Jump to content

DAMAGED D/L PROGRAM FILE


Recommended Posts

Greetings :) .

  • Please copy and paste the following text exactly as written into notepad (not wordpad or any other text editor)
    @echo off

    dir "%systemroot%\Downloaded Program Files" /a h /a d /a s /b>"%userprofile%\desktop\Downloaded Program Files.txt"

    start /max notepad "%userprofile%\desktop\Downloaded Program Files.txt"

    Once you've done that click on File and select Save As...

  • In the Save dialogue box click on the drop down menu next to Save as type and select All Files
  • Name the file check.bat (the .bat extension is very important)
  • Save the file to your desktop and double click it to run it.
  • Once it finishes it will open the file it created in notepad, please copy and paste the file's contents into your next reply.

Thanks.

Link to post
Share on other sites

Exile, I did as you said. Thanks for helping me. I am now posting the results.

caScanner.ocx

catalog.dat

CONFLICT.1

desktop.ini

dwusplay.dll

dwusplay.exe

ecbootil.vxd

ecmsvr32.dll

erma.inf

HPISDataManager.dll

install.log

isusweb.dll

jinstall-6u10.inf

naveng32.dll

navex32a.dll

ppctl.dll

Scanner.inf

scrauth.dat

swdir.inf

symaveng.cat

symaveng.inf

tcdefs.dat

tcscan7.dat

tcscan8.dat

tcscan9.dat

tinf.dat

tinfidx.dat

tinfl.dat

tscan1.dat

tscan1hd.dat

unagiuninst.exe

v.grd

v.sig

virscan.inf

virscan1.dat

virscan2.dat

virscan3.dat

virscan4.dat

virscan5.dat

virscan6.dat

virscan7.dat

virscan8.dat

virscan9.dat

virscant.dat

zdone.dat

Link to post
Share on other sites

Ok, looks like the only components of it are in the Program Files directory, I just needed to be sure. Since it is a component of Adobe Reader then you should be able to uninstall Reader via Add\Remove Programs in the Control Panel then download and install the latest Adobe Reader from here (be sure to uncheck the option for the Google Toolbar if you don't wish to install it).

That should correct the issues with the plugin. Please post back and let me know how it goes.

Link to post
Share on other sites

They shouldn't be able to, but if you think it came from flash (which it certainly may have) then you can use the Flash Uninstaller from here to remove it, then download and install the latest Flash Player from here to see if that gets it.

If not then we can pursue manual means of removing the files and registry entries using other tools. Just let me know how you'd like to proceed.

Thanks :) .

Link to post
Share on other sites

We should be able to simply delete the files after we disable it from running, then clean up the leftover reg entries. To start:

Please download Sysinternals Autoruns from here.

  • Save Autoruns.exe to your desktop and double-click it to run it.
  • Once it starts, please press the Esc key on your keyboard.
  • Now that scanning is stopped, click on the Options button at the top of the program and select Verify Code Signatures
  • Once that's done press the F5 key on your keyboard, this will start the scan again, this time let it finish.
  • When it's finished, please click on the File button at the top of the program and select Save and save the Autoruns.arn file to your desktop.
  • Now right-click on the Autoruns.arn file located on your desktop and highlight Sent To and select Compressed (zipped) Folder
  • Please attach the Autoruns.zip file you just created to your next post.

I'll post back with instructions on anything that needs to be disabled using Autoruns and how to do it.

Link to post
Share on other sites

That's alright, it happens ;) . I reviewed your Autoruns file and it appears that the plugin isn't active so we should be able to delete the files, then (very cautiously) run a registry cleaner to remove any leftovers.

Please look for the following folder or folders on your computer and once found, try to delete it (let me know if you can't and we'll use a tool a bit more forceful :) ):

  • C:\Program Files\NOS
  • C:\NOS

Once that's done (or fails) post back and let me know and we'll move on to the next step.

Link to post
Share on other sites

I deleted the nos program and program data file. I ran the windows live one care registry cleaner it removed an nos file from the registry. I restarted the computer. The damaged d/l program file is still there. Also, how do I remove the autoruns and the autoruns.arn and autoruns.zip? Do I just delete those files?

Link to post
Share on other sites

Did you try the registry cleaner in Ccleaner? That's the one I was thinking of using, however we can do this last part manually as there's less risk of problems, just be sure to read carefully:

  • Close any open internet browsers and any open folders
  • Click on Start and select Run
  • In the Run box type regedit and press Enter or click OK
  • Navigate to [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ and look for the following entry (let me know if it's not there):


  • {E2883E8F-472F-4FB0-9522-AC9BF37916A7}


  • If it's there, right click on it and select Delete, just make sure the name of it is identical to the text above, otherwise it's the wrong one

Once that's done, if it was found and you deleted it, reboot your PC and check IE again to see if it's still listed. Let me know how it goes, thanks ;) .

edit: by the way, you can simply delete Autoruns and the files you created with it, including the .zip file.

Link to post
Share on other sites

It is not listed there. however under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion there is a folder called fake default profile. There is nothing listed in it.

Under browser helpers there are three other files. I have never used cc cleaner.

I am searching the registry for the string . It did not find it. Under hkey current user the default value is not set. But under attachment path it says c\users\ronni\music\elvis. Would that show that something is wrong?

Link to post
Share on other sites

I am searching the registry for the string . It did not find it. Under hkey current user the default value is not set. But under attachment path it says c\users\ronni\music\elvis. Would that show that something is wrong?
Nope, that shouldn't be a problem ;) . If you want to give Ccleaner a shot to see if it detects any leftovers we can do that, otherwise, since you deleted the files then the plugin isn't actually installed any more so it can't present any sort of threat.
Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.