Registry Issues

[jpl458]

Hope this is the correct forum for this. If not, point me to the proper place.

Short version - Had a Trojan, which was difficult to remove but cleaned it out with Search and Destroy. Now I have registry problems, but don't trust sites on the web. Looking for a recomendation for a good registry fixer. Got a lot of help at Tek Tips so I trust what I read here.

Thanks in advance

jpl

 

[goombawaho]

Use CCleaner and run the temp file remover first, then run the registry cleaner. When asked if you want to make a backup before changes are made - DO IT.

Keep running the cleaner until it comes back with no errors (or the same ones) to fix.

REBOOT

Maybe do an SFC /SCANNOW just to be sure no system files were molested.

Also, I'd download and run MalwareByte's Anti-Malware and run that (FULL SCAN) to see if everything is removed. I trust it a LOT more than Spybot

 

[jpl458]

I just tried to download CClener and had a problem. There are multiple locations to get it, but one also has a thing called Registry Mechanic, which I passed on. At another location I started the download for CCleaner but it said it was downloading AAVSregistry cleaner, so i stopped the transmission.

What is the right site?

thanks

jpl

 

[cmeagan656]

I always get this type of download from download.com. Here is the link for CCleaner.

Hope this helps.

Please help us help you. Read Tek-Tips posting polices before posting.

Canadian members check out Tek-Tips in Canada for socializing, networking, and anything non-technical.

 

[linney]

I don't use Registry Cleaners myself, if things are that bad, then a clean install, or restore a backup from an Image, are my chosen route.

This has always had a good reputation, but it is no longer free, but has been around since Windows 98,

jv16 PowerTools 2009

http://www.macecraft.com/jv16powertools2009/

There is another link to CCleaner at the end of this thread.

Safely Delete the Temporary Internet Files

http://www.mvps.org/winhelp2002/delcache.htm

If your playing with the Registry, this program is worth having, and it is free.

Registry Backup and Restore for Windows NT/2000/2003/XP/Vista

http://www.larshederer.homepage.t-online.de/erunt/

 

[goombawaho]

Linney - never had a problem with a registry cleaner yet (knock on wood). Don't be a afraid if you back up your changes first.

 

[jpl458]

I ran CCleaner, SFC /SCANNOW nad got The antimalware, Antimalware found a bundle of stuff whch it repaired. The pc runs faser now but i am left with two issues left from the Trojan incident:

1. I can't restart or turnoff the pc from the screen, I have to use the power button. Is the setting i should look at?

2. After I reboot I get a message from Windows stating that:
Windows cannot locate Logon.exe, make sure you spelled it correctly, and do a serach.

search finds nothing, and i think it's a remnant of the Trojan.

Thanbks for all your help

 

[linney]

Some general things to try.



Try Safe Mode (Do you have this problem in Safe Mode?).

310353 - How to Perform a Clean Boot in Windows XP

http://support.microsoft.com/default.aspx?scid=kb;en-us;310353&FR=1&PA=1&SD=HSCH

316434 - HOW TO: Perform Advanced Clean-Boot Troubleshooting in Windows XP

http://support.microsoft.com/default.aspx?scid=kb;en-us;316434&FR=1&PA=1&SD=HSCH

310560 - How to Troubleshoot By Using the Msconfig Utility in Windows XP

http://support.microsoft.com/kb/310560

Try running ChkDsk to check your drive for errors. Right-click your Drive icon/ Properties/ Tools/ Error Checking. Select both boxes.


If they don't work you could try repairing windows by running it over itself. You will lose all your windows updates but your files will be untouched.

How to Perform an In-Place Upgrade (Reinstallation) of Windows XP (Q315341)

http://support.microsoft.com/kb/315341/en-us

 

[jpl458]

The culprit was Mcafee. I disabled it and I was able to do normal turn off and restart. Mcafee never detected or found the Trojan, which begs the question, are those virus protection packages worth it? I heard pros and cons.

I will read the boot stuff that was forwarded by linney.

I will say that the old hoss is running pretty good, so thanks a ton to all.

jpl

 

[goombawaho]

I've seen every brand of anti-virus with up to date definitions have malware get installed on them. Not sure what to make of that in terms of the value of these products except this: be careful where you go and what you click OK to while browsing.

If in doubt about something - Control Alt Delete and kill your browser off.

I think there are four factors related to getting infected:
1. Windows Updates - behind or up to date
2. Anti-virus - installed/updated or not
3. User behavior - download or agree to anything that comes along vs. visiting fewer trusted sites and being cautious.
4. Browser - IE is innately more dangerous that Firefox and others due to vulnerabilities and hackers focusing on it.

 

[G0AOZ]

The file LOGON.EXE is not a Windows file. It is reputed to be some sort of adware file, and the message you're getting suggests that the file itself has been eliminated but that you're left with entries in the Registry relating to it.

I suggest backing up the Registry and then doing a search through it for "LOGON.EXE", and if found delete those entries.

ROGER - G0AOZ.