Replies

John-O, you mention Combofix in your post, but your warning about the tool could be a little stronger. This tool should NOT be used by most users without supervision by someone who understands the logs and the power of the tool. Even where you get the tool is important since the hackers already have posted infected versions on the net. Using it incorrectly or using an infected version can turn a computer into a doorstop in a heartbeat.

Read this IT guys post on Combofix.

As John-O said, if it is recurring, it has hidden a .dll or other infected file or registry key on your system that may be tough (but not impossible) to ferret out. It sounds like you are not comfortable working with something like this and should probably seek the assistance of a local tech to clean your system. If you feel you can do it, without transferring the infection, I would suggest you make a backup copy of all your important data like pictures, documents, address book, Favorites menu, etc. (anything you have created and do not wish to lose) before taking it to the tech. Better safe than sorry when dealing with personal data that cannot be easily recreated, if at all. Second best option is to ask the tech to backup your data to an external source before they begin work.

Try the malwarebytes removal in Safe Mode as Medico suggests. It’s quite possible that will clear the infection.

I’m not familiar with the Windows 7 registry, but in my XP registry, the Windows folder at that location, the first letter is capitalized while the one in your string is in lower case. Are you comfortable with editing your registry ?? If so, try navigating down to that key and check to see if there are 2 Windows folders, one Windows and the other windows. If you do, run Malwarebytes again and then, immediately after rebooting, don’t let the machine access the internet after it reboots and run Malwarebytes again to see if the file has recreated itself from a file on your machine. If it finds it, you may need to go to one of the malware removal help forums, like Bleeping Computer and let them really confuse you.

This thread in the Malwarebytes forums will give you an idea of what you may be in for with this little nasty. Sorry I can’t be more encouraging.

It’s a computer…. it’s not supposed to make sense. :huh:

Doesn’t seem everything “works as intended”. But, it sounds like you have to install the AVG toolbar and uncheck the option (if one exists) to install Google Chrome. If you can’t option out of Chrome, let it install and then change you default back to your preferred browser and uninstall Chrome. PITA, but I have no other advice….. other than to change to a different free AV program like Avast.

To expand on Paul’s reply, if you have uninstalled the underlying program, then any folders left behind are orphans that are not related to any other program and, thus, safe to delete. If they are being used by another program, Windows will let you know when you try to delete them and won’t allow you to. Also, the uninstall routine should have told you if any files where “shared” and asked if you wanted to remove them or not.

The “feature” you are after may have been rolled into the AVG Toolbar. I don’t use AVG so I can’t say. You might want to give this review of AVG a look to see if it helps clear things up.

Excellent. Glad you got it sorted.

OK, I believe I may have an answer for this. Check out this thread. I checked out the RegScanner utility recommended there and it seems to be a better option than the Windows Registry Editor. Here’s a how to article on it that might help you choose between the two. BTW – it’s FREE.

Glad it worked out for you Les. Sometimes the simple stuff works.

Thanks for posting back with that Connie. It may not be a “fix”, but it is a solution.

Hi Connie,

If you’ve been chasing the tale on this one then I’m sure you know it’s a real smack in the forehead issue. Is you system 64 or 36 bit Vista ?? I came across a possible fix for the issue on 64 bit systems but don’t believe it works on 32 bit (but I don’t suppose it could hurt to try it if you export the registry value before you mess with it, so if it borks anything, you can set it right again pretty easily.

Take a look here for the fix. I found it at the bottom of this thread in the Adobe Forums. The problem is VERY old.

Soooo… you’ve got the AVG Security thingy now without the unwanted tag-alongs ?? Yes… No ??

See if anything here helps.

See if any information in this thread on another forum might help resolve your issue.