My regedit.exe file is 'missing'

[dunedin]

Bob,

Yes, that is the problem with all the virus/spyware scanners. Not one of them will find everything. You have to run a few different ones to get the best detection. It is all the more difficult when we do not know the name of the nasty.

So, you can`t do an online scan because the address is too long. Just so that I`m clear here, can you go to any long addresses, or is it just the online scans you cannot access?
Some nasties actually stop you accessing online scans so that you cannot clean them out.

That being the case, underneath are some more downloadable cleaners. We have not done malware cleaners yet so give them a go. It could well be that.

1.Microsoft Windows Malicious Software Removal Tool
http://www.microsoft.com/downloads/d...displaylang=en

2. a-squared
http://www.emsisoft.com/en/software/free/

3. Spybot Search and Destroy
http://www.safer-networking.org/en/download/
Update it before running. Get it to fix all the RED entries it finds

4. Microsoft Windows Antispyware
http://www.microsoft.com/athome/secu...e/default.mspx

If these don`t find anything you will have to use our ultimate weapon HijackThis.

Try these first.

Elaine

[BobUK]

Elaine...Gratefull thanks to you and everyone else who are trying to help the 'old-man' You just caught me as I was going to go out and get an upgrade so that I could register the programmes that I just purchased. They are two cleaning programmes that I thought might help me. Them being NoAdware and PCConPoint.

Whatever 'virus' that I have is doing exactly what you are saying, it is stopping me getting into these sites.

I do have SpyBot and run it often.

I will try your suggestions Elaine and then get back to you.

Regards
BobUK

[WhitPhil]

I would suggest downloading, installing and running HiJackThis

Then, go to the HiJackThis Logfiles forum, start a new thread, reference this one, and copy/paste the created LOG file there.

[BobUK]

Elaine....Many thanks again...now

1.Microsoft Windows Malicious Software Removal Tool
Result was No malicious software was detected.

2. a-squared
Result was a message of 'an error occured while uploading'

3. Spybot Search and Destroy
Result was ok.

4. Microsoft Windows Antispyware
I am not sure how this was works Elaine

If these don`t find anything you will have to use our ultimate weapon HijackThis.

WhitPhil...Thanks for your input and I ran this one and the resuly was over 5 pages long of 'gobbledegook' which to you kind people will be 'interesting reading'

Advise please...

BobUK

[dunedin]

Bob

Instructions for HijackThis. Please follow all instructions exactly otherwise your log will not be read.

HijackThis http://www.majorgeeks.com/download3155.html


1. Please go to My Computer, open your C:\ drive, Select: New >> Folder and name the folder HJT.

2. Download HijackThis to the new folder:

3. Double Click on 'HijackThis.zip' to extract and install HijackThis.exe to the new folder.

(If you have downloaded the Self-extracting version of Hijackthis, then it will automatically install in C:\Program Files\HijackThis directory.)

4. Close ALL windows except HJT


5. SCAN with HJT and SAVE LOG. (a notepad window will open with the log in it when you click Save Log) (Ctrl-A to 'select all', Ctrl-C to 'copy')

6. POST the log a new thread (Ctrl-V to 'paste')

Go to the HijackThis Forum
http://discussions.virtualdr.com/for...?s=&forumid=71

Read the "Stickies" for instructions how to use this program

At the beginning of you post, tell them that you have run stand alone virus and spyware removal programs, but you cannot run an online scan. Also give just a short summary of your problems.

This will find all malware on your system, but be sure to follow all their instructions carefully.
It is a busy forum so just be patient.

Elaine

[WhitPhil]

Go to the HJT forum (link above), start a new post, briefly describe your problem, reference this thread, and then copy/paste the LOG file (the gobbledegook) into the post.

[smitee]

Are any of these on your machine?

cmd.com
regedit.com
taskkill.com
tasklist.com

http://www.trendmicro.com/vinfo/viru...LCAN.A&VSect=T

smitee

[BobUK]

Smitee...Thank you for your input and my machine does not have any of those names you quoted running.

The 'bug' would not let the site download.

I am using my 'daughters' PC at this moment because mine keeps 'freezing'

Thanks to EVERYONE and I am going as fast as my 'computer' will let me.

Regards
BobUK

[lgbpop]

WhitPhil...Thanks for your input and I ran this one and the resuly was over 5 pages long of 'gobbledegook' which to you kind people will be 'interesting reading'

Bob, if you still have this log you referred to, please post it for starters. If necessary, put halves of it in successive posts. Don't worry about its length...the longest one here so far was seven halves.

[BobUK]

Bob, if you still have this log you referred to, please post it for starters. If necessary, put halves of it in successive posts. Don't worry about its length...the longest one here so far was seven halves.

Igbpop...Thank's again to you. I have posted it and hope that it is accepted by the site as I am always grateful to Virtual Dr for any help given.

Regards
BobUK

UPDATE...

I ran the programme NoAdware and I quote some of the files etc that it found and maybe there are clues there:-

W32.Lovegate.ADC\Windows\System32\Raymond.eFile

W32\Netsky.c@NC\Windows\Winlogan. (with) exe

I could not activate the programme because I could not Register it without Regedit.exe.

[dunedin]

Bob,

Oh yes. These are nasties alright Need to get rid of them

Are you sure you posted your log on the HijackThis forum? I went to have a look at it, but I can`t see it.
Maybe I`m just going blind

Elaine

[BobUK]

Elaine... I did post it on the HiJack Section and I cant see it either. Perhaps I did somethig wrong but I thought it looked ok. Perhaps it was too long.

If I could only get the regedit.exe I could 'register' my programme and then it would get rid of these nasties Elaine.

Regards
BobUK

[dunedin]

Well Bob, you seem to be between a rock and a hard place.

Try posting the log again.
I have searched for removal tools for both of these nasties, but I can`t find any for the variations you have. (there are so many variations of both of them)

I found these tools to run. I don`t know if they are for your variants or not, but it won`t do any harm to try them. Download them with your other machine.

http://www.grisoft.com/doc/Utilities/lng/us/tpl/tpl01

Scroll down and look for
(Supplemental File rmlovgte.exe)
(Supplemental File rmnetsky_a2d.exe)

They were both added recently, so you might be lucky.


Here is another program to try.
Just download it and run it. It is actually very good. Remember to stay offline.
There are free and paid for versions, but it is the same download. At the end of 2 weeks you will get nags about paying for it and if you do not, you will be left with the free version functionality.
However it will work well for you just now, so try it.

http://www.ewido.net/en/download/

When installing, under "Additional Options" uncheck "Install background guard" and "Install scan via context menu."
Launch ewido, there should be a big "E" icon on your desktop, double-click it.
The program will prompt you to update; click the "OK" button
The program will now go to the main screen
Update ewido:
You will need to update ewido to the latest definition files.
On the left hand side of the main screen click update
Click on Start
The update will start and a progress bar will show the updates being installed.

If it finds anything write the name down so we know what is beung fixed (if anything)

I will look for more removal tools, but try posting the log again.

Elaine

PS
Try repairing "regedit" but it might not work

http://www.kellys-korner-xp.com/xp_tweaks.htm

Line 173 left hand side

[Train]

Start by running McAfee AVERT Stinger from here.
It will fit on a floppy and lists both of the 2 you listed.
Plus about 40 more. I have used it in the past and have had good enough results that I was able to run
Panda http://www.pandasoftware.com/active...n_principal.htm

Trend Micro Housecall http://housecall.trendmicro.com/

Run both, maybe one will get what the other missed.

[BobUK]

Elaine and Train many thanks for your suggestions...

I have started with Ewido and the prog opened with the question "Ewido Security Suite has detected that the guard is not running. Do you want to restart" ? So I said Yes.

The prog found 14 Objects incl quite a lot of 'spyware strips' and others of which I will post when the prog ends.

Ewido has left me with one question that I need advice on please and I quote the question that require eithr Yes or No for the programme to finish.

I quote "The file C\Documents and Settings\Robert\My Documents\xoftspy/1 cannot be removed because it is embedded in the archive of the same name.

Do you want to remove the who archive ?

I will leave the PC running as is until I get a reply.

Regards and thanks
BobUK

The file