en de fr

Submitted by MalwareSucks on 1 July, 2012 - 13:53

 So I installed PDF creator (great tool, thank you) however it seems you have this unfortunate association with "Incredibar", a highly frustrating Malware.

 

Now I've attempted to remove this using the instructions found within your FAQ and various other internet sites but have had little joy.

 

Can you please assist me in the absence of any help on their website: http://www.incredibar.com/essentials/homepage

Re: Incredibar & underhand tactics (URGENT!!!)

You are not the first to complain about these underhanded tactics. See also: http://www.pdfforge.org/forum/open-discussion/8973-sweetim-spyware

I was able to remove most of "Incredibar" using Spybot Search & Destroy. However, this infection happened last night, and despite multiple hours trying to clean it, I'm still finding bits and pieces of this software: for example, check all your browser homepages, browser extension settings (FF in about:config), including even the "address bar search" mechanism (in about:config, search for "keyword.url" and reset that key).

Also double check for a "Web Assistant 2.0" in your add-ons. It does not have a "remove" button within, but can be removed in Windows' Add/Remove program dialog.

If you find anything else, please feel free to post it here.

It's really sad that the developers are this desperate. As I said in the other thread: by letting this spyware install, they have lost the trust of their users, damaged the reputation of Sourceforge, and, finally, completely stopped me from using the software and certainly ever donating.

While this is certainly morally suspect and unwelcome in FOSS, furthermore I believe Sourceforge may have a policy against this, in which case we should report it: http://sourceforge.net/projects/pdfcreator/report_inappropriate

Re: Incredibar & underhand tactics (URGENT!!!)

Oh, I found another place: "WebAssistant" stores keys (in Firefox's about:config) under

"{336D0C35-8A85-403a-B9D2-65C292C39087}". If this is not the same ID that yours uses, try

searching for "ScriptData_WSG" and then right click "copy name" and paste that ID into the

search field.

Supposedly resetting these keys and then restarting Firefox should remove them. However,

if the keys persist after restarting, you then also need to search in your user profile

(in "%APPDATA%\Application Data\Mozilla\Firefox\Profiles") and find "user.js". Delete any

lines with "incredibar" in them.

Obviously, I'm operating on the assumption that most people who get infected with this are

using Firefox. I hope this thread will help anyone else who needs to remove this mess.

 

Re: Incredibar & underhand tactics (URGENT!!!)

Wow, sorry for the formatting nightmare above. Let's try again:

Oh, I found another place: WebAssistant stores keys (in Firefox's about:config) under "{336D0C35-8A85-403a-B9D2-65C292C39087}". If this is not the same ID that yours uses, try searching for "ScriptData_WSG" and then right click "copy name" and paste that in the search field.

Supposedly resetting these keys and then restarting Firefox should remove them. However, if the keys persist after restarting, you then also need to search in your user profile (in "%APPDATA%\Application Data\Mozilla\Firefox\Profiles") and find "user.js". Delete any lines with "incredibar" in them.

Obviously, I'm operating on the assumption that most people who get infected with this are using Firefox. I hope this thread will help anyone else who needs to remove this mess.