Windows Message

Hi, first contribution so I hope that this is the right place to pose my question. I have posted to a couple of other Tech Help forums but received no response so I am hoping that someone at 'Geeks' can help me.

Last week I installed and then uninstalled Opera browser.

A couple of days ago I ran a scan with Process Explorer and Virus Total picked up a few false positives. When I tried to investigate this by clicking the Virus Total result, I was unable to make any progress because of this message:



Any advice would be welcome.

Thanks.

 

What Operating System do you have on that computer?
Have you checked in File Associations (ie program defaults) to see if, despite uninstalling it, Opera is still set as the default web browser?

 

Hi Max, thanks for your reply.
My Operating System is Vista Home Premium. Pale Moon is still set as my default browser. No sign of Opera.

 

To remove any traces of Opera it is safe to use CCleaner Slim
in its default settings.
Run CCleaner > Cleaner and remove all found.
Run CCleaner > Registry > Scan for issues > choose 'fix all issues' and agree to the back up it suggests each time.
Run the Registry > Scan for issues as many times as needed until it finds 'zero' issues.

 

Hi Max, I followed the instructions but the problem prevails.

 

If you didn't restart your system after using CCleaner, I suggest you do that now and see what happens.
I would also make sure Process Explorer is fully shut down on your system before starting it again.

 

Hi Max, the restart made no difference and I deleted Process Explorer then replaced it with the latest edition but to no avail. It would appear that there is no simple solution to my problem (but it is more of an annoyance than a problem). My computer is running well and it can survive without analysing the Virus Total results. Although I appreciate your suggestions I will understand if you would prefer to offer your advice to someone with more serious issues.

P.S.
I'm sure I recognise you from somewhere.

 

Hi Ted

I think as long as you keep the OS Vista up to date, and have a decent third-party software real-time Anti-Virus program installed and kept up to date, then you should be fine.
For general advice on how best to do that, read through this MajorGeeks guide:
http://forums.majorgeeks.com/index.php?threads/how-to-protect-yourself-from-malware.44525/

PS: It's not me but the person I feel best suited to lead the government of my country.

 

Okay, Max. Will do.

Thanks again.

 

Hi plodr, no sign of Opera....but....there is this: ehshell.exe Command Line "C:\Windows\eHome\ehshell.exe""%1"

Could this be the culprit?

 

That is part of Windows Media and an Operating System file.
To carry out a general check on system files, carry out an administrator command prompt sfc /scannow
See this guide, scroll down to the section for Vista
https://support.microsoft.com/en-gb/kb/929833
To see a simple to read text file of the results see here:
https://support.microsoft.com/en-gb/kb/929833#bookmark-cbs log

 

Does Autoruns come up with anything Opera related?
http://www.majorgeeks.com/files/details/microsoft_autoruns.html

HowToGeek lesson on Autoruns: http://www.howtogeek.com/school/sysinternals-pro/lesson6/all/

 

Scannow results:

Windows Resource Protection found corrupt files but was unable to fix some of them. Details are included in the CBS.Log %WinDir%\Logs\CBS\CBS.log.

When I type in the 'findstr' command and press 'Enter' , the command disappears so I am unable to read the results.

 

Hi satrow, no, not a sign of Opera in Autoruns

 

If I type 'Opera' into Search I get results for the shortcut and the application but if I try to open the file a Windows message tells me it cannot find them

 

Hmm, it must be in file associations somewhere then, not familiar with Vista but in W7: Control Panel\All Control Panel Items\Default Programs\Set Associations and scan through that resulting list, replacing anything down as Opera back to Pale Moon.

 

You have to copy and paste the entire long line from that findstr line in the guide. I couldn't just read it and type it by hand, I'd definitely make a mistake! It places a text file on your Desktop. Yes the command prompt window closes because it has placed the text file there. The text file will be there among whatever else shows on your desktop.

For the below, as satrow says, there really must be a file association still existing for Opera. Control Panel > Default Programs - it must be showing there somewhere.

 

Thanks Max. I thought that I did C&P the line into the text box but I may not have copied the entire line. Will try again.
I followed satro's suggestion but there was no sign of Opera. Then I took the following steps: Computer>CDrive>Search and the Opera shortcut and the OperaSetupWinxpvista Application are displayed. If I hover over the Folder the location is shown but neither are in their appropriate locations.

 

If you can navigate to that folder are you saying it is empty?
I would make sure you have the file view setting 'Show all hidden files and folders'
http://www.bleepingcomputer.com/tutorials/how-to-see-hidden-files-in-windows-vista/

 

This is what happens when I try to access the folder

I had 'Show hidden files and folders' checked when I searched.

 

It's easier to first make sure you have all files set to view, as I mentioned earlier, and then go directly to the file itself.

 

I made sure that the full line was copied but again, on pressing Enter, no results are shown.

Probably an unrelated issue?

 

Max, I need to go out, now so I will be unable to reply to any posts until this evening.
As I said previously , this is an issue that I can live with. I feel a bit guilty troubling yourself and the other advisers but I am very grateful for your help and I would like to solve this frustrating problem. Having said that, if you have contributors with more urgent needs, please put me to the end of the queue.

Ted.

 

No worries Ted. If it's not a problem then just leave it.

 

I agree with MaxTurner.
Process Explorer is probably finding an obsolete registry entry and CCleaner's Registry Cleaner is almost worthless.
If you want a registry cleaner that will find Opera-related entries, I will make a recommendation.
If this issue doesn't interfere with your day-to-day workings, ignore it.

FYI...

We don't do that.
And MaxTurner will stay with you to the end.

 

A pleasure to correspond with you guys. As I mentioned in my OP, I had posted to two other Tech Help forums (I have still received no response from either) before registering with Major Geeks where I couldn't have asked for better attention. It would be useful to employ Process Explorer/Virus Total to its fullest potential but this is only an inconvenience and not interfering with my daily use of the computer. If anyone can throw any more ideas into the mix I would appreciate it but I do understand that this is a frustrating issue with no simple solution and you probably have bigger fish to fry.

@Eldon. I've been led to believe that registry cleaners can be a bit dangerous to use but if you can recommend something that might help me I am willing to try it.

 

Eusing Free Registry Cleaner is the only registry cleaner I will recommend.
http://www.majorgeeks.com/files/details/eusing_free_registry_cleaner.html

Run it, uncheck everything and then look for entries relating to Opera. Only clean those. Restart the PC.
FYI The program does create a registry backup prior to cleaning.

 

Hi Eldon. Please excuse my tentativeness but I don't want to make any mistakes here.

I have just opened Eusing Reg Cleaner and everything is checked:

Do I uncheck everything now or press scan registry?

 

Please ignore the above post.

I ran the Reg Cleaner and found two entries relating to Opera then cleaned them. But it has made no difference.

These entries still show up when I search C Drive:

 

Download the appropriate version of SystemLook for your Vista operating system (32 or 64 bit) from http://jpshortstuff.247fixes.com/SystemLook.html

Launch SystemLook and paste the content of the following code box into the edit window then press Look.

Code:

:reg
HKCU\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http /s

:regfind
OperaStable

When the scan completes, a logfile will open. Post the content of the logfile.

 

SystemLook 30.07.11 by jpshortstuff
Log created at 08:37 on 14/10/2016 by TEDISTED
Administrator - Elevation successful

========== reg ==========

[HKEY_CURRENT_USER\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http]
(No values found)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice]
"Progid"="OperaStable"


========== regfind ==========

Searching for "OperaStable"
[HKEY_CURRENT_USER\Software\Clients\StartMenuInternet]
@="OperaStable"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\ftp\UserChoice]
"Progid"="OperaStable"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice]
"Progid"="OperaStable"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\https\UserChoice]
"Progid"="OperaStable"
[HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet]
@="OperaStable"
[HKEY_USERS\S-1-5-21-3306118321-2799461415-1222813793-1000\Software\Clients\StartMenuInternet]
@="OperaStable"
[HKEY_USERS\S-1-5-21-3306118321-2799461415-1222813793-1000\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\ftp\UserChoice]
"Progid"="OperaStable"
[HKEY_USERS\S-1-5-21-3306118321-2799461415-1222813793-1000\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice]
"Progid"="OperaStable"
[HKEY_USERS\S-1-5-21-3306118321-2799461415-1222813793-1000\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\https\UserChoice]
"Progid"="OperaStable"

-= EOF =-

Thanks for your reply,nullptr. Please find log as instructed.

 

The screenshot in post #30, are those the results when you search for Opera?
What happens when you open the containg folders?

 

Open notepad and copy/paste the content of the following code box:

Code:

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Clients\StartMenuInternet]
@="IEXPLORE.EXE"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\ftp\UserChoice]
"Progid"="IE.FTP"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice]
"Progid"="IE.HTTP"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\https\UserChoice]
"Progid"="IE.HTTPS"

Save as type: All Files (*.*)
File Name: urlfix.reg

Close any browsers that may be running, then double click on the reg file and allow to merge.
Process Explorer should now launch Internet Explorer for the VT information.

 

Follow _nullptr's advice.
I'll continue to monitor your progress.

 

YESSSSSSSSSS!!!!!!!!!!!!

 

Well it was a long haul but we got there in the end.

I know that this was a comparatively trivial problem but the attention it received was fantastic.

Thank you very much to everyone who contributed to this thread.