Pop-ups intempestifs "Windows Installer"
alain78700
-
edouard -
edouard -
Hello,
for a few weeks now I have been suffering from unsolicited Windows Installer popups in several cases:
- when I right-click on certain icons or files
- when I try to delete files in Windows Explorer
- when I try to launch certain applications by "double-clicking" on their icon.
On this popup, it tells me that I am trying to use a network resource that is unavailable and asks me to click "OK" to retry or to specify another path to the directory that contains the installation package "Symantec Antivirus.msi". And in the box where I need to enter this path, it suggests as a source:
C:\Documents and Settings\...\Local Settings\Temp\WZSE0.TMP\
By clicking once or several times on the "Cancel" button of this popup, I can continue with the action I was undertaking normally. But it’s a bit annoying and I would like to return to normal functioning.
And for about the same period, I have a problem with launching Internet Explorer sessions: it takes about 5 minutes and I don’t understand why. Once the session is open, browsing the Internet works fine, but as soon as I need to open a new window, it’s back to 5 minutes.
I don’t know if the two problems are related.
I am on Windows 2000 with IE 6.0.2800.
I used to have Norton on this machine when I was using it for professional needs, but since I could no longer update it now that this machine is only for private use, I replaced it with Antivir and Spybot (which I use regularly and which have not detected anything particular). However, my uninstallation of Norton has apparently not been correct since I still see 'Symantec Antivirus' in the list provided by 'Add/Remove Programs' in the Control Panel. But I cannot uninstall it further (installation source of the product not available).
If you have any ideas to fix these problems, thank you in advance.
for a few weeks now I have been suffering from unsolicited Windows Installer popups in several cases:
- when I right-click on certain icons or files
- when I try to delete files in Windows Explorer
- when I try to launch certain applications by "double-clicking" on their icon.
On this popup, it tells me that I am trying to use a network resource that is unavailable and asks me to click "OK" to retry or to specify another path to the directory that contains the installation package "Symantec Antivirus.msi". And in the box where I need to enter this path, it suggests as a source:
C:\Documents and Settings\...\Local Settings\Temp\WZSE0.TMP\
By clicking once or several times on the "Cancel" button of this popup, I can continue with the action I was undertaking normally. But it’s a bit annoying and I would like to return to normal functioning.
And for about the same period, I have a problem with launching Internet Explorer sessions: it takes about 5 minutes and I don’t understand why. Once the session is open, browsing the Internet works fine, but as soon as I need to open a new window, it’s back to 5 minutes.
I don’t know if the two problems are related.
I am on Windows 2000 with IE 6.0.2800.
I used to have Norton on this machine when I was using it for professional needs, but since I could no longer update it now that this machine is only for private use, I replaced it with Antivir and Spybot (which I use regularly and which have not detected anything particular). However, my uninstallation of Norton has apparently not been correct since I still see 'Symantec Antivirus' in the list provided by 'Add/Remove Programs' in the Control Panel. But I cannot uninstall it further (installation source of the product not available).
If you have any ideas to fix these problems, thank you in advance.
Configuration: Windows 2000 Internet Explorer 6.0
17 answers
-
Hi,
1. First, remove Norton with this: http://service1.symantec.com/SUPPORT/INTER/tsgeninfointl.nsf/en_docid/20050414110429924
2. WZSE0.TMP among the temporary files is highly suspicious. Install rsit and post the logs: https://forum.pcastuces.com/randoms_system_information_tool_rsit-f31s31.htm
++ -
Hello,
I am having some issues executing the requested actions:
1) Norton Removal Tool: when I run it, it tells me that I first need to remove "Symantec Antivirus 9 or later" using the "Add/Remove Programs" component. However, this action fails systematically because I get one of those annoying popups "Windows Installer" asking for "SymantecAntivirus.msi". Since I don't have this file anywhere on my hard drive, the operation fails with the message "The installation source for this product is not available. Verify that the source exists and that you can access it" (translation of the message I have in English).
2) RSIT.exe: I downloaded this utility to my desktop from the provided link. But when I try to run it by "double-clicking" the desktop icon, I get an error saying that RSIT.exe is not a valid Win32 application!! -
Good evening Alain,
Okay. Let's try this:
Create a new folder at the root of C: (for example "hjt", from HijackThis). Go here http://free.antivirus.com/hijackthis/ right-click on "Executable" (not on "Installer"), choose save as and change the name of the program before saving it to hjt.exe. Navigate to save it in C:\hjt. Run a scan with it and post the log. Tutorial here: http://www.infos-du-net.com/forum/271838-11-comment-utiliser-hijackthis (except for the installation part, which should not be done).
++ -
Hello Sandul,
here is the report from the Hijack This analysis:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:32:12, on 12/09/2009
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\ibmpmsvc.exe
C:\Program Files\Aventail\Connect\as32svc.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\drivers\trcboot.exe
C:\Program Files\Personal Communications\PCS_AGNT.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINNT\system32\CTsvcCDA.EXE
C:\WINNT\System32\svchost.exe
C:\Program Files\c4ebreg\isamsmt.exe
C:\WINNT\System32\drivers\ldlcserv.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\ltmsg.exe
C:\WINNT\system32\tp4serv.exe
C:\PROGRA~1\ThinkPad\UTILIT~1\TP98TRAY.EXE
C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
C:\WINNT\system32\PRPCUI.exe
C:\WINNT\system32\dla\tfswctrl.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\BroadJump\Client Foundation\CFD.exe
C:\Program Files\Common Files\Talkway\vmtalk.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Samsung\EmoDio\SMSTray.exe
C:\WINNT\system32\internat.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\Program Files\IBM\Infoprint Select\ipnotify.exe
C:\Program Files\Zone Labs\Integrity Client\iclient.exe
C:\Program Files\Club-Internet\Lanceur\lanceur.exe
C:\WINNT\system32\ZoneLabs\vsmon.exe
C:\Program Files\Club-Internet\Dr Club Internet\bin\mpbtn.exe
C:\WINNT\system32\taskmgr.exe
C:\Program Files\Java\jre1.6.0_02\bin\jucheck.exe
C:\Program Files\ThinkPad\PkgMgr\HOTKEY\TPONSCR.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\progra~1\c4ebreg\c4ebreg.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\hjt\hjt.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://actus.sfr.fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = ftp= ;http=
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;<local>
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (file missing)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.1121.2472\swg.dll (file missing)
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [LTWinModem1] ltmsg.exe 9
O4 - HKLM\..\Run: [TrackPointSrv] tp4serv.exe
O4 - HKLM\..\Run: [ISSI EZUpdate Service] "c:\sdwork\issimsvc.exe"
O4 - HKLM\..\Run: [TPTRAY] C:\PROGRA~1\ThinkPad\UTILIT~1\TP98TRAY.EXE
O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
O4 - HKLM\..\Run: [PRPCMonitor] PRPCUI.exe
O4 - HKLM\..\Run: [C4EBReg] "C:\progra~1\c4ebreg\c4ebreg.exe" /q
O4 - HKLM\..\Run: [ConfigSafe] C:\CFGSAFE\NTFSCLUP.EXE
O4 - HKLM\..\Run: [CSScheduleCheck] C:\CFGSAFE\SCHWIZEX.EXE -CHECK
O4 - HKLM\..\Run: [dla] C:\WINNT\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [ISAM SMT Service] "C:\Program Files\c4ebreg\isamsmt.exe"
O4 - HKLM\..\Run: [stgclean] c:\sdwork\w32main2.exe /cleanup
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [vmtalk] C:\Program Files\Common Files\Talkway\vmtalk.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [SMSTray] C:\Program Files\Samsung\EmoDio\SMSTray.exe
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - HKCU\..\Run: [Creative Detector] C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [EPSON Stylus DX8400 Series] C:\WINNT\system32\spool\DRIVERS\W32X86\3\E_FATICEE.EXE /FU "C:\WINNT\TEMP\E_S1B5.tmp" /EF "HKCU"
O4 - HKCU\..\Run: [72153835536566171752923560629737] C:\Program Files\Antivirus 2009\av2009.exe
O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user')
O4 - Startup: Club Internet.lnk = C:\Program Files\Club-Internet\Lanceur\lanceur.exe
O4 - Global Startup: Docteur Club Internet.lnk = C:\Program Files\Club-Internet\Dr Club Internet\bin\matcli.exe
O4 - Global Startup: Infoprint Select Notification.lnk = C:\Program Files\IBM\Infoprint Select\ipnotify.exe
O4 - Global Startup: Integrity Client.lnk = C:\Program Files\Zone Labs\Integrity Client\iclient.exe
O4 - Global Startup: Lotus QuickStart.lnk = C:\lotus\wordpro\ltsstart.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINNT\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINNT\bdoscandel.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O12 - Plugin for .bcf: C:\Program Files\Internet Explorer\Plugins\NPBelv32.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O12 - Plugin for .swf: C:\Program Files\Netscape\Communicator\Program\PLUGINS\npswf32.dll
O16 - DPF: teleir_cert - https://static.ir.dgi.minefi.gouv.fr/secure/connexion/archives/ie4n4/teleir_cert.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {1754A1BA-A1DF-4F10-B199-AA55AA1A120F} (InstallerBehaviorFactory Class) - https://www.msn.com/fr-fr/
O16 - DPF: {1FF43AD5-2262-4C2F-81D4-26D710C3F305} (VB2S Mannequin Virtuel Control) - http://mannequin.redoute.fr/activex/Mannequin.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} (Symantec Script Runner Class) - https://support.norton.com/sp/en/us/home/current/info
O16 - DPF: {4EC99A0B-E57C-4FBE-B9C4-8428424FBF88} (McciUtilsSpecialFolder Class) - http://motive.club-internet.fr/...
O16 - DPF: {545F0C50-D82C-423E-90F5-B64B8FDA2289} (McciUtilsPath Interface) - http://motive.club-internet.fr/...
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {637E07C0-56A8-41E5-85E8-52DAE23F3091} (McciUtilsDirectory2 Class) - http://motive.club-internet.fr/...
O16 - DPF: {63BAECA2-9E3C-45DE-B2B1-BBC5FA99958E} (MCCWrapperObj Class) - http://motive.club-internet.fr/...
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {9519B2A2-6592-4E41-8290-D0298459270C} (LNWebAssist Class) - http://w3.ibm.com/bluepages/scripts/lnwebassist.cab
O16 - DPF: {9FC5238F-12C4-454F-B1B5-74599A21DE47} (Webshots Photo Uploader) - https://webshots.com/weekly
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O16 - DPF: {DEB21AD3-FDA4-42F6-B57D-EE696A675EE8} (IP-Uploader Control) - http://asp06.photoprintit.de/microsite/1156/defaults/activex/ImageUploader3.cab
O16 - DPF: {EFD3EA56-234D-4240-90EA-CC9FA3AF5A01} (ConnectivityTester Class) - http://motive.club-internet.fr/...
O17 - HKLM\System\CCS\Services\Tcpip\..\{E93B2037-7693-4129-9848-5DE452F226AA}: Domain =
O23 - Service: Avira AntiVir Personal Scheduler - Free Antivirus (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Aventail Connect (As32Svc) - Aventail Corporation - C:\Program Files\Aventail\Connect\as32svc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe (file missing)
O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe (file missing)
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINNT\system32\CTsvcCDA.EXE
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Unknown owner - C:\Program Files\Symantec AntiVirus\DefWatch.exe (file missing)
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: IBM PM Service (IBMPMSVC) - Unknown owner - C:\WINNT\system32\ibmpmsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: ISAM SMT Service (ISAMsmt) - IBM Global Services - C:\Program Files\c4ebreg\isamsmt.exe
O23 - Service: ISSI EZUpdate (ISSIMon) - Unknown owner - c:\sdwork\issimsvc.exe (file missing)
O23 - Service: LocalSystem (ldlcserv) - Unknown owner - C:\WINNT\System32\drivers\ldlcserv.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: SAVRoam (SavRoam) - Unknown owner - C:\Program Files\Symantec AntiVirus\SavRoam.exe (file missing)
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe (file missing)
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe (file missing)
O23 - Service: Symantec AntiVirus - Unknown owner - C:\Program Files\Symantec AntiVirus\Rtvscan.exe (file missing)
O23 - Service: TrcBoot - Unknown owner - C:\WINNT\System32\drivers\trcboot.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINNT\system32\ZoneLabs\vsmon.exe
--
End of file - 13971 bytes -
Hello,
To uninstall Norton and Symantec: Restart by tapping F8 to go into safe mode and choose the admin session. Once there, go to Start, Run, type: regedit and click OK. At the top, click on Edit, Find (Ctrl+F), type: norton, check the boxes for Keys, Values, Data and click Next. The search begins, when a file appears, delete everything related to norton and also look in the right pane, then press F3 to continue the search and do the same until the search is finished. Do the same thing by typing symantec. Still in safe mode, run CCleaner for a proper cleanup and restart.
CCleaner --> https://filehippo.com/download_ccleaner/
--
The human being is at its best when things are at their worst. -
Re,
Norton is partially uninstalled (see hijackthis log).
Do this:
1. If your Spybot Search & Destroy has the Timer module active, disable it as it will interfere with what we are about to do (Launch spybot, Menu mode: click on "advanced" then on "tools", "resident" icon then on the right uncheck Teatimer)
2. Uninstall Symantec Live Update from add/remove programs
3. Try to kill (using Task Manager) these 2 processes: VPTray.exe and ccApp.exe. It's okay if Windows refuses to do it, continue with the next steps.
4. Close all other applications. Launch hijackthis, scan, select the following lines and only these, click on the Fix Checked button and close hijackthis:
O23 - Service: Symantec AntiVirus - Unknown owner - C:\Program Files\Symantec AntiVirus\Rtvscan.exe (file missing)
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe (file missing)
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe (file missing)
O23 - Service: SAVRoam (SavRoam) - Unknown owner - C:\Program Files\Symantec AntiVirus\SavRoam.exe (file missing)
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE (if the line is still present after the uninstallation of Live Update)
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Unknown owner - C:\Program Files\Symantec AntiVirus\DefWatch.exe (file missing)
O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe (file missing)
O17 - HKLM\System\CCS\Services\Tcpip\..\{E93B2037-7693-4129-9848-5DE452F226AA}: Domain =
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.1121.2472\swg.dll (file missing)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (file missing)
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
Uninstall MessengerPlus3. If you want to keep it, reinstall it by checking the box "I refuse to give my support, install messenger without the sponsor"
Download SmitFraudFix here: http://siri.urz.free.fr/Fix/SmitfraudFix.exe
* Double-click the program to launch it.
* Pass the warning message by pressing any key on the keyboard.
* In the menu, select 1.
* At the end of the scan, a report will be generated: C:\rapport.txt.
Post this report in your next reply.
To lighten the reading of this thread, I suggest you post the requested logs on https://www.cjoint.com/ (you will only provide the cjoint links on this thread).
++ -
Hello again Sandul,
I haven't yet taken the action suggested by Ekim55 to uninstall Norton and Symantec. Should I do it?
Regarding what you asked me:
1) I didn't have "Symantec Live Update" in the "Add/Remove Programs" list, so I couldn't uninstall it this way (I think I already uninstalled it that way).
2) I didn't have a "VPTray.exe" or "ccApp.exe" task active in Task Manager.
3) I carried out the requested actions with Hijack This.
4) I can't uninstall "Messenger Plus 3" via "Add/Remove Programs" (I've tried several times in the past without success. It just tells me that Messenger Plus wasn't uninstalled but without any explanation).
5) I ran SmitfraudFix.exe and the scan report is posted here: https://www.cjoint.com/?jmsDuANcEv
Thank you for your help. -
I don't think a direct action in the registry is necessary to get rid of Norton. We'll see during the next Hijack log.
Change the download folder (no longer download in the C:\hjt directory): hjt.exe should remain alone in its directory. You can delete smitfraudfix (the executable + the folder generated in c:\hjt).
OK, on the other hand, for a CCleaner cleanup. Tutorial here: https://www.malekal.com/tutoriel-ccleaner/ You can keep this little software and use it regularly. Do not install the toolbar that comes packaged with CCleaner (there’s a box to uncheck during its installation!)
Download YourUninstaller (21-day trial version limited to 2 uninstallations per run) here: http://www.ursoftware.com/download.php Try to uninstall all the programs you want to get rid of (especially Symantec and Messenger Plus 3). If YourUninstaller crashes, move on to the MBAM cleanup (next step and then return to YourUninstaller to finish).
Finally, download and scan with MBAM. Tutorial here: https://forum.pcastuces.com/malwarebytes_antimalwares___tutoriel-f31s3.htm Delete everything MBAM finds, restart, open MBAM again and clear its quarantine.
Run CCleaner again (files + registry).
Post the MBAM report and a new hijackthis on cjoint.
++-
Hello Sandul,
I installed CCleaner and I already cleaned up the files. For the registry, can I safely delete everything it indicates? (I really have a lot of entries!!)
As for "YourUnInstaller", I was able to uninstall Symantec Antivirus (it no longer appears in my "Add/Remove Programs" list). However, "Messenger Plus 3" is still resisting. The uninstallation with "Your Uninstaller" failed.
I'll do the MBAM part tomorrow.
Thanks again and see you later.
-
-
My proposal in point 5 is just a suggestion sandul and alain78700, if there is a program that has issues with uninstallation, this intervention in the registry can help remove any stubborn program along with its remnants in a radical and unprecedented way, very effectively in safe mode when there are no active processes.
Good continuation.
--
Human beings are at their best when things are at their worst. -
@Ekim: I never said otherwise, but I prefer to work directly with the registry only as a last resort. It's easy to make a mistake (it has happened to me several times). Don't take it the wrong way...
Alain,
Yes, CCleaner is really well made. You can safely remove what it suggests (generally this is not the case with other registry cleaners). And it's normal to have hundreds of error lines. Clean the registry multiple times (usually 3) until CCleaner finds nothing more
Okay for the next steps. I'm waiting for your MBAM and hijackthis logs tomorrow
Good night -
No problem, Sandul, you don't know me well, it was just a suggestion that could help you and after all, we are here to support each other.
--
Human beings are at their best when things are at their worst. -
Good evening Sandul,
I have completed the requested operations:
1) The MBAM report is posted here: https://www.cjoint.com/?jnt0iSOcyL
2) The report from the new HijackThis run is posted here: https://www.cjoint.com/?jnt1mtuKHW
Regarding CCleaner, there are only 3 lines left:
Non-existent ActiveX/COM InProcServer32\C:\WINNT\System32\macromed\flash\Flash.ocx HKCR\CLSID\{1171A62F-05D2-11D1-83FC-00A0C9089C5A}
Invalid application path HijackThis.exe - C:\hjt\hijackthis.exe HKLM\Sofware\Microsoft\Windows\CurrentVersion\App Paths\HijackThis.exe
Invalid uninstall reference "C:\hjt\HijackThis.exe" /uninstall HKLM\Sofware\Microsoft\Windows\CurrentVersion\Uninstall\HijackThis
The 2 from HijackThis because I didn't dare remove them knowing I would still be using it.
The first one because it keeps reappearing despite 3 successive corrections that seem to go well.
See you and thank you. -
Hello there,
It's better. But not finished yet. Do you know C:\Program Files\Common Files\Talkway\vmtalk.exe? Do you have it among the applications in add/remove programs?
If you don't know it and if the size of the executable is < 10 MB, have it analyzed here: https://www.virustotal.com/gui/ If it tells you that it has already been analyzed, still do another analysis and post the link to the Virustotal page here (something like http://www.virustotal.com/fr/analisis/32384d218dd051fe48e1cdd5873181b72805d95441dba193833ab2ad08947be0-1252872477)
For Messenger Plus: try again with YourUninstaller. If it still doesn't work, download Windows Installer Cleanup Utility here https://support.microsoft.com/en-us/help/290301, install it and run it afterwards. It will display a number of installed applications ==> select messenger plus 3 and uninstall.
If uninstallation is OK, restart and check that the folder C:\Program Files\MessengerPlus! 3\ no longer exists (delete it if necessary).
Run CCleaner afterwards.
Post another hijackthis. How is the PC doing now?
++-
Good evening Sandul,
concerning "vmtalk.exe," it seems to be a "normal" software called "Video Email V2.0 for Outlook Express."
It does appear in my "Add/Remove Programs" list, and the analysis done with VirusTotal did not detect anything (report available here: http://www.virustotal.com/fr/analisis/f8bed5ff89d76f0f99bbbeec2cc7b7fb668b166fb2dd12e8778824e8030806e7-1253042055).
Since I do not use it, I uninstalled it (without any problems).
Regarding "Messenger Plus 3," the uninstallation using Your Uninstaller still doesn't work.
I installed "Windows Installer CleanUp," but when I launch it, it does not offer "Messenger Plus 3" in the list of installed applications.
Concerning the PC, since Sunday I haven't had any pop-up openings for "Windows Installer," so it's much better.
However, opening a new "Internet Explorer" session is still very slow (4 to 5 minutes).
I ran CCleaner again, and I got exactly the same result as last time (see previous post).
I also ran a scan with HijackThis, and the report can be found here: http://cjoint.com/confirm.php?cjoint=jpwlxq01f0
I noticed that there are still "023 - Service" lines referring to Symantec in the list, even though we were supposed to have corrected them on Saturday or Sunday.
See you later.
-
-
Hello Alain,
OK... We're going to try to optimize the PC a bit and fine-tune the cleanup...
First of all, what are the machine's specifications? (Processor / RAM / available disk space)
I asked you in a previous post to stop TeaTimer from Search & Destroy, remember? It's still active:
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
Since it protects the registry, it may be the reason why uninstalls are not working perfectly. So stop it.
Uninstall BroadJump Client Foundation (unnecessary)
What version of ZoneAlarm are you using?
What does your Task Scheduler do? Open a DOS window and typeat
to list the active tasks on your system. Post here what the at command returns (if any).
Control Panel/Computer Management/Services. Stop and set the remote registry access service to disabled (it's unnecessary + security flaw + resource-consuming). Please take a look here http://www.blackviper.com/WIN2K/servicecfg.htm ==> you can take the configuration from the "Safe" column. I agree it’s a bit (a lot!?) annoying to check each service, especially when you'll have to match the names of services in English and those in French. But it's useful (and if you optionally read the description of each service, it’s also enriching; here is, for example, the description of the remote registry access service: http://www.blackviper.com/WIN2K/win2kservice411.htm#Remote_Registry_Service)
There are a lot of IBM processes running on this machine. You'll need to question the usefulness of each of them for you (via Google); some of them, like c4ebreg.exe, are certainly unnecessary in a "Home" environment. The O4 lines of the hijackthis log correspond to auto-starts at boot. You can also see (and temporarily disable or permanently delete) these autostarts with CCleaner ==> recommended method.
Java is not up to date; it is recommended to replace 1.6_02 with 1.6_16.
So from CCleaner do the cleanup and disable at startup everything you find unnecessary on the IBM software side + Java updates + RealPlayer updates + Messenger Plus 3 + CTDetect.exe + icwconn1.exe. Then restart afterwards.
After rebooting: open Hijackthis again and look for all lines ending with "file missing." Check them and do Fix Checked. Be careful, before clicking Fix Checked, make sure you have closed all other windows (including this IE window!!)
Regarding your IE connection: very slow startup due to the Club Internet launcher. Normally, you don't need this. But it's long to explain, I'll do it another time :=)
Oh, yes: check that after disabling Messenger Plus with CCleaner (see above) you still have it in the O4 hijackthis list. If you don't, you can delete the folder C:\Program Files\MessengerPlus! 3. A registry cleanup with CCleaner will take care of the rest (because the reference file will no longer exist).
Future optimization directions: disk defragmentation to be done and memory consumption to be monitored. Also, give up the Club Internet launcher.
There you go, a very long message, I'm unable to make it shorter :) Good night... -
Good evening Sandul,
here are some answers to the questions you asked:
1) Characteristics of the machine:
IBM ThinkPad T23 with Intel Pentium III Mobile CPU 1133 MHz, 512 MB of RAM, Microsoft Windows 2000 Professional Release 5.00.2195 Service Pack 4
Hard drive of 27.9 GB with 4.87 GB free.
This is my old professional computer from the time I was at IBM (hence all those IBM processes you saw) that I was able to keep for my personal use when they sold my division to another company in 2003. Since then, most of these utilities provided by IBM have not been updated (updates used to be done automatically via "in-house" utilities).
Among the small details that might be important for a specialist, about a year and a half ago, this workstation was infected by a virus (or a trojan, I can't remember too well). I was able to get rid of it with help from the forum "Commentçamarche". But since then, I have had a problem with my Windows updates that can no longer run automatically (issues with BITS service and System Event Notification). I have 2 threads open on this issue on the Windows forum under my username "alain78700".
I also had some recurring messages a few months ago when launching Spybot telling me that my registry was too small (given all the junk that’s in there, I understand better now). I had therefore increased it to make that message disappear.
2) I did indeed reactivate Tea Timer this weekend and I had forgotten to turn it off again. It’s done now.
3) BroadJump Client Foundation: I uninstalled it without issue via "Add/Remove Programs"
4) ZoneAlarm: I'm sorry but I don't know what it is or where to find this information about its version.
5) Task Scheduler: when I type "at" in a DOS window, I get the response "There are no entries in the list".
6) Regarding the services, fortunately my PC is configured in English (IBM!!!) so the names of the services match exactly the list from blackviper. I started by stopping and disabling the Remote Registry Service. For the others, I will do a more thorough check later.
7) I have installed the latest version of Java (1.6_16)
8) I also uninstalled the Club Internet Launcher since I never use it, but it had no effect on the very slow startup of my Internet Explorer sessions (I hadn't touched that launcher since its installation nearly 3 years ago, and the slowness issue only appeared a few weeks ago).
9) I have made the startup deactivations suggested by CCleaner.
10) I feel like I finally managed to get rid of MessengerPlus 3!
11) Finally, I ran a scan with HijackThis again, checking all the O23 lines ending with "(file missing)" (7 lines including 4 for Symantec) then by clicking "Fix Checked", but the lines always reappear the next time (I had indeed closed all other windows). The last report is located at: https://www.cjoint.com/?jqwZIRf7ad
12) Regarding defragmentation, the analysis I launched indicates that it is not necessary (report of this analysis stored at: https://www.cjoint.com/?jqw3ojsj5t
See you.
Alain. -
Hello Alain,
Your PC is no longer very young, so don't expect miracles. My Asus, which dates from the same era, is already in the closet.
I suggest you install a trial version of jv16 power tools (a bit more difficult to use than YourUninstaller <= you can uninstall it), but I've never seen it fail: http://www.macecraft.com/jv16powertools2009-info/ After that, you can clean the registry with (the default options are fine for a good result; a more aggressive cleaning is also possible, but you'll have to check line by line what it deletes).
Do in jv16 System Tools / Software Uninstaller. You'll be surprised by what you see... The list can be sorted by clicking on the column headers Author, Software or Installation date ==> very, very useful for grouping. You can, for example, check the software installed around the presumed date of your slowdowns.
Uninstalling with jv16 is very effective. Sometimes it takes several passes to get rid of something, so always check the list after each uninstallation and repeat if necessary. Try to look with jv16 at the items listed under Author=Symantec, for example. See if jv16 can clean efficiently...
ZoneAlarm is a firewall. Some versions have been very good, others a disaster as they were riddled with bugs. Medium compatibility with other applications. The slowdown can also be due to ZA. Uninstall if ZA is no longer accessible (at the bottom right, as an icon) and if you don't want a firewall (not really necessary on a machine with your configuration, provided you're on NAT (behind a router) and are careful about browsing/executing unknown applications).
To uninstall ZA, read this: https://forums.commentcamarche.net/forum/affich-12530356-bogue-true-vector-zone-alarm-vista If you can't access the ZA configuration to do what is requested, check with jv16 everything that is launched automatically at startup and disable the ZA part; do the same for services (if you find any ZA services); restart and try to uninstall ZA (with jv16, because you told me you don't see it in add/remove programs). Tips for a manual installation (ugh, good luck) here: https://www.patreon.com/ChrisPirillo
If you say the slowdowns are not due to the Club Internet launcher, I'm a bit stumped. Let's see if the situation improves after cleaning the apps (see above).
++
Dominic -
How to get rid of the pesky pop-up window that keeps appearing from Windows Installer (preparing to install) while everything else is working. XP SP3
