Remove pest, help please

[marquitico]

I am trying to help a friend clean up his computer, which is running Windows XP Pro. I am not very familiar with XP at all, and I do not understand the Windows registry except in a superficial fashion.

The pest in question is SearchSquire. The files seem already to have been removed (he has MacAfee and SpyBot), but there are registry entries that still point to them. The registry entries are in:

MyComputer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage

and in:

MyComputer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs

The values specify the complete path to these files, which all resided in \Windows\System32 until whatever utility it was deleted them.

Finally to my question.

Since these entries are now effectively orphaned, is it safe simply to delete them? Or is it necessary still to do some other task first? Or should I be using some registry cleanup software utility to do it all for me?

Thank you in advance for your thoughts and advice.

Mark
"marquitico"

 

[linney]

You should just delete the key or value for SearchSquire's own files that you can clearly identify, because if any files are used by other programs they may be a bit risky to delete, so perhaps you should just rely on the cleaning ability of your security tools to have removed everything necessary and leave it at that.

In any case it is always good practice to use the Export function via the File Menu and highlighting, or by right-clicking, the registry key in question and backing up before any deletion.

You then have the ability to Import the key back into the registry should you make an error in deletion.

 

[marquitico]

Excellent advice, thank you. I have juct backed the entire registry up, so I can merge it all back in case of a big kablooie.

As you wrote it would be risky to delete the whole registry tree. I will restrict my editing to the specific values in question. I just wondered whether or not it was indeed harmless to rub out an orphaned registry value by hand.

Thanks again.

Mark
"marquitico"