Malware Removal Forums

spyware problem

helen.bicari · 2008-03-24T09:42:29+00:00

hi, i have a problem with my computer. it is running fine, not being slow or anything, but often im being redirected to uk.celldrado.com and another websites like life insuarance. also sometimes warning like your computer is at risk, downloald antispyware comes up. if i click on cross to cancel it, it still wants open and run this file. and then opens web site where i can download that antispyware.i run 3x antispyware ad-aware, spybot-search&destroy and superantispyware, also avast antivirus and ouldnt find anything. i hijacked my computer and this is the result: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Pr

27 min read

chryssi2001 MRU Teacher Emeritus

March 31, 2008, 12:28 PM UTC

Hi helen,

You already created a new restore point.
Don't use cleanmgr as this confused you.

Follow these instructions they are more easy to do:
These instructions will create a new restore point and flush away all the previous ones.

1. Turn off System Restore.

On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.

2. Reboot.

3. Turn ON System Restore.

On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
UN-Check *Turn off System Restore*.
Click Apply, and then click OK.

helen.bicari

March 31, 2008, 4:24 PM UTC

hi chryssi, i did the restore like u told me and i tried to download that tool but when i click on it it directs me to site saying
Windows Registry Editor Version 5.00

[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Uninstall]
"NoRemovePage"=dword:00000001

chryssi2001 MRU Teacher Emeritus

March 31, 2008, 5:09 PM UTC

Hello helen,

Please click on the tool link i gave you and save it at your desktop.
Then double click on it.
It should work.

helen.bicari

March 31, 2008, 5:31 PM UTC

Download and Run this tool and tell me if any changes in your Add/Remove programs.

the think is, when i click on tool, it opens that website i sent u before

there was not any other link

chryssi2001 MRU Teacher Emeritus

March 31, 2008, 5:43 PM UTC

helen, when i double click or click HERE
it gives me a file to save. Do you get a link only?

That's strange. Please give it another try.

If the tool still doesn't work please follow the steps below:

Copy/paste the following quote box into a new notepad (not wordpad) document.

regedit /e C:\look.txt "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"

start notepad C:\look.txt

Save it to your Desktop as look.txt. Save it as File Type: All Files (not as a text document or it wont work).
Save it as filename: look.txt

Locate look.txt on your Desktop and double-click it.
When Notepad opens, copy/paste the content in your reply.
When you close Notepad, the CMD window will close automatically and the text file will be deleted.

helen.bicari

March 31, 2008, 5:53 PM UTC

hi chryssi, yes, when i click on it, it opens link not file to save, so im gonna follow the other option

helen.bicari

March 31, 2008, 5:58 PM UTC

here is the notepad.

regedit /e C:\look.txt "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"

chryssi2001 MRU Teacher Emeritus

March 31, 2008, 6:52 PM UTC last edited March 31, 2008, 8:18 PM UTC

Hi helen, can you please re-try?

I made a small mistake.

Copy/paste the following quote box into a new notepad (not wordpad) document.

regedit /e look.txt "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
start notepad look.txt
del /q look.txt

Save it to your Desktop as look.bat. Save it as File Type: All Files (not as a text document or it wont work).

Locate look.bat on your Desktop and double-click it.
When Notepad opens, copy/paste the content in your reply.
When you close Notepad, the CMD window will close automatically and the text file will be deleted.

helen.bicari

March 31, 2008, 7:45 PM UTC

hiya, well when i click on look.bat it opens black box but closes fast, so i dont have time to read it and then note pad opens with warning: cannot find the C:/look.txt file do you want to create new file?

chryssi2001 MRU Teacher Emeritus

March 31, 2008, 8:31 PM UTC

Can you retry please? I've changed it slightly.

helen.bicari

March 31, 2008, 9:18 PM UTC

still same, sorry

any idea why?

chryssi2001 MRU Teacher Emeritus

April 1, 2008, 4:37 AM UTC

helen, sorry about this, i am not sure what's wrong with the batch file.

Please remove them all into the recycle-bin.

There is a possibility you don't have this registry key on your pc.
Can you try this please?
Just to let you know i am trying to export the registry key which affects those programs in your Add/Remove programs which don't give you the option to uninstall them.

Please download RegQuery by Noviciate to your desktop

Copy the following registry keypath by highlighting the text and pressing CTRL and C at the same time
Double click RegQuery.exe to run the program
Paste the text you have copied using CRTL and V, into the textbox
Click the Query button
A Notepad file will open. Please paste the contents in your next reply
You may now close the RegQuery program

helen.bicari

April 1, 2008, 8:05 AM UTC

hi chryssi, you dont have to say sorry, you are helping me very much and its not yor fault its not working. i just wanted to ask. i have registry mechanic on cd. shall i install it and clean my registry? here is the log from regquery

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Shockwave Player]
@=""
"DisplayName"="Adobe Shockwave Player 11"
"UninstallString"="C:\\WINDOWS\\system32\\adobe\\SHOCKW~1\\UNWISE.EXE C:\\WINDOWS\\system32\\Adobe\\SHOCKW~1\\Install.log"
"DisplayVersion"="11"
"Publisher"="Adobe Systems, Inc."
"URLInfoAbout"="http://www.adobe.com"
"InstallLocation"="C:\\WINDOWS\\system32\\Adobe\\"
"VersionMajor"=dword:0000000b
"VersionMinor"=dword:00000000
"DisplayIcon"="C:\\WINDOWS\\system32\\Adobe\\Shockwave 11\\SwInit.exe,0"
"HelpLink"="http://www.adobe.com/support/shockwave"
"URLUpdateInfo"="http://www.adobe.com/software/shockwaveplayer/index.html"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\avast!]
"DisplayName"="avast! Antivirus"
"DisplayVersion"="4.8"
"HelpLink"="http://www.avast.com"
"HelpTelephone"=""
"UrlInfoAbout"="http://www.avast.com"
"UrlUpdateInfo"="http://www.avast.com"
"InstallLocation"="C:\\PROGRA~1\\ALWILS~1\\Avast4"
"InstallSource"="C:\\PROGRA~1\\ALWILS~1\\Avast4\\setup"
"Publisher"="Alwil Software"
"VersionMajor"=dword:00000004
"VersionMinor"=dword:00000008
"DisplayIcon"="C:\\Program Files\\Alwil Software\\Avast4\\ashAvast.exe"
"UninstallString"="C:\\Program Files\\Alwil Software\\Avast4\\aswRunDll.exe \"C:\\Program Files\\Alwil Software\\Avast4\\Setup\\setiface.dll\",RunSetup"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HijackThis]
"DisplayName"="HijackThis 2.0.2"
"UninstallString"="\"C:\\Program Files\\Trend Micro\\HijackThis\\HijackThis.exe\" /uninstall"
"DisplayIcon"="C:\\Program Files\\Trend Micro\\HijackThis\\HijackThis.exe"
"DisplayVersion"="2.0.2"
"Publisher"="TrendMicro"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Kaspersky Online Scanner]
"DisplayName"="Kaspersky Online Scanner"
"DisplayIcon"="C:\\WINDOWS\\system32\\Kaspersky Lab\\Kaspersky Online Scanner\\kavuninstall.exe"
"UninstallString"="C:\\WINDOWS\\system32\\Kaspersky Lab\\Kaspersky Online Scanner\\kavuninstall.exe"
"DisplayVersion"="5.0"
"InstallLocation"="C:\\WINDOWS\\system32\\Kaspersky Lab\\Kaspersky Online Scanner"
"URLInfoAbout"="http://www.kaspersky.com"
"URLUpdateInfo"="http://www.kaspersky.com/updates.asp"
"Contact"="Customer Support Department"
"HelpLink"="http://support.kaspersky.com/helpdesk.html?LANG=en"
"Publisher"="Kaspersky Lab"
"NoModify"=dword:00000001
"NoRepair"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Malwarebytes' Anti-Malware_is1]
"Inno Setup: Setup Version"="5.2.3"
"Inno Setup: App Path"="C:\\Program Files\\Malwarebytes' Anti-Malware"
"InstallLocation"="C:\\Program Files\\Malwarebytes' Anti-Malware\\"
"Inno Setup: Icon Group"="Malwarebytes' Anti-Malware"
"Inno Setup: User"="[redacted]"
"Inno Setup: Selected Tasks"="desktopicon,quicklaunchicon"
"Inno Setup: Deselected Tasks"=""
"DisplayName"="Malwarebytes' Anti-Malware"
"UninstallString"="\"C:\\Program Files\\Malwarebytes' Anti-Malware\\unins000.exe\""
"QuietUninstallString"="\"C:\\Program Files\\Malwarebytes' Anti-Malware\\unins000.exe\" /SILENT"
"Publisher"="Malwarebytes"
"URLInfoAbout"="http://www.malwarebytes.org"
"HelpLink"="http://www.malwarebytes.org"
"URLUpdateInfo"="http://www.malwarebytes.org"
"NoModify"=dword:00000001
"NoRepair"=dword:00000001
"InstallDate"="20080329"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Shockwave]
"QuietDisplayName"="Shockwave Director 11.0"
"QuietUninstallString"="RunDll32 advpack.dll,LaunchINFSection C:\\WINDOWS\\\\INF\\\\swdir.inf,DefaultUninstall,5"
"RequiresIESysFile"="4.70.0.1155"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3248F0A8-6813-11D6-A77B-00B0D0160050}]
"DisplayIcon"="C:\\Program Files\\Java\\jre1.6.0_05\\\\bin\\javaws.exe"
"AuthorizedCDFPrefix"=""
"Comments"=""
"Contact"="http://java.com"
"DisplayVersion"="1.6.0.50"
"HelpLink"=hex(2):68,00,74,00,74,00,70,00,3a,00,2f,00,2f,00,6a,00,61,00,76,00,\
61,00,2e,00,63,00,6f,00,6d,00,00,00
"HelpTelephone"=""
"InstallDate"="20080329"
"InstallLocation"=""
"InstallSource"="http://javadl.sun.com/webapps/download/GetFile/1.6.0_05-b13/windows-i586/"
"ModifyPath"=hex(2):4d,00,73,00,69,00,45,00,78,00,65,00,63,00,2e,00,65,00,78,\
00,65,00,20,00,2f,00,49,00,7b,00,33,00,32,00,34,00,38,00,46,00,30,00,41,00,\
38,00,2d,00,36,00,38,00,31,00,33,00,2d,00,31,00,31,00,44,00,36,00,2d,00,41,\
00,37,00,37,00,42,00,2d,00,30,00,30,00,42,00,30,00,44,00,30,00,31,00,36,00,\
30,00,30,00,35,00,30,00,7d,00,00,00
"NoRepair"=dword:00000001
"Publisher"="Sun Microsystems, Inc."
"Readme"=hex(2):43,00,3a,00,5c,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,20,\
00,46,00,69,00,6c,00,65,00,73,00,5c,00,4a,00,61,00,76,00,61,00,5c,00,6a,00,\
72,00,65,00,31,00,2e,00,36,00,2e,00,30,00,5f,00,30,00,35,00,5c,00,52,00,45,\
00,41,00,44,00,4d,00,45,00,2e,00,74,00,78,00,74,00,00,00
"Size"=""
"EstimatedSize"=dword:0001c8de
"UninstallString"=hex(2):4d,00,73,00,69,00,45,00,78,00,65,00,63,00,2e,00,65,00,\
78,00,65,00,20,00,2f,00,49,00,7b,00,33,00,32,00,34,00,38,00,46,00,30,00,41,\
00,38,00,2d,00,36,00,38,00,31,00,33,00,2d,00,31,00,31,00,44,00,36,00,2d,00,\
41,00,37,00,37,00,42,00,2d,00,30,00,30,00,42,00,30,00,44,00,30,00,31,00,36,\
00,30,00,30,00,35,00,30,00,7d,00,00,00
"URLInfoAbout"="http://java.com"
"URLUpdateInfo"="http://java.sun.com"
"VersionMajor"=dword:00000001
"VersionMinor"=dword:00000006
"WindowsInstaller"=dword:00000001
"Version"=dword:01060000
"Language"=dword:00000000
"DisplayName"="Java(TM) 6 Update 5"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-1033-7B44-A81200000003}]
"AuthorizedCDFPrefix"=""
"Comments"=" "
"Contact"="Customer Support"
"DisplayVersion"="8.1.2"
"HelpLink"=hex(2):68,00,74,00,74,00,70,00,3a,00,2f,00,2f,00,77,00,77,00,77,00,\
2e,00,61,00,64,00,6f,00,62,00,65,00,2e,00,63,00,6f,00,6d,00,2f,00,73,00,75,\
00,70,00,70,00,6f,00,72,00,74,00,2f,00,6d,00,61,00,69,00,6e,00,2e,00,68,00,\
74,00,6d,00,6c,00,00,00
"HelpTelephone"=""
"InstallDate"="20080329"
"InstallLocation"="C:\\Program Files\\Adobe\\Reader 8.0\\Reader\\"
"InstallSource"="C:\\DOCUME~1\\HELENK~1\\LOCALS~1\\Temp\\Adobe Reader 8\\"
"ModifyPath"=hex(2):4d,00,73,00,69,00,45,00,78,00,65,00,63,00,2e,00,65,00,78,\
00,65,00,20,00,2f,00,49,00,7b,00,41,00,43,00,37,00,36,00,42,00,41,00,38,00,\
36,00,2d,00,37,00,41,00,44,00,37,00,2d,00,31,00,30,00,33,00,33,00,2d,00,37,\
00,42,00,34,00,34,00,2d,00,41,00,38,00,31,00,32,00,30,00,30,00,30,00,30,00,\
30,00,30,00,30,00,33,00,7d,00,00,00
"NoRepair"=dword:00000001
"Publisher"="Adobe Systems Incorporated"
"Readme"=hex(2):43,00,3a,00,5c,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,20,\
00,46,00,69,00,6c,00,65,00,73,00,5c,00,41,00,64,00,6f,00,62,00,65,00,5c,00,\
52,00,65,00,61,00,64,00,65,00,72,00,20,00,38,00,2e,00,30,00,5c,00,52,00,65,\
00,61,00,64,00,65,00,72,00,5c,00,52,00,65,00,61,00,64,00,6d,00,65,00,2e,00,\
68,00,74,00,6d,00,00,00
"Size"=""
"EstimatedSize"=dword:0002017c
"UninstallString"=hex(2):4d,00,73,00,69,00,45,00,78,00,65,00,63,00,2e,00,65,00,\
78,00,65,00,20,00,2f,00,49,00,7b,00,41,00,43,00,37,00,36,00,42,00,41,00,38,\
00,36,00,2d,00,37,00,41,00,44,00,37,00,2d,00,31,00,30,00,33,00,33,00,2d,00,\
37,00,42,00,34,00,34,00,2d,00,41,00,38,00,31,00,32,00,30,00,30,00,30,00,30,\
00,30,00,30,00,30,00,33,00,7d,00,00,00
"URLInfoAbout"="http://www.adobe.com"
"URLUpdateInfo"="http://www.adobe.com/products/acrobat/readstep.html"
"VersionMajor"=dword:00000008
"VersionMinor"=dword:00000001
"WindowsInstaller"=dword:00000001
"Version"=dword:08010002
"Language"=dword:00000409
"DisplayName"="Adobe Reader 8.1.2"

chryssi2001 MRU Teacher Emeritus

April 1, 2008, 8:17 AM UTC

Hi helen,

hmmmmm i am buffled now. All those programs which don't have then uninstall/remove command should normally show in the script you posted.
I'll have to find another way to see what is happening.
Be patient please.

helen.bicari

April 1, 2008, 8:34 AM UTC

well it is wierd but you said the programs which dont have remove option r not installed but in registry. but some of them like ad-aware or 4 od or windows life messenger or microsoft life webcam dont have the remove option but are in my computer as i use them. and also some other like bs player or windows player or even real player r not in add or remove program, but r in my computer. have u ever heard of anything like that?