Sunday, November 27, 2011

Fighting EpicPlay

Like other on the net, my computer has been infected by "EpicPlay".
On a PC #1, it shows up on Firefox and as an application in Windows (in the registery).
On PC #2 it shows up only on Firefox.

EpicPlay has done a great job in removing useful Forum threads about how to remove it's evil programs, so here's my blog contribution.

On PC #1:

  • Uninstall the Addon from within Firefox Extension manager.
  • Used Windows Control Panel; Remove Programs; to find EpicPlay and uninstall
This may have worked, but its entirely possible that the Uninstall script just hid it from plain sight. I do not see it on Firefox yet.

On PC #2 (older XP) attempt 1:
  • Disable Addon from within Firefox Extension manager (uninstall was not available)
  • Result : restarting Firefox just brings it back as active
  • Unable to find the installing AddOn via Control Panel; Remove programs
Attempt 2:
  • Start Firefox in Safe mode, now I see the Uninstall button for EpicPlay
  • Uninstall EpicPlay
  • Result : restarting Firefox just brings it back as installed and active
Attempt 3: 
  • Use Firefox Troubleshooting Information to see Extensions
  • "EpicPlay Games" is listed with ID: textlinks@epicplay.com
  • Use "Open the containing folder"but it's not there
  • Open Mozilla Firefox\extensions\ ; there is an extension not listed in Troubleshooting menu
  • remove that extension folder.. restart Firefox
  • Result : Did not work... EpicPlay still in place as AddOn
Attempt 4:

  • Search "EpicPlay" on filesystem
  • Found in Mozilla\ .. \Extension\{hex code address here}\
  • Manually deleted several times as Firefox is started, 3rd time only creates empty directory
  • Result : WORKED.. but I am concerned it's not a permanent fix
  • Search again after restart.. no reference to EpicPlay

No comments: