Wednesday, April 6, 2011

And while we're on software...

I got hit with what I thought at the time was a virus, or exception of some sort - it stopped me accessing any files, apps, even music, email and piccies...but what popped up was an MS product that cleaned it, but not removed it. In short, I had no choice at the time but pay the subscription for removal. Well fuck me if tonight while looking for another video downloader (for music and such for this blog, not porn!) the exact same thing happened again. After three hours of near on screaming, I managed to sneak round the product, MS Removal Tool I got a search via Google (my friend) to find out what I was dealing with, and how to fix it, and here goes, should you come across it;

MS Removal Tool removal instructions using HijackThis or Process Explorer (in Normal mode):
1. Download iexplore.exe (NOTE: iexplore.exe file is renamed HijackThis tool from TrendMicro).
Launch the iexplore.exe and click "Do a system scan only" button.
If you can't open iexplore.exe file then download explorer.scr and run it.

2. Search for such entry in the scan results:

Windows XP/2000:
O4 - HKCU\..\RunOnce: [fHrPqDaZcCg02547] C:\Documents and Settings\All Users\Application Data\fHrPqDaZcCg02547\fHrPqDaZcCg02547.exe

Windows Vista/7:
O4 - HKCU\..\RunOnce: [fHrPqDaZcCg02547] C:\ProgramData\fHrPqDaZcCg02547\fHrPqDaZcCg02547.exe

The process name will be different in your case [SET OF RANDOM CHARACTERS].exe, located in:
C:\Documents and Settings\All Users\Application Data\ in Windows XP and C:\ProgramData\ in Windows Vista/7. Select all similar entries and click once on the "Fix checked" button. Close HijackThis tool.

OR you may download Process Explorer and end MS Removal Tool process:
  • [SET OF RANDOM CHARACTERS].exe, i.e. fHrPqDaZcCg02547.exe

Now, this appears to have done it for me...stay posted.

No comments:

Post a Comment