Regsupreme Pro caused Virus/Spyware to keep comming back.

masterblaster

I had unwanted startup programs that I would delete and they kept coming back.

I finally figured it out when I ran registry cleaner, It put back the startup programs.

I finally got rid of them by deleting them rather that fixing them with the Registry cleaner.

Here are the HijackThis entries that I finally removed...

O4 - HKLM\..\RunOnce: cmd /C "rmdir /Q c:\WINDOWS\SoftwareDistribution\Download"

O4 - HKLM\..\RunOnce: cmd /C "rmdir /Q C:\WINDOWS\system32\Macromed\Download"

O4 - HKLM\..\RunOnce: cmd /C "del c:\windows\system32\macromed\shockwave 10\download.exe"

O4 - HKLM\..\RunOnce: cmd /C "del c:\windows\system32\macromed\shockwave 10\download.dll"

jv16

Could you please explain what do you mean by:

"I had unwanted startup programs that I would delete and they kept coming back. I finally figured it out when I ran registry cleaner, It put back the startup programs. "

RegSupreme Pro doesn't make up ane registry entries, it does fix entries with errors but if the entries are already deleted it doesn't put anything back to the registry.

masterblaster

What I mean is....

The above startup programs are either spyware or a virus.

I went online and found several ways to eliminate these. Each time I removed them, I ran Regsupreme Pro and "fixed" the errors in the registry. Then rebooted.

Each time my computer started, the startup entries in my startup file were back.

One time I deleted them and ran Regsupreme Pro but selected "Delete" rather than "Fix" and the startup entries were gone.

I guess Regsupreme Pro thought it should put back the startup entries that I removed.

jv16

That doesn't sound right, RegSupreme Pro's Registry Cleaner never adds any entries to the registry, ever. Its registry fixing feature can modify existing registry entries, but it doesn't ever create new registry entries.

Did you verify that the entries were back in the registry right after you ran the RegSupreme Pro? Wouldn't it be possible that the spyware itself was still running and it didn't recreate those entries?

masterblaster

OK, here is what I did.

I manually deleted the questionable directories/files from my computer.

I manually removed the 4 startup entries from the registry (using Code Stuff Starter).

I confirmed that they were removed.

I ran Regsupreme Pro “Fixing” all registry issues. I received a message that only a few were repairable and most needed to be deleted.

I rebooted my computer.

The startup entries were back.

I tried several times, same outcome.

Then…..

I manually deleted the questionable directories/files from my computer.

I manually removed the 4 startup entries from the registry (using Code Stuff Starter).

I confirmed that they were removed.

I ran Regsupreme Pro “Deleting” the registry issues.

I rebooted my computer.

The startup entries have not returned since.

My assumption was that Regsupreme Pro looked at my registry and thought the startup settings needed to be added back.

I did not confirm that the startup settings were added back after Regsupreme Pro and before the reboot. Too late now.

And yes, it’s possible that the spyware recreated the startup entries. That’s very common with spyware/viruses. That didn’t seem to explain why they didn’t come back the last time when I “Deleted” the registry entries using Regsupreme Pro.

This may not be related to Regsupreme Pro but it seemed to be.

redseujac

Maybe when using "fix" the program using the program cache (not renewed) has repaired the links in the registry to still existing files on the harddisk, while using "delete" all the wrong entries in the registry are removed (so no links to files remaining on the harddisk are restored)?

What does jv16 thinks about that possibility?

oxford

masterblaster wrote
I had unwanted startup programs that I would delete and they kept coming back.

I finally figured it out when I ran registry cleaner, It put back the startup programs.

I finally got rid of them by deleting them rather that fixing them with the Registry cleaner.

Here are the HijackThis entries that I finally removed...

O4 - HKLM\..\RunOnce: cmd /C "rmdir /Q c:\WINDOWS\SoftwareDistribution\Download"

O4 - HKLM\..\RunOnce: cmd /C "rmdir /Q C:\WINDOWS\system32\Macromed\Download"

O4 - HKLM\..\RunOnce: cmd /C "del c:\windows\system32\macromed\shockwave 10\download.exe"

O4 - HKLM\..\RunOnce: cmd /C "del c:\windows\system32\macromed\shockwave 10\download.dll"

These program entries you talk about are not spyware / malware, they are the latest ADOBE FlashPlayer 9 and Adobe Shockwave Player 10. Now that you have removed them you cannot use Flash enabled sites on the Web.

Regards

Oxford

masterblaster

Regards

Oxford

: : :

That's way too obvious. You need to do more research.

http://www.cybertechhelp.com/forums/showthread.php?t=85750&goto=nextnewest

jv16

redseujac wrote
Maybe when using "fix" the program using the program cache (not renewed) has repaired the links in the registry to still existing files on the harddisk, while using "delete" all the wrong entries in the registry are removed (so no links to files remaining on the harddisk are restored)?

What does jv16 thinks about that possibility?

I don't think that is possible. If an entry has been removed from the registry, our products can't fix it by creating the entry back to the registry, no matter what would the file cache contain. The fixing feature only modifies broken entries, it doesn't ever create new entries.

oxford

Sorry, we encountered an error while displaying this content. If you're a user, please try again later. If you're an administrator, take a look in your Flarum log files for more information.

masterblaster

jv16,

It looks like Regsupremepro has nothing to do with my startup programs reinstalling themselves. I appreciate the feedback and I agree with you.

Oxford,

The HijackThis file on the link I referenced was not mine. I only referenced it for these entries (which keep comming back!!!!!)

O4 - HKLM\..\RunOnce: cmd /C "rmdir /Q c:\WINDOWS\SoftwareDistribution\Download"

O4 - HKLM\..\RunOnce: cmd /C "rmdir /Q C:\WINDOWS\system32\Macromed\Download"

O4 - HKLM\..\RunOnce: cmd /C "del c:\windows\system32\macromed\shockwave 10\download.exe"

O4 - HKLM\..\RunOnce: cmd /C "del c:\windows\system32\macromed\shockwave 10\download.dll"

The link you sent (thanks) referenced order versions of Macromedia Flash Player. Mine seems to be version 10, not 6 or older.

I use McAfee and Spy Sweeper to keep my computer clean which has been a winning combination up to this point.

I have scanned with both of these programs along with Spybot and Adaware. I have deleted the directories where these programs and manually removed registry settings.

Nothing works so far.

oxford

Hello Masterblaster:

I am glad that you got the assistance, determining that your Macecraft product was not at fault.

As for your problem I may be able to help but I also want to respect the forum rules. This would be considered off topic in this thread now that the discovery, Macecraft is not the problem.

Maybe it could be discussed under the General Topics but that would be totally up to the Moderators.

Personally I would like to see a Help and Assist or Tips and Tricks Thread for this purpose, again this is up to the Moderators.

Goodf Luck

Oxford

redseujac

Sorry, we encountered an error while displaying this content. If you're a user, please try again later. If you're an administrator, take a look in your Flarum log files for more information.