What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Accidently Deleted...

1 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hi everyone! I deleted some file (in the folowing post you'll see what) and i;am afraid that i shouldn't do that but it seemed to me that it wasn't there before. It' something like ../3573244.exe in the HKLM-not anymore there. Have i done something wrong and besiedes, can i somehow delete some R3 UrlHokk…
thanks in front!
Logfile of HijackThis v1.94.0
Scan saved at 12:14:59 PM, on 11/2/2003
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page=C:\WINDOWS\System32\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page=%SystemRoot%\system32\blank.htm
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)<<<<<<<<<<<<<<<<<<———–this is what i can't delete!!!!!!!!!!!
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FlashGet\jccatch.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\MSDXM.OCX
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
O4 - HKLM\..\Run: [ASUS Probe] C:\Program Files\ASUS\Probe\AsusProb.exe
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\pccguide.exe"
O4 - HKLM\..\Run: [PCCClient.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\PCCClient.exe"
O4 - HKLM\..\Run: [Pop3trap.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\Pop3trap.exe"
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [VGAUtil] C:\WINDOWS\System32\G-VGA.exe
O4 - HKLM\..\Run: [HydraVisionDesktopManager] C:\Program Files\ATI Technologies\HydraVision\HydraDM.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
here was some …./3573244.exe <<<<<—————————–i deleted preety easy so i got afraid that i deleted something important!!!!
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [Washer] C:\Program Files\Washer\washer.exe /0
O8 - Extra context menu item: Download All by FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm
O9 - Extra button: FlashGet (HKLM)
O9 - Extra 'Tools' menuitem: &FlashGet (HKLM)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwa…ash/swflash.cab


igispacer
Post #2
Don't know as I am not an expert yet (At SWI I am a 'advanced member'), but did you save the hijackthis file that was produced, you should be able to get hijackthis to restore it. BUT most files with just numbers are very xxxxxx. Do you know what these two are as they are not in pacmans startup list. Does not mean that they are bad, just means I don't know. O4 - HKLM\..\Run: [ASUS Probe] C:\Program Files\ASUS\Probe\AsusProb.exe O4 - HKLM\..\Run: [VGAUtil] C:\WINDOWS\System32\G-VGA.exe
Post #4
@Chris! thanks for reply, but u didn't saved log of that file so i can't restore it. Do you have any idea on how to delete that R3? About those files you asked, G-vga has to something with my graphic card 'cause i have Gygabite radeon, and that asus-probe is related with something on my motherboard cause it's ASUS-as understandable! It's all OK! thanks again jiggy
Post #5

R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)<<<<<<<<<<<<<<<<<<———–this is what i can't delete!!!!!!!!!!!

It's because you're running an old version of Hijack This. It can't handle these cunningly hacked registry keys (notethe backslash preceding "_{CFBFAE00-17A6….."

Download the latest version from http://tomcoyote.org/hjt/ , and run it.

It will delete that one without a prob.
Post #7
The thing you accidentally fixed: O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe is SoftModem Messaging Applet All you did was disable it as a startup - the file is still there and can be run manually when needed. Or you can run HijackThis, click Config->Backups, and restore anything you like.
Post #9
Glad we could help, igispacer. :)

If you need this topic reopened, please request this by sending the moderating team an email with the address of the thread. This applies only to the original topic starter. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI