DAMAGED D/L PROGRAM FILE

[RIZZIES]

I am running vista home premium service pack 1. I just noticed that i have a damaged d/l program file . It is

http://platformdl.adobe.com/NOS/getPlusPlus/1. Does anyone know how to remove this. It wont remove in the normal method by ie or disc cleanup.

[exile360]

Greetings .

• Please copy and paste the following text exactly as written into notepad (not wordpad or any other text editor)
  

  @echo off
  
  dir "%systemroot%\Downloaded Program Files" /a h /a d /a s /b>"%userprofile%\desktop\Downloaded Program Files.txt"
  
  start /max notepad "%userprofile%\desktop\Downloaded Program Files.txt"

  Once you've done that click on File and select Save As...
  

• In the Save dialogue box click on the drop down menu next to Save as type and select All Files
  
• Name the file check.bat (the .bat extension is very important)
  
• Save the file to your desktop and double click it to run it.
  
• Once it finishes it will open the file it created in notepad, please copy and paste the file's contents into your next reply.
  

Thanks.

[RIZZIES]

Do I copy it with the word code and the ? ph or just the text inside the box?

[exile360]

Just the text inside the box .

[RIZZIES]

Exile, I did as you said. Thanks for helping me. I am now posting the results.

caScanner.ocx

catalog.dat

CONFLICT.1

desktop.ini

dwusplay.dll

dwusplay.exe

ecbootil.vxd

ecmsvr32.dll

erma.inf

HPISDataManager.dll

install.log

isusweb.dll

jinstall-6u10.inf

naveng32.dll

navex32a.dll

ppctl.dll

Scanner.inf

scrauth.dat

swdir.inf

symaveng.cat

symaveng.inf

tcdefs.dat

tcscan7.dat

tcscan8.dat

tcscan9.dat

tinf.dat

tinfidx.dat

tinfl.dat

tscan1.dat

tscan1hd.dat

unagiuninst.exe

v.grd

v.sig

virscan.inf

virscan1.dat

virscan2.dat

virscan3.dat

virscan4.dat

virscan5.dat

virscan6.dat

virscan7.dat

virscan8.dat

virscan9.dat

virscant.dat

zdone.dat

[exile360]

Ok, looks like the only components of it are in the Program Files directory, I just needed to be sure. Since it is a component of Adobe Reader then you should be able to uninstall Reader via Add\Remove Programs in the Control Panel then download and install the latest Adobe Reader from here (be sure to uncheck the option for the Google Toolbar if you don't wish to install it).

That should correct the issues with the plugin. Please post back and let me know how it goes.

[RIZZIES]

I believe this happened when I updated adobe flash last week. Even though I first uninstalled the flash player before d/l the new one.

[RIZZIES]

Can anyone access my system thru this file?

[exile360]

They shouldn't be able to, but if you think it came from flash (which it certainly may have) then you can use the Flash Uninstaller from here to remove it, then download and install the latest Flash Player from here to see if that gets it.

If not then we can pursue manual means of removing the files and registry entries using other tools. Just let me know how you'd like to proceed.

Thanks .

[RIZZIES]

I uninstalled the flash player then restarted the computer. I then reinstalled the flash player and restarted the computer. I am sorry to say the file is still there. Is there an easy way to remove it?

[exile360]

We should be able to simply delete the files after we disable it from running, then clean up the leftover reg entries. To start:

Please download Sysinternals Autoruns from here.

• Save Autoruns.exe to your desktop and double-click it to run it.
  
• Once it starts, please press the Esc key on your keyboard.
  
• Now that scanning is stopped, click on the Options button at the top of the program and select Verify Code Signatures
  
• Once that's done press the F5 key on your keyboard, this will start the scan again, this time let it finish.
  
• When it's finished, please click on the File button at the top of the program and select Save and save the Autoruns.arn file to your desktop.
  
• Now right-click on the Autoruns.arn file located on your desktop and highlight Sent To and select Compressed (zipped) Folder
  
• Please attach the Autoruns.zip file you just created to your next post.
  

I'll post back with instructions on anything that needs to be disabled using Autoruns and how to do it.

[RIZZIES]

SSorry I could not do this last night. My internet went out. I called my internet company and they said they were doing maintenanc.e When I ran autoruns, It asked to access the internet I allowed it. I am attaching the file. Thanks exile

AutoRuns.zip

AutoRuns.zip

[exile360]

That's alright, it happens . I reviewed your Autoruns file and it appears that the plugin isn't active so we should be able to delete the files, then (very cautiously) run a registry cleaner to remove any leftovers.

Please look for the following folder or folders on your computer and once found, try to delete it (let me know if you can't and we'll use a tool a bit more forceful ):

• C:\Program Files\NOS
• C:\NOS
  

Once that's done (or fails) post back and let me know and we'll move on to the next step.

[RIZZIES]

I deleted the nos program and program data file. I ran the windows live one care registry cleaner it removed an nos file from the registry. I restarted the computer. The damaged d/l program file is still there. Also, how do I remove the autoruns and the autoruns.arn and autoruns.zip? Do I just delete those files?

[exile360]

Did you try the registry cleaner in Ccleaner? That's the one I was thinking of using, however we can do this last part manually as there's less risk of problems, just be sure to read carefully:

• Close any open internet browsers and any open folders
  
• Click on Start and select Run
  
• In the Run box type regedit and press Enter or click OK
  
• Navigate to [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ and look for the following entry (let me know if it's not there):
  

  
  

• {E2883E8F-472F-4FB0-9522-AC9BF37916A7}

  
  

• If it's there, right click on it and select Delete, just make sure the name of it is identical to the text above, otherwise it's the wrong one
  

Once that's done, if it was found and you deleted it, reboot your PC and check IE again to see if it's still listed. Let me know how it goes, thanks .

edit: by the way, you can simply delete Autoruns and the files you created with it, including the .zip file.

[RIZZIES]

It is not listed there. however under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion there is a folder called fake default profile. There is nothing listed in it.

Under browser helpers there are three other files. I have never used cc cleaner.

I am searching the registry for the string . It did not find it. Under hkey current user the default value is not set. But under attachment path it says c\users\ronni\music\elvis. Would that show that something is wrong?

[exile360]

I am searching the registry for the string . It did not find it. Under hkey current user the default value is not set. But under attachment path it says c\users\ronni\music\elvis. Would that show that something is wrong?

Nope, that shouldn't be a problem . If you want to give Ccleaner a shot to see if it detects any leftovers we can do that, otherwise, since you deleted the files then the plugin isn't actually installed any more so it can't present any sort of threat.

[RIZZIES]

Exile,

Thanks for your help. I guess if it is not dangerous, I will just leave it alone now.

[exile360]

OK. Sounds like a plan. Nothing could use it or exploit it since the actual files aren't there any more. If you need anything else, just let us know .

[RIZZIES]

I just checked the d/l programs files thru disk cleanup again and it says this damaged file was last accessed 8/05/09. Could some one be hijacking my computer?

[exile360]

Nope, it's accessed every time Internet Explorer is opened. You should be OK.

[RIZZIES]

Malwarebytes found adaware.shopping.report on my computer yesterday. I posted it in the hijack log forum. ,where it tells you to post if you are infected.