Yahoo Messenger Troubleshooter

[daivddd]

Oh no, my enthusiasm was misplaced--I got another BSOD

Last night I left my computer on with 2 windows and several tabs going, iTunes, and Ares. I awoke to a blue screen.

I checked hidden devices and SbFw is back!!! The drivers folder now contains all 3 originals that I had renamed, and the renamed files are gone. I'll go through the routine again, but this time I'll attempt to remove them completely and I'll look around to see if I can find a way to be sure Sunbelt gets totally removed. If you know of a tool or plan, be sure to let me know!

[daivddd]

¡¡¡IGNORANCE DETECTED!!!

(This post follows 2 I wrote you might not have seen yetl.)

I re-did my Sunbelt removals then restored so that I could get connected, then I checked the drivers folder. Apparently, as you must know, restoring restores drivers that you delete even in safe command prompt. All Sunbelt driver files I deleted were back.

Or maybe Sunbelt has a backup file to restore their files that are deleted.

I'll look on Google how to delete Sunbelt, but if you have an idea let me know.

[daivddd]

Sorry, this will be the last one until I hear from you...

I found a link at several sites to completely remove Sunbelt, but the link does not work.

There are MANY entries in regedit containing the word Sunbelt. I'm not expert at regedit, so I didn't mess with any of them. But is it safe to first remove the drivers I found then delete the entries in regedit? If so, would I remove the entire "folder" containing those entries or just the individual entries?

I'm rather stumped right now, so I'll wait for you. I CAN access the internet, so I'm not expecting you to drop everything to work on this. Just when you have time is perfectly OK--I can be patient.

[satrow]

Hmm, I think we first need to ascertain whether Sunbelt means Sunbelt or whether it's referring to Vipre (I think they also use it, or bought the rights to it - there may be others too?), scan through the registry for Vipre, also see if there's a cleanup tool from Vipre you can use (sorry for the brief reply, lots of catchup to do today, I'll look in again later).

[daivddd]

An update--

I contacted the company. He ran me through some steps. First deleted Koko in Programs and Features. Then changed Adapter Settings in the Network and Sharing Center. For each adapter I unchecked in "This connection uses the following items" a setting for Sunbelt Software Firewall NDIS IM Filter. That seemed to do it. I restarted a couple of times and all the driver files remain deleted, Koko is gone, and I get immediate connection

One thing hopefully out of the way. If I have to send you a minidump again we'll see if Sunbelt REALLY is gone!

[satrow]

Ahh, great work - KoKo (never heard of it before now) had been hooked into the Sunbelt driver and that was the reason it couldn't be uninstalled/removed?, Nice find :

Kliente KoKo Information and Removal.
Copyright © 2012 Sunbelt Software. Reproduction in whole or in part without permission is prohibited.

Threat Name Kliente KoKo
Summary Kliente KoKo is a remote administration tool.
Category RATCategory information
Level ElevatedLevel information
Advice Quarantine
Description Kliente KoKo is a remote administration tool.
Release Date Jul 28 2005
Last Updated Apr 24 2009

http://www.sunbeltsecurity.com/Threa...E8C65F73E4FE32 if the above is any indication, you're well rid of it!

Now get us some dumps so we can be sure that was the cause ^^ !

[daivddd]

As you know I won't be sure for several days, but as of now I can report that everything looks very good. For a while I fretted--if I turned on my computer from "off" I was immediately connected online; however, when resuming from sleep I could not get connected. No BSOD, just not connection. I'd run Troubleshoot my connection to the Internet and get the response "Troubleshooting couldn't identify the problem," but each time I could then get connected anyhow...kinda odd. I then re-checked "Allow the computer to turn off this device to save power," which I had previously unchecked while we were narrowing things down. Now I can get connected immediately any time. Feels really good! I hope in several days I can come back to you with these same comments

[satrow]

Part of the KoKo/Sunbelt removal process may have reset some of the driver properties to default, looks like you figured that out quick enough

I'm pleased to hear that, for a short time at least, it seems to be much improved; you did a fine job of sticking to the task in hand - I hope your computer will do the same for you now.

If you're free of BSOD's for around 10 days, I reckon you've cracked it. If it does BSOD again, upload the dump and a little history around it happening and someone will take a look through it.

[daivddd]

Well it's been several days and I have not again run into any sort of problem! I consider it all fixed My machine once again runs fast and powerful

So, satrow & handygal, and anyone else who contributed, thank you very much It took a while, but we finally narrowed it down to Koko and its firewall. Once removed absolutely my comp was back to normal.

Now then, do you all do this sort of work as a hobby and challenge, or do you hope to earn some money? I don't have a lot to deal with, but you did provide me with a valuable service. Please tell me what you are anticipating, what is normal to contribute. (Don't just say whatever I think is good!)

Thanks again,
David

[handygal]

Thanks for letting us know!

Interesting question. satrow fixed you but as far as why invest the time, for me, it's a combination of paying back to the community that I have learned much from and also the challenge. It is not much different from puzzles and internet games. I'm just a member like most users on here.

[satrow]

Yes, thanks for the positive feedback David, great that you seem to have found the problem and fixed it.

If my arm's being twisted here, I'll say that sometimes I feel that helping a user to work out or understand a little more about the problem is better than preaching at the user and expecting him/her to follow complex instructions blindly. Better to try to keep the user involved and reasonably confident that any troubleshooting steps are useful and, hopefully, understandable to all concerned. I think we all learned something from this thread.

Thanks again David, you were a great help and a pleasure to work with. HG, you played your part well too, thanks for that.

As to why I do it? Probably the education factor looming large, I enjoy learning things, I also enjoy trying to pass on some of that knowledge and hopefully boosting the confidence of those who may otherwise feel too inexperienced or distanced from the problem somehow. Difficult to explain, I'm under-educated and struggle to translate my thoughts into sensible English - frequently!