cannot delete 84qf6uh9

[LJ]

Archived from groups: microsoft.public.windowsxp.configuration_manage (More info?)

Can someone help me delete the file "84qf6uh9" from every where in my startup
and registry. When I scan the computer for viruses with McAffee this file
comes out as a threat. I try to delete it here, to no avail. I also tried
to delete it from:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder
> and
> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg
> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg

but it comes back.... I need help! I think it's causing a lot of trouble in
my computer. 8-(

 

[Guest]

Archived from groups: microsoft.public.windowsxp.configuration_manage (More info?)

Look in;
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
but be advised that usually there is another process running that recreates
a process with a new name each time it starts up.

--
Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

"lj" wrote:
| Can someone help me delete the file "84qf6uh9" from every where in my
startup
| and registry. When I scan the computer for viruses with McAffee this
file
| comes out as a threat. I try to delete it here, to no avail. I also
tried
| to delete it from:
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder
| > and
| > HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg
| > HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg
|
| but it comes back.... I need help! I think it's causing a lot of trouble
in
| my computer. 8-(
|
|

 

[LJ]

Archived from groups: microsoft.public.windowsxp.configuration_manage (More info?)

Yes, I have deleted the stuff there, too. However, like you say, there is
another process running that recreates a process with a new name each time it
starts up. That's what I want to find out so I can delete it.
LJ


"Dave Patrick" wrote:

> Look in;
> HKLM\Software\Microsoft\Windows\CurrentVersion\Run
> HKCU\Software\Microsoft\Windows\CurrentVersion\Run
> but be advised that usually there is another process running that recreates
> a process with a new name each time it starts up.
>
> --
> Regards,
>
> Dave Patrick ....Please no email replies - reply in newsgroup.
> Microsoft Certified Professional
> Microsoft MVP [Windows]
> http://www.microsoft.com/protect
>
> "lj" wrote:
> | Can someone help me delete the file "84qf6uh9" from every where in my
> startup
> | and registry. When I scan the computer for viruses with McAffee this
> file
> | comes out as a threat. I try to delete it here, to no avail. I also
> tried
> | to delete it from:
> | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder
> | > and
> | > HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg
> | > HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg
> |
> | but it comes back.... I need help! I think it's causing a lot of trouble
> in
> | my computer. 8-(
> |
> |
>
>
>

 

[Guest]

Archived from groups: microsoft.public.windowsxp.configuration_manage (More info?)

You're on the right track. One of the spyware removal apps may help you as
well.

--
Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

"lj" wrote:
| Yes, I have deleted the stuff there, too. However, like you say, there is
| another process running that recreates a process with a new name each time
it
| starts up. That's what I want to find out so I can delete it.
| LJ

 

[Guest]

Archived from groups: microsoft.public.windowsxp.configuration_manage (More info?)

On Tue, 2 Aug 2005 09:39:24 -0600, "Dave Patrick"

>HKLM\Software\Microsoft\Windows\CurrentVersion\Run
>HKCU\Software\Microsoft\Windows\CurrentVersion\Run
>but be advised that usually there is another process running that recreates
>a process with a new name each time it starts up.

The best way to approach this, is formally (i.e. without running the
infected HD's code at all). If FATxx, you can do this from a Win9x
DOS mode boot diskette, Linux bootable CDR, or Bart's PE bootable CDR.
If NTFS, you can "look, don't touch" from Linux, or use Bart's PE.

If you think it's strange that MS still provides no maintenance OS for
htis purpose, after selling XP and NTFS into consumerland for 3 years,
you're right; it is. It's as wierd as buying NT 4 server and having
to rely on shareware to defrag the "mission-critical" hard drives.

Google for "Bart PE" and you'll find it...

http://www.nu2.nu/pebuilder/

....as well as the relevant forums...

http://www.911cd.net/forums//index.php?s=2d8129076720e6e30cc2031100d2b258&showforum=30

You can basically roll your own maintenance OS and malware management
tools (as well as data recovery, such as is possible for NTFS). It's
a shame that you have to do everything yourself, but that's how it is.

I've walked this walk, and using Bart with the RunScanner plugin, I
have and run the foillowing tools in this order:
- virus scanners, e.g. Trend SysClean, AntiVir, Stinger, McAfee
- AdAware and Spybot
- manual integration tools, e.g. HiJackThis, MSConfig, Shell Ex View

I use a lot of the last category, including brillliant ones from
NirSoft (www.nirsoft.net) and SystemInternals.

If the above sounds "too difficult", then follow the more common
advice; boot into Safe Mode Cmd Only, and try scanning from there.
Many malware still fail to integrate themselves into this mode, and
most are not coded to counter-attack your attempts to remove them, as
at August 2005. Drugs are usually safe too, etc. Believe.



>-------------------- ----- ---- --- -- - - - -
Running Windows-based av to kill active malware is like striking
a match to see if what you are standing in is water or petrol.
>-------------------- ----- ---- --- -- - - - -