Spybot/AVG/CCleaner don't work

Brecki · Apr 19, 2008

and I keep coming up with the same issue. Hope someone can help me.

Of course, it's a registry issue. My concern is that it's continuous when I run these. Never clears up, even when I run in safe mode. So, hopefully you can tell me whether or not it's okay to delete these from my registry. Always says it's changed:

HKEY_USERS\PE_C_ADMIN\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedMRU

HKEY_USERS\PE_C_ADMINISTRATOR\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11DO-9888-006097DEACF9}\Count

HKEY_USERS\PE_C_ADMINISTRATOR\Software\Microsoft\Windows\CurrentVersion\Explorer\UsersAssist\{5E6AB780-7743-11CF-A12B-00AA004AE837}\Count

And, if you could let me know what the heck these are? I am a self-taught registry deleter :eek (kidding). I am learning how to get around the registry, run spyware, etc., and so far, I haven't created any problems or had to reinstall any programs.

Thanks, you guys and gals, for helping me learn what I've learned since my first time on this site. I have learned enough that a programmer has entrusted me to clean up a customers computer in faith. And, well, it's all your guys' fault! Take the credit and go buy yourself a pizza!

blessings to you all, and again, I cannot thank you enough for helping me become independent of having to rely on others to come over and fix what I screwed up (the past).:wave (in other words, my appreciation runs deep!)

TimW · Apr 19, 2008

As you feel this is a registry issue, I have moved your thread to software. If you feel this is not the case then you can start a new thread in Malware after doing this:

Please follow the instructions in the below link and attach the requested logs when you finish these instructions.

READ & RUN ME FIRST. Malware Removal Guide

plodr · Apr 19, 2008

Are you running MRU Blaster?
http://www.javacoolsoftware.com/mrublaster.html
I ask because when searching for the one item "75048700-EF1F-11DO-9888-006097DEACF9" one of two hits I got, the person had been using MRU Blaster. Since the item above it says MRU, I'm thinking maybe it is related.

Okay, this looks like the information

HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre
ntVersion\Explorer\UserAssist\{5E6AB780-7743-11CF-A12B-00AA004AE837}\Count

There will be a series of binary sub-keys called HRZR_EHACVQY:%pfvqy6%\ These are actually your favorites cached in a encrypted form

and this key:

HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre
ntVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count

There will be a series of binary sub-keys called HRZR_EHACVQY:%pfvqy2%\ These are actually the sites you've visited, nicely cached in a encrypted form .
Click to expand...

So my guess is that if you remove them, you'll be erasing the history and your favorites.

Brecki · Apr 20, 2008

Thank you, Tim.

Brecki · Apr 20, 2008

Plodr:
I am not running MRU Blaster that I know of! In fact, I don't recall downloading it. So, to move further into the depths and for a better understanding for myself, could this program be why I am having files show up from 4 years ago (before or directly after formatting hard-drive)? That's what confuses me, actually.

Thank you for this tid bit of information. I am going to research it further and decide whether to take action or not. I also do have another question that is not registry related; suppose I should go to another thread, eh? That will keep you guys from consistently having to move my posts!

Again, thank you!

plodr · Apr 20, 2008

Now I'm confused. You formatted the hard drive and now have 4 year old files showing up? Clearly that is not normal.
As far as the registry keys, I rarely see any mention of HKEY_USERS usually things are in HKEY_CURRENT_USER or HKEY_LOCAL_MACHINE

What you can do is go to the registry section, export these parts
HKEY_USERS\PE_C_ADMIN and HKEY_USERS\PE_C_ADMINISTRATOR to your desktop then remove those three items and reboot.
Use the computer for a few days and see if it behaves, if so, those strings aren't needed.
If, however, it seems broken, click on the reg files on your desktop and import them back and it will be as if you never removed them.

Brecki · Apr 20, 2008

yeah, weird, huh? I figured after formatting a few years back it would have been cleaned up, but as I look, I see stuff that's from up to a year before the formatting, so obviously, something is askew.

I will try what you suggested when time permits. Thank you so much!
Blessings!!!!

Log in or Sign up

Spybot/AVG/CCleaner don't work

Brecki Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

plodr MajorGeek Super Extraordinaire Moderator Staff Member

Brecki Private E-2

Brecki Private E-2

plodr MajorGeek Super Extraordinaire Moderator Staff Member

Brecki Private E-2