Cannot get rid of ppupdstub.exe

Every time I start my computer I get an error message that Windows cannot find a program it is trying to load.

The program is identified as: "C:\PROGRAM~1\COMMON~1\Scanner\PPUPD~1.EXE"

CCleaner shows the following startup entry in the Registry:

HKLM:Runonce

ppupdstub

C:\PROGRAM~1\COMMON~1\Scanner\PPUPD~1.EXE "C:\PROGRAM~1\COMMON~1\Scanner\ppctl.dll"

I delete the entry. When I reboot, the same error occurs. Something IN my computer keeps resetting this Registry key.

I have also tried to locate the files ppupdstub.exe and ppctl.dll on my computer but they do not exist. There is no such folder as C:\Program Files\Common Files\Scanner.

Current updated version of Webroot Spysweeper does not identify any threat, nor does Norton Antivirus. But something is in my computer which keeps on writing the entry into the registry.

Do you have ANY idea what this could be? This is driving me crazy and it's a bit spooky, too. Help!!!!

Do you have PestPatrol installed on your computer?

This may help check out the last post

http://forum.zonelabs.org/zonelabs/board/m...;message.id=326

If "Pest Patrol" is installed in my computer, it did so without my permission. I have no idea what Pest Patrol is and I do not own it and I never installed it. Furthermore, there is no such program listed with Windows.

The name is certainly appropriate. What a pest.

If "Pest Patrol" is installed in my computer, it did so without my permission. I have no idea what Pest Patrol is and I do not own it and I never installed it. Furthermore, there is no such program listed with Windows.

The name is certainly appropriate. What a pest.

If you read the last post in the link I gave you you will see its just a registry key left behind from one of browsers.

If you read the last post in the link I gave you you will see its just a registry key left behind from one of browsers.

Mike --

Yes I did read it. The problem is that I cannot get rid of the registry key.

No matter how many times I delete the Runonce startup entry key, it comes back. Something in my computer keeps on resetting the key and I have no idea what is doing it or how. That's what I was hoping someone could help me with.

Jerry

That is an indication that you are probably infected with some malware. Can you try to run an online scan at http://www.ewido.net/en/onlinescan/ (needs to run on Internet Explorer).

O4 - HKLM\..\RunOnce: [ppupdstub] C:\PROGRA~1\CA\ETRUST~1\core\PPUPDS~1.EXE "C:\PROGRA~1\COMMON~1\Scanner\ppctl.dll"

belongs to PestPatrol Version 5 SDK and is no Malware.

Was this a "fly by installation" from Netscape?s Security-Center?

There might be more than one file responsible for the startup of the program

Start MSConfig and try to deactivate the necessary services that belong to PP.

Have aswell a closer look to:

Windows NT 'Wininit.ini':

PendingFileRenameOperations: C:\Program Files\Common Files\pestpatrol\ppupdstub.exe

Oliver

[...]

[...]

Sorry admins for the double-posts - the Forum starts getting awfully slow concerning server-responses. :)

Oliver

O4 - HKLM\..\RunOnce: [ppupdstub] C:\PROGRA~1\CA\ETRUST~1\core\PPUPDS~1.EXE "C:\PROGRA~1\COMMON~1\Scanner\ppctl.dll"

belongs to PestPatrol Version 5 SDK and is no Malware.

Was this a "fly by installation" from Netscape?s Security-Center?

There might be more than one file responsible for the startup of the program

Start MSConfig and try to deactivate the necessary services that belong to PP.

Have aswell a closer look to:

Windows NT 'Wininit.ini':

PendingFileRenameOperations: C:\Program Files\Common Files\pestpatrol\ppupdstub.exe

Oliver

Oliver

Thanks for your reply. I don't know what a "fly-by" installation is, but Netscape IS my browser of choice. I don't use IE at all. I never purposely installed Pest Patrol. I cannot get rid of it and neither Norton or Spysweeper seem to find anything improper. No matter how many times I delete the registry key, SOMETHING keeps on putting the key back. I ran HijackThis a short time ago, and guess what it finds:

O4 - HKLM\..\RunOnce: [ppupdstub] C:\PROGRA~1\COMMON~1\Scanner\PPUPDS~1.EXE "C:\PROGRA~1\COMMON~1\Scanner\ppctl.dll" "C:\DOCUME~1\JERRYB~1\LOCALS~1\Temp\PPCTLD~1.PPU"

Yes, it's baaaccccckkkkk.....

Again, NONE of these files exist on my computer, yet some process keeps on inserting this key into my registry.

There does not seem to be anyone in the entire world who knows what this is. Thanks for your help.

As Oliver and I have tried to point out Netscape or Yahoo use pestpatrol to run once. Thats the area to look at

JerryB. wrote:

[...]I don't know what a "fly-by" installation is[...]

...it is an unwanted installation of a smaller and hidden secondary programm coming together with the major program. Originally you probably just wanted Netscape (8.1?) and you secretly got Pest Patrol aswell... it is like a big shark that is followed by smaller fishes in the hope to get their little share... that?s how the internet ticks nowadays - it?s all about money...

Start MSConfig (over Start >>> Run).

proceed to the Services-Tab and tick the box for "Hiding MS-Sevices". (I am just translating from a German System here - so I don?t know if the terms a correct).

the remaining Non-MS-Services can be deactivated (not deleted) so that with the next System-Start you?ll boot into a plain Windows environment without secondary programs. (Same with Safe-Boot over F8).

Figure out which service is responsible for PP and delete it - afterwards it is possible to delete the PP entries out of the "Run"-Keys of the Registry.

Oliver