A PC I have been charged with sorting out has one remaining problem.
At one time there was iMesh on it. It had been removed, but an error as follows still remains upon boot.
RUNDLL
Error loading C:\Progra~1\Uninsta~1.dll
The specified module could not be found.
Now, the plot thickened. I have used Ccleaner and Hijack this to see the processes that startup and have removed the entry in HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce.
Reboot, fine...no recurrence.
Reboot again, ITS BACK. Same place as I removed it from before.
I have used Spysweeper, Panda ActiveScan, Spyhunter, Spybot, Adaware and a few other things but nothing comes up with owt that does anything but remove this key.
I have now run out of ideas as I have removed every registry entry, file on the PC and uninstalled it as well as cleaned the registry but nothing stops this from coming back.
If anyone knows of this error I would be most grateful as to how to get rid of it.
Cheers
Tongy
an executable that keeps rewriting the registry ? Can u log reg changes and see which proggy did it ?
A couple more ideas I have had since the BHO idea from eairlier...
check that the machine is using explorer.exe at:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell\
Also check that the version and date modified of the explorer.exe on the machine is the same as one on an uninfected machine.
Also check the [boot] section of system.ini for anything untoward, on XP there shouldnt be anything in there (afaik).
Finally check each of these (before rebooting):
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce\
HKLU\Software\Microsoft\Windows\CurrentVersion\Run\
HKLU\Software\Microsoft\Windows\CurrentVersion\RunOnce\
If after clearing that lot out you still have the problem then I would have to suggest that a normally benign application has been infected and turned into a host.
Usually the stuff instals at least two programs, one of which you know about and the other is the one that keeps on putting it back in place. I had one of these and eventually used a trawl through all the stuff on C: using powerdesk for the filename it was reinstalling. Took ages but managed to remove it in the end.
My daughter installed it on her puter a while back it was a bitch to remove, I forgot how but it involved registery monitoring to find out what it did.
And on the 8th day the Lord restricted the users administrative authority with a smackdown heard across the galaxy...
:lol: Been there, torn hair out.
Quote from: maximusotter:lol: Been there, torn hair out.
So thats why you are bald? :lol:
Quote from: SeriousQuote from: maximusotter:lol: Been there, torn hair out.
So thats why you are bald? :lol:
No, Im bald to compensate for my 8" rooster. Bok, bok bok BOK! :heehaw:
Right, I have spent hours on this and thank the big fella Nimrod as well as others for help but I found it was a key lurking under the pretence of being a similar name to a SpySweeper file.... It turned out to be:
SsiEfr.e (the legit name is Ssiefr.exe).
I personally hope that whomever was involved in the development of this garbage software rots.
Cheers and good-fsking night!
Tongy
my brother has about 5 programs on his pc that run in the same way, hide away and keep putting the main part back after you remove it :(
the thing is..... I format it for him.... then he re-installes them !
autoruns (http://www.sysinternals.com/Utilities/Autoruns.html) from sysinternals is handy in these cases.
Quote from: knightymy brother has about 5 programs on his pc that run in the same way, hide away and keep putting the main part back after you remove it :(
the thing is..... I format it for him.... then he re-installes them !
:rofl: :cry: