Windows Antivirus Pro 2009: cannot remove

What is the exact word for word error message that you receive.

You need to remove all of the below files from the C:\Program Files folder and don't save anything here anymore. This folder should only contain more folers that are from installed applications

Code:

2006-07-18 01:22 . 2006-07-18 01:22 10382696 -c--a-w- c:\program files\Napster3726US.exe
2006-05-29 13:09 . 2006-05-29 13:09 469524 -c--a-w- c:\program files\GHC KY-19849 (2).pdf
2006-05-02 00:46 . 2006-05-02 00:46 1126968 -c--a-w- c:\program files\yphotos_setup_us.exe
2006-03-11 01:37 . 2006-03-11 01:37 1483616 -c--a-w- c:\program files\Windows-KB890830-V1.13.exe
2006-03-10 23:16 . 2006-03-10 23:16 7181984 -c--a-w- c:\program files\sdsetup.exe
2006-02-02 02:02 . 2006-02-02 02:01 1360056 -c--a-w- c:\program files\NetSet.exe
2005-11-07 21:34 . 2005-11-05 01:51 9815872 -c--a-w- c:\program files\NapsterSetup-US-3.5.2.3.exe
2005-10-27 02:14 . 2005-10-27 02:14 11768792 -c--a-w- c:\program files\GoogleEarthSetup.exe
2005-10-22 23:46 . 2005-10-22 23:46 10992752 -c--a-w- c:\program files\3511_enu_w2k_xp_release.exe
2005-09-12 19:33 . 2005-09-12 19:33 9918872 -c--a-w- c:\program files\WMEncoder.exe
2005-08-19 01:08 . 2005-08-19 01:07 32175728 -c--a-w- c:\program files\sj652en.exe
2005-06-16 00:34 . 2005-06-16 00:34 2077424 -c--a-w- c:\program files\WindowsXP-KB894391-x86-ENU.exe
2002-03-29 16:08 . 2002-03-29 16:08 4133 -c--a-w- c:\program files\readmeXP_cs780.html
2002-03-08 19:51 . 2002-03-08 19:51 1159 -c--a-w- c:\program files\questionmark.gif
2002-03-08 19:48 . 2002-03-08 19:48 1190 -c--a-w- c:\program files\Splat.gif
2002-03-08 16:32 . 2002-03-08 16:32 6569 -c--a-w- c:\program files\usb.gif
2001-09-29 15:39 . 2001-09-29 15:39 16473 -c----r- c:\program files\icm12.cat
2001-09-28 05:49 . 2001-09-28 05:49 4344 -c----r- c:\program files\ICM12fil.inf
2001-09-28 05:49 . 2001-09-28 05:49 2640 -c----r- c:\program files\ICM12cmp.inf
2001-09-28 05:49 . 2001-09-28 05:49 16275 -c----r- c:\program files\ICM12usb.inf
2001-09-28 05:49 . 2001-09-28 05:49 1339858 -c----r- c:\program files\icm12.cab
2000-10-12 13:39 . 2000-10-12 13:39 3985 -c--a-r- c:\program files\intel.gif

Now we need to use ComboFix

• Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
  • If it is not on your Desktop, the below will not work.
• Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.
• If ComboFix tells you it has expired or need to be updated to a new version, make sure you allow it to update.
• Open Notepad and copy/paste the text in the below quote box into it:

• Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
• At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
• You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
• Now use your mouse to drag CFscript.txt on top of ComboFix.exe
• Follow the prompts.
• When it finishes, a log will be produced named c:\combofix.txt
• I will ask for this log below

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.

Now run Ccleaner. Only use the Run Cleaner button. Do not run anything else on any other forms.

Now download the current version of MGtools (yes another new version) and save it to your root folder. Overwrite your previous MGtools.exe file with this one.

Run MGtools.exe ( Note: If using Vista make sure UAC is still disabled. Also don't double click on it, use right click and select Run As Administrator )


Now attach the below log:

• C:\ComboFix.txt
• C:\MGlogs.zip

Make sure you tell me how things are working now!

 

You appear to be mixing up messages together and your improper use of quoting is making it difficult to follow. Please only quote what is necessary to quote and do not put your own comments within quotes of my messages. Do it like I do below which shows you I say in response to what you said and only quote what you are specifically answering or questioning.

You already told be the below several messages ago.

I'm trying to wade thru all of your messages now to figure out what I need to know. I may have to edit the message to try an clarify things because it is too hard to read right now.

 

Click Start, Run and enter service.msc and click OK. In the Services form scroll down to Windows Installer and double click on it. Does it look like below? Double click to expand the thumbnail.

 

Sorry! I typed it to fast on the way out for dinner. It needs another 's' at the end. It is services.msc

 

Okay then let's do the below one more time.

• Click on Start->Run, and copy-paste the following command (the bolded text) into the "Open" box, and click OK. When it's finished, there will be a log called Win32kDiag.txt on your desktop. Please attach this log

C:\win32kdiag.exe -f -r



Also please try running the below online scan:

http://www.superantispyware.com/onlinescan.html

Reboot immediately after scanning if it finds and removes anything. Let me know if anything was found. It does not save a log.

 

Okay that looks much better and SAS removed a bunch more.


Now we need to scan the system with this special tool.

• Please download Junction.zip and save it to your root folder (C:\Junction.zip)
• Unzip it and put junction.exe in the root folder (C:\junction.exe)
• Now click Start => Run... => Copy and paste the following command in the run box and click OK:
  
  cmd /c c:\junction -s c:\ >C:\log.txt
  ​
• A command prompt window opens and also a license agreement from SysInternals will appear.
• Accept the license agreement and the scan will begin.
• Wait until a log file opens. Attach this C:\log.txt when it finishes (the command prompt window will close when it finishes).
• NOTE: It scans your whole hard disk so if can take a long time. Be patient and don't do anything else while it is scanning.

 

Try downloading it again to your C:\Windows folder and extract it there. Do not use the original files downloaded! Download it again. The see if the below command works:

cmd /c C:\windows\junction -s c:\ >C:\log.txt​

 

Click Start, Run, and enter cmd and click OK. This should open a command prompt window. Enter the below in the Command Prompt window and hit enter.

cd C:\Windows

After entering the above the prompt should change to C:\Windows>

At the new prompt just type junction and hit enter. Do you see the below for a response

Code:

Junction v1.05 - Windows junction creator and reparse point viewer
Copyright (C) 2000-2007 Mark Russinovich
Systems Internals - [URL]http://www.sysinternals.com[/URL]
The first usage is for displaying reparse point information, and the
second usage is for creating or deleting a NTFS junction point:
usage: junction [-s] [-q] <file or directory>
       -q     Don't print error messages (quiet)
       -s     Recurse subdirectories
usage: junction [-d] <junction directory> [<junction target>]
       -d     Delete the specified junction
       example: junction d:\link c:\winnt

 

I did say you need to extract the new dowload to C:\Windows

Then you may not have the file extracted from the ZIP file as requested. Type the below at the command prompt. There is a space after the dir and before and after the >

dir junction*.* > c:\flist.txt

Then attach the C:\flist.txt file here.

 

From message # 67

Talk with you sometime tomorrow night.

 

You were not supposed to unzip it to its own folder. You are supposed to unzip junction.exe into the C:\Windows folder. The below command

cmd /c C:\windows\junction -s c:\ >C:\log.txt
​

will only find junction.exe if it is located in the C:\windows folder. It will not find it if it is located like this C:\Windows\junction\junction.exe


If you now have the junction.exe file located in the C:\windows folder and not the C:\windows\junction folder then you need to use the above bold print command. Doing the above is the same as saying the below with the added .exe

cmd /c C:\windows\junction.exe -s c:\ >C:\log.txt

 

Click Start, Run and enter cmd and click OK. This will open a command prompt window. In the command prompt window, enter the below commands each followed by the Enter key. Note there are spaces after the cd and after each dir

cd C:\Windows
dir > C:\flist.txt
dir > C:\flist2.txt

Now attach the two logs created ( C:\flist.txt and C:\flist2.txt )

 

Please do the below.

First run this: Resetting Registry and File Permissions

Now download the current version of MGtools and save it to your root folder. Overwrite your previous MGtools.exe file with this one.

Run MGtools.exe ( Note: If using Vista make sure UAC is still disabled. Also don't double click on it, use right click and select Run As Administrator )


Now attach the below log:

• C:\MGlogs.zip

Now run the C:\MGtools\FixPerm.bat file by double clicking on it. It may run quickly or it may take awhile to run if it can run properly. Attach the C:\MGtools\junclog.txt file that hopefully will be created.


Now since it has been a number of days, I need a refresher on exactly what problems you are still having at this point. After doing all of the above, please itemize the exact problems that remain for me.