Uninstalling Malware Fighter impossible

Hello,

Disable the program if possible,

Disable everything you find from the program with

Autoruns or Autoruns64 (64 bit)

Restart and simply uninstall it.

It's still not uninstalling :/

If you delete from Logon and Services, it is no longer active, just remove its traces.

Then in Drivers:

regfilter.sys

If you see an IMFFilter or something like that too.

If you delete everything with Autoruns, and then restart, you should be able to delete everything from the program folder except the IMFShellExt.dll file.

You will need to use CCleaner, in Tools -> Startup -> Context menu, and delete everything from IOBit.

Well, I tested it, and the IMFFilter that I didn't see with Autoruns, I see it with RegRun Reanimator

Item Name: IMFFilter
Author:
Current Setting: \??\C:\Program Files\IObit\IObit Malware Fighter\Drivers\wxp_x86\IMFFilter.sys
Type: Drivers

Install RegRun Reanimator (Download Mirror 1 or 2)

Click on "Fix Problems".

Click on "Scan Windows Startup...".

Check the box "Use Deep Level Scanning Once (For Advanced Users)".

Click on "Make Scan Now".

After the scan, click on "Fix Problems".

Do not delete anything other than the item I showed you, unless you ask for my opinion.

Scroll through the other items with the arrow.

Click on Reboot at the end to restart.

There should be no trace left of IOBit Malware Fighter.

At startup, RegRun Reanimator appears by itself with a black background and there are always some 'things' written.
OBit Malware Fighter is still there, maybe it’s another problem that prevents deletion?

Do you have other IOBit programs?

Only remove IOBit stuff with the Get it out button.

Delete and Reboot even before entering Windows on restart.

Normally no, I don't have IOBit

Oh, but I didn't click on 'Get it out', that's probably why lol

When I'm at this point: http://www.casimages.com/i/160715031248169683.jpg.html
there are several 'programs' that show up when I click on the top arrows

If that's where I need to choose IOBit, well, it's not there :/

What I see in the window may be a false positive, described as Unwanted, but that's not always the case; it doesn't seem harmful.

You can copy what you see on the forum with right-click -> Copy to clipboard for the other (each) item if you want, so I can see.

Nom de l'élément : REIMAGE.INI
Auteur :
Paramètre actuel : C:\WINDOWS\REIMAGE.INI
Type : Fichiers de logiciels indésirables

Nom de l'élément : .jpg
Auteur :
Paramètre actuel : C:\PROGRAM FILES\PHOTOFILTRE 7\PHOTOFILTRE7.EXE
Type : Extensions de fichiers principaux

Nom de l'élément : .jpeg
Auteur :
Paramètre actuel : C:\PROGRAM FILES\PHOTOFILTRE 7\PHOTOFILTRE7.EXE
Type : Extensions de fichiers principaux

Nom de l'élément : jfdljn
Auteur :
Paramètre actuel : C:\Windows\System32\drivers\sfqutbru.sys
Type : Pilotes

Nom de l'élément : johci
Auteur :
Paramètre actuel : C:\Windows\system32\DRIVERS\johci.sys
Type : Pilotes

Nom de l'élément : slltkd
Auteur :
Paramètre actuel : C:\Windows\System32\drivers\knvl.sys
Type : Pilotes

Nom de l'élément : C:\WINDOWS\SYSTEM32\TASKS\RealPlayerRealUpgradeScheduledTaskS-1-5-21-4007347698-596265779-3101119184-1000
Auteur :
Paramètre actuel : C:\Program Files\Real\RealUpgrade\RealUpgrade.exe
Type : Tâches planifiées 2

You can delete what seems to be a remnant of Reimage, but later, it's not urgent.

Item Name: REIMAGE.INI
Author:
Current Setting: C:\WINDOWS\REIMAGE.INI
Type: Unwanted Software Files

Install Virustotal Uploader

https://support.virustotal.com/hc/en-us/articles/115002179065-Desktop-Apps

Right-click on these files and select Send To -> Virustotal

A browser window will open, copy me the address of virustotal for these two files. (After the analyses)

Item Name: slltkd
Author:
Current Setting: C:\Windows\System32\drivers\knvl.sys
Type: Drivers

Item Name: jfdljn
Author:
Current Setting: C:\Windows\System32\drivers\sfqutbru.sys
Type: Drivers

Then do what you want with it, you can disable it if you want with Autoruns in Scheduled tasks rather than deleting it if you don't find it useful, it's a personal choice.

Item Name: C:\WINDOWS\SYSTEM32\TASKS\RealPlayerRealUpgradeScheduledTaskS-1-5-21-4007347698-596265779-3101119184-1000
Author:
Current Setting: C:\Program Files\Real\RealUpgrade\RealUpgrade.exe
Type: Scheduled Tasks 2

' Right-click on these files and select Send to -> Virustotal '

How do I find the files?

The problem is that I can't find them, definitely.

So delete with Reanimator, it's just leftovers.

But be careful not to delete anything else by mistake, you have a legitimate driver among the 3 indicated drivers.

Then, you can keep RegRun Reanimator, it can help you in the future,

Click on "False positive" for the good items when there are any, it won't detect them anymore.

If you uninstall it, just before, you can click on "Uninstall Partizan" (in the program).

And you can click on this .reg file that restores the Bootexecute key to default if it isn't:

https://www.cjoint.com/c/DIwp0hjRA6Y

You can click on the .reg file even if you keep RegRun Reanimator.

RegRun can use it for "Reboot" analyses with Partizan

But when it's not useful, you can click on the .reg file.

Well, it's a bit of Chinese to me lol but the 2 drivers are deleted :)

We can consider your issue resolved if everything is in order.

What I will do,

If there's anything, you can always reply...

See you later!

The IOBit Malware Fighter 4 is still here and it still doesn't want to go away :/

Here is the message
http://www.casimages.com/i/160715092511477387.jpg.html

I thought it was over.

You mean it's in Add/Remove Programs?

Or is it still active?

Download Process Explorer

Close all IOBit processes and delete any possible files in the IOBit folder in Program Files, and let me know where it gets stuck.