Over 1 million tech questions and answers.

Removing leftover system files

Q: Removing leftover system files

Hi, i'm trying to understand what these folders are for, they are on my non system drive, i'm guessing they are left over from a previous windows installation. when I try to remove them it says I have no permission to modify them. How would I go about deleting them?

Preferred Solution: Removing leftover system files

I recommend downloading and running Reimage. It's a computer repair tool that has been proven to identify and fix many Windows problems with a high level of success.

I've used it in the past to identify and fix everything from blue screens (BSOD's), ActiveX errors, corrupt files and processes, dll/exe/sys errors, recover lost memory, Windows update problems, defragging, malware removal etc.

You can download it direct from this link http://downloadreimage.com/download.php. (This link will automatically start a download of Reimage that you can save to your computer.)

A: Removing leftover system files

To help us help you,please use the TSG System Info tool to let Tech's know the specs of your computer: http://static.techguy.org/download/SysInfo.exe Copy and paste the results here in your thread. You can use the TSG Info to fill in your computer information in your user profile as well.

Also, if its a brand name system like an Acer,Dell or HP, please post the exact model of the system.

Read other 1 answers

Hello folks,

Laptop got a little sluggish and some programs (Firefox, Waterfox, Handbrake etc) were crashing all the time. Uninstallation using Revo Uninstaller and reinstallation didn't seem to solve the problems. So had to restore the system to previous restore point which restored to the OS+updates to that day+ a few essential programs.

Now I am left with the system where there are no programs but settings are still there, so when I am installing the programs, it takes these settings to run. I was wondering how do I delete these settings?

I ran CCleaner but it didn't help. Any other pointer?

Thanks in advance.

A:Deleting leftover files after System Restore

Perform a factory restore or a clean install, thats the only way.

Read other 1 answers

I uninstalled Norton System Works 2002. I wanted to install a new virus program instead of NAV that was included in NSW 2002. I used the Uninstall routine that came with NSW. After I uninstalled I installed my new virus program. There is no problem with the new virus program but there were some files left over from NSW. I now get annoying pop up dialog boxes indicating that some files cannot be found. These are all file names left over from NSW. I went to Symentec's website to see if there was a KB paper that would clear up this problem, but found nothing. Does anyone have any ideas as to how I can get rid of these annoyances? Some of the file names are SEVINST.EXE, and CSINJECT.EXE.Thanks, jerrydee(Moderator edit: post moved to more appropriate forum. jgweed)

A:Uninstalling Leftover Files From Norton System Works

This article from Symantic may be of some help.http://service1.symantec.com/SUPPORT/nsw.n...001091013435207

Read other 3 answers

Hi, I think I have something leftover from an uninstall and I'd prefer to get rid of whatever is left if possible please.

My CPU was consistently running at 50% when using audio programs (iTunes, VLC etc) and the culprit was the System Process. I later found out it was "stdriverx64.sys" specifically, and that it is associated with NCH software. As such I've attempted to remove those programs (via Control Panel). This has solved the CPU problem and all but two of the programs seem to have been removed successfully.

The remaining programs are "Prism Video File Converter" and "Express Zip". If I log in as Admin, these are NOT present in the Control Panel uninstall screen, however they are present when logged in as my usual user account (no admin rights). Clicking uninstall does not work: for Prism nothing happens, and for Express Zip I get the message "Access denied while deleted registry contents" followed by a reboot request which does not help. The same thing happens via CCleaner. I also tried a different third party uninstaller but it was also unable to help ("Best Uninstall Tool").

Is there a way I can get rid of these?

Thanks for any help!
OS: Windows 7 Home Premium 64bit + Service Pack 1

A:Removing leftover bits of NCH software

Let's see if AdwCleaner finds and removes some of the 'left-overs'.

Download AdWareCleaner AdwCleaner Download to your desktop
1.Right-click on adwcleaner.exe and select Run As Administrator to launch the application.
2.Click on Delete button.
3.Confirm each time with OK.
4.Your computer will be rebooted automatically. A text file will open after the restart. Please post the content of that logfile in your reply.
Note: You can find the logfile at C:\AdwCleaner[Sn].txt as well - n is the order number.

Read other 9 answers


I've got several programs that I've uninstalled in the past that haven't removed themselves from the registry(or so I assume). Things like WinAmp (2 and 3..). Doesn't exist on my computer but windows still believes it to be the default player for certain files. A while back on the forums I saw a link to a program that would remove these little leftovers without requiring the user (me) to use regedit, which I'm not comfortable with, but I can't for the life of me remember what it was. Any suggestions?



Running Windows XP Sp1, P4 1.6 mobile

A:Removing leftover registry values?

I use all these .

RegSeeker is a perfect companion for your Windows regsitry !
RegSeeker includes a powerful registry cleaner and can display various informations like your
startup entries, several histories (even index.dat files), installed applications and much
more ! With RegSeeker you can search for any item inside your registry, export/delete the
results, open them in the registry. RegSeeker also includes a tweaks panel to optimize your
OS !

RegSeeker is FREE for personal use only !

Click on Clean the Registry & tick > Scan Drives for old exe entries in the registry. Click OK.
My personal use , is to delete only the Green entries .
Left click to highlight , hold the Shift key down , to highlght bulk Green entries .
Right click to delete .


jv16 PowerTools , which doesn't expire , is available here:
http://down.hengshui.com/download.asp?downid=1&id=726 .
Click on Registry Tool > Tools > Registry Cleaner > Continue > Start .
When finished , Click on Select > Special select > Items that should be safe to remove > Remove.


OleClean ( Freeware . I tick all the boxes in Options ) from ,
h... Read more

Read other 1 answers

Looking through the C:drive on my Widows 10 desktop PC, I have discovered a folder named ComboFix. I ran a ComboFix scan and repair a couple of years back under directions from BleepingComputer.com when i had a different username (chipparus) and adifferent OS (Windows 7 I think).
Out of curiosity I looked at the properties of this folder which states
Type: Folder
Location:   C:/
Size:   60.3 MB
Files    337
Folders    3
However, when I click on the folder it seems to contain a replication of "My PC" including six system folders and Drives: C:/, D:/, E:/, F:/ & G:/ including all content amounting to over 500GB. I am wondering if this is a duplication or some sort of false library folder and whether or not I can get rid of it?
Any advice would be much appreciated.
Many thanks

A:Removing leftover ComboFix folders Windows 10

Please download DelFix by Xplode and save to your Desktop.Double-click on delfix.exe to run the tool.Vista/Windows 7/8/10 users right-click and select Run As Administrator.Put a check mark next to these items:- Remove disinfection tools- Create registry backup.Click the "Run" button.When the tool has finished, it will create and open a log report (DelFix.txt)-- Doing this should remove ComboFix and all of its related files/folders as well as any other specialized tools downloaded and used for malware removal. Any leftover logs, files, folders or tools remaining on your Desktop which were not removed can be deleted manually (right-click on it and choose delete).

Read other 3 answers

I couldn't put my computer into a standby mode two days ago. I had to hold the on/off button until it shut off. When I turned it back on, I received what I believe was a fake 'Security Center Alert' stating that my computer was at risk and the following virus had been found by Windows' Firewall: win32.netsky.q I say fake because I don't have my Windows firewall activated, I use the Norton Internet firewall. But when I went to my Windows firewall application, it was turned on. Not by me, though.
The alert mentioned worms/viruses can perform key-logging. There was a button to "Enable Protection" which opened up a web page to purchase some protection. I could close the 'Alert' by clicking on the 'X' button, which I did.
The alert would show up every 10 minutes. I went online to determine how to remove malware win32.netsky.q, which I did.
I haven't had any more of those notices, but now whenever I boot up or restart, Windows Data Execution Prevention pops up with "To help protect your computer...windows has closed this program: svchost with a button to 'make changes' or ' close message.' When I click on 'make changes' it goes to the Control Panel-->System-->Advanced-->Performance window where I've had it set, for years, for DEP to do whatever it does except for iexplorer.exe. But now there is svchost, so I checked it. The I tried unchecking it, but the same DEP notice kee... Read more

A:Leftover problem after removing win32.netsky.q worm

Is there another site I could try to get some help? Thanks.

Read other 1 answers

Can anyone tell me if there is such a progamme that can detect leftover programmes on the pc. By that I mean, when you have installed a programme and then decide you don't want it, you delete it from the add/remove control but it always seems to leave some file behind.

Is there anything that would clean all those files up? Hope I am making sense.


A:Leftover files?

Read other 14 answers

HI, i removed a security program,and i now find that i have leftover files, i went into task manager found file location, but when i try to delete them, a popup say's i need permission. i am the only user on the pc and also administrater how do i obtain permision or is the another way to delete. i have vista premium 32-bit...thanks

A:Get rid of leftover files

Hi patch41, Take ownership of that file and then delete it.

Read other 5 answers

I installed RT Seven Lite Software for making my own Windows 7 custom ISO. I loaded official Windows 7 ISO into RT Seven lite and started editing, But for some reason i stopped working on that. The problems is i uninstalled RT Seven Lite and i thought the windows files i was working on will be delete automatically but this didn't happened. Now i have left over windows 7 setup files that i can't delete. When i delete files it gives error '' You require permission from administrators to make changes to this file/folders''. But i am on administrative account.
And even if i try to change ownership of files/folders the options are not accessible. Only Trustedinstaller have full control on files. (My English is not good so please watch video to understand my problem)

Details - YouTube

I even tried to use Linux Fedora OS to delete those files but still failed. Those files took 32GB size on my HardDrive. I don't want to format my drive.Help please

A:Can not delete RT7lite's leftover files

Have you tried this one? Add "Take Ownership" to Explorer Right-Click Menu in Win 7 or Vista
99% of times that's all that's needed here to get rid of stuff. But a (very) few times had to manually add\edit owner in 'Advanced Security Settings', info here Permissions - Allow or Deny Users and Groups

btw, in case it's something very special to your program, try a ticket on RT Seven support?

Read other 3 answers

I removed mcafee using add/remove programs under the control panel. although i got the message that the uninstall was successful, there are still some things in the start.ini referring to this program. should i remove these using regedit. also will it help in getting rid of a conflict i'm having with other programs already on my computer?

A:using regedit to remove leftover files

If you are not real familiar with the registry, I suggest you download RegEditPlus.. a freeware program which provides the same service as windows regedit, but provides backup in case you make an error.
Then, in registry click 'C' and Find, enter any references to McAfee and use the delete button at the extreme top of panel on any that are found.
Download at:
or -

Read other 2 answers

Hi, I got infected with a bunch of stuff a couple of days ago. Smitfraud,Smitfraud-C, Toolbar 888 was installed into Internet Explorer, (therewere a few others but I don't remember the names) and I had a bunch ofnew icons put on the desktop. I ran Norton Anti-Virus, AdAware, SpybotSearch & Destroy, and Ewido Anti-Malware. They cleaned it all up asfar as I can tell. My Problem is I still have some leftover files, etc. on my system thatI was wondering about. After my computer was infected I had Update.exe running in the processesat starup. It wasn't running before the infection. I did a search for itand I found a file named Update.exe in the folderc:\:Program files\Common files\{F084CEF6-0B17-1033-1006-031225030001}\ There was also a file called system.dll in this folder. Ewido caught bothof the files and deleted them but the folder is still there. Can I safelydelete this folder? There's also an Icon left on my desktop that wasn't there before (therest of them were cleaned up by the above programs). It is a yellow trianglewith an exclamation point in it and the caption says "Click Here to Findand Fix Errors". As far as I can tell it's just some kind of link to awebsite not a shortcut to an actual program. Can I just delete this icon? When I was looking for the Update.exe file I found two other foldersc:\:Program files\Common files\{3084CEF6-0B17-1033-1006-031225030001}\ This folder had a file in it called &qu... Read more

A:Need Help With Some Leftover Files After I Cleaned Infection.

next log go to FORMAT in notepad and click on wordwrap1. Download this file : http://download.bleepingcomputer.com/sUBs/combofix.exehttp://www.techsupportforum.com/sectools/combofix.exe2. Double click combofix.exe & follow the prompts.3. When finished, it shall produce a log for you. Post that log and a HiJack log in your next replyNote: Do not mouseclick combofix's window while its running. That may cause it to stall

Read other 5 answers

Hi, I don't know much about computers so please bear with me.

I've installed a cookie/files cleanup (Evidence Eliminator), which is actually a 30 day trial program. Not even a day past, I decided to uninstall it. Unfortunately, I experienced problem uninstalling it with my pc's Add/Remove Program, so crazy to say I tried to remove them manually.
Now, I've noticed that "Evidence Eliminator" items still appear on context menu list when I right-click one of the items in Start Menu or any one of the files in My Documents and Desktop Icons. So, how can I delete and stop all these items (Evidence Eliminator Safe Delete, Evid. Elim. Quick Mode, Evid. Elim. Safe Start, etc.) to appear on right-clikck (context menu) list?

Someone told me about going to Registry Editor, but did not find them. Then, I also tried to run window thorough search, and nothing found either.

Its kind of frustraing doing research about this problem and it always takes me to a dead end. I hope I expressed my problem with my computer clearly and also hope to hear from you guys, soon.


A:Leftover Files After Program Uninstallation

Find Search assistant (the one with the yellow dog) and click "All files and folders". Right click every line it shows and choose delete. Be careful. After deleting a folder, some extra lines may show up on the Search assistant GUI. Do not delete those. Instead: run a second search to make sure.

Read other 4 answers

Uninstalled MSN but many files left.
Now on Comcast cable, so messenger 6.1 was installed.

Problem: When I start Messenger, a message says unable to connect to the interent, but our connection works fine. However, the old MSN email address appears in the messenger window. It seems to be overriding the new internet connection.

Which MSN files can I identify to safely remove--there are tons in a folder called 1386. ???

How can I get messenger to work with cable not that the MSN account is closed?

A:Messenger fails to connect due to leftover MSN files

1) Go to add/remove programs and uninstall messenger if present
2) Download the xp_messenger_remove.vbs from:
3) Reboot the system
4) Reinstall messanger

Read other 1 answers

I uninstalled BitDefender Internet Security 2010 last night, in favour for Microsoft Security Essentials. I used Revo to do this. The funny thing is though, the bdagent still runs in the background as per usual, and the all the program files and folders are still there, but I can't delete them. I can't change permissions either because "access is denied."

I can't use BitDefender's remove/repair function either because it doesn't recognise it as an installed program, and I can't reinstall the program for some reason either.

Any ideas?

A:Cannot delete leftover program folders/files

I also tried the "deleting undeletable files" method (in cmd prompt) but the prompt continually says it can't even find the directory.

Read other 4 answers

can anyonen tell me why i am getting leftover files when i run norton clean sweep. i have been using this prog for years now and have experienced this before but have no idea what causes it. the prog work great most of the time but sometimes this happens. i am getting 206k of files that just cannot be cleaned.

thanks for any help


Read other answers

So yeah, just went through the harrowing ordeal of getting rid of System Fix, only to find my poor, innocent laptop in even more trouble. AVG is picking up rootkits, which I've only just managed to get rid of, Internet explorer was completely hijacked by something (uninstalling IE was my sloppy fix of choice) and Google redirects are frequent. Here's the DDS (and the attach thing, too. I followed the preparation guide):

DDS (Ver_2011-08-26.01) - NTFSAMD64
Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_24
Run by Touphi at 3:26:34 on 2011-11-16
Microsoft Windows 7 Home Premium 6.1.7601.1.932.81.1033.18.3836.1968 [GMT -5:00]
AV: AVG Anti-Virus Free Edition 2012 *Disabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}
SP: AVG Anti-Virus Free Edition 2012 *Disabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
============== Running Processes ===============
C:\windows\system32\svchost.exe -k DcomLaunch
C:\windows\system32\svchost.exe -k RPCSS
C:\windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\windows\system32\svchost.exe -k netsvcs
C:\windows\system32\svchost.exe... Read more

A:Leftover trouble after dealing with System Fix

Hello and welcome to Bleeping ComputerWe apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine. If you are unable to create a log because your computer cannot start up successfully please provide detailed information about the Windows version you are using: What we in particular need to know is version, edition and if it is a 32bit or a 64bit system. [/b]If you are unsure about any of these caracteristics, just let us know and we'll help you figuring it out. Please also tell us if you have your Windows CD/DVD handy.Please include a clear description of the problems you're having, along with any steps you may have performed so far.Please refrain from running tools or applying updates other than those we suggest while we are cleaning up your computer. The reason for this is so we know what is going on with the machine at any time. Some programs can interfere with others and hamper the recovery process.Even if you have already provided information about y... Read more

Read other 2 answers

After doing the latest Disk Keeper Defrag and after moving my iTunes directory to another drive (hard drive was at 2 percent free space) I noticed alot I mean ALOT of Low performing system files like 889 according to the page report from DK. They were spread out all over the place I ran DK again and they are still there even though DK said they were fragmented files. So what i need to clear up is:
Do I need to defrag them ?
Will they hinder my systems performance?
And if I need to do i remove them with DK?

A:Removing low performing system files?

Read other 16 answers

some critical system files on my XP are infected by trojans:
and cant be cleaned so they must be deleted.
So, is it safe to copy same files from "%systemroot\system32\dllcache\cache" which are clean, on the original location where are infected files-needed to be deleted?

1. I scanned system with eset online,bitdefender online,malwarebyte and Hitman Pro 3, and they found Trojan.Win32.Patched.aa in all those files.

2. I planned to do this operation through "Microsoft Windows Recovery Console"
Thanks for advice in advance.

A:removing infected system files

What are these files infected with ?

What is telling you they cant be cleaned ?

Read other 3 answers

Hello - My computer had Win98 and I upgraded to XP years ago when it came out. When I upgraded I think I had the option of keeping the Win98 files in case the upgrade to XP didn't work or something like that. It was so long ago I don't remember.

The problem is I'm running out of space on my hard drive. I would like to know if there is any way to remove files from Win98 that aren't needed, if any. I know about a quarter of the disk space was taken up with only Win98 installed. After the upgrade to XP, a little over half of the disk space was being used and that was before any other software or files were added. Is removing the Win98 stuff even possible?

I hit F8 on start up and found that XP is the only operating system I can choose to boot. I don't know much about partitioning and stuff and I upgraded so long ago I don't remember what I did. Any suggestions? I can't afford another hard drive at the moment so I have to work with what I have.


A:Removing old operating system files (?)


If you installed Windows XP to a different folder than the Win98 that was on your PC before - then removing those files is easy - just remove the old Win98 folder. Unfortunately, the default folder for BOTH operating systems is C:\Windows - so if you remove files in C:\Windows, you'll delete Windows XP as well.

You can search your drive for a Windows.old folder. If this folder exists - delete it.

You can also run XP's Disk Cleanup in Accessories, System Tools.

The only SURE way to remove all old Win98 components without messing up XP would be to reformat and reinstall XP from scratch.

Try Disk Cleanup and see if that helps.

- John

Read other 4 answers

since having to re-install comp after nasty virus i seem to have found files i don't recognise. Think they are SP1 files, and just wanted to know if they are safe to delete... The files are in a directory as below...


inside this sub dir there are two


The second of which contains a multitude of files, folders & manifests

has anyone had this problem, SP1 seems to have installed ok as it shows up in system

thanks in advance

p.s. did look on forum for this but was unable to find, so i apologise if it has already been asked

A:Win 7 SP1 Leftover files on hard drive - Safe to remove?

Reboot a couple of times to make sure that any installs have finished and completed properly, then you can delete the folder - I would suggest putting it in the rcycle bin, and then rebooting again. You can clear teh recycle bin after a couple of days with no problems.

Read other 1 answers

I am using the Backup and Restore Center to backup a desktop and a PC to a local network WD My Book one TB drive. These backups are monthly. There are sets of fifteen to twenty zero length temp files of the form SDT3648.tmp for each machine for each backup. It seem obvious that the backup program should have deleted these files. Is this a common experience with Windows Vista backup for anyone else?
Frank C

A:Windows backup, leftover zero length temp files

Hmmm, i am not sure if they are supposed to be left or not, but, temp files are just that, temporary, i use this to clean my up : TFC - Temp File Cleaner by OldTimer - Geeks to Go Forums
Hope this helps you out.

Read other 1 answers


About a week ago, System Fix mysteriously appeared on my computer. I looked into it, and was able to remove it (or so I thought).

What's left is that all search engines in firefox or IE redirect to various sites (such as get-answers-fast). I also get random 'Stack Overflow at line ###' error popups, even if no programs are open.

I need some assistance to clean this off. I've tried all the programs that I'm familiar with.

The OS is Win7 Home Premium 64 bit.

Thanks in advance

Here's the DDS log:

DDS (Ver_2011-08-26.01) - NTFSAMD64
Internet Explorer: 8.0.7601.17514 BrowserJavaVersion: 1.6.0_20
Run by Adam at 19:02:22 on 2011-12-12
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3003.1737 [GMT -5:00]
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
============== Running Processes ===============
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe
C:\Window... Read more

A:System Fix Leftover - All Search Engines Redirect

Hello and Welcome to the forums!My name is Gringo and I'll be glad to help you with your computer problems.Somethings to remember while we are working together.Do not run any other tool untill instructed to do so!please Do not Attach logs or put in code boxes.Tell me about any problems that have occurred during the fix.Tell me of any other symptoms you may be having as these can help also.Do not run anything while running a fix.Do not run any other tool untill instructed to do so!Click on the Watch Topic Button and select Immediate Notification and click on proceed, this will help you to get notified faster when I have replied and make the cleaning process faster.Please print out or make a copy in notpad of any instructions given, as sometimes it is necessary to go offline and you will lose access to them.Run Combofix:You may be asked to install or update the Recovery Console (Win XP Only) if this happens please allow it to do so (you will need to be connected to the internet for this)Before you run Combofix I will need you to turn off any security software you have running, If you do not know how to do this you can find out >here< or >here<Combofix may need to reboot your computer more than once to do its job this is normal.You can download Combofix from one of these links.Link 1Link 2Link 31. Close any open browsers or any other programs that are open.2. Close/disable all anti virus and anti malware programs so they do not interfere with the runn... Read more

Read other 16 answers

I have some system corruption ( I think).  Used eset special virus removal tool to get rid of Zero access and several virus'.  Now I think some of my system files are corrupted or just plain missing.  I have ran sfc /scannow.  and some problems found and some fixed.  Several functions windows just don't work now.  During virus removal Eset was damaged, sent them log files, their reply was to run special clean uninstall then reinstall.  I did, eset now works but event viewer does not. Windows firewall just is not there.  Ran system repair from boot disk.  Some problems found and fixed others not..  I have some services missing. Don't Know where to start now.   HELP????????

A:Corrupted system files when removing Rootkit.

Personal opinion is that when your machine is infected you can no longer trust anything it tells you.  I highly recommend backing up your data and reloading the machine.  It will take you less time than trying to figure out what is wrong.

Read other 5 answers

My Norton expires in a week and I would like to get rid of all remnants of it and use a different anti-virus. I use Norton System works and have heard horror stories about removing it. Is there an easy way to clear the remnants and make sure its all gone.
Windows xp pro sp2..

Thanks for the help


A:removing all norton system work files

Read other 7 answers

I tried doing SFC /SCANNOW but its not working certain programs that I try to run they won't run e.g. cmd.exe, sfc.exe and a few more...if anyone can help me that'd be great

A:Need to repair my system files after removing a rootkit


My name is Debbie.

Is your account an administrator account? Try right-clicking on cmd.exe and selecting Run as Administrator. Reply back to me with the answer.
After that Boot into safe mode and run sfc /scannow

If no-go, try another user account - create a new one if you can.

Please reply in case you have any questions.

Read other 4 answers

My computer was infected with Vista Guardian 2010 two days ago. I first ran a full scan using McAfee but didn't detect anything. Following a friend's advice, I then ran Windows Update on the system. After restarting, I lost my desktop, only a small window saying "Personalizing the personal setting of your Internet Explorer" and it stayed there for ever. I managed to get online through Task Manager by hiting ctrl+alt+del. Then I downloaded Microsoft Security Essential and it found two malwares. I clicked "Remove Now" to the first one and my desktop came back. So when the second message prompted me to "Restart Now", I restared my computer while the scanning was still running. After restarting, everything was fine except a bit slower than before. But when I tried to open any .exe file (like IE browser, Firefox browser, MS Security Essential), none of them would open. The system keeps asking me which software I want to use to open the file, and still wouldn't open. I cannot open any browsers and cannot get online now. What should I do? (I tried in Safemode, and didn't work either). Thanks a lot!

A:system can't recgonize .exe files after removing malware

Seems that the malware has caused a lot of problems. If it were my computer, I would go back about a week before there was any possiblity of infection and do a system restore. The upside, you will be 100% back to normal. The downside, any changes that you made (programs etc) betwenn today's date and the restore point date will have to be done over.

Read other 5 answers

Hi, Everyone,

I bought a new computer about a month ago. (HP Pavilion dv6985se). I began the process of burning a copy of the system files, but, stopped when I realized I did not have the right discs and deciding I was just going to buy it from HP. Now, I am stuck with those files waiting to be burned in my D drive. When I open the folder, it warns me not to tamper with these files because I could delete other files in the process that could prevent me from restoring the system files in case of a failure. Is there anyway I can delete those files? I don't want to continue the burning as it would have taken 17 discs. I appreciate it if someone could answer this for me. Thanks!

Read other answers

Does anyone know of a program that will completely uninstall programs and also get rid of fragments of programs that were leftover by previous attempts at uninstalling programs, broken links, bogus registry files, etc? Thanks in advance.

A:Uninsaller with ability to delete orphan files, leftover bits of programs, etc.

I use Norton SystemWorks. It includes CleanSweep, Which monitors installs, and will completely remove anything it monitors. It wont clean programs already installed, Just the ones installed after installing CleanSweep. SystemWorks also includes Norton Utilities, Which has WinDoctor. WinDoctor will clean your registry, fix broken links, etc... SystemWorks also comes with Norton Anti-Virus. I have used SystemWorks since 98, and wouldnt use a PC without it

Read other 2 answers

Hi All,

I could successfully remove SYSTEM FIX virus with the useful guide but unhide.exe did not work for me and I still have many files hidden in many folders.

Could you please anyone out here help??



A:Files are still hidden after removing SYSTEM FIX virus 3 months back!!

Hello and welcome to Bleeping Computer! I am HelpBot: an automated program designed to help the Bleeping Computer Staff better assist you! This message contains very important information, so please read through all of it before doing anything. We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here. To help Bleeping Computer better assist you please perform the following steps:*************************************************** In order to continue receiving help at BleepingComputer.com, YOU MUST tell me if you still need help or if your issue has already been resolved on your own or through another resource! To tell me this, please click on the following link and follow the instructions there.CLICK THIS LINK >>> http://www.bleepingcomputer.com/logreply/465361 <<< CLICK THIS LINK If you no longer need help, then all you needed to do was the previous instructions of telling me so. You can skip the rest of this post. If you do need help please continue with Step 2 below.*************************************************** If you still need help, I would like you to post a Reply to this topic (click the "Add Reply" button in the lo... Read more

Read other 2 answers

I just found out about the files that Microsoft uses to store information which leave tracks behind of internet activities even after you clear your IE history and cookies cache. Anyhow, I found a utility that deletes them but I seem to loose my System Restore points. It wipes them clean and I am left with none. Before I downloaded this utility I deleted the index.dat manually following some web sites instructions and the same thing happened. All System REstore points gone. Is index.dat and System restore somehow connected? Or is it just Microsoft's revenge for me finding the files and deleting them? Heh heh.
Thanks for your help.

A:removing index.dat files affecting System Restore points

Can't see the link myself...what utility are you referring to?

I delete my index.dat's on a daily basis and it has no knock on effects to other programs. However, I don't use System Restore anymore but when I did the points were active after index.dat deletion but it all depends on how you delete them. I use batch files to do it but there are other ways such as logging off and onto another admin account then browsing to your profile and deleting them plus tools such as Unlocker and/or moveonboot can do it...usually by a reboot or restarting the explorer.exe shell.

Read other 8 answers

Disk Cleanup claims it can remove about 9.5 GB of old system update files, but upon running it, nothing happens (and I don't free up any space).

This may or may not be related, but I ran SFC and it found problems it couldn't fix. I've attached the logs.

A:Disk Cleanup not removing system update files/SFC can't fix problems

Did you run Disc Clean up as Administrator. Right click on Disc Clean up & select run as Administrator. When it opens make sure there are Ticks in all the boxes you wish to clean up.

Read other 4 answers

Hi all!
I have MS Win XP Pro SP3 32-bit, and Windows Media Player 11, and would like to remove several files named AlbumArt.jpg, AlbumArtSmall.jpg and Folder.jpg . There is also an important file named desktop.ini, which I of course will not delete.
However, as I try to delete them, one of the following generic warning message(s) that comes up, is like this:

AlbumArtSmall.jpg is a system file.
If you remove it, it is possible that your computer or one of the programs on your computer will not work properly. Are you sure you would like to move it to the Recycle Bin?

Obviously this is because the files are 'hidden'.
I rarely use Windows Media Player, as I have moved on to iTunes, which IMO is far more versatile for maintaining my music library.
So, now I am wondering: How do I safely remove Windows Media Player leftover jpeg files with a script?
Thank you very much in advance!

A:How do I safely remove Windows Media Player leftover jpeg files with a script?

Hi again midimusicman79 Windows Media Player is a core component of Windows. Any attempt to remove it, uninstall it or else will leave you with system files corruption. So if I were you, I would leave it be and not touch it. You cannot fully uninstall "core" components of Windows, any attempt to do so will bring you problems, I can guarantee you that.

Read other 3 answers

I'm using Windows 10 on a Lenovo IdeaPad laptop, with Revo Uninstaller installed. I've been using this for a long time and it always hangs for a while on "scanning for leftover files". Tonight I tried using it to uninstall Avira (want to reinstall this, having issues), and it simply hangs on "scanning for leftover files" infinitely. Been waiting for almost an hour and it's still stuck there, roughly 75% of the bar.

Anyone know what might be causing this? Fresh restart + CCleaner didn't help either.

Read other answers


I think I'm n the right section. Brand new Lenovo G570. Using Kaspersky Internet Security 2012 and I keep getting viruses. Restored to factory settings and I think the virus is still here. For Windows 7 update preference I chose to notify me before installing updates and let me choose which updates I want to install, computer keeps changing to update automatically @ 3am everyday. Desktop colors have change.

Each time I perform a full scan with Kaspersky and Malwarebytes, scan reports no viruses found. Internet explorer won't connect at all. I am using Safari as my default browser. The computer also randomly freezes.
Please help me.


A:System infected after removing trojan. System changes on its own.

A Clean Install may be the quickest & easiest way to go.

Clean Install Windows 7

Read other 5 answers

hey guys. I have peerguardian 2 and everytime i start my computer someone called offeroptimizer.com/static.callinghome.biz[spy], st. also i was looking with spysweeper at my items that startup with windows and i noticed there is something called ShowWnd.exe and i googeld it and some things said it was malicious and some said it was not. Maybe you could help me out. Heres my Hijackthis log. Thanks.Logfile of HijackThis v1.99.1Scan saved at 4:20:18 PM, on 5/25/2005Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\csrss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\Common Files\Symantec Shared\ccProxy.exeC:\WINDOWS\system32\Ati2evxx.exeC:\Program Files\Common Files\Symantec Shared\ccSetMgr.exeC:\WINDOWS\Explorer.EXEC:\Program Files\Norton Internet Security\ISSVC.exeC:\Program Files\Common Files\Symantec Shared\SNDSrvc.exeC:\Program Files\Common Files&#... Read more


Welcome leftover to Bleeping Computer.*Restart the computer.*as soon as BIOS is loaded begin tapping the F8 key until the Advanced Options menu appears.*Use the arrow keys to select the Safe mode menu item*press Enter.***We need to make sure all hidden files are showing so please:* Click Start. * Open My Computer. * Select the Tools menu and click Folder Options. * Select the View Tab. * Under the Hidden files and folders heading select Show hidden files and folders. * Uncheck the Hide protected operating system files (recommended) option. * Click Yes to confirm. * Click OK.***Close all programs leaving only HijackThis running. Place a check against each of the following, making sure you get them all and not any others by mistake:O4 - HKLM\..\Run: [ShowWnd] ShowWnd.exeClick on Fix Checked when finished and exit HijackThis.***Open Windows Explorer.Find and delete this file:C:\Windows\System32\ShowWnd.exe***Reboot the computer to normal mode.Please post back in this topic with a fresh log using HijackThis.

Read other 16 answers

I got some kind of malware last week. I kept getting tons of pop-ups, which never bothered me before, and other things. One of those fake anti-spyware sites that took over my computer till I shut it down, etc.

So in the past week I have done the following:

I ran Stinger, Ad-Aware, Malicious Removal Tool, CC Cleaner, Housecall, HS Remove, cwshredder, Kill2Me, all of which found nothing, and did a System Restore which had no effect..

Then I ran Malwarebytes and Stopzilla both of which found some Trojans, Malwares, Ad cookies etc and deleted them. (No worms that I could see.)

Since then I still have the following problems:

When I load Firefox - before the page loads in the upper left hand corner I get the following box:

"Java Application Type Error: spElement is null." (A search of "spElement is null" on Google turns up nothing.)

When I click OK, the message box disappears and Firefox loads. Sometimes a few different pages load, Ask.Com, My * 10.Com, etc. A couple pages sometime try to load but there is a message box that says the locations couldn't be found. I click off those pages, I seem to be able to use Firefox without any further problems.

If I try and load Internet Explorer, a bunch pf pages try to load, all with the same internet address with numbers, letters, and symbols that I have never seen before (not a foreign language, but symbols which aren't on my keyboard, letters, etc) Luckily for each page that tries to loa... Read more

A:A few leftover's that I can't seem to shake??

I would do the following.....Use Rkill to stop the rootkit processes that start when the computer comes on. Then I run the Malwarebytes and SUPERAntiSpyware. Here are some DL links for the Rkill....LINK 1LINK 2LINK 3LINK 4Save it to your desktop and then double click to launch it (With Vista you need to right click and select run as administrator). You should see a little black window open and then close. If you see that box then it worked. If you don't see the black box then delete the file and use another download link and repeat the steps.After running Rkill update and run MBAM. Next I would install AFT Cleaner check the box for select all and then run it. Finally, I would run SUPERAntiSpyware. If you have more than one username then you will need to scan each user account seperately with this.

Read other 1 answers

After finally getting the Windows 10 Anniversary Update to install, as expected, I had a WIndows.0ld file. Following instructions posted here and elsewhere, I used Disc Cleanup to remove most of that file.

There are still two folders remaining in Windows.old from System32, one in Drivers (IntcDaud.sys) and one in DriverStore (intcdaud.info.amd64xxxxx.) When I go directly to System32, both drivers appear in the same folders where they show in Wndows.old. Disc Cleanup no longer even recognizes Windows.old, so I cannot run it again to remove what appear to me to be extraneous entries.

Can I safely use Unlocker to try to remove the remaining Windows.old file, which likely would only work after a reboot? If not, is there some other method, short of using the Jaws of Life or a ten-pound sledge hammer to remove the leftover Windows.old file?

A:Windows.old leftover

Hello Not Myself,

Unlocker should work for you. If you like, OPTION THREE below should work as well.

Windows.old Folder - Delete in Windows 10

Read other answers

thank you for helping me,

Here is where we were working on Internet Explorer issues before I was told there was leftover malware items> http://forums.techguy.org/windows-xp/949714-internet-explorer-problem.html#post7597460

i ran the uninstaller then did the hijack this scan again.
i didn't see the two items you said i should check mark on the list.. so i looked back at the first log and they are listed, but now after the uninstall they are gone. because im not sure what to do, i didn't do the Norton uninstaller part yet.. this it the latest file after the uninstall.

i also noticed that when i would open any file the Search Settings v1.2.3 tried to open every time, and i had to hit the cancel button several times to close it. now that I've done the uninstall, it no longer does this. im guessing they are related somehow and i hope that this new information doesn't come too late..
thank you again for your help.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:40:46, on 9/13/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.17080)
Boot mode: Normal

Running processes:
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\... Read more

A:Leftover infection

Search Settings seems to be gone alright.

As for Norton, it should be removed since you should never run more than one antivirus software at the time. They will work one against the other (Avira and Norton), cause your system to be slow and even freeze. Your computer will be even more vulnerable.

Your log is showing traces of past or present infection. After we're done here, we'll need to get you transfered to the Virus & Other Malware Removal forum.

Read other 1 answers

Hi I need help getting rid of some trojan/malware remains. Malwarebytes and tdsskiller don't find anything but I am still getting internet explorer redirects, windows firewall turned off & will not turn on and need help because it looks like I may have a rootkit hiding somewhere. I have included my dds files. Also avast is showing alot of "malicious URL blocked" messages and the process is C:\Windows\System32\ping.exe. I have ESAT, MBAM, SAS & HiJackThis logs. I have combofix, aswMBR & minitoolbox dl'd & ready to run but don't want to use them without your direction. I have windows 7 32 Thanks!

A:Win7Antispyware leftover fix

Update......running eset fixed the redirects but I wonder if I still have the rootkit. Eset said I had a variant of the Win32/Sirefef.DN trojan.

Read other 19 answers


Not long ago I ran a search for all .bak files on my hard drive. Thousands of these files appeared but as I tried to delete them, I was unable to. I'm sorry, I forget what the error message said, but I was somehow blocked from deleting them.

After this, I have done the same search (typing *.bak into Windows search) and now no files of that type appear... not one.

I know there are possibly tens of thousands of these and are taking up valuable, valuable space on my hard drive.

Can someone help me locate and remove these files?

Thank you!

A:Help Removing .bak Files

I just searched again, removing the asterisk from *.bak. I typed in .bak and now I'm getting search results. But when I try to delete, it says:

Cannot delete file: Cannot read from the source file or disk.


Read other 2 answers

Is it safe to remove my tmp files on my computer by using: %tmp% using the Run command?

A:removing tmp files?

yup. But it's '%temp%'.....you forgot the 'e'.

Read other 2 answers

I recently discovered a file rk.exe hidden in my personal computer and am denied access from removing it. It is a process and it's from "Relavent Knowledge". I deleted it from my exceptions but everytime I restart it reappears. Any suggestions?

A:Need Help Removing rk.exe from my files

Hello jorvis, and Welcome to TSF!

Please download Ad-aware SE and install it if you don't have it already. Make sure it's the newest version and check for any updates before running it. Also go here to get the plug-in for fixing VX2 variants. To run this tool, go into Ad-aware->Add-ons and select VX2 Cleaner. Then click Run Tool and OK to start it. If it's clean, it will say Status System Clean. Otherwise, you will have to click on the Clean button to remove the VX2 infection. Also make sure to customize the settings in Ad-aware for better scan results. Run the scan and fix everything that it finds.

Download and install Spybot S&D . Run Spybot and click on the 'Search for Updates' button. Install any updates that are available. Next click on the 'Check for Problems' button. Let it run the scan. If it finds something, check all those in RED and hit the Fix Selected Problems button. Exit Spybot. If you keep getting the DSO Exploit entries, even after you updated Windows and fixed them, then download the Spybot DSO Exploit Fix and install it over the current Spybot installation.

Please download HijackThis - this program will help us determine if there are any spyware/malware on your computer. Create a folder at C:\\HJT and move HijackThis.exe there. Double click on the program to run it.

1. If it gives you an intro screen, just choose 'Do a system scan and save a logfile'.
2. If you don't get the intro screen, just hit Scan and then click on Save log.
3.... Read more

Read other 1 answers

I recently upgraded from Win98 to XP, and when I did I chose to save Win98 until I felt comfortable with XP. I suspect this is eating up a lot of space. Is there a way to get rid of the Win98-related files now that I'm good with XP?


A:Removing Files

It wont eat much space. Actually Xp is using alot of the original 98 files, and deciphering what is 98 and what is xp is almost impossible and tedious work.

Sorry, but you cant remove it as far as I know.

Read other 1 answers

I have deleted programs and files from my computer and they are still on here, i would like to know how to get rid of this, and also what files and programs can i remove that will free up space and not hurt my computer

A:Removing Files

Welcome to TSF

What programs are you referring to? Did you use the Add/Remove Programs applet to remove them? Where are they still located at?

Try using the Windows Installer CleanUp Utility. As long as you installed the application using the Windows Installer, this utility will remove all the folders, files, registry keys, and entries from your system and allow you to start over with a clean slate.

Download the Windows Installer CleanUp Utility
Locate and run msicuu2.exe to install the Windows Installer CleanUp Utility.
Locate and launch the Windows Installer CleanUp Utility on the Start menu.
From the Windows Installer CleanUp Utility window, locate the application in the list and click the Remove button.
Once the application has been removed, click the Exit button to close the utility.

Read other 1 answers

Hey guys, I've just gone from win xp 32 bit to win 7 64 bit via custom install, i'm guessing from what i've read that that's a clean install. After finishing my installation, i realised that my HDD is still filled up with programs from my win xp 32bit and i can still run them, also there's the windows.old stuff. Must I uninstall these programs or can i just delete them, I'm not sure because they can still run. I'm also now confused about which folders are new and which are old. Any advice is greatly appreciated.


A:Removing old files?

My suggestion is that delete those Program Files from the Windows.old file or transfer them to your current Windows Program Files folder (Cut+Paste) and them reinstall them via Repair rather than Install.

Read other 2 answers