Warning: Removal of Marketscore not effective

  • Thread starter Thread starter Brian Bergin
  • Start date Start date
B

Brian Bergin

If you use MS Antispyware (16 Feb 05 version) to remove the spyware
product Marketscore it will NOT completely remove the spyware. It
leaves hooks in place that forces IE to continue to look for the
Marketscore proxy servers. You need a removal tool from them, which
is VERY hard to get, to get it off your system. They list an invalid
phone # with Whois for their domain so you have to call their parent
company comscore.com, #'s can be found at
http://www.comscore.com/contact/locations.asp. When you get there ask
them for the tool called CSRemove.exe. This tool does fully remove
the software. A further note, the uninstaller that comes with it also
doesn't fully remove it as reported by many other web postings so
you'll likely need the tool no matter what, but MS needs to either
fully remove it or tell you how to contact the company to fully remove
it, but not halfway remove it and leave you crippled.
 
Try running a full system scan in Safe Mode. On the Scan Page choose Scan
Options > Full System. Also, enable show hidden folders, tools > Folder
Options > View (Tab). Empty your temp directory. Also remember before you
enter safe mode to turn off system restore.
 
Try running a full system scan in Safe Mode. On the Scan Page choose Scan
Options > Full System. Also, enable show hidden folders, tools > Folder
Options > View (Tab). Empty your temp directory. Also remember before you
enter safe mode to turn off system restore.
Click to expand...

Nope, tried and failed on a VPC install of XP Pro SP2 with full admin
rights.
 
I can see you have replied saying its not possible but
there is more info than whats on that link so wanted to
post it incase it helps others,

The software can silently download and install arbitrary
unsigned code from its controlling server, as a self-
update feature.

MarketScore also installs its own trusted root
certificates, so that it can intercept secure (SSL)
connections made by your machine. These certificates are
left behind even when the software is uninstalled,
allowing MarketScore servers to impersonate any other
domain.

The OS variant may provide an entry in the Control
Panel's Add/Remove Programs feature, which should work.
Otherwise, use the hidden uninstall feature. Either way,
check below to remove the Root CA certificates.

Do not attempt to remove the LSP components of
MarketScore by hand; failure to get it exactly right will
result in a loss of internet connection. Also, you won't
be able to kill ossproxy.exe (OS variant) or mksc.exe
(MKSC variant) from the Task Manager as normal, as the
program hides itself when it sees the Task Manager open.

To use the hidden uninstaller, open a DOS command prompt
window (from Start->Programs->Accessories) and enter, for
the NS variant:

cd %WinDir%\System
nscheck /uninstall

Or, for the OS variant:

cd %WinDir%\System
ossproxy -bootremove -uninst:RelevantKnowledge

Or, for the MKSC variant:

cd %WinDir%\System
mksc -bootremove -uninst:RelevantKnowledge

Reboot the machine and you should be able to delete the
ossproxy.exe or mksc.exe file from the System folder
(which is inside the Windows folder, and
called 'System32' under Windows NT/2000/XP/2003). You can
also delete nscheck.exe and nsconfig.dll for the NS
variant, or okshook.dll, osmim.dll and osconfig.dll for
the OS variant.

Finally, open Internet Options (from the Control Panel
or, in IE, Tools->Options) and click the 'Certificates'
button on the 'Content' tab. Search for 'Netsetter' in
the list in the Trusted Root Certification Authorities
tab, select it and remove it. For the OS variant, do the
same for the 'MarketScore' certificate.

Optionally, you can open the registry (Start->Run-
regedit) and delete the key Software\Netsetter in both
Click to expand...
HKEY_LOCAL_MACHINE and HKEY_CURRENT_USER to clear up.


Plus for repairing the LSP chain if needed:


LSP-Fix
Repairs Winsock 2 settings, caused by buggy or improperly-
removed Internet software, that result in loss of
Internet access

http://www.cexx.org/lspfix.htm

Regards Andy
 
The lists they provide you have to scroll through. If you delete everything
listed, Marketscore is gone. The only way it could come back is a hidden
trojan still on your machine hiding.
 
The lists they provide you have to scroll through. If you delete everything
listed, Marketscore is gone. The only way it could come back is a hidden
trojan still on your machine hiding.
Click to expand...

Or a variation in their software. I've so far found at least 3
variations and yes I did scroll through all the areas. SAV CE 9.02,
Spybot, & Ad-Aware Pro all found no issues with trojan's or other
products.
 
Back
Top