PDA

View Full Version : Remove entries



HNC_Comp
02-03-2003, 08:06 AM
Hi, well ive finally seen the error of my ways and decided to remove KAZZALITE from my system :)

I went through the add/remove progs and deleted the folders thinking that would solve it but when i \Run\msconfig i still see kazaa in the start up tab ive unclicked so it do not run but it would be nice to remove any trace of the virus carrying scum :)

what have i missed???

thanks HNC_Comp

mjc
02-03-2003, 10:12 AM
You can go here (http://www.spywareinfo.com/~merijn/) and download HiJack This, run it, save the log and post the it, then go to the config button, misc tools, and run StartupList and post that log. This way we'll be able to find where it is loading from and remove it manually.

HNC_Comp
02-03-2003, 12:43 PM
Thanks for the reply mjc

before i saw it i downloaded RegCleaner 4.3 ...ran it and it found 3 references to kazaa which i deleted.... but still it remains in msconfig in my startup list.

I downloaded Hijackthis and here is the pasting of my log

Logfile of HijackThis v1.91.2
Scan saved at 16:21:20, on 03/02/2003
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page=http://www.gamespot.com/
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {CD4C3CF0-4B15-11D1-ABED-709549C10000} - C:\Program Files\Go!Zilla\GoIEHlp.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe /STARTUP
O4 - HKLM\..\Run: [iamapp] C:\Program Files\Norton Internet Security\IAMAPP.EXE
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O8 - Extra context menu item: Download with Go!Zilla - file://C:\Program Files\Go!Zilla\download-with-gozilla.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://fdl.msn.com/public/chat/msnchat45.cab


I can't see any kazza :confused:

this is what it says in msconfig

Kazza C:\Program Files\Kazza Lite\Kazza.exe /SYSTRAY

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

But that folder don't exist any more

If it cant be fixed i can live with it :)
Pity i don't have such problems when it comes to deleting important stuff lol ;) :( :( :( :( :(

Budfred
02-03-2003, 01:36 PM
If you have Spybot it includes a tool that will allow you to delete programs from msconfig. You might want to try that to remove this reference. I suspect it is an artifact of the install rather than an actual program, but mjc will be able to say more about that.

mjc
02-03-2003, 02:43 PM
Get the StartUp List log too, (config => misc tools => StartUp list, in HijackThis) and yes it probablly is liek Budfred said.