[RESOLVED] Can't remove Rogers Online Protection

[COPO]

Win XP SP3

I'm using Norton on my Laptop and can load it on 2 more PC's so I loaded it on my Tower PC. I'm trying to remove Rogers Online Protection but the programs that came with it won't uninstall when using the Start/Programs area. I tried to go to add/remove programs in the comtrol panel and it says Please make sure you have finished any previous setup.
So I go and try and reinstall Rogers Online Protection http://www.hispeed.rogers.com/bband/..._-getprotected

and it says Installation of Rogers Servicepoint Agent has failed because the existing version failed to uninstall.

I tried removing the new Norton I installed in case it was causing an issue but I got the same messages as above. I didn't want to be open to any attacks so I reinstalled Norton.

What can I do to get rid of the traces of Rogers Online Protection or get it reinstalled so I can uninstall it cleanly from the add/remove programs area?

I just started Rogers Online Protection in admin tools cause it was stopped. I'll see if I can remove it now. No go still.

I tried this too Should you experience any difficulties with the uninstall process, click here to perform an additional uninstall of the software. From http://help.yahoo.com/l/ca/rogers/yo...ics-89718.html

Some files got cleaned up but I still have the Rogers Programs in add/remove Programs and in the Start Programs pull down menu.

[COPO]

I checked the registry for any Rogers Programs under HKEY_LOCAL_MACHINE\ SOFTWARE\ Microsoft\ Windows\ CurrentVersion\ Uninstall

and Rogers Yahoo Applications is the only one there. I still have the Rogers Online Protection Program directories in Windows\Program Files and still in add/remove programs list.

[Broni]

Did you try Revo?
http://www.revouninstaller.com/

[foxy]

You beat me to it. I LOVE Revo.

[COPO]

I'll try it. I'm going back to another restore point.
I somehow also for some reason started to see a Freedom icon in the bottom right of my screen. I looked it up and it's a firewall. Is this real or a Trojan because I didn't install it? I just read about Freedom and will remove it too with the suggested uninstall program ^^ since I have a firewall with Norton.

BTW, will restore recover the registry line ^ that I deleted? I did bkup the reg and can import it back.

[COPO]

Do I use the Uninstall icon at the top to the left of View to uninstall the programs I want out?

[COPO]

Ok, I got that all cleaned up....thx for the program link...I'll have to buy it.

BTW, I still have 1 directory from Rogers Online Protection, and can't delete AVCntxtR.dll.
Access denied, make sure the disk is not full or write protected and that the file is not currently in use.

It's doing something after a reboot if I do a right click on Start I see something like RPS... starting or something and if I go into that Rogers directory there's more directories and files that got created.

How can I remove this dll file?

OOPS I just noticed I have a Rogers Yahoo Appl program still to remove from the add/remove program icon..I'll try that first.

[Broni]

can't delete AVCntxtR.dll

Try Safe Mode.

[COPO]

I did but the keyboard won't let me type anything in. How about DOS?
That directory is bringing files back automatically when I start to delete them.

Screen pops up and says:

RPS Antivirus. Please wait while Windows configures RPS Antivirus.

I went into DOS from Run cmd and deleted it and it comes back.
I'll try running my superantiv... and malware... programs.

[Broni]

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2

• Double-click SystemLook.exe to run it.
• Vista users:: Right click on SystemLook.exe, click Run As Administrator
• Copy the content of the following box into the main textfield:
  

  :filefind
  AVCntxtR.dll

• Click the Look button to start the scan.
• When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

[COPO]

SystemLook v1.0 by jpshortstuff (11.01.10)
Log created at 17:03 on 07/02/2010 by Administrator (Administrator - Elevation successful)

========== filefind ==========

Searching for "AVCntxtR.dll"
C:\Program Files\Rogers Online Protection\Rogers Online Protection\AVCntxtR.dll --a--- 108272 bytes [03:50 28/02/2009] [03:50 28/02/2009] B7B0CBC9521BC9549822FE9B0E60ED6E

-=End Of File=-

[Broni]

Please download OTM

• Save it to your desktop.
• Please double-click OTM to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
• Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

:Processes

:Services

:Reg

:Files
C:\Program Files\Rogers Online Protection
      
:Commands
[purity]
[resethosts]
[emptytemp]
[Reboot]

• Return to OTM, right click in the Paste Instructions for Items to be Movedwindow (under the yellow bar) and choose Paste.
• Click the red Moveit! button.
• Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
• Close OTM and reboot your PC.

Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.

[COPO]

I did not have the option to paste into IE since the only window that was left was OTM.

After the reboot, I selected it to run on the prompt I received and it generated this log.

All processes killed
========== PROCESSES ==========
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
C:\Program Files\Rogers Online Protection\Rogers Online Protection\Tool folder moved successfully.
C:\Program Files\Rogers Online Protection\Rogers Online Protection\resources\zk_en_US folder moved successfully.
C:\Program Files\Rogers Online Protection\Rogers Online Protection\resources folder moved successfully.
C:\Program Files\Rogers Online Protection\Rogers Online Protection folder moved successfully.
C:\Program Files\Rogers Online Protection folder moved successfully.
========== COMMANDS ==========
C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 2550581 bytes
->Temporary Internet Files folder emptied: 7207838 bytes
->Java cache emptied: 22811506 bytes
->FireFox cache emptied: 0 bytes
->Google Chrome cache emptied: 0 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Guest
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: LocalService
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 24192 bytes
Windows Temp folder emptied: 2609497 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 34.00 mb


OTM by OldTimer - Version 3.1.8.0 log created on 02072010_170934

Files moved on Reboot...
File C:\WINDOWS\temp\Perflib_Perfdata_448.dat not found!

Registry entries deleted on Reboot...

[COPO]

As soon as I did a right mouse click on start to open Windows Explorer I saw that RPS start as it did before.
I looked in Program Files and the Rogers Online Protection directory is still there with it's files and other directories.

Did I jump the gun by doing the right mouse click on the start button? Do I need to repeat the OTM run?

[Broni]

That folder was completely removed, but...
You must have some other leftovers...

Download HijackThis:
http://www.trendsecure.com/portal/en...kthis/download
by clicking on Installer under Version 2.0.2
[DO NOT download version 2.0.3 (beta)]
Install, and run it.
Post HijackTHis log.
Do NOT attempt to fix anything!

NOTE. If you're using Vista, or 7, right click on HijackThis, and click Run as Administrator