removing spyware from registry.

[69x]

Okay, Like many of you I've become familiar with spyware remove because I had to remove that crap. I've used Hijackthis and that by and large fixed my remaining problems. What's left is a pop up message everything I boot up that's harmless. But, I know want to get rid of it. The pop up is a RUNDLL error that says:

"Error loading c:\winnt\system32\stlbupdt.exe The specified module cannot be found."

Does anyone know how to remedy this? I'm not sure where in the registry to fix this. If you think a hijackthis log will help, I'll post it.

 

[2ffat]

You can use regedt32. Once you open the program, go to View, make sure Tree and Data is checked, then click on Find Key. Enter stlbupdt.exe and off you go.

I suspect that you will find it in software/run but it may be hiding anywhere.

Note I suggest regedt32 instead of regedit. This only work in W2k and XP. These OS' have multivalue keys that the old regedit won't work with.

James P. Cottingham
[sup]
There's no place like 127.0.0.1.
There's no place like 127.0.0.1.
[/sup]

 

[Xemus]

Check these areas specifically if the program is (was) running at startup:
HKLM/Software/Microsoft/Windows/Current Version/run
HKCU/Software/Microsoft/Windows/Current Version/run

http://www.closedsocket.com

 

[69x]

I have tried using James' suggestion looking for the dll with regedit32, but come up with nothing. I can't believe I am doing something wrong.

Next, I will try the suggestion from Xemus. I'll post the results.

 

[angoid]

I use the freeware Spybot Search and Destroy, coupled with the free AdAware to zap spyware and the like.

Spybot Search and destroy can be downloaded from here:

http://www.safer-networking.org/index.php?page=spybotsd

Ad-Aware can be downloaded from here:

http://download.com.com/3000-2094-10045910.html?legacy=cnet

Update both products before scanning your system with them, and have them fix anything and everything indicated as requring fixing. Afterwards, reboot your system.

Note that Spybot Search and Destroy detects AdAware, but they co-exist quite happily together. In fact, they form quite a powerful combination.

If this does not resolve your problem, post a full HijackThis log (current release is 1.97.7) and we'll see if there's anything that has escaped your notice.

 

[2ffat]

If it is not in the registry, it might be in one of the startup ini files. Which OS are you using? If XP, you can use msconfig to see what starts up and what's in the startup ini files.

James P. Cottingham
[sup]
There's no place like 127.0.0.1.
There's no place like 127.0.0.1.
[/sup]

 

[69x]

I'm at work and haven't had a chance to work it since my last reply. James, I am using W2K. What do I use to check my startup ini files? Boot.ini? Thanks for your help.

 

[johnwm]

msconfig - get to it from the Run command on the Start menu

________________________________________________________________
If you want to get the best response to a question, please check out FAQ222-2244 first

'If we're supposed to work in Hex, why have we only got A fingers?'

 

[xbafge]

johnwm: didn't work for me.

 

[johnwm]

The ini files you need are normally in C:\ and C:\WINNT in a default installation. You can open them with Notepad

________________________________________________________________
If you want to get the best response to a question, please check out FAQ222-2244 first

'If we're supposed to work in Hex, why have we only got A fingers?'

 

[xbafge]

Okay. But if MSConfig is like a Windows utility that used to open config.sys, autoexec.bat, win.ini etc. in one stroke, it would be quite convenient.

 

[jrbarnett]

xbafge
MSConfig only exists in Windows 98, Me and XP. If you run Windows 2000 or NT, get the freeware Startup control panel from

http://www.mlin.net

instead, it works great.

John

 

[xbafge]

jrbarnett: I checked it out and it looks nice but what johnwm seems to be talking about is some kind of .ini file editor?

 

[johnwm]

xbafge,

Just to clarify, you were asking about checking your ini files. They are just plain text files and so can be read (and edited if required) with Notepad.

msconfig (sorry not available in W2K) allows you to edit ini files and also do limited reg editing. AFAIK the prog that jrbarnett is talking about deals with the reg side of things, and Notepad will cover the ini files.

________________________________________________________________
If you want to get the best response to a question, please check out FAQ222-2244 first

'If we're supposed to work in Hex, why have we only got A fingers?'

 

[xbafge]

Right. Thanks for allowing the interjection, 69x.

 

[carrr]

msconfig runs perfectly well in Windows 2000...I'll never understand why it was left out.
You can download OS specific versions here:

http://www.perfectdrivers.com/howto/msconfig.html

"'Tis an ill wind that blows no minds." - Malaclypse the Younger

 

[2ffat]

MSCONFIG and et. al. for NT and W2K came on the Resource CD. An extra paid option for the OS.

James P. Cottingham
[sup]
There's no place like 127.0.0.1.
There's no place like 127.0.0.1.
[/sup]

 

[carrr]

I $ee.

"'Tis an ill wind that blows no minds." - Malaclypse the Younger