro version
before but the time limit ran out. If you want me to do
a custom scan etc I need a valid link to download it.

Robert

Mark Twain wrote:
Hello Paul,

Just to make sure, I ran Agent Ransack again, closed FF
and then attempted to open the file with Notebook and
again it failed. I do have Microsoft Word if you think it
would work.

I had no problems whatsoever that I was aware of until
this new version of FF came out and then it seems all this
stuff started to happen.

Also today I had this pop-up for a download of Nvidia,

http://i59.tinypic.com/2cgn3te.jpg

considering all that's been happening I opted not to download.
Which is also why I declined the Adobe download. I tried
looking for Adobe updates on my system but apparently you have
to go to the homepage. I haven't had very good luck in
picking the correct downloads. The last time I did I got
infected. I haven't checked for Nvidia.

I tried your first link and followed your instructions and this is
what it gave me:

http://i57.tinypic.com/29ghdgh.jpg

Robert



OK, for the TakeOwn and your last picture...

http://i57.tinypic.com/29ghdgh.jpg

you want to select "Open Containing Folder". That takes
you to where the .reg file is stored from the download.
Once the File Explorer window opens from doing that,
locate the newly downloaded file.

"Add_Take_Ownership_to_context_menu.reg"

Then right-click it, and the option at the top
of the menu should be "Merge".

With regard to your first picture, I've marked in
yellow, what I see on mine. That's just a floating
decoration of the NVidia web page, and isn't malicious.
It's part of their web page. It should disappear once
you're done getting a video card driver update.

http://i58.tinypic.com/2mn1z5j.jpg

Paul

Hello Paul,

I followed your instructions and
this is what it gave me:

http://i57.tinypic.com/2vm5wdj.jpg

then

http://i58.tinypic.com/5kf3ls.jpg

then

http://i60.tinypic.com/21afiba.jpg

Robert

I forgot to add the last picture,

http://i58.tinypic.com/311x79s.jpg

Robert

Mark Twain wrote:
I forgot to add the last picture,

http://i58.tinypic.com/311x79s.jpg

Robert

It was looking so good up until then :-)

That last picture is probably MBAE, Avast, or
some other member of your army of protectors.

Pretty hard to have fun on that computer
when it's tied down like that.

On some AV programs, there is a setting to
"disable protection for ten minutes" or
similar. You could look in Avast and see
if such an option is available.

*******

You can see in this article, there are longer
recipes for taking ownership of a file. So
there are other ways to achieve an objective.

http://www.vistax64.com/tutorials/67...ship-file.html

The principles in that article, should be the
same whether it is Vista, Win7, or Win8.

One hint for you, in that case, is about
spaces in path names. If I want to do something
to a file, and help guarantee the filename
will not be misinterpreted, use double quotes.

dir "C:\Program Files\MyProgram\someprogram.exe"

By using double quotes around a path string like that,
it helps ensure the entire string of characters is
considered as one unit. As otherwise, with a space in
the middle and no double quotes, it is seen as

dir chunk1 chunk2

and neither chunk1 nor chunk2 is meaningful. While
there are some situations in Command Prompt where
the shell does the right thing, it's just better
to always "insulate" things that have spaces in the
name.

So your options now a

1) Figure out which AV or anti-exploit software is
doing it. Temporarily turn off the protection,
then try to merge the .reg file.

Alternately, in Avast, attempt to do a "complete scan"
and see if the system is infected. A registry could
be locked by malware, in an attempt to prevent you
from removing what the malware has done.

2) Resort to using the longer recipe, if you need to
change permissions on a file.

There are more risky ways to get this done (.reg merge(,
but I've not tried them, and I certainly don't want
you to be a guinea pig. The above procedure with
the Takeown .reg file was supposed to be easy,
and it's been done successfully by thousands and
thousands of people. I just tested it on a Windows7
VM here, and it worked first try. That VM has no
AV running in it :-) I also don't use a web browser in
there. That's my software compile VM (MinGW), for when
I write short programs in C.

HTH,
Paul

"Mark Twain" wrote in message
...



No, I have not tried uninstalling and reinstalling FF
and just how do I save all my bookmarks? I don't know
how to disable add-ons.

I do have FF free version and I tried the Pro version
before but the time limit ran out. If you want me to do
a custom scan etc I need a valid link to download it.

Robert
I think you are referring to MBAM. The free version does just as good a job
at finding and getting rid of malware as the Pro version. It is an on-demand
scanner, while the Pro can be set to Real-Time.
Just update the free version and run the Custom scan with the settings I
suggested.
I am not sure how to export your bookmarks, but if you just do a normal
uninstall of FF, it will save your bookmarks.
Only takes around 10 min to uninstall and install (download the latest
version first) FF.
To get to the add-ons, just left click on Tools in FF or the 3 horizontal
lines symbol on the upper right of the FF page and select Add-Ons and then
select Extensions and Plug-ins and you will see the options on disabling
individual items, etc.

--
Buffalo

I followed your instructions you gave me awhile back:


"How to Temporarily Disable your Anti-virus"

http://www.bleepingcomputer.com/foru...ware-programs/

"AVAST

Right-click on the avast! icon in system tray.
Select avast! shields control and there will be options
to disable avast for 10 minutes, 1 hour, until the computer
is restarted, or permanently.
"

MalwareBytes comes in two versions. The free version (one
time scanner) should not need to be disabled. Malwarebytes
also makes a commercial version, with real time protection.
I assume this is the procedure for the real-time one (paid).

http://www.bleepingcomputer.com/foru...ams/?p=1102203

"There are several ways to disable MBAM's real-time
protection (registered version only).

* Right-click on the MBAM icon in the systray
and uncheck Enable Protection.
* When asked, "Are you sure you want to disable the
MBAM Protection Module?", click Yes.
* Right-click on the MBAM icon again and then uncheck Start with Windows.
* The Protection Module is now disabled and will not restart.

This one is for SuperAntiSpyware (I assume your spelling
above is a mis-quote).

http://www.superantispyware.com/supp...ay.html?faq=49

"SUPERAntiSpyware FREE Edition does not have
real-time anti-spyware protection

SUPERAntiSpyware Professional has real-time protection.

To exit SUPERAntiSpyware, right-click the SUPERAntiSpyware
system tray icon, and select "Exit" from the menu.

*******

SypwareBlaster isn't on that tutorial page. I start
with Wikipedia, for some hints.

http://en.wikipedia.org/wiki/Spywareblaster

http://www.brightfort.com/spywareblaster.html#FAQ

"SpywareBlaster is passive protection. It plugs the holes that
spyware and other potentially unwanted software use to get in
to your system. As such, there is no running process - and no
CPU and memory usage either. All you have to do is remember to
update SpywareBlaster once a week, and enable the latest protection."

Still not being happy with that answer, I did find this.

"Enabling and disabling SpywareBlaster protection"

https://www.brightfort.com/support/i...eid=42&nav=0,4

"To disable protection for all database items (remove all protection):

* Open SpywareBlaster program

* Click on the "Disable All Protection" link under Quick Tasks

* Exit the program
"

HTH,
Paul

Since I have the free version of Malwarebytes there's no need to disabled it but I did disable Avast and SpywareBlaster and it seems the others are passive. The only other program I have is Windows Defender which runs whenever it suppose to run.

I then tried to merge the files and it gave me the same error message as before

Robert

I checked Malwarebytes and all they offer
now is the free version and the premium
version. I did look for custom scan but
I don't have it.

http://i58.tinypic.com/5vpx5t.jpg

Here are the Add-on pages:

http://i59.tinypic.com/13z1uyq.jpg

http://i61.tinypic.com/2zemqaf.jpg

http://i62.tinypic.com/110g8iv.jpg

It says that Avast security is disabled but I selected
it to be disabled until I restarted and the system tray
shows its active.

http://i59.tinypic.com/v8j5s.jpg

I'm not going to take the step of uninstalling FF
and possibly loosing all my bookmarks.

"Mark Twain" wrote in message
...

I checked Malwarebytes and all they offer
now is the free version and the premium
version. I did look for custom scan but
I don't have it.

http://i58.tinypic.com/5vpx5t.jpg

Here are the Add-on pages:

http://i59.tinypic.com/13z1uyq.jpg

http://i61.tinypic.com/2zemqaf.jpg

http://i62.tinypic.com/110g8iv.jpg

It says that Avast security is disabled but I selected
it to be disabled until I restarted and the system tray
shows its active.

http://i59.tinypic.com/v8j5s.jpg

I'm not going to take the step of uninstalling FF
and possibly loosing all my bookmarks.

OK, I guess you don't have the same new version I have. Just update the
definitions and use the best scan they offer, I think there is the Quick and
the other one. Use the other one.

--
Buffalo

I've already run fulll scan and I cannot update
it.

http://i57.tinypic.com/2lwxk48.jpg

If you have a link for a newer better version I
would appreciate it.


Robert

I ran a full MalwareBytes scan:


http://i58.tinypic.com/2ed2s7q.jpg


Robert

I cannot update my version of Malwarebytes.

http://i57.tinypic.com/2lwxk48.jpg

Robert