How do you get rid of a toolbar

[gypsy63]

Using:
Vista Home Premium 32 bit
Firefox 3.6.6
Avast
SuperAntiSpyware
Ad-Aware

I was using a video downloader called Freecorder and recently had to uninstall it in order to be able to upgrade to the newest version to make it compatible with my newer version of FF. I went to the web site where Freecorder was located and printed out all the instructions for uninstalling this program. I followed the instructions exactly and then rebooted. I uninstalled Replay Media Catcher first, then next I uninstalled Freecorder Toolbar and Freecorder Application--(I did not have my browser open either) and then rebooted. After the reboot, I opened up Firefox and the toolbar was still there. Next I went back to the Control Panel and checked the list and all of the programs were no longer listed. I then checked my program's list and they were not listed there either. I also checked the Task Manager and it did not show anything at all listed as FlvSrvc.exe--so I could not stop that process since it was not on the list. The only thing left in my Add/Remove program that I thought might have anything to do with all of this, was another Applian Technology program called, Applian Director 1.1, so I uninstalled it too--then rebooted and opened browser again--still had the toolbar. I have been going nuts trying to figure out what else to do.

Right now I have the toolbar hidden because it is completely useless and I don't need it now. Could someone please tell me what else I can try in order to get this toolbar out of my browser?
Thanks,

[Broni]

Download FoxScan from HERE, or HERE
Double click on FoxScan.exe to start the scan.
DOS-like window will pop-up.
Press 2 for English. Press Enter.
Be patient. It'll take few minutes.
When the tool is done, it'll display:

Search completed.
Press any key to coninue...

Press any key.
Notepad window titled Rapport-FS.txt will open.
Save the file to known location, and attach it to your next reply.

[gypsy63]

Since my last posting, this is what I tried next. I downloaded Revo Uninstaller and then after that I re-installed the same version I had of Freecorder before. Once it was once again installed, I used Revo Uninstaller, using moderate uninstall option to try uninstalling the toolbar and get rid of the registry keys. This was suppose to do a through scan of the registry and let me delete all associated with the program. It showed 14 keys that needed deleting at the end of the scan. After deleting the keys, I opened FF back up and the toolbar was still there! Next I reinstalled the program again and used Revo Uninstaller to uninstall again but this time using the advance mode where it was suppose to do a very deep scan of the computer and look for all registry keys and files and folders. At the end of the scan it only showed 7 registry keys that needed deleting but did not show any files or folders. Can't help but wonder why I had less registry keys this time to delete using a deeper scan than the scan I did that was not as deep of a scan. Anyway, when I finished deleting all the registry keys and then opened FF back up, there was the toolbar still! I just don't know what else to do any more but I am going to bed now and worry about it again tomorrow, it is almost 1 AM here. Will appreciate any suggestions anyone can make.
Thanks,

[Broni]

Did you read my reply?

[gypsy63]

Broni: We must have crossed posted because after I submitted my last post I then saw yours! I will do as you suggest, but first a couple of questions. I presume before starting this scan that I need to turn off all my anti ware that is running in the back ground, and second, how do you attach this file to my next reply that you need? I have never attached something to one of my posts before.
Thanks,

[Broni]

You don't have to turn off anything.
In "Quick reply", click on "Go advanced".
On next page click on "Manage attachments" button underneath reply window.
Attachment window will pop-up.
Navigate to a file, you want to attach.

[gypsy63]

Broni: Neither one of those links work. The first one says "DNS Look up error" and the other one says, "404 Not Found". What do I do now?

[Broni]

They both work for me.
I'm attaching the file (zipped).

[gypsy63]

I have WinZip and when I doubled clicked on the zip file, I got this error message from WinZip:

Extracting to "C:\Users\Shiela\AppData\Local\Temp\wze86e\"
Use Path: yes Overlay Files: yes
WinZip can't find C:\Users\Shiela\AppData\Local\Temp\FoxScan.zip.

I have to admit I am not very good with opening zip files, so did I do something wrong? Wasn't I just suppose to double click on the file and it was suppose to open?

[Broni]

OK, I uploaded straight .exe file here: http://www.uploadmb.com/dw.php?id=1278653720

[gypsy63]

That was easier than Zip. I will await your reply.

FoxScan Version 1.1.1
By Loup blanc - Zebulon.fr
Scan started Fri 07/09/2010 at 1:41

Microsoft Windows Vista (TM) Home Premium Service Pack 2 [Version 6.0.6002]

Mozilla Firefox version : 3.6.6 (en-US)
Installation folder : C:\Program Files\Mozilla Firefox


=================================================================================
---------- User account : Shiela [Current session]
=================================================================================


Profile name : default
Profile folder : C:\Users\Shiela\AppData\Roaming\mozilla\firefox\Profiles\afqcglpm.default\
Start pages prefs.js : "http://www.google.com/"


//////////// Setting \\\\\\\\\\\\\
======= Profile name : default =======

Firefox update : Activated
Add-on update : Activated
Search engines update : Activated
Java : Activated
Javascript : Activated
Proxy : No Proxy




//////////// Add-on \\\\\\\\\\\\\

======= Profile name : default =======

Installation notification for Add-on is enabled

Nom : deskCut
Dossier : C:\Users\Shiela\AppData\Roaming\mozilla\firefox\Profiles\afqcglpm.default\extensions\{9125C9CB-BE2B-4389-A0C7-46A4BDD46AEA}\
Etat : actif

Nom : Forecastfox
Dossier : C:\Users\Shiela\AppData\Roaming\mozilla\firefox\Profiles\afqcglpm.default\extensions\{0538E3E3-7E9B-4d49-8831-A227C80A7AD3}\
Etat : actif

Nom : Microsoft .NET Framework Assistant
Dossier : C:\Users\Shiela\AppData\Roaming\mozilla\firefox\Profiles\afqcglpm.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}\
Etat : actif

Nom : NoSquint
Dossier : C:\Users\Shiela\AppData\Roaming\mozilla\firefox\Profiles\afqcglpm.default\extensions\[email protected]\
Etat : actif

Nom : Adblock Plus
Dossier : C:\Users\Shiela\AppData\Roaming\mozilla\firefox\Profiles\afqcglpm.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}\
Etat : actif

Nom : Web2PDF converter
Dossier : C:\Users\Shiela\AppData\Roaming\mozilla\firefox\Profiles\afqcglpm.default\extensions\{e8f509f0-b677-11de-8a39-0800200c9a66}\
Etat : actif
Nom : Web2PDF конвертер
Dossier : C:\Users\Shiela\AppData\Roaming\mozilla\firefox\Profiles\afqcglpm.default\extensions\{e8f509f0-b677-11de-8a39-0800200c9a66}\
Etat : actif

Nom : printpdf
Dossier : C:\Users\Shiela\AppData\Roaming\mozilla\firefox\Profiles\afqcglpm.default\extensions\[email protected]\
Etat : actif

Nom : glowygreen
Dossier : C:\Users\Shiela\AppData\Roaming\mozilla\firefox\Profiles\afqcglpm.default\extensions\[email protected]\
Etat : actif

Nom : Freecorder Toolbar
Dossier : C:\Users\Shiela\AppData\Roaming\mozilla\firefox\Profiles\afqcglpm.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\
Etat : actif

Nom : Default
Dossier : C:\Program Files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}\
Etat : actif

Nom : Java Console
Dossier : C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}\
Etat : actif






Nom : McAfee SiteAdvisor
Dossier : C:\Program Files\McAfee\SiteAdvisor\
Etat : actif


Nom : RealPlayer Browser Record Plugin
Dossier : C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext\
Etat : actif




//////////// Search plugins \\\\\\\\\\\\\

======= Profile name : default =======

Search in "prefs.js" :

browser.search.defaultenginename : "Secure Search"
browser.search.defaulturl :
browser.search.selectedEngine : "Amazon.com"
keyword.URL :
keyword.enable :


--------- Search engines found ------------
+ Search form configured for the engine


C:\Users\Shiela\AppData\Roaming\mozilla\firefox\Profiles\afqcglpm.default\searchplugins\siteadvisor.xml
Template : http://www.siteadvisor.com/lookup?q





=================================================================================
---------- Common section
=================================================================================

//////////// DLL found in C:\Program Files\Mozilla Firefox\components \\\\\\\\\\\\\

browserdirprovider.dll
brwsrcmp.dll
GoogleDesktopMozilla.dll


------------------------------------------------------

//////////// Search plugins \\\\\\\\\\\\\

--------- Search engines found ------------
+ Search form configured for the engine


C:\Program Files\Mozilla Firefox\searchplugins\amazondotcom.xml
Template : http://www.amazon.com/exec/obidos/external-search/


C:\Program Files\Mozilla Firefox\searchplugins\answers.xml
Template : http://www.answers.com/main/ntquery


C:\Program Files\Mozilla Firefox\searchplugins\creativecommons.xml
Template : http://search.creativecommons.org/


C:\Program Files\Mozilla Firefox\searchplugins\eBay.xml
Template : http://rover.ebay.com/rover/1/711-47294-18009-3/4


C:\Program Files\Mozilla Firefox\searchplugins\google.xml
Template : http://www.google.com/search


C:\Program Files\Mozilla Firefox\searchplugins\googledesktop.xml
Template : http://127.0.0.1:4664/search&s


C:\Program Files\Mozilla Firefox\searchplugins\McSiteAdvisor.xml
Template : http://search.yahoo.com/search


C:\Program Files\Mozilla Firefox\searchplugins\wikipedia.xml
Template : http://en.wikipedia.org/wiki/Special:Search


C:\Program Files\Mozilla Firefox\searchplugins\yahoo.xml
Template : http://search.yahoo.com/search



------------------------------------------------------

//////////// Plugins set in registry \\\\\\\\\\\\\


[HKEY_LOCAL_MACHINE\software\mozillaplugins\@adobe.com/FlashPlayer]
"Description"="Adober Flashr Player 10.1 Plugin"
"Vendor"="Adobe Systems Incorporated"
"Path"="C:\Windows\system32\Macromed\Flash\NPSWF32.dll"

[HKEY_LOCAL_MACHINE\software\mozillaplugins\@adobe.com/ShockwavePlayer]
"Description"="Adobe Shockwave Player"
"Vendor"="Adobe Systems Inc."
"Path"="C:\Windows\system32\Adobe\Director\np32dsw.dll"

[HKEY_LOCAL_MACHINE\software\mozillaplugins\@Apple.com/iTunes,version=]
"Description"="iTunes Detector Plug-in"

[HKEY_LOCAL_MACHINE\software\mozillaplugins\@Apple.com/iTunes,version=1.0]
"Vendor"="Apple Inc."
"Path"="C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll"

[HKEY_LOCAL_MACHINE\software\mozillaplugins\@canon.com/EPPEX]
"Description"="Canon Easy-PhotoPrint EX"
"Vendor"="Canon Inc"
"Path"="C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL"

[HKEY_LOCAL_MACHINE\software\mozillaplugins\@Google.com/GoogleEarthPlugin]
"Description"="Google Earth in your browser"
"Vendor"="Google Inc."
"Path"="C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll"

[HKEY_LOCAL_MACHINE\software\mozillaplugins\@google.com/npPicasa3,version=3.0.0]
"Description"="Picasa3 plugin"
"Vendor"="Google, Inc."
"Path"="C:\Program Files\Google\Picasa3\npPicasa3.dll"

[HKEY_LOCAL_MACHINE\software\mozillaplugins\@microsoft.com/WPF,version=3.5]
"Description"="Windows Presentation Foundation plug-in for Mozilla browsers"
"Vendor"="Microsoft Corp."
"Path"="c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll"

[HKEY_LOCAL_MACHINE\software\mozillaplugins\@real.com/nppl3260;version=6.0.12.732]
"Description"="RealPlayer(tm) LiveConnect-Enabled Plug-In"
"Vendor"="RealNetworks"
"Path"="C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll"

[HKEY_LOCAL_MACHINE\software\mozillaplugins\@real.com/nprjplug;version=1.0.3.732]
"Description"="RealJukebox Netscape Plugin"
"Vendor"="RealNetworks"
"Path"="C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll"

[HKEY_LOCAL_MACHINE\software\mozillaplugins\@real.com/nprphtml5videoshim;version=1.0.0.0]
"Description"="RealPlayer(tm) HTML5VideoShim Plug-In"
"Vendor"="RealNetworks"
"Path"="C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll"

[HKEY_LOCAL_MACHINE\software\mozillaplugins\@real.com/nprpjplug;version=6.0.12.732]
"Description"="6.0.12.732"
"Vendor"="RealNetworks"
"Path"="C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll"

[HKEY_LOCAL_MACHINE\software\mozillaplugins\@real.com/nsJSRealPlayerPlugin;version=]

[HKEY_LOCAL_MACHINE\software\mozillaplugins\@tools.google.com/Google Update;version=8]
"Description"="Google Update"
"Vendor"="Google"
"Path"="C:\Program Files\Google\Update\1.2.183.29\npGoogleOneClick8.dll"

[HKEY_LOCAL_MACHINE\software\mozillaplugins\@videolan.org/vlc,version=1.0.1]
"Description"="VLC Multimedia Plugin"
"Vendor"="VideoLAN"
"Path"="C:\Program Files\VideoLAN\VLC\npvlc.dll"

[HKEY_LOCAL_MACHINE\software\mozillaplugins\@videolan.org/vlc,version=1.0.3]
"Description"="VLC Multimedia Plugin"
"Vendor"="VideoLAN"
"Path"="C:\Program Files\VideoLAN\VLC\npvlc.dll"

[HKEY_CURRENT_USER\software\mozillaplugins\@facebook.com/FBPlugin,version=1.0.3]
"Description"="Facebook's Mighty Plug-In"
"Vendor"="Facebook, Inc."
"Path"="C:\Users\Shiela\AppData\Roaming\Facebook\npfbplugin_1_0_3.dll"


------------------------------------------------------

//////////// Additional search... \\\\\\\\\\\\\

==== Additional extension ====

"{20a82645-c095-46ed-80e3-08825760534b}"="C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\"

"{ABDE892B-13A8-4d1b-88E6-365A6E755758}"="C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext"



=========================== End of report ===========================

Edited to show log

[gypsy63]

Broni: I keep falling asleep at my computer because it is almost 3 AM here. I will just have to go to bed and check back here tomorrow for your reply. Sorry I could not stay awake to complete fixing this problem.
Thanks and goodnight,

[gypsy63]

Broni: If I don't get back to you right away after you get here and post, just know it is probably due to this really bad thunderstorm that is about to begin here. I hear a lot of thundering and know the storm is coming closer. We have a lot of those lately and since we have satellite Internet Service we won't have any Internet Service while it is storming--plus I always unplug my computer when it storms. Will post back as soon as the weather will allow.

Oh BTW, I noticed in that attachment that I posted here that there is something there listed about Facebook. I only had an account with them for a week and decided to get rid of the account. I had no idea that Facebook planted something on my computer. While you are helping me get rid of the toolbar, could you also help me get rid of whatever that is planted by Facebook? I sure don't want any spyware on my computer and have heard that Facebook is bad about doing that.
Thanks,

[Broni]

Sorry for your wait. I went to bed

Please download OTM

• Save it to your desktop.
• Close Firefox.
• Please double-click OTM to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
• Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

:Processes

:Services

:Reg

:Files
C:\Users\Shiela\AppData\Roaming\mozilla\firefox\Profiles\afqcglpm.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\ 
      
:Commands
[emptytemp]
[Reboot]

• Return to OTM, right click in the Paste Instructions for Items to be Movedwindow (under the yellow bar) and choose Paste.
• Click the red Moveit! button.
• Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
• Close OTM and reboot your PC.

Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.

[gypsy63]

Broni: Sorry could not get back here last night, storm knocked out all our power and just got electricity this morning. I did as you instructed this morning and had to do as your "Note" instructed because the window did come up that stated a reboot was necessary to move all the files--but I did not have to hunt for Notepad because when computer came back up, Notepad was already opened on my desktop with the text below:

All processes killed
========== PROCESSES ==========
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
C:\Users\Shiela\AppData\Roaming\mozilla\firefox\Profiles\afqcglpm.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\searchplugin folder moved successfully.
C:\Users\Shiela\AppData\Roaming\mozilla\firefox\Profiles\afqcglpm.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\META-INF folder moved successfully.
C:\Users\Shiela\AppData\Roaming\mozilla\firefox\Profiles\afqcglpm.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\lib folder moved successfully.
C:\Users\Shiela\AppData\Roaming\mozilla\firefox\Profiles\afqcglpm.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\defaults folder moved successfully.
C:\Users\Shiela\AppData\Roaming\mozilla\firefox\Profiles\afqcglpm.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\components folder moved successfully.
C:\Users\Shiela\AppData\Roaming\mozilla\firefox\Profiles\afqcglpm.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome folder moved successfully.
C:\Users\Shiela\AppData\Roaming\mozilla\firefox\Profiles\afqcglpm.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612} folder moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Public

User: Shiela
->Temp folder emptied: 1233090 bytes
->Temporary Internet Files folder emptied: 11255915 bytes
->Java cache emptied: 81763305 bytes
->FireFox cache emptied: 106529022 bytes
->Google Chrome cache emptied: 10121294 bytes
->Flash cache emptied: 466217 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 1377135 bytes
%systemroot%\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 6806963 bytes
%systemroot%\system32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment folder emptied: 25494564 bytes
RecycleBin emptied: 1565339 bytes

Total Files Cleaned = 235.00 mb


OTM by OldTimer - Version 3.1.12.2 log created on 07102010_053230

Files moved on Reboot...
File C:\Windows\temp\_avast5_\Webshlock.txt not found!

Registry entries deleted on Reboot...