the alfmeister

a figment of reality's imagination

And while we’re on software…


>I got hit with what I thought at the time was a virus, or exception of some sort – it stopped me accessing any files, apps, even music, email and piccies…but what popped up was an MS product that cleaned it, but not removed it. In short, I had no choice at the time but pay the subscription for removal. Well fuck me if tonight while looking for another video downloader (for music and such for this blog, not porn!) the exact same thing happened again. After three hours of near on screaming, I managed to sneak round the product, MS Removal Tool I got a search via Google (my friend) to find out what I was dealing with, and how to fix it, and here goes, should you come across it

MS Removal Tool removal instructions using HijackThis or Process Explorer (in Normal mode):
1. Download iexplore.exe (NOTE: iexplore.exe file is renamed HijackThis tool from TrendMicro).
Launch the iexplore.exe and click “Do a system scan only” button.
If you can’t open iexplore.exe file then download explorer.scr and run it.

2. Search for such entry in the scan results:

Windows XP/2000:
O4 – HKCU\..\RunOnce: [fHrPqDaZcCg02547] C:\Documents and Settings\All Users\Application Data\fHrPqDaZcCg02547\fHrPqDaZcCg02547.exe

Windows Vista/7:
O4 – HKCU\..\RunOnce: [fHrPqDaZcCg02547] C:\ProgramData\fHrPqDaZcCg02547\fHrPqDaZcCg02547.exe

The process name will be different in your case [SET OF RANDOM CHARACTERS].exe, located in:
C:\Documents and Settings\All Users\Application Data\ in Windows XP and C:\ProgramData\ in Windows Vista/7. Select all similar entries and click once on the “Fix checked” button. Close HijackThis tool.

OR you may download Process Explorerand end MS Removal Tool process:

  • [SET OF RANDOM CHARACTERS].exe, i.e. fHrPqDaZcCg02547.exe

Now, this appears to have done it for me…stay posted.

Advertisements

Single Post Navigation

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: