Jump to content

TonyKlein

Experienced Members
  • Posts

    586
  • Joined

  • Last visited

Posts posted by TonyKlein

  1. I too am getting a virus message on the Uninst.ext file (win32/zlob.oa). I am using F-Prot. This started showing up about a week ago.

     

     

    OK, so please report the False Positive to F-Prot so they can correct this... I'll report it myself as well.

     

     

    ...

     

     

    done! :)

  2. Well, I'm still unable to duplicate it using the VT scan. Possibly the online scanner isn't using the Extended Virus databases...

     

    Will try http://virusscan.jotti.org/ now...

     

    Now Kaspersky is telling me to delete Ccleaner, or at least the uninstall.exe file. Any opinions?

     

     

    I'll post in the specialized forum in question, where it should be noticed by someone from KAV.

     

    But feel free to contact them yourselves as well. It can only be a FP...

     

     

    ....

     

     

    Well, still unable to duplicate it using either Jotti's or Kaspersky's own online scan:

     

    http://www.kaspersky.com/remoteviruschk

     

    It didn't object to my uninst.exe either...

     

    FP Submitted at the board.

  3. Hi and welcome. :)

     

    It's either a false positive or ALL of us are now infected... LOL!

     

    ... just kidding of course, and I'm unable to duplicate that. I just downloaded the latest version from here:

     

    http://www.ccleaner.com/download/

     

    I uploaded the installer to be tested at http://www.virustotal.com/flash/index_en.html , a site which uses a number of different AVs, including Kaspersky, to scan a file, and the results were negative, as is to be expected.

     

    Not sure what exactly it was you downloaded, or where you found it...

  4. Well, the RegSearch results I requested are in fact a reg export of all keys containing references to (in this case) AOL.

     

    I insisted on seeing said export because, as I mentioned before, every single key DOES need to be examined to be sure that removing it won't have implications for other applcations or for the functioning of Windows itself.

     

    In addition, when searching for a string as short as 'aol', you can be sure that references will pop up that will have no reference to AOL at all.

     

    One case in point was indeed this registry key, which is related to HP scanner software,, and which was found solely because the filename contains 'aol' ...

     

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs]

    "C:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqaol08.exe"=dword:00000001

     

     

    Once I had the integrated RegSearch results I could then create a regfile based on it that would remove all unnecessary or orphaned keys.

     

    We decided to continue outside this thread because we didn't think it was relevant to its original subject, and because of the fact hat the regfile would be applicable to Hazelnut's configuration only anyway.

  5. None at all Tony, and none in C\programs

     

    Still, these orphaned (?) registry entries aren't really causing any problems just by being there...

     

    But please do the following:

     

    Download Registry Search and extract it (preferably) to a new folder. Doubleclick the icon to run the application, and fill in the search string of your choice (I supposed you searched for AOL)

     

    Click "OK" and Registry Search will search the Registry which will take a little time. When done it will open the results in your text editor.

     

    Then please post them here so that we can have a look (sure hope it's not too much...).

  6. I'd urge caution, even in a case like this.

     

    Generally, each reg key or value needs to be individually examined, their dependencies checked, and I'm simply not so careless as to tell you that it's perfectly alright to get rid of everything in one fell swoop, especially without the benefit of direct access to your computer...

     

    It is certainly possible that most if not all of it can go, but you simply need to know what you're doing.

     

    First I'd again have a look in Add/Remove Programs. Anything AOL listed there?

  7. Should it have been a DWORD value to begin with?

     

    Yes, and that's just the way Windows is wired. Specific values need to be of a certain type, or Windows won't know what to do with them, and this particular restriction needs to be implemented as a DWORD value.

     

    I'll have to check out that registry editor. Most times when I have to find something in the registry I do a search with RegSeeker and then find the corresponding item in regedit.

     

    Try Registrar. You'll like it a LOT.

     

    Speaking of which, have you tried using Locate32 instead of Microsofts regular search function?

     

    Nope, but I use File Locator Pro for that, which is also an excellent replacement for Windows search.

    It also has a freeware equivalent: Agent Ransack, and I can recomment that one as well.

     

    Neither actually caches your files, like Locate32 or the various Desktop search tools do, but they are extremely fast nonetheless.

     

    http://www.mythicsoft.com/filelocatorpro/

  8. BTW, I'd just like to use this occasion to plug Resplendence's Registrar Registry Manager.

     

    It is such a HUGE improvement on Windows' native Regedit that everyone who edits or even thinks he/she will ever need to edit the Registry should install it.

     

    I'm using the Pro version myself, and Resplendence is no longer offering the original Lite 2.0 (having replaced it with a Pro lite/trial with nag screens instead) , but I still managed to find a download here

     

    The best free Windows 95/98/NT/2000/XP Registry Editor anywhere. The Search facility alone is worth the download – unlike the standard Windows REGEDIT which only allows you to search in step mode fashion, with Registrar Lite you can search the entire Registry or selected trees in one go with all matches presented together, an immense time saviour when you want to delete, for example, all references to a particular piece of software. You can also search for key names only, for value names only, for data values only, or any combination of the three. You can set bookmarks, and have bookmarks coloured. Registrar Lite also includes helpful descriptions about the most common registry keys, the facility to backup or restore your registry, property sheets for keys, the ability to expand a whole subtree in one go, and more, and more. And this is just the free version – the full version adds powerful remote facilities for the administration of user registries in a network environment, multiple undo, registry monitoring and defrag as well as a number of other extras. An indispensable tool for anyone who edits the Windows Registry.

     

    And it searches about a zillion times faster than Regedit does....

  9. As for the inability to modify the value data, it could possibly be a permissions issue, but why then would it let you rename the value? Weird...

     

    In any case, you can now delete the "NoSaveSettings OLD" value as it isn't recognized by Windows anyway.

     

    ....

     

    Ah, now I see...

     

    Your original NoSaveSettings (now NoSaveSettings OLD) was a binary value instead of the required DWORD value.

     

    Second time around you did indeed create a DWORD value, and not surprisingly it does work. :)

  10. To be sure, almost EVERY program's uninstaller leaves an enormous amount of junk behind, and even manually searching the registry for 'just' the name of the program won't get all of it.

     

    There are often registry keys containing short (8.3) file paths and so on that will sometimes fail to show up in such a search.

     

    I'm afraid 'registry bloat' is a fact of life when you add and remove software on a regular basis...

     

    An install monitor that takes snapshots before and after is the best way to keep that in check. (Ashampoo Uninstaller, Total Uninstall, Advanced Uninstaller Pro)

  11. As you may already have found out yourself, Viewpoint's Media Player is also packaged with the AOL client, and possibly with other software.

     

    Although in itself harmless, it's quite allright to get rid of that "@viewpoint.com"subkey.

     

    Just in case, you also want to have a look whether you have Viewpoint Media Player listed in Add/Remove Software, in which case I'd uninstall it.

×
×
  • Create New...

Important Information

By using this site, you agree to our Terms of Use.