Computer Support Forum

Editing HKCU

Question: Editing HKCU

I am despreate now,

I really need to know if there is anyway to edit HKCU from a logon script?

More replies
Relevance 100%
Preferred Solution: Editing HKCU

I recommend downloading and running Reimage. It's a computer repair tool that has been proven to identify and fix many Windows problems with a high level of success.

I've used it in the past to identify and fix everything from blue screens (BSOD's), ActiveX errors, corrupt files and processes, dll/exe/sys errors, recover lost memory, Windows update problems, defragging, malware removal etc.

You can download it direct from this link http://downloadreimage.com/download.php. (This link will automatically start a download of Reimage that you can save to your computer.)

Relevance 44.28%
Question: Hkcu

I had two instances of HKCU\SOFTWARE\Microsoft\WindowsNT\Current Version and that
is all I can see, in Startup msconfig. I'm not exactly sure how they arrived with me, I have deleted one of them from the registry.
I would dearly love to get rid of the second one but I don't know which entry to pick in the registry.The other thing is I run XPhome.
I once clicked on a members URL in his specs, he was from this board. I could be wrong. Does anyone have any idea how I could delete this from the registry. It's an eyesore for me when I go there. TIA.
 

Answer:Hkcu

Forget about it, it's not really important. Will live with it.
 

3 more replies
Relevance 44.28%
Question: What is an HKCU?

And where can they be located on your computer
 

Answer:What is an HKCU?

HKCU is an abbreviation for the Windows Registry Tree

HKEY_CURRENT_USER

See if this helps: http://www.systweak.com/winreg/wr6.htm
 

2 more replies
Relevance 44.28%

Weird error. All search engines direct me to broken URLs. After messing around with a computer friend, he gave up and pointed me here. HJT keeps turning this up as nasty, but it keep truning...What can i do?Logfile of Trend Micro HijackThis v2.0.2Scan saved at 10:32:34 PM, on 6/26/2009Platform: Windows Vista (WinNT 6.00.1904)MSIE: Internet Explorer v7.00 (7.00.6000.16643)Boot mode: NormalRunning processes:C:\Windows\system32\Dwm.exeC:\Windows\Explorer.EXEC:\Program Files\Windows Defender\MSASCui.exeC:\Windows\RtHDVCpl.exeC:\Program Files\Synaptics\SynTP\SynTPEnh.exeC:\Acer\Empowering Technology\eDataSecurity\eDSloader.exeC:\Program Files\Launch Manager\LManager.exeC:\Program Files\Java\jre1.6.0_04\bin\jusched.exeC:\Program Files\Common Files\InstallShield\UpdateService\issch.exeC:\Program Files\Lavasoft\Ad-Aware\AAWTray.exeC:\Program Files\Windows Sidebar\sidebar.exeC:\Program Files\Windows Live\Messenger\msnmsgr.exeC:\Windows\ehome\ehtray.exeC:\Program Files\MagicDisc\MagicDisc.exeC:\Program Files\OpenOffice.org 2.4\program\soffice.exeC:\Acer\Empowering Technology\ENET\ENMTRAY.EXEC:\Acer\Empowering Technology\EPOWER\EPOWER_DMC.EXEC:\Program Files\OpenOffice.org 2.4\... Read more

Answer:O4 - HKCU\..\Run: [?????????] ??????????????e

Hello and welcome to Bleeping ComputerWe apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine. If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.Upon completing the steps below another staff member will review and take the steps necessary with you to get your machine back in working order clean and free of malware.If you have already posted a DDS log, please do so again, as your situation may have changed.Use the 'Add Reply' and add the new log to this thread.Thanks and again sorry for the delay.We need to see some information about what is happening in your machine. Please perform the following scan:Download DDS by sUBs from one of the following links. Save it to your desktop.DDS.scrDDS.pifDouble click on the DDS icon, allow it to run.A small box will open, with an explaination about the tool. No input is needed, the scan is running.Notepad will open with the results.Foll... Read more

2 more replies
Relevance 44.28%

I decided to look at the startups on my computer so I could reduce some of them. I noticed this one, 'O4 - HKCU\..\Run: [?????????] ??????????????e', I tried getting HijackThis to Fix it but it keeps coming back. Does anyone know what it is? Is it useful? Is It malware? If it is malware how to get rid of it?Logfile of Trend Micro HijackThis v2.0.2Scan saved at 11:21, on 2009-06-20Platform: Windows Vista SP1 (WinNT 6.00.1905)MSIE: Internet Explorer v8.00 (8.00.6001.18702)Boot mode: NormalRunning processes:C:\Windows\system32\taskeng.exeC:\Windows\system32\Dwm.exeC:\Program Files\Alwil Software\Avast4\ashDisp.exeC:\Windows\System32\hkcmd.exeC:\Windows\RtHDVCpl.exeD:\Program Files\iTunesHelper.exeC:\Program Files\Hamachi\hamachi.exeC:\Program Files\LogMeIn\x86\LogMeInSystray.exeC:\Program Files\LogMeIn\x86\LMIGuardian.exeC:\Acer\Empowering Technology\ENET\ENMTRAY.EXEC:\Acer\Empowering Technology\EPOWER\EPOWER_DMC.EXEC:\Acer\Empowering Technology\ACER.EMPOWERING.FRAMEWORK.SUPERVISOR.EXEC:\Program Files\OpenOffice.org 2.4\program\soffice.exeC:\Program Files\OpenOffice.org 2.4\program\soffice.BINC:\Program Files\Skype\Phone\Skype.exeC:\Program Files\Skype\Plugin Manager\skypePM.exeC:\Windows\... Read more

Answer:O4 - HKCU\..\Run: [?????????] ??????????????e

Hello and welcome to Bleeping ComputerWe apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine. If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.Upon completing the steps below another staff member will review and take the steps necessary with you to get your machine back in working order clean and free of malware.If you have already posted a DDS log, please do so again, as your situation may have changed.Use the 'Add Reply' and add the new log to this thread.Thanks and again sorry for the delay.We need to see some information about what is happening in your machine. Please perform the following scan:Download DDS by sUBs from one of the following links. Save it to your desktop.DDS.scrDDS.pifDouble click on the DDS icon, allow it to run.A small box will open, with an explaination about the tool. No input is needed, the scan is running.Notepad will open with the results.Foll... Read more

22 more replies
Relevance 44.28%
Question: HKCU pop up

i tap on icon to get explore home page (google) and a little square window pops up with HKCU in it.either close it or hit ok. hit ok explore loads. never seen this before. how to get rid of this?
 

More replies
Relevance 44.28%
Question: [email protected]

Windows Defender identified a program as having potentially unwanted behavior is there anyway that the information can be translated so that I can understand where it has come from?
tpeac.

More replies
Relevance 44.28%
Question: [email protected]

Does anybody recognize this item which seems to have eluded all the safety nets?
 

More replies
Relevance 43.87%

My spyware checker says theres spyware there, but it doesn't show the path before HKCU\Software\ etc.
 

Answer:Does anyone know where the HKCU folder is?

I doubt that you will find a HKCU folder. The entry that you gave refers to a Regristry key. Go to Start - Run - type regedit and that will carry into the registry editor. Be careful about what you delete.
 

1 more replies
Relevance 43.87%

I got this virus and it's hiding in the registry. Where can I find it? I can't clean my system. I've tried everything. The virusCan somebody please show me the way?WinXP SP3 IE6

Answer:Where the heck is HKCU?

Welcome to BC.Please download Malwarebytes Anti-Malware and save it to your desktop.Make sure you are connected to the Internet.Double-click on mbam-setup.exe to install the application.When the installation begins, follow the prompts and do not make any changes to default settings.When installation has finished, make sure you leave both of these checked:Update Malwarebytes' Anti-MalwareLaunch Malwarebytes' Anti-MalwareThen click Finish.MBAM will automatically start and you will be asked to update the program before performing a scan. If an update is found, the program will automatically update itself. Press the OK button to close that box and continue. If you encounter any problems while downloading the updates, manually download them from here and just double-click on mbam-rules.exe to install.On the Scanner tab:Make sure the "Perform Quick Scan" option is selected.Then click on the Scan button.If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button. The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".Click OK to close the message box and continue with the removal process.Back at the main Scanner screen, click on the Show Results button to see a list of any malware that was found.Ma... Read more

1 more replies
Relevance 43.87%

Alrighty, so here';s what's going on: I was looking through my startup list, looking up(that's how I found bleepingcomputer) and unchecking items that might be slowing me down, when it struck me that I should look at my registry too. Now, I have no experience with registries, but I figured I'd take a look for anything fishy... I found this in HKCU:

-seekglobaluser
|_
UpBash

That's my best impression of it, seekglobal user is the folder in HKCU, and UpBash is a subordinate of that.
In seekglobaluser, I found:

Name Type Data
(Default) REG_SZ value not set
nurb lite REG_BINARY >long hex code here<
Maybe its just me, but "seekglobauser", "UpBash", and "nurblite" sound a little suspicious. I found absolutely no information about these terms on google.
My other question is, suppose I've uninstalled a certain software, half life 2 demo for example. There is still a Valve folder in HKCU. Can I delete that safely, and do I need to do anything first? Will I gain anything from it?

Once upon a time, I used GMail FS (Gmail Drive), a shell extension that allows me to store files on gmail as attachments, only using the interface of a folder/drive named gmail. Not the most useful thing in the world, but I figured I'd try it out. Only thing is, now it is obselete. I've u... Read more

Answer:Hkcu/seekglobaluser?

A lot of members here are pleased with the results of cleaning the registry by using Windows Live OneCare safety scanner. I would think that would be better than trying to decipher all the possible errors or leftovers from uninstalled programs. http://safety.live.com/site/en-us/default

2 more replies
Relevance 43.87%

Hi, I found most of the answers to my Hijack this log in other threads, but I was unable to find these particular lines:

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
and
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

Are these something I need to delete?

Thank you in advance!
 

Answer:Hijack This O16 - DPF & O6 - HKCU\

Hi and welcome

No, those are legit. Especially the 016.
As for the 06, unless you have the Spybot S&D option 'Lock homepage from changes' active, or your system administrator put this into place, have Hijack This fix it.
 

3 more replies
Relevance 43.87%
Question: HKCU\Software

Is it okay to manually delete any uninstalled software from HKCU\Software in the registry? Some programs leave a lot of keys their after being uninstalled but I want to make sure it won't break anything.

Thanks.

Answer:HKCU\Software

Hello Marty,

I would recommend to create a restore point to be safe, but it should be fine since the program is uninstalled. These will most likely just be user settings left in case you reinstall the program to have them back.

4 more replies
Relevance 43.87%
Question: HKCU mystery¿

HCKU\Softeware\Policies\Microsoft\Internet Explorer\Restrictions present

not sure what it means exactly? any clues if i actually need this in my reg.
 

Answer:HKCU mystery¿

6 more replies
Relevance 43.87%

I'm trying to get a handle on my Start-Up items and I'm reading all kinds of advice on MajorGeeks. So I check msconfig for my start-up stuff and I find a bunch of these things: HKLM\software\Microsoft\Windows\Current VersionVer and HKCU\software\Microsoft\Windows\Current VersionVer. In front of these lines are such things as: jusched, and issch. What in the world is all this? I recognize a lot of the startup items, but not these. Help. Thanks.
 

Answer:What are HKLM and HKCU?

Hi

HKLM = Hkey Local machine

LKCU = Hkey local user

These are various locations in the windows registry and each can at times mirror the info held in the other but they are quiet specific and its not worth deleting items from them unless confident.... deleting the run hive items is pretty ok as many unless your security software listings are not really needed, but if you post a list we can advise on whats safe or not to remove.

Sadly due to how the application works it may pop its startup into either of those registry keys run hives.


jusched is Sun Javas startup and more so its updater and well is not needed to delete as Sun Java is not a rollup applications it always needs older version uninstalling and newer installing

issch is Installshields installer app and also not needed as all applications come with their own installers.


I normally just use Ccleaners Startup list to delete what I dont need BUT this is perminent deletion so another app I have is this which allows you to manage themstartups Startup Delay so you can untick the startups and see if anything breaks if not then leave them unticked or fully delete.
 

4 more replies
Relevance 43.46%

Hi, I am on Windows XP. I recently got a wireless modem/internet provider, and I think I got spyware through IE. Here is what is happening:
changes my password to login after comp. goes on standby- not to power up
changes IE start page to about:blank
comes back no matter how often I click "fix checked" in Hijack this
Now is giving me random popups for some sort of music site
When I Ctrl+alt+delete, CPU Usage is often 100%

I have already deleted IE, and now use firefox. I also tried system restore, but it always returns.

I will post my logfile below. Thank you for your halp.

Logfile of HijackThis v1.99.1
Scan saved at 1:53:42 PM, on 11/19/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Norton Internet Security\NISUM.EXE
C:\Program Files\Norton Internet Security\ccPxySvc.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\SysRes.exe
C:\Program Files\UKBroadband\now_wireless_broadband\dialer\Dialer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDO... Read more

Answer:Solved: HKCU on Hijack this...

16 more replies
Relevance 43.46%

Logfile of HijackThis v1.99.1
Scan saved at 02:45:42, on 17/07/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\Program Files\Sygate\SPF\smc.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\drivers\trcboot.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\drivers\ldlcserv.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\Mcshield.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\WINNT\system32\nvsvc32.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe
C:\WINNT\system32\internat.exe
C:\Program Files\HijackThis\HijackThis.exe
C:\WINNT\system32\cmd.exe
C:\WINNT\system32\taskmgr.exe
c:\progra~1\intern~1\iexplore.exe
c:\progra~1\intern~1\iexplore.exe
C:\WINNT\system32\NOTEPAD.EXE
C:\PROGRA~1\MOZILL~1\firefox.exe
C:\Program Files\SpywareBlaster\spywareblaster.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgb... Read more

Answer:R1 - HKCU when deleted - reapers

9 more replies
Relevance 43.46%

hello when i scan my pc with adwclean i found 3 error in regedit i click to fix those error but after a few days adwclean find the same errors 
 
 
 
 

More replies
Relevance 43.46%

Having a bit of a computer check, and seeing in Start-Up the above reference, I was wondering if its essential to remain in Start-Up.
Checking on the internet, it gives various suggestions for or against removal, including this is to do with Office XP (which I do not have installed).
Any comments very much appreciated.

Answer:Is HKCU: Run CTFMON.EXE Essential?

No its not essential I have it disabled on all of my machines.

5 more replies
Relevance 43.46%

Hello! I've been following many topics regarding Conduit, but at least every time I run ADW Cleaner, the application found it! So, is there no other way to kill forever this intruder??? So glad about your thought...Best regards, greysmouth BO IT.

Answer:HKCU\Software\Conduit

I gotten conduit-ed several times, mostly when I download something without reading '''every word''' of their information ''before'' I start the download. Then I just refuse to use any product that has 'Conduit' as a supporter.I finally went into my Registery (regedit), and studied it for awhile. Then I went to Edit and conducted a 'find' for conduit. Every time I found it I deleted it. After going through the Registery this way, I rebooted and did it again. Seem to work for me. I know it's not recommended that a non-computer expert go into the Registery, but I was as careful as I could be, and I've removed Conduit at least3 times this way. It never resurfaced again until I got caught not paying attention to my download several months later, each time...Good Luck. And, study yourregistery' first!!!

7 more replies
Relevance 43.46%

Hello,
 
I have ran adwcleaner several times in thje past few days. and there is something there that keeps appearing in adwcleaner.
 
I run the program but this  HKCU\Software\ImInstaller keeps appearing.
I think it is a trojan/worm
but not sure.
But I did some looking up about this and it seems it is a trojan malware.
Can you please help me remove what ever it is.
and let me know anything  else.
 
thankyou
and have a good day.

Answer:HKCU\Software\ImInstaller

Hello rp-57

Let's look at all these logs.

MiniToolBox
Please download MiniToolBox, save it to your desktop and run it.Checkmark the following checkboxes:
Flush DNSReport IE Proxy SettingsReset IE Proxy SettingsReport FF Proxy SettingsReset FF Proxy SettingsList content of HostsList IP configurationList Winsock EntriesList last 10 Event Viewer logList Installed ProgramsList Users, Partitions and Memory size.
Click Go and post the result (Result.txt). A copy of Result.txt will be saved in the same directory the tool is run. Note: When using "Reset FF Proxy Settings" option Firefox should be closed.AdwCleaner
Please download AdwCleaner by Xplode and save to your Desktop.Double click on AdwCleaner.exe to run the tool. Vista/Windows 7/8 users right-click and select Run As AdministratorClick on the Scan button.AdwCleaner will begin...be patient as the scan may take some time to complete.After the scan has finished, click on the Report button...a logfile (AdwCleaner[R0].txt) will open in Notepad for review.The contents of the log file may be confusing. Unless you see a program name that you know should not be removed, don't worry about it. If you see an entry you want to keep, let me know about it.Copy and paste the contents of that logfile in your next reply.A copy of all logfiles are saved in the C:\AdwCleaner folder which was created when running the tool.
Junkware Removal Tool
Please download Junkware Removal Tool to your desktop.Shut down your protection software now to avoid... Read more

26 more replies
Relevance 43.46%

Hello. Here attached the two FRST logs after running the application on my PC. Please, let me know...Many thanks, greysmouth BO IT.
 FRST.txt   47.63KB
  5 downloads
 Addition.txt   38.39KB
  3 downloads

Answer:HKCU\SOFTWARE\Conduit\

Hello and welcome to Bleeping Computer! I am HelpBot: an automated program designed to help the Bleeping Computer Staff better assist you! This message contains very important information, so please read through all of it before doing anything.
We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.
To help Bleeping Computer better assist you please perform the following steps:
*************************************************** In order to continue receiving help at BleepingComputer.com, YOU MUST tell me if you still need help or if your issue has already been resolved on your own or through another resource! To tell me this, please click on the following link and follow the instructions there.CLICK THIS LINK >>> http://www.bleepingcomputer.com/logreply/569202 <<< CLICK THIS LINK
If you no longer need help, then all you needed to do was the previous instructions of telling me so. You can skip the rest of this post. If you do need help please continue with Step 2 below.
***************************************************If you still need help, I would like you to post a Reply to this topic (click the "Add Reply" button in the lower right hand of t... Read more

9 more replies
Relevance 43.46%

This is a bonehead question about the registry.
Is the HKCU hive (if that's the right term) dynamically built from HKU\S-1-5-21-... records every time a user logged on?

I want to make some changes to the registry records of product - copying hundreds of configuration records from an old release set to a new release set. I'm very aware that this may be a big blunder. The records are in both HKCU and my HKU. If I change the HKCU registry records and am blown out of the water, will logging off and back on get me back to the unchanged HKU copy, or does Windows keep the two sets in sync?

I could (and probably will) export all the records I intend to change, but I could also just uninstall and reinstall the program if it fails to run. But I'm more worried about changing something I did not intend to change - something else in the HKCU hive.

I will take a complete backup of my system before doing any of this and plan on doing a system restore if I really hose things over, but I would rather have a quicker and more simple recovery.

Answer:HKCU and HKU registry records

I'm not great on the Registry but it is made up of 5 Hives or basically text files that Windows uses to know how to run itself and programs. I'd think those Hives are created when installing Windows and subsequently installing programs and messing with one may be as dire as preventing Windows from running properly if at all. I see those 2 Hives you mentioned are different, some things in one are in subkeys on the other.

This is a simplified view of the files when I once backed up the Registry several years ago on a different computer, haven't checked if Win10 has the same [now use a shortcut to create a new Restore Point when I need].

6 more replies
Relevance 42.64%

Hi ,

Updating the registry value in HKCU node is possible when my IE plugin options has been changed during the Protected mode is OFF .

But ,If the protected mode is made On, i am not able to find the registry value updating in that particular HKCU registry node.
I am updating the registry values programatically using dotnet code.

Please, anyone say why this updating registry value is not happening when the protected mode is On ??
Thanks in advance ...


Thanks and Regards,
Chetan.

Answer:IE-8 ProtectedMode-On issue updating HKCU

I believe you'll find your answer(s) here -> A Developer's Survival Guide to IE Protected Mode - CodeProject

2 more replies
Relevance 42.64%

Hello all, 
 
My computer had been experiencing issues with logging into windows (UUID) and Chrome would not launch. 
 
After researching the issue I downloaded AdwCleaner and ran both the scan & cleaning tools. The tool helped to remove approximately five issues (sorry, I cannot remember what). I can now successfully login into windows (without issue) and launch Chrome, however the below issue remains.  

HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyOverride] - <local>
Is the above malware or a false positive?
 
After further research I found Bleeping Computer.
 
Please find attached FRST and Addition. 
 
Please find attached the log from AdwCleaner, 'AdwCleaner[R7]'.
 
Please find attached the log from Malwarebytes, 'Malwarebytes scan results'.
 
The settings in Chrome have been restored to their original defaults and the CCleaner tool has been used.
 
Any help would be appreciated. 
 
Thank you. 
 
 

Answer:HKCU\....\Internet Settings [ProxyOverride]

Hello, Welcome to BleepingComputer.I'm nasdaq and will be helping you.If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed.===Open notepad (Start =>All Programs => Accessories => Notepad). Please copy the entire contents of the code box below.

start

EmptyTemp:
RemoveProxy:
CloseProcesses:

HKLM\...\Run: [] => [X]
BHO-x32: Norton Vulnerability Protection -> {6D53EC84-6AAE-4787-AEEE-F4628F01010C} -> C:\Program Files (x86)\Norton 360\Engine\21.7.0.11\IPS\IPSBHO.DLL No File
CHR HKLM\...\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - https://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - https://clients2.google.com/service/update2/crx
S3 Tosrfcom; No ImagePath

End
Save the files as fixlist.txt in the same folder where the Farbar tool is running from.The location is listed in the 3rd line of the Farbar log you have submitted.Run FRST and click Fix only once and wait.Restart the computer normally to reset the registry.The tool will create a log (Fixlog.txt) please post it to your reply.===How is the computer running now?

15 more replies
Relevance 42.64%

Hi All,
Looking for some help to a strange issue I'm experiencing.
To start with, I had a single user created on my Win7 PC.
I have loaded on some software, where certain preferences set within the software are stored in a registry key in HKU/HKCU.
I have set some values to '0' , both within the software and also via RegEdit. I have confirmed the values are saved by checking RegEdit.
Each time I run the software however, It looks as if the key is being re-created or overwritten and the values change back to '1'
I've checked permissions and ruled this out as being an issue, as I have full read and write access to this registry key.
If I run the software in compatibility mode for Vista SP2 or earlier, the issue does not occur.
If I create a new User account on the same PC and switch off compatibility mode, so it's running as a standard win7 app, the issue does not occur and any preferences I alter remain saved in the registry upon re-running the software. (confirmed in RegEdit)
What is going on with my User Account? Why will it work on my account only if I use Compatibility <=Vista SP2 ? Why does it work correctly on a different user account on same PC, without the need to run in compatibility mode?
Thanks in advance

More replies
Relevance 42.64%

I've posted a HJT scan of my computer here a few times in the past, and the results were extremely positive, thanks to the help of great people here. I do have, however, an extremely stubborn and recurring problem that I've tried to resolve myself, but to no avail. Whenever I scan HJT, an entry appears in the R1 (Start/Search pages) line in the HKCU category. I continually "fix" it with HJT, but it continues to regenerate after each reboot. I've tried to remove it by navigating to it in REGEDIT as well, but same eventual conclusion. I know for a fact that its a non-legit entry, as determined in this forum in the past. Any help in permanently removing this pest would be appreciated.

I've done all required in the READ THIS FIRST post in order to post a HJT scan, so if needed, I can post the most recent one. Thanks again.

Windows 98SE
160MbRAM
56K Modem
 

Answer:A stubborn regenerating HKCU entry

Go ahead post your HJT log as an attachment.
 

38 more replies
Relevance 42.64%

HKCU\software\Microsoft\windows\current version\run\Google update (sseccaZ.najorT)
 
I would be grateful if someone could help in removing this rootkit Trojan - here is the DDS Log
 
 
(Ver_2012-11-20.01) - NTFS_AMD64
Internet Explorer: 11.0.9600.16428
Run by jacandian at 15:53:12 on 2013-12-21
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.44.1033.18.4044.1615 [GMT 0:00]
.
AV: McAfee Anti-Virus and Anti-Spyware *Enabled/Updated* {ADA629C7-7F48-5689-624A-3B76997E0892}
SP: McAfee Anti-Virus and Anti-Spyware *Enabled/Updated* {16C7C823-5972-5907-58FA-0004E2F9422F}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: McAfee Firewall *Enabled* {959DA8E2-3527-57D1-4915-924367AD4FE9}
.
============== Running Processes ===============
.
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe
C:\Program Files... Read more

Answer:Removal of Najor T HKCU Registry

Hello, Welcome to BleepingComputer.I'm nasdaq and will be helping you.If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed.===Please download AdwCleaner by Xplode onto your Desktop.Close all open programs and internet browsers.Double click on AdwCleaner.exe to run the tool.Click the Scan button and wait for the process to complete.Click the Report button and the report will open in Notepad.IMPORTANTIf you click the Clean button all items listed in the report will be removed.If you find some false positive items or programs that you wish to keep, Close the AdwCleaner windows.Close all open programs and internet browsers.Double click on AdwCleaner.exe to run the tool.Click the Scan button and wait for the process to complete.Check off the element(s) you wish to keep.Click on the Clean button follow the prompts.A log file will automatically open after the scan has finished.Please post the content of that log file with your next answer.You can find the log file at C:\AdwCleaner[Sn].txt (n is a number). Please downloadJunkware Removal Tool to your Desktop.Please close your security software to avoid potential conflicts.Run the tool by double-clicking it. If you are using Windows Vista or 7, right-mouse click it and select Run as administrator.The tool will open and start scanning your system.Please be patient as this can take a while to complete, depending on your system's specifica... Read more

8 more replies
Relevance 42.64%

In my HKCU folderthe main folder itselfI have two entries which I haven't seen on other machines: HTTP11SAVED REG_DWORD 0x00000001 (1) and HTTP11SAVED_VAL REG_DWORD 0x00000000 (0). Are they good entries or bad entries?
RTG
 

Answer:HKCU root registry entries

6 more replies
Relevance 42.64%

Hi,

I'm trying to install an soft via sccm into an windows7 64 bit system
now the first soft is an msi that is installed via the system-account and this works fine,
but in the same package i install an xxx.reg file via the useraccount into HKCU and this doesn't work. i'm getting error: Registry editing is disable by your administrator
I'm not used to work with windows7 but in windowsXP an simple user can insert into HKCU without problem.

is there an way to tell windows7 that an simple user-account can insert into the registry of HKCU?

any help would be very welcome

btw my first post here, i just wanted to say very nice forum i think i will learn a lot here

Answer:Regedit, how to insert to HKCU as user

Hello Moby,

You might see if using OPTION ONE in the tutorial below may be able to allow you to edit the registry afterwards.

Regedit - Enable or Disable - Vista Forums

Afterwards, I would recommend that you do a full scan of your system with Malwarebytes free just to be safe and help make sure your system is clean of malware or viruses.

Hope this helps,
Shawn

3 more replies
Relevance 42.64%

Hi All,Looking for some help to a strange issue I'm experiencing.To start with, I had a single user created on my Win7 PC.I have loaded on some software, where certain preferences set within the software are stored in a registry key in HKU/HKCU.I have set some values to '0' , both within the software and also via RegEdit. I have confirmed the values are saved by checking RegEdit.Each time I run the software however, It looks as if the key is being re-created or overwritten and the values change back to '1' I've checked permissions and ruled this out as being an issue, as I have full read and write access to this registry key.If I run the software in compatibility mode for Vista SP2 or earlier, the issue does not occur.If I create a new User account on the same PC and switch off compatibility mode, so it's running as a standard win7 app, the issue does not occur and any preferences I alter remain saved in the registry upon re-running the software. (confirmed in RegEdit) What is going on with my User Account? Why will it work on my account only if I use Compatibility <=Vista SP2 ? Why does it work correctly on a different user account on same PC, without the need to run in compatibility mode?Thanks in advance

More replies
Relevance 42.23%

Hello,

I'm running Win 7 64 bit, and I've had no problems with anything and it's very stable. However it's been a while since I installed it and as always with windows, some things begin to crop up.

I have noticed that on every bootup, I get weird keys created in the HKCU registry, that look like this:

? and ?[

Here's a screen shot:

What could that be? I tried creating RegMon filters and doing bootup detection. I couldn't find anything that creates those entries. I have the latest version of Avira AntiVir installed and running at all times. This is a little bothersome to me.

Answer:Weird characters in HKCU getting created on every reboot?!?

What shows in the right screen if you click on them, anything that could help id them?

9 more replies
Relevance 42.23%

What functions are performed by the keys at

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage

?

I know the "Favorites" key registers the items pinned to the Start Menu (and maybe the Taskbar too), but what do the other keys do?
Q2: is there a way to back up only one key instead of having to export/import the entire StartPage folder?

Answer:Functions of the HKCU\....\Explorer\StartPage registry key

Export the key you wish to back up, right click on the reg entry & select "Edit" & it will open in notepad. Delete the information you don't wish to backup. Hope this is clear enough. Good luck!

1 more replies
Relevance 42.23%

Whatever this infection is, it keeps recreating the following registry key value:
 
regsvr32.exe "C:\Users\llehman\AppData\Roaming\AufOmxu\WeyInba.dll
 
in the HKCU/Software/Microsoft/Windows/CurrentVersion/Run key
 
I delete it and hit F5 and it is back.  Don't know how to tell what is creating it.
 
In addition it seems to be causing Acrobat Reader to crash and a repeating occurance of WerFault.exe that will slow the computer to a crawl.  A reboot will stop the repeating werfault.exe from coming up but opening up a PDF will cause it again.  Reinstalling Acrobat reader does not fix the issue. 
 
I have run JRT and also combofix - neither has appeared to be able to handle it.
 
Here is the FRST log and I have attached the addition.txt:
 
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:29-12-2015
Ran by llehman (administrator) on ROCK-PC3 (29-12-2015 15:06:40)
Running from C:\Users\llehman\Downloads
Loaded Profiles: llehman (Available Profiles: Admin & zylatech & llehman)
Platform: Windows 7 Professional Service Pack 1 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
 
==================== Processes (Whitelisted) =================
 
(If an entry is included in the fixlist, the process will be closed... Read more

Answer:Infected with something that keeps recreating hkcu/run registry entry

Welcome to Bleeping Computer's Malware Removal Logs area. My name is Sintharius. I will assist you with your problem.Please allow me some time to review your logs and I will be back with instructions.

13 more replies
Relevance 42.23%

Hi,
 
I've run ADWCleaner and it removed some adware I had. I re-ran it to be certain and it noticed the HKCU\Software\FLEXnet Key in my registry and marked it for deletion. But each time I re-run it, it finds the same key but it never seems to delete. I can't find the key myself in the registry using Regedit. Everything else seems fine.
 
Do I have a problem still or is HKCU\Software\FLEXnet normal?
 
Thx.
 
 

Answer:Ran ADWCleaner - HKCU\Software\FLEXnet remains

Welcome HamiltonLets give these a run and see.Please download Rkill by Grinler and save it to your desktop.Link 1Link 2Double-click on the Rkill desktop icon to run the tool.If using Vista, right-click on it and Run As Administrator.A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.If not, delete the file, then download and use the one provided in Link 2.If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.If the tool does not run from any of the links provided, please let me know.Do not reboot the computer, you will need to run the application again.Please download Malwarebytes Anti-Malware and save it to your desktop.Important!! When you save the mbam-setup file, rename it to something random (such as 123abc.exe) before beginning the download.Double-click on the renamed file to install, then follow these instructionsfor doing a Quick Scan in normal mode.Don't forget to check for database definition updates through the program's interface (preferable method) before scanning.If you cannot update Malwarebytes or use the Internet to download any files to the infected computer, manually update the database by following the instructions in FAQ Section A: 4. IssuesMalwarebytes may "make changes to your registry" as part of its disinfection routine. If using other security programs that detect registry changes (ie Spybot's Teatimer), they may interfere or alert you. Temp... Read more

5 more replies
Relevance 42.23%

Hi,
 
I'd posted a query at http://www.bleepingcomputer.com/forums/t/519955/ran-adwcleaner-hkcusoftwareflexnet-remains/ and it was suggested that I post again regarding the Flexnet files remaining. I made a mistake with my original scanning by leaving the Malwarebytes resident and then in I went and replied to my second posting which I shouldn't have done ( http://www.bleepingcomputer.com/forums/t/520055/ran-adwcleaner-hkcusoftwareflexnet-remains/ ) so here is a new post (I wanted to rerun rkill and malwarebytes again anyway since I was having another problem) -- At the moment I still only have the FLEXnet remaining but only ADWCleaner notices it.
 
Since my last query, malwarebytes seemed to be having trouble with two issues and they appear to now be cleaned since I ran rkill and then malwarebytes again, so I'll start with what I've seen since the first query -- This is what I saw on Malwarebytes -- I was getting a lot of popups from malwarebites but it didn't seem to be able to remove the problem -- I'm rather curious about what was going on --
 

 
2014/01/09 13:42:14 -0500    LINDA-PC    (null)    MESSAGE    Starting protection
2014/01/09 13:42:14 -0500    LINDA-PC    (null)    MESSAGE    Protection started successfully
2014/01/09 13:42:14 -0500    LINDA-PC    (null)    MESSAGE   ... Read more

Answer:Ran ADWCleaner - HKCU\Software\FLEXnet remains

Hello lhamilton and welcome to Bleeping Computer!
My name is bloopie and I'll be helping you with your problems as best I can! A few things to keep in mind while we are working together:
If you have since resolved the original problem you were having, I would appreciate it if you let me know.
If you are unsure about any of the steps just post what you can and I will guide you!
Please tell me if you have your original Windows CD/DVD available.
Please copy and paste all logs here unless otherwise instructed!
Upon completing the steps below I will review your topic an do my best to resolve your issues.
Please do not run any other tools without my instruction to do so!
==========
 

Do I need to run rkill before removing things with malwarebytes?

Rkill is a program designed to stop known malware processes that could be interfering with the running of your normal antimalware programs. It is not always necessary to run Rkill unless your normal tools are obviously being stopped prematurely.
 
...And by looking at your Rkill log above, there were no malware services, processes, or issues running for Rkill to...well...kill!
 
==========
 
FlexNet is really nothing to worry about, and it wouldn't hurt to have AdwCleaner remove these two registry keys or to leave them alone. They are not necessary to have running when the system boots, but they are created from legitimate programs.
 
==========
 
It looks like MBAM was trying to block some activity...can... Read more

14 more replies
Relevance 42.23%

After running Rkill, Malwarebytes and Junkware Removal Tool the only thing still left is HKCU\Software\FLEXnet and it's only noticed by ADWCleaner which wants to remove it but can't.
 
As requested, here is the ADWCleaner log:
 

 
# AdwCleaner v3.016 - Report created 07/01/2014 at 20:22:59
# Updated 23/12/2013 by Xplode
# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)
# Username : Linda - LINDA-PC
# Running from : D:\lhamilto\install\AdwCleaner.exe
# Option : Scan
***** [ Services ] *****
***** [ Files / Folders ] *****
***** [ Shortcuts ] *****
***** [ Registry ] *****
Key Found : HKCU\Software\FLEXnet
Key Found : [x64] HKCU\Software\FLEXnet
***** [ Browsers ] *****
-\\ Internet Explorer v11.0.9600.16428
-\\ Mozilla Firefox v26.0 (en-US)
[ File : C:\Users\Linda\AppData\Roaming\Mozilla\Firefox\Profiles\3zwcdwdb.default-1367292270194\prefs.js ]
*************************
AdwCleaner[R0].txt - [8926 octets] - [07/01/2014 00:32:57]
AdwCleaner[R1].txt - [978 octets] - [07/01/2014 00:41:54]
AdwCleaner[R2].txt - [1097 octets] - [07/01/2014 00:45:07]
AdwCleaner[R3].txt - [1157 octets] - [07/01/2014 01:05:06]
AdwCleaner[R4].txt - [1277 octets] - [07/01/2014 19:46:59]
AdwCleaner[R5].txt - [1338 octets] - [07/01/2014 19:52:15]
AdwCleaner[R6].txt - [1458 octets] - [07/01/2014 19:55:49]
AdwCleaner[R7].txt - [1135 octets] - [07/01/2014 20:22:59]
AdwCleaner[S0].txt - [7609 octets] - [07/01/2014 00:35:54]
AdwCleaner[S1].txt - [999 octets] - [07/01/2014 00:4... Read more

Answer:Ran ADWCleaner - HKCU\Software\FLEXnet remains

BTW, after I posted, I reran the MalwareBytes checks and it found nothing. As requested, I've made no changes but MalwareBytes Pro evaluation version remains on my system and told me a few times this morning that it is blocking 162.210.192.21 IP but none since then.

8 more replies
Relevance 42.23%

I am not certain how or why these keys are there but under my HKEY_CURRENT_USER are a bunch of weird looking subkeys composed of random characters followed by an Equals sign. I have posted a screenshot to show. These keys also show up under HKEY_USERS. I have no idea how they got there and virus/spyware scans all come back clean. I am running Vista Ultimate and I am not really experiencing any problems. I am concerned because I am fairly knowledgeable about computers and the registry but I have never seen anything like this before. Typically things like this sound off my virus/worm/keylogger..etc alarms. Any ideas?

Answer:Strange Registry Keys located in HKCU & HKU

Hello and welcome to Bleeping Computer.

What virus/spyware scans have you used so far?

6 more replies
Relevance 42.23%

I got some kind of mixi dj spyware with some free soft. I successfully deleted the toolbar, however there's still an entry in the registry.
HKCU \Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}

I delete it, but as soon as I refresh the registry, comes back again. Tried deleting through cmd - says there's a syntax error. Deleting in safe mode won't help as well.
Any suggestions?
Thanks a lot
 

Answer:HKCU registry entry comes right back after I delete it

Put AdwCleaner to use.

----------------------------------------------------------
 

1 more replies
Relevance 42.23%

at start up it states that it can not start the program that is associated with HKCU\software\microsoft\windowsNT\current version\windows:run reinstall the program or delete it from the registry. How do I find this program?

Answer:HKCU\software\microsoft\windowsNT\current ver

I'd be worried it was a virus. You can make a backup of the registry and then delete the key to test.Why did it take me over a year to phone in a problem to ATT?

5 more replies
Relevance 42.23%

Hi everyone. New to this site. Hope this is the right forum. Running Win 7 Home Premium on a 64 bit AMD dual core w/ Avast Free 8.0
I was checking out registry settings investigating a possible problem, and I found this directory:
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RADAR

Anyone know what it is or where it came from?
Avast hasn't complained and the only reference Google returns is: http://www.threatexpert.com/report.aspx?md5=30217c197d8f4110741d1489e7976155
I found none of the other entries mentioned at the link in my registry.
Should I worry?
Should I remove it?
 

Answer:HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RAD AR ???

Hi owsleyskid,
RADAR registry entries are a legitimate part of Windows.
They record data on application memory leaks, and provide the information back to MS anonymously.
This allows programs, and the OS itself, to fix bugs before they get to be a big problem.
This is a big help in early releases of software packages.
In short, these entries are OK, and you should best leave them alone.

askey127
 

2 more replies
Relevance 42.23%

I didnt export the original, as I should have =P if someone would be so kind as to upload one. I would be most greatful.

Answer:Seeking [HKCU\CurrentVers.\Explorer\FileExt\.dll]

  
Quote: Originally Posted by Poopcow23


I didnt export the original, as I should have =P if someone would be so kind as to upload one. I would be most greatful.


Did you just delete that key? Why?

6 more replies
Relevance 42.23%

Is it okay to delet 04-hkcu\run:[money agent}
ogfile of HijackThis v1.99.1
Scan saved at 2:31:39 PM, on 2/23/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe
C:\WINNT\system32\Ati2evxx.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINNT\Explorer.EXE
C:\WINNT\GWHotKey.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\WINNT\System32\spool\drivers\w32x86\3\hpztsb05.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\FamilyOnline\Fastlane\AcceleNetClient.exe
C:\PROGRA~1\Webshots\webshots.scr
C:\Program Files\FamilyOnline\Fastlane\ClientSideProxy.exe
C:\WINNT\system32\cisvc.exe
C:\WINNT\system32\cidaemon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\O... Read more

Answer:HijackThis Is it okay to delet 04-hkcu\run:[money agent}

http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html

Get the blaster worm removal tool here

Use it REBOOT and post a fresh log please
 

2 more replies
Relevance 42.23%

This is a screenshot from a downloaded msconfig utility. I have Win2000Pro. Could anyone tell me what the "N" startup item is? Before I disabled it HKCU was preceeding the location extension, but I have searched (as well as I know how) the Current User beehive and can't find a thing. This shows up in no Start Menu/Startup folder, nor in Regcleaner startup list. Disabling has manifested no problems, but what the heck is it?


Thanks,
Randall
 

Answer:Solved: HKCU beehive/startup question

16 more replies
Relevance 41.82%

Hello

I had Ramnit virus 2 weeks ago and ended up reformatting my hard drive and starting from scratch (thanks to Mole for all the help with that issue). I reformatted, reinstalled Avira, Spybot, Spyware Blaster, Malware Bytes, Super Anti Spyware, Zone Alarm and CCleaner. All updates are current as well as all Microsoft updates.

Using CCleaner I noticed today an odd entry in my Start up list and I am wondering if anyone can advise about it. I have deleted it from the Start up list twice and upon reboot it always returns.

Yes HKCU:Run Gvuvil rundll32.exe "C:\WINDOWS\dlocafit.dll",Startup

I have run Avira, Spybot, Malware Bytes and Super Anti Spyware which have not yet turned up this entry (some others which were dealt with did pop up). I also ran Windows Live Onecare which came back clean.

Any help with this is greatly appreciated.

Thelma

Answer:HKCU:Run Gvuvil rundll32.exe "C:\WINDOWS\dlocafit.dll",Startup

Hi, I can't find info on this yet. Try disable and not delete and see.

5 more replies
Relevance 41.82%

http://default-homepage-network.com/start.cgi?hkcu

How do I get rid of this? Spybot and Ad ware and Cool Web Shredder didn't help...it keeps coming back.
 

Answer:http://default-homepage-network.com/start.cgi?hkcu

go to http://www.thespykiller.co.uk/files/HijackThis.exe and download 'Hijack This!'.
make sure it is placed into it's own folder, not a temporary folder. Then doubleclick the Hijackthis.exe.
Click the "Scan" button, when the scan is finished the scan button will become "Save Log" click that and save the log.
Go to where you saved the log and click on "Edit > Select All" then click on "Edit > Copy" then Paste the log back here in a reply.
It will possibly show issues deserving our attention, but most of what it lists will be harmless or even required,
so do NOT fix anything yet.
Someone here will be happy to help you analyze the results.
 

1 more replies
Relevance 41.82%

Is there a Group Policy that would allow me to disable a program that starts up in HKCU?

Orange County District Attorney

More replies
Relevance 41.82%

I'm usually pretty good at getting rid of these infections, but I've got one here that's been killing me.Originally the infection was not displaying any pop-ups, but sending out mass amounts of emails from the PC and also blocking most malware scanning software from running (Malwarebytes, ComboFix, etc.). I was also getting browser redirects with Google. After manually cleaning it up somewhat and removing many infected files I was able to run some scans and remove the majority of the infection. To get to this point I've run Malwarebytes, Combofix, and several online scanners (Microsoft, ESET, etc.).At this point I believe the browser redirects and everything else are gone, but I'm still seeing a couple of symptoms of an infection that I can't seem to kick. First off is a proxy of 127.0.0.1:5555 in HKCU. Every time this key is deleted (via Hijackthis or manually), it immediately reappears. I'm also seeing a couple of Protocols (a5res and XBasic) in Hijackthis that keep coming back.At this point Malwarebytes comes up clean, along with several other scanners that I've tried. I'm hoping someone here might help me find the last pieces of this infection so I can avoid a wipe/rebuild.Here is a Hijackthis log file. Please let me know where to start!Logfile of Trend Micro HijackThis v2.0.2Scan saved at 7:20:51 AM, on 10/15/2010Platform: Windows XP SP3 (WinNT 5.01.2600)MSIE: Internet Explorer v8.00 (8.00.6001.18372)Boot mode: NormalRunnin... Read more

Answer:persistent infections, not a lot of symptoms except 127.0.0.1:5555 proxy in HKCU

Hello and Welcome to the forums! My name is Gringo and I'll be glad to help you with your computer problems. Somethings to remember while we are working together.Do not run any other tool untill instructed to do so!Please Do not Attach logs or put in code boxes.Tell me about any problems that have occurred during the fix.Tell me of any other symptoms you may be having as these can help also.Do not run anything while running a fix.In the upper right hand corner of the topic you will see a button called Options. If you click on this in the drop-down menu you can choose Track this topic. By doing this and then choosing Immediate E-Mail notification and then clicking on Proceed you will be advised when we respond to your topic and facilitate the cleaning of your machine.We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.In order for me to see the status of the infection I will need a new set of logs to start with.Please print out or make a copy in notpad of any instructions given, as sometimes it is necessary to go offline and you will lose access to them.DeFogger: Please download DeFogger to your desktop.

Double click DeFogger to run the tool.
The ... Read more

4 more replies
Relevance 41.82%

Was wondering if anyone can help us solve a logon issue?

Our corporate logon script written in VBScript is designed to write Internet Proxy values to the users HKCU registry hive depending on the physical location of the PC being logged into. We have a number of users that travel between offices and the logon script is not able to write these registry key values to the registry like it does on everyone else in the company.

Today while one of these users was in we replaced his NTUSER.DAT file to rule out the profile but this solved nothing. We then cloned a new account from his existing account. Dispite the fact that the old account always fails, the new account worked flawlessly. Same groups same access, etc. The only differences that we can come up with is the fact that the old logonid has SID history carried over from when his account was migrated from their legacy NT domain to our new Active Directory domain. If I'm not mistaken the SID history would not carry over to the clone even though the permissions did.

So, what I would like to understand is why the new account works great and the old one fails? If it does happen to have something to do with SID history what is it that is causing the regwrites to fail and how would one fix this problem?

Any help would be appreciated.
 

Answer:Logon script cannot change HKCU settings in registry

Hi wchull, my bet is that you have enabled FolderRedirection for the first account - probably with a GPO. This is a known problem when applying IE proxy settings. First get your user to LOGOFF then LOGON (NOT ShutDown>Restart) do the new settings then appear? GPOs applied to the user won't make it to the Registry hive unless you give the User time to instantiate and later save the results, so when they do appear a second LOGOFF will save them to the profile.

Are you using roaming profiles?

wchull said:

Was wondering if anyone can help us solve a logon issue?

Our corporate logon script written in VBScript is designed to write Internet Proxy values to the users HKCU registry hive depending on the physical location of the PC being logged into. We have a number of users that travel between offices and the logon script is not able to write these registry key values to the registry like it does on everyone else in the company.

Today while one of these users was in we replaced his NTUSER.DAT file to rule out the profile but this solved nothing. We then cloned a new account from his existing account. Dispite the fact that the old account always fails, the new account worked flawlessly. Same groups same access, etc. The only differences that we can come up with is the fact that the old logonid has SID history carried over from when his account was migrated from their legacy NT domain to our new Active Directory domain. If I'm not mistaken the SID history would not ... Read more

1 more replies
Relevance 41.82%

Can anyone point me to a reference for decoding the "toolbars", "settings", "settings word mail", and "toolbars word mail" entries in Vista 64 Registry Entry HKCU\software\microsoft\office\12\word\data

Background and Reason For Asking: For several weeks, when closing Word 2007 SP2 have been getting message "change has been made that affects the global template normal do you want to save these changes". Since I haven't done anything that should have changed it, I don't save. Googling shows that several others have a similar problem. KB291352 and other reports have information on cause and correction, none of which appear to apply in my case.

Today, while working with Microsoft tech support on another Word 2007 issue, the message went away. Some "diagnostic" activity taken by tech support included renaming three HKCU Registry Keys. Afterwards, I reversed these renames on a one-at-a-time basis and found that the HKCU\...\data key is the one that triggers the message. The new and renamed entries are made up of hexadecimal data. My assumption is that one or more of the bit settings is the trigger, and I'd like to decode them to see if the cause can be determined. - Thanks

More replies
Relevance 41.41%

Hi folks,

So I have been playing with making my own custom themes, as many here have done (and shared here). However, I wanted to do a little more, and in the process I solved some of my own confusions but brought up new ones. So I wanted to post my process here so hopefully some of you can help me improve what I am doing... I have jumped into the world of editing the .theme files and (potentially) the .msstyles file, but would love some help decoding some of it. I can find almost no guides on the latter, and the guides on the former, such as this one from Microsoft Dev Center are clearly not written for Windows 10 because not all of the attributes are the same, and even then not everything is explained completely... A lot of this I could probably figure out if I spent many hours tweaking one thing at a time to see the result but hopefully others already have the knowledge...

(For the purposes of this post I will use the moniker "NEW_THEME" to indicate the name of the theme I have been working on).

My primary goal was a simple slide show background, and I used the method explained in these forums, about saving a theme for sharing. Easy enough. However, I am using photos of all different sizes, so they are made to fit the screen but the background color is visible. I was not happy with any of the available background colors. So I navigated to the Theme folder (%User%\AppData\Local\Microsoft\Windows\Themes) and that is where you will find folder ... Read more

Answer:Custom Background Colors, Theme Editing, msstyles editing advice?

TLDR: don't mess with msstyles.

As much as it's rewarding in having a true custom theme, it's not worth it if some update or something else broke things and you end up repairing/reinstalling Windows 10.

4 more replies
Relevance 41.41%

Computer infected. Noticed while uploading pictures to facebook via picasa. Screen went blank and said "This is Jim" Keeps shutting down. Rebotted in safe mode and scanned with Trend Micro. Found nothing. Ran Malwarebytes and found this file: HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced|Start_ShowSearch (PUM.Hijack.StartMenu)

 Have the log for that.
 
DDS Log below.
 
DDS (Ver_2012-11-20.01) - NTFS_AMD64 NETWORK
Internet Explorer: 8.0.7601.17514  BrowserJavaVersion: 10.11.2
Run by User at 20:39:15 on 2013-02-18
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.1.1033.18.3836.2703 [GMT -6:00]
.
AV: Trend Micro AntiVirus *Enabled/Updated* {68F968AC-2AA0-091D-848C-803E83E35902}
SP: Trend Micro AntiVirus *Enabled/Updated* {D3988948-0C9A-0693-BE3C-BB4CF86413BF}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\Explorer.EXE
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system... Read more

Answer:HKCU\SOFTWARE Malware Deleted. System infected Keeps shutting down

Hi and welcome to Bleeping Computer!    My name is Jeff and I would be more than happy to help you with your malware related problems.
 
 
Please download aswMBR to your desktop.
 
Double click the aswMBR icon to run it.
Click the Scan button to start scan.
If you are asked to update the Avast Virus database please allow it to do so.
When it finishes, press the save log button, save the logfile to your desktop and attach its contents in your next reply.
 

Click the image to enlarge it
 

AdwCleaner

Close all open programs and internet browsers.
Double click on adwcleaner.exe to run the tool.
Click on Delete.
Confirm each time with Ok.
You will be prompted to restart your computer. A text file will open after the restart.
Please post the contents of that logfile with your next reply.
You can find the logfile at C:\AdwCleaner[S1].txt as well.

13 more replies
Relevance 41.41%

Greetings.A rogue.fakeAV and PUM.Hijack.StartMenu took over my laptop yesterday. I've isolated it in quarantine with Malwarebytes. There are 7 entries total: 4 files, 1 registry value and 2 registry data entries.I was searching for graphics when I got hit with this drive-by download. It shut down and locked me out of my apps, hid my program data files, app data files and all my shortcut links in the desktop/start menus. It used my own anti-virus software screen to try to get me to buy a "component" I "didn't have."Laptop is in safe mode currently. I'm on another computer as I type.I have kids; they constantly download junk and sometimes they get infected. I've dealt with this before; however, this particular is on my primary laptop and I need to proceed carefully. Unlike my children, I have data I can not lose without serious consequences. So here I am, seeking help.The virus executables do not produce google results like they normally do. So, has anyone heard of items:c:\programData\ZuTBB1WK8qdEiQ.exe c:\programData\HVQyGgmxOVolAC.exe c:\users\...\AppData\..\cqimjtkzynyzbmgl[1].exec:\users\...\AppData\...\NNyikPGrHVD4xG.exe.tmp?I know to prolly delete them.My main purpose here is to understand the registry entries these little buggers made on my laptop.I'm confident editing my registry. However, I'm not confident that these registry items are fake and can be d... Read more

Answer:? Working with Quarantined HKCU Registry Values, Data and Files

It looks like you had this virus - Smart HDDThe virus executables do not produce google results like they normally do. So, has anyone heard of items:c:\programData\ZuTBB1WK8qdEiQ.exe c:\programData\HVQyGgmxOVolAC.exe c:\users\...\AppData\..\cqimjtkzynyzbmgl[1].exec:\users\...\AppData\...\NNyikPGrHVD4xG.exe.tmpThose files look like the main virus files that installed the virus. So they need to be removed carefully.

2 more replies
Relevance 41%

We have a client that cannot make a global change to this setting due to performance issues. One system builds a dynamic web page at each visit and requires this setting to be set to Every visit to the page. Is there a way to have a global default but
also have a unique setting for an individual URL?

More replies
Relevance 41%

A coworker asked me to look at her laptop (Gateway Viper-SR,Vista Business SP 2) to fix a Citrix-related problem and I ran a full system scan in Safe Mode using MBAM 1.75.0.1300 for standard maintenance. It pulled up 2 entries in the Registry Values Detected section of the log:
 
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System | DisableRegEdit (HiJack.Regedit)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System | DisableRegEdit (HiJack.Regedit)
 
There were no other infections or problems detected elsewhere in the system. Her system is not slow or exhibiting any other issues that may indicate an active infection but I don't want to send the machine home until I am reasonably sure there is not a lurking rootkit,etc.
 
Is this just a false positive or a signal to do more extensive testing?

Answer:[Hijack.Regedit] flagged for registry keys DisableRegEdit (HKCU+HKLM)

I typically see this output from MBAM due to a GPO being in place. Do you know if your organization would have a "prevent registry editing tools" policy in place?

2 more replies
Relevance 41%

Greetings,

There is a big difference between the old and new for this registry key UserPreferencesMask located at HKCU\Control Panel\Desktop. On 32-bit Windows, this is a 32-bit value. On 64-bit Windows, this is a 64-bit value. Example: 9012038010000000 (or 90,12,03,80,10,00,00,00) with 8 pairs of 2 instead of 4 pairs of 2.

I've been Googling a lot trying to figure out how to determine what options are actually set by the above example. I found a resource at MSFN forums with a text file attachment, but I am unable to download it because I am unable to login or register an account due to an IP Driver/database error message that the forum produces, so I am not sure if this text file has what I am looking for.

You can find the Microsoft TechNet documentation for the 32-bit version of this registry key at http://technet.microsoft.com/en-us/library/cc957204.aspx. It is no use. From my research, such as at https://social.technet.microsoft.co.../thread/d95ce351-ef0c-415d-ac55-80553b74ce52/, the values for the 64-bit version of this registry key are totally and entirely different from the 32-bit version; the same values do not enable the same functions.

So, I'm kind of at a moot point. I don't know where to go or how to reverse engineer this 9012038010000000 value to know what it is applying and doing.

EDIT: Found it. See http://www.sevenforums.com/tutorials/1908-visual-effects-settings-change.html under OPTION TWO. And thanks to http://communities.vmware.com/thr... Read more

More replies
Relevance 41%

Some searching through google, "alternativeto", YouTube, for video and audio editing or recording software, FREEWARE, showed BandiCam, Screencast-o-matic, Audacity, and I've been aware of Windows Movie Maker.
 
 
I would like to be able to make audio adjustments and audio changes to a few screencast videos.  I do not really undestand Audacity; but tried learning it many years ago.  I am absolutely not confident nor comfortable with learning Movie Maker; I am not sure how to handle Bandicam, having tried it briefly many many months ago.  I am comfortable with and have used Screencast-o-matic, the free downloadable version, a few times, and it was fairly easy to learn and to use.  I would just like to learn and use something a little bit more clever than Screen-cast-o-matic, and to edit or make changes to some video recordings.  FREE/FREEWARE wanted.

Answer:Video editing or including audio editing or recording

Hey, cafejose! I have used Movie Maker before. It is not that difficult in fact. And for freewares, then you can see some recommendations of ShowMore. This is a newly-built website that I am very fond of and I get quite a lot help from its application. I always take it to record Skype calls but I think it can also solve your problem here. For more alternatives, I advice you to take these free recording tools introductions for your reference.

1 more replies
Relevance 37.72%

I have gone inTask Manager startup as suggested as a suggested solution in a posted forum but I cannot locate this registry key in my startup?  Can it be in a different location or under another name?
Also I have previously done some changes to my sound to optomize but have since lost sound but earphones work.  I have tried everything suggested and repeated solutions but nothing works...I am at my wits end!
Thank you in advance

More replies
Relevance 37.31%

Hello Everyone,

I am using ie11 on win7 in a Domain. Does anyone know of a complete list of the possible values the flags entry (see title) can have? The Internet describes it as a bitmask but according to


https://support.microsoft.com/en-us/kb/182569

the highest possible value should be 255. I have already seen higher values though (for example 323) and I am not the only one :
https://social.technet.microsoft.com/Forums/ie/en-US/782ec987-e8fa-44bd-b552-2c2f7ee40be3/trusted-sites-require-server-verification-https-for-all-sites-in-this-zone?forum=ieitprocurrentver

Thanks for your help!
HarryNew

More replies
Relevance 37.31%

Please accept my apologies in advance as a newbie if this issue has been discussed already at length on numerous occasions in this forum...

This question came upon me in the course of tracking down irritating IE Browser "Helper" Objects and SpyWare in general in my computer Registry -

Is any of the statistical tracking under the key "HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats" necessary to the operating system or browsing in general? That is to say, might I "safely" delete all of the entries without spending an eternity to check the legitimacy of each of the references underneath?

Of curiosity is a follow-up question, whether this is where a good deal of spying in general takes place (i.e. from "legitimate" software companies as well)?

Thanks in advance for your response(s).
 

Answer:Is "HKCU/SW/M$/Win/CV/Ext/Stats" Spying in General?

You can delete them if you want but I don't see the point. The key will just be recreated when you run the BHO again (when you open IE again for most of them).
 

1 more replies
Relevance 35.26%

Trojan infection was mitigated through the employment of sysinternals.  Source of trojan infection was a CHROME emergency update fake post.  Use of Sysinternals and W7 bootstick allowed for the removal of most of the infection.

Original infection keys and file removed
[HKEY_USERS\S-1-5-21-1232934697-1086943095-315576832-55753\Software\Classes\c31796]

[HKEY_USERS\S-1-5-21-1232934697-1086943095-315576832-55753\Software\Classes\c31796\shell]

[HKEY_USERS\S-1-5-21-1232934697-1086943095-315576832-55753\Software\Classes\c31796\shell\open]

[HKEY_USERS\S-1-5-21-1232934697-1086943095-315576832-55753\Software\Classes\c31796\shell\open\command]
@="\"C:\\Windows\\system32\\mshta.exe\" \"javascript:i9KIFxNK=\"S\";u5W9=new ActiveXObject(\"WScript.Shell\");xxFwDLW1=\"83lvZdZJ\";HdP0t=u5W9.RegRead(\"HKCU\\\\software\\\\ydwarldiy\\\\zujmvfhc\");wu5Uwrzh=\"Qd07LlR\";eval(HdP0t);gY6bZRg=\"aB8l\";\""
-----------------------------------------------------------------------
Persistent script error still occurs.  Have sourced it to the mshta.exe.  Image file is verified as microsoft Version 11.0.9600.16428.  Command line seems to be the culprit.  C:\Windows\System32\mshta.exe"
javascript:DPHB4C0="98sQmHed";v22t=new%20ActiveXObject("WScript.Shell");Dr1JH6E="zlYd";f58vmO=v22t.RegRead("HKCU\\software\\ydwarldiy\\zujmvfhc");... Read more

More replies
Relevance 35.26%

After downloading Avant, my computer got infected. Running the software below I got rid of most of it, but adwcleaner still show hkcu/software/appdatalow/software. And even though it says it deletes it, it's still there after restarting.
 
I'm attaching the adwcleaner and Rkill, I also ran ESET from IE, it found it and said it deleted it, but adwcleaner still shows it's there.
 
There was also an icon that said "homegroup" that showed up, but was taken off after restarting from using ESET.
 
# AdwCleaner v3.211 - Report created 25/05/2014 at 23:28:12
# Updated 26/05/2014 by Xplode
# Operating System : Windows 8.1  (64 bits)
# Username : Richard - RICK
# Running from : C:\Users\Richard\Desktop\adwcleaner_3.211.exe
# Option : Clean
***** [ Services ] *****
***** [ Files / Folders ] *****
***** [ Shortcuts ] *****
***** [ Registry ] *****
Key Deleted : HKCU\Software\AppDataLow\Software
***** [ Browsers ] *****
-\\ Internet Explorer v11.0.9600.17037
-\\ Mozilla Firefox v29.0.1 (en-US)
[ File : C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\sz8gk6ir.default\prefs.js ]
-\\ Google Chrome v35.0.1916.114
[ File : C:\Users\Richard\AppData\Local\Google\Chrome\User Data\Default\preferences ]
*************************
AdwCleaner[R0].txt - [1997 octets] - [23/04/2014 08:51:51]
AdwCleaner[R10].txt - [1720 octets] - [22/05/2014 22:16:52]
AdwCleaner[R11].txt - [1781 octets] - [23/05/2014 21:01:44]
AdwCleaner[R12].txt - [1842 octets] - [24/05/2014 20:29:52]
AdwCl... Read more

Answer:hkcu/software/appdatalow/software

Hello, Welcome to BleepingComputer.I'm nasdaq and will be helping you.If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed.===Key Found : HKCU\Software\AppDataLow\SoftwareThe developer is aware of this. The matter should be fixed with the next version.

3 more replies
Relevance 35.26%

I ran adwcleaner.exe that I downloaded from this site. Could anyone please take a look at the log and tell me if this is a false positive? (The registry key that is) I clicked the option to clean it. Once that was done, it restarted my computer and generated this log. However, when I ran adwcleaner again, the same registry key was still there.

Answer:HKCU\Software\AppDataLow\Software

Hello, Welcome to BleepingComputer.I'm nasdaq and will be helping you.The owner of the AdwCleaner tool is aware of this.It should be corrected in the next version.nasdaq

2 more replies
Relevance 35.26%

I am so agitated right now; none of my favorite Bleeping Computers tools are catching malware. Computer is acting up, I discovered  HKCU\Software\AppDataLow\Software I ran the following programs, RkillAdwcleanerTdssKillerJRTMbarRkillRogueKiller The only tool that found anything is Farbar, this program found far more than I expected, Even Ms Word is bad.. Can I simpky delete the registry  HKCU\Software\AppDataLow\Software, or no? Additional scan result of Farbar Recovery Scan Tool (x86) Version:06-06-2014Ran by User at 2014-06-07 14:51:10Running from C:\Documents and Settings\User\DesktopBoot Mode: Normal============================================================================== Security Center ========================AV: Microsoft Security Essentials (Disabled - Up to date) {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}==================== Installed Programs ======================Adobe Flash Player 13 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 13.0.0.214 - Adobe Systems Incorporated)Adobe Flash Player 13 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 13.0.0.214 - Adobe Systems Incorporated)Adobe Reader XI (11.0.07) (HKLM\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.07 - Adobe Systems Incorporated)CCleaner (HKLM\...\CCleaner) (Version: 3.07 - Piriform)HiJackThis (HKLM\...\{45A66726-69BC-466B-A7A4-12FCBA4883D7}) (Version: 1.0.0 - Trend Micro)HP Deskjet 1050 J410 series Basic Device Software (HKLM\...\{226837D8... Read more

Answer:HKCU\Software\AppDataLow\Software

Hello, Welcome to BleepingComputer.I'm nasdaq and will be helping you.If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed.===Get the latest AdwCleaner version. This key HKCU\Software\AppDataLow\Software is now fix.Please download AdwCleaner by Xplode onto your Desktop.Close all open programs and internet browsers.Double click on AdwCleaner.exe to run the tool.Click the Scan button and wait for the process to complete.Click the Report button and the report will open in Notepad.IMPORTANTIf you click the Clean button all items listed in the report will be removed.If you find some false positive items or programs that you wish to keep, Close the AdwCleaner windows.Close all open programs and internet browsers.Double click on AdwCleaner.exe to run the tool.Click the Scan button and wait for the process to complete.Check off the element(s) you wish to keep.Click on the Clean button follow the prompts.A log file will automatically open after the scan has finished.Please post the content of that log file with your next answer.You can find the log file at C:\AdwCleaner[Sn].txt (n is a number).===Download the correct version of this tool for your operating system.Farbar Recovery Scan Tool (64 bit)Farbar Recovery Scan Tool (32 bit)and save it to a folder on your computer's Desktop.Double-click to run it. When the tool opens click Yes to disclaimer.Press Scan button.It will make a log (FR... Read more

3 more replies
Relevance 34.85%

I do some light video editng for vimeo and social networking..looking for someone who has some experience
with video editing on xps 13 or 15 to get some info before buying..
Personally I will prefer 13" because I travel a lot and 15" only if editing on 13" is not possible..
I will really appreciate info from someone with experience on this matter..tnx

More replies
Relevance 28.7%
Question: Editing help

I've recently downloaded Audacity, however when I try to open an mp3 file it reads: "This is not a Win32 file"

Does anyone know how to change the file to allow me to edit it??

Any help appreciated. Thanks.

Answer:Editing help

Quote:





Originally Posted by ib14


I've recently downloaded Audacity, however when I try to open an mp3 file it reads: "This is not a Win32 file"

Does anyone know how to change the file to allow me to edit it??

Any help appreciated. Thanks.




Not sure if i understand what you are asking but have you checked this out.

1 more replies
Relevance 28.7%

Hello,

First post.

I have several PDFs I want to touch up. I need to:

-rotate pages slightly
-crop pages
-split pages (currently has pages side-by-side)

I do not mind paying for a app if it is worth it.

Thanks,

Jamie
 

Answer:Best app for PDF editing?

DomLuc,
Thank you for the suggestions.


I was hoping for advice from experienced parties. Which app can easily split a single (side-by-side pdf page of 2 scanned pages)?

Rotation is also needed - but not huge amounts. Most programs seem to have 90-degree presets, with no other options. I just need to rotate some pages @ 5 degrees.

Thanks ahead of time.

-Jamie
 

2 more replies
Relevance 28.7%

I've got a dv camcorder and would like to know what i need to capture and edit video . My pc uses W98se , 512 sdram,NV440MX 3d card and a big HDD . I'm not looking for a top of the range tool just a beginner to modreate weapon will do .Is it true that i need a firewire card as well .

Answer:DV editing - what all do i need .

You will need a firewire card and cable in order to get the video from your camcorder to the computer. If your camcorder has DV-in then look for software that can transfer the edited video back to the camcorder (Adobe Premiere does this).As for the software, I use Adobe Premiere but it is complex. Pinnacle do a good one (so I've heard).If you do a search for video editing in the helproom then you should find quite a few threads with software recommendations.Hope this helpsRegardsFitshase

4 more replies
Relevance 28.7%
Question: Editing from DVD

Hi

I have transferred footage from a camcorder to a dvd +rw via a philips dvd recorder. I would now like to edit the dvd on my pc and am currently using sonic my dvd but it will not allow me to import the footage from the dvd.

Is there a programme that will allow me to do this please?

Thanks
 

Answer:Editing from DVD

12 more replies
Relevance 28.7%

Hi I'm editing an avi file, basically cutting 3minutes from the end so that I can convert to VCD to put on CD for use in DVD player.

I'm struggling though!!! I'm trying to use Blaze Media Pro, however it takes hours to complete and only saves video (i.e NOT audio). Surely it is only a simple process of cutting then saving as a smaller file!!! The original file in question is 82.5 mins and I can discard 2.5 mins to make it fit.

Anyone help with this? It is becoming urgent as it's a Christmas present for my mother-in-law!!!!

Thanks

 

Answer:AVI editing - please help!!!

i got avi editing suite from torrentspy may be worth a look as urgent type avs into its search engine
 

2 more replies
Relevance 28.7%
Question: dvd editing

I want to extract a small segment from a existing DVD. Is there any free software download available (for 'dummies' please), or a decent priced one (i've heard good things about Dazzle - but there seem to be a few different ones and I don't see a big difference between them).
Any help would be greatly appreciated.
b
 

Answer:dvd editing

Welcome to MG's..

You should find what you need here.

http://www.majorgeeks.com/downloads32.html
 

1 more replies
Relevance 28.7%

I am trying to edit a movie on Windows Movie Maker. I am trying to copy from a dvd-r onto Movie maker but it comes up: The file D:\Video_TS|VTS_01_01.VOB is not a supported file type. and it cannot be imported into windows movie maker
How do I convert the file so that I can edit it on windows movie maker???

Cheers and thanks in advance to anyone who can help
Saul Marron
 

Answer:Dvd-r Editing HELP!!!

6 more replies
Relevance 28.7%

im sure some of you know that certain songs you download (legally of course) have annoying DJ's yelling all over the song. Is there a program out there that edits mp3's and could maybe detect the annoying yelling and edit it out? any help or opinions on what to do would be great. thank you!
 

Answer:editing mp3's.. help!

have annoying DJ's yelling all over the song.Click to expand...

But if you cut in many places through a song, I doubt that it would sound any better, with all the abrupt stops and starts that have no direct continuation between them
 

5 more replies
Relevance 28.7%
Question: PDF Editing

Hi everyone.
I'm looking for a good choice for editing PDFs. I've googled plenty but this subject seems to be a black hole of information on the internet.

I'm aware that .pdf is a format designed for publishing and output, and that it's not meant to be edited. However, designer's wishes never really stopped anyone. I'm guessing that most PDF editors are hacks, but some of them work quite well.

The best one I've found so far is Inkscape, which is perfect in almost every way except for the rather major flaw that it can only import or export one page of a PDF at a time.

Things I would mainly be looking to do with pdfs:

Rotating them
Extracting images
Correcting spelling mistakes
Copying text
Converting to .doc or similar for major edits

I can't seem to find one free editor that offers all of the above.
Windows preferred, although any platform will do as I have access to an imac and a debian box too.
 

Answer:PDF Editing

Here you go: Maybe these will work for you.

PDFescape

PDFedit
 

2 more replies
Relevance 28.7%
Question: Editing a .exe

How can I edit a .exe and make it require another file to run.

Even something as simple as checking for a .txt file in another folder in order to run?
 

Answer:Editing a .exe

For some reason I can't edit or deltee posts, anyways I have resource hacker, just need to know how I can make it look for a file and require it for it to be able to run.
 

2 more replies
Relevance 28.7%
Question: ID3 Tag editing

I'm looking for a program to edit the ID3 tags of mp3s easily. I have over 5000 songs so I can't do it by hand. The concept is simple, but I can't find a program to do this. I want to edit all the track tags in this form:

filename should be the track name
the folder it is in is the album
and the parent folder is the artist

is there any way to name them like this?
 

Answer:ID3 Tag editing

I've seen plenty of batch ID3 editing programs, but I don't think I've ever seen one that will draw tags from folder names, like you described... That would be a good programming project though

Someone else maybe, has seen such a thing?
 

7 more replies
Relevance 28.7%
Relevance 28.7%
Question: Editing

Is Pinnacle Studio Moviebox the best programme for editing video and camcording. If not which one is? Ken

Answer:Editing

Can't speak for the USB video transfer device, but I use Pinnacle Studio 8 video editing software, which comes bundled with the Studio Moviebox. (Transfer movies from my digital camcorder using firewire)Studio 8 is pretty good, and is intuitive to use without being patronising (can't think of a better word, but some other systems seem this way!). Is it the best? The only criticisms I have are the occasional need to reinstall to get it to work properly - dont know why this problem occurred, maybe nothing to do with Studio 8 - and I find creating bespoke DVD menus quite hard (although using the default ones supplied is easy)

3 more replies
Relevance 28.7%
Question: Editing a DVD

I need to edit a DVD... but I have no idea how, I have an editing program but It says that the DVD has a copyright on it, so it won't let me.
How can I uncopyright the DVD, or is there some other way.
 

Answer:Editing a DVD

if it has copyright on it, i doubt its meant to be edited. removing copyright in most circumstances is illegal so we cant help you. just out of curiosity what is the DVD you want to edit?
 

2 more replies
Relevance 28.7%

Hi all,

I have a car stereo that plays MP3 from CD, SD and USB, but the problem is that the player misses the beginning of each MP3 track.

So, is there a program to use that is capable of adding silence to the beginning of a track and that can handle multiple MP3 edits?

I have the program "Audacity" but I'm not sure if it can do batch edits.

Any help here would be much appreciated.

Moozer
 

Answer:Help with MP3 editing

First I would check to see if there's something wrong with the Mp3 files themselves. Get MP3 Diags and scan some of your files to see if they're damaged.

The program will also repair most types of damage.
 

1 more replies
Relevance 28.7%
Question: .mkv editing help

what is a program i can edit a .mkv file?

I have some videos that have japanese and english as a audio..plus english subtitles. but i want to delete the japanese audio.

reason why i want to do this is to see if that will help with the video skipping. unless theres something else i can do. When i play videos that have several languages in the file the video lags.

any program that will work on mac os x.
 

Answer:.mkv editing help

MKVToolnix
With MKVExtract you can extract the streams of an MKV file, as for example the subtitles.
 

2 more replies
Relevance 28.7%
Question: MP3 editing

Can anyone recommend software that cuts large mp3s (such as an audio book) into cd-sized segments?

Answer:MP3 editing

click hereRegards

2 more replies
Relevance 28.7%
Question: Editing a CD

I have already burned a playlist of 8 songs onto a CD. I have been trying now to burn only parts of each song onto another CD to be use as a soundtrack for a DVD of picutres and video I am creating. How does one burn/copy a part of a song? Please give specific directions and/or referral to a specific program or website where I can do this task. Thanks for the time and attention you have given this matter. I can use either Windows 2000 or Windows XP operating systems.
Jim Baillie
[email protected]
 

Answer:Editing a CD

Audacity will allow you to edit audio, and it should do the trick for you.
 

1 more replies
Relevance 28.7%
Question: Editing a .exe

How can I edit a .exe and make it require another file to run.

Even something as simple as checking for a .txt file in another folder in order to run?
 

Answer:Editing a .exe

For some reason I can't edit or delte posts, anyways I have resource hacker, just need to know how I can make it look for a fil and require it for it to be able to run.
 

2 more replies
Relevance 28.7%
Question: DVD Editing

I just returned from vacation with 5 small DVD-RW discs that I used to record my vacation.

What does [H] recommend as a dvd editing program?

- I need to take each of these small DVD's and put them all together onto one proper size DVD
- I want to be able to insert "closed captioning" for some scenes, and for others still frame pictures.
- I want to be able to make a sexy DVD menu, and organize my chapters different from the way I recorded it.
- I also have some video recorded from my regular camera. I want to import this other video, and it is in "Motion JPG" format.
 

More replies
Relevance 28.7%
Question: Editing DVD RW

Is there a way to edit a DVD plus RW?
 

Answer:Editing DVD RW

6 more replies
Relevance 28.7%

I have a Panasonic digital camera with a movie mode with sound. It records in .mov format. I can play the files using Quicktime, of course, but I need to be able to edit them.
Remember, I want freeware!
I've searched all over the net for a freeware video editor that will perform similar functions to Windows Movie Maker, but on .mov files, but I haven't had any luck.
I've also looked for a freeware program to convert .mov to .wmv files so I can simply use Movie Maker. But I haven't found anything that can convert .mov to .wmv with little or no loss in quality.

Is there anything out there that can do what I want in a free, convenient package?

P.S. I'd like to hear your thoughts on the one program I've found and actually considered: SUPER. I want to know how the quality of the conversion is, and how usable the interface is (one site that reviewed it said it was difficult to use).
 

Answer:.mov editing OR .mov to .wmv

13 more replies
Relevance 28.7%
Question: .mov editing

Does anyone know if there is a free .mov editing piece of software? The digital camera I use saves its movie files in QuickTime format, and I can't seem to edit them. How can I do so?

Answer:.mov editing

click here (and ignore my post!).

10 more replies
Relevance 28.7%
Question: DVD Editing

Hello peeps,

I have a question about files currently on a disc. The vob files. I want to make them MPEG, so the disc can play in a dvd player. I know you can change them if they were on a computer hd, but can they be changed if they are already on the disc?
 

Answer:DVD Editing

If it is DVD RW, then yes. If not- no. You'll probably have to copy the files to you computer, convert them appropriately, then put them onto a new disk.
 

2 more replies
Relevance 28.7%
Question: Editing PDF

I have a PDF file (read-only). I want to do some changes to the file. How do I do it ? I have installed free version of professional DVD writer thinking that I could edit that reader. But this didn't work out. The one I have downloaded installed as a virtual print driver. I guess this is basically to convert the documents into a PDF file. Now my question is what is the way for me to edit the existing PDF file. Can someone help ?
 

Answer:Editing PDF

If the PDF file is "read only" thats quite normal. Its designed to NOT be able to be edited.
If its "protected" as well to prevent diassembly (quite common) then you can not edit it usually, even with the software that exists for conversion. Some are created as an "image" which is also non-convertable.

If its not protected, you can copy and paste the text to Word, but formatting is lost usually.

You need the full Adobe Acrobat (not a printer or the free reader program) to allow editing of the PDF, or a similar program. I use a commercially available (not free) SolidPDF converter to convert PDF to Word, but it will only work for non-protected documents.

There may be free ones, but I never found one that worked for me.

But please be careful, if the document is a form or any other quasi-legal or contractual document, conversion, editing and reconverting will invalidate it in most cases. Thats why many documents are sent in PDF, so their integrity is assured.

I work with, and issue such documents.
If anyone ever edited and sent one back it would go straight in the trash.
If its a non-commercial issue, it should not be a problem, and I recommend SolidPDF Converter.
 

3 more replies
Relevance 28.7%
Question: Editing in IE7

With IE6 I could scroll to a toolbar for editing. I could edit a document with either Excel or Word. In IE7 in the File toolbar it allows me to edit with Excel only. How can I get an option to edit it with Word??Peter

Answer:Editing in IE7

Go to Tools, Internet Options, Programs, and click on the drop arrow to display the list of options for HTML editor.  If Word is listed, select it, click Apply and OK.

3 more replies