Welcome to MalwareRemoval.com,
What if we told you that you could get malware removal help from experts, and that it was 100% free? MalwareRemoval.com provides free support for people with infected computers. Our help, and the tools we use are always 100% free. No hidden catch. We simply enjoy helping others. You enjoy a clean, safe computer.

Malware Removal Instructions

Attack of the popups.... trojan and junk

MalwareRemoval.com provides free support for people with infected computers. Using plain language that anyone can understand, our community of volunteer experts will walk you through each step.

Re: Attack of the popups.... trojan and junk

Unread postby firehooves » November 14th, 2007, 4:24 pm

Deleted all those files :)
C:\Program Files\AdVantage\TR.dll was already gone, because last night I went on a RAMPAGE and deleted all my pictures, any music not in my itunes folder, all my old documents... I removed a lot of the programs on my computer.

I dont have any more problems, just one more question..
a long time ago I downloaded a trial to a game "Armadillo Run". I was sure that I uninstalled it, however it still appears in my "Add/Remove Programs" list and my start menu. When I try to uninstall it, I get the message " File C:\Program Files\Armadillo Run Demo\unins000.dat does not exist. Cannot Uninstall." When I open program files\armadillo run demo the file appears, and i cannot delete it, it says it doesn't exist? Is there any way to get rid of it? If not, thats fine, its not causing me any harm :)

Thank you so much for your help!
User avatar
firehooves
Regular Member
 
Posts: 34
Joined: August 16th, 2006, 9:59 am
Advertisement
Register to Remove

Re: Attack of the popups.... trojan and junk

Unread postby Shaba » November 15th, 2007, 4:55 am

Hi

"I dont have any more problems, just one more question..
a long time ago I downloaded a trial to a game "Armadillo Run". I was sure that I uninstalled it, however it still appears in my "Add/Remove Programs" list and my start menu. When I try to uninstall it, I get the message " File C:\Program Files\Armadillo Run Demo\unins000.dat does not exist. Cannot Uninstall." When I open program files\armadillo run demo the file appears, and i cannot delete it, it says it doesn't exist? Is there any way to get rid of it? If not, thats fine, its not causing me any harm"

Go in HijackThis here:

Open misc tools -> open uninstall manager.

Highlight that entry and click delete that entry.

Did it help?
User avatar
Shaba
Admin/Teacher Emeritus
 
Posts: 26974
Joined: March 24th, 2006, 4:42 am
Location: Finland

Re: Attack of the popups.... trojan and junk

Unread postby Shaba » November 19th, 2007, 6:18 am

firehooves?
User avatar
Shaba
Admin/Teacher Emeritus
 
Posts: 26974
Joined: March 24th, 2006, 4:42 am
Location: Finland

Re: Attack of the popups.... trojan and junk

Unread postby firehooves » November 19th, 2007, 6:19 pm

Sorry, I was away for the weekend!!
I deleted the entry through hijackthis, and it still comes up in the start menu. But it doesnt matter, we dont have to fuss with it, i just wondered if itd be a quick fix.
User avatar
firehooves
Regular Member
 
Posts: 34
Joined: August 16th, 2006, 9:59 am

Re: Attack of the popups.... trojan and junk

Unread postby Shaba » November 20th, 2007, 4:52 am

Hi

"I deleted the entry through hijackthis, and it still comes up in the start menu"

Please download the Registry Search tool by clicking on the "hard drive" icon halfway down this page:
http://www.billsway.com/vbspage/
Save it to the desktop and run it. If you get an alert from your antivirus about scripting, choose to allow the script to run. Search for Armadillo Run and click OK. Post the logfile from the tool here for me.
User avatar
Shaba
Admin/Teacher Emeritus
 
Posts: 26974
Joined: March 24th, 2006, 4:42 am
Location: Finland

Re: Attack of the popups.... trojan and junk

Unread postby firehooves » November 20th, 2007, 8:05 am

REGEDIT4
; RegSrch.vbs © Bill James

; Registry search results for string "Armadillo Run" 11/20/2007 8:03:19 AM

; NOTE: This file will be deleted when you close WordPad.
; You must manually save this file to a new location if you want to refer to it again later.
; (If you save the file with a .reg extension, you can use it to restore any Registry changes you make to these values.)


[HKEY_USERS\S-1-5-21-2831891825-2885365911-1179562763-1007\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\Armadillo Run Demo]

"C:\\Documents and Settings\\nicole\\Local Settings\\Temporary Internet Files\\Content.IE5\\HSPJ4CMS\\setup[2].exe"="setup[2]"
"C:\\Program Files\\Armadillo Run Demo\\unins000.exe"="Setup/Uninstall"
User avatar
firehooves
Regular Member
 
Posts: 34
Joined: August 16th, 2006, 9:59 am

Re: Attack of the popups.... trojan and junk

Unread postby Shaba » November 20th, 2007, 8:10 am

Hi

First we'll need to backup registry:

Start -> Run -> regedit -> ok. Then File -> Export. Give it a name and press Save.

Save text below as fix.reg on Notepad (save it as all files (*.*)) on Desktop

Windows Registry Editor Version 5.00

[-HKEY_USERS\S-1-5-21-2831891825-2885365911-1179562763-1007\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\Armadillo Run Demo]

It should look like this -> Image

Doubleclick fix.reg, press Yes and ok.

(In case you are unsure how to create a reg file, take a look here with screenshots.)

Reboot.

Is it now gone?
User avatar
Shaba
Admin/Teacher Emeritus
 
Posts: 26974
Joined: March 24th, 2006, 4:42 am
Location: Finland

Re: Attack of the popups.... trojan and junk

Unread postby firehooves » November 27th, 2007, 9:51 am

still not gone. (its being awfully stubborn).
its not totally nessecary that we fix it, if it will take too much time
User avatar
firehooves
Regular Member
 
Posts: 34
Joined: August 16th, 2006, 9:59 am

Re: Attack of the popups.... trojan and junk

Unread postby Shaba » November 27th, 2007, 10:56 am

Hi

  • Download Registrar Lite from here and install it.
  • Start Registrar Lite.
  • Type in to Address field this and click ok: HKEY_USERS\S-1-5-21-2831891825-2885365911-1179562763-1007\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\Armadillo Run Demo
  • Right-click that key and choose Properties. Click "Take ownership".
  • Right-click that key again and choose Delete.

Now gone?
User avatar
Shaba
Admin/Teacher Emeritus
 
Posts: 26974
Joined: March 24th, 2006, 4:42 am
Location: Finland

Re: Attack of the popups.... trojan and junk

Unread postby Shaba » December 6th, 2007, 6:08 am

This topic is now closed due to inactivity. If you wish it to be reopened, please send us an email to 'admin at malwareremoval.com' with a link to your thread.

If it has been 10 days or more since your last post, and the helper assisting you posted a response to that post to which you did not reply, this topic will not be reopened. If you still require help, please start a new topic and include a fresh HijackThis log and a link to this thread in your new topic.

You can help support this site from this link :
Donations For Malware Removal

Please do not contact us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
User avatar
Shaba
Admin/Teacher Emeritus
 
Posts: 26974
Joined: March 24th, 2006, 4:42 am
Location: Finland
Advertisement
Register to Remove

Previous

  • Similar Topics
    Replies
    Views
    Last post

Return to Infected? Virus, malware, adware, ransomware, oh my!



Who is online

Users browsing this forum: No registered users and 476 guests

Contact us:

Advertisements do not imply our endorsement of that product or service. Register to remove all ads. The forum is run by volunteers who donate their time and expertise. We make every attempt to ensure that the help and advice posted is accurate and will not cause harm to your computer. However, we do not guarantee that they are accurate and they are to be used at your own risk. All trademarks are the property of their respective owners.

Member site: UNITE Against Malware