# [SOLVED] Cannot remove items from Registry



## JohnthePilot (Mar 30, 2006)

Hi Guys and Gals,
I've posted here because my problem has very tenuous links with security. :grin: First, it involves McAfee and second you've probably got more experience of mucking about with the registry than anyone else.

I recently changed from McAfee Security Suite to AVG Pro. I uninstalled McAfee through Add/Remove and also ran all the McAfee cleaners including MCPR, but I still have McAfee entries in my Sytem Configuration File and it appears in Startup in MSCONFIG. I've been into the registry and deleted all references to McAfee without trouble, except when I go back to the top and use EDIT>FIND the entries are all back again. I've even been into Safe Mode as Administrator with the same result. As far as I can see my permissions are OK. Please, please tell me how I can get rid of the <TWIBAT> things.

Many thanks,
John.


----------



## Glaswegian (Sep 16, 2005)

*Re: Cannot remove items from Registry*

Hi John

Some first thoughts...

Do you have Spybot's Tea Timer, WinPatrol, Ad-Watch, SpywareGuard or any similar protection programme running? Could be one of them is restoring any Registry changes.

I could get you to run a scanner that would show me all the Registry keys, but thought I'd check on the protection side first.


----------



## JohnthePilot (Mar 30, 2006)

*Re: Cannot remove items from Registry*

Thanks Iain. Yes, I have all of those. I'll try disabling them and let you know the result.


----------



## JohnthePilot (Mar 30, 2006)

*Re: Cannot remove items from Registry*

Hi Iain,
I turned absolutely everything off and the <TWIBAT>s are still there.


----------



## Kalim (Nov 24, 2006)

Spybot Tea Timer function will restore any such registry changes and it's quite a pain once you first figure it out.

Switch it off completely. Reboot and then delete the registry keys. Then see how that goes. (If it works get Spybot up and running again)

EDIT:
Actually, why not use RegSeeker and look for any mention of the deleted item to remove that way?


----------



## JohnthePilot (Mar 30, 2006)

*Re: Cannot remove items from Registry*

Thanks Kalim. I actually tried that. In fact, I rebooted into Safe Mode just be sure. This is worse than Norton to get rid of. :grin:


----------



## Glaswegian (Sep 16, 2005)

*Re: Cannot remove items from Registry*

Hi John

Let's have deeper look then, and see if we can find those entries.

Download *SilentRunners.*
*Right click & choose Save As* --> Save it to Desktop. Make sure you have disabled any programs that may block/disable scripts (like your anti-virus or anti-spyware programs -- if you're going to disable these, then disconnect from the Internet for this step). *Double-click* Silent Runners to run it. This will take a few minutes, and will create a file called "Startup Programs" followed by your computer name and current date.

*Open up that file and post all its contents here in your next post.*


----------



## JohnthePilot (Mar 30, 2006)

*Re: Cannot remove items from Registry*

Hi Iain,
It's not affecting my work, it's just annoying. As I'm heavily involved with the Articles Index at present, I'll try your suggestion out later.
Many thanks,
John.


----------



## JohnthePilot (Mar 30, 2006)

*Re: Cannot remove items from Registry*

Hi Iain,
On reflection, it's going to take more than a few hours to finish the Index (it's like painting the Forth Bridge - did I really "volunteer" for this :grin: ) so I thought I run Silent Runners now. I'm sure it will make more sense to you than to me. Ignore all the porn films. :laugh: 
Regards,
John.

PS. I don't know why TeaTimer and AdWatch are showing up cos I made a point of disabling everything.

"Silent Runners.vbs", revision R50, http://www.silentrunners.org/
Operating System: Windows XP SP2
Output limited to non-default values, except where indicated by "{++}"


Startup items buried in registry:
---------------------------------

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
"MsnMsgr" = ""C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background" [MS]
"ctfmon.exe" = "C:\windows\system32\ctfmon.exe" [MS]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}" = ""C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"" ["Nero AG"]
"PcSync" = "C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog" ["Time Information Services Ltd."]
"AWMON" = ""C:\Program Files\Lavasoft\Ad-Aware SE Professional\Ad-Watch.exe"" ["Lavasoft Sweden"]
"SpybotSD TeaTimer" = "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" ["Safer Networking Limited"]

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
"Cmaudio" = "RunDll32 cmicnfg.cpl,CMICtrlWnd" [MS]
"TkBellExe" = ""C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot" ["RealNetworks, Inc."]
"NeroFilterCheck" = "C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" ["Nero AG"]
"PCSuiteTrayApplication" = "C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup" ["Nokia"]
"NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup" [MS]
"MCAgentExe" = "c:\PROGRA~1\mcafee.com\agent\mcagent.exe" [file not found]
"MCUpdateExe" = "c:\PROGRA~1\mcafee.com\agent\mcupdate.exe" [file not found]
"MSKAGENTEXE" = "C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe" [file not found]
"MSKDetectorExe" = "C:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.exe /startup" [file not found]
"VSOCheckTask" = ""C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask" [file not found]
"VirusScan Online" = "C:\Program Files\McAfee.com\VSO\mcvsshld.exe" [file not found]
"OASClnt" = "C:\Program Files\McAfee.com\VSO\oasclnt.exe" [file not found]
"MPFExe" = "C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe" [file not found]
"MPSExe" = "c:\PROGRA~1\mcafee.com\mps\mscifapp.exe /embedding" [file not found]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided)
-> {HKLM...CLSID} = "Adobe PDF Reader Link Helper"
\InProcServer32\(Default) = "C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll" [file not found]
{4A368E80-174F-4872-96B5-0B27DDD11DB2}\(Default) = "SpywareGuard Download Protection"
-> {HKLM...CLSID} = "SpywareGuardDLBLOCK.CBrowserHelper"
\InProcServer32\(Default) = "C:\Program Files\SpywareGuard\dlprotect.dll" [null data]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided)
-> {HKLM...CLSID} = "SSVHelper Class"
\InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll" ["Sun Microsystems, Inc."]
{9030D464-4C02-4ABF-8ECC-5164760863C6}\(Default) = (no title provided)
-> {HKLM...CLSID} = "Windows Live Sign-in Helper"
\InProcServer32\(Default) = "C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll" [MS]

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "HyperTerminal Icon Ext"
-> {HKLM...CLSID} = "HyperTerminal Icon Ext"
\InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."]
"{FC9FB64A-1EB2-4CCF-AF5E-1A497A9B5C2D}" = "Messenger Sharing Folders"
-> {HKLM...CLSID} = "My Sharing Folders"
\InProcServer32\(Default) = "C:\Program Files\MSN Messenger\fsshext.8.1.0178.00.dll" [MS]
"{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office12\msohevi.dll" [MS]
"{993BE281-6695-4BA5-8A2A-7AACBFAAB69E}" = "Microsoft Office Metadata Handler"
-> {HKLM...CLSID} = "Microsoft Office Metadata Handler"
\InProcServer32\(Default) = "C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll" [MS]
"{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97}" = "Microsoft Office Thumbnail Handler"
-> {HKLM...CLSID} = "Microsoft Office Thumbnail Handler"
\InProcServer32\(Default) = "C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll" [MS]
"{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}" = "Shell Extensions for RealOne Player"
-> {HKLM...CLSID} = "RealOne Player Context Menu Class"
\InProcServer32\(Default) = "C:\Program Files\Real\RealPlayer\rpshell.dll" ["RealNetworks, Inc."]
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]
"{B327765E-D724-4347-8B16-78AE18552FC3}" = "NeroDigitalIconHandler"
-> {HKLM...CLSID} = "NeroDigitalIconHandler Class"
\InProcServer32\(Default) = "C:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll" ["Nero AG"]
"{7F1CF152-04F8-453A-B34C-E609530A9DC8}" = "NeroDigitalPropSheetHandler"
-> {HKLM...CLSID} = "NeroDigitalPropSheetHandler Class"
\InProcServer32\(Default) = "C:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll" ["Nero AG"]
"{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer"
-> {HKLM...CLSID} = "Desktop Explorer"
\InProcServer32\(Default) = "C:\windows\system32\nvshell.dll" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\windows\system32\nvshell.dll" ["NVIDIA Corporation"]
"{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class"
-> {HKLM...CLSID} = "DesktopContext Class"
\InProcServer32\(Default) = "C:\windows\system32\nvcpl.dll" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu"
-> {HKLM...CLSID} = "nView Desktop Context Menu"
\InProcServer32\(Default) = "C:\windows\system32\nvshell.dll" ["NVIDIA Corporation"]
"{97F68CE3-7146-45FF-BE24-D9A7DD7CB8A2}" = "NeroCoverEd Live Icons"
-> {HKLM...CLSID} = "NeroCoverEdLiveIcons Class"
\InProcServer32\(Default) = "C:\Program Files\Nero\Nero 7\Nero CoverDesigner\CoverEdExtension.dll" ["Nero AG"]
"{81559C35-8464-49F7-BB0E-07A383BEF910}" = (no title provided)
-> {HKLM...CLSID} = "SpywareGuard.Handler"
\InProcServer32\(Default) = "C:\Program Files\SpywareGuard\spywareguard.dll" [null data]
"{416651E4-9C3C-11D9-8BDE-F66BAD1E3F3A}" = "PhoneBrowser"
-> {HKLM...CLSID} = "Nokia Phone Browser"
\InProcServer32\(Default) = "C:\Program Files\Nokia\Nokia PC Suite 6\PhoneBrowser.dll" ["Nokia"]
"{5858A72C-C2B4-4dd7-B2BF-B76DB1BD9F6C}" = "Microsoft Office OneNote Namespace Extension for Windows Desktop Search"
-> {HKLM...CLSID} = "Microsoft Office OneNote Namespace Extension for Windows Desktop Search"
\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\ONFILTER.DLL" [MS]
"{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}" = "AVG7 Shell Extension"
-> {HKLM...CLSID} = "AVG7 Shell Extension Class"
\InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG7\avgse.dll" ["GRISOFT, s.r.o."]
"{9F97547E-460A-42C5-AE0C-81C61FFAEBC3}" = "AVG7 Find Extension"
-> {HKLM...CLSID} = "AVG7 Find Extension Class"
\InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG7\avgse.dll" ["GRISOFT, s.r.o."]
"{2170E0A4-42F2-4EB5-911F-ABC2717F6563}" = "PagePlus Thumbnail Handler"
-> {HKLM...CLSID} = "PagePlus Thumbnail Handler"
\InProcServer32\(Default) = "C:\Program Files\Serif\PagePlus\12.0\Program\ThumbnailProvider.dll" ["Serif (Europe) Ltd"]
"{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF}" = "iTunes"
-> {HKLM...CLSID} = "iTunes"
\InProcServer32\(Default) = "C:\Program Files\iTunes\iTunesMiniPlayer.dll" ["Apple Inc."]
"{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper"
-> {HKLM...CLSID} = "NVIDIA CPL Extension"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]
"{20082881-FC36-4E47-9A7A-644C95FF749F}" = "IntelliPoint Wireless Control Panel Property Page"
-> {HKLM...CLSID} = "Wireless Property Page"
\InProcServer32\(Default) = ""C:\Program Files\Microsoft IntelliPoint\ipcplwir.dll"" [MS]
"{AF90F543-6A3A-4C1B-8B16-ECEC073E69BE}" = "IntelliPoint Wheel Control Panel Property Page"
-> {HKLM...CLSID} = "Wheel Property Page"
\InProcServer32\(Default) = ""C:\Program Files\Microsoft IntelliPoint\ipcplwhl.dll"" [MS]
"{653DCCC2-13DB-45B2-A389-427885776CFE}" = "IntelliPoint Activities Control Panel Property Page"
-> {HKLM...CLSID} = "Activities Property Page"
\InProcServer32\(Default) = ""C:\Program Files\Microsoft IntelliPoint\ipcplact.dll"" [MS]
"{124597D8-850A-41AE-849C-017A4FA99CA2}" = "IntelliPoint Buttons Control Panel Property Page"
-> {HKLM...CLSID} = "Buttons Property Page"
\InProcServer32\(Default) = ""C:\Program Files\Microsoft IntelliPoint\ipcplbtn.dll"" [MS]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\
<<!>> "{091EB208-39DD-417D-A5DD-7E2C2D8FB9CB}" = "Microsoft AntiMalware ShellExecuteHook"
-> {HKLM...CLSID} = "Microsoft AntiMalware ShellExecuteHook"
\InProcServer32\(Default) = "C:\PROGRA~1\WINDOW~4\MpShHook.dll" [MS]
<<!>> "{81559C35-8464-49F7-BB0E-07A383BEF910}" = (no title provided)
-> {HKLM...CLSID} = "SpywareGuard.Handler"
\InProcServer32\(Default) = "C:\Program Files\SpywareGuard\spywareguard.dll" [null data]

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
<<!>> avgwlntf\DLLName = "avgwlntf.dll" ["GRISOFT, s.r.o."]

HKLM\Software\Classes\PROTOCOLS\Filter\
<<!>> text/xml\CLSID = "{807563E5-5146-11D5-A672-00B0D022E945}"
-> {HKLM...CLSID} = "Microsoft Office InfoPath XML Mime Filter"
\InProcServer32\(Default) = "C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL" [MS]

HKLM\Software\Classes\Folder\shellex\ColumnHandlers\
{7D4D6379-F301-4311-BEBA-E26EB0561882}\(Default) = "NeroDigitalExt.NeroDigitalColumnHandler"
-> {HKLM...CLSID} = "NeroDigitalColumnHandler Class"
\InProcServer32\(Default) = "C:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll" ["Nero AG"]
{F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info"
-> {HKLM...CLSID} = "PDF Shell Extension"
\InProcServer32\(Default) = "C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."]

HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
AVG7 Shell Extension\(Default) = "{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}"
-> {HKLM...CLSID} = "AVG7 Shell Extension Class"
\InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG7\avgse.dll" ["GRISOFT, s.r.o."]
Cover Designer\(Default) = "{73FCA462-9BD5-4065-A73F-A8E5F6904EF7}"
-> {HKLM...CLSID} = "NeroCoverEdContextMenu Class"
\InProcServer32\(Default) = "C:\Program Files\Nero\Nero 7\Nero CoverDesigner\CoverEdExtension.dll" ["Nero AG"]
FileUtilities_MainContextMenu Class\(Default) = "{BB773C31-BB7F-491D-8266-E85B2068FA96}"
-> {HKLM...CLSID} = "FileUtilities_MainContextMenu Class"
\InProcServer32\(Default) = "C:\Program Files\[email protected]\[email protected]\fush.dll" ["Gibin Software House (http://www.gibinsoft.net)"]
moveonboot_delete\(Default) = "{12B23346-6BD8-4812-BF8C-75E7C386ACB8}"
-> {HKLM...CLSID} = "MoveOnBootBootPopupMenuShlExt Class"
\InProcServer32\(Default) = "C:\Program Files\[email protected]\[email protected]\mboot.dll" ["Gibin Software House (http://www.gibinsoft.net)"]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\
FileUtilities_MainContextMenu Class\(Default) = "{BB773C31-BB7F-491D-8266-E85B2068FA96}"
-> {HKLM...CLSID} = "FileUtilities_MainContextMenu Class"
\InProcServer32\(Default) = "C:\Program Files\[email protected]\[email protected]\fush.dll" ["Gibin Software House (http://www.gibinsoft.net)"]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
AVG7 Shell Extension\(Default) = "{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}"
-> {HKLM...CLSID} = "AVG7 Shell Extension Class"
\InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG7\avgse.dll" ["GRISOFT, s.r.o."]
FileUtilities_MainContextMenu Class\(Default) = "{BB773C31-BB7F-491D-8266-E85B2068FA96}"
-> {HKLM...CLSID} = "FileUtilities_MainContextMenu Class"
\InProcServer32\(Default) = "C:\Program Files\[email protected]\[email protected]\fush.dll" ["Gibin Software House (http://www.gibinsoft.net)"]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]


Group Policies {policy setting}:
--------------------------------

Note: detected settings may not have any effect.

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\

"New Value #1" = (REG_BINARY) hex:
{unrecognized setting}

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\

"shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001
{Shutdown: Allow system to be shut down without having to log on}

"undockwithoutlogon" = (REG_DWORD) hex:0x00000001
{Devices: Allow undock without having to log on}


Active Desktop and Wallpaper:
-----------------------------

Active Desktop may be disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

Displayed if Active Desktop enabled and wallpaper not set by Group Policy:
HKCU\Software\Microsoft\Internet Explorer\Desktop\General\
"Wallpaper" = "%APPDATA%\Microsoft\Internet Explorer\Internet Explorer Wallpaper.bmp"

Displayed if Active Desktop disabled and wallpaper not set by Group Policy:
HKCU\Control Panel\Desktop\
"Wallpaper" = "C:\Documents and Settings\John\Application Data\Microsoft\Internet Explorer\Internet Explorer Wallpaper.bmp"


Enabled Screen Saver:
---------------------

HKCU\Control Panel\Desktop\
"SCRNSAVE.EXE" = "C:\windows\system32\logon.scr" [MS]


Startup items in "John" & "All Users" startup folders:
------------------------------------------------------

C:\Documents and Settings\John\Start Menu\Programs\Startup
"SpywareGuard" -> shortcut to: "C:\Program Files\SpywareGuard\sgmain.exe" [null data]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup
"Adobe Reader Synchronizer" -> shortcut to: "C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe" [null data]
"EPSON Status Monitor 3 Environment Check 2" -> shortcut to: "C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV02.EXE" ["SEIKO EPSON CORPORATION"]


Enabled Scheduled Tasks:
------------------------

"AppleSoftwareUpdate" -> launches: "C:\Program Files\Apple Software Update\SoftwareUpdate.exe -Task" ["Apple Computer, Inc."]
"MP Scheduled Scan" -> launches: "C:\Program Files\Windows Defender\MpCmdRun.exe Scan -RestrictPrivileges" [MS]


Winsock2 Service Provider DLLs:
-------------------------------

Namespace Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]

Transport Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
C:\windows\system32\avgfwafu.dll ["GRISOFT, s.r.o."], 01 - 05
%SystemRoot%\system32\mswsock.dll [MS], 06 - 08, 11 - 22
%SystemRoot%\system32\rsvpsp.dll [MS], 09 - 10


Toolbars, Explorer Bars, Extensions:
------------------------------------

Toolbars

HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\
"{F2CF5485-4E02-4F68-819C-B92DE9277049}"
-> {HKLM...CLSID} = "&Links"
\InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS]

Explorer Bars

HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\

HKLM\Software\Classes\CLSID\{FF059E31-CC5A-4E2E-BF3B-96E929D65503}\(Default) = "&Research"
Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar]
InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL" [MS]

Extensions (Tools menu items, main toolbar menu buttons)

HKLM\Software\Microsoft\Internet Explorer\Extensions\
{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\
"MenuText" = "Sun Java Console"
"CLSIDExtension" = "{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBC}"
-> {HKCU...CLSID} = "Java Plug-in 1.5.0_09"
\InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll" ["Sun Microsystems, Inc."]
-> {HKLM...CLSID} = "Java Plug-in 1.5.0_09"
\InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_09\bin\npjpi150_09.dll" ["Sun Microsystems, Inc."]

{2670000A-7350-4F3C-8081-5663EE0C6C49}\
"ButtonText" = "Send to OneNote"
"MenuText" = "S&end to OneNote"
"CLSIDExtension" = "{48E73304-E1D6-4330-914C-F5F514E3486C}"
-> {HKLM...CLSID} = "Send to OneNote from Internet Explorer button"
\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll" [MS]

{85D1F590-48F4-11D9-9669-0800200C9A66}\
"MenuText" = "Uninstall BitDefender Online Scanner v8"
"Exec" = "%windir%\bdoscandel.exe" [null data]

{92780B25-18CC-41C8-B9BE-3C9C571A8263}\
"ButtonText" = "Research"

{E2E2DD38-D088-4134-82B7-F2BA38496583}\
"MenuText" = "@xpsp3res.dll,-20001"
"Exec" = "%windir%\Network Diagnostic\xpnetdiag.exe" [MS]

{FB5F1910-F110-11D2-BB9E-00C04F795683}\
"ButtonText" = "Messenger"
"MenuText" = "Windows Messenger"
"Exec" = "C:\Program Files\Messenger\msmsgs.exe" [MS]


Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------

EPSON Printer Status Agent2, EPSONStatusAgent2, "C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe" ["SEIKO EPSON CORPORATION"]
NMIndexingService, NMIndexingService, ""C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe"" ["Nero AG"]
NVIDIA Display Driver Service, NVSvc, "C:\windows\system32\nvsvc32.exe" ["NVIDIA Corporation"]
ProtexisLicensing, ProtexisLicensing, "C:\WINDOWS\system32\PSIService.exe" [null data]
ServiceLayer, ServiceLayer, ""C:\Program Files\PC Connectivity Solution\ServiceLayer.exe"" ["Nokia."]
STI Simulator, STI Simulator, "C:\windows\System32\PAStiSvc.exe" [null data]
Windows Defender, WinDefend, ""C:\Program Files\Windows Defender\MsMpEng.exe"" [MS]
Windows Driver Foundation - User-mode Driver Framework, WudfSvc, "C:\windows\system32\svchost.exe -k WudfServiceGroup" {"C:\windows\System32\WUDFSvc.dll" [MS]}


Print Monitors:
---------------

HKLM\System\CurrentControlSet\Control\Print\Monitors\
EPSON V3 2KMonitor300\Driver = "E_SL2300.DLL" ["SEIKO EPSON CORPORATION"]
EPSON V5 2KMonitor\Driver = "EBPMON2.DLL" ["SEIKO EPSON CORPORATION"]
Microsoft Document Imaging Writer Monitor\Driver = "mdimon.dll" [MS]
Send To Microsoft OneNote Monitor\Driver = "msonpmon.dll" [MS]


----------
<<!>>: Suspicious data at a malware launch point.

+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
launch it from a command prompt or a shortcut with the -all parameter.
+ The search for DESKTOP.INI DLL launch points on all local fixed drives
took 156 seconds.
---------- (total run time: 201 seconds)


----------



## Glaswegian (Sep 16, 2005)

*Re: Cannot remove items from Registry*

Hi John

We’ll ignore all the other infections for now and concentrate on McAfee…j/k :grin:


Click on the zip file attached to this post to open and extract the file *JTP.reg* to your desktop. *Do not run it yet.*


Then completely disable/shutdown

Ad-Watch
Spybot Tea Timer
Spywareguard
Microsoft Antimalware


Now boot to Safe Mode.


In safe Mode double click on the file *JTP.reg* to run it. Answer *yes* to any prompts and allow it to merge into the Registry.



Reboot back to normal mode.


Let me know how that works.


----------



## JohnthePilot (Mar 30, 2006)

*Re: Cannot remove items from Registry*

Thaks Iain,
I'll get back to you when I've caught up with my User CP. Only 23 threads left to deal with.:grin:


----------



## JohnthePilot (Mar 30, 2006)

*Re: Cannot remove items from Registry*

Hi Iain,
You're not going to believe this but.........


----------



## Glaswegian (Sep 16, 2005)

*Re: Cannot remove items from Registry*

Oh, you are such a tease.....:grin:


----------



## JohnthePilot (Mar 30, 2006)

*Re: Cannot remove items from Registry*

I've got to keep you occupied somehow. I'd hate you to be bored.:grin:


----------



## Glaswegian (Sep 16, 2005)

*Re: Cannot remove items from Registry*


----------



## JohnthePilot (Mar 30, 2006)

*Re: Cannot remove items from Registry*

ROFL. :laugh: Come on get up. All this beating Jen is taking it out of you. Now see if you can beat McAfee. :grin:


----------



## Glaswegian (Sep 16, 2005)

*Re: Cannot remove items from Registry*

lol - I guess that didn't work. Did you notice I'd amended the reg file? Make sure you used the later one....


----------



## JohnthePilot (Mar 30, 2006)

*Re: Cannot remove items from Registry*

I must have cos your edit was 8.42 and I ran it at post 8.48


----------



## Glaswegian (Sep 16, 2005)

*Re: Cannot remove items from Registry*

OK, now you've got me going on this...

Please download *Registrar Lite* and install it.


Copy and paste the following text into the address bar and hit Go:*HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run*

*Find each McAfee key and Right click *the key and select *Properties*. Then click *Permissions* & give full control to everyone and click *Apply*
Then click on *Advanced*
Under the permissions tab, select '*Everyone*' & then click *Edit*
Select - Apply onto - this key & subkeys
Make sure that *Delete* is set to *Allowed*.
Click OK & then delete key


----------



## JohnthePilot (Mar 30, 2006)

*Re: Cannot remove items from Registry*

Slight problem. When I right click and select properties I get this:



Nothing about permissions.
I'm glad you like a challenge. :grin:


----------



## Glaswegian (Sep 16, 2005)

*Re: Cannot remove items from Registry*

lol - I've decided to retire....:laugh:

Try just deleting the keys using RegLite and see if that works.


----------



## JohnthePilot (Mar 30, 2006)

*Re: Cannot remove items from Registry*

 I tried just deleting them with RegLite, but as fast as I was deleting them they were reappearing at the bottom of the list. Every malware prog except Tea Timer was disabled - SpyBot wouldn't let me disable it so in the end I uninstalled SpyBot - but the <TWIBATS> are still there. As I said before, they are not causing a problem, but it's now become a challenge. Don't put yourself out too much over this cos there are far more deserving cases out there. :grin: 
Regards,
John.


----------



## Glaswegian (Sep 16, 2005)

*Re: Cannot remove items from Registry*

Perhaps so, but this is going to annoy me now. However, after I've attended to the more deserving of my help, I'll be back...with something...:grin:


----------



## JohnthePilot (Mar 30, 2006)

*Re: Cannot remove items from Registry*

Thanks Iain. As I said it's not urgent, just annoying. :grin:


----------



## Glaswegian (Sep 16, 2005)

*Re: Cannot remove items from Registry*

Please download this tool > System Repair Engineer
 Extract it to it's own folder & double click *SREng.exe* to run it











Select *'Boot Items'*
- Click on *'Registry'*
-- Select each of the McAfee entries & click the *[Delete Seleted]* button


This is a powerful tool John - feel free to have a play with it (but be careful!!). Note that there is also a Config tab and a Services tab - you might want to check for any traces there as well.


----------



## JohnthePilot (Mar 30, 2006)

*Re: Cannot remove items from Registry*

OK. I'll give it a go. I'm not worried about things going wrong cos I've got no end of backups. :grin:


----------



## JohnthePilot (Mar 30, 2006)

*Re: Cannot remove items from Registry*

I clicked on System Repair but I haven't got the same tabs as you.


----------



## Glaswegian (Sep 16, 2005)

*Re: Cannot remove items from Registry*

John, it's Boot Items (the Clock icon) - start by clicking on that first.


----------



## JohnthePilot (Mar 30, 2006)

*Re: Cannot remove items from Registry*

Doh! :laugh: It was late.


----------



## Glaswegian (Sep 16, 2005)

*Re: Cannot remove items from Registry*

11.30pm - late? That's early for you, isn't it? :grin:


----------



## JohnthePilot (Mar 30, 2006)

*Re: Cannot remove items from Registry*

Yes, but I was up all the previous night doing the Index.:laugh: Anyway, you're not going to believe this. I went into Safe Mode, made sure everything was disabled, deleted all the items, rebooted into Normal Mode and THEY ARE STILL THERE!!!! I give up. :grin:


----------



## Glaswegian (Sep 16, 2005)

*Re: Cannot remove items from Registry*

There has to be a reason that the entries keep coming back, but I can't work out what it is. We really need sUBs expertise here....


----------



## sUBs (May 5, 2005)

*Re: Cannot remove items from Registry*

So far, I have seen just HKLM\~Run entries only. Is it correct to assume that these are the only ones remaining? 

You mentioned uninstalling SpyBot S&D. Please check if this folder still exist. 

Documents and Settings\All Users\Application Data\Spybot - Search & Destroy

Let me know.


----------



## JohnthePilot (Mar 30, 2006)

*Re: Cannot remove items from Registry*

Hi Subs,

I uninstalled SpyBot but I've now reinstalled it.

The McAfee enrtries in registry are as follows:









As I told Iain, this is low priority, so there is no rush. It's just <TWIBAT> irritating. :grin: 

Regards,
John


----------



## sUBs (May 5, 2005)

*Re: Cannot remove items from Registry*

John, the Security Centre entry is a default value. Even machines like mine, which has never been _infected_ by McAfee has that value. :grin: 

Picture 1 should be the *HKLM\~Run* entries. 

Where are pictures 3 & 4 taken from? Are those *HKCU\~ComDlg32\OpenSaveMRU* entries ? 


You havent answered my question about this folder > *Documents and Settings\All Users\Application Data\Spybot - Search & Destroy*


----------



## JohnthePilot (Mar 30, 2006)

*Re: Cannot remove items from Registry*

Hi Subs.
Forgive my ignorance about registry entries.
In regedit I did an Edit>find for McAfee and posted pics of all the instances that turned up. I think these refer to pics I've save in Corel. What I can't understand is why McAfee is still in my Sytem Configuration File despite the fact I've unchecked all entries.
BTW SpyBot is in the folder the asked about because I've reinstalled it.



Regards,
John.


----------



## sUBs (May 5, 2005)

*Re: Cannot remove items from Registry*

Okay.. the MRU (Most Recently used) & the Security Centre entries aren't important.

I suspect that it's SpyBot's TeaTimer that's regenerating the entries. Please do as follows:
Open Spybot Search & Destroy.
In the Mode menu click "Advanced mode" if not already selected.
Choose Yes at the Warning prompt.
Expand the Tools menu.
Click Resident.
Uncheck the Resident "TeaTimer" (Protection of overall system settings) active. box.
In the File menu click Exit to exit Spybot Search & Destroy.

Download http://www.techsupportforum.com/sectools/ResetTeaTimer.zip
Double click ResetTeaTimer.bat to remove all entries set by TeaTimer.

When that's done, run the regfix which Iain previously proffered. Reboot the machine & see if those entries comes back


----------



## JohnthePilot (Mar 30, 2006)

*Re: Cannot remove items from Registry*

Hi Subs,
The problem does seem to be Tea Timer. I've run the prog you recommended but when I go back into SpyBot TeaTimer is still resident. I'll try uninstalling it again and see wahat happens.
Regards,
John.


----------



## sUBs (May 5, 2005)

*Re: Cannot remove items from Registry*

Try uninstalling SpyBot & deleting the aforementioned folder


----------



## JohnthePilot (Mar 30, 2006)

*Re: Cannot remove items from Registry*

   I've done all that and the <TWIBAT>s are still there. Igor's hammer might be the answer :grin: Thanks for your help sUBs and Iain, but I might just have to live with it.


----------



## Kalim (Nov 24, 2006)

*Re: Cannot remove items from Registry*

I've delete with this once before (without any uninstallation) and it was a PITA but there is a way around it, for sure. 

Or I'm just Superman and your cursed John. :grin:


----------



## JohnthePilot (Mar 30, 2006)

*Re: Cannot remove items from Registry*

You may have forgotten about this, but I haven't because everytime I ran Registry Mechanic (despite what Chevy and GG say, it's never let me down) I got 9 faults in Startup Programs. It didn't seem to affect anything so I've just learnt to live with it. On my latest run with Registry Mechanic, however, I got 0 faults in Startup Programs. I ran regedit and lo, and behold!, McAfee has gone. I've done nothing else to try and get rid of it, but gone it has. Don't ask me why. :4-dontkno Just thought I'd let you know.


----------



## Glaswegian (Sep 16, 2005)

I'd forgotten about this - glad it's gone though (however you managed it.:grin


----------

