Over 1 million tech questions and answers.

Cannot delete this malware leftover

Q: Cannot delete this malware leftover

So my dad was using the pc and installed malware by mistake. I ran malwarebyes and removed the malware but every time he signs into his account on startup this error pops up. I tried to find it's folder but couldn't see it so how can I remove it please?

RELEVANCY SCORE 200
Preferred Solution: Cannot delete this malware leftover

I recommend downloading and running Reimage. It's a computer repair tool that has been proven to identify and fix many Windows problems with a high level of success.

I've used it in the past to identify and fix everything from blue screens (BSOD's), ActiveX errors, corrupt files and processes, dll/exe/sys errors, recover lost memory, Windows update problems, defragging, malware removal etc.

You can download it direct from this link http://downloadreimage.com/download.php. (This link will automatically start a download of Reimage that you can save to your computer.)

A: Cannot delete this malware leftover

Originally Posted by Edward


So my dad was using the pc and installed malware by mistake. I ran malwarebyes and removed the malware but every time he signs into his account on startup this error pops up. I tried to find it's folder but couldn't see it so how can I remove it please?



Hi Edward.
Do you have Ccleaner installed on the computer?
If so, please navigate to the TOOLS selection on the left, then go across the tabs to SCHEDULED TASKS. Look in that window for the DLL call and highlight it, and select DISABLE. Reboot the computer.

Read other 3 answers
RELEVANCY SCORE 59.2

Hi ... I have uninstalled a software program through Add/Remove. The program did uninstall, HOWEVER, the name of the software remained in the Add/Remove list and is blank. I tried reinstalling the program and then uninstalling it again hoping it would fix the problem but it never. Now there are two name the same left in Add/Remove. The software was for a Canon camera & I have Windows XP. Hoping someone can help. Thanks
 

A:Delete leftover names in Add/Remove

To remove the invalid/orphaned entries from the Add/Remove applet manually [Windows 2000/XP]

1. Start Registry Editor (Regedit.exe).
2. Locate the following key in the registry:
3. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
4. Make sure you backup the keys by exporting them to a .reg file.
5. Look for the name of the program with the orphaned entry.
6. Delete the entire listing for the software with the orphaned entry.
7. Close the registry editor.
8. Restart your computer.
 

Read other 1 answers
RELEVANCY SCORE 59.2

I installed RT Seven Lite Software for making my own Windows 7 custom ISO. I loaded official Windows 7 ISO into RT Seven lite and started editing, But for some reason i stopped working on that. The problems is i uninstalled RT Seven Lite and i thought the windows files i was working on will be delete automatically but this didn't happened. Now i have left over windows 7 setup files that i can't delete. When i delete files it gives error '' You require permission from administrators to make changes to this file/folders''. But i am on administrative account.
And even if i try to change ownership of files/folders the options are not accessible. Only Trustedinstaller have full control on files. (My English is not good so please watch video to understand my problem)

Details - YouTube

I even tried to use Linux Fedora OS to delete those files but still failed. Those files took 32GB size on my HardDrive. I don't want to format my drive.Help please

A:Can not delete RT7lite's leftover files

Have you tried this one? Add "Take Ownership" to Explorer Right-Click Menu in Win 7 or Vista
99% of times that's all that's needed here to get rid of stuff. But a (very) few times had to manually add\edit owner in 'Advanced Security Settings', info here Permissions - Allow or Deny Users and Groups

btw, in case it's something very special to your program, try a ticket on RT Seven support?

Read other 3 answers
RELEVANCY SCORE 59.2

Hello,
As I using Windows long time and have uninstall and install many apps and the uninstalled apps left some registry entries, most of the entries is under HKEY_Current_User\Software and HKEY_Local_Machine and many keys name is same as the uninstalled apps, does it is safe to delete the entries?

A:Should I delete leftover registry entries

I sometimes encountered problems re-installing applications after normal uninstall and manual registry key deletions of same applications.

Could be because these keys can be associated with files which are still present in program files folder and other locations, so deleting these folders is what I would do. but still re-installation could be incomplete some times.

Read other 17 answers
RELEVANCY SCORE 59.2

I recently did a lossless re-install of Windows 7 on my machine, which placed my old data onto a folder called "Windows.Old", allowing me to totally restore everything. However, doing this generated a few folders that I can't seem to do anything with. I was able to remove most of them through the use of the Delete Invalid File application, but not even that is able to clear the last two folders:

My old Users folder, and my old ProgramData folder.

No matter what I do, these files are totally locked. I was able to move them to the desktop, but beyond that, they are being stubborn. Every time I try to delete them normally, I get the following message:



This is after I get a popup to allow administrative rights on the aforementioned folder. No matter what I do, this message will always pop up and bar me from deleting the folders.

Here's a list of all the things I've tried:

Changing file ownership.
Deleting individual files within the folders.
Disabling User Account Control notifications.
Fiddling with administrative details.
Deleting the folders through the use of Delete Invalid File.
Moving the folders to new locations.

None of these work. I can't remove the files at all. They're stuck, sitting on my desktop, taunting me as they use up my already tightly constrained HDD space.


How do I get rid of these pesky old files?

A:Impossible to delete leftover folders

Try Unlocker:
Download Unlocker 1.9.2 - FileHippo.com

edit: No need to use the Direct Download link on FileHippo's website. They abandoned that. Just use the green rectangle shown in the screenshot below.
Just be sure to uncheck the other junk it offers to install:

Once installed...
...right click on the folder of interest
...select Unlocker from the context menu
Deal with the User Account Control - if needed.

Once Unlocker opens...
If nothing is locking the folder(s)...
...select Delete from the drop down menu in the lower left part of the window
...then click on the button named OK.

If something is locking the folder(s)...
...select Delete from the drop down menu in the lower left part of the window
...then click on the button named Unlock All.

Be careful. Unlocker is powerful and dangerous. You might want to uninstall it after using it.

Read other 7 answers
RELEVANCY SCORE 58.4

I uninstalled BitDefender Internet Security 2010 last night, in favour for Microsoft Security Essentials. I used Revo to do this. The funny thing is though, the bdagent still runs in the background as per usual, and the all the program files and folders are still there, but I can't delete them. I can't change permissions either because "access is denied."

I can't use BitDefender's remove/repair function either because it doesn't recognise it as an installed program, and I can't reinstall the program for some reason either.

Any ideas?

A:Cannot delete leftover program folders/files

I also tried the "deleting undeletable files" method (in cmd prompt) but the prompt continually says it can't even find the directory.

Read other 4 answers
RELEVANCY SCORE 58

hi there,
after sometime i decided to check out my windows registry, so i typed regedit and went in. and to my dismay, i could find several folders(or are what are they?) of programs i uninstalled some long time ago. prominently appearing among them were visual studios that i had installed some time back but later uninstalled. they include the visual studio c++ 2010, visual studio 2012 Express edition. and some other programs also, and i noticed that these folders are huge and I'm wondering if they are not slowing down my PC. so my question is, how do i deal with them safely, i haven't touched them yet..

A:how to safely delete leftover registriy entries after uninstall?

Not unusual obby I have done this loads of times with bloatware Norton / Symantec being the real PITA one I just right click on the reg entry I find and click delete. This is quite handy when removing crap like the AVG add on stuff that you think is removed by uninstall but the reg bits linger.

But don't go on what I say playing in there can be quite dodgy unless you are sure of what you are deleting - I always open them out before deleting to make sure something else is not hiding in the sub entries. Click on the entry and it will open downwards like things do in C: drive and its folders.

Just be CAREFUL.

Read other 4 answers
RELEVANCY SCORE 56.8

Does anyone know of a program that will completely uninstall programs and also get rid of fragments of programs that were leftover by previous attempts at uninstalling programs, broken links, bogus registry files, etc? Thanks in advance.
 

A:Uninsaller with ability to delete orphan files, leftover bits of programs, etc.

I use Norton SystemWorks. It includes CleanSweep, Which monitors installs, and will completely remove anything it monitors. It wont clean programs already installed, Just the ones installed after installing CleanSweep. SystemWorks also includes Norton Utilities, Which has WinDoctor. WinDoctor will clean your registry, fix broken links, etc... SystemWorks also comes with Norton Anti-Virus. I have used SystemWorks since 98, and wouldnt use a PC without it
 

Read other 2 answers
RELEVANCY SCORE 56

Ok, finally got Smitfraud-C.Core Service and Virtumonde cleaned out. DriveCleaner2006 does not seem to want to go away now. Had some WinAntiSpyware as well. The only thing that seems to be hanging on at this point is the DriveCleaner. Here is the HijackThis log. Thanks for your help!Logfile of HijackThis v1.99.1Scan saved at 3:24:28 AM, on 7/26/2007Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v7.00 (7.00.6000.16473)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exec:\program files\safeandsecure\safeandsecure\app\CurtainsSysSvcNt.exeC:\Program Files\Common Files\Command Software\dvpapi.exeC:\WINDOWS\eHome\ehRecvr.exeC:\WINDOWS\eHome\ehSched.exeC:\Program Files\McAfee\Common Framework\FrameworkService.exeC:\Program Files\McAfee\VirusScan Enterprise\vstskmgr.exeC:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXEC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\dllhost.exeC:\WINDOWS\system32\ctfmon.exe... Read more

A:Leftover Stuff From Malware

Welcome to BleepingComputer, I am currently reviewing your log. Please note that this is under the supervision of an expert analyst, and I will be back with a fix for your problem as soon as possible.I recommend that you "track this topic" to be notified when a reply has been made. At the top if this thread choose Options > Track This Topic and then select Immediate Email Notification.RegardsPOADB.

Read other 14 answers
RELEVANCY SCORE 56

Last Thursday, I'm sure a file from WinMX while my AVG was off(that's a long story) caused a browser hijack. Anyway, I read though your and other forums and followed some of the suggestions given to others with similar ills. After a lot of trail and error I seem to no longer have browser hijacking ( i.e.. new window opening with "url.urtbk" in the address) but I'm not sure if all is well. There may still be leftovers. My browser still runs slower than normal and I fear a redirect is in my future. Here's my current HijackThis log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:56:51 PM, on 7/27/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16850)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
C:\WINDOWS\system32\imapi.exe
C:\Program Files\Softex\OmniPass\Omniserv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Softex\OmniPass\OPXPApp.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx... Read more

A:Malware leftover blues

I now have Java SE installed (files in my registry leftover fron Windows Cleanup Utility prevented installation)
 

Read other 1 answers
RELEVANCY SCORE 56

I have previously posted in this forum about my computer on this thread: http://www.bleepingcomputer.com/forums/t/239917/google-redirect/. The google redirection issue described there was resolved, but there are still a few symptoms that indicate the computer may not be completely fixed. I was working with Blade81 via private message but we were unable to solve these symptoms. They are:When I log into the "Steve" account, I see this error message:
RUNDLL
Error loading C:/DOCUME~1/Steve/protect.dll
The specified module could not be found.
(Note that the combofix in the previous thread was done to the Donna account)The antivirus program auto-update does not seem to be working. I can do a manual update, and I can see that automatic updates are enabled, but they do not seem to be executing.Uploading actions, such as sending an email or uploading pictures to Picasa, seem to take longer than they should.I have run DDS on the "Steve" account since it is the one that has the error message. Thanks in advance for any help you can provide.DDS (Ver_09-07-30.01) - NTFSx86 Run by Steve at 21:08:58.73 on Wed 09/02/2009Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_15Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2046.1679 [GMT -5:00]AV: AntiVir Desktop *On-access scanning enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}============== Running Processes ===============C:\WINDOWS\system32\svchost -k DcomLaunchsvchost.exeC:\WINDOWS\System32\svchost.exe -k ... Read more

A:Leftover Malware from a Previous Fix

Hello and welcome to Bleeping ComputerWe apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine. If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.Upon completing the steps below another staff member will review and take the steps necessary with you to get your machine back in working order clean and free of malware.If you have already posted a DDS log, please do so again, as your situation may have changed.Use the 'Add Reply' and add the new log to this thread.Thanks and again sorry for the delay.We need to see some information about what is happening in your machine. Please perform the following scan:Download DDS by sUBs from one of the following links. Save it to your desktop.DDS.scrDDS.pifDouble click on the DDS icon, allow it to run.A small box will open, with an explaination about the tool. No input is needed, the scan is running.Notepad will open with the results.Foll... Read more

Read other 9 answers
RELEVANCY SCORE 55.6

I've tried many times but they wont go away. I have a screenshot of the issue.

I've had a previous issue where I was losing disk space for no reason. I don't know if this had anything to with it, but I still have that issue even though I've tried everything. I've backed up my personal data so it's no big issue.

The issue right now is that I can't remove some of the malware that Hitmanpro had detected. I can't find them anywhere on the computer and CltMngSvc isn't even on the task manager.
 

Read other answers
RELEVANCY SCORE 55.6

I am getting the following error reportGeneric Host Process for Win32 Services has encountered a problem and needs to close.C:DOCUME~1MELOCALS~1TempWER5602.dir00svchost.exe.mdmpC:DOCUME~1MELOCALS~1TempWER5602.dir00appcompat.txtWhen I first realized I had a problem, AVG stopped working so I unistalled it and downloaded Spybot and ran that in Safe Mode. This seemed to repair some of the problem as it found many infected files. I reinstalled AVG. Ran that and it to found infections. I then had problems running certain things like disk defragmenter and task manager. Unistalled Spybot and installed Malwarebytes. This corrected almost everything. AVG is now telling me that my atapi.sys is infected and it can't do anything to it. Here is a list of what is in my AVG virus vault."Infection";"Trojan horse SHeur3.ARI";"C:Documents and SettingsMemvhasyvimk.exe";"";"2/28/2010, 3:23:08 PM""Infection";"Trojan horse BackDoor.Generic12.AMHS";"C:lsass.exe";"";"2/28/2010, 3:29:17 PM""Infection";"Trojan horse SHeur3.ATW";"C:WINDOWSTempiufg.tmpsvchost.exe";"";"3/1/2010, 4:41:17 AM""Infection";"Trojan horse FakeAV.SL";"C:WINDOWSsystem32sshnas21.dll";"";"3/2/2010, 5:32:06 AM""Infection";"Trojan horse FakeAV.SY";"C:WINDOWSsystem32_VOIDkdkxcqwpwc.dll";""... Read more

A:Have leftover problems from either a virus or malware

Thank you Pandy for getting me in the right forum. I am having trouble getting the rest of my reports to post.

Read other 12 answers
RELEVANCY SCORE 54.8

So whenever i use Rkill it detects a bunch of malware domains on the HOSTS file after sometime that are (probably) leftovers from the last time my computer got infected but i also get sometime while visit new websites that CloudFlare is establishing a secure connetction or something (i dont remember because it happened long ago and i didnt pay attention to it because it got me to the site i wanted to go to with no problems but i lost my trust in things of such nature from cloudflare since last time.
The whole file ( i cant post attachments here )
 
Rkill 2.8.3 by Lawrence Abrams (Grinler)
http://www.bleepingcomputer.com/
Copyright 2008-2016 BleepingComputer.com
More Information about Rkill can be found at this link:
 http://www.bleepingcomputer.com/forums/topic308364.html
 
Program started at: 08/22/2016 04:09:22 AM in x86 mode.
Windows Version: Windows 7 Professional Service Pack 1
 
Checking for Windows services to stop:
 
 * No malware services found to stop.
 
Checking for processes to terminate:
 
 * No malware processes found to kill.
 
Checking Registry for malware related settings:
 
 * No issues found in the Registry.
 
Resetting .EXE, .COM, & .BAT associations in the Windows Registry.
 
Performing miscellaneous checks:
 
 * No issues found.
 
Checking Windows Service Integrity: 
 
 * Windows Defender (WinDefend) is not Running.
   Startup Type set to: Di... Read more

A:Leftover malware domains in the HOSTS file

Reset the Hosts file back to the default?

Read other 4 answers
RELEVANCY SCORE 54.8

I got infected with the subject malware and managed to remove enough of the pieces that my Dell is operational again (Windows XP Home SP2). However, I still have two problems I haven't been able to eliminate. One, just to the right of the time in my toolbar, I keep seeing the msg "VIRUS ALERT!" and it also appears in various other places. The larger issue though, is that although I have 3 hard drives (C, D and F), since the malware problem, the only hard drive that "My Computer" shows is F. Using Acronis partition software, that software sees the other drives and all the files are still there. Although I've lost some desktop icons that used to be there, if I go into All Programs and tell the system to start a program that resides on one of the "unseen by Windows" drives, the program starts up and runs just fine.

How do I restore the ability of My Computer to show me all the installed drives (I'm guessing it's some trick in the registry). Thanks for any assistance.

Ted

A:Antivirus 2008 Malware Leftover Issue

Download and install TweakUI (the download is on the right hand side of the screen). Run TweakUI and then click on My Computer > Drives and place a check next to the drives you want to unhide.

Read other 2 answers
RELEVANCY SCORE 54.4

After I followed some instructions to remove the system diagnosis malware, some others remained and I don't know how to remove them.
I followed the instructions on pasting the DDS log, but had a problem with gmer.exe. When I opened gmer.exe, I was only allowed to check some of the settings, I can only check services, registry, files and ADS.

DDS (Ver_2011-08-26.01) - NTFSAMD64
Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 10.3.1
Run by Yongbin at 17:58:05 on 2012-09-14
Microsoft Windows 7 Home Premium 6.1.7601.1.936.86.1033.18.3835.2614 [GMT -7:00]
.
AV: 360杀毒 *Disabled/Updated* {A0FD413B-F662-C08C-7B21-F57CED225A55}
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Program Files\IDT\WDM\STacSV64.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\atieclxx.exe
C:\Program Files (x86)\360\360Safe\deepscan\Zh... Read more

A:Malware removal leftover (google redirect and sound ads)

I forgot to mention, there are some chinese programs in that DDS list. I looked over it and the programs with Chinese characters are virus scan, firewall protection, Chinese character input, and video player.

Read other 46 answers
RELEVANCY SCORE 44

I've been seeing here that Emsisoft Anti-Malware is free for 30 days, after 30 days of use will be able to scan and remove malware that it finds?
I do not want to use it with real-time protection, I have ESET for it, I use it as I use Malwarebytes Anti-Malware Free, only for weekly scans!
Thank you
#Translator
 

A:Emsisoft Anti-Malware Free'll be able to scan and delete the malware?

Download emsisoft emergency kit

Emsisoft Free Emergency Kit: Portable malware scanner | Free removal of Viruses, Bots, Spyware, Keyloggers and Trojans

it's scanner without real time, full free
 

Read other 3 answers
RELEVANCY SCORE 39.6

hey guys. I have peerguardian 2 and everytime i start my computer someone called offeroptimizer.com/static.callinghome.biz[spy], st. also i was looking with spysweeper at my items that startup with windows and i noticed there is something called ShowWnd.exe and i googeld it and some things said it was malicious and some said it was not. Maybe you could help me out. Heres my Hijackthis log. Thanks.Logfile of HijackThis v1.99.1Scan saved at 4:20:18 PM, on 5/25/2005Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\csrss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\Common Files\Symantec Shared\ccProxy.exeC:\WINDOWS\system32\Ati2evxx.exeC:\Program Files\Common Files\Symantec Shared\ccSetMgr.exeC:\WINDOWS\Explorer.EXEC:\Program Files\Norton Internet Security\ISSVC.exeC:\Program Files\Common Files\Symantec Shared\SNDSrvc.exeC:\Program Files\Common Files&#... Read more

A:HJT-Leftover

Welcome leftover to Bleeping Computer.*Restart the computer.*as soon as BIOS is loaded begin tapping the F8 key until the Advanced Options menu appears.*Use the arrow keys to select the Safe mode menu item*press Enter.***We need to make sure all hidden files are showing so please:* Click Start. * Open My Computer. * Select the Tools menu and click Folder Options. * Select the View Tab. * Under the Hidden files and folders heading select Show hidden files and folders. * Uncheck the Hide protected operating system files (recommended) option. * Click Yes to confirm. * Click OK.***Close all programs leaving only HijackThis running. Place a check against each of the following, making sure you get them all and not any others by mistake:O4 - HKLM\..\Run: [ShowWnd] ShowWnd.exeClick on Fix Checked when finished and exit HijackThis.***Open Windows Explorer.Find and delete this file:C:\Windows\System32\ShowWnd.exe***Reboot the computer to normal mode.Please post back in this topic with a fresh log using HijackThis.

Read other 16 answers
RELEVANCY SCORE 39.2

Hi I need help getting rid of some trojan/malware remains. Malwarebytes and tdsskiller don't find anything but I am still getting internet explorer redirects, windows firewall turned off & will not turn on and need help because it looks like I may have a rootkit hiding somewhere. I have included my dds files. Also avast is showing alot of "malicious URL blocked" messages and the process is C:\Windows\System32\ping.exe. I have ESAT, MBAM, SAS & HiJackThis logs. I have combofix, aswMBR & minitoolbox dl'd & ready to run but don't want to use them without your direction. I have windows 7 32 Thanks!

A:Win7Antispyware leftover fix

Update......running eset fixed the redirects but I wonder if I still have the rootkit. Eset said I had a variant of the Win32/Sirefef.DN trojan.

Read other 19 answers
RELEVANCY SCORE 39.2

HI, i removed a security program,and i now find that i have leftover files, i went into task manager found file location, but when i try to delete them, a popup say's i need permission. i am the only user on the pc and also administrater how do i obtain permision or is the another way to delete. i have vista premium 32-bit...thanks

A:Get rid of leftover files

Hi patch41, Take ownership of that file and then delete it.

Read other 5 answers
RELEVANCY SCORE 39.2

After finally getting the Windows 10 Anniversary Update to install, as expected, I had a WIndows.0ld file. Following instructions posted here and elsewhere, I used Disc Cleanup to remove most of that file.

There are still two folders remaining in Windows.old from System32, one in Drivers (IntcDaud.sys) and one in DriverStore (intcdaud.info.amd64xxxxx.) When I go directly to System32, both drivers appear in the same folders where they show in Wndows.old. Disc Cleanup no longer even recognizes Windows.old, so I cannot run it again to remove what appear to me to be extraneous entries.

Can I safely use Unlocker to try to remove the remaining Windows.old file, which likely would only work after a reboot? If not, is there some other method, short of using the Jaws of Life or a ten-pound sledge hammer to remove the leftover Windows.old file?

A:Windows.old leftover

Hello Not Myself,

Unlocker should work for you. If you like, OPTION THREE below should work as well.

Windows.old Folder - Delete in Windows 10

Read other answers
RELEVANCY SCORE 39.2

I got some kind of malware last week. I kept getting tons of pop-ups, which never bothered me before, and other things. One of those fake anti-spyware sites that took over my computer till I shut it down, etc.

So in the past week I have done the following:

I ran Stinger, Ad-Aware, Malicious Removal Tool, CC Cleaner, Housecall, HS Remove, cwshredder, Kill2Me, all of which found nothing, and did a System Restore which had no effect..

Then I ran Malwarebytes and Stopzilla both of which found some Trojans, Malwares, Ad cookies etc and deleted them. (No worms that I could see.)

Since then I still have the following problems:

When I load Firefox - before the page loads in the upper left hand corner I get the following box:

"Java Application Type Error: spElement is null." (A search of "spElement is null" on Google turns up nothing.)

When I click OK, the message box disappears and Firefox loads. Sometimes a few different pages load, Ask.Com, My * 10.Com, etc. A couple pages sometime try to load but there is a message box that says the locations couldn't be found. I click off those pages, I seem to be able to use Firefox without any further problems.

If I try and load Internet Explorer, a bunch pf pages try to load, all with the same internet address with numbers, letters, and symbols that I have never seen before (not a foreign language, but symbols which aren't on my keyboard, letters, etc) Luckily for each page that tries to loa... Read more

A:A few leftover's that I can't seem to shake??

I would do the following.....Use Rkill to stop the rootkit processes that start when the computer comes on. Then I run the Malwarebytes and SUPERAntiSpyware. Here are some DL links for the Rkill....LINK 1LINK 2LINK 3LINK 4Save it to your desktop and then double click to launch it (With Vista you need to right click and select run as administrator). You should see a little black window open and then close. If you see that box then it worked. If you don't see the black box then delete the file and use another download link and repeat the steps.After running Rkill update and run MBAM. Next I would install AFT Cleaner check the box for select all and then run it. Finally, I would run SUPERAntiSpyware. If you have more than one username then you will need to scan each user account seperately with this.

Read other 1 answers
RELEVANCY SCORE 39.2

thank you for helping me,

Here is where we were working on Internet Explorer issues before I was told there was leftover malware items> http://forums.techguy.org/windows-xp/949714-internet-explorer-problem.html#post7597460

i ran the uninstaller then did the hijack this scan again.
i didn't see the two items you said i should check mark on the list.. so i looked back at the first log and they are listed, but now after the uninstall they are gone. because im not sure what to do, i didn't do the Norton uninstaller part yet.. this it the latest file after the uninstall.

i also noticed that when i would open any file the Search Settings v1.2.3 tried to open every time, and i had to hit the cancel button several times to close it. now that I've done the uninstall, it no longer does this. im guessing they are related somehow and i hope that this new information doesn't come too late..
thank you again for your help.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:40:46, on 9/13/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.17080)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\... Read more

A:Leftover infection

Search Settings seems to be gone alright.

As for Norton, it should be removed since you should never run more than one antivirus software at the time. They will work one against the other (Avira and Norton), cause your system to be slow and even freeze. Your computer will be even more vulnerable.

Your log is showing traces of past or present infection. After we're done here, we'll need to get you transfered to the Virus & Other Malware Removal forum.
 

Read other 1 answers
RELEVANCY SCORE 39.2

Can anyone tell me if there is such a progamme that can detect leftover programmes on the pc. By that I mean, when you have installed a programme and then decide you don't want it, you delete it from the add/remove control but it always seems to leave some file behind.

Is there anything that would clean all those files up? Hope I am making sense.

Thanks
 

A:Leftover files?

Read other 14 answers
RELEVANCY SCORE 39.2

Hey everyone!
Yesterday, I found (again) a malware on my computer. Actually, I have already deleted it at least 3 times, and every time I restarted my CPU, I checked if it's gone or not, but It usually disappeared. Every time, after a few days when I checked my computer, I only found that one.
I would be really thankful if anyone could help me

Read other answers
RELEVANCY SCORE 39.2

Hi there - this is my first post, I decided to join this forum after I saw this thread. First of all - thank you! I picked up this virus/trojan (not a tecchie so not quite sure what it is) on the weekend and have spent the past few days trying to figure out what it is. When I first got it, my Norton antivirus scan and my Adaware scans couldn't detect it. It was only the pop-up which alerted me to the fact that I had some virus on my computer. Luckily, through reading these forums I did discover Malwarebytes Anti-Malware software and even though initially it also couldn't find it, it did pick up something yesterday after new updates. I haven't seen the pop-up since, but I am still worried that there is still a trojan sitting on my computer. I did find the mermen.exe file and delete it manually, but am not sure what else I can do. All my scans are coming up clean, I can't detect any strange activity any more, but I'm a bit sceptical since all my scans were telling me the computer was clean, even when Explorer and Firefox were freezing up and the popup was appearing. Does anyone know what this is yet? And is it actually a keylogger trojan or was that just the message the virus displayed? I have been too scared to do internet banking since I discovered this problem.

Thanks in advance for all your help. This forum has really been useful, especially since I am not a tecchie person at all. And finding someone else who had found this merman.exe f... Read more

A:Malware I cannot delete

Hi there -

I couldnt find any more of the .exe files listed above and I assumed that my computer was clean. Tonight, however, when trying to update my Symantec Antivirus I got the following error message:

LU1806: LiveUpdate was not able to install any of the 1 updates that you selected. For more information please click the "+" sign next to the update(s) that did not install. All available updates were selected.

It is telling me that it couldn't download or read the virus definition file in "Avenge MicroDefs25 SavCorp10 ".

I'm not sure if this is just a glitch with Norton or if it is another symptom of the virus. Has anyone else experienced this problem? Any advice on what I should do?

Sevan - are you still getting obvious symptoms of a virus infection or does everything appear to be normal?

Read other 1 answers
RELEVANCY SCORE 39.2

I have Malwarebytes Anti-Malware Premium installed on Windows 7. For the past week in my daily scans I am getting message that (4)malware has been detected. The only way I know what malware has been found is to read the scan log which I have attached. They are all of the pup variety. I get no pop up warnings that pup is trying to "invade". There is nothing placed in the vault for me to delete, in fact nothing is posted in history at all except for the scan and protection logs.
I was getting a pop up notifiying me of some Microsoft thing was attempting and I blocked the site, (don't know what the site was). These 4 pup items are probably the same ones being detected daily, but I don't know how to delete them.
 

Read other answers
RELEVANCY SCORE 39.2

Heres my log file

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
O2 - BHO: (no name) - {a4d98ade-1179-440e-8cad-d52281c68e6c} - C:\WINDOWS\system32\takewoke.dll (file missing)
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
O4 - HKLM\..\Run: [XboxStat] "C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe" silentrun
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [lejehipahe] Rundll32.exe "C:\WINDOWS\system32\tijoravi.dll",s
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 -... Read more

Read other answers
RELEVANCY SCORE 39.2

mWinlogon: Userinit = c:\windows\system32\userinit.exe,,c:\program files\iuavidfb\qbrisdor.exeStartupFolder: c:\documents and settings\krishna\start menu\programs\startup\qbrisdor.exe
 
this malware detected by dds suggest by  argus1 sir .... According to his advice  i am posting here how to delete this malware with key value ... please me 
 
 

A:how to delete malware

Hello krishna_dasI would like to welcome you to the Malware Removal section of the forum.Around here they call me Gringo and I will be glad to help you with your malware problems.Very Important --> Please read this post completely, I have spent my time to put together somethings for you to keep in mind while I am helping you to make things go easier, faster and smoother for both of us!Please do not run any tools unless instructed to do so.We ask you to run different tools in a specific order to ensure the malware is completely removed from your machine, and running any additional tools may detect false positives, interfere with our tools, or cause unforeseen damage or system instability.Please do not attach logs or use code boxes, just copy and paste the text.Due to the high volume of logs we receive it helps to receive everything in the same format, and code boxes make the logs very difficult to read. Also, attachments require us to download and open the reports when it is easier to just read the reports in your post.Please read every post completely before doing anything.Pay special attention to the NOTE: lines, these entries identify an individual issue or important step in the cleanup process.Please provide feedback about your experience as we go.A short statement describing how the computer is working helps us understand where to go next, for example: I am still getting redirected, the computer is running normally, etc. Please do not describe the computer as "the same... Read more

Read other 30 answers
RELEVANCY SCORE 39.2

I cant delete the trojan from my dvd drive mawarebytes detected it and deleted it but its still not deleted from my system i was mannualy uninstalling and it said cannot remove file running on system what do i do and it slows my pc down  the file name is serial_virus_bursters_6.3virusbursters-6.3_virusbursters_6.3_virusbursters_6.3.iso and 
serial_number_virus_bursters_6.3virusbursters_6.3_virusbusters_6.3.exe
 (ssry 4 my english)     

A:i cant delete the malware

Hello saim12 and welcome to Bleeping Computer!Lets see if we can remove it with this. Can you post your last Malwarebytes log here? If you don't know how use these instructions:Open MalwarebytesClick on the History tab > Application Logs.Double click on the scan log which shows the Date and time of the scan just performed.Click 'Copy to Clipboard'Paste the contents of the clipboard into your reply. ESET Online ScannerClick here to download the installer for ESET Online Scanner and save it to your Desktop.Disable all your antivirus and antimalware software - see how to do that here.Right click on esetsmartinstaller_enu.exe and select Run as Administrator.Place a checkmark in YES, I accept the Terms of Use, then click Start. Wait for ESET Online Scanner to load its components.Select Enable detection of potentially unwanted applications.Click Advanced Settings, then place a checkmark in the following:Remove found threatsScan archivesScan for potentially unsafe applicationsEnable Anti-Stealth technologyClick Start to begin scanning.ESET Online Scanner will start downloading signatures and scan. Please be patient, as this scan can take quite some time.When the scan is done, click List threats (only available if ESET Online Scanner found something).Click Export, then save the file to your desktop.Click Back, then Finish to exit ESET Online Scanner.Post the log from your desktop in your next reply.

Read other 4 answers
RELEVANCY SCORE 39.2

I scanned my computer with Ad-ware and have some Malware
in the quarantine that I am not sure if I should delete it or not.
these are the names of them-
Win32toolbar.alexa it says i have 33
Win32TrojanAgent- says there is 1

under action it says do nothing, but there is an option to delete.
is it safe to delete?
thank you,
karebear
 

Read other answers
RELEVANCY SCORE 39.2

I am new to this site. I was directed here to utilize the latest SmitFraud scan by my son-in-law last night. We were hopeful it would clear a recurring "brower warning" that pops up and blocks my MSN homepage. I also ran several SpyBot scans and it appears there are many "anti-viral" programs present that are probably just the opposite. I am worried that this malware is replicating itself every time I log in to my MSN homepage to see if it is gone. I am needing help to know what to do next. I did just copy to my desktop the latest report from SmitFraud but is sounds like this is not the area to post that.

A:Can't Delete Malware

What does the browser warning pop up say?Did you follow the generic instructions for using SmitfraudFix in BC's self-help tutorial "How to remove the Smitfraud/Generic Zlob"?(scroll down to where it says Removal Instructions)If so and that has not resolved the problem, download RogueRemover and save to you Desktop. (This program is for Win XP, 2000, NT only)Double-click on rr-free-setup.exe to install in C:\Program Files\RogueRemover.During the installation an icon will automatically be created on your Desktop.Double-click on the RogueRemover icon to launch the program and select Check for Updates.If prompted, click Download to receive the latest updates. When completed, close the update window.Select "Scan" and the program will walk you through the remaining steps.Then download and scan with SUPERAntiSpyware FreeDouble-click SUPERAntiSpyware.exe and use the default settings for installation.An icon will be created on your desktop. Double-click that icon to launch the program.If asked to update the program definitions, click "Yes". If not, update the definitions before scanning by selecting "Check for Updates". (If you encounter any problems while downloading the updates, manually download them from here and unzip into the program's folder.)Reboot in "SAFE MODE using the F8 method and launch SUPERAntispyware.In the main screen, under "Scan for Harmful Software" click Scan your computer.There are three scanning options. Choose "Perform Complete Scan" and click "Next".After the... Read more

Read other 1 answers
RELEVANCY SCORE 39.2

Dear all

my infection is very similar to another one I read about last week. Infection was first noticed when McAfee would pop up in the system tray that it had detected and removed Trojans "Downloader-BEA" and "Downloader-BFC." At the same time, started getting IE popups for seemingly random sites.

-Ran AdAware 2007 in Safe Mode and it didn't find anything troubling (just the normal cookies).
- I ran spyware doctor which did delete some spyware after which McAfee stopped alerting the above masseges.

-Then, in both Safe Mode and normal mode, I'm getting a yellow, flashing triangle with an exclamation point in the system tray. It seems to rotate messages noting (in bad grammatical form) a variety of system alerts and "warnings" that I've been infected with things called "cyber-log" and others... I also get a desktop popup saying we're infected. Both the desktop popup and system tray popups want me to go download something

-Also, desktop shortcuts have been automatically created titled "Online Security Guide" and "Live Safety Center." They both target htepo.com.

- My explorer would slow down and eventually the system will get stuck.

- my restart takes forever, and sometimes will not finish at all.

-I tried combofix and smitfraudfix in both regular and safe mode and nothing.

I ran HJT and the log is pasted below. Any assistance will be much appreciated... thank you in advance!

Logfile of Hi... Read more

Read other answers
RELEVANCY SCORE 38.8

So I contracted Smitfraud-c, as named by Spybot, and like everyone else I couldn't get it off. My computer was just going nuts; adding desktop icons, opening my browser, countless prompts ostensibly notifying me of spyware removal tools, and actually running these fake programs. I tried a few smitfraud cleaners and other recommendations to no avail.
Finally I tried using HJT to "delete a file on reboot.." and deleted the dll associated with smitfraud-c. I think I determined the dll file with the SpybotSD recovery listings following a scan, or something like that. Anyway, after I did this SpybotSD was actually able to delete the Smitfraud-c object. After numerous scans with all of my clean-up tools, they are no longer picking up any more malware.
I was happy about this, however things still arent completely right: Boot-ups take a long time (malware is starting up and initiating its hijack, I think), my home page keeps changing, and I'm pretty sure I'm seeing browser hijacker entries in my HJT log.
Security and cleanup tools that I use: SpybotSD, AdawareSE, Spyware blaster, AVG, windows firewall, CCleaner, RegCleaner, Windows disk cleaner and every now and then I'll run rootkit scanners. Here's my HJT log:

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.e... Read more

A:smitfraud-c, leftover stuff

Read other 12 answers
RELEVANCY SCORE 38.8

My old EIDE WD Caviar200AA is in a box.It was in a Compaq p.o.s.that died,last march.
My new" no-name" is running NTFS. and has 80 Gb Hdd.
How much hassle to add additional" slave" drive to new machine?
what are the snafu's out there? How do I start?
btw I'm new at this

Is the ole' 5600rpm drive seemingly tons slower than my 7200 in practice?

Can any of the fat32 stuff be left on that 20Gb or does it all have to be wiped?
 

A:should I install a leftover second- harddrive,20G

Read other 8 answers
RELEVANCY SCORE 38.8

I am trying to clear out the last remnants of 2 spyware infections, spysherriff.exe and ibm0001.exe. I have gotten just about everything cleared out, but i still have a few items on my hijackthis log that i can not get rid of at all. I am not sure if this is related or not, but my internet just stops working after 20 minutes after i reboot. Called the ISP, they said my connection is okay, i can ping out, but i can not get a connection to anything, IE and firefox open as nothing, no page.this is the one entry that i can not get rid of.O20 - Winlogon Notify: avpe32 - C:\WINDOWS\SYSTEM32\avpe32.dllI have ran, Ewido, adaware, AVG, Spybot - Search & Destroy, kaspersky (which for some reason i can no longer get too). I run WIN XP's firewall, but i can not get to the settings, gives me an error saying "Due to an unidentified problem, Windows cannot display Windows Firewall Settings".Any help would be gladly appreciated, Thanks in advance.Logfile of HijackThis v1.99.1Scan saved at 6:20:24 PM, on 1/14/2006Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\csrss.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\System32�... Read more

A:Hijackthis Log: Last Remnants Leftover

Hi,

Sorry for this delay. Post please a fresh hijackthis log if you still have problems.

Read other 5 answers
RELEVANCY SCORE 38.8

I had a trial program loaded, the program was past the trial period and I forgot to uninstall it. When I did uninstall the program I thought all traces of it where gone. That was about a couple of months ago.
I decided that I would like to use it the program and tried to download it. The program started to download, but never finished the download. Got a message that "old version" needed to be removed.
I've done a search for the program, couldn't find any trace of the program. Went into regedit>software..found something I'm not sure if its the program or not. The program in question FakeWebCam...found in regedit>software "fwc" with 9 keys with values. The initials match the program's name.
Should I delete that folder from regedit?
 

A:Solved: Leftover Program

I just installed it into a virtual machine and it created the fwc key with 9 values so that's probably the one to delete. Always a good idea to export a copy first just in case.

HTH

Jerry
 

Read other 3 answers
RELEVANCY SCORE 38.8

There's been a lot of trojans/malware on this pc in the past and although I've usually managed to eliminate most of the threats, I'm pretty sure there are still some leftover bits and pieces, so I figured I'd try posting this log to see if anyone could help me clean it up a bit, as it's not my computer, obviously I don't want to go messing about in the registry by myself. Take your time, no rush ;)Logfile of Trend Micro HijackThis v2.0.4Scan saved at 03:36:58, on 27/07/2011Platform: Windows XP SP3 (WinNT 5.01.2600)MSIE: Internet Explorer v8.00 (8.00.6001.18702)Boot mode: NormalRunning processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\Ati2evxx.exeC:\Program Files\AVG\AVG9\avgchsvx.exeC:\Program Files\AVG\AVG9\avgrsx.exeC:\WINDOWS\system32\spoolsv.exeC:\Program Files\AVG\AVG9\avgcsrvx.exeC:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exeC:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDevice... Read more

A:Hijack This / Looking For Leftover Narsties

Hi,Please do the following:Please download DDS from either of these linksLINK 1 LINK 2and save it to your desktop.Disable any script blocking protection Double click dds to run the tool. When done, two DDS.txt's will open. Save both reports to your desktop.---------------------------------------------------Please include the contents of the following in your next reply:DDS.txtAttach.txt. NEXTPlease download aswMBR ( 511KB ) to your desktop.Double click the aswMBR.exe icon to run itClick the Scan button to start the scanOn completion of the scan, click the save log button, save it to your desktop and post it in your next reply.

Read other 18 answers
RELEVANCY SCORE 38.8

This is not a big deal, but after cleaning up a mildly infected computer with Malwarebytes Professional, AdwCleaner and HitmanPro, I find I still have a running process for SearchProtect when I checked in Task Manager for anything else.  It is not showing it's using a lot of resources, but it is there.  The entry is located in the System 32 file.  I hesitate to remove anything from that file... Should I leave well enough alone or delete it?  Thanks!Edit: Topic moved from General Security to the more appropriate forum. ~ AnimalEdit: Topic moved from Am I Infected forum to the more appropriate forum. At the request of Malware Removal team member. ~ Animal

A:Leftover Conduit Entry

Hi & to Bleeping Computer Forums!My name is Jürgen and I will be assisting you with your Malware related problems.Before we move on, please read the following points carefully: My native language isn't English. So please do not use slang or idioms. It could be hard for me to read. Thanks for your understanding.Please read my instructions completely. If there is anything that you do not understand kindly ask before proceeding.Perform everything in the correct order. Sometimes one step requires the previous one.If you have any problems while you are follow my instructions, Stop there and tell me the exact nature of your problem.Do not run any other scans without instruction or Add/ Remove Software unless I tell you to do so. This would change the output of our tools and could be confusing for me.Post all Logfiles as a reply rather than as an attachment unless I specifically ask you. If you can not post all logfiles in one reply, feel free to use more posts.If I don't hear from you within 5 days from this initial or any subsequent post, then this thread will be closed.If I don't reply within 24 hours please PM me!Stay with me. I will give you some advice about prevention after the cleanup process. Absence of symptoms does not always mean the computer is clean.Step 1Please run a FRST scan. This will help us diagnose your problem.Please download Farbar Recovery Scan Tool and save it to your Desktop.(If you are not sure which version (32-/64-bit) applies to your system, d... Read more

Read other 14 answers
RELEVANCY SCORE 38.8

Logfile of Trend Micro HijackThis v2.0.2Scan saved at 3:20:52 PM, on 4/24/2010Platform: Windows XP SP3 (WinNT 5.01.2600)MSIE: Internet Explorer v8.00 (8.00.6001.18702)Boot mode: NormalRunning processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Alwil Software\Avast4\aswUpdSv.exeC:\Program Files\Alwil Software\Avast4\ashServ.exeC:\WINDOWS\Explorer.EXEC:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exeC:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exeC:\Program Files\Real\RealPlayer\RealPlay.exeC:\WINDOWS\system32\ezSP_Px.exeC:\Program Files\Verizon\McciTrayApp.exeC:\Program Files\ATT-SST\McciTrayApp.exeC:\WINDOWS\system32\spoolsv.exeC:\Program Files\Common Files\Motive\McciCMService.exeC:\WINDOWS\System32\nvsvc32.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Viewpoint\Common\ViewpointService.exeC:\WINDOWS\wanmpsvc.exeC:\Program Files\Linksys\WUSB54GSC\WLService.exeC:\Program Files\Linksys\WUSB54GSC\WUSB54GSC.exeC:\WINDOWS\system... Read more

A:HJthis log - still have viruses leftover?

Hello and welcome to Bleeping ComputerWe apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine. If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.Upon completing the steps below I will review and take the steps necessary with you to get your machine back in working order clean and free of malware.If you have already posted a DDS log, please do so again, as your situation may have changed.Use the 'Add Reply' and add the new log to this thread.Thanks and again sorry for the delay.We need to see some information about what is happening in your machine. Please perform the following scan:Download DDS by sUBs from one of the following links. Save it to your desktop.DDS.scrDDS.pifDouble click on the DDS icon, allow it to run.A small box will open, with an explaination about the tool. No input is needed, the scan is running.Notepad will open with the results.Follow the instructions... Read more

Read other 2 answers
RELEVANCY SCORE 38.8

Need some help with this log please, guys. I have broadband but the last day or so the connection was extremely slow and sluggish. I then ran a Spybot search and came up with the wwwcoolsearch.leftover virus. I deleted it from Spybot but the system remained slow - sometimes taking 5 minutes or so to load a page. I then performed a system restore to three days ago and so far that seems to have solved the problem - speed of the broadband connection seems to be much faster now. I just want to make sure there's nothing in my HJT log that should warrant further investigation. If it's of any interest, on Monday I upgraded from ME to XP.



Logfile of HijackThis v1.99.1
Scan saved at 00:07:13, on 31/03/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\devldr32.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBVE.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcal... Read more

A:wwwcoolsearch.leftover Hijack log

OK, seems I typed too soon. System is back to slow this AM. HELP!

Read other 2 answers
RELEVANCY SCORE 38.8

I had been using WMP 6.4. Decided to try Version 7. Uninstalled and checked out Version 9. Wish I hadn't done either. I don't care for the extra features they added and should have just stayed with 6.4.

After searching, I've learned that those newer versions added lots of registry entry's that do not get removed with Add/Remove Programs.

When I run Spybot S&D, I still see entry's about Media Player and SDK. I have Win98SE, use Norton Windoctor and JV16 Powertools.

Is there a tool or guide to remove leftover WMP registry entries before putting 6.4 back on? I had deleted 6.4 from Explorer and ran the above before installing the other versions. I also have the Alternative versions, but need WMP for streaming.
 

A:Remove leftover WMP reg entries

Read other 8 answers
RELEVANCY SCORE 38.8

Hello

I am trying to help my friend again with her PC. I removed Adware and Kazaa a few months ago but someone installed Kazaa again so now I have to clean it up again. She promised her first born if it happens again.

I have installed the latest Windows security updates, cwshredder and Spybot but the browser is still not 100%. It is usable but there 4-5 ads when you launch. Here is her Hijack this file

Logfile of HijackThis v1.97.7
Scan saved at 7:00:14 AM, on 6/4/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LMPDPSRV.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\WINDOWS\System32\P2P Networking\P2P Networking.exe
C:\Program Files\Common files\updmgr\updmgr.exe
C:\Program Files\Altnet\Points Manager\Points Manager.exe
C:\WINDOWS\System32\mwvzapst.exe
C:\Program Files\Internet Optimizer\optimize.exe
C:\Program Files\ISTsvc\istsvc.exe
C:\WINDOWS\dhbrwsr.exe
C:\WINDOWS\odrbvzkha.exe
C:\documents and settings\user\local settin... Read more

A:Leftover Kazaa problems

Read other 11 answers
RELEVANCY SCORE 38.8

I used the Windows Police removal procedure as shown and successfully removed the program. THANKS - got my computer back! However, every time I start up my computer or a program now I get the following window notification "name of exec file - BAD IMAGE. Then it states that "globalroot\systemroot\system32\gasfkybospyfqm.dll" is not a valid Windows image. Please check it against your installation disk." I can click on OK and everything works but it comes up everytime something loads. Any information on getting rid of this screen would be appreciated. Also - all my RESTORE points have gone, I can't even get back into yesterday or last month. RESTORE is set to work so????

A:Windows Police leftover help please

Moved from HJT to a more appropriate forum. Tw

Read other 7 answers
RELEVANCY SCORE 38.8

I downloaded a bad file on accident and got inundated with trojans and all kinds of other garbage. So I ran a full MBAM scan and cleaned it all out, mostly. When I open up my browser (Firefox) This is what I see on the top of my browserI also randomly get a page that says "CONNECTION RESET BY REMOTE SERVER. something about reasons for errors, then a link that says RUN THE COMPLETE SCAN." Obviously it's a ruse and I just hit refresh and it goes away. Any help is appreciated

A:I need some help cleaning up some leftover spyware. . .

Hello please run these as instructed and post back 2 logs. If you have SpyBot running please disable it for these.From your regular user account..Download Attribune's ATF Cleaner and then SUPERAntiSpyware , Free Home Version. Save both to desktop ..DO NOT run yet.Open SUPER from icon and install and Update itUnder Scanner Options make sure the following are checked (leave all others unchecked):Close browsers before scanning.Scan for tracking cookies.Terminate memory threats before quarantining.Click the "Close" button to leave the control center screen and exit the program. DO NOT run yet.Now reboot into Safe Mode: How to enter safe mode(XP)Using the F8 MethodRestart your computer. When the machine first starts again it will generally list some equipment that is installed in your machine, amount of memory, hard drives installed etc. At this point you should gently tap the F8 key repeatedly until you are presented with a Windows XP Advanced Options menu. Select the option for Safe Mode using the arrow keys. Then press enter on your keyboard to boot into Safe Mode. Double-click ATF-Cleaner.exe to run the program.Under Main "Select Files to Delete" choose: Select All.Click the Empty Selected button.If you use Firefox or Opera browser click that browser at the top and choose: Select AllClick the Empty Selected button.If you would like to keep your saved passwords, please click No at the prompt.Click Exit on the Main menu to close the program.NOW Scan with... Read more

Read other 5 answers
RELEVANCY SCORE 38.8

I am reparing a machine for a friend. After installing and updating Mcafee, I found and removed multiple viruses. However, the desktop still has a long message on a black background that reads: WARNING You Are In Danger All that you ever do on your computer...... Can anyone tell me how to get this off the Desktop? Thanks.
 

A:Desktop Virus Leftover

http://www.processlibrary.com/processscan/ this may help once you reach desktop,however i would run all the anti spy you have make sure you have spybot,adaware etc,download iobit v2 free install run then go to tools start up and look through the registry entries which are starting with windows,also microsoft malicious removal tool may be usefull
http://www.iobit.com/AdvancedWindowsCarePersonal/download.htm
http://www.microsoft.com/security/malwareremove/default.mspx
 

Read other 1 answers