Welcome to MalwareRemoval.com,
What if we told you that you could get malware removal help from experts, and that it was 100% free? MalwareRemoval.com provides free support for people with infected computers. Our help, and the tools we use are always 100% free. No hidden catch. We simply enjoy helping others. You enjoy a clean, safe computer.

Malware Removal Instructions

spyware problem

MalwareRemoval.com provides free support for people with infected computers. Using plain language that anyone can understand, our community of volunteer experts will walk you through each step.

Re: spyware problem

Unread postby chryssi2001 » March 31st, 2008, 8:28 am

Hi helen,

You already created a new restore point.
Don't use cleanmgr as this confused you.

Follow these instructions they are more easy to do:
These instructions will create a new restore point and flush away all the previous ones.

1. Turn off System Restore.
  • On the Desktop, right-click My Computer.
  • Click Properties.
  • Click the System Restore tab.
  • Check Turn off System Restore.
  • Click Apply, and then click OK.

2. Reboot.

3. Turn ON System Restore.
  • On the Desktop, right-click My Computer.
  • Click Properties.
  • Click the System Restore tab.
  • UN-Check *Turn off System Restore*.
  • Click Apply, and then click OK.
User avatar
chryssi2001
MRU Teacher Emeritus
 
Posts: 14395
Joined: September 24th, 2006, 2:11 am
Location: far away
Advertisement
Register to Remove

Re: spyware problem

Unread postby helen.bicari » March 31st, 2008, 12:24 pm

hi chryssi, i did the restore like u told me and i tried to download that tool but when i click on it it directs me to site saying
Windows Registry Editor Version 5.00

[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Uninstall]
"NoRemovePage"=dword:00000001
helen.bicari
Regular Member
 
Posts: 47
Joined: March 24th, 2008, 5:24 am

Re: spyware problem

Unread postby chryssi2001 » March 31st, 2008, 1:09 pm

Hello helen,

Please click on the tool link i gave you and save it at your desktop.
Then double click on it.
It should work.
User avatar
chryssi2001
MRU Teacher Emeritus
 
Posts: 14395
Joined: September 24th, 2006, 2:11 am
Location: far away

Re: spyware problem

Unread postby helen.bicari » March 31st, 2008, 1:31 pm

Download and Run this tool and tell me if any changes in your Add/Remove programs.


the think is, when i click on tool, it opens that website i sent u before

there was not any other link
helen.bicari
Regular Member
 
Posts: 47
Joined: March 24th, 2008, 5:24 am

Re: spyware problem

Unread postby chryssi2001 » March 31st, 2008, 1:43 pm

helen, when i double click or click HERE
it gives me a file to save. Do you get a link only?

That's strange. Please give it another try.

If the tool still doesn't work please follow the steps below:

Copy/paste the following quote box into a new notepad (not wordpad) document.

regedit /e C:\look.txt "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"

start notepad C:\look.txt

Save it to your Desktop as look.txt. Save it as File Type: All Files (not as a text document or it wont work).
Save it as filename: look.txt

Locate look.txt on your Desktop and double-click it.
When Notepad opens, copy/paste the content in your reply.
When you close Notepad, the CMD window will close automatically and the text file will be deleted.
User avatar
chryssi2001
MRU Teacher Emeritus
 
Posts: 14395
Joined: September 24th, 2006, 2:11 am
Location: far away

Re: spyware problem

Unread postby helen.bicari » March 31st, 2008, 1:53 pm

hi chryssi, yes, when i click on it, it opens link not file to save, so im gonna follow the other option
helen.bicari
Regular Member
 
Posts: 47
Joined: March 24th, 2008, 5:24 am

Re: spyware problem

Unread postby helen.bicari » March 31st, 2008, 1:58 pm

here is the notepad.

regedit /e C:\look.txt "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
helen.bicari
Regular Member
 
Posts: 47
Joined: March 24th, 2008, 5:24 am

Re: spyware problem

Unread postby chryssi2001 » March 31st, 2008, 2:52 pm

Hi helen, can you please re-try?

I made a small mistake. :(

Copy/paste the following quote box into a new notepad (not wordpad) document.
regedit /e look.txt "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
start notepad look.txt
del /q look.txt

Save it to your Desktop as look.bat. Save it as File Type: All Files (not as a text document or it wont work).

Locate look.bat on your Desktop and double-click it.
When Notepad opens, copy/paste the content in your reply.
When you close Notepad, the CMD window will close automatically and the text file will be deleted.
Last edited by chryssi2001 on March 31st, 2008, 4:18 pm, edited 3 times in total.
User avatar
chryssi2001
MRU Teacher Emeritus
 
Posts: 14395
Joined: September 24th, 2006, 2:11 am
Location: far away

Re: spyware problem

Unread postby helen.bicari » March 31st, 2008, 3:45 pm

hiya, well when i click on look.bat it opens black box but closes fast, so i dont have time to read it and then note pad opens with warning: cannot find the C:/look.txt file do you want to create new file?
helen.bicari
Regular Member
 
Posts: 47
Joined: March 24th, 2008, 5:24 am

Re: spyware problem

Unread postby chryssi2001 » March 31st, 2008, 4:31 pm

Can you retry please? I've changed it slightly.
User avatar
chryssi2001
MRU Teacher Emeritus
 
Posts: 14395
Joined: September 24th, 2006, 2:11 am
Location: far away

Re: spyware problem

Unread postby helen.bicari » March 31st, 2008, 5:18 pm

still same, sorry

any idea why?
helen.bicari
Regular Member
 
Posts: 47
Joined: March 24th, 2008, 5:24 am

Re: spyware problem

Unread postby chryssi2001 » April 1st, 2008, 12:37 am

helen, sorry about this, i am not sure what's wrong with the batch file.

Please remove them all into the recycle-bin.

There is a possibility you don't have this registry key on your pc.
Can you try this please?
Just to let you know i am trying to export the registry key which affects those programs in your Add/Remove programs which don't give you the option to uninstall them.

Please download RegQuery by Noviciate to your desktop
  • Copy the following registry keypath by highlighting the text and pressing CTRL and C at the same time
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
  • Double click RegQuery.exe to run the program
  • Paste the text you have copied using CRTL and V, into the textbox
  • Click the Query button
  • A Notepad file will open. Please paste the contents in your next reply
  • You may now close the RegQuery program
User avatar
chryssi2001
MRU Teacher Emeritus
 
Posts: 14395
Joined: September 24th, 2006, 2:11 am
Location: far away

Re: spyware problem

Unread postby helen.bicari » April 1st, 2008, 4:05 am

hi chryssi, you dont have to say sorry, you are helping me very much and its not yor fault its not working. i just wanted to ask. i have registry mechanic on cd. shall i install it and clean my registry? here is the log from regquery


Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Shockwave Player]
@=""
"DisplayName"="Adobe Shockwave Player 11"
"UninstallString"="C:\\WINDOWS\\system32\\adobe\\SHOCKW~1\\UNWISE.EXE C:\\WINDOWS\\system32\\Adobe\\SHOCKW~1\\Install.log"
"DisplayVersion"="11"
"Publisher"="Adobe Systems, Inc."
"URLInfoAbout"="http://www.adobe.com"
"InstallLocation"="C:\\WINDOWS\\system32\\Adobe\\"
"VersionMajor"=dword:0000000b
"VersionMinor"=dword:00000000
"DisplayIcon"="C:\\WINDOWS\\system32\\Adobe\\Shockwave 11\\SwInit.exe,0"
"HelpLink"="http://www.adobe.com/support/shockwave"
"URLUpdateInfo"="http://www.adobe.com/software/shockwaveplayer/index.html"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\avast!]
"DisplayName"="avast! Antivirus"
"DisplayVersion"="4.8"
"HelpLink"="http://www.avast.com"
"HelpTelephone"=""
"UrlInfoAbout"="http://www.avast.com"
"UrlUpdateInfo"="http://www.avast.com"
"InstallLocation"="C:\\PROGRA~1\\ALWILS~1\\Avast4"
"InstallSource"="C:\\PROGRA~1\\ALWILS~1\\Avast4\\setup"
"Publisher"="Alwil Software"
"VersionMajor"=dword:00000004
"VersionMinor"=dword:00000008
"DisplayIcon"="C:\\Program Files\\Alwil Software\\Avast4\\ashAvast.exe"
"UninstallString"="C:\\Program Files\\Alwil Software\\Avast4\\aswRunDll.exe \"C:\\Program Files\\Alwil Software\\Avast4\\Setup\\setiface.dll\",RunSetup"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HijackThis]
"DisplayName"="HijackThis 2.0.2"
"UninstallString"="\"C:\\Program Files\\Trend Micro\\HijackThis\\HijackThis.exe\" /uninstall"
"DisplayIcon"="C:\\Program Files\\Trend Micro\\HijackThis\\HijackThis.exe"
"DisplayVersion"="2.0.2"
"Publisher"="TrendMicro"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Kaspersky Online Scanner]
"DisplayName"="Kaspersky Online Scanner"
"DisplayIcon"="C:\\WINDOWS\\system32\\Kaspersky Lab\\Kaspersky Online Scanner\\kavuninstall.exe"
"UninstallString"="C:\\WINDOWS\\system32\\Kaspersky Lab\\Kaspersky Online Scanner\\kavuninstall.exe"
"DisplayVersion"="5.0"
"InstallLocation"="C:\\WINDOWS\\system32\\Kaspersky Lab\\Kaspersky Online Scanner"
"URLInfoAbout"="http://www.kaspersky.com"
"URLUpdateInfo"="http://www.kaspersky.com/updates.asp"
"Contact"="Customer Support Department"
"HelpLink"="http://support.kaspersky.com/helpdesk.html?LANG=en"
"Publisher"="Kaspersky Lab"
"NoModify"=dword:00000001
"NoRepair"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Malwarebytes' Anti-Malware_is1]
"Inno Setup: Setup Version"="5.2.3"
"Inno Setup: App Path"="C:\\Program Files\\Malwarebytes' Anti-Malware"
"InstallLocation"="C:\\Program Files\\Malwarebytes' Anti-Malware\\"
"Inno Setup: Icon Group"="Malwarebytes' Anti-Malware"
"Inno Setup: User"="HELENKA A MONDI"
"Inno Setup: Selected Tasks"="desktopicon,quicklaunchicon"
"Inno Setup: Deselected Tasks"=""
"DisplayName"="Malwarebytes' Anti-Malware"
"UninstallString"="\"C:\\Program Files\\Malwarebytes' Anti-Malware\\unins000.exe\""
"QuietUninstallString"="\"C:\\Program Files\\Malwarebytes' Anti-Malware\\unins000.exe\" /SILENT"
"Publisher"="Malwarebytes"
"URLInfoAbout"="http://www.malwarebytes.org"
"HelpLink"="http://www.malwarebytes.org"
"URLUpdateInfo"="http://www.malwarebytes.org"
"NoModify"=dword:00000001
"NoRepair"=dword:00000001
"InstallDate"="20080329"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Shockwave]
"QuietDisplayName"="Shockwave Director 11.0"
"QuietUninstallString"="RunDll32 advpack.dll,LaunchINFSection C:\\WINDOWS\\\\INF\\\\swdir.inf,DefaultUninstall,5"
"RequiresIESysFile"="4.70.0.1155"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3248F0A8-6813-11D6-A77B-00B0D0160050}]
"DisplayIcon"="C:\\Program Files\\Java\\jre1.6.0_05\\\\bin\\javaws.exe"
"AuthorizedCDFPrefix"=""
"Comments"=""
"Contact"="http://java.com"
"DisplayVersion"="1.6.0.50"
"HelpLink"=hex(2):68,00,74,00,74,00,70,00,3a,00,2f,00,2f,00,6a,00,61,00,76,00,\
61,00,2e,00,63,00,6f,00,6d,00,00,00
"HelpTelephone"=""
"InstallDate"="20080329"
"InstallLocation"=""
"InstallSource"="http://javadl.sun.com/webapps/download/GetFile/1.6.0_05-b13/windows-i586/"
"ModifyPath"=hex(2):4d,00,73,00,69,00,45,00,78,00,65,00,63,00,2e,00,65,00,78,\
00,65,00,20,00,2f,00,49,00,7b,00,33,00,32,00,34,00,38,00,46,00,30,00,41,00,\
38,00,2d,00,36,00,38,00,31,00,33,00,2d,00,31,00,31,00,44,00,36,00,2d,00,41,\
00,37,00,37,00,42,00,2d,00,30,00,30,00,42,00,30,00,44,00,30,00,31,00,36,00,\
30,00,30,00,35,00,30,00,7d,00,00,00
"NoRepair"=dword:00000001
"Publisher"="Sun Microsystems, Inc."
"Readme"=hex(2):43,00,3a,00,5c,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,20,\
00,46,00,69,00,6c,00,65,00,73,00,5c,00,4a,00,61,00,76,00,61,00,5c,00,6a,00,\
72,00,65,00,31,00,2e,00,36,00,2e,00,30,00,5f,00,30,00,35,00,5c,00,52,00,45,\
00,41,00,44,00,4d,00,45,00,2e,00,74,00,78,00,74,00,00,00
"Size"=""
"EstimatedSize"=dword:0001c8de
"UninstallString"=hex(2):4d,00,73,00,69,00,45,00,78,00,65,00,63,00,2e,00,65,00,\
78,00,65,00,20,00,2f,00,49,00,7b,00,33,00,32,00,34,00,38,00,46,00,30,00,41,\
00,38,00,2d,00,36,00,38,00,31,00,33,00,2d,00,31,00,31,00,44,00,36,00,2d,00,\
41,00,37,00,37,00,42,00,2d,00,30,00,30,00,42,00,30,00,44,00,30,00,31,00,36,\
00,30,00,30,00,35,00,30,00,7d,00,00,00
"URLInfoAbout"="http://java.com"
"URLUpdateInfo"="http://java.sun.com"
"VersionMajor"=dword:00000001
"VersionMinor"=dword:00000006
"WindowsInstaller"=dword:00000001
"Version"=dword:01060000
"Language"=dword:00000000
"DisplayName"="Java(TM) 6 Update 5"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-1033-7B44-A81200000003}]
"AuthorizedCDFPrefix"=""
"Comments"=" "
"Contact"="Customer Support"
"DisplayVersion"="8.1.2"
"HelpLink"=hex(2):68,00,74,00,74,00,70,00,3a,00,2f,00,2f,00,77,00,77,00,77,00,\
2e,00,61,00,64,00,6f,00,62,00,65,00,2e,00,63,00,6f,00,6d,00,2f,00,73,00,75,\
00,70,00,70,00,6f,00,72,00,74,00,2f,00,6d,00,61,00,69,00,6e,00,2e,00,68,00,\
74,00,6d,00,6c,00,00,00
"HelpTelephone"=""
"InstallDate"="20080329"
"InstallLocation"="C:\\Program Files\\Adobe\\Reader 8.0\\Reader\\"
"InstallSource"="C:\\DOCUME~1\\HELENK~1\\LOCALS~1\\Temp\\Adobe Reader 8\\"
"ModifyPath"=hex(2):4d,00,73,00,69,00,45,00,78,00,65,00,63,00,2e,00,65,00,78,\
00,65,00,20,00,2f,00,49,00,7b,00,41,00,43,00,37,00,36,00,42,00,41,00,38,00,\
36,00,2d,00,37,00,41,00,44,00,37,00,2d,00,31,00,30,00,33,00,33,00,2d,00,37,\
00,42,00,34,00,34,00,2d,00,41,00,38,00,31,00,32,00,30,00,30,00,30,00,30,00,\
30,00,30,00,30,00,33,00,7d,00,00,00
"NoRepair"=dword:00000001
"Publisher"="Adobe Systems Incorporated"
"Readme"=hex(2):43,00,3a,00,5c,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,20,\
00,46,00,69,00,6c,00,65,00,73,00,5c,00,41,00,64,00,6f,00,62,00,65,00,5c,00,\
52,00,65,00,61,00,64,00,65,00,72,00,20,00,38,00,2e,00,30,00,5c,00,52,00,65,\
00,61,00,64,00,65,00,72,00,5c,00,52,00,65,00,61,00,64,00,6d,00,65,00,2e,00,\
68,00,74,00,6d,00,00,00
"Size"=""
"EstimatedSize"=dword:0002017c
"UninstallString"=hex(2):4d,00,73,00,69,00,45,00,78,00,65,00,63,00,2e,00,65,00,\
78,00,65,00,20,00,2f,00,49,00,7b,00,41,00,43,00,37,00,36,00,42,00,41,00,38,\
00,36,00,2d,00,37,00,41,00,44,00,37,00,2d,00,31,00,30,00,33,00,33,00,2d,00,\
37,00,42,00,34,00,34,00,2d,00,41,00,38,00,31,00,32,00,30,00,30,00,30,00,30,\
00,30,00,30,00,30,00,33,00,7d,00,00,00
"URLInfoAbout"="http://www.adobe.com"
"URLUpdateInfo"="http://www.adobe.com/products/acrobat/readstep.html"
"VersionMajor"=dword:00000008
"VersionMinor"=dword:00000001
"WindowsInstaller"=dword:00000001
"Version"=dword:08010002
"Language"=dword:00000409
"DisplayName"="Adobe Reader 8.1.2"
helen.bicari
Regular Member
 
Posts: 47
Joined: March 24th, 2008, 5:24 am

Re: spyware problem

Unread postby chryssi2001 » April 1st, 2008, 4:17 am

Hi helen,

hmmmmm i am buffled now. All those programs which don't have then uninstall/remove command should normally show in the script you posted.
I'll have to find another way to see what is happening.
Be patient please. ;)
User avatar
chryssi2001
MRU Teacher Emeritus
 
Posts: 14395
Joined: September 24th, 2006, 2:11 am
Location: far away

Re: spyware problem

Unread postby helen.bicari » April 1st, 2008, 4:34 am

well it is wierd but you said the programs which dont have remove option r not installed but in registry. but some of them like ad-aware or 4 od or windows life messenger or microsoft life webcam dont have the remove option but are in my computer as i use them. and also some other like bs player or windows player or even real player r not in add or remove program, but r in my computer. have u ever heard of anything like that?
helen.bicari
Regular Member
 
Posts: 47
Joined: March 24th, 2008, 5:24 am
Advertisement
Register to Remove

PreviousNext

  • Similar Topics
    Replies
    Views
    Last post

Return to Infected? Virus, malware, adware, ransomware, oh my!



Who is online

Users browsing this forum: No registered users and 90 guests

Contact us:

Advertisements do not imply our endorsement of that product or service. Register to remove all ads. The forum is run by volunteers who donate their time and expertise. We make every attempt to ensure that the help and advice posted is accurate and will not cause harm to your computer. However, we do not guarantee that they are accurate and they are to be used at your own risk. All trademarks are the property of their respective owners.

Member site: UNITE Against Malware