Uninstalling program fragments from the registry.

[Peter Jason]

I have Win7 ultimate SP1.

Is it enough to make a system restore point before deleting "registry
keys" from the registry. Is this the same as a "registry backup?"

I have an annoying program that keeps reappearing even though I have
removed everything about it in the normal way.

Peter

 

[Nil]

I have Win7 ultimate SP1.

Is it enough to make a system restore point before deleting "registry
keys" from the registry. Is this the same as a "registry backup?"

I have an annoying program that keeps reappearing even though I have
removed everything about it in the normal way.

Since you decline to say what that program is, you can get only the
most general of answers.

Yes, a Restore Point backs up the registry (plus other stuff.)

Many malware programs insinuate themselves into the system in ways that
are intentionally hard to identify and remove, and unless you are
extremely savvy they're likely to keep coming back no matter how much
you hack at the registry.

 

[MetalStorm©]

I have Win7 ultimate SP1.

Is it enough to make a system restore point before deleting "registry
keys" from the registry. Is this the same as a "registry backup?"

I have an annoying program that keeps reappearing even though I have
removed everything about it in the normal way.

Peter

if its not malware, take a look in the startup or services

 

[Char Jackson]

I have Win7 ultimate SP1.

Is it enough to make a system restore point before deleting "registry
keys" from the registry. Is this the same as a "registry backup?"

I have an annoying program that keeps reappearing even though I have
removed everything about it in the normal way.

There's something about your post that screams, "Danger, Will
Robinson!" (Some will be too young to get that.)

Before you select a Registry key and press the Delete key, go to
Regedit's File menu and select the Export command. Give it a name that
you'll remember and save it in a location that you can find later.
After that, if you decide you want to restore the deleted Registry
keys, just double click the saved file and the keys will be
restored...without making a bunch of other system changes at the same
time.

People use System Restore far too often, IMHO, and usually overlook
the law of unintended consequences.

 

[Peter Jason]

Since you decline to say what that program is, you can get only the
most general of answers.

It's called "zapshares" from www.zapshares.com
It promised to prevent uploads from Internet-downloaded files of the
eMule/Bittorrent/LimeWire/Piratebay type. As you know the p2p works
by allowing auto uploads of downloaded files, and the Zapshare
software promised to prevent this. Alas, it only quarantines
*completed* downloads by removing them to another location, and does
not prevent the uploading of partially-downloaded files. Therefore
this software is useless because completed downloads can be removed
manually anyway.

 

[Peter Jason]

if its not malware, take a look in the startup or services

Not identifiable there. I looked in TCPview too, but it may have a
different name. Is there a "properties" box for the entries in
startup & services?

 

[Peter Jason]

There's something about your post that screams, "Danger, Will
Robinson!" (Some will be too young to get that.)

Before you select a Registry key and press the Delete key, go to
Regedit's File menu and select the Export command. Give it a name that
you'll remember and save it in a location that you can find later.
After that, if you decide you want to restore the deleted Registry
keys, just double click the saved file and the keys will be
restored...without making a bunch of other system changes at the same
time.

People use System Restore far too often, IMHO, and usually overlook
the law of unintended consequences.

Thanks, but I won't touch the registry just yet; until I've tried
other ways.

 

[Nil]

It's called "zapshares" from www.zapshares.com
It promised to prevent uploads from Internet-downloaded files of
the eMule/Bittorrent/LimeWire/Piratebay type. As you know the p2p
works by allowing auto uploads of downloaded files, and the
Zapshare software promised to prevent this. Alas, it only
quarantines *completed* downloads by removing them to another
location, and does not prevent the uploading of
partially-downloaded files. Therefore this software is useless
because completed downloads can be removed manually anyway.

I don't know anything about eMule or Limewire, but any competent
Bittorrent program can do all all that without the need for yet another
program. Zapwares looks to me like it's useless at best and a scam at
worst.

Besides, the spirit of bittorrent is that you take a little and you
also share a little. It's not really fair if you don't reciprocate.

If it really refuses to uninstall cleanly, that supports my idea that
the program is malware. But since you're already "infected", I would
re-install it and then uninstall it, in case something went wrong
during your first uninstall attempt. I would pay close attention to
where it placed its files during the install. If that doesn't work and
it won't uninstall cleanly, I might try Revo Uninstaller.

 

[SC Tom]

There's something about your post that screams, "Danger, Will
Robinson!" (Some will be too young to get that.)

Not too awfully long after, "What's that, Lassie, Timmy's in the well?"

Gawd, we're old farts, aren't we?

Before you select a Registry key and press the Delete key, go to
Regedit's File menu and select the Export command. Give it a name that
you'll remember and save it in a location that you can find later.
After that, if you decide you want to restore the deleted Registry
keys, just double click the saved file and the keys will be
restored...without making a bunch of other system changes at the same
time.

People use System Restore far too often, IMHO, and usually overlook
the law of unintended consequences.

I agree with this method 100%. I even have a folder on my C: drive called RegFiles just for that purpose.

 

[Char Jackson]

Not too awfully long after, "What's that, Lassie, Timmy's in the well?"

Gawd, we're old farts, aren't we?

Yes, but even young'uns have a chance to see some of that stuff since
there are a handful of classic TV channels broadcasting these days.

How about this? "Gee, Wally, do you think Dad's going to be sore with
me?"

I hate to give it away, (heck, it's already obvious), but what about
the classic line from Mom, "Ward, don't you think you were a bit hard
on the Beaver last night?" The 12-year old inside me loves that line.

 

[MetalStorm©]

Not identifiable there. I looked in TCPview too, but it may have a
different name. Is there a "properties" box for the entries in
startup & services?

keep it simple stoooopid. you might gbe looking too deep. lets say
the program is roxio cd creator. if you see anything that says roxio
in start up or services, that is waht you turn off. google some of
the svcs and see what goodgle says about them. if you uninstalled a
obscure program, it makes it a little harder.
when all else fails, do what my techs do after researching for one
minute and than giving up.....reimage

 

[Ed Cryer]

Yes, but even young'uns have a chance to see some of that stuff since
there are a handful of classic TV channels broadcasting these days.

How about this? "Gee, Wally, do you think Dad's going to be sore with
me?"

I hate to give it away, (heck, it's already obvious), but what about
the classic line from Mom, "Ward, don't you think you were a bit hard
on the Beaver last night?" The 12-year old inside me loves that line.

I can only guess at these references; not that I'm a toddler, but I live
in the UK.

How about this for Americans?
"Ah, ah, Jim lad!"

Ed

 

[SC Tom]

I can only guess at these references; not that I'm a toddler, but I live in the UK.

How about this for Americans?
"Ah, ah, Jim lad!"

Got me on that one. About the only thing British that comes to mind is "I don't like Spam!" I used to watch Dr. Who
way back when, but I was in the service when I first saw it, so it's not quite as old as Lassie and Leave it to Beaver.
Older than Lost in Space, though.

Westerns were the main Saturday morning fare when I was a kid, like Lash LaRue, Sky King, Wild Bill Hickok, etc. with a
pirate show (The Buccaneers, IIRC) and Robin Hood thrown in.

 

[Wolf K]

keep it simple stoooopid. you might gbe looking too deep. lets say
the program is roxio cd creator. if you see anything that says roxio
in start up or services, that is waht you turn off. google some of
the svcs and see what goodgle says about them. if you uninstalled a
obscure program, it makes it a little harder.
when all else fails, do what my techs do after researching for one
minute and than giving up.....reimage

CCleaner has a pretty good Start-up control utility included (plus a few
other handy tools, besides its main function of cleaning up junk files).

Wolf K.

 

[Wolf K]

Got me on that one. About the only thing British that comes to mind is
"I don't like Spam!" I used to watch Dr. Who way back when, but I
was in the service when I first saw it, so it's not quite as old as
Lassie and Leave it to Beaver. Older than Lost in Space, though.

Dr Who started in 1963.

http://www.bbc.co.uk/doctorwho/classic/

Westerns were the main Saturday morning fare when I was a kid, like Lash
LaRue, Sky King, Wild Bill Hickok, etc. with a pirate show (The
Buccaneers, IIRC) and Robin Hood thrown in.

Have Gun, Will Travel.

Wolf K.

 

[Philip Herlihy]

I don't know anything about eMule or Limewire, but any competent
Bittorrent program can do all all that without the need for yet another
program. Zapwares looks to me like it's useless at best and a scam at
worst.

Besides, the spirit of bittorrent is that you take a little and you
also share a little. It's not really fair if you don't reciprocate.

If it really refuses to uninstall cleanly, that supports my idea that
the program is malware. But since you're already "infected", I would
re-install it and then uninstall it, in case something went wrong
during your first uninstall attempt. I would pay close attention to
where it placed its files during the install. If that doesn't work and
it won't uninstall cleanly, I might try Revo Uninstaller.

+1 for Revo Uninstaller.

 

[Ed Cryer]

Got me on that one. About the only thing British that comes to mind is
"I don't like Spam!" I used to watch Dr. Who way back when, but I
was in the service when I first saw it, so it's not quite as old as
Lassie and Leave it to Beaver. Older than Lost in Space, though.

Westerns were the main Saturday morning fare when I was a kid, like Lash
LaRue, Sky King, Wild Bill Hickok, etc. with a pirate show (The
Buccaneers, IIRC) and Robin Hood thrown in.

This might put you wise;

Ed

 

[SC Tom]

Dr Who started in 1963.

http://www.bbc.co.uk/doctorwho/classic/

And Lost in Space was 1965, so Dr. Who is older.
http://www.imdb.com/title/tt0058824/

Lassie the series was 1954 http://www.imdb.com/title/tt0046617/
and Leave it to Beaver was 1957 http://www.imdb.com/title/tt0050032/
So they are older than Dr. Who.

Have Gun, Will Travel.

That was a night time series in my area, not a Saturday morning one. But it was a great show just the same

 

[SC Tom]

This might put you wise;

Ed

I was thinking more on the line of TV series, not movies. From the "Jim lad," I had figured a pirate series of some
sort, but couldn't think of a specific one.

 

[Peter Jason]

On Fri, 23 Dec 2011 18:47:06 -0500, MetalStorm©<MetalStorm©> wrote: [...]
if its not malware, take a look in the startup or services

Not identifiable there. I looked in TCPview too, but it may have a
different name. Is there a "properties" box for the entries in
startup& services?

keep it simple stoooopid. you might gbe looking too deep. lets say
the program is roxio cd creator. if you see anything that says roxio
in start up or services, that is waht you turn off. google some of
the svcs and see what goodgle says about them. if you uninstalled a
obscure program, it makes it a little harder.
when all else fails, do what my techs do after researching for one
minute and than giving up.....reimage

CCleaner has a pretty good Start-up control utility included (plus a few
other handy tools, besides its main function of cleaning up junk files).

Wolf K.

Tentatively, I have got rid of it by running a full scan with MS
Security Essentials. This revealed & deleted the following:

Exploit: Java/Blacode.AZ

Exploit: Java/Blacode.AY

Exploit: Java/Blacode.BA

Anyway, it's no longer transferring completed downloads to some remote
folder.

P