What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Computer Just restarts

5 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
So not sure why this is happening. Im just taking a SHOT On the dark about seeing if HIJACK is going to find the problem though so here goes


——Last program i installed was an upgraded version of WEBROOT SPY SWEEPER———
Other then that i havent installed ANYTHING else that would cause system failures or interruptions.
Nothing out of the ordinary is runing in my START > RUN > MSCONFIG > START UP list either.

I was working with the computer lastnight and it just restarted while i was downloading emails via OUTLOOK (not express)

So today i turned it on, and left it alone, sure enough i came back within the hour and it had again restarted.

When the system does a hard crash / restart, obviously it goes through its disc scan process before windows fully starts up
It did that too, and from what i see on the screen
(working from memory)
FILE PATH/……FILE PATH/…..WEBROOT/ SPY SWEEPER/….FILE PATH/…..some file name .tpm is not a valid amount


Ok so the system is telling me something is wrong with webroot
no problem right? just uninstall and reinstall…..well
i cant uninstall it. It wont let me
It says theres a file missing to do that
"uninst001.dat" I belive is the name of the file.





LOG FILE————-
Logfile of HijackThis v1.98.2
Scan saved at 4:19:07 PM, on 7/16/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\mysql\bin\mysqld-nt.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\System32\ups.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Microsoft Office\Office\1033\OLFSNT40.EXE
C:\WINDOWS\system32\devldr32.exe
C:\Documents and Settings\lqd\My Documents\spytools\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://clubexl.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://antifmradio.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Warwick Online
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = ;;localhost;
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~2\TOOLS\IESDSG.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~2\TOOLS\IESDPB.DLL
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] "C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe"
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\KODAK\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: PowerReg Scheduler.exe
O4 - Global Startup: Symantec Fax Starter Edition Port.lnk = C:\Program Files\Microsoft Office\Office\1033\OLFSNT40.EXE
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~2\TOOLS\IESDPB.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\My Downloads\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://newyork.tribe.net
O16 - DPF: Win32 Classes -
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com/i/cha…v45/yacscom.cab
O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} (Yahoo! Audio UI1) - http://chat.yahoo.com/cab/yacsui.cab
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secur…loadManager.ocx
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/ractrl.cab?lmi=100
Post #3
Logfile of HijackThis v1.99.1
Scan saved at 5:14:53 PM, on 7/16/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\mysql\bin\mysqld-nt.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\System32\ups.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Microsoft Office\Office\1033\OLFSNT40.EXE
C:\WINDOWS\system32\devldr32.exe
C:\Program Files\winamp5 24\Winamp\winamp.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\lqd\My Documents\spytools\hijackthis\HijackThis 7-2006.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://clubexl.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://antifmradio.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Warwick Online
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = ;;localhost;
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~2\TOOLS\IESDSG.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~2\TOOLS\IESDPB.DLL
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] "C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe"
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\KODAK\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: PowerReg Scheduler.exe
O4 - Global Startup: Symantec Fax Starter Edition Port.lnk = C:\Program Files\Microsoft Office\Office\1033\OLFSNT40.EXE
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~2\TOOLS\IESDPB.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\My Downloads\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://newyork.tribe.net
O15 - Trusted Zone: http://*.tribe.net
O16 - DPF: Win32 Classes -
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secur…loadManager.ocx
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/ractrl.cab?lmi=100
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: MySQL - Unknown owner - C:\mysql\bin\mysqld-nt.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe



sorry i was running WINAMP and had Explorer open during the scan
Post #4
Fix these with HijackThis:

O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray

O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe

Copy the text in the following quote box into Notepad:

sc stop WebrootSpySweeperService
sc delete WebrootSpySweeperService

Save it to your desktop as ff.bat

Now, the ff.bat file on the desktop. A DOS window will briefly open, then close.

Reboot.

See if you can delete this folder:

C:\Program Files\Webroot\Spy Sweeper

Post a new HijackThis! log.
:)
Post #5
still cant delete spy sweeper folder
i got a
Can not delete SSCtxMnu.dll
access denied…make sure its not open or in use ..other program.. bla bla







Logfile of HijackThis v1.99.1
Scan saved at 2:43:40 PM, on 7/17/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\mysql\bin\mysqld-nt.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\WINDOWS\System32\ups.exe
C:\Program Files\Microsoft Office\Office\1033\OLFSNT40.EXE
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\devldr32.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\lqd\My Documents\spytools\hijackthis\HijackThis 7-2006.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://clubexl.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://antifmradio.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Warwick Online
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = ;;localhost;
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~2\TOOLS\IESDSG.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~2\TOOLS\IESDPB.DLL
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] "C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\KODAK\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: PowerReg Scheduler.exe
O4 - Global Startup: Symantec Fax Starter Edition Port.lnk = C:\Program Files\Microsoft Office\Office\1033\OLFSNT40.EXE
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~2\TOOLS\IESDPB.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\My Downloads\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://newyork.tribe.net
O15 - Trusted Zone: http://*.tribe.net
O16 - DPF: Win32 Classes -
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secur…loadManager.ocx
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/ractrl.cab?lmi=100
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: MySQL - Unknown owner - C:\mysql\bin\mysqld-nt.exe
Post #6
Please download/unzip this:

Registry Search by Bobbi Flekman

on regsearch.exe, and search for this:

SSCtxMnu.dll

It may take a while to run, so be patient. When finished, the search results will appear in your text editor,

Paste the contents of the search results into your next post.
:)
Post #7
here we go REGEDIT4 ; Registry Search 2.0 by Bobbi Flekman © 2005 ; Version: 2.0.1.0 ; Results at 7/17/2006 3:20:23 PM for strings: ; 'ssctxmnu.dll' ; Strings excluded from search: ; (None) ; Search in: ; Registry Keys Registry Values Registry Data ; HKEY_LOCAL_MACHINE HKEY_USERS [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7C9D5882-CB4A-4090-96C8-430BFE8B795B}\InprocServer32] @="C:\\PROGRA~1\\Webroot\\SPYSWE~1\\SSCtxMnu.dll" ; End Of The Log…
Post #8
Copy and paste the contents of the quote box below into notepad.

Save it as file name: "fixme.reg" (not including the quotes). Save as file type: *All files* and save it on your Desktop.

REGEDIT4

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7C9D5882-CB4A-4090-96C8-430BFE8B795B}\InprocServer32]


Then, locate fixme.reg on your desktop and it.

You will receive a prompt similar to: "Do you wish to merge the information into the registry?".

Answer 'Yes' and wait for a message to appear similar to "Merged Successfully".

Reboot.

Attempt to remove the SpySweeper folder once more.

Before attempting to install it again, I suggest we look for other "orphaned" registry entries.

Run the regsearch tool again.

Make sure ALL the little "boxes" (at the bottom) are checked.

This time search for:

webroot
sweeper

(On separate lines, you can search for up to 3 items at a time.)

Post the results.
:)
Post #9
i was able to remove the folders WEBROOT/ SPY SWEEPER i did this before runing the REG scan. Howerver obviously there are still files on the system as it shows in the current log below. hope im fast enough for ya ;-) REGEDIT4 ; Registry Search 2.0 by Bobbi Flekman © 2005 ; Version: 2.0.1.0 ; Results at 7/17/2006 5:41:22 PM for strings: ; 'webroot' ; 'sweeper' ; Strings excluded from search: ; (None) ; Search in: ; Registry Keys Registry Values Registry Data ; HKEY_LOCAL_MACHINE HKEY_USERS [HKEY_LOCAL_MACHINE\SOFTWARE\Adaptec\AUDIO_CD_INFO\18FE8FE] "5"="Sinesweeper - Eyes Wide Shut" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\SpySweeper] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{1281A68F-9E75-418F-B3AC-D5B23DD86408}] "LocalService"="WebrootSpySweeperService" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\SpySweeper.exe] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\SpySweeper.exe\shell] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\SpySweeper.exe\shell] "FriendlyCache"="Spy Sweeper" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1281A68F-9E75-418F-B3AC-D5B23DD86408}\LocalServer32] @="C:\\PROGRA~1\\Webroot\\SPYSWE~1\\SPYSWE~1.EXE" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7C9D5882-CB4A-4090-96C8-430BFE8B795B}] @="Webroot Spy Sweeper Context Menu Integration" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\SpySweeper] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{8A0934AB-9231-4054-8955-6C491EDB6047}\2.0\0\win32] @="C:\\Program Files\\Webroot\\Spy Sweeper\\WRSSSDK.exe" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{8A0934AB-9231-4054-8955-6C491EDB6047}\2.0\HELPDIR] @="C:\\Program Files\\Webroot\\Spy Sweeper\\" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{8A0934AB-9231-4054-8955-6C491EDB6047}\3.0\0\win32] @="C:\\Program Files\\Webroot\\Spy Sweeper\\SpySweeper.exe" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{8A0934AB-9231-4054-8955-6C491EDB6047}\3.0\HELPDIR] @="C:\\Program Files\\Webroot\\Spy Sweeper\\" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\SpySweeper] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\Oc Manager\Subcomponents] "minesweeper"=dword:00000001 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved] "{7C9D5882-CB4A-4090-96C8-430BFE8B795B}"="Webroot Spy Sweeper Context Menu Integration" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5AE68DC3-F16E-457D-947A-092D614C7ABD}_is1] "Inno Setup: App Path"="C:\\Program Files\\Webroot\\Spy Sweeper" "InstallLocation"="C:\\Program Files\\Webroot\\Spy Sweeper\\" "Inno Setup: Icon Group"="Webroot\\Spy Sweeper" "DisplayName"="Spy Sweeper" "Publisher"="Webroot Software, Inc." "URLInfoAbout"="http://www.webroot.com/" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-790525478-1708537768-1343024091-1004\S-1-5-21-790525478-1708537768-1343024091-1004\Software\Webroot] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-790525478-1708537768-1343024091-1004\S-1-5-21-790525478-1708537768-1343024091-1004\Software\Webroot\SpySweeper] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-790525478-1708537768-1343024091-1004\S-1-5-21-790525478-1708537768-1343024091-1004\Software\Webroot\SpySweeper\IEH] [HKEY_LOCAL_MACHINE\SOFTWARE\Webroot] [HKEY_LOCAL_MACHINE\SOFTWARE\Webroot\ClientRegistry] [HKEY_LOCAL_MACHINE\SOFTWARE\Webroot\ClientRegistry] "C:\\Program Files\\Webroot\\Spy Sweeper\\SpySweeper.exe"="72cd/4wrinPqcsszRgRnsgjOlO7fwbpYVnJNFfR7WHZT22MjnvZh3RNo0g7VBVM5aWdQVhKPCGLMLgo8gxzoEA==" "C:\\Program Files\\Webroot\\Spy Sweeper\\SafeSweeper.exe"="1dwXKiE3yCfbwGaeZr6h5gzm6ybe5fSoPOze6ik2VqR/tmVvh9DDBIZuyHcSgBRHbZnkwEtF9uQx3cSH4SWuIg==" "C:\\Program Files\\Webroot\\Spy Sweeper\\SpySweeperUI.exe"="72cd/4wrinPqcsszRgRnsgjOlO7fwbpYVnJNFfR7WHZT22MjnvZh3RNo0g7VBVM5aWdQVhKPCGLMLgo8gxzoEA==" "C:\\Program Files\\Webroot\\Spy Sweeper\\wrsshp.exe"="1dwXKiE3yCfbwGaeZr6h5gzm6ybe5fSoPOze6ik2VqR/tmVvh9DDBIZuyHcSgBRHbZnkwEtF9uQx3cSH4SWuIg==" [HKEY_LOCAL_MACHINE\SOFTWARE\Webroot\SpySweeper] [HKEY_LOCAL_MACHINE\SOFTWARE\Webroot\SpySweeper] "id"="C:\\Program Files\\Webroot\\Spy Sweeper" "uninstallurl"="http://products.webroot.com/disp0201.php?pc=64021&rc=1&ps=T&oc=33&mjv=4&mnv=5&bld=711&cd=&dcc=&drc=&mo=&sid=1866587951&lang=en&loc=USA&rsc=" "ignorewebrootproducts"=dword:00000000 [HKEY_LOCAL_MACHINE\SOFTWARE\Webroot\SpySweeper\Affiliates] [HKEY_LOCAL_MACHINE\SOFTWARE\Webroot\SpySweeper\ExtSW] [HKEY_LOCAL_MACHINE\SOFTWARE\Webroot\SpySweeper\FNC] [HKEY_LOCAL_MACHINE\SOFTWARE\Webroot\SpySweeper\Host File] [HKEY_LOCAL_MACHINE\SOFTWARE\Webroot\SpySweeper\IEH] [HKEY_LOCAL_MACHINE\SOFTWARE\Webroot\SpySweeper\reports] [HKEY_LOCAL_MACHINE\SOFTWARE\Webroot\SpySweeper\Stats] [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\WebrootSpySweeperService] [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\WebrootSpySweeperService] [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SSFS041A\0000] "DeviceDesc"="Spy Sweeper File System Filer Driver: 041A" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SSHRMD\0000] "DeviceDesc"="Spy Sweeper Hookrack MiniDriver" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SSIDRV\0000] "DeviceDesc"="Spy Sweeper Interdiction Driver" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_WEBROOTSPYSWEEPERSERVICE] [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_WEBROOTSPYSWEEPERSERVICE\0000] [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_WEBROOTSPYSWEEPERSERVICE\0000] "Service"="WebrootSpySweeperService" "DeviceDesc"="Webroot Spy Sweeper Engine" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SSFS041A] "DisplayName"="Spy Sweeper File System Filer Driver: 041A" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SSHRMD] "DisplayName"="Spy Sweeper Hookrack MiniDriver" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SSIDRV] "DisplayName"="Spy Sweeper Interdiction Driver" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SSKBFD] "DisplayName"="Webroot Spy Sweeper Keylogger Shield Keyboard Filter" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\SafeBoot\Minimal\WebrootSpySweeperService] [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\SafeBoot\Network\WebrootSpySweeperService] [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_SSFS041A\0000] "DeviceDesc"="Spy Sweeper File System Filer Driver: 041A" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_SSHRMD\0000] "DeviceDesc"="Spy Sweeper Hookrack MiniDriver" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_SSIDRV\0000] "DeviceDesc"="Spy Sweeper Interdiction Driver" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_WEBROOTSPYSWEEPERSERVICE] [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_WEBROOTSPYSWEEPERSERVICE\0000] [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_WEBROOTSPYSWEEPERSERVICE\0000] "Service"="WebrootSpySweeperService" "DeviceDesc"="Webroot Spy Sweeper Engine" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\SSFS041A] "DisplayName"="Spy Sweeper File System Filer Driver: 041A" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\SSHRMD] "DisplayName"="Spy Sweeper Hookrack MiniDriver" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\SSIDRV] "DisplayName"="Spy Sweeper Interdiction Driver" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\SSKBFD] "DisplayName"="Webroot Spy Sweeper Keylogger Shield Keyboard Filter" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WebrootSpySweeperService] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WebrootSpySweeperService] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SSFS041A\0000] "DeviceDesc"="Spy Sweeper File System Filer Driver: 041A" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SSHRMD\0000] "DeviceDesc"="Spy Sweeper Hookrack MiniDriver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SSIDRV\0000] "DeviceDesc"="Spy Sweeper Interdiction Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WEBROOTSPYSWEEPERSERVICE] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WEBROOTSPYSWEEPERSERVICE\0000] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WEBROOTSPYSWEEPERSERVICE\0000] "Service"="WebrootSpySweeperService" "DeviceDesc"="Webroot Spy Sweeper Engine" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SSFS041A] "DisplayName"="Spy Sweeper File System Filer Driver: 041A" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SSHRMD] "DisplayName"="Spy Sweeper Hookrack MiniDriver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SSIDRV] "DisplayName"="Spy Sweeper Interdiction Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SSKBFD] "DisplayName"="Webroot Spy Sweeper Keylogger Shield Keyboard Filter" [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run-] "SpySweeper"="\"C:\\Program Files\\Webroot\\Spy Sweeper\\SPYSWEEPER.EXE\" /0" [HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Run-] "SpySweeper"="\"C:\\Program Files\\Webroot\\Spy Sweeper\\SPYSWEEPER.EXE\" /0" [HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Run-] "SpySweeper"="\"C:\\Program Files\\Webroot\\Spy Sweeper\\SPYSWEEPER.EXE\" /0" [HKEY_USERS\S-1-5-21-790525478-1708537768-1343024091-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\txt] "j"="C:\\Documents and Settings\\lqd\\Desktop\\Spysweeper Serial Key.txt" [HKEY_USERS\S-1-5-21-790525478-1708537768-1343024091-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu\Programs\Spy Sweeper] [HKEY_USERS\S-1-5-21-790525478-1708537768-1343024091-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\Spy Sweeper] [HKEY_USERS\S-1-5-21-790525478-1708537768-1343024091-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\Webroot] [HKEY_USERS\S-1-5-21-790525478-1708537768-1343024091-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\Webroot\Spy Sweeper] [HKEY_USERS\S-1-5-21-790525478-1708537768-1343024091-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{bec6bb80-ecf8-11da-af58-806d6172696f}\_Autorun\DefaultIcon] @="E:\\WEBROOT.ICO" [HKEY_USERS\S-1-5-21-790525478-1708537768-1343024091-1004\Software\Microsoft\Windows\CurrentVersion\Run-] "SpySweeper"="\"C:\\Program Files\\Webroot\\Spy Sweeper\\SPYSWEEPER.EXE\" /0" [HKEY_USERS\S-1-5-21-790525478-1708537768-1343024091-1004\Software\Microsoft\Windows\ShellNoRoam\MUICache] "C:\\Program Files\\Webroot\\Spy Sweeper\\SpySweeperUI.exe"="Spy Sweeper Client Executable" "C:\\Program Files\\Webroot\\Spy Sweeper\\unins000.exe"="Setup/Uninstall" "C:\\Program Files\\Webroot\\Spy Sweeper\\SpySweeper.exe"="Spy Sweeper Engine" [HKEY_USERS\S-1-5-21-790525478-1708537768-1343024091-1004\Software\Webroot] [HKEY_USERS\S-1-5-21-790525478-1708537768-1343024091-1004\Software\Webroot\SpySweeper] [HKEY_USERS\S-1-5-21-790525478-1708537768-1343024091-1004\Software\Webroot\SpySweeper\expectedsweeptimes] [HKEY_USERS\S-1-5-21-790525478-1708537768-1343024091-1004\Software\Webroot\SpySweeper\IEFavorites] [HKEY_USERS\S-1-5-21-790525478-1708537768-1343024091-1004\Software\Webroot\SpySweeper\IEH] [HKEY_USERS\S-1-5-21-790525478-1708537768-1343024091-1004\Software\Webroot\SpySweeper\mf] [HKEY_USERS\S-1-5-21-790525478-1708537768-1343024091-1004\Software\Webroot\SpySweeper\proxyparams] [HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run-] "SpySweeper"="\"C:\\Program Files\\Webroot\\Spy Sweeper\\SPYSWEEPER.EXE\" /0" ; End Of The Log…
Post #10
:o Well…. I'd rather be cautious here. If it was just two or three entries… No problem…. But with that many….. "Monkeying" in the registry when not "necessary" can lead to disaster. I've not "screwed up" anyones machine yet, and I'd rather not start now. I say, if you're going to install it again, give it a try. If it absolutley won't "go"… Well… We'll cross that bridge only if we have to. Is that OK with you? :) :thumbup:
Post #11
sounds good to me too bad though i paid for this dam thing and now its just screwing things up know of any tool LIKE sweeper that i wont have to end up paying for yet again?
Post #12
This page may help:

Rogue Anti-Spyware Programs

It also has "good" anti-spyware programs listed.

I really can't say from personal experience what program you might use.
:scratch:

My defenses are as such:

1. Norton Internet Security/Antivirus 2006

2. IE-SpyAd

3. Spybot Search and Destroy and Ad-Aware (I run once a week).

4. An "alternate" browser. I use Firefox mostly. I don't use IE unless necessary.

5. Check your browser settings here: Jason's Toolbox

Computer "glitches" happen.

One thing I always try to remember to do is to reboot right before installing anything.

That seems to help ward off "glitches".
:)
Post #13
This topic is now closed.

If you need this topic reopened, please request this by sending an email to us at the following link
(Click for address)
Include your post user name and detail why you need it reopened with a valid link to your post.
Any bad links or emails that are not from the original poster will be deleted without response.
Any emails without the subject "Reopen" will be deleted without being looked at.

If this is not your thread please start a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI