Win XP add/remove tech help

SpiritWarrior · 09-26-2005, 03:29 PM

So I had this IE hijacker thing going on, a trojan that pretends to be msnmsgs.exe. While reading some steps for removal (unsuccessful ones btw) I made my way to the add/remove programs window in the control panel. It then said to click to Add/remove windows components and scroll down to find 'windows messenger', tick it and remove it.

Well, when I did that and restarted I noticed I was missing things such as shortcuts on my toolbars and the IE shortcut was gone. I could live with that -just remake 'em. Now I notice my 'volume control' (you know, the one with all the master volumes in accessories>entertainment) is gone. I can't seem to find it on the drive at all either...any suggestions of how to reverse this? I distinctly remember only having 'windows messenger' ticked when I told the windows component wizard to remove. Maybe it did something unexpected? Anyways, any help appreciated.

[ 09-26-2005, 11:58 PM: Message edited by: SpiritWarrior ]

ZFR · 09-26-2005, 03:45 PM

Start->Settings->Control Panel->Sound and Audio Deices->Make sure "Place volume icon on taskbar" is checked.

btw, did you try Lavasoft Adaware and Spybot - Search and Destroy (try a google search for this, forgot the webpage)?

Melcheor · 09-26-2005, 05:27 PM

Get a good virus scanner along with the suff ZFR mentioned. Back up important stuff quick! (BG2 savegames for instance...) Can never be too careful.

LennonCook · 09-26-2005, 11:14 PM

Quote:

Originally posted by SpiritWarrior:
Well, when I did that and restarted I noticed I was missing things such as shortcuts on my toolbars and the IE shortcut was gone. I could live with that -just remake 'em. Now I notice my 'volume control' (you know, the one with all the master volumes in accessories>entertainment) is gone. I can't seem to find it on the drive at all either...any suggestions of how to reverse this? I distinctly remember only having 'windows messenger' ticked when I told the windows component wizard to remove. Maybe it did something unexpected? Anyways, any help appreciated.

At a guess, the Windows Messenger icon still exists?

And the way to avoid Bad Things: Firefox + Spybot SD + AVG Free. Uninstall whatever virus protector you have first, or things could go wrong. Forgo ad-aware, it isn't what it used to be.

SpiritWarrior · 09-27-2005, 12:18 AM

Thank you for the replies, guys. The earlier suggestions didn't work for me unfortunately but I finally found the solution here http://support.microsoft.com/default...b;en-us;319095

I still have some sort of trojan parading around and I can't seem to get rid of it. Norton picks it up as an IE hijack but always 'fails' when I try to remove it. Spybot and Adaware find it, seem to delete it and yet the process msmsgs.exe (I mispelled it earlier in my post) continues to boot up. If I 'end task' on it, it re-appears 5 minutes later. It is not windows messenger but (from what I read) a trojan disguised as one. Both MSN and Windows Messenger (the one in the startup services tab) are disabled and from its persistant behavior it acts like a virus or worm. Anyone heard of this one yet?

I even looked for certain registry keys recommended by Norton for manual deletion yet they weren't there, leading me to beleive that maybe this process is all that remains but is in effect, doing nothing. Still, it bugs me that its there : /.

T-D-C · 09-27-2005, 12:31 AM

The below process usually works well.

1) Turn off System Restore
2) Boot into Safe Mode
3) Scan with AV and Spyware tools
4) Clear your Internet Temp Files.
5) Reboot

Cheers!

SpiritWarrior · 09-27-2005, 03:07 AM

Not this time I'm afraid

. I had done all that and still it persists. This is a tough one but I still have a few tricks to try hehe. Will keep ya posted.

LennonCook · 09-27-2005, 04:17 AM

Quote:

Originally posted by SpiritWarrior:
Thank you for the replies, guys. The earlier suggestions didn't work for me unfortunately but I finally found the solution here http://support.microsoft.com/default...b;en-us;319095

I still have some sort of trojan parading around and I can't seem to get rid of it. Norton picks it up as an IE hijack but always 'fails' when I try to remove it. Spybot and Adaware find it, seem to delete it and yet the process msmsgs.exe (I mispelled it earlier in my post) continues to boot up. If I 'end task' on it, it re-appears 5 minutes later. It is not windows messenger but (from what I read) a trojan disguised as one. Both MSN and Windows Messenger (the one in the startup services tab) are disabled and from its persistant behavior it acts like a virus or worm. Anyone heard of this one yet?

I even looked for certain registry keys recommended by Norton for manual deletion yet they weren't there, leading me to beleive that maybe this process is all that remains but is in effect, doing nothing. Still, it bugs me that its there : /.

Norton antivirus? There's your problem. Replace it with AVG Free (linked above) - download AVG, uninstall Norton, install AVG, run AVG, watch problems disapear.

SpiritWarrior · 09-27-2005, 03:41 PM

I finally cleared it up, found the correct regisry settings to delete and did so.

I take it you don't like Norton then? Are you saying AVG free would be better than NAV professional? If so I may just do that.

Felix The Assassin · 09-27-2005, 10:17 PM

Quote:

Originally posted by SpiritWarrior:
I finally cleared it up, found the correct regisry settings to delete and did so.

I take it you don't like Norton then? Are you saying AVG free would be better than NAV professional? If so I may just do that.

NAV professional?
I have Norton Firewall/AV 'CE' (Corporate Edition) have not had any issues, and have been to some of the links that others have not returned from, without any issues.

Also, look at it his way. You get what you pay for! [img]graemlins/2cents.gif[/img]

--------------------

09-26-2005, 03:29 PM	#1
SpiritWarrior Jack Burton Join Date: May 31, 2002 Location: Ireland Posts: 5,854	So I had this IE hijacker thing going on, a trojan that pretends to be msnmsgs.exe. While reading some steps for removal (unsuccessful ones btw) I made my way to the add/remove programs window in the control panel. It then said to click to Add/remove windows components and scroll down to find 'windows messenger', tick it and remove it. Well, when I did that and restarted I noticed I was missing things such as shortcuts on my toolbars and the IE shortcut was gone. I could live with that -just remake 'em. Now I notice my 'volume control' (you know, the one with all the master volumes in accessories>entertainment) is gone. I can't seem to find it on the drive at all either...any suggestions of how to reverse this? I distinctly remember only having 'windows messenger' ticked when I told the windows component wizard to remove. Maybe it did something unexpected? Anyways, any help appreciated. [ 09-26-2005, 11:58 PM: Message edited by: SpiritWarrior ] __________________ Still I feel like a child when I look at the moon, maybe I grew up a little too soon...

09-26-2005, 03:45 PM	#2
ZFR Legion Symbol Join Date: February 14, 2002 Location: Ireland Age: 39 Posts: 7,367	Start->Settings->Control Panel->Sound and Audio Deices->Make sure "Place volume icon on taskbar" is checked. btw, did you try Lavasoft Adaware and Spybot - Search and Destroy (try a google search for this, forgot the webpage)? __________________ ZFR

09-27-2005, 12:18 AM	#5
SpiritWarrior Jack Burton Join Date: May 31, 2002 Location: Ireland Posts: 5,854	Thank you for the replies, guys. The earlier suggestions didn't work for me unfortunately but I finally found the solution here http://support.microsoft.com/default...b;en-us;319095 I still have some sort of trojan parading around and I can't seem to get rid of it. Norton picks it up as an IE hijack but always 'fails' when I try to remove it. Spybot and Adaware find it, seem to delete it and yet the process msmsgs.exe (I mispelled it earlier in my post) continues to boot up. If I 'end task' on it, it re-appears 5 minutes later. It is not windows messenger but (from what I read) a trojan disguised as one. Both MSN and Windows Messenger (the one in the startup services tab) are disabled and from its persistant behavior it acts like a virus or worm. Anyone heard of this one yet? I even looked for certain registry keys recommended by Norton for manual deletion yet they weren't there, leading me to beleive that maybe this process is all that remains but is in effect, doing nothing. Still, it bugs me that its there : /. __________________ Still I feel like a child when I look at the moon, maybe I grew up a little too soon...

09-27-2005, 12:31 AM	#6
T-D-C Ironworks Moderator Join Date: October 26, 2003 Location: Sydney, Australia Age: 43 Posts: 4,415	The below process usually works well. 1) Turn off System Restore 2) Boot into Safe Mode 3) Scan with AV and Spyware tools 4) Clear your Internet Temp Files. 5) Reboot Cheers! __________________

09-27-2005, 03:07 AM	#7
SpiritWarrior Jack Burton Join Date: May 31, 2002 Location: Ireland Posts: 5,854	Not this time I'm afraid . I had done all that and still it persists. This is a tough one but I still have a few tricks to try hehe. Will keep ya posted. __________________ Still I feel like a child when I look at the moon, maybe I grew up a little too soon...

09-26-2005, 05:27 PM	#3
Melcheor Manshoon Join Date: August 17, 2005 Location: North Yorkshire, Merry old England Age: 37 Posts: 227	Get a good virus scanner along with the suff ZFR mentioned. Back up important stuff quick! (BG2 savegames for instance...) Can never be too careful.

09-27-2005, 03:41 PM	#9
SpiritWarrior Jack Burton Join Date: May 31, 2002 Location: Ireland Posts: 5,854	I finally cleared it up, found the correct regisry settings to delete and did so. I take it you don't like Norton then? Are you saying AVG free would be better than NAV professional? If so I may just do that. __________________ Still I feel like a child when I look at the moon, maybe I grew up a little too soon...

Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
If you could remove all BUT one	Wyvern	Wizards & Warriors Forum	4	08-08-2004 04:52 PM
If you could remove just one	Wyvern	Wizards & Warriors Forum	7	08-05-2004 02:31 PM
how do you remove........	marco	Neverwinter Nights 1 & 2 Also SoU & HotU Forum	5	08-25-2003 10:59 PM
Remove XP Cap	Barloc	Baldurs Gate II Archives	2	10-26-2001 05:37 AM
Remove exp cap	Entreri	Baldurs Gate II Archives	6	01-28-2001 10:39 PM