Over 1 million tech questions and answers.

HJT-Leftover

Q: HJT-Leftover

hey guys. I have peerguardian 2 and everytime i start my computer someone called offeroptimizer.com/static.callinghome.biz[spy], st. also i was looking with spysweeper at my items that startup with windows and i noticed there is something called ShowWnd.exe and i googeld it and some things said it was malicious and some said it was not. Maybe you could help me out. Heres my Hijackthis log. Thanks.Logfile of HijackThis v1.99.1Scan saved at 4:20:18 PM, on 5/25/2005Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\csrss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\Common Files\Symantec Shared\ccProxy.exeC:\WINDOWS\system32\Ati2evxx.exeC:\Program Files\Common Files\Symantec Shared\ccSetMgr.exeC:\WINDOWS\Explorer.EXEC:\Program Files\Norton Internet Security\ISSVC.exeC:\Program Files\Common Files\Symantec Shared\SNDSrvc.exeC:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exeC:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exeC:\WINDOWS\system32\spoolsv.exeC:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exeC:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYSC:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exeC:\WINDOWS\system32\wdfmgr.exeC:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exeC:\WINDOWS\System32\alg.exeC:\Program Files\Digital Media Reader\shwiconem.exeC:\WINDOWS\SOUNDMAN.EXEC:\Program Files\CyberLink\PowerDVD\PDVDServ.exeC:\Program Files\QuickTime\qttask.exeC:\WINDOWS\zHotkey.exeC:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exeC:\Program Files\Microsoft AntiSpyware\gcasServ.exeC:\Program Files\Common Files\Symantec Shared\ccApp.exeC:\Program Files\Webroot\Spy Sweeper\SpySweeper.exeC:\Program Files\Microsoft AntiSpyware\gcasDtServ.exeC:\Program Files\PeerGuardian2\pg2.exeC:\Program Files\Mozilla Firefox\firefox.exeC:\Program Files\HijackThis\HijackThis.exeR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.emachines.com/R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.emachines.com/O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\COMPAN~1\Installs\cpn\ycomp5_5_7_0.dllO2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dllO2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll (file missing)O2 - BHO: Norton Internet Security - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dllO2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dllO3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\COMPAN~1\Installs\cpn\ycomp5_5_7_0.dllO3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dllO3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dllO4 - HKLM\..\Run: [SunKistEM] C:\Program Files\Digital Media Reader\shwiconem.exeO4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXEO4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXEO4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exeO4 - HKLM\..\Run: [CHotkey] zHotkey.exeO4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exeO4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /ConsumerO4 - HKLM\..\Run: [ShowWnd] ShowWnd.exeO4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /0O4 - HKCU\..\Run: [Steam] "c:\program files\valve\steam\steam.exe" -silentO4 - HKCU\..\Run: [PeerGuardian] C:\Program Files\PeerGuardian2\pg2.exeO8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htmO8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htmO8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htmO8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htmO9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dllO9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dllO9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exeO9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dllO16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dllO16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co...b?1113618189981O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061...all/xscan53.cabO23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exeO23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exeO23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exeO23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exeO23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exeO23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exeO23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exeO23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exeO23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYSO23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exeO23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exeO23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exeO23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exeO23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

RELEVANCY SCORE 200
Preferred Solution: HJT-Leftover

I recommend downloading and running DAP. It can help sort out any driver and firmware related issues on your system

It's worked out well for many of us in the past.

You can download it direct from this link http://downloaddap.org. (This link will open the download page of DAP so you can save a copy to your computer.)

A: HJT-Leftover

Welcome leftover to Bleeping Computer.*Restart the computer.*as soon as BIOS is loaded begin tapping the F8 key until the Advanced Options menu appears.*Use the arrow keys to select the Safe mode menu item*press Enter.***We need to make sure all hidden files are showing so please:* Click Start. * Open My Computer. * Select the Tools menu and click Folder Options. * Select the View Tab. * Under the Hidden files and folders heading select Show hidden files and folders. * Uncheck the Hide protected operating system files (recommended) option. * Click Yes to confirm. * Click OK.***Close all programs leaving only HijackThis running. Place a check against each of the following, making sure you get them all and not any others by mistake:O4 - HKLM\..\Run: [ShowWnd] ShowWnd.exeClick on Fix Checked when finished and exit HijackThis.***Open Windows Explorer.Find and delete this file:C:\Windows\System32\ShowWnd.exe***Reboot the computer to normal mode.Please post back in this topic with a fresh log using HijackThis.

Read other 16 answers
RELEVANCY SCORE 39.2

Can anyone tell me if there is such a progamme that can detect leftover programmes on the pc. By that I mean, when you have installed a programme and then decide you don't want it, you delete it from the add/remove control but it always seems to leave some file behind.

Is there anything that would clean all those files up? Hope I am making sense.

Thanks
 

A:Leftover files?

Read other 14 answers
RELEVANCY SCORE 39.2

HI, i removed a security program,and i now find that i have leftover files, i went into task manager found file location, but when i try to delete them, a popup say's i need permission. i am the only user on the pc and also administrater how do i obtain permision or is the another way to delete. i have vista premium 32-bit...thanks

A:Get rid of leftover files

Hi patch41, Take ownership of that file and then delete it.

Read other 5 answers
RELEVANCY SCORE 39.2

I got some kind of malware last week. I kept getting tons of pop-ups, which never bothered me before, and other things. One of those fake anti-spyware sites that took over my computer till I shut it down, etc.

So in the past week I have done the following:

I ran Stinger, Ad-Aware, Malicious Removal Tool, CC Cleaner, Housecall, HS Remove, cwshredder, Kill2Me, all of which found nothing, and did a System Restore which had no effect..

Then I ran Malwarebytes and Stopzilla both of which found some Trojans, Malwares, Ad cookies etc and deleted them. (No worms that I could see.)

Since then I still have the following problems:

When I load Firefox - before the page loads in the upper left hand corner I get the following box:

"Java Application Type Error: spElement is null." (A search of "spElement is null" on Google turns up nothing.)

When I click OK, the message box disappears and Firefox loads. Sometimes a few different pages load, Ask.Com, My * 10.Com, etc. A couple pages sometime try to load but there is a message box that says the locations couldn't be found. I click off those pages, I seem to be able to use Firefox without any further problems.

If I try and load Internet Explorer, a bunch pf pages try to load, all with the same internet address with numbers, letters, and symbols that I have never seen before (not a foreign language, but symbols which aren't on my keyboard, letters, etc) Luckily for each page that tries to loa... Read more

A:A few leftover's that I can't seem to shake??

I would do the following.....Use Rkill to stop the rootkit processes that start when the computer comes on. Then I run the Malwarebytes and SUPERAntiSpyware. Here are some DL links for the Rkill....LINK 1LINK 2LINK 3LINK 4Save it to your desktop and then double click to launch it (With Vista you need to right click and select run as administrator). You should see a little black window open and then close. If you see that box then it worked. If you don't see the black box then delete the file and use another download link and repeat the steps.After running Rkill update and run MBAM. Next I would install AFT Cleaner check the box for select all and then run it. Finally, I would run SUPERAntiSpyware. If you have more than one username then you will need to scan each user account seperately with this.

Read other 1 answers
RELEVANCY SCORE 39.2

After finally getting the Windows 10 Anniversary Update to install, as expected, I had a WIndows.0ld file. Following instructions posted here and elsewhere, I used Disc Cleanup to remove most of that file.

There are still two folders remaining in Windows.old from System32, one in Drivers (IntcDaud.sys) and one in DriverStore (intcdaud.info.amd64xxxxx.) When I go directly to System32, both drivers appear in the same folders where they show in Wndows.old. Disc Cleanup no longer even recognizes Windows.old, so I cannot run it again to remove what appear to me to be extraneous entries.

Can I safely use Unlocker to try to remove the remaining Windows.old file, which likely would only work after a reboot? If not, is there some other method, short of using the Jaws of Life or a ten-pound sledge hammer to remove the leftover Windows.old file?

A:Windows.old leftover

Hello Not Myself,

Unlocker should work for you. If you like, OPTION THREE below should work as well.

Windows.old Folder - Delete in Windows 10

Read other answers
RELEVANCY SCORE 39.2

Hi I need help getting rid of some trojan/malware remains. Malwarebytes and tdsskiller don't find anything but I am still getting internet explorer redirects, windows firewall turned off & will not turn on and need help because it looks like I may have a rootkit hiding somewhere. I have included my dds files. Also avast is showing alot of "malicious URL blocked" messages and the process is C:\Windows\System32\ping.exe. I have ESAT, MBAM, SAS & HiJackThis logs. I have combofix, aswMBR & minitoolbox dl'd & ready to run but don't want to use them without your direction. I have windows 7 32 Thanks!

A:Win7Antispyware leftover fix

Update......running eset fixed the redirects but I wonder if I still have the rootkit. Eset said I had a variant of the Win32/Sirefef.DN trojan.

Read other 19 answers
RELEVANCY SCORE 39.2

thank you for helping me,

Here is where we were working on Internet Explorer issues before I was told there was leftover malware items> http://forums.techguy.org/windows-xp/949714-internet-explorer-problem.html#post7597460

i ran the uninstaller then did the hijack this scan again.
i didn't see the two items you said i should check mark on the list.. so i looked back at the first log and they are listed, but now after the uninstall they are gone. because im not sure what to do, i didn't do the Norton uninstaller part yet.. this it the latest file after the uninstall.

i also noticed that when i would open any file the Search Settings v1.2.3 tried to open every time, and i had to hit the cancel button several times to close it. now that I've done the uninstall, it no longer does this. im guessing they are related somehow and i hope that this new information doesn't come too late..
thank you again for your help.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:40:46, on 9/13/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.17080)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\... Read more

A:Leftover infection

Search Settings seems to be gone alright.

As for Norton, it should be removed since you should never run more than one antivirus software at the time. They will work one against the other (Avira and Norton), cause your system to be slow and even freeze. Your computer will be even more vulnerable.

Your log is showing traces of past or present infection. After we're done here, we'll need to get you transfered to the Virus & Other Malware Removal forum.
 

Read other 1 answers
RELEVANCY SCORE 38.8

Hi!
I created that XML using WSIM. However, if I leave the size field blank (partition: 4), I encounter an error during installation, claiming DiskConfiguration to be incorrect. Is there any way to do this, and how?
Also, after I fixed this, I got a message telling me drivers for HDD/SSD were missing. Since this doesn't seem to happen with the regular installer disks, how and which drivers I need to integrate?

Thanks in advance!
<?xml version="1.0" encoding="utf-8"?><unattend xmlns="urn:schemas-microsoft-com:unattend">    <settings pass="windowsPE">        <component name="Microsoft-Windows-International-Core-WinPE" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">            <SetupUILanguage>                <UILanguage>de-DE</UILanguage>            </SetupUILanguage>            <InputLocale>de-DE</InputLocale>      &nbs... Read more

Read other answers
RELEVANCY SCORE 38.8

I had a virus/rootkit that I thought I had cleaned up. I'm still having the following issues though:
1. Blue screen trying to boot into safe mode (can't read reason)
2. Generic Host Process for Win32 Services has encountered a problem and needs to close message
3. Can't run full antivirus scan now without getting the above error, but it pops up at other times, like right now. When I get it, I have to restart my laptop - it won't do anything else.
4. Have the occasional extra pop up with an advertisement when I open up IE.
5. I couldn't post this on my laptop - I had to borrow someone else's for a few minutes to get this to go through. It just kept saying it couldn't diplay the page after I tried hitting submit.
6. My laptop is running much slower than normal.

Hope someone can help! I'm in the middle of a big project that needs files from my only computer, so this is the worst timing ever!

.
DDS (Ver_11-03-05.01) - NTFSx86
Run by Liz at 17:38:04.46 on Fri 05/13/2011
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_23
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2039.894 [GMT -4:00]
.
AV: Symantec Endpoint Protection *Enabled/Updated* {FB06448E-52B8-493A-90F3-E43226D3305C}
.
============== Running Processes ===============
.
C:\WINDOWS\System32\svchost.exe -k Cognizance
C:\WINDOWS\system32\svchost.exe -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k ne... Read more

A:Leftover Problems from Rootkit

Hello and welcome to the forums!My secret agent name on the forums is SweetTech (you can call me ST for short), it's a pleasure to meet you. I am very sorry for the delay in responding, but as you can see we are at the moment being flooded with logs which, when paired with the never-ending shortage of helpers, resulted in the delayed responding to your thread.I would be glad to take a look at your log and help you with solving any malware problems.If you have since resolved the issues you were originally experiencing, or have received help elsewhere, please inform me so that this topic can be closed. If you have not, please adhere to the guidelines below and then follow instructions as outlined further below:Logs from malware removal programs (OTL is one of them) can take some time to analyze. I need you to be patient while I analyze any logs you post. Please remember, I am a volunteer, and I do have a life outside of these forums.
Please make sure to carefully read any instruction that I give you. Attention to detail is important! Since I cannot see or directly interact with your computer I am dependent on you to "be my eyes" and provide as much information as you can regarding the current state of your computer.
If you're not sure, or if something unexpected happens, do NOT continue! Stop and ask!
If I instruct you to download a specific tool in which you already have, please delete the copy that you hav... Read more

Read other 3 answers
RELEVANCY SCORE 38.8

Howdy,

Now that I seem to have removed my root-kit I now wish to figure out how to remove what is leftover from a Virumonde infection that I had last year. I am no longer infected, but have 2 calls for dll files that are left in the registry, and cause an error on system start, generating error boxes. I am simply tired of them, but had to get my other issues taken care of first.

Hijack This and MB both allow me to delete the registry entries for both dlls, but they keep reappearing. I have researched this, only to find that it has something to do with the system restore function in XP. That doesn't make sense to me as I have turned system restore off, and it still happens. That leads me to believe that this problem is coming from somewhere else, but I have no idea how to track it down.

Thanks!
 

A:Leftover Virtumonde trash

Read other 16 answers
RELEVANCY SCORE 38.8

My old EIDE WD Caviar200AA is in a box.It was in a Compaq p.o.s.that died,last march.
My new" no-name" is running NTFS. and has 80 Gb Hdd.
How much hassle to add additional" slave" drive to new machine?
what are the snafu's out there? How do I start?
btw I'm new at this

Is the ole' 5600rpm drive seemingly tons slower than my 7200 in practice?

Can any of the fat32 stuff be left on that 20Gb or does it all have to be wiped?
 

A:should I install a leftover second- harddrive,20G

Read other 8 answers
RELEVANCY SCORE 38.8

I am reparing a machine for a friend. After installing and updating Mcafee, I found and removed multiple viruses. However, the desktop still has a long message on a black background that reads: WARNING You Are In Danger All that you ever do on your computer...... Can anyone tell me how to get this off the Desktop? Thanks.
 

A:Desktop Virus Leftover

http://www.processlibrary.com/processscan/ this may help once you reach desktop,however i would run all the anti spy you have make sure you have spybot,adaware etc,download iobit v2 free install run then go to tools start up and look through the registry entries which are starting with windows,also microsoft malicious removal tool may be usefull
http://www.iobit.com/AdvancedWindowsCarePersonal/download.htm
http://www.microsoft.com/security/malwareremove/default.mspx
 

Read other 1 answers
RELEVANCY SCORE 38.8

I had been using WMP 6.4. Decided to try Version 7. Uninstalled and checked out Version 9. Wish I hadn't done either. I don't care for the extra features they added and should have just stayed with 6.4.

After searching, I've learned that those newer versions added lots of registry entry's that do not get removed with Add/Remove Programs.

When I run Spybot S&D, I still see entry's about Media Player and SDK. I have Win98SE, use Norton Windoctor and JV16 Powertools.

Is there a tool or guide to remove leftover WMP registry entries before putting 6.4 back on? I had deleted 6.4 from Explorer and ran the above before installing the other versions. I also have the Alternative versions, but need WMP for streaming.
 

A:Remove leftover WMP reg entries

Read other 8 answers
RELEVANCY SCORE 38.8

Last Thursday, I'm sure a file from WinMX while my AVG was off(that's a long story) caused a browser hijack. Anyway, I read though your and other forums and followed some of the suggestions given to others with similar ills. After a lot of trail and error I seem to no longer have browser hijacking ( i.e.. new window opening with "url.urtbk" in the address) but I'm not sure if all is well. There may still be leftovers. My browser still runs slower than normal and I fear a redirect is in my future. Here's my current HijackThis log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:56:51 PM, on 7/27/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16850)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
C:\WINDOWS\system32\imapi.exe
C:\Program Files\Softex\OmniPass\Omniserv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Softex\OmniPass\OPXPApp.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx... Read more

A:Malware leftover blues

I now have Java SE installed (files in my registry leftover fron Windows Cleanup Utility prevented installation)
 

Read other 1 answers
RELEVANCY SCORE 38.8

I had a trial program loaded, the program was past the trial period and I forgot to uninstall it. When I did uninstall the program I thought all traces of it where gone. That was about a couple of months ago.
I decided that I would like to use it the program and tried to download it. The program started to download, but never finished the download. Got a message that "old version" needed to be removed.
I've done a search for the program, couldn't find any trace of the program. Went into regedit>software..found something I'm not sure if its the program or not. The program in question FakeWebCam...found in regedit>software "fwc" with 9 keys with values. The initials match the program's name.
Should I delete that folder from regedit?
 

A:Solved: Leftover Program

I just installed it into a virtual machine and it created the fwc key with 9 values so that's probably the one to delete. Always a good idea to export a copy first just in case.

HTH

Jerry
 

Read other 3 answers
RELEVANCY SCORE 38.8

Hello

I am trying to help my friend again with her PC. I removed Adware and Kazaa a few months ago but someone installed Kazaa again so now I have to clean it up again. She promised her first born if it happens again.

I have installed the latest Windows security updates, cwshredder and Spybot but the browser is still not 100%. It is usable but there 4-5 ads when you launch. Here is her Hijack this file

Logfile of HijackThis v1.97.7
Scan saved at 7:00:14 AM, on 6/4/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LMPDPSRV.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\WINDOWS\System32\P2P Networking\P2P Networking.exe
C:\Program Files\Common files\updmgr\updmgr.exe
C:\Program Files\Altnet\Points Manager\Points Manager.exe
C:\WINDOWS\System32\mwvzapst.exe
C:\Program Files\Internet Optimizer\optimize.exe
C:\Program Files\ISTsvc\istsvc.exe
C:\WINDOWS\dhbrwsr.exe
C:\WINDOWS\odrbvzkha.exe
C:\documents and settings\user\local settin... Read more

A:Leftover Kazaa problems

Read other 11 answers
RELEVANCY SCORE 38.8

This is not a big deal, but after cleaning up a mildly infected computer with Malwarebytes Professional, AdwCleaner and HitmanPro, I find I still have a running process for SearchProtect when I checked in Task Manager for anything else.  It is not showing it's using a lot of resources, but it is there.  The entry is located in the System 32 file.  I hesitate to remove anything from that file... Should I leave well enough alone or delete it?  Thanks!Edit: Topic moved from General Security to the more appropriate forum. ~ AnimalEdit: Topic moved from Am I Infected forum to the more appropriate forum. At the request of Malware Removal team member. ~ Animal

A:Leftover Conduit Entry

Hi & to Bleeping Computer Forums!My name is Jürgen and I will be assisting you with your Malware related problems.Before we move on, please read the following points carefully: My native language isn't English. So please do not use slang or idioms. It could be hard for me to read. Thanks for your understanding.Please read my instructions completely. If there is anything that you do not understand kindly ask before proceeding.Perform everything in the correct order. Sometimes one step requires the previous one.If you have any problems while you are follow my instructions, Stop there and tell me the exact nature of your problem.Do not run any other scans without instruction or Add/ Remove Software unless I tell you to do so. This would change the output of our tools and could be confusing for me.Post all Logfiles as a reply rather than as an attachment unless I specifically ask you. If you can not post all logfiles in one reply, feel free to use more posts.If I don't hear from you within 5 days from this initial or any subsequent post, then this thread will be closed.If I don't reply within 24 hours please PM me!Stay with me. I will give you some advice about prevention after the cleanup process. Absence of symptoms does not always mean the computer is clean.Step 1Please run a FRST scan. This will help us diagnose your problem.Please download Farbar Recovery Scan Tool and save it to your Desktop.(If you are not sure which version (32-/64-bit) applies to your system, d... Read more

Read other 14 answers
RELEVANCY SCORE 38.8

Ok, finally got Smitfraud-C.Core Service and Virtumonde cleaned out. DriveCleaner2006 does not seem to want to go away now. Had some WinAntiSpyware as well. The only thing that seems to be hanging on at this point is the DriveCleaner. Here is the HijackThis log. Thanks for your help!Logfile of HijackThis v1.99.1Scan saved at 3:24:28 AM, on 7/26/2007Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v7.00 (7.00.6000.16473)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exec:\program files\safeandsecure\safeandsecure\app\CurtainsSysSvcNt.exeC:\Program Files\Common Files\Command Software\dvpapi.exeC:\WINDOWS\eHome\ehRecvr.exeC:\WINDOWS\eHome\ehSched.exeC:\Program Files\McAfee\Common Framework\FrameworkService.exeC:\Program Files\McAfee\VirusScan Enterprise\vstskmgr.exeC:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXEC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\dllhost.exeC:\WINDOWS\system32\ctfmon.exe... Read more

A:Leftover Stuff From Malware

Welcome to BleepingComputer, I am currently reviewing your log. Please note that this is under the supervision of an expert analyst, and I will be back with a fix for your problem as soon as possible.I recommend that you "track this topic" to be notified when a reply has been made. At the top if this thread choose Options > Track This Topic and then select Immediate Email Notification.RegardsPOADB.

Read other 14 answers
RELEVANCY SCORE 38.8

So my dad was using the pc and installed malware by mistake. I ran malwarebyes and removed the malware but every time he signs into his account on startup this error pops up. I tried to find it's folder but couldn't see it so how can I remove it please?

A:Cannot delete this malware leftover

Originally Posted by Edward


So my dad was using the pc and installed malware by mistake. I ran malwarebyes and removed the malware but every time he signs into his account on startup this error pops up. I tried to find it's folder but couldn't see it so how can I remove it please?



Hi Edward.
Do you have Ccleaner installed on the computer?
If so, please navigate to the TOOLS selection on the left, then go across the tabs to SCHEDULED TASKS. Look in that window for the DLL call and highlight it, and select DISABLE. Reboot the computer.

Read other 3 answers
RELEVANCY SCORE 38.8

I used the Windows Police removal procedure as shown and successfully removed the program. THANKS - got my computer back! However, every time I start up my computer or a program now I get the following window notification "name of exec file - BAD IMAGE. Then it states that "globalroot\systemroot\system32\gasfkybospyfqm.dll" is not a valid Windows image. Please check it against your installation disk." I can click on OK and everything works but it comes up everytime something loads. Any information on getting rid of this screen would be appreciated. Also - all my RESTORE points have gone, I can't even get back into yesterday or last month. RESTORE is set to work so????

A:Windows Police leftover help please

Moved from HJT to a more appropriate forum. Tw

Read other 7 answers
RELEVANCY SCORE 38.8

I have previously posted in this forum about my computer on this thread: http://www.bleepingcomputer.com/forums/t/239917/google-redirect/. The google redirection issue described there was resolved, but there are still a few symptoms that indicate the computer may not be completely fixed. I was working with Blade81 via private message but we were unable to solve these symptoms. They are:When I log into the "Steve" account, I see this error message:
RUNDLL
Error loading C:/DOCUME~1/Steve/protect.dll
The specified module could not be found.
(Note that the combofix in the previous thread was done to the Donna account)The antivirus program auto-update does not seem to be working. I can do a manual update, and I can see that automatic updates are enabled, but they do not seem to be executing.Uploading actions, such as sending an email or uploading pictures to Picasa, seem to take longer than they should.I have run DDS on the "Steve" account since it is the one that has the error message. Thanks in advance for any help you can provide.DDS (Ver_09-07-30.01) - NTFSx86 Run by Steve at 21:08:58.73 on Wed 09/02/2009Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_15Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2046.1679 [GMT -5:00]AV: AntiVir Desktop *On-access scanning enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}============== Running Processes ===============C:\WINDOWS\system32\svchost -k DcomLaunchsvchost.exeC:\WINDOWS\System32\svchost.exe -k ... Read more

A:Leftover Malware from a Previous Fix

Hello and welcome to Bleeping ComputerWe apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine. If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.Upon completing the steps below another staff member will review and take the steps necessary with you to get your machine back in working order clean and free of malware.If you have already posted a DDS log, please do so again, as your situation may have changed.Use the 'Add Reply' and add the new log to this thread.Thanks and again sorry for the delay.We need to see some information about what is happening in your machine. Please perform the following scan:Download DDS by sUBs from one of the following links. Save it to your desktop.DDS.scrDDS.pifDouble click on the DDS icon, allow it to run.A small box will open, with an explaination about the tool. No input is needed, the scan is running.Notepad will open with the results.Foll... Read more

Read other 9 answers
RELEVANCY SCORE 38.8

Need some help with this log please, guys. I have broadband but the last day or so the connection was extremely slow and sluggish. I then ran a Spybot search and came up with the wwwcoolsearch.leftover virus. I deleted it from Spybot but the system remained slow - sometimes taking 5 minutes or so to load a page. I then performed a system restore to three days ago and so far that seems to have solved the problem - speed of the broadband connection seems to be much faster now. I just want to make sure there's nothing in my HJT log that should warrant further investigation. If it's of any interest, on Monday I upgraded from ME to XP.



Logfile of HijackThis v1.99.1
Scan saved at 00:07:13, on 31/03/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\devldr32.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBVE.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcal... Read more

A:wwwcoolsearch.leftover Hijack log

OK, seems I typed too soon. System is back to slow this AM. HELP!

Read other 2 answers
RELEVANCY SCORE 38.8

I downloaded a bad file on accident and got inundated with trojans and all kinds of other garbage. So I ran a full MBAM scan and cleaned it all out, mostly. When I open up my browser (Firefox) This is what I see on the top of my browserI also randomly get a page that says "CONNECTION RESET BY REMOTE SERVER. something about reasons for errors, then a link that says RUN THE COMPLETE SCAN." Obviously it's a ruse and I just hit refresh and it goes away. Any help is appreciated

A:I need some help cleaning up some leftover spyware. . .

Hello please run these as instructed and post back 2 logs. If you have SpyBot running please disable it for these.From your regular user account..Download Attribune's ATF Cleaner and then SUPERAntiSpyware , Free Home Version. Save both to desktop ..DO NOT run yet.Open SUPER from icon and install and Update itUnder Scanner Options make sure the following are checked (leave all others unchecked):Close browsers before scanning.Scan for tracking cookies.Terminate memory threats before quarantining.Click the "Close" button to leave the control center screen and exit the program. DO NOT run yet.Now reboot into Safe Mode: How to enter safe mode(XP)Using the F8 MethodRestart your computer. When the machine first starts again it will generally list some equipment that is installed in your machine, amount of memory, hard drives installed etc. At this point you should gently tap the F8 key repeatedly until you are presented with a Windows XP Advanced Options menu. Select the option for Safe Mode using the arrow keys. Then press enter on your keyboard to boot into Safe Mode. Double-click ATF-Cleaner.exe to run the program.Under Main "Select Files to Delete" choose: Select All.Click the Empty Selected button.If you use Firefox or Opera browser click that browser at the top and choose: Select AllClick the Empty Selected button.If you would like to keep your saved passwords, please click No at the prompt.Click Exit on the Main menu to close the program.NOW Scan with... Read more

Read other 5 answers
RELEVANCY SCORE 38.8

I am trying to clear out the last remnants of 2 spyware infections, spysherriff.exe and ibm0001.exe. I have gotten just about everything cleared out, but i still have a few items on my hijackthis log that i can not get rid of at all. I am not sure if this is related or not, but my internet just stops working after 20 minutes after i reboot. Called the ISP, they said my connection is okay, i can ping out, but i can not get a connection to anything, IE and firefox open as nothing, no page.this is the one entry that i can not get rid of.O20 - Winlogon Notify: avpe32 - C:\WINDOWS\SYSTEM32\avpe32.dllI have ran, Ewido, adaware, AVG, Spybot - Search & Destroy, kaspersky (which for some reason i can no longer get too). I run WIN XP's firewall, but i can not get to the settings, gives me an error saying "Due to an unidentified problem, Windows cannot display Windows Firewall Settings".Any help would be gladly appreciated, Thanks in advance.Logfile of HijackThis v1.99.1Scan saved at 6:20:24 PM, on 1/14/2006Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\csrss.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\System32�... Read more

A:Hijackthis Log: Last Remnants Leftover

Hi,

Sorry for this delay. Post please a fresh hijackthis log if you still have problems.

Read other 5 answers
RELEVANCY SCORE 38.8

Logfile of Trend Micro HijackThis v2.0.2Scan saved at 3:20:52 PM, on 4/24/2010Platform: Windows XP SP3 (WinNT 5.01.2600)MSIE: Internet Explorer v8.00 (8.00.6001.18702)Boot mode: NormalRunning processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Alwil Software\Avast4\aswUpdSv.exeC:\Program Files\Alwil Software\Avast4\ashServ.exeC:\WINDOWS\Explorer.EXEC:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exeC:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exeC:\Program Files\Real\RealPlayer\RealPlay.exeC:\WINDOWS\system32\ezSP_Px.exeC:\Program Files\Verizon\McciTrayApp.exeC:\Program Files\ATT-SST\McciTrayApp.exeC:\WINDOWS\system32\spoolsv.exeC:\Program Files\Common Files\Motive\McciCMService.exeC:\WINDOWS\System32\nvsvc32.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Viewpoint\Common\ViewpointService.exeC:\WINDOWS\wanmpsvc.exeC:\Program Files\Linksys\WUSB54GSC\WLService.exeC:\Program Files\Linksys\WUSB54GSC\WUSB54GSC.exeC:\WINDOWS\system... Read more

A:HJthis log - still have viruses leftover?

Hello and welcome to Bleeping ComputerWe apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine. If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.Upon completing the steps below I will review and take the steps necessary with you to get your machine back in working order clean and free of malware.If you have already posted a DDS log, please do so again, as your situation may have changed.Use the 'Add Reply' and add the new log to this thread.Thanks and again sorry for the delay.We need to see some information about what is happening in your machine. Please perform the following scan:Download DDS by sUBs from one of the following links. Save it to your desktop.DDS.scrDDS.pifDouble click on the DDS icon, allow it to run.A small box will open, with an explaination about the tool. No input is needed, the scan is running.Notepad will open with the results.Follow the instructions... Read more

Read other 2 answers
RELEVANCY SCORE 38.8

There's been a lot of trojans/malware on this pc in the past and although I've usually managed to eliminate most of the threats, I'm pretty sure there are still some leftover bits and pieces, so I figured I'd try posting this log to see if anyone could help me clean it up a bit, as it's not my computer, obviously I don't want to go messing about in the registry by myself. Take your time, no rush ;)Logfile of Trend Micro HijackThis v2.0.4Scan saved at 03:36:58, on 27/07/2011Platform: Windows XP SP3 (WinNT 5.01.2600)MSIE: Internet Explorer v8.00 (8.00.6001.18702)Boot mode: NormalRunning processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\Ati2evxx.exeC:\Program Files\AVG\AVG9\avgchsvx.exeC:\Program Files\AVG\AVG9\avgrsx.exeC:\WINDOWS\system32\spoolsv.exeC:\Program Files\AVG\AVG9\avgcsrvx.exeC:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exeC:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDevice... Read more

A:Hijack This / Looking For Leftover Narsties

Hi,Please do the following:Please download DDS from either of these linksLINK 1 LINK 2and save it to your desktop.Disable any script blocking protection Double click dds to run the tool. When done, two DDS.txt's will open. Save both reports to your desktop.---------------------------------------------------Please include the contents of the following in your next reply:DDS.txtAttach.txt. NEXTPlease download aswMBR ( 511KB ) to your desktop.Double click the aswMBR.exe icon to run itClick the Scan button to start the scanOn completion of the scan, click the save log button, save it to your desktop and post it in your next reply.

Read other 18 answers
RELEVANCY SCORE 38.8

So I contracted Smitfraud-c, as named by Spybot, and like everyone else I couldn't get it off. My computer was just going nuts; adding desktop icons, opening my browser, countless prompts ostensibly notifying me of spyware removal tools, and actually running these fake programs. I tried a few smitfraud cleaners and other recommendations to no avail.
Finally I tried using HJT to "delete a file on reboot.." and deleted the dll associated with smitfraud-c. I think I determined the dll file with the SpybotSD recovery listings following a scan, or something like that. Anyway, after I did this SpybotSD was actually able to delete the Smitfraud-c object. After numerous scans with all of my clean-up tools, they are no longer picking up any more malware.
I was happy about this, however things still arent completely right: Boot-ups take a long time (malware is starting up and initiating its hijack, I think), my home page keeps changing, and I'm pretty sure I'm seeing browser hijacker entries in my HJT log.
Security and cleanup tools that I use: SpybotSD, AdawareSE, Spyware blaster, AVG, windows firewall, CCleaner, RegCleaner, Windows disk cleaner and every now and then I'll run rootkit scanners. Here's my HJT log:

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.e... Read more

A:smitfraud-c, leftover stuff

Read other 12 answers
RELEVANCY SCORE 38.4

Hello,
As I using Windows long time and have uninstall and install many apps and the uninstalled apps left some registry entries, most of the entries is under HKEY_Current_User\Software and HKEY_Local_Machine and many keys name is same as the uninstalled apps, does it is safe to delete the entries?

A:Should I delete leftover registry entries

I sometimes encountered problems re-installing applications after normal uninstall and manual registry key deletions of same applications.

Could be because these keys can be associated with files which are still present in program files folder and other locations, so deleting these folders is what I would do. but still re-installation could be incomplete some times.

Read other 17 answers
RELEVANCY SCORE 38.4

Hello! A few months ago my computer was infected with the Happili virus. It was incredibly difficult to get out, but with the help of one of the guys on here, I finally got rid of it. I noticed my computer still seemed to be running slower than usual, though, but I chalked it up to a high CPU usage. Unfortunately, just a few weeks ago my computer has started acting really funky. It takes about two to five minutes for it to pull up my desktop. Sometimes it will open Firefox; other times Firefox will never come up, no matter how many times I click the icon. Still other times, Firefox will work temporarily and then just stop loading websites out of the blue. Sometimes there is no volume - it claims that the audio mixing device is missing - and other times the volume is just fine. Most recently, I won't have volume and can't pull the volume adjuster up at all, or I can pull the volume adjuster up but have absolutely no sound. Sometimes it will open OpenOffice and WordPad, but most of the time it never pulls them up. The one thing that remains the same is that 90% of the time, I have to force it to shutdown, otherwise it just sits there with an iconless desktop background. Also, instead of going straight to the "Microsoft Windows" loading screen (the one before the "welcome" screen) it shows me a black screen that asks me if I want to boot up in Safe Mode, Safe Mode with Networking or Normal Mode. This screen always pops up every time I turn it on.
... Read more

Read other answers
RELEVANCY SCORE 38.4

Had securityuptodate.com/atmclk.exe hyjacker. Followed the instructions for removal posted on My 14,2006 by another member and managed to recover my home page.
Ran SmitfraudFix, Ewido Security Suite, and Webroot SpySweeper, asper the instruction string. I have mostly recovered all my previous settings Except that there is a remaining flashing Icon on my system tray and a Virus alert pop-up which persist. All of this was done without posting my HJT log (Foolish I guess). I haver included the HJT log . This is driving me nuts.

Running a P4 2.4Ghs/ 1Gig Ram PC on Win XP Pro with SP2 (up tp date) Have a router and am using ZoneAlarm with Norton AV 2005.

How much security is enough?

PLEASE HELP

Thanks, Roberto

Logfile of HijackThis v1.99.1
Scan saved at 12:03:44 PM, on 5/21/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Share... Read more

A:Solved: TROUBLE with securityuptodate.com LEFTOVER POP ups

make sure you have smitfraud fix 2,45

if you have a previous version then redownload it and ruin option 4
 

Read other 3 answers
RELEVANCY SCORE 38.4

I had SpySheriff on my computer and had a large black box on my desktop with Spyware Infection in red letters on my desktop. Also, my internet security setting kept being set to minimum. However, I have taken care of most of the problems...I think. All that is left now is a black desktop that I cannot change.

The steps I have taken to get to this point are from brendandonhu's fix of lazbum's problem. The thread is titled "Spyware infection desktop wont go away i need help." However, when I get to actually doing the desktop fix, it doesn't work.

Please let me know what I can do to fix this. Thanks
 

A:Solved: Spysheriff leftover problem...

Read other 9 answers
RELEVANCY SCORE 38.4

Hello,I used to own an HP Envy 120 printer that I gave to my daughter.  I tried to remove all the software concerning the Hp product,  but I seem to be stuck with a leftover .dll that I can't remove.  When I open my portable I always receive as an hello message,  the following message:  C:\ProgramFiles\HP\HPENVY120 series\bin\HPStatusBL.dll I searched all over the registry but I can't find any files pertaining to HP.  Can anyone help,  Please? Maurice

Read other answers
RELEVANCY SCORE 38.4

I have installed a couple of Linux distros a copy of XP etc that have been removed from the system. The entries are still left showing up in the bootmenu. How do I delete these unwanted entries?

Note, currently I have Zorin 8 installed dual booting with Windows so it's grub's boot loader that shows up first. This is fine with me and the way I prefer it. On choosing to go to my windows bootmenu I then get the bootmenu screen with all the unwanted entries.

If I am not mistaken, I should be able to delete these entries so when choosing to boot Windows, the system then should boot right into windows without giving me that extra windows bootmenu screen ( because it's not needed - there will be no other choices in that menu to choose from)

How can I do this? Thanks (BTW, I don't want to use a 3rd party tool like BCDEdit)

A:How do I remove leftover entries from the Win 8 bootmenu?

Windows key + R. type msconfig and press Enter.
Click on the Boot tab.
Select the entries you want to remove and click the Delete button.

Read other 9 answers
RELEVANCY SCORE 38.4

I like to reformat my computer periodically, it keeps everything running smooth. The time had come to reformat, so I popped in my XP Pro install disc and let it whirr. I did the usual deal, deleted my old partition, and recreated a new one using a Quick NTFS Format. The install went smoothly.

Now however, I'm looking at some registry values, and I have all kinds of entries from old programs that were installed before I formatted. There are a few games on the list (FEAR, Oblivion, etc), the only problem is, I haven't installed those programs yet. It seems as if the format I've done didn't actually clean everything off.

I have two harddrives, but I use one for all the downloads/files/pictures/documents/other OS's/etc, and I use the other one just for installing XP and my programs. Is it possible that the quick format didn't do its job? Maybe it didn't get to delete the partition tables correctly or something, I dunno.

Anyone else ever have this problem before?
 

A:Leftover registry values after reformat

Read other 6 answers
RELEVANCY SCORE 38.4

Hi, I think I have something leftover from an uninstall and I'd prefer to get rid of whatever is left if possible please.

My CPU was consistently running at 50% when using audio programs (iTunes, VLC etc) and the culprit was the System Process. I later found out it was "stdriverx64.sys" specifically, and that it is associated with NCH software. As such I've attempted to remove those programs (via Control Panel). This has solved the CPU problem and all but two of the programs seem to have been removed successfully.

The remaining programs are "Prism Video File Converter" and "Express Zip". If I log in as Admin, these are NOT present in the Control Panel uninstall screen, however they are present when logged in as my usual user account (no admin rights). Clicking uninstall does not work: for Prism nothing happens, and for Express Zip I get the message "Access denied while deleted registry contents" followed by a reboot request which does not help. The same thing happens via CCleaner. I also tried a different third party uninstaller but it was also unable to help ("Best Uninstall Tool").

Is there a way I can get rid of these?

Thanks for any help!
OS: Windows 7 Home Premium 64bit + Service Pack 1

A:Removing leftover bits of NCH software

Let's see if AdwCleaner finds and removes some of the 'left-overs'.

Download AdWareCleaner AdwCleaner Download to your desktop
1.Right-click on adwcleaner.exe and select Run As Administrator to launch the application.
2.Click on Delete button.
3.Confirm each time with OK.
4.Your computer will be rebooted automatically. A text file will open after the restart. Please post the content of that logfile in your reply.
Note: You can find the logfile at C:\AdwCleaner[Sn].txt as well - n is the order number.

Read other 9 answers
RELEVANCY SCORE 38.4

I installed RT Seven Lite Software for making my own Windows 7 custom ISO. I loaded official Windows 7 ISO into RT Seven lite and started editing, But for some reason i stopped working on that. The problems is i uninstalled RT Seven Lite and i thought the windows files i was working on will be delete automatically but this didn't happened. Now i have left over windows 7 setup files that i can't delete. When i delete files it gives error '' You require permission from administrators to make changes to this file/folders''. But i am on administrative account.
And even if i try to change ownership of files/folders the options are not accessible. Only Trustedinstaller have full control on files. (My English is not good so please watch video to understand my problem)

Details - YouTube

I even tried to use Linux Fedora OS to delete those files but still failed. Those files took 32GB size on my HardDrive. I don't want to format my drive.Help please

A:Can not delete RT7lite's leftover files

Have you tried this one? Add "Take Ownership" to Explorer Right-Click Menu in Win 7 or Vista
99% of times that's all that's needed here to get rid of stuff. But a (very) few times had to manually add\edit owner in 'Advanced Security Settings', info here Permissions - Allow or Deny Users and Groups

btw, in case it's something very special to your program, try a ticket on RT Seven support?

Read other 3 answers
RELEVANCY SCORE 38.4

I recently did a lossless re-install of Windows 7 on my machine, which placed my old data onto a folder called "Windows.Old", allowing me to totally restore everything. However, doing this generated a few folders that I can't seem to do anything with. I was able to remove most of them through the use of the Delete Invalid File application, but not even that is able to clear the last two folders:

My old Users folder, and my old ProgramData folder.

No matter what I do, these files are totally locked. I was able to move them to the desktop, but beyond that, they are being stubborn. Every time I try to delete them normally, I get the following message:



This is after I get a popup to allow administrative rights on the aforementioned folder. No matter what I do, this message will always pop up and bar me from deleting the folders.

Here's a list of all the things I've tried:

Changing file ownership.
Deleting individual files within the folders.
Disabling User Account Control notifications.
Fiddling with administrative details.
Deleting the folders through the use of Delete Invalid File.
Moving the folders to new locations.

None of these work. I can't remove the files at all. They're stuck, sitting on my desktop, taunting me as they use up my already tightly constrained HDD space.


How do I get rid of these pesky old files?

A:Impossible to delete leftover folders

Try Unlocker:
Download Unlocker 1.9.2 - FileHippo.com

edit: No need to use the Direct Download link on FileHippo's website. They abandoned that. Just use the green rectangle shown in the screenshot below.
Just be sure to uncheck the other junk it offers to install:

Once installed...
...right click on the folder of interest
...select Unlocker from the context menu
Deal with the User Account Control - if needed.

Once Unlocker opens...
If nothing is locking the folder(s)...
...select Delete from the drop down menu in the lower left part of the window
...then click on the button named OK.

If something is locking the folder(s)...
...select Delete from the drop down menu in the lower left part of the window
...then click on the button named Unlock All.

Be careful. Unlocker is powerful and dangerous. You might want to uninstall it after using it.

Read other 7 answers
RELEVANCY SCORE 38.4

'evening

I've got several programs that I've uninstalled in the past that haven't removed themselves from the registry(or so I assume). Things like WinAmp (2 and 3..). Doesn't exist on my computer but windows still believes it to be the default player for certain files. A while back on the forums I saw a link to a program that would remove these little leftovers without requiring the user (me) to use regedit, which I'm not comfortable with, but I can't for the life of me remember what it was. Any suggestions?

Viverr

-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-

Running Windows XP Sp1, P4 1.6 mobile
 

A:Removing leftover registry values?

I use all these .

RegSeeker
http://www.hoverdesk.net/freeware.htm
RegSeeker is a perfect companion for your Windows regsitry !
RegSeeker includes a powerful registry cleaner and can display various informations like your
startup entries, several histories (even index.dat files), installed applications and much
more ! With RegSeeker you can search for any item inside your registry, export/delete the
results, open them in the registry. RegSeeker also includes a tweaks panel to optimize your
OS !

RegSeeker is FREE for personal use only !

Click on Clean the Registry & tick > Scan Drives for old exe entries in the registry. Click OK.
My personal use , is to delete only the Green entries .
Left click to highlight , hold the Shift key down , to highlght bulk Green entries .
Right click to delete .

=========================================

jv16 PowerTools 1.3.0.195 , which doesn't expire , is available here:
http://spazioinwind.libero.it/puntocr/dwl/jv16pt_setup.exe
http://down.hengshui.com/download.asp?downid=1&id=726 .
Click on Registry Tool > Tools > Registry Cleaner > Continue > Start .
When finished , Click on Select > Special select > Items that should be safe to remove > Remove.

==================================

OleClean ( Freeware . I tick all the boxes in Options ) from ,
http://www.majorgeeks.com/showfiles.php?cat=15
http://www.geocities.com/maurizioferreira/oleclean.html
http://www.google.com/search?hl=en&q=oleclean
h... Read more

Read other 1 answers
RELEVANCY SCORE 38.4

Hi ... I have uninstalled a software program through Add/Remove. The program did uninstall, HOWEVER, the name of the software remained in the Add/Remove list and is blank. I tried reinstalling the program and then uninstalling it again hoping it would fix the problem but it never. Now there are two name the same left in Add/Remove. The software was for a Canon camera & I have Windows XP. Hoping someone can help. Thanks
 

A:Delete leftover names in Add/Remove

To remove the invalid/orphaned entries from the Add/Remove applet manually [Windows 2000/XP]

1. Start Registry Editor (Regedit.exe).
2. Locate the following key in the registry:
3. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
4. Make sure you backup the keys by exporting them to a .reg file.
5. Look for the name of the program with the orphaned entry.
6. Delete the entire listing for the software with the orphaned entry.
7. Close the registry editor.
8. Restart your computer.
 

Read other 1 answers
RELEVANCY SCORE 38.4

Hi, i'm trying to understand what these folders are for, they are on my non system drive, i'm guessing they are left over from a previous windows installation. when I try to remove them it says I have no permission to modify them. How would I go about deleting them?

 

A:Removing leftover system files

To help us help you,please use the TSG System Info tool to let Tech's know the specs of your computer: http://static.techguy.org/download/SysInfo.exe Copy and paste the results here in your thread. You can use the TSG Info to fill in your computer information in your user profile as well.

Also, if its a brand name system like an Acer,Dell or HP, please post the exact model of the system.
 

Read other 1 answers
RELEVANCY SCORE 38.4

I removed mcafee using add/remove programs under the control panel. although i got the message that the uninstall was successful, there are still some things in the start.ini referring to this program. should i remove these using regedit. also will it help in getting rid of a conflict i'm having with other programs already on my computer?
 

A:using regedit to remove leftover files

If you are not real familiar with the registry, I suggest you download RegEditPlus.. a freeware program which provides the same service as windows regedit, but provides backup in case you make an error.
Then, in registry click 'C' and Find, enter any references to McAfee and use the delete button at the extreme top of panel on any that are found.
Download at:
http://www.pcmag.com/article2/0,4149,53887,00.asp
or -
www.zdnet.de/download/library/deAVB-wc.htm
 

Read other 2 answers
RELEVANCY SCORE 38.4

I uninstalled AOL 9.0 off of all of my computers (because it sucks). I scanned all of them with a few Registry Cleaners (Ace Utilities, System Suite, and RegScrubXP). Then I opened regedit and searched for all entries with AOL in it an got a ton of left over entries.

I was wondering why these Registry Cleaners didn't get them.

But I do have AIM and I am thinking some entries belong to that so I don't know what to delete.

Any Help?
~ Thanks, 2madre
 

A:AOL leftover registry entries after uninstall

Read other 6 answers
RELEVANCY SCORE 38.4

I've tried many times but they wont go away. I have a screenshot of the issue.

I've had a previous issue where I was losing disk space for no reason. I don't know if this had anything to with it, but I still have that issue even though I've tried everything. I've backed up my personal data so it's no big issue.

The issue right now is that I can't remove some of the malware that Hitmanpro had detected. I can't find them anywhere on the computer and CltMngSvc isn't even on the task manager.
 

Read other answers
RELEVANCY SCORE 38.4

Last night I got a nasty case of the Virusbursters disease. I'm running a fully updated Windows XP. I followed the "How To Remove Virusbursters" instructions for the automatic removal, and that seemed to help. Then suddenly the whole thing started over again. Then I tried following the manual removal instructions, but none of the dll files that I was supposed to remove were present. Then I read somewhere that Prevx would get rid of it, so I used the Prevx software and that did seem to get rid of Virusbursters. Although it did leave an entry for it on my quickstart bar and my Add/Remove Programs list. Unfortunately, a range of other stuff has been popping up. Random IE pop-up windows and even Firefox tabs coming up with ads for porn and music sites, and most of all for BS anti-virus programs. One repeat offender is something like Win Anti-VirusPro, or something like that. Also, Windows Explorer has been crashing, leaving me with a blank desktop. [Edit - I see others are having issues with this as well. Also, one bit I forgot - my Norton Anti-Virus periodically gives me the "A virus tried to do something, but I stopped it" pop-up message. The virus is always some random name.exe, and never the same one twice.] I have run the following: Spybot S&D (found and removed a bunch of stuff) Ad-Aware (found and removed some stuff) Panda Scan (found a ton of spyware, over a thousand files, according to the scan, but the free version wouldn't clean them) Windows ... Read more

A:Virusbursters - Leftover Problems After Removal

For added, reference, here's my rapport.txt after running a SmitFraudFix search.

SmitFraudFix v2.124

Scan done at 22:06:23.92, Sun 11/26/2006
Run from C:\Documents and Settings\Ed\Desktop
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
Fix run in normal mode

???????????????????????? C:\
???????????????????????? C:\WINDOWS
???????????????????????? C:\WINDOWS\system
???????????????????????? C:\WINDOWS\Web
???????????????????????? C:\WINDOWS\system32

C:\WINDOWS\system32\ot.ico FOUND !
C:\WINDOWS\system32\components\flx?.dll FOUND !
C:\WINDOWS\system32\components\flx??.dll FOUND !
C:\WINDOWS\system32\components\flx???.dll FOUND !

???????????????????????? C:\WINDOWS\system32\LogFiles
???????????????????????? C:\Documents and Settings\Ed
???????????????????????? C:\Documents and Settings\Ed\Application Data
???????????????????????? Start Menu

C:\DOCUME~1\ALLUSE~1\STARTM~1\Online Security Guide.url FOUND !
C:\DOCUME~1\ALLUSE~1\STARTM~1\Security Troubleshooting.url FOUND !

???????????????????????? C:\DOCUME~1\Ed\FAVORI~1

C:\DOCUME~1\Ed\FAVORI~1\Antivirus Test Online.url FOUND !

???????????????????????? Desktop
???????????????????????? C:\Program Files

C:\Program Files�... Read more

Read other 22 answers
RELEVANCY SCORE 38.4

Hi all,My computer had a virus until recently when I thought I removed it. Now the computer works fine ... for about 10 minutes before freezing. Is there anything in my logfile that shouldn't be there? Thanks in advance!ChadLogfile of Trend Micro HijackThis v2.0.3 (BETA)Scan saved at 4:27:23 AM, on 3/9/2010Platform: Windows XP SP3 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)Boot mode: NormalRunning processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\Windows Defender\MsMpEng.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\Common Files\Microsoft Shared\Ink\KeyboardSurrogate.exeC:\Program Files\Intel\Wireless\Bin\EvtEng.exeC:\Program Files\Intel\Wireless\Bin\S24EvMon.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\SYSTEM32\WISPTIS.EXEC:\WINDOWS\System32\tabbtnu.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\system32\ctfmon.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\system32\netdde.exeC:\Program Files\Common Files\Adobe Systems Shared\Service\... Read more

A:Random freezes, leftover virus

Hello and welcome to Bleeping ComputerWe apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine. If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.Upon completing the steps below another staff member will review and take the steps necessary with you to get your machine back in working order clean and free of malware.If you have already posted a DDS log, please do so again, as your situation may have changed.Use the 'Add Reply' and add the new log to this thread.Thanks and again sorry for the delay.We need to see some information about what is happening in your machine. Please perform the following scan:Download DDS by sUBs from one of the following links. Save it to your desktop.DDS.scrDDS.pifDouble click on the DDS icon, allow it to run.A small box will open, with an explaination about the tool. No input is needed, the scan is running.Notepad will open with the results.Foll... Read more

Read other 2 answers
RELEVANCY SCORE 38.4

Trojan installed fake security program without warning, disabled task manager and then bluescreened. Restarted and ran malawarebytes and was able to quarantine most of the files. Google was being redirected, so I ran CWShredder and fixed that, sort of. Now google only randomly redirects when I click on some links in search. Ran RootRepeal and have a log for that as well which shows some issues.
DDS (Ver_09-12-01.01) - NTFSx86
Run by ERIKA at 14:42:01.15 on Tue 12/22/2009
Internet Explorer: 7.0.5730.11 BrowserJavaVersion: 1.6.0_17
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1023.560 [GMT -5:00]
============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe -k imgsvc
c:\WINDOWS\system32\ZuneBusEnum.exe
C:\Program Files\Zune\ZuneLauncher.exe
C:\Program Files\Java ... Read more

A:Leftover Vundo.H trojan issues

Hello and welcome to Bleeping Computer! We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine. If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.Upon completing the steps below another staff member will review and take the steps necessary with you to get your machine back in working order clean and free of malware.If you have already posted a DDS log, please do so again, as your situation may have changed.Use the 'Add Reply' and add the new log to this thread.Thanks and again sorry for the delay.We need to see some information about what is happening in your machine. Please perform the following scan:Download DDS by sUBs from one of the following links. Save it to your desktop.DDS.scrDDS.pifDouble click on the DDS icon, allow it to run.A small box will open, with an explaination about the tool. No input is needed, the scan is running.Notepad will open with the results.Fo... Read more

Read other 2 answers